Interactive Proofs for Quantum Computations

TL;DR

This paper introduces Quantum Prover Interactive Proofs (QPIP), enabling a classical verifier with limited quantum capabilities to verify quantum computations, addressing foundational and cryptographic questions in quantum computing.

Contribution

It formalizes QPIP, proving that all BQP problems have such proofs with computation hiding, and provides two protocols based on quantum authentication schemes.

Findings

QPIP can verify BQP computations with limited quantum resources

Two protocols are proposed: one using Clifford rotations, another using polynomial codes

The work lays groundwork for verifiable quantum computing and highlights open challenges

Abstract

The widely held belief that BQP strictly contains BPP raises fundamental questions: if we cannot efficiently compute predictions for the behavior of quantum systems, how can we test their behavior? In other words, is quantum mechanics falsifiable? In cryptographic settings, how can a customer of a future untrusted quantum computing company be convinced of the correctness of its quantum computations? To provide answers to these questions, we define Quantum Prover Interactive Proofs (QPIP). Whereas in standard interactive proofs the prover is computationally unbounded, here our prover is in BQP, representing a quantum computer. The verifier models our current computational capabilities: it is a BPP machine, with access to only a few qubits. Our main theorem states, roughly: 'Any language in BQP has a QPIP, which also hides the computation from the prover'. We provide two proofs, one based on a quantum authentication scheme (QAS) relying on random Clifford rotations and the other based on a QAS which uses polynomial codes (BOCG+ 06), combined with secure multiparty computation methods. This is the journal version of work reported in 2008 (ABOE08) and presented in ICS 2010; here we have completed the details and made the proofs rigorous. Some of the proofs required major modifications and corrections. Notably, the claim that the polynomial QPIP is fault tolerant was removed. Similar results (with different protocols) were reported independently around the same time of the original version in BFK08. The initial independent works (ABOE08, BFK08) ignited a long line of research of blind verifiable quantum computation, which we survey here, along with connections to various cryptographic problems. Importantly, the problems of making the results fault tolerant as well as removing the need for quantum communication altogether remain open.

Equations

$$\text{mbox}{Q-CIRCUIT}_{\text{YES}}$$

$$\text{mbox}{Q-CIRCUIT}_{\text{NO}}$$

$$A_k(|\psi ⟩{|0⟩}^{\otimes e})$$

$$B_k{A}_k(|\psi ⟩⟨\psi |\otimes |0⟩{⟨0|}^{\otimes e})A_k^{†}{B}_k^{†}=|\psi ⟩⟨\psi |\otimes |0⟩{⟨0|}^{\otimes e}$$

$${\Pi }_1^{|\psi ⟩}$$

$${\Pi }_0^{|\psi ⟩}$$

$${\rho }_B=\frac{1}{|\mathcal{K}|}\sum _k{B}_k(\mathcal{O}(A_k(|\psi ⟩⟨\psi |\otimes |0⟩{⟨0|}^{\otimes e})A_k^{†}))B_k^{†}$$

$$\text{mbox}Tr({\Pi }_1^{|\psi ⟩}{\rho }_B)\ge 1-ϵ$$

$$X|a⟩$$

$$Z|a⟩$$

$$Y$$

$$F|a⟩$$

$$F_r|a⟩$$

$$SUM|a⟩|b⟩$$

$$T|a⟩|b⟩|c⟩\stackrel{\mathrm{def}}{=}|a⟩|b⟩|c+ab⟩$$

$$M_r|a⟩\stackrel{\mathrm{def}}{=}|ra⟩$$

$$CPG|a⟩|b⟩={\omega }_q^{ab}|a⟩|b⟩$$

$$\frac{1}{q}\sum _{a,b\in F_q}|a,b,ab⟩$$

$$\frac{1}{q}\sum _{a,b\in F_q}|a,b,ab,c,d,e⟩$$

$$\frac{1}{q}\sum _{a,b\in F_q}|a,b,ab⟩⟶\frac{1}{\sqrt{q^3}}\sum _{a,b,l\in F_q}{\omega }^{-le}|a,b,ab+e,c-a,d-b,l⟩$$

$${\omega }^{-ze}|c-x,d-y,(c-x)(d-y)+e⟩$$

$$C_{x,y,z}\stackrel{\mathrm{def}}{=}T(X^x\otimes X^y\otimes Z^z)T^{†}=(X^x{Z}^{-yz}\otimes X^y{Z}^{-xz}\otimes X^{xy}{Z}^z)SU{M}_{1,3}^{y}SU{M}_{2,3}^{x}CP{G}_{1,2}^{-z}$$

$$|c,d,e+cd⟩$$

$$\text{SUM}(Z^{z_A}{X}^{x_A}\otimes Z^{z_B}{X}^{x_B}){\text{SUM}}^{†}$$

$$F_r{Z}^z{X}^x{F}_r^{†}=X^{-r^{-1}z}{Z}^{rx}$$

$$M_r{Z}^z{X}^x{M}_r^{†}=Z^{r^{-1}z}{X}^{rx}$$

$$|S_a⟩\stackrel{\mathrm{def}}{=}\frac{1}{\sqrt{q^d}}\sum _{f:def(f)\le d,f(0)=a}|f({\alpha }_1),\dots ,f({\alpha }_m)⟩$$

$$|S_a^k⟩\stackrel{\mathrm{def}}{=}\frac{1}{\sqrt{q^d}}\sum _{f:deg(f)\le d,f(0)=a}|k_1\cdot f({\alpha }_1)\dots k_m\cdot f({\alpha }_m)⟩$$

$$E_k|a⟩{|0⟩}^{\otimes m-1}=|S_a^k⟩$$

$${\rho }^k\stackrel{\mathrm{def}}{=}{E}_k(\rho \otimes |0⟩{⟨0|}^{\otimes m-1})E_k^{†}$$

$${\tilde{X}}_k^x|S_a^k⟩\stackrel{\mathrm{def}}{=}(X^{k_{1}x}\otimes \cdots \otimes X^{k_{m}x})|S_a^k⟩=|S_{a+x}^k⟩$$

$$\widetilde{\text{SUM}}|S_a^k⟩|S_b^k⟩\stackrel{\mathrm{def}}{=}(SUM{)}^{\otimes m}|S_a^k⟩|S_b^k⟩=|S_a^k⟩|S_{a+b}^k⟩$$

Full text

To provide answers to these questions, we define Quantum Prover Interactive Proofs (QPIP). Whereas in standard interactive proofs [GMR85] the prover is computationally unbounded, here our prover is in BQP, representing a quantum computer. The verifier models our current computational capabilities: it is a BPP machine, with access to only a few qubits. Our main theorem can be roughly stated as: “Any language in BQP has a QPIP which hides the computation from the prover”. We provide two proofs. The simpler one uses a new (possibly of independent interest) quantum authentication scheme (QAS) based on random Clifford elements. This QPIP, however, involves two way quantum communication for polynomially many rounds. Our second protocol uses polynomial codes QAS due to Ben-Or, Crépeau, Gottesman, Hassidim, and Smith [BOCG*+*06], combined with secure multiparty quantum computation techniques. This protocol involves quantum communication from the verifier to the prover at the start of the protocol, and classical communication throughout the rest of the protocol. Both protocols are inherently “blind”: both the quantum circuit and the input remain unknown to the prover.

This is the journal version of work reported in 2008 ([ABOE08]) and presented in ICS 2010. The protocols are slightly modified from the original version, whereas some of the proofs required major modifications and corrections. Notably, the claim that the polynomial QPIP is fault tolerant was removed.

After deriving the results in [ABOE08], we learnt that Broadbent, Fitzsimons, and Kashefi [BFK08] have independently suggested “universal blind quantum computation” using completely different methods (measurement based quantum computation). Their construction implicitly implies similar implications. The protocol in [BFK08] was flawed but based on similar ideas, Fitzsimons and Kashefi have provided a protocol and proof of blind verifiable computation in [FK12]. The initial independent works ([ABOE08],[BFK08]) ignited a long line of research of blind and verifiable quantum computation, which we survey here, along with connections to various cryptographic problems. Importantly, the problems of making the results fault tolerant, as well as removing the need for quantum communication altogether, remain open.

1 Introduction

1.1 Motivation

As far as we know today, the quantum mechanical description of many-particle systems requires exponential resources to simulate. This has the following fundamental implication: the results of an experiment conducted on a many-particle physical system described by quantum mechanics cannot be predicted (in general) by classical computational devices in any reasonable amount of time. This important realization (or belief), which stands at the heart of the interest in quantum computation, led Gottesman [Got04] to ask: Can a classical verifier verify the correctness of quantum evolutions? The question was phrased by Vazirani [Vaz07] as: Is quantum mechanics a falsifiable physical theory? Assuming that small quantum systems obey quantum mechanics to an extremely high accuracy, it is still possible that the physical description of large systems deviates significantly from quantum mechanics. Since there is no efficient way to make the predictions of the experimental outcomes for most large quantum systems, there is no way to test or falsify this possibility experimentally, using the usual scientific paradigm of predict and compare.

 

This question has practical implications. Experimentalists who attempt to realize quantum computers would like to know how to test that their systems indeed perform the way they should. But most tests cannot be compared to any predictions! The tests whose predictions can in fact be computed do not actually test the more interesting aspects of quantum mechanics, namely those which cannot be simulated efficiently classically.

 

The problem arises in cryptographic situations as well. It is natural to expect that the first generations of quantum computers will be extremely expensive, and thus quantum computations would be delegated to untrusted companies. Is there any way for the customer to trust the outcome, without the need to trust the company which performed the computation, even though the customer cannot verify the outcome of the computation (since he cannot simulate it)? And even if the company is honest, can the customer detect innocent errors in such a computation? Given the amounts of grant money and prestige involved, the possibility of dishonesty of experimentalists and experimentalists’ bias inside the academia should not be ignored either [Roo03, Wik08].

 

As Vazirani points out [Vaz07], an answer to these questions is already given in the form of Shor’s factoring algorithm [Sho97]. Indeed, quantum mechanics does not seem to be falsifiable using the usual scientific paradigm, assuming that BQP is strictly lager than BPP. However, Shor’s algorithm does provide a way for falsification, by means of an experiment which lies outside of the usual scientific paradigm: though its result cannot be predicted and then compared to the experimental outcome, it can be verified once the outcome of the experiment is known (by simply taking the product of the factors and checking that this gives the input integer).

 

This, however, does not fully address the issues raised above. Consider, for example, a company called Q-Wave which is trying to convince a customer that it has managed to build a quantum computer of 100 qubits. Such a system is already too big to simulate classically. However, any factoring algorithm that is run on a system of a $100$ qubits can be easily performed by today’s classical technology. For delegated quantum computations, how can Shor’s algorithm help in convincing a customer of correctness of, say, the computation of the BQP complete problem of approximating the Jones polynomial [AJL06, AA06, FKLW01, BFLW09]? As for experimental results, it is difficult to rigorously state which aspects of quantum mechanics are exactly falsified or verified by the possibility to apply Shor’s algorithm. Moreover, we are now facing a time in which small quantum computers of a few tens of qubits may very well be realizable; yet, factoring is still impossible in such systems, and we would nevertheless like to be able to test their evolution.

 

We thus pose the following main question: Can one be convinced of the correctness of the computation of any polynomial quantum circuit? Alternatively, can one be convinced of the “correctness” of the quantum mechanical description of any quantum experiment that can be conducted in the laboratory, even though one cannot compute the predictions for the outcomes of this experiment? In this paper, we address the above fundamental question in a rigorous way and provide a positive answer to these questions, in a well defined framework. We do this by taking a computational point of view on the interaction between the supposed quantum computer, and the entity which attempts to verify that the quantum computer indeed computes what it should.

1.2 Quantum Prover Interactive Proofs (QPIP)

Interactive proof systems, defined by Goldwasser, Micali and Rackoff [GMR85], play a crucial role in the theory of computer science. Roughly, a language $\mathcal{L}$ is said to have an interactive proof if there exists a computationally unbounded prover (denoted $\mathds{P}$) and a BPP verifier ($\mathds{V}$) such that for any instance $x$ in $\mathcal{L}$, $\mathds{P}$ convinces $\mathds{V}$ of the fact that $x\in\mathcal{L}$ with probability $\geq\frac{2}{3}$ (completeness). Otherwise, when $x\notin\mathcal{L}$, there does not exist a prover who can convince $\mathds{V}$ that $x\in\mathcal{L}$ with probability higher than $\frac{1}{3}$ (soundness).

 

Quantum interactive proofs in which the prover is an unbounded quantum computer, and the verifier is a BQP machine have previously been studied in [Wat03]. The starting point of this work is the observation that Shor’s factoring algorithm [Sho97] can be viewed as an interactive proof of a very different kind: one between a classical BPP verifier, and a quantum polynomial time (BQP) prover, in which the prover convinces the verifier of the factors of a given number (this can be easily converted to the usual IP formalism of membership in a language by converting the search problem to a decision problem in the standard way).

 

One might suspect that such an interactive proof exists for all problems inside BQP $\cap$ NP  by asking the BQP prover to find the witness, which the classical verifier can then verify. We do not know this to be true; the trouble with this argument is that the fact that the problem is in BQP $\cap$ NP does not guarantee that the BQP machine can also find a witness efficiently - decision to search reductions are known only for NP-complete problems. In any case, it is widely believed that BQP is not contained in NP ( and in fact not even in the polynomial hierarchy - see [Aar09] and references therein). The main goal of this paper is to generalize the interactive point of view of Shor’s algorithm, as mentioned above, in order to show that a BPP verifier can be convinced of the result of any polynomial quantum circuit, using interaction with the BQP prover (the quantum computer). In other words, we would like to extend the above interactive proof (which is specific to factoring) to a BQP complete problem.

 

To this end we define a new model of quantum interactive proofs which we call quantum prover interactive proofs (QPIP). The simplest definition would be an interactive proof in which the prover is a BQP machine and the verifier a BPP classical machine. In some sense, this model captures the possible interaction between the quantum world (for instance, quantum systems in the lab) and the classical world. However, we do not know how to provide interactive proofs for all problems in BQP with only classical interaction; this is a major open problem (see Section 1.8). We therefore modify the model a little, and allow the verifier additional access to a constant number of qubits. The verifier can be viewed as modeling our current computational abilities, and so in some sense, the verifier represents “us”.

Definition 1.1

A Language $\mathcal{L}$ is said to have a Quantum Prover Interactive Proof ($\textsf{QPIP}_{\kappa}$) with completeness $c$ and soundness $s$ (where $c-s$ is a constant) if there exists a pair of algorithms $(\mathds{P},\mathds{V})$, where $\mathds{P}$ is the prover and $\mathds{V}$ is the verifier, with the following properties:

• •

The prover $\mathds{P}$ is a BQP machine, which also has access to a quantum channel which can transmit $\kappa$ qubits.

• •

The verifier $\mathds{V}$ is a hybrid quantum-classical machine. Its classical part is a BPP machine. The quantum part is a register of $\kappa$ qubits, on which the verifier can perform arbitrary quantum operations and which has access to a quantum channel which can transmit $\kappa$ qubits. At any given time, the verifier is not allowed to possess more than $\kappa$ qubits. The interaction between the quantum and classical parts of the verifier is the usual one: the classical part controls which operations are to be performed on the quantum register, and outcomes of measurements of the quantum register can be used as input to the classical machine.

• •

There is also a classical communication channel between the prover and the verifier, which can transmit polynomially many bits at any step.

• •

At any given step, either the verifier or the prover perform computations on their registers and send bits and qubits through the relevant channels to the other party.

We require:

• •

Completeness*: if $x\in\mathcal{L}$, then after interacting with $\mathds{P}$, $\mathds{V}$ accepts with probability $\geq c$.*

• •

Soundness*: if $x\notin\mathcal{L}$, then the verifier rejects with probability $\geq 1-s$ regardless of the prover $\mathds{P}^{\prime}$ (who has the same description as $\mathds{P}$) with whom he is interacting.*

Abusing notation, we denote the class of languages for which such a proof exists also by $\textsf{QPIP}_{\kappa}$. Throughout the paper, when we refer to QPIP without a subscript, we are assuming the subscript is a constant $c$. We remark that our definition of $\textsf{QPIP}_{\kappa}$ is asymmetric - the verifier is “convinced” only if the quantum circuit outputs $1$. This asymmetry seems irrelevant in our context of verifying correctness of quantum computations. Indeed, it is possible to define a symmetric version of $\textsf{QPIP}_{\kappa}$ (which we denote by $\textsf{QPIP}_{\kappa}^{sym}$) in which the verifier is convinced of correctness of the prover’s outcome whether or not $x\in\mathcal{L}$ rather than only if $x\in\mathcal{L}$; see Appendix A for the definition.

1.3 Main Results

Our main results are phrased in terms of the BQP complete problem $\mbox{{Q-CIRCUIT}}_{\gamma}$:

Definition 1.2

The promise problem $\mbox{{Q-CIRCUIT}}_{\gamma}$ consists of a quantum circuit made of a sequence of gates, $U=U_{N}{\ldots}U_{1}$, acting on $n$ input bits. The task is to distinguish between two cases for all $x\in\{0,1\}^{n}$:

[TABLE]

when we are promised that one of the two cases holds.

$\mbox{{Q-CIRCUIT}}_{\gamma}$ is a BQP complete problem as long as $1-2\gamma>\frac{1}{poly(n)}$. Throughout this paper, if we refer to Q-CIRCUIT (without the parameter $\gamma$), we are assuming that $\gamma$ satisfies the above inequality. Our main result is:

Theorem 1.1

For $0<\epsilon<1$ and $\gamma<1-\epsilon$, the language $\mbox{{Q-CIRCUIT}}_{\gamma}$ has a $\textsf{QPIP}_{O(\log(\frac{1}{\epsilon}))}$ with completeness $1-\gamma$ and soundness $\epsilon+\gamma$.

We note that although we provide QPIP protocols only for the language Q-CIRCUIT (for which the initial state is always a standard basis state), our proofs can be extended to security for a modified language for which the initial state is an arbitrary quantum state. In addition, we prove soundness against an unbounded prover, rather than a BQP prover (as given in Definition 1.1). By setting $\epsilon$ to a constant, we obtain a $\textsf{QPIP}_{c}$ for a constant $c$, which gives our main theorem:

Theorem 1.2

There exists a constant $c$ for which ${\sf BQP}\ =\textsf{QPIP}_{c}$.

*Proof: * Since Q-CIRCUIT is BQP complete, the fact that BQP is in $\textsf{QPIP}_{c}$ follows from Theorem 1.1. $\textsf{QPIP}_{c}$ is trivially in BQP since the BQP machine can simulate both prover, verifier and their interactions. $\Box$

 

Thus, a BQP prover can convince the verifier of any language he can compute. Since BQP is closed under completion, we also get equality to the symmetric version of $\textsf{QPIP}_{c}$ (see Appendix A for the proof):

Corollary 1.3

There exists a constant $c$ for which ${\sf BQP}=\textsf{QPIP}_{c}^{sym}$

Our main tools for the proof of Theorem 1.1 are quantum authentication schemes (QAS) [BCG*+*02]. Roughly, a QAS allows two parties to communicate in the following way. First, Alice sends an encoded quantum state to Bob. Then Bob decodes the state and decides whether or not it is valid. If the state was not altered along the way, then upon decoding, Bob gets the same state that Alice had sent (and declares it valid). If the state was altered, the scheme is $\epsilon$-secure if Bob declares a wrong state valid with probability at most $\epsilon$. The basic idea used to extend a QAS to a QPIP is that similar security can be achieved, even if the state needs to be rotated by unitary gates, as long as the verifier can control how the unitary gates affect the authenticated states.

1.3.1 Clifford QAS based QPIP

We start with a simple QAS (which we extend to a QPIP) based on random Clifford group operations (it is reminiscent of Clifford based quantum $t$-designs [AE07, ABW08]). The Clifford QAS based QPIP demonstrates some key ideas and might be of interest on its own due to its simplicity. However, the QPIP has the disadvantage that it requires two way quantum communication between the prover and the verifier.

 

We first describe the Clifford QAS. To encode a state of $n$ qubits, Alice tensors the state with $e$ qubits in the state $\left|0\right>$, and applies a random Clifford operator on the $n+e$ qubits. To decode, Bob removes the Clifford operator chosen by Alice and checks if the $e$ auxiliary qubits are in the state $\left|0\right>^{\otimes e}$ (see Protocol 3.1 for a complete description of the QAS). We prove the following theorem:

Theorem 1.4

The Clifford scheme given in Protocol 3.1 is a QAS with security $\epsilon=2^{-e}$.

This QAS might be interesting in its own right due to its simplicity. To construct a QPIP using this QAS, we simply use the prover as an untrusted storage device: the verifier asks the prover for the authenticated qubits on which he would like to apply the next gate, decodes them by applying the appropriate inverse Clifford operators, applies the gate, applies new random Clifford operators and sends the resulting qubits to the prover. As we show in the following theorem, this protocol (see Protocol 4.1 for full details) is a QPIP:

Theorem 1.5

For $0<\epsilon<1$ and $\gamma<1-\epsilon$, Protocol 4.1 is a $\textsf{QPIP}_{O(\log(\frac{1}{\epsilon}))}$ with completeness $1-\gamma$ and soundness $\gamma+\epsilon$ for $\mbox{{Q-CIRCUIT}}_{\gamma}$.

1.3.2 Polynomial code QAS based QPIP

Our second type of QPIP uses a QAS due to Ben-Or, Crépeau, Gottesman, Hassidim and Smith [BOCG*+*06]. This QAS is based on signed quantum polynomial codes (defined in Definition 2.6) , which are quantum polynomial codes [ABO97] of degree at most $d$ multiplied by some random sign ($1$ or $-1$) at every coordinate (this is called the sign key $k$) and a random Pauli at every coordinate (the Pauli key). The QAS simply consists of Alice encoding a single qudit using the signed polynomial code and Bob checking if the received state is indeed encoded under the signed polynomial code (described in further detail in Protocol 5.1). We prove the following theorem:

Theorem 1.6

The polynomial authentication scheme as described in Protocol 5.1 is a QAS with security $\epsilon=2^{-d}$.

The security proof of the polynomial code based QAS is subtle, and was missing from the original paper [BOCG*+*06]; we provide it here.

 

To extend the polynomial based QAS to a QPIP, we first note that performing Clifford gates in this setting is very easy. Due to its algebraic structure, the signed polynomial code allows applying Clifford gates without knowing the sign key (if the same sign key is used for all registers). This was used in [BOCG*+*06] for secure multiparty quantum computation; here we use it to allow the prover to perform gates without knowing the sign key or the Pauli key. To perform Toffoli gates, the verifier first creates authenticated magic states (used in [Sho96],[BK05],[BOCG*+*06]) and sends them to the prover. The prover can apply a Toffoli gate by first applying Clifford operations between the computation qubits and a magic state, then measuring 3 of the computation qubits, and then adaptively applying a Clifford correction based on the measurement results (for more details on applying Toffoli gates using Toffoli states see Section 2.3.1). Note that since the prover obtains a measurement result encoded under the polynomial QAS, he must send it to the verifier to be decoded before he can perform an adaptive Clifford correction. It follows that with authenticated magic states and classical assistance from the verifier, the prover can perform universal computation using only Clifford group operations and measurements (universality was proved for qubits in [BK05] and for higher dimensions it was shown in [ABO97]).

 

The polynomial QPIP protocol (Protocol 6.1) goes as follows. The prover receives all authenticated qubits in the beginning. Those include the inputs to the circuit, as well as authenticated magic states required to perform Toffoli gates. The prover can then perform universal computation as described above. Except for the first round, any further communication between the verifier and prover (occuring when implementing the Toffoli gates) is thus classical. We show that this protocol is a QPIP in the following theorem:

Theorem 1.7

For $0<\epsilon<1$ and $\gamma<1-\epsilon$, Protocol 6.1 is a $\textsf{QPIP}_{O(\log(\frac{1}{\epsilon}))}$ protocol with completeness $1-\gamma$ and soundness $\gamma+\epsilon$ for $\mbox{{Q-CIRCUIT}}_{\gamma}$.

We remark that in the study of the classical notion of IP, a natural question is to ask how powerful the prover must be to prove certain classes of languages. It is known that a PSPACE prover is capable of proving any language in PSPACE to a BPP verifier, and similarly, it is known that NP or #P restricted provers can prove any language which they can compute to a BPP verifier. This is not known for coNP, SZK or PH [AB09]. It is natural to ask what is the power of a BQP prover; our results imply that such a prover can prove the entire class of BQP (albeit to a verifier who is not entirely classical). Thus, we provide a characterization of the power of a BQP prover. We stress the open question of characterizing this power when the interaction between the prover and verifier is completely classical (discussed in Section 1.8).

1.3.3 Blindness

In the works [Chi01, AS06] a related question was raised: in our cryptographic setting, if we distrust the company performing the delegated quantum computation, we might want to keep both the input and the function which is being computed secret. Can this be done while maintaining the confidence in the outcome? A simple modification of our protocols to work on universal quantum circuits gives the following theorem, which we prove in Section 7:

Theorem 1.8

Theorem 1.1 holds also in a blind setting, namely, the prover does not get any information regarding the function being computed and its input.

We note that an analogous result for NP-hard problems was shown already in the late $80$’s to be impossible (in the setting of classical communication) unless the polynomial hierarchy collapses [AFK87].

 

To achieve Theorem 1.8, we modify our construction so that the circuit that the prover performs is a universal quantum circuit, i.e., a fixed sequence of gates which gets as input a description of a quantum circuit (with gates from a constant size universal set of gates) plus an input string to that circuit, and applies the input quantum circuit to the input string. Since the universal quantum circuit is fixed, it reveals nothing about the input quantum circuit or the input string to it. To prove blindness, we simply need to show that the input states provided to the prover by the verifier (and all messages provided to the prover during the protocol) do not leak information about the input to the universal circuit. This is done by showing that at all times, the prover’s state is independent of the input to the universal circuit.

 

Proving blindness of the Clifford scheme is quite straightforward and done in the following theorem (which we prove in Section 7):

Theorem 1.9** (Blindness of the Clifford Based QPIP)**

The state of the prover in the Clifford based QPIP (Protocol 4.1) is independent of the input to the circuit which is being computed throughout the protocol.

On the other hand, proving blindness of the polynomial scheme is a bit more involved, due to the classical interaction:

Theorem 1.10** (Blindness of the Polynomial Based QPIP)**

The state of the prover in the polynomial based QPIP (Protocol 6.1) remains independent of the input to the circuit which is being computed throughout the protocol.

1.3.4 Interpretation

We will now present some corollaries which clarify the connection between the results and the motivating questions, and show that one can use the QPIP protocols designed here to address the various issues raised in Sec. 1.1.

 

We start with some basic questions. Conditioned that the verifier does not abort, does he know that the final state of the machine is very close to the correct state that was supposed to be the outcome of the computation? This unfortunately is not the case. It may be that the prover can make sure that the verifier aborts with very high probability, but when he does not abort, the outcome of the computation is wrong. However a weaker form of the above result (which achieves what is reasonable to hope for) does hold: if we know that the probability of not aborting is high, then we can deduce something about the probability of the final state being very close to the correct state.

Corollary 1.11

For the Clifford based QPIP protocol with security parameter $\epsilon$, if the verifier does not abort with probability $\geq\beta$ then the trace distance between the final density matrix conditioned on the verifier’s accepting and the correct final state, is at most $\frac{\epsilon}{\beta}$.

The proof is given in Section 8 - it is simple for the Clifford QPIP. For the polynomial scheme a similar corollary holds, with a proof which is more involved:

Corollary 1.12

For the polynomial based QPIP protocol with security parameter $\epsilon$, if the verifier does not abort with probability $\geq\beta$, and the correct final state is a standard basis state, then the trace distance between the final density matrix conditioned on the verifier’s acceptance and the correct final state is at most $\frac{\epsilon}{\beta}$.

The following corollary (which we prove in Appendix A) contains another implication of Theorem 1.2. We show that under a somewhat stronger assumption than BQP $\neq$ BPP, but still a widely believed assumption, it is possible to lower bound the computational power of the prover (and deduce that the prover is not within BPP) by efficiently testing the prover (assuming the prover passes the test with high probability).

Corollary 1.13

Assume that there is a language $L\in$ BQP and there is a polynomial time sampleable distribution $D$ on the instances of $L$ on which any BPP  machine errs with non negligible probability (e.g. the standard cryptographic assumption about the hardness of Factoring or Discrete Log). If the verifier runs a QPIP (with soundness $\gamma+\epsilon$ and completeness $1-\gamma$) on $\mbox{{Q-CIRCUIT}}_{\gamma}$ on an instance drawn from $D$ and does not abort with probability $\geq\beta$ (where $\beta-\frac{4\epsilon}{1-2\gamma}$ is a constant), then the prover’s computational power cannot be simulated by a BPP machine.

1.4 Proofs Overview

As mentioned, we rely on two different quantum authentication schemes (and their proofs of security) in order to derive and prove completeness and soundness of our two QPIPs.

1.4.1 Clifford QAS

To prove the security of the Clifford QAS (as stated in Theorem 1.4) we first prove in Lemma 3.2 that any non identity attack of Eve is mapped by the random Clifford operator to a uniform mixture over all non identity Pauli operators. We call this property of Clifford operators (as stated in Lemma 3.2) operator decohering by Cliffords or in short, Clifford decoherence. Next, we show that the uniform mixture over Pauli operators changes the auxiliary 0 states used in the Clifford authentication scheme with high probability, and the non identity attack is therefore likely to be detected by Bob’s decoding procedure.

1.4.2 Clifford QPIP

To prove the soundness of the Clifford based QPIP (stated in Theorem 1.5), we use Clifford decoherence to reduce the soundness of the QPIP to the security of the QAS. We do this by showing in Claim 4.2 that Clifford decoherence (Lemma 3.2) allows us to shift all attacks of the prover to the end of the protocol (at which point we can simply apply the security proof of the QAS). This shifting is clearly possible if the prover’s attack is the identity operator. If the prover’s attack is non identity, Clifford decoherence maps the prover’s attack to a uniform mixture over all non identity Pauli operators. It follows that after the verifier decodes the state sent by the prover, the state will essentially be maximally mixed, and whatever the verifier applies at this point commutes with the prover’s attack which is currently acting on the state (this is shown in Lemma 4.6). Note that it is important that the verifier does not check the states for correctness in each round (by measuring the auxiliary qubits and checking whether they are 0); instead, he only checks in the final round. If the verifier had instead checked the states for correctness in each round, we could not have used the shifting technique due to Clifford decoherence, since the verifier would be applying a non unitary operator (measurement). We thereby obtain a simple QPIP, with a rather short proof.

 

The key disadvantage of this protocol is the two way quantum communication required in each round.

1.4.3 Polynomial based QAS

To strengthen the results, we use a polynomial based QPIP instead. The proof of the security of the corresponding QAS (Theorem 1.6) requires some care, due to a subtle point which was not addressed in [BOCG*+*06]. To prove Theorem 1.6, we first prove in Lemma 5.2 that no non identity Pauli attack can preserve the signed polynomial code for more than 2 of the sign keys, and thus the sign key suffices in order to protect against any non identity Pauli attack of Eve’s. Next, we need to show that the scheme is secure against general attacks. This, surprisingly, does not follow by linearity from the security against Pauli attacks (as is the case in quantum error correcting codes): if we omit the Pauli key we get an authentication scheme which is secure against Pauli attacks but not against general attacks333Without Pauli keys, the sign key can be determined up to $\pm 1$ from a measurement of the state. This follows from the uniqueness of signed polynomials, which is proven in Fact 5.1.. We proceed by showing (with some similarity to the Clifford based QAS) that the random Pauli key effectively translates Eve’s attack to a mixture (not necessarily uniform like in the Clifford case) of Pauli operators acting on a state encoded by a random signed polynomial code. We call this property of random Pauli keys Pauli decoherence (see Lemma 5.1).

1.4.4 Polynomial based QPIP

We proceed to proving the soundness of the polynomial based QPIP (as stated in Theorem 1.7). Unlike in the Clifford case, the soundness of the polynomial QPIP cannot be directly reduced to the security of the polynomial QAS, because the prover’s attack cannot be shifted to the end of the protocol in the polynomial QPIP. This is due to the weakness of Pauli decoherence relative to Clifford decoherence. In more detail, Clifford decoherence first maps the prover’s attack to a convex sum over Pauli operators, and then further maps each non-identity Pauli operator to a uniform mixture over all non identity Pauli operators. Pauli decoherence only performs the first step: it maps the prover’s attack to a convex sum over Pauli operators (which are weighted according to the original attack). This does not create a maximally mixed state, and therefore does not allow the same shifting of the prover’s attack to the end of the protocol. Thus, the proof of Theorem 1.7 does not use the proof of the polynomial QAS (Theorem 1.6) as a black box, and in fact that proof is not strictly needed for the proof of Theorem 1.7. However, we included Theorem 1.6 and its proof for completeness (as it was not written before), and mainly because the two key ideas used in that proof will also be used in the proof of the polynomial based QPIP. Recall that these two key ideas are Pauli decoherence from Lemma 5.1 and security of the sign key against Pauli attacks from Lemma 5.2 (which takes up most of the technical effort involved in proving Theorem 1.6).

 

To prove soundness of the polynomial QPIP, we first note that if all of the classical messages sent from the verifier to the prover were fixed ahead of time, shifting the prover’s attacks to the end of the protocol would be fine, as the verifier’s messages to the prover do not depend on the prover’s measurement results. Once we shift the prover’s attacks, we can apply the two main ideas (Pauli decoherence from Lemma 5.1 and security of the sign key from Lemma 5.2) used in the proving the security of the polynomial QAS to obtain soundness of the polynomial QPIP. However, in the actual polynomial QPIP protocol, the classical interaction does depend on the prover’s messages. We employ an idea from [FK12] (see Figure 7 in their paper): as part of the analysis, we fix the interaction transcript at the start of the protocol (to allow shifting of the prover’s attacks) and then project onto this fixed interaction transcript at the end of the protocol to enforce consistency. This technique (which is formalized in Claim 6.1) essentially partitions the prover’s Hilbert space according to the interaction transcript, and we can then apply the two key ideas used in proving the security of the polynomial QAS in each partition.

1.4.5 Blindness

Proving blindness of the Clifford scheme (as stated in Theorem 1.9) is quite straightforward and is done by showing that, due to the randomness of the Clifford encoding operator, the prover’s state is maximally mixed at all times. This is because applying a random Clifford operator on a state results in a maximally mixed state (see Lemma 4.4). See Section 7 for the full proof.

 

Proving blindness of the polynomial scheme (as stated in Theorem 1.10) is a bit more involved due to the classical interaction - see Section 7. Without the classical interaction, we could use the randomness of the Pauli keys to show that the prover’s state is always maximally mixed (this relies on the fact that applying a random Pauli operator to a state results in a maximally mixed state, as stated in Lemma 4.5). When we include classical interaction (for the purpose of decoding measurement results), we need to show that the measurement results (even if altered by a malicious prover) do not leak information about the input state. This is due to the fact that measurement results are initially distributed uniformly at random, and even if a malicious prover attacks, his attack can be reduced to a convex sum over Pauli operators (due to Lemma 5.1), which preserves the uniform distribution. Note that we could have simplified this proof significantly by including extra randomness in the magic states, which would serve essentially as a one time pad for the decoded measurement results (this would have complicated the description of the polynomial QPIP protocol, Protocol 6.1) . However, it is interesting to note that this extra randomness is not needed for blindness, and that the protocol is blind due to the randomness of the measurement results and the Pauli keys.

1.4.6 Interpretation

We prove the corollaries (Corollary 1.11 and Corollary 1.12) given in Section 1.3.4 in Section 8. Both proofs rely on using the format of the prover’s state, as shown in Claim 4.2 for the Clifford QPIP and Claim 6.1 for the polynomial QPIP, to first determine what the prover’s state will look like conditioned on the verifier’s acceptance. In the Clifford case, the trace distance can then be determined quite easily, due to the simplicity of Claim 4.2. The format of the prover’s final state in the polynomial case is significantly more involved. The proof of Corollary 1.12 proceeds by analyzing the effect of two different types of Pauli attack operators (trivial and non trivial) in order to show that the trace distance between the final state after acceptance and the correct final state is correlated to the probability of acceptance and the security parameter.

1.5 Changes from Conference Version

This journal version is a corrected and elaborated version of the conference version, and a new author (U.M) was added. We describe here in detail the differences from the conference version.

1.5.1 Soundness

Clifford Scheme

The main difference between the Clifford QPIP protocol in this version and theconference version is that in this version the verifier checks correctness (by measuring the auxiliary 0 states) only in the final round, whereas in the conference version, the verifier checked correctness each time he received qubits from the prover. The conference version of the protocol is actually not sound; the prover can cheat by deviating only slightly in each round. Since there are polynomially many rounds, this can add up to a significant deviation in the final state, without being detected, using essentially the zeno effect.

 

The security proof in the original version assumed that all attacks of the provercould be shifted to the end of the protocol; namely, that the prover only deviated at the end of the protocol. While this does not hold in the original protocol, in the new scheme this can be proven, which is what makes the proof go through. The final proof eventually turns out to go along similar lines to the original one, except for this change in the protocol.

Polynomial Scheme

The protocol for the polynomial QPIP remained the same. However, the security proof needed to be changed dramatically, due to the same incorrect assumption used in the Clifford QPIP regarding shifting the prover’s attacks to the end of the protocol (as mentioned above). Whereas in the Clifford scheme a minor change in the protocol sufficed to guarantee that this assumption actually holds, we did not have such a simple solution in the polynomial scheme. As described in Section 1.4, this is because the weakness of Pauli decoherence relative to Clifford decoherence: Pauli decoherence does not map the attack to a uniform mixture over Paulis, thus preventing shifting the prover’s attacks to the end of the protocol. The polynomial QPIP proof therefore required major revisions, because we could not simply reduce to the security of the polynomial QAS.

1.5.2 Fault Tolerance

In the original version of the paper a scheme for making the protocol fault tolerant was proposed and was claimed to be secure. Unfortunately, there is a fatal flaw in the proof; we retract the claim about fault tolerance (see open questions in Section 1.8 for possible approaches left for future work).

 

We describe below the proposal for fault tolerance of [ABOE08] and the bug. The proposed protocol was: at the first stage of the protocol, authenticated qudits are sent from the verifier to the prover, one by one. As soon as the prover receives an authenticated qudit, he protects his qudits using his own concatenated error correcting codes so that the effective error in the encoded authenticated qudit is constant. This constant accuracy can be maintained for a long time by the prover, by performing error correction with respect to his error correcting code (see [ABO97]). Thus, polynomially many such authenticated states can be passed to the prover in sequence. A constant effective error is not good enough, but can be amplified to an arbitrary inverse polynomial by purification. Indeed, the prover cannot perform purification on his own since the purification compares authenticated qudits and the prover does not know the authentication code. However, the verifier can help the prover by using classical communication. This way the prover can reduce the effective error on his encoded authenticated qudits to inverse polynomial, and perform the usual fault tolerant construction of the given circuit, with the help of the verifier in performing the gates.

 

The problem with this approach is that the purification protocol could leak information about the sign key; during the purification protocol the verifier tells the prover which states are good enough for him to keep and which he should throw away. A cheating prover could lie on all of his messages to the verifier; eventually, he will figure out which of his lies will lead to the verifier accepting, and this should give him information about the sign key chosen by the verifier. Once the sign key is no longer hidden from the prover, the QPIP protocol is no longer secure. The problem seems to be difficult. In Section 1.8 we describe why several other possible avenues we tried, in order to achieve fault tolerance, failed; It remains open to achieve blind verifiable QPIPs in the noisy setting, even when we allow the verifier to hold a polylogarithmic quantum register, rather than a constant one.

1.6 Related Work

Related Work in Blindness and Verifiability

The question of delegated blind computation was asked by Childs in [Chi01] and by Arrighi and Salvail in [AS06], who proposed schemes to deal with such scenarios. However [Chi01] does not deal with a cheating prover, so the protocol is not verifiable. Also, the setting is somewhat different; rather than limiting the quantum space of the verifier, the verifier is limited to only performing Pauli gates. In [AS06], Arrighi and Salvail provide a blind interactive quantum protocol in this setting for a restricted set of functions, and prove its security against a restricted set of attacks.

Independent work

After deriving the results of the first version of this paper, we learned that Broadbent, Fitzsimons, and Kashefi [BFK08] have claimed related results. Using measurement based quantum computation, they construct a protocol for universal blind quantum computation. In their case, it suffices that the verifier’s register consists of a single qubit. Their results have similar implications to ours in terms of the QPIP notion, though these are implicit in [BFK08]. However, their protocol was not secure against general attacks (as noted in [FK12]). However, based on similar ideas, Fitzsimons and Kashefi suggested a measurement based protocol which is both verifiable and blind, and prove its security in [FK12] (a key idea they used to prove security was also useful in our proof of the polynomial QPIP, as described in Section 1.4).

Follow-up Work

Since the results presented here were first posted [ABOE08], together with the [BFK08] paper, there had been a surge of results investigating the notions of blind quantum computation, verifiable quantum computation, the ability to perform those in a noisy environment fault tolerantly, as well as experimental demonstrations.

 

As mentioned, Fitzimons and Kashefi gave a different QPIP protocol which is both verifiable and blind, based on measurement based quantum computation [FK12]. Our protocol seems to be simpler to state, but the [FK12] has the advantage of only requiring a single qubit at the verifier’s end.

 

In [BGS12], Broadbent, Gutoski and Stebila provided a framework for analysing blind QPIPs in the context of one time quantum programs; a sketch for a proof of the blindness (but not of the verifiability) of a protocol very similar to our polynomial based protocol (Protocol 6.1) is given in that paper in Section 6.1. In [MF16], Morimae and Fitzsimons proposed a very nice and simple QPIP protocol which is just verifiable but not blind. Moreover, it requires the verifier only to be able to measure qubits in the standard or Hadamard basis; it is based on the idea of the prover generating the history state known from Kitaev’s QMA proof ([KSV02]). Additional blind QPIP protocols were proposed in [HM15], [Mor14] and [Bro15].

 

A very interesting question which branched out from the results presented here, was taken by Reichardt, Unger and Vazirani[RUV12]. In their work, they proposed a protocol in which a BPP verifier could verify a BQP computation by only classical interaction, when interacting with two BQP entangled provers [RUV12]. Since then, there have been several papers which have explored the model of multiple BQP provers and a single BPP verifier (such as [Mck13], [GKW15], [HPDF15], [HH16]).

 

The difficulties in providing a fault tolerant blind verifiable protocol with only $O(1)$ qubits at the verifier’s end seem hard to get around. There have been several attempts to suggest solutions, including the conference version of this paper [ABOE08] as well as [FK12, TFMI16] but to the best of our knowledge this problem remains importantly open, even when the verifier is allowed to hold a polylogarithmic quantum register.

.

As for experimental demonstrations, we mention a few: of blind computing in [BKB*+*12],[GRB*+*16] and of verifiable computing in [BFKW13]).

1.7 Fault Tolerance Open Questions and Attempts

Technically, the main open question raised by this work is to provide a fault tolerant version of these results. In work yet to be published ([ASMZ17]), it is shown that fault tolerance can be achieved if only one of the tasks (blindness or verification) is required. However, we do not know how to achieve fault tolerance for both tasks simultanuously. Moreover, we do not even know how to do this when allowing the verifier a quantum register of polylogarithmic size. There seems to be an inherent problem in any of the straightforward approaches to making our schemes fault tolerant, which we now explain.

 

We already discussed above why the approach which we suggested in the original paper, of purification with the help of the verifier (see Section 1.5.2), failed. Another attempt is to create a fault tolerant version of the Clifford protocol by running a fault tolerant circuit, which involved the prover passing the qubits back to the verifier for correction at every step of the circuit. This seemed to require the verifier to measure and check for errors when correcting, which compromises the soundness of the Clifford protocol as explained in Section 1.5.1 (recall from Section 1.4 that the verifier only checks for errors at the end of the current Clifford protocol).

 

We also attempted to create a fault tolerant version of the polynomial protocol by using blind computation to allow the prover to create the authenticated states on his own; the prover can then do everything in his lab fault tolerantly. This idea seemed troublesome because the prover did not have to honestly run the blind computation in order to create the authenticated states, and his dishonesty during the state creation phase could potentially compromise security later on in the protocol.

 

Finally, we attempted to use standard fault tolerant techniques (e.g. [ABO97]) in order to simulate the QPIP protocol, both by the verifier and the prover. The protocol will start with the verifier (who now has a quantum register of polylogarithmic size) creating a fault tolerant encoding of his authenticated states, and sending those to the prover. The prover will act as expected by the QPIP protocol, but will keep correcting the state with respect to the code used for fault tolerance. Unfortunately, we do not yet know how to extend our security proofs to hold for this protocol, though it may be secure. A natural attempt to prove security would be to reduce the security in the noisy case to that of the ideal case. In other words, we would like to claim that if the protocol is insecure in the noisy setting, then the prover can also cheat in the noiseless setting (by simulating the noise). Unfortunately, we do not know how to claim that the prover can simulate the effect of the noise acting on the authenticated states, since the noise may depend on the private keys of the verifier (this is because the verifier’s circuit to create the authenticated states depends on these keys). One might hope to use error correction techniques to remove the dependence of the noise on the keys, but this approach turns out to fail due to a very subtle issue - namely, due to teleportation-like effects, dependencies on the keys may propagate through the error correction to qubits which were previously subject to errors independent of the keys. Hence, we leave this approach for future investigation.

1.8 Conclusion and Open Questions

The results presented here introduced the notion of interactive proofs with quantum provers and this journal version provides rigorous proofs of the two QPIPs presented in [ABOE08]. These results show that the fundamental questions regarding the falsifiability of the high complexity regime of quantum mechanics, the ability to delegate quantum computations to untrusted servers, and the ability to test that experimental quantum systems behave as they should can all be done using interactive protocols between a BQP prover and a classical (BPP) verifier augmented with $O(1)$ qubits.

 

This work has revolutionary implications in the context of philosophy of science. It suggests that experiments can be conducted in a structured adaptive way, along the lines of interactive proofs [GMR85]; this can be called ”interactive experiments” and suggests a new approach to confirmation of physical theories. Following discussions with us at preliminary stages of this work, Jonathan Yaari has studied “Interactive proofs with Nature” from the philosophy of science perspective [Yaa08]. The philosophical aspects of this possibility of interactive experiments suggested by our QPIP protocols were also discussed by Aharonov and Vazirani in [AV12]. A very interesting question is whether interactive experiments can be designed to test conjectured physical theories, even in the absence of full control of the physical system as is required in our protocols. A particularly interesting example is high $T_{c}$ superconductivity, in which guesses regarding the governing Hamiltonian exist. It would be extremely interesting to be able to test the correctness of the Hamiltonian using such interactive techniques, without resorting to full fledged quantum computational power.

 

Perhaps the most important and intriguing open question that emerges from this work is whether it is possible to remove the necessity for even a small quantum register, and achieve similar results in the more natural QPIP model in which the verifier is entirely classical. This would have interesting fundamental implications regarding the ability of a classical system to learn and test a quantum system; it is likely that such a protocol might also have implications on the major open problem of quantum PCP [AAV13].

 

Finally, we can also ask whether it is possible to achieve blind (rather than verifiable) computation, in two different settings. The question of blind computation involves a client who would like to ask a BQP server to run a BQP circuit. The client does not wish to verify the result of the computation, but just to ensure that the server does not learn anything about the computation, even though he is able to run the computation. If the client is a BQP machine (but does some amount of work which is independent of the size of the computation) and there is only one round of interaction, this problem is known as quantum fully homomorphic encryption. While there have been several results exploring this question, such as [DSS16], [BJ14] and [YPDF14] (which is an impossibility result regarding information theoretically secure quantum homomorphic encryption), quantum fully homomorphic encryption remains an open question. We can also change the model slightly by allowing classical interaction and restricting the client to be a BPP machine. This variant also remains open.

 

We remark that this area is notorious for the difficulty in providing rigorous protocols and proofs of security, as the arguments involved are very delicate and subtle. We hope that this journal version makes a useful contribution in this direction. We believe that the techniques presented here will be very useful in the vastly growing area of delegated quantum computation and quantum cryptographic protocols.

Paper Organization We start with some notations and background in Sec. 2. In Section 3, we present the Clifford QAS and prove its security. In Section 4, we present the Clifford QPIP and prove security. Sections 5 and 6 present the polynomial QAS and QPIP. Blind delegated quantum computation is proved in Section 7. The corollaries related to the interpretations of the results are proven in Section 8. Appendix A contains the definition of $\textsf{QPIP}_{\kappa}^{sym}$ as well as the proofs of Corollary 1.3 and Corollary 1.13. Appendix B contains useful lemmas about Clifford and Pauli operators, Appendix C contains proofs of the technical lemmas required in Sections 3 and 4 and Appendix D contains proofs of correctness of the logical operators on signed polynomial codes. Finally, in Appendix E we provide a notation table; this is especially helpful in reading Section 6, as we introduce a significant amount of notation in that section.

2 Background

2.1 Quantum Authentication

Quantum authentication is a protocol by which a sender $\mathcal{A}$ and a receiver $\mathcal{B}$ are capable of verifying that the state sent by $\mathcal{A}$ had not been altered while transmitted to $\mathcal{B}$.

2.1.1 Quantum Security

If $\mathcal{B}$ is a quantum machine, we would like our authentication definition to capture the following two requirements. On the one hand, in the absence of intervention, the received state should be the same as the sent state and moreover, $\mathcal{B}$ should not abort. On the other hand, we want that when the adversary does intervene, then with all but a small probability (or in fact, distance in terms of density matrices), either $\mathcal{B}$ rejects or his received state is the same as that sent by $\mathcal{A}$.

This is formalized below for pure states; one can deduce the appropriate statement about fidelity of mixed states, or for states that are entangled to the rest of the world (see [BCG*+*02] Appendix B).

Definition 2.1

(adapted from Barnum et. al. [BCG*+*02]). A quantum authentication scheme (QAS) from $l$ to $m=l+e$ qubits, with security $\epsilon$, is a pair of polynomial time quantum algorithms $\mathcal{A}$ and $\mathcal{B}$ together with a set of classical keys $\mathcal{K}$ such that:

• •

$\mathcal{A}$* takes as input a state $\left|\psi\right>$ on $l$ qubits and chooses $k\in\mathcal{K}$ uniformly at random. $\mathcal{A}$ then applies a unitary operator $A_{k}$ on the state of $m$ qubits $\left|\psi\right>\left|0\right>^{\otimes e}$ obtaining:*

[TABLE]

• •

$\mathcal{B}$* takes as input a state of $m$ qubits and a classical key $k\in\mathcal{K}$. He applies a unitary operator $B_{k}$ to the input state to obtain an output state of $m$ qubits. $\mathcal{B}$ declares the state valid if the last $e$ qubits of the output state lie in the space $\left|0\right>\left<0\right|^{\otimes e}$ and declares the state erroneous if the last $e$ qubits lie in the space $\Pi_{ABR}=\mathcal{I}-\left|0\right>\left<0\right|^{\otimes e}$.*

We require:

• •

Completeness*: For all keys $k\in\mathcal{K}$,*

[TABLE]

To quantify soundness, define the projections:

[TABLE]

[TABLE]

Then

• •

Soundness*: For any super-operator $\mathcal{O}$ (representing a possible intervention by the adversary), let $\rho_{B}$ be defined by*

[TABLE]

Then the quantum authentication scheme is $\epsilon$-secure if:

[TABLE]

2.2 Pauli and Clifford Gates in $F_{2}$

The $n$-qubits Pauli group consists of all elements of the form $P=P_{1}\otimes P_{2}{\otimes{\ldots}\otimes}P_{n}$ where $P_{i}\in\{\mathcal{I},X,Y,Z\}$, together with the multiplicative factors $-1$ and $\pm i$. We will use a subset of this group, which we denote as $\mathbbm{P}_{n}$, which includes all operators $P=P_{1}\otimes P_{2}{\otimes{\ldots}\otimes}P_{n}$ but not the multiplicative factors.

The Pauli group $\mathbbm{P}_{n}$ is a basis to the matrices acting on n-qubits. We can write any matrix $U$ over a vector space $A\otimes B$ (where $A$ is the space of $n$ qubits) as $\sum_{P\in\mathbbm{P}_{n}}P\otimes U_{P}$ where $U_{P}$ is some (not necessarily unitary) matrix on $B$.

Let $\mathfrak{C}_{n}$ denote the $n$-qubit Clifford group. Recall that it is a finite subgroup of unitaries acting on $n$ qubits generated by the Hadamard matrix-H, by K=\left(\begin{array}[]{ll}1&0\\ 0&i\end{array}\right), and by controlled-NOT. The Clifford group is characterized by the property that it maps the Pauli group $\mathbbm{P}_{n}$ to itself, up to a phase $\alpha\in\{\pm 1,\pm i\}$. That is: $\forall C\in\mathfrak{C}_{n},P\in\mathbbm{P}_{n}:\leavevmode\nobreak\ \alpha CPC^{\dagger}\in\mathbbm{P}_{n}$

Fact 2.1

[DLT02]** A random element from the Clifford group on $n$ qubits can be sampled efficiently by choosing a string $k$ of $poly(n)$ bits uniformly at random. The map from $k$ to the group element represented as a product of Clifford group generators can be computed in classical polynomial time.

2.3 Generalized Gates over $F_{q}$

Definition 2.2

The generalized Pauli operators over $F_{q}$ perform the following maps:

[TABLE]

where $\omega_{q}=e^{2\pi i/q}$ is the primitive q-root of the unity.

We note that $ZX=\omega_{q}XZ$. The generalized Pauli group consists of generalized Pauli operators, together with the multiplicative factor $\omega_{q}$. We use the same notation, $\mathbbm{P}_{n}$, for the standard and generalized Pauli groups, as it will be clear by context which one is being used.

Definition 2.3

For vectors $x,z$ in $F_{q}^{m}$, we denote by $P_{x,z}$ the Pauli operator $Z^{z_{1}}X^{x_{1}}{\otimes{\ldots}\otimes}Z^{z_{m}}X^{x_{m}}$.

We now define the other generalized gates we will need:

Definition 2.4

Generalized Gates

The generalized Fourier transform over $F_{q}$ performs the following map on $a\in F_{q}$:

[TABLE] 2. 2.

The generalized $r$- variant of the Fourier transform over $F_{q}$ performs the following map on $a\in F_{q}$:

[TABLE] 3. 3.

The generalized CNOT gate, which we denote as SUM, performs the following map on $a,b\in F_{q}$:

[TABLE] 4. 4.

The generalized Toffoli gate $T$ performs the following map on $a,b,c\in F_{q}$:

[TABLE] 5. 5.

The multiplication gate $M_{r}$ (for $r\in F_{q}$, $r\neq 0$) performs the following map on $a\in F_{q}$:

[TABLE] 6. 6.

The generalized controlled phase gate, which we denote as CPG, performs the following map on $a,b\in F_{q}$:

[TABLE]

2.3.1 Toffoli Gate by Teleportation

If given a resource state (which we will also refer to as a magic state or a Toffoli state) of the following form:

[TABLE]

it is possible to apply a Toffoli gate using only Clifford operations and measurements. This can be done as follows. Assume we would like to apply the Toffoli gate to the state $\left|c,d,e\right>$, resulting in $\left|c,d,e+cd\right>$. We start with the following state:

[TABLE]

We then perform the following Clifford entangling operations: a SUM gate from register 6 to register 3, inverse sum gates from register 1 to 4 and register 2 to 5, and an inverse Fourier gate on register 6 resulting in:

[TABLE]

We then measure registers 4,5, and 6 obtaining measurement results $x,y,z$ where $x$ corresponds to register 4, etc.. The renormalized state after measurement on the unmeasured registers (the first three registers) is then:

[TABLE]

Then we apply the following correction to the state (on the first three remaining registers):

[TABLE]

where the subscript denotes the registers (the first is the control and second is the target). We note that the above correction involves Toffoli gates, but since they are acting by conjugation on Pauli operators, the expression is actually a Clifford operator. It is easy to check that after applying $C_{x,y,z}$ to the state in equation 18, the resulting state is:

[TABLE]

2.4 Conjugation Properties of Generalized Gates

In this section, we describe how the gates above conjugate operators in the Pauli group. We begin with the SUM gate. It is easy to check that:

[TABLE]

Next, the Fourier gate swaps the roles of the $X$ and $Z$ Pauli operators; i.e. for $r\in F_{q}$ ($r\neq 0$)

[TABLE]

Finally, the multiplication gate $M_{r}$ (again for $r\in F_{q}$ where $r\neq 0$) has the following conjugation behavior:

[TABLE]

2.5 Signed Polynomial Codes

We first define polynomial codes:

Definition 2.5

Polynomial error correction code [ABO97]. Given $m,d,q$ and $\{\alpha_{1},\ldots,\alpha_{m}\}$ where $\alpha_{i}$ are distinct non zero values from $F_{q}$, the encoding of $a\in F_{q}$ is $\left|S_{a}\right>$

[TABLE]

We use here $m=2d+1$, in which case the code subspace is its own dual. It is easy to see that this code can detect up to $d$ errors [ABO97]. In this paper, we will be using signed polynomial codes:

Definition 2.6

([BOCG*+*06])* The signed polynomial code with respect to a string $k\in\{\pm 1\}^{m}$ is defined by:*

[TABLE]

We again use $m=2d+1$. Similar to the polynomial code, the signed polynomial code can detect $d$ errors and is self dual [BOCG*+*06]. We will require the following encoding circuit:

Definition 2.7

Let $E_{k}$ be a unitary operator such that:

[TABLE]

$E_{k}$ is the encoding circuit, which we describe in further detail in Section 2.5.2. We will write $\rho^{k}$ to denote that a density matrix $\rho$ is encoded with the signed polynomial code with respect to $k$; i.e. if $\rho$ is one qudit, then

[TABLE]

2.5.1 Signed Polynomial Code Logical Gates

For proofs of all claims and lemmas below, see Appendix D. We first provide the logical $X$ operator:

Claim 2.1

For $x\in F_{q}$ and $k\in\{-1,1\}^{m}$, the logical $X$ operator ${\widetilde{X}}_{k}^{x}$ obeys the following identity:

[TABLE]

Similarly for logical SUM, we consider the transitive application of controlled-sum, that is a SUM operation applied between the $j$’th register of $\left|S_{a}\right>$ and $\left|S_{b}\right>$.

Claim 2.2

For all $k\in\{-1,1\}^{m}$, the logical SUM operator ${\widetilde{\textit{SUM}}}$ obeys the following identity:

[TABLE]

where each SUM gate in the tensor product acts between registers $i$ and $m+i$ for $1\leq i\leq m$.

Showing what is the logical Fourier transform on the signed polynomial code requires more work. We need the following lemma:

Lemma 2.3

For any $m$ distinct numbers $\{\alpha_{i}\}_{1}^{m}$ there exist interpolation coefficients $\{c_{i}\}_{1}^{m}$ such that

[TABLE]

for any polynomial of degree $\leq m-1$.

We are now ready to define the logical Fourier transform.

Claim 2.4

For all $k\in\{-1,1\}^{m}$, the logical Fourier operator ${\widetilde{F}}$ obeys the following identity:

[TABLE]

where $\left|{\widetilde{S_{b}^{k}}}\right>$ is the encoding of $b$ in a signed polynomial code of degree $m-d$ on $m$ registers.

Finally, we define the logical $Z$ operator.

Claim 2.5

For $z\in F_{q}$ and $k\in\{-1,1\}^{m}$, the logical Pauli $Z$ operator ${\widetilde{Z}}_{k}^{z}$ obeys the following identity:

[TABLE]

2.5.2 Signed Polynomial Encoding Circuit

The encoding circuit $E_{k}$ first applies a Fourier transform on the first $d$ 0 states, and then interpolates to fill in the rest of the state. The following unitary operator performs the interpolation:

Definition 2.8

Let $D_{k}$ be a unitary operator such that

[TABLE]

such that $deg(f)\leq d$ and $f(0)$ = a.

Now if $F$ is the generalized Fourier transform (see equation 10) it is easy to check that

[TABLE]

We now describe $D_{k}$ in further detail.

Claim 2.6

The operator $D_{k}$ can be written as a product of SUM operators controlled by registers $1,\ldots,d+1$ with target registers $1,d+2,\ldots,m$ and a multiplication operator on the first register. More explicitly:

[TABLE]

where $2\leq i\leq d+1$, $d+2\leq j\leq m$ and for $i^{\prime}\in\{0,2,...,d+1\}$ and $\alpha_{0}=0$

[TABLE]

*Proof: * Observe that

[TABLE]

It follows that for all $d+2\leq j\leq m$, register $j$ holds the following value after the controlled sum operations detailed above:

[TABLE]

Now we can see that the controlled sum operations have performed the following mapping:

[TABLE]

The only thing left to do is map the first register from $f(0)$ to $k_{1}f(\alpha_{1})$. To do this, first multiply the first register by $k_{1}h_{0}(\alpha_{1})$ by using the multiplication operation $M_{k_{1}h_{0}(\alpha_{1})}$, where

[TABLE]

The multiplication operator performs the following mapping:

[TABLE]

Then apply controlled sum operations from registers $\hat{i}\in\{2,\ldots,d+1\}$ to register 1 $h_{\hat{i}}(\alpha_{1})k_{i}k_{1}$ times. Due to equation 34, the value in the first register after these operations is:

[TABLE]

It follows that the final controlled sum operations have performed the following mapping:

[TABLE]

$\Box$

3 Clifford Authentication Scheme

We now define a quantum authentication scheme based on Clifford operations. Let $\mathcal{K}_{m}$ be the set of authentication keys, consisting of succinct descriptions of Clifford operations in $\mathfrak{C}_{m}$ (i.e. Clifford operations on $m$ qubits); these descriptions exist due to Fact 2.1.

Protocol 3.1

Clifford based QAS : Given is a state $\left|\psi\right>$ on $l$ qubits. Let $e\in\mathbbm{N}$ be such that $2^{-e}=\epsilon$. We denote $m=l+e$. We denote by $C_{k}$ the operator specified by a key $k\in\mathcal{K}_{m}$.

• •

Encoding - $A_{k}$: Alice applies $C_{k}$ on the state $\left|\psi\right>\otimes\left|0\right>^{\otimes e}$.

• •

Decoding - $B_{k}$: Bob applies $C_{k}^{\dagger}$ to the received state. Bob measures the $e$ auxiliary registers and declares the state valid if they are all [math], otherwise Bob aborts.

Theorem 1.4   The Clifford scheme given in Protocol 3.1 is a QAS with security $\epsilon=2^{-e}$.

3.1 The Overall Proof of Theorem 1.4

The completeness of this protocol is trivial. In the following proof, we show soundness by first showing that any attack of Eve can be decomposed into a distribution over Pauli attacks. We then show that averaging over the random Clifford operators maps a Pauli operator to a uniform distribution over Paulis; the effective transformation on the original state is an application of a random Pauli. These two facts are summarized by Claim 3.1. We conclude the proof of Theorem 1.4 by showing that any Pauli attack is detected with high probability.

Proof of $\bf{Theorem\leavevmode\nobreak\ \ref{thm:CliffordAuth}}$:    We denote the space of the message sent from Alice to Bob as $M$. Without loss of generality, we can assume that Eve adds to the message a system $E$ (of arbitrary dimension) and performs a unitary transformation $U$ on the joint system. We note that there is a representation of $U$ as $\sum_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$, where $P$ acts on the message space $M$, and $U_{P}$ is not necessarily unitary and acts on the environment $E$. This is because the Pauli matrices form a basis for the $2^{m}\times 2^{m}$ matrix vector space. We first characterize the effect that Eve’s attack has on the unencoded message: $\left|\psi\right>\otimes{\left|0\right>}^{\otimes e}$.

Claim 3.1

Let $\rho=\left|\psi\right>\left<\psi\right|\otimes{\left|0\right>}^{\otimes e}$ be the state of Alice before the application of the Clifford operator. For any attack $U=\sum_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ by Eve, Bob’s state after decoding is $s\rho+\frac{1-s}{4^{m}-1}\sum_{P\neq\mathcal{I}}P\rho P^{\dagger}$, where $s=\mbox{Tr}(U_{I}\rho_{E}U_{I}^{\dagger})$.

We proceed with the proof of the theorem. From the above claim we know what Bob’s state after Eve’s intervention is and we would like to bound its projection on $P_{0}^{\left|\psi\right>}$ (defined in equation 4):

[TABLE]

By definition of $\Pi_{0}^{\left|\psi\right>}$ we see that $\mbox{Tr}(\Pi_{0}^{\left|\psi\right>}\rho)=0$. On the other hand: $\mbox{Tr}{(\Pi_{0}^{\left|\psi\right>}Q\rho Q^{\dagger})}\leq 1$ when $Q$ does not flip any auxiliary qubits, and vanishes otherwise. The Pauli operators that do not flip auxiliary qubits can be written as $Q^{\prime}\otimes Q^{\prime\prime}$ where $Q^{\prime}\in\mathbbm{P}_{l}$ and $Q^{\prime\prime}\in\{\mathcal{I},Z\}^{\otimes e}$. It follows that the number of such operators is exactly $4^{l}2^{e}$. Omitting the identity $\mathcal{I}_{m}$ we are left with $4^{l}2^{e}-1$ operators which are undetected by our scheme. We return to Eq. 43:

[TABLE]

The security follows from the fact that $1-s\leq 1$, and hence the projection is bounded by $\frac{1}{2^{e}}$. This concludes the proof. $\Box$

We remark that the above proof in fact implies a stronger theorem: interventions that are very close to $\mathcal{I}$ are even more likely to keep the state in the space defined by $\Pi_{1}^{\left|\psi\right>}$.

3.2 Proof of Claim 3.1

Let $U=\sum_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ be the operator applied by Eve. We denote $\rho=\left|\psi\right>\left<\psi\right|\otimes\left|0\right>\left<0\right|^{\otimes e}$ the state of Alice prior to encoding. Let us now write $\rho_{Bob}$, the state of Bob’s system after decoding and before measuring the $e$ auxiliary qubits. For clarity of reading we omit the normalization factor $|\mathfrak{C}_{m}|$ and denote the Clifford operation applied by Alice (Bob) $C$ ($C^{\dagger}$):

[TABLE]

At this point, we require the following lemma which states that a random Clifford conjugating an operator has the effect of decohering (removing the cross terms) of the operator:

Lemma 3.2** (Clifford Decoherence)**

Let $\rho^{\prime}$ be a density matrix on $m^{\prime}>m$ qubits and let $U=\sum\limits_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ be a matrix acting on $\rho^{\prime}$ by conjugation. Then

[TABLE]

The proof of the above lemma is in Section 3.3. Applying Lemma 3.2, we have

[TABLE]

We now require the following lemma, which allows us to trace out the extra space a prover may use as part of his attack. See Section 3.3 for the proof:

Lemma 3.3

Let $U=\sum_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ be a unitary operator acting on $m^{\prime}>m$ qubits. For any density matrix $\tau$ acting on the last $m^{\prime}-m$ qubits:

[TABLE]

We apply Lemma 3.3 to write Bob’s state as:

[TABLE]

for $s=\mbox{Tr}({U_{\mathcal{I}}\rho_{E}U_{\mathcal{I}}^{\dagger}})$, which concludes the proof of Claim 3.1.

3.3 Proofs of Technical Lemmas

In this section we prove Lemma 3.2 and Lemma 3.3.

3.3.1 Proof of Lemma 3.2

To prove Lemma 3.2, we require the following three lemmata, which we prove in Appendix C. The lemma below states that applying a random Clifford operator in $\mathfrak{C}_{m}$ (by conjugation) to a non identity Pauli operator $P\in\mathbbm{P}_{m}$ maps it to a Pauli operator $Q\in\mathbbm{P}_{m}$ chosen uniformly over all non-identity Pauli operators:

Lemma 3.4** (Pauli Partitioning by Cliffords)**

For every $P,Q\in\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$ it holds that : $\left|\left\{C\in\mathfrak{C}_{m}|C^{\dagger}PC=Q\right\}\right|=\frac{\left|\mathfrak{C}_{m}\right|}{\left|\mathbbm{P}_{m}\right|-1}=\frac{\left|\mathfrak{C}_{m}\right|}{4^{m}-1}$.

The following two lemmas describe the effect of conjugating an operator by a random Pauli or Clifford operator. The lemma below (Lemma 3.5) is used in the proof of the lemma after it (Lemma 3.6), and since it will be useful also when we handle the polynomial codes based protocol later on, we state it here with generalized Pauli operators:

Lemma 3.5** (Pauli Twirl)**

Let $P\neq P^{\prime}$ be generalized Pauli operators. For any density matrix $\rho^{\prime}$ on $m^{\prime}>m$ qubits it holds that

[TABLE]

Lemma 3.6** (Clifford Twirl)**

Let $P\neq P^{\prime}$ be Pauli operators. For any density matrix $\rho^{\prime}$ on $m^{\prime}>m$ qubits it holds that

[TABLE]

We now proceed to the proof of Lemma 3.2:

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{CliffordDiscretization}}$:    We start with

[TABLE]

We use Lemma 3.6 and are left only with $P=P^{\prime}$

[TABLE]

We first consider the case were $P=\mathcal{I}$, then:

[TABLE]

On the other hand when, $P\neq\mathcal{I}$ by Lemma 3.4:

[TABLE]

$\Box$

3.3.2 Proof of Lemma 3.3

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{Decompose}}$:    We analyze the action of $U$ on the density matrix $\frac{1}{2^{m}}\mathcal{I}\otimes\tau$. We first notice that $U$ is a trace preserving operator, that is: $\frac{1}{2^{m}}\mbox{Tr}(U(\mathcal{I}\otimes\tau)U^{\dagger})=\frac{1}{2^{m}}\mbox{Tr}(\mathcal{I}\otimes\tau)=\mbox{Tr}{(\tau)}$. On the other hand it holds that:

[TABLE]

If $P\neq P^{\prime}$ then \mbox{Tr}\big{(}PP^{\prime\dagger}\big{)}=0, and therefore:

[TABLE]

It follows that $\mbox{Tr}(\tau)=\sum_{P\in\mathbbm{P}_{m}}\mbox{Tr}(U_{P}\tau U_{P}^{\dagger})$, which concludes the proof.

$\Box$

4 Quantum Interactive Proofs with Clifford Authentication

Protocol 4.1

Clifford based Interactive Proof for Q-CIRCUIT: Fix a security parameter $\epsilon$. Given is a quantum circuit consisting of two-qubit gates, $U=U_{N}{\ldots}U_{1}$, acting on $n$ input qubits with error probability reduced to $\leq\gamma$. The verifier chooses $n$ authentication keys $k_{1},\ldots,k_{n}\in\mathcal{K}_{e+1}$, where $e=\lceil{\log{\frac{1}{\epsilon}}}\rceil$. The verifier authenticates the input qubits of the circuit one by one using the Clifford QAS ; that is qubit $j$ is authenticated using operation $C_{k_{j}}$ on $e+1$ qubits. The verifier sends the authenticated qubits to the prover $\mathds{P}$. In round $i$ (for $1\leq i\leq N$), the verifier asks $\mathds{P}$ to return the qubits on which $U_{i}$ will act. The verifier decodes these qubits by applying the inverse Clifford operator. The verifier then applies $U_{i}$, authenticates the resulting qubits with new authentication keys and the same (unmeasured) auxiliary qubits and sends the qubits to $\mathds{P}$. In round $N+1$, the prover sends the verifier the first authenticatd qubit, which the verifier decodes and rejects if the auxiliary qubits are not valid. The verifier then measures the decoded qubit (which contains the result of the circuit) and accepts or rejects accordingly. In any case that the verifier does not get the correct number of qubits during the protocol he aborts.

Theorem 1.5  For $0<\epsilon<1$ and $\gamma<1-\epsilon$, Protocol 4.1 is a $\textsf{QPIP}_{O(\log(\frac{1}{\epsilon}))}$ with completeness $1-\gamma$ and soundness $\gamma+\epsilon$ for $\mbox{{Q-CIRCUIT}}_{\gamma}$.

The quantum communication is linear in the number of gates. For $\epsilon=\frac{1}{2}$, we get $e=1$, and so the verifier uses a register of $4$ qubits (2 per gate). In fact $3$ is enough, since each of the authenticated qubits can be decoded (or encoded and sent) on its own before a new authenticated qubit is handled.

4.1 Overall Proof of Theorem 1.5

Let us first analyze completeness:

Claim 4.1** (Completeness)**

For any $\gamma>0$, Protocol 4.1 is a QPIP protocol with completeness $1-\gamma$ for Q-CIRCUIT.

*Proof: * To prove completeness, we assume the prover is honest and we will show that if $x\in L$, the verifier accepts with probability $\geq 1-\gamma$. Since the prover is honest, the state at all times is indeed the correctly authenticated state of the circuit. Thus, the output qubit is indeed an authentication of a (possibly mixed) state, which if measured, outputs $1$ with probability $\geq 1-\gamma$ (the error in the circuit is $\leq\gamma$). The decoding of the output block received by the verifier will thus result in accept with probability $\geq 1-\gamma$. $\Box$

 

To prove that Protocol 4.1 has soundness $\gamma+\epsilon$, we will first observe that each round is essentially a run of the Clifford authentication scheme (the only difference is that the auxiliary qubits are not measured and checked by the verifier in each round). Let round $i$ be the round in which the verifier applies $U_{i}$. Each round can be seen as an authentication protocol on the 1 or 2 authenticated qubits requested by $V$; the rest of the qubits are independently authenticated and can therefore be thought of as the extra space of the verifier. Therefore, we can apply the main claim involved in the soundness proof of the authentication scheme (Claim 3.1) in each round to just the qubits requested by $V$.

 

We will use the claim below to prove soundness, and then we will prove the claim by induction:

Claim 4.2** (Clifford QPIP State Evolution)**

The state held by the prover at the start of round $i$ (before sending qubits for $U_{i}$ to the verifier) can be written as:

[TABLE]

where $C_{k}=C_{k_{1}}\otimes\cdots\otimes C_{k_{n}}$, $O^{i}$ is a unitary, $\rho_{i}=(U_{i-1}\cdots U_{1})\rho(U_{i-1}\cdots U_{1})^{\dagger}$ ($\rho$ is the initial density $n$ qubit matrix), and $\rho_{E_{i}}$ represents the prover’s extra space.

This is the claim, which, as mentioned in Section 1.4 of the introduction, uses the strong properties of Clifford decoherence (Lemma 3.2) to show that the attack of the prover can be passed through all rounds to the end of the protocol. Using this claim, we will prove soundness:

Claim 4.3** (Soundness)**

For any $\epsilon,\gamma>0$, Protocol 4.1 is a QPIP protocol with soundness $\gamma+\epsilon$ for Q-CIRCUIT.

*Proof: * Assume Claim 4.2 holds. Before the prover sends the verifier the first authenticated qubit in round $N+1$ (the final round), Claim 4.2 implies that his state is:

[TABLE]

Now we can average over all of the authentication keys except $k_{1}$, since they will not be used for decoding. After averaging, the prover’s state can be written as:

[TABLE]

Here we require the following lemma, which states that random Clifford operators acting on a state turn it into a maximally mixed state:

Lemma 4.4** (Clifford Mixing)**

For a matrix $\rho$ on spaces $A\otimes B$, where $A$ is the space of $n$ qubits and $n\in\mathbbm{N}$

[TABLE]

The proof of this lemma follows from a similar lemma which uses Pauli operators instead of Clifford operators:

Lemma 4.5** (Pauli Mixing)**

For a matrix $\rho$ on two spaces $A,B$

[TABLE]

The proofs of both Lemma 4.4 and Lemma 4.5 can be found in Appendix B. By applying Lemma 4.4,we can see that the averaging changes the state in the final round to:

[TABLE]

where

[TABLE]

and $A$ represents the space of all computational qubits other than the first. Now we proceed to write down the state after the verifier’s decoding. Namely, the verifier will decode by applying $C_{k_{1}}^{\dagger}$, and then we can average over $k_{1}$, obtaining:

[TABLE]

Now we can directly apply Claim 3.1 to obtain the state after decoding. This is done by replacing $\rho$ in the statement of Claim 3.1 with $\mbox{Tr}_{A}(\rho_{N+1})$ and replacing $\rho_{E}$ in the statement with $\rho_{AE_{N+1}}$. We would like to bound the projection of the state on $\Pi_{0}^{\left|1\right>}$:

[TABLE]

[TABLE]

Due to the circuit error $\gamma$, $\mbox{Tr}(\Pi_{0}^{\left|1\right>}\rho_{N+1})\leq\gamma$. The rest of the upper bound is exactly as in the proof of Theorem 1.4 (see the explanation linking equations 43 and 44), and the final upper bound is:

[TABLE]

$\Box$

4.2 Proof of Claim 4.2

We now proceed to the proof of the claim. We will require the following lemma, which we will prove after completing the current proof:

Lemma 4.6** (Unitary Commutation)**

For all unitaries $U$ acting on $A$, a space of $k$ qubits (for $k\in\mathbbm{N}$), and density matrices $\rho$ acting on $A\otimes B$, we have:

[TABLE]

We prove Claim 4.2 by induction. The base case is clear. For the inductive step, we assume the claim holds for round $i$ and show that it holds for round $i+1$. When the verifier requests the qubits needed for $U_{i}$, the prover sends back register $\mathcal{R}_{i}$, which contains the authenticated qudits required to apply $U_{i}$. Assume $\mathcal{R}_{i}$ is the first register of the state written below and that it contains 2 authenticated qudits. Then the prover sends back $\mathcal{R}_{i}$ from the state as given in the inductive step:

[TABLE]

We now write the state after the verifier decodes register $\mathcal{R}_{i}$ (and after averaging over the Clifford keys for register $\mathcal{R}_{i}$):

[TABLE]

Next, we can decompose $O^{i}$ as $\sum_{P\in\mathbbm{P}_{|\mathcal{R}_{i}|}}P\otimes O_{P}^{i}$, where $P$ acts on register $\mathcal{R}_{i}$ and $O_{P}^{i}$ acts on all other qubits (i.e. the remaining computational qubits as well as the extra space of the prover). Applying Lemma 3.2, we can write the state as:

[TABLE]

where $C_{k^{\prime}}=\mathcal{I}\otimes C_{k_{3}}\otimes\cdots\otimes C_{k_{n}}\otimes\mathcal{I}_{E}$. The verifier then applies the gate $U_{i}$ and authenticates register $\mathcal{R}_{i}$ with fresh keys $C_{\hat{k}_{1}}\otimes C_{\hat{k}_{2}}$. Let $U_{i}^{\prime}=(C_{\hat{k}_{1}}\otimes C_{\hat{k}_{2}})U_{i}$; this is the operation applied to the decoded state (given in equation 68) by the verifier. First observe the action of this operation on the first term of the decoded state; it is now:

[TABLE]

where $C_{\hat{k}}=(C_{\hat{k}_{1}}\otimes C_{\hat{k}_{2}}\otimes\mathcal{I})C_{k^{\prime}}$. To determine what happens to the second term of the decoded state in equation 68 after the verifier applies $U_{i}^{\prime}$, we will apply the unitary commutation lemma, Lemma 4.6. We first write the second term (after application of $U_{i}^{\prime}$) in a way which makes it easier to apply Lemma 4.6:

[TABLE]

Now we apply Lemma 4.6, obtaining that the above expression is equal to:

[TABLE]

[TABLE]

It follows that the entire state is:

[TABLE]

We require one last observation: as it stands, the above state consists of a superoperator acting on $C_{\hat{k}}(\rho_{i+1}\otimes\rho_{E_{i}})C_{\hat{k}}^{\dagger}$. To see that the above operation is a superoperator, note that it was obtained by conjugating a unitary by Clifford operators, and then averaging over the Clifford operators. By expanding the extra space from $\rho_{E_{i}}$ to $\rho_{E_{i+1}}$, we can instead assume we have a unitary $O^{i+1}$ acting on $C_{\hat{k}}(\rho_{i+1}\otimes\rho_{E_{i+1}})C_{\hat{k}}^{\dagger}$.

4.2.1 Proof of Lemma 4.6 (Unitary Commutation)

We obtain the following equality from Lemma 4.5:

[TABLE]

where $\rho$ is a matrix on spaces $A,B$ and $Q$ acts on $A$. We have:

[TABLE]

This concludes the proof.

5 Signed Polynomial Code Authentication Scheme

Let $\mathcal{K}_{m}$ be the set of pairs of Pauli and sign operators which will be used for authentication; i.e. $\mathcal{K}_{m}=\{(k,z,x)|k\in\{-1,1\}^{m},x,z\in F_{q}^{m}\}$.

Protocol 5.1

Polynomial Authentication protocol : Alice wishes to send the state $\left|\psi\right>$ of dimension $q$. She chooses a security parameter $d$, a code length $m=2d+1$, and selects $k^{\prime}=(k,z,x)\in\mathcal{K}_{m}$ at random.

• •

Encoding - $A_{k^{\prime}}$:* Alice applies $E_{k}$ to $\left|\psi\right>\otimes\left|0\right>^{\otimes m-1}$ to encode $\left|\psi\right>$ using the signed quantum polynomial code of polynomial degree $d$ (see Definition 2.7). She then applies the Pauli $Z^{z}X^{x}$ defined by $x,z\in F_{q}^{m}$ (i.e., for $j\in\{1,..,m\}$ she applies $Z^{z_{j}}X^{x_{j}}$ on the $j$’th qubit).*

• •

Decoding - $B_{k^{\prime}}$:* Bob applies the inverse of $A_{k^{\prime}}$; he applies $(Z^{z}X^{x})^{\dagger}$ followed by $E_{k}^{\dagger}$. Bob measures the $m-1$ auxiliary registers and declares the state valid if they are all [math], otherwise Bob aborts.*

Theorem 1.6  The polynomial authentication scheme as described in Protocol 5.1 is a QAS with security $\epsilon=2^{-d}$.

5.1 The Overall Proof of Theorem 1.6

The completeness of this protocol is trivial. We proceed to prove the security of the protocol. As in the proof of Theorem 1.4, we first show that any intervention made by the adversary can be broken down into a distribution over generalized Pauli interventions. This is given by the Pauli decoherence lemma, Lemma 5.1, which is the weaker analogue of the Clifford decoherence lemma (Lemma 3.2). We then state and prove the sign key security lemma (Lemma 5.2), which states that non identity Pauli interventions by the adversary on states authenticated with the signed polynomial code are detected with high probability. We note that the main difference between the polynomial and Clifford QAS proofs is the ease in which we can prove the security of each QAS against Eve’s non trivial Pauli interventions. In the Clifford case, this is easy because a random Pauli will change the auxiliary 0 states with high probability (see the explanation between equation 43 and equation 44 in the proof of Theorem 1.4). In the polynomial case, the sign key security lemma (Lemma 5.2) requires quite a few technical details.

 

Proof of $\bf{Theorem\leavevmode\nobreak\ \ref{thm:PolynomialAuth}}$:    We denote $\rho=\left|\psi\right>\left<\psi\right|\otimes\left|0\right>\left<0\right|^{\otimes e}$ the state of Alice prior to encoding. Let $U$ be the attack made by Eve on the joint system, including the message space $M$ and Eve’s environment $E$. Bob’s state prior to measuring but after applying the decoding operators is:

[TABLE]

At this point we require Lemma 5.1 (it is analogous to Lemma 3.2), which allows us to reduce general adversary interventions to adversary interventions which are generalized Pauli operators. The lemma states that a random Pauli conjugating an operator has the effect of decohering (removing the cross terms) of the operator (we will prove this lemma in Section 5.2):

Lemma 5.1** (Pauli Decoherence)**

Let $\rho$ be a matrix on $m^{\prime}>m$ qudits and let $U=\sum\limits_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ be a matrix acting on $\rho$. Then

[TABLE]

We decompose the attack $U$ made by Eve to $U=\sum_{P\in\mathbbm{P}_{m}}P\otimes U_{P}$ (where $P$ acts on the space $M$ and $U_{P}$ acts on the space $E$) and then apply the lemma to equation 79 by replacing $\rho$ in the lemma with $E_{k}\rho E_{k}^{\dagger}$, obtaining:

[TABLE]

We set \alpha_{P}=\mbox{Tr}{\big{(}U_{P}^{\dagger}U_{P}\rho_{E}\big{)}}. Bob’s state is now:

[TABLE]

Recall that we are interested in the projection of Bob’s state onto $\Pi_{0}^{\left|\psi\right>}$ (defined in equation 4), which can now be written as:

[TABLE]

[TABLE]

Notice that each term in the above sum represents a generalized Pauli attack on the signed polynomial code. We now provide a lemma which states that the signed polynomial code allows detection of adversary interventions which are generalized Pauli operators (we will prove this lemma in Section 5.3):

Lemma 5.2** (Sign Key Security)**

The signed polynomial code is $\frac{1}{2^{m-1}}$-secure against (generalized) Pauli attacks. More formally, for a density matrix $\rho=\left|\psi\right>\left<\psi\right|\otimes\left|0\right>\left<0\right|^{\otimes m-1}$ and a generalized Pauli operator $P\in\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$:

[TABLE]

We can now use the bound from Lemma 5.2 on each term in the sum in equation 84 to obtain:

[TABLE]

where the equality follows due to Lemma 3.3, which provides the following equality:

[TABLE]

$\Box$

Similarly to the random Clifford authentication scheme, interventions that are very close to $\mathcal{I}$ are even more likely to keep the state in the space defined by $P_{1}^{\left|\psi\right>}$.

We notice that in this scheme a $q$-dimensional system is encoded into a system of dimension $q^{m}=q^{2d+1}$ and achieves security of $\frac{1}{2^{m-1}}$. The Clifford QAS encodes a 2-dimensional system into a system of dimension $2^{1+e}$ and achieves security of $2^{-e}$. The polynomial scheme is somewhat worse in parameters (since $q$ must be at least 5), but still with exponentially good security.

To encode several registers, one can independently authenticate each register as in the Clifford case, but in fact we will see that we can use the same sign key $k$ for all registers, while still maintaining security. This property will be extremely useful in applying gates as part of the polynomial QPIP protocol and we will use it in Section 6. For more details on how gates are applied on top of the signed polynomial code, see Section 2.5.1.

5.2 Proof of Lemma 5.1

We will require the following lemma:

Lemma 5.3

For any two generalized Pauli operators $P$ and $Q$

[TABLE]

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{pauliID}}$:    From the observation about generalized Pauli operators in Sec. 2 we know that for any two generalized Pauli operators $P,Q$ $PQ=\beta QP$ where $\beta$ is some phase (of magnitude 1) dependent on $P$ and $Q$.

[TABLE]

$\Box$

We can now proceed to the proof:

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{PauliDiscretization}}$:    We start with:

[TABLE]

We regroup elements to write the above expression as

[TABLE]

We use Lemma 3.5 and are left only with $P=P^{\prime}$

[TABLE]

Now we use Lemma 5.3 :

[TABLE]

$\Box$

5.3 Proof of Lemma 5.2

In this section, we will prove Lemma 5.2 (security against Pauli attacks due to the sign key).

*Proof: * Our goal is to show for a density matrix $\rho=\left|\psi\right>\left<\psi\right|\otimes\left|0\right>\left<0\right|^{\otimes m-1}$ and a generalized Pauli operator $P\in\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$:

[TABLE]

Throughout this proof, we will ignore phases which come about from Cliffords conjugating Pauli operators or moving Pauli operators past each other. This is due to the format of $\rho_{B}$; whenever we manipulate $P$ to obtain a phase $\omega_{q}^{a}$, we obtain $\omega_{q}^{-a}$ by manipulating $P^{\dagger}$ in the same manner. We first need to develop tools to understand how a generalized Pauli attack affects a signed polynomial state. This is done in the following subsection, after which we will return to the proof of Lemma 5.2.

5.3.1 $k$-Correlated Pauli Operators

We begin with definitions and their corresponding properties, and then proceed to analyze how generalized Pauli operators affect a signed polynomial state.

Definitions and Properties

We now define what a correlated Pauli operator is:

Definition 5.1

For a sign key $k\in\{-1,1\}^{m}$, we will call a non identity Pauli operator $Q$ $k$-correlated if there exist one qudit states $\left|\psi\right>$ and $\left|\phi\right>$:

[TABLE]

In other words, $Q$ maps a state encoded with the signed polynomial code to another state with the same encoding and therefore cannot be detected. We will show that a non identity generalized Pauli operator $Q$ can be $k$-correlated for at most 2 sign keys $k$ according to the above definition. We will then show that for all sign keys $k$, all non identity Pauli operators $Q$ which are not $k$-correlated can be written as a product of a $k$-correlated Pauli operator $Q_{k}$ and a non identity, uncorrelated operator $\hat{Q}_{k}$ of a specific form. $\hat{Q}_{k}$ will always be detected by $B$’s decoding procedure, as it will change the auxiliary states. This implies that a non identity Pauli operator will be caught with probability $\frac{1}{2^{m-1}}$ (it will be caught for all but at most two sign keys for which it is $k$-correlated).

Next, we describe what a $k$-correlated Pauli $X$ operator looks like. We will require the following fact.

Fact 5.1

For $k,\hat{k}\in\{-1,1\}^{m}$ (where $k\neq\hat{k}$), there exist polynomials $f,g$ of degree at most $d$ such that

[TABLE]

only if $k=-\hat{k}$.

*Proof: * There must either be at least $d+1$ indices on which $k$ and $\hat{k}$ agree or at least $d+1$ indices on which they differ. First consider the case in which there are at least $d+1$ indices where they agree. Since the values of $k$ and $\hat{k}$ at these indices uniquely define $f$ and $g$, $f$ and $g$ must be equal. It follows that $k_{i}=\hat{k}_{i}$ for all $i$. If we instead consider the case when $k$ and $\hat{k}$ differ on at least $d+1$ indices, we obtain that $f$ is equal to $-g$ and therefore $k_{i}=-\hat{k}_{i}$. $\Box$

Claim 5.4

A non identity Pauli operator $X=X^{x}$ is $k$-correlated if and only if it has the following form:

[TABLE]

where $\beta$ is a phase with $|\beta|^{2}=1$, $f$ is a polynomial of degree at most $d$. The Pauli operator $X^{x}$ can be $k$-correlated for at most 2 sign keys $k$.

*Proof: * It follows by Definition 5.1 that

[TABLE]

is $k$-correlated. We will now show that if $X^{x}$ is $k$-correlated it must have the form above. An $X$ Pauli operator can only be $k$-correlated if it adds a low degree polynomial signed with $k$ to the encoded state it is acting on. Therefore, if it is $k$-correlated, it must equal

[TABLE]

for a polynomial $f$ of degree at most $d$. We now show that a non identity Pauli operator $X^{x}$ can be $k$-correlated for at most 2 sign keys. Assume now that $X$ is also $k^{\prime}$-correlated. By the argument above, it follows that it must equal

[TABLE]

for a polynomial $g$ of degree at most $d$. However, Fact 5.1 implies that either $k=k^{\prime}$ or $k=-k^{\prime}$. $\Box$

Next, we describe what a $k$-correlated Pauli $Z$ operator looks like:

Claim 5.5

A non identity Pauli operator $Z=Z^{z}$ is $k$-correlated if and only if it has the following form:

[TABLE]

where $\beta$ is a phase with $|\beta|^{2}=1$, $f$ is a polynomial of degree at most $d$ and $c_{i}$ is the interpolation coefficient defined in Lemma 2.3 with the following property:

[TABLE]

The Pauli operator $Z^{z}$ can be $k$-correlated for at most 2 sign keys $k$.

*Proof: * We first show that if $Z^{z}$ is $k$-correlated it must also have the form above. Assume that $Z^{z}$ for $z\in F_{q}^{m}$ is $k$-correlated. Then it follows from Definition 5.6 that there exist one qudit states $\left|\psi\right>$ and $\left|\phi\right>$ such that:

[TABLE]

Now if we apply a logical Fourier operator (described in Claim 2.4), the left hand side of the above equation becomes:

[TABLE]

where the last equality follows since $\tilde{F}$ is a logical operator (which is also proven in Claim 2.4). The right hand side of equation 101 becomes:

[TABLE]

Then (by setting the right and left hand side of the equations equal to each other) we have:

[TABLE]

Due to the conjugation properties of $\tilde{F}$ (for more details about the conjugation behavior of $\tilde{F}$, see the Fourier description in Section 2.4), we have (where $\alpha$ is a phase)

[TABLE]

and due to equation 105 we can see that the above operator is $k$-correlated. By Claim 5.4, the $X$ Pauli operator in equation 106 can be $k$-correlated for at most 2 sign keys $k$. It follows that the Pauli operator $Z^{z}$ can be $k$-correlated for at most 2 sign keys. Finally, if $Z^{z}$ is indeed $k$-correlated, we can combine the fact that the $X$ operator in equation 106 is $k$-correlated and Claim 5.4, to write $Z^{z}$ as:

[TABLE]

for a polynomial $f$ of degree at most $d$. We now need to show the opposite direction: if $Z^{z}$ can be written as

[TABLE]

it is $k$-correlated. To see this, we can obtain the following equality from equation 106

[TABLE]

Since this is a correlated $X$ operator, it follows by Definition 5.1 that $Z^{z}$ is a correlated $Z$ operator. $\Box$

We can extend the claims for $X$ and $Z$ Pauli operators to general Pauli operators:

Claim 5.6

A non identity Pauli operator can be $k$-correlated for at most 2 sign keys $k$.

*Proof: * Consider a non identity Pauli operator $Z^{z}X^{x}$. In order for it to be correlated, $X^{x}$ must add a low degree signed polynomial to a state encoded by $E_{k}$ which it is acting on. This means that $X^{x}$ is $k$-correlated. It follows by Claim 5.4 that if $x\neq 0$, the Pauli operator $Z^{z}X^{x}$ can be $k$-correlated for at most 2 sign keys $k$. If $x=0$, Claim 5.5 implies that the Pauli operator $Z^{z}X^{x}$ can be $k$-correlated for at most 2 sign keys. $\Box$

Correlation Properties of Generalized Pauli Operators

Now that we have defined $k$-correlation, we can see how a generalized Pauli operator will behave on a signed polynomial state. We begin by showing that for a fixed sign key $k$, a Pauli operator $Q$ can be broken down into a product of a $k$-correlated Pauli operator and an uncorrelated Pauli operator:

Claim 5.7

Let $k$ be a sign key and $Q\in\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$ be an uncorrelated Pauli operator. Then $Q=Z^{z}X^{x}$ can be written as

[TABLE]

where $Q_{k}$ is $k$-correlated and $\hat{Q}_{k}$ is uncorrelated (and in particular, non identity) and can be written (up to a phase) as:

[TABLE]

where if $z=0$, $(\hat{z}_{2},\ldots,\hat{z}_{d+1})=0^{d}$ and if $x=0$, $(\hat{x}_{d+2},\ldots,\hat{x}_{m})=0^{d}$.

*Proof: * Observe that a signed low degree polynomial is determined by $d+1$ points. For a given sign key $k$ and $d+1$ points $y_{i_{1}},\ldots,y_{i_{d+1}}\in F_{q}$, where $i_{1},\ldots,i_{d+1}\in\{1,\ldots,m\}$, let

[TABLE]

be the signed polynomial that is obtained by interpolating the $d+1$ points $y_{i_{1}},\ldots,y_{i_{d+1}}$. Let:

[TABLE]

For $Q=Z^{z}X^{x}=Z^{z_{1}}X^{x_{1}}\otimes\cdots\otimes Z^{z_{m}}X^{x_{m}}$, we claim that

[TABLE]

is $k$-correlated. Claims 5.4 and 5.5 imply that both the $Z$ and $X$ operators of $Q_{k}$ are $k$-correlated. It follows by the definition of a $k$-correlated operator (Definition 5.1) that the product of two $k$-correlated operators ($Q_{k}$ in this case) is $k$-correlated. Now we define $\hat{Q}_{k}$ such that:

[TABLE]

It can be readily checked, using the definition of $Q_{k}$ in equation 114, that $\hat{Q}_{k}$ is of the following form (up to a phase):

[TABLE]

Observe that $\hat{Q}_{k}$ as written in the above equation is uncorrelated. If it was $k$-correlated, then $Q$ would be a product of two $k$-correlated operators ($Q_{k}$ and $\hat{Q}_{k}$) which implies that $Q$ is also $k$-correlated, which contradicts our starting assumption that $Q$ is uncorrelated. Observe also that the last line of the claim (about the implication of $z=0$ or $x=0$) follows immediately from the definitions of $Q_{k}$ and $\hat{Q}_{k}$. $\Box$

Observe that an operator of the form of $\hat{Q}_{k}$ is always detected, as it will change the auxiliary qudits:

Claim 5.8

For all one qudit states $\left|\psi\right>$ and $\left|\phi\right>$ and a fixed sign key $k\in\{-1,1\}^{m}$, an uncorrelated operator $\hat{Q}_{k}$ of the form described in Claim 5.7 in equation 111 satisfies the following equation:

[TABLE]

*Proof: * We claim the following equality holds up to a phase:

[TABLE]

Recall (from Section 2.5.2) that

[TABLE]

The conjugation behavior of $E_{k}^{\dagger}$ can be determined by looking at the conjugation properties of Clifford operators (see Section 2.4). As a brief description, recall from Section 2.5.2 that $E_{k}^{\dagger}$ consists of the interpolation circuit ($D_{k}^{\dagger}$), which is a series of inverse controlled sum operations and an inverse multiplication operator on the first register (see Claim 2.6). The final operation in $E_{k}^{\dagger}$ is an inverse Fourier transform ($(\mathcal{I}\otimes F^{\otimes d}\otimes\mathcal{I})^{\dagger}$). Using the conjugation properties given in equations 21, 23, and 22 in Section 2.4, we obtain the following equalities. Inverse sum operations have the following conjugation behavior (up to a phase):

[TABLE]

where the SUM operator above is controlled by the left register. The inverse multiplication operation, $M_{r}^{\dagger}$ (for $r\neq 0$), has the following conjugation behavior (up to a phase):

[TABLE]

Fourier operations have the following conjugation behavior (up to a phase):

[TABLE]

The inverse sum operations in $D_{k}^{\dagger}$ have no effect on $\hat{Q_{k}}$, since the target registers (registers $1,d+2,\ldots,m$) never have a non zero $Z$ coefficient in equation 118 and the control registers (registers $1,\ldots,d+1$) never have a non zero $X$ coefficient in equation 118. In other words, the coefficients $x_{1}$ and $z_{2}$ in equation 120 will be 0. The multiplication operation (which is in between the inverse sum operations) similarly has no effect on $\hat{Q}_{k}$; it is acting on the first register, for which both the $Z$ and $X$ coefficient are 0 (since it is $\mathcal{I}$). The inverse Fourier operation flips the $Z$ operators of registers $2,\ldots,d+1$ to $X$ operators.

Now, returning to equation 118, since $\hat{Q}_{k}$ was not equal to the identity, it will make at least one of the auxiliary qudits nonzero (recall that the auxiliary qudits are contained in registers $2,\ldots,m$). $\Box$

5.3.2 Proof of Lemma 5.2

We now use the concepts we developed in the above section to prove Lemma 5.2. To summarize, what we have shown is that for each sign key $k$, a generalized non identity Pauli operator $Q$ can be broken down into a product of a $k$-correlated operator $Q_{k}$ and an uncorrelated operator $\hat{Q}_{k}$ (Claim 5.7). The uncorrelated operator $\hat{Q}_{k}$ will always be detected (Claim 5.8) and will only be non identity for at most 2 sign keys $k$ (Claim 5.6). Therefore, $Q$ can only preserve a signed polynomial state for at most 2 sign keys $k$.

Recall that we would like to upper bound the following expression:

[TABLE]

By Claim 5.6, $P$ can be $k$-correlated for at most 2 sign keys $k$. Consider one $k$ in the above sum for which $P$ is not $k$-correlated. We can now apply Claim 5.7, to obtain that the term is equal to

[TABLE]

where the second equality follows from the fact that $P_{k}$ is a $k$-correlated operator and the final equality follows from Claim 5.8. Then we only obtain a non zero expression when $P$ is $k$-correlated. It follows that

[TABLE]

$\Box$

6 Quantum Interactive Proofs with Polynomial Authentication

In this section, we give a QPIP for Q-CIRCUIT (providing another proof for Theorem 1.1) using the signed polynomial encoding from the previous section. The key advantage of this protocol is that the prover can perform the gates on top of the encoding without knowing the encoding itself. This means that the prover does not need to hand back the qudits to the verifier in order for the verifier to perform the gates; the prover can perform them on his own. This also means that only one way quantum communication is required (the verifier only needs to send qudits at the start of the protocol, and the rest of the communication is classical).

The key disadvantage of this protocol is the relative difficulty of proving soundness in comparison to the Clifford QPIP protocol (Theorem 1.5). This difficulty arises due to the difference between Lemma 5.1 (Pauli decoherence) and Lemma 3.2 (Clifford decoherence). The strength of Clifford decoherence allows us to prove Claim 4.2 (the Clifford state evolution claim), which states that the prover’s state throughout the protocol is the correct authenticated state (i.e. the state with the gates applied as requested by the verifier) with an attack independent of the authentication acting on top of it. Essentially, this is because Claim 4.2 uses the unitary commutation lemma, Lemma 4.6, and the Clifford decoherence lemma, Lemma 3.2, to change any logical attack (an attack acting inside the authentication) to an attack outside of the authentication (which no longer preserves the authenticated state). Claim 4.2 then allows us to reduce the soundness of the Clifford QPIP to the security of the Clifford QAS.

We cannot use Pauli decoherence (Lemma 5.1) to prove a claim analogous to Claim 4.2 in the polynomial case for the following reason. Lemma 5.1 shows that averaging over the Pauli conjugations of an operator removes cross terms, thereby mapping the operator to a convex sum over Pauli operators. Lemma 3.2 shows that averaging over the Clifford conjugations of an operator not only maps the operator to a convex sum over Pauli operators, but goes one step further to map each non identity Pauli operator to a unifrom mixture over all non identity Pauli operators. This uniform mixture is crucial to the proof of Claim 4.2; the key part of the proof is the application of the unitary commutation lemma (Lemma 4.6) to the mixture, which allows us to shift the prover’s attacks to the end of the protocol.

Since we do not have a claim analogous to Claim 4.2 for the polynomial QPIP, we instead have to monitor how the authenticated state changes throughout the protocol, as a function of the prover’s deviation. At a high level, we do this by partitioning the Hilbert space of the prover according to the interaction transcript (as done in [FK12]). In each partition, the transcript is fixed at the start and then the measurement results of the state are projected onto the fixed transcript to enforce consistency. This method is formalized in Claim 6.1, which describes the state shared by the verifier and prover throughout the protocol.

Now since each partition has a fixed interaction transcript, we can shift the prover’s attack to the end of the protocol (his attack no longer determines the interaction transcript). After shifting the prover’s attack, we can analyze each partition using the same main ideas we used to prove security of the polynomial QAS (Pauli decoherence from Lemma 5.1 and sign key security from Lemma 5.2).

We begin by discussing how to apply gates on top of the signed polynomial authentication (Section 6.1). We then describe the protocol, introduce necessary notation and assumptions and conclude with proving the soundness and completeness of the protocol.

6.1 Application of Quantum Gates

We will describe how the prover performs a set of universal gates (consisting of the Fourier transform and Toffoli gate) on authenticated qubits by applying only Clifford operators which do not require knowledge of the Pauli or sign keys. The prover does this by using classical communication with the verifier and authenticated Toffoli states sent by the verifier. As described in Section 2.3.1, if given an authenticated Toffoli state, a Toffoli gate can be applied using logical Pauli, SUM and Fourier operations, along with measurement. We now describe how to apply these operations on authenticated states, which will complete our description of how the prover performs a universal set of gates.

6.1.1 Pauli Operations

To apply Pauli $X$ and $Z$ operations, the verifier only needs to update his Pauli keys and the prover does not need to do anything. Recall from Section 2.5.1 that the logical ${\widetilde{X}}_{k}$ operator consists of an application of $X^{k_{1}}\otimes,{\ldots}\otimes X^{k_{m}}$ where $k\in\{-1,1\}^{m}$ is the sign key. We claim that this operation can be applied to the authenticated state by the verifier simply changing his Pauli key from $(x,z)$ to $(x-k,z)$. This is because:

[TABLE]

The $Z$ operator is performed in the same manner as the $X$ operator; all that is needed is a change of the Pauli key. We recall that ${\widetilde{Z}}_{k}=Z^{c_{1}k_{1}}{\otimes{\ldots}\otimes}Z^{c_{m}k_{m}}$. We define the vector $\mathbf{t}$ to be $t_{i}=c_{i}k_{i}$. From the same argument as above, it holds that the change of keys must be $(x,z)\rightarrow(x,z-\mathbf{t})$.

6.1.2 Fourier and SUM Operations

To apply Fourier and SUM operations, the verifier needs to update his Pauli keys and the prover needs to apply the corresponding logical gate. For the SUM gate, the prover applies the logical SUM gate (${\widetilde{\textit{SUM}}}$ as given in Section 2.5.1) and the verifier updates his pair of keys (for $x_{A},z_{A},x_{B},z_{B}\in F_{q}^{m}$) from $(x_{A},z_{A}),(x_{B},z_{B})$ to $(x_{A},z_{A}-z_{B})$ and $(x_{B}+x_{A},z_{B})$ where $A$ is the control register and $B$ is the target register. This is because the logical SUM operator is applied on top of the Pauli keys, and must be shifted past. The update operations of the verifier essentially perform this shift:

[TABLE]

where the last equality is up to a global phase and follows due to the conjugation properties given in Section 2.4.

The Fourier gate is applied in a similar way; the prover applies the logical Fourier transform ${\widetilde{F}}$ given in Section 2.5.1 (Claim 2.4) and the verifier updates his keys according to the conjugation behavior of ${\widetilde{F}}$, which we can determine from Section 2.4. The following equality is up to a global phase:

[TABLE]

Therefore, for each register $i$, the verifier must change the key from $(x_{i},z_{i})$ to $(-c^{-1}_{i}z_{i},c_{i}x_{i})$.

6.1.3 Measurement

The prover measures the encoded state in the standard basis and sends the resulting string in $F_{q}^{m}$ to the verifier. The verifier first removes the entire Pauli key. Note that we are assuming a classical verifier can remove the $Z$ portion of the Pauli key; this is because the Pauli key is acting on a measured string, and phase gates have no effect on standard basis strings. Therefore, applying a $Z$ operator is the same as not applying it. We choose to assume the verifier does apply it because it simplifies the soundness proof of the protocol (specifically, it comes up in the proof of Claim 6.3). The verifier then applies $D_{k}^{\dagger}$ (see Section 2.5.2), obtaining a string $\delta\in F_{q}^{m}$. If the prover requires the decoded measurement result, the verifier sends the prover the first coordinate of $\delta$ (which should contain the value of the polynomial at 0). If the last $d$ coordinates of $\delta$ are not 0, the verifier records the measurement as invalid and aborts at the end of the protocol.

 

Observe that the verifier is not applying $E_{k}^{\dagger}$ (the full decoding circuit). It turns out that this is actually enough for the interactive protocol, since we only need to be able to catch attack operators involving Pauli $X$ deviations. Attack operators involving $Z$ deviations will not change measurement results. We will see below (in Corollary 6.9) that applying $D_{k}^{\dagger}$ and checking the appropriate auxiliary qudits allows the verifier to catch Pauli $X$ deviations.

6.1.4 Conversion to Logical Circuit

Now that we have described how to apply gates, we can describe how to convert a quantum circuit on $n$ qubits consisting of gates from the above universal set, $U=U_{N}\cdots U_{1}$, into a logical circuit acting on authenticated states. Assume $U$ contains $L$ Toffoli gates. Then

[TABLE]

where $A_{i}$ is a Clifford circuit. To apply $U$ to authenticated states, we instead apply

[TABLE]

where $\tilde{A}_{L}$ denotes a logical operation, as described above. Each $\tilde{T}_{i}$ involves Clifford entanglement operations (which we will denote by $\tilde{B}_{i}$) with a new magic state followed by a measurement, the results of which are sent to the verifier. Assume that the $i^{th}$ measurement result decodes to $\beta_{i}\in F_{q}^{3}$. Then $\tilde{T}_{i}$ consists of $\tilde{B}_{i}$, followed by measurement, followed by correction $\tilde{C}_{\beta_{i}}$ (which is the logical version of $C_{\beta_{i}}$ - see Section 2.3.1 for a reminder of how the Toffoli gate is applied). Now combine the Clifford entangling operators with the preceding Clifford operators in the circuit:

[TABLE]

where $B_{L+1}=\mathcal{I}$. Then to apply $U$ to authenticated states, we first apply $\tilde{Q_{0}}$. Then for $1\leq i\leq L$, we measure, obtaining $\beta_{i}\in F_{q}^{3}$, and then apply $\tilde{Q_{i}}\tilde{C}_{\beta_{i}}$.

Properties of Toffoli Gate by Teleportation

In order to prove soundness of the polynomial QPIP, we will need to better understand the result of applying a circuit using Toffoli states (as described immediately above in Section 6.1.4). More specifically, this understanding will come in to play when we are analyzing the behavior of Pauli attacks on the state at the end of the protocol (this is done in Claim 6.4 and Claim 6.5). In this section, we will not work with logical operators and authenticated qudits, but with unauthenticated qudits. However, the analysis can immediately be extended to authenticated qudits. To begin, assume the measurement results $\beta_{i}\in F_{q}^{3}$ of each Toffoli gate are fixed beforehand. Then the circuit which will be applied (as described above) is:

[TABLE]

We will now provide a fact (used in Claim 6.4 and Claim 6.5) which characterizes what the state looks like (including measurement results) after applying the circuit in equation 138 on $n+3L$ qudits (the circuit acts on $n$ input qudits initially in state $\left|\phi\right>$ and $L$ Toffoli states of 3 qudits each):

Fact 6.1

For a string $\beta=(\beta_{1},\ldots,\beta_{L})\in F_{q}^{3L}$, where $\beta_{i}\in F_{q}^{3}$, the result of applying

[TABLE]

to

[TABLE]

is

[TABLE]

where $\left|\phi\right>$ is a state on $n$ qudits and $\left|\psi\right>_{\beta,l}$ is a state on $n$ qudits which equals $U\left|\phi\right>$ if $\beta=l$.

Before proving the fact, observe that if we project the first register containing $l$ onto $\beta$, we obtain the state $U\left|\psi\right>$. This makes sense; if the measurement results obtained are the same ones we fixed for the Clifford corrections, then each Toffoli gate is applied as intended. Moreover, note that without this projection, each $\l\in F_{q}^{3L}$ is equally probable. We now prove the fact.

Proof of $\bf{Fact\ref{fact:teleportationstate}}$:    First consider what happens if we would like to apply one Toffoli (as described above) to a 3 qudit state $\left|\psi\right>$ using a magic state. After the Clifford operations entangling $\left|\psi\right>$ and the magic state, but preceding the measurement (i.e. at the stage of equation 17), the state is:

[TABLE]

We can write the state in this format because we know that when the measurement result is $x,y,z$, the operation $T(X^{x}\otimes X^{y}\otimes Z^{z})T^{\dagger}$ corrects the state to $T\left|\psi\right>$. Let’s swap the first 3 registers with the last 3 registers (to be consistent with how the state is written in Fact 6.1). The state is now:

[TABLE]

Now let’s assume the correction operator applied is $T(X^{a}\otimes X^{b}\otimes Z^{c})T^{\dagger}$. The result is:

[TABLE]

where

[TABLE]

Observe that

[TABLE]

In other words, when the correction $\beta$ matches the measurement result $l$, we get the desired result: the application of a Toffoli gate to the initial state. To prove the fact, the above analysis is simply applied each time the Toffoli protocol is performed. $\Box$

6.2 Protocol Description

Protocol 6.1

Polynomial based Interactive Proof for Q-CIRCUIT Fix a security parameter $\epsilon$. Given is a quantum circuit on $n$ qubits consisting of gates from the above universal set, $U=U_{N}{\cdots}U_{1}$, which can be converted to a logical circuit on authenticated qudits as in Section 6.1.4. We assume there are $L$ Toffoli gates. We assume the circuit $U$ has error probability $\leq\gamma$. The verifier sets $m=\lceil{\log{\frac{1}{\epsilon}}}\rceil+1$, $d=\frac{m-1}{2}$ and uses $3$ registers of $m$ qudits each, where each qudit is of dimensionality $q>m$. The verifier uses the polynomial QAS with security parameter $d$ to authenticate $n$ input qudits and $L$ Toffoli states and sends the authenticated states to the prover. The verifier uses the same sign key (but independent Pauli keys) for each state. This is done sequentially using $3m$ qudits at a time. Round 0 consists of the prover and verifier performing the Clifford gates $\tilde{Q}_{0}$. At the start of round $i$, for $1\leq i\leq L$, the prover and verifier perform the measurement (as described in Section 6.1.3) on the $3m$ qudits as required for the $i^{th}$ Toffoli gate. The verifier sends the prover the decoded measurement result, and then they jointly perform the Clifford corrections required to complete the Toffoli gate and the Clifford circuit $\tilde{Q}_{i}$. In round $L+1$ (the final round), the verifier and prover perform the measurement of the first authenticated qudit (the verifier does not provide the prover with the decoded measurement result). The verifier aborts if the measurement results from any round were stored as invalid (see Section 6.1.3). If he does not abort, he accepts or rejects according to the final decoded measurement outcome.

Theorem 1.7  For $0<\epsilon<1$ and $\gamma<1-\epsilon$, Protocol 6.1 is a $\textsf{QPIP}_{O(\log(\frac{1}{\epsilon}))}$ protocol with completeness $1-\gamma$ and soundness $\gamma+\epsilon$ for $\mbox{{Q-CIRCUIT}}_{\gamma}$.

 

This theorem implies a second proof for Theorem 1.1. The size of the verifier’s register is naively $3m$, but using the same idea as in the Clifford case, $m+2$ suffice. As a reminder, the idea is to send qudits as they are encoded. For the Toffoli state, the verifier begins with 3 qudits, encodes the first one (using $m+2$ registers at this point), sends the first encoded qudit to the prover, and continues. With $\epsilon=1/2$, $m=3$ (because $m=2d+1$) giving a register size of 5 qudits of dimension 5 (since $q>m$). Before we provide the proof of the theorem, we introduce some necessary notation and make several observations about the protocol described above.

6.3 Assumptions

• •

The prover’s messages are quantum states. Note that although in the protocol the prover sends the verifier classical strings which the verifier then decodes, we can instead assume that the prover sends the verifier qudits, then the verifier decodes and finally measures. This is because the verifier’s decoding operations (which consist of removing Pauli keys and applying $D_{k}^{\dagger}$, as described in Section 6.1.3) commute with standard basis measurement. In other words, if you consider an $m$ qudit density matrix $\rho$, the following equality holds:

[TABLE]

• •

The prover’s deviation can be delayed until the end of each round. In round $i$ (for $i\geq 1$), we can assume without loss of generality that the prover measures, sends the results to the verifier, receives the decoded measurement results $g(\delta_{i})$ from the verifier, and then applies a unitary $\hat{V}_{g(\delta_{i})}$ to the authenticated qudits and his extra space. Anything the prover does before the measurement can be shifted to the previous round. $\hat{V}_{g(\delta_{i})}$ can be written as

[TABLE]

In other words, we can assume that the prover measures, applies the unitaries requested by the verifier in round $i$ ($\tilde{Q}_{i}\tilde{C}_{\beta_{i}}$) and then applies a unitary attack $V_{g(\delta_{i})}$. Using similar reasoning, in round 0, we can assume the prover first applies $\tilde{Q}_{0}$ as requested and then applies a unitary attack.

6.4 Notation

Now we provide some of the notation that will be used in the proof. Please see the notation tables in Appendix E for all notations together, which hopefully will help in reading this part of the paper, since it is quite heavy on notation. First, throughout this protocol, we will refer to $Z$ and $\mathcal{I}$ Pauli operators as trivial and all other Pauli operators (Pauli operators containing the $X$ operator) as non trivial. This is because, as noted in Section 6.1.3, trivial Pauli operators cannot change measurement results and non trivial Pauli operators can. Therefore, we only need to ensure that the verifier can detect non trivial Pauli operators.

 

For strings $b_{1},\ldots,b_{j}\in F_{q}^{m}$, let

[TABLE]

where $b_{i}(1)\in F_{q}$ is the first value of the string. This is referred to as the decoded value of a measurement result, as it is the value the verifier will return to the prover after decoding the prover’s measurement result.

 

If the prover decides to deviate from the protocol, he can apply unitary operators to both the qudits sent by the verifier and his environment. We call the register corresponding to his environment $\mathcal{E}$. For convenience, we also label the other registers of the quantum state shared between the prover and verifier as follows. Note that at the start of round 0, the total number of qudits sent to the prover by the verifier is $m^{\prime}=3mL+mn$. In every following round, except round $L+1$, $3m$ qudits (which are to be measured) are sent to the verifier ($m$ qudits to be measured are sent in round $L+1$). For $i\geq 1$, we call the register containing all authenticated qudits left at the prover’s hands at the beginning of round $i$ (equivalently at the end of round $i-1$) register $\mathcal{P}_{i}$ (it holds $m(3(L-i+1)+n)$ qudits). We call the register containing all the qudits sent to the verifier in rounds $1,\ldots,i-1$ register $\mathcal{V}_{i}$ (it holds $3m(i-1)$ qudits and is held by the verifier). We also add another register to the verifier’s space (which we call the key register): at the start of round $i$, it contains the state $\tau_{i}(z,x,k)$, which carries the memory of the sign key $k$ and the Pauli keys $x,z\in F_{q}^{|\mathcal{P}_{i}|}$ for those qudits still held by the prover (qudits in register $\mathcal{P}_{i}$). More precisely:

[TABLE]

Note that we are assuming the verifier no longer keeps record of the Pauli keys for qudits which were already sent to him by the prover; after the verifier uses these Pauli keys to decode, he traces them out of the key register.

 

Given this notation, we can now provide Figure 1 as an illustration of Protocol 6.1.

6.5 Overall Proof of Theorem 1.7

*Proof: * The completeness is trivial, similarly to the Clifford case (see Theorem 1.5). To prove soundness, recall that we begin with a Q-CIRCUIT instance, $U$, which takes as input $\left|y\right>^{\otimes n}$ (where $y$ is a classical $n$ bit string), and for soundness we would like to show that if the first qudit of $U\left|y\right>^{\otimes n}$ is 0 with probability $1-\gamma$, the verifier will either abort or not accept the final decoded measurement result with probability $\geq 1-(\gamma+\epsilon)$, which gives the soundness parameter of $\gamma+\epsilon$. To do this, we will characterize how the prover’s state evolves throughout the protocol.

When each qudit is sent to the verifier at the start of round $i$ as part of the application of the Toffoli gate, the verifier will apply the inverse of the appropriate Pauli keys, interpolate with operator $D_{k}^{\dagger}$ (see Definition 2.8), and measure the $3m$ received qudits. Let the result of this measurement be $\delta_{i}\in F_{q}^{3m}$. We thus denote the effect of the measurement with this result by the projection $\left|\delta_{i}\right>\left<\delta_{i}\right|$ conjugating the density matrix (for $\delta_{i}\in F_{q}^{3m}$). Of course we will sum over all the different values of $\delta_{i}$. Next (in all rounds except round $L+1$), the verifier will send the prover the decoded measurement results $g(\delta_{i})$ so the prover will be able to apply the Clifford correction $C_{g(\delta_{i})}$, as written in equation 19. The verifier will then instruct the prover to apply the next set of Clifford gates $\tilde{Q}_{i}$ in the circuit. Since the verifier sent the prover $g(\delta_{i})$, the prover’s next attack can be dependent on this value.

We now provide the claim characterizing the state shared between the prover and the verifier, as a summation over all of the measurement results from previous rounds ($\Delta_{i-1}=(\delta_{1},\ldots,\delta_{i-1})$):

Claim 6.1** (Polynomial QPIP State Evolution)**

For $1\leq i\leq L+1$, the state shared by the prover and the verifier at the start of round $i$ can be written as:

[TABLE]

where $m^{\prime}=3mL+mn$,

[TABLE]

[TABLE]

where $U_{g(\Delta_{i-1})}$ is a unitary operator dependent on $g(\Delta_{i-1})$ and

[TABLE]

for $\Delta_{i-1}=(\delta_{1},\ldots,\delta_{i-1})\in F_{q}^{|\mathcal{V}_{i}|}$, where $\rho$ is the initial state on $3L+n$ qubits (consisting of $L$ Toffoli states and an $n$ qudit input state), $\rho^{k}$ indicates authentication as described in equation 25, and $\rho_{\mathcal{E}}$ is the initial state of the prover’s environment.

The projection $\left|\Delta_{i-1}\right>\left<\Delta_{i-1}\right|$ denotes the verifier’s measurement (it acts on register $\mathcal{V}_{i}$), part of which has been sent back to the prover in the form of $g(\Delta_{i-1})$ (hence the dependence of $U$ and $\rho^{k}$ on $g(\Delta_{i-1})$).

As a brief aside, recall that (as mentioned at the start of Section 6) one key difference between the Clifford and polynomial protocols is that the authenticated state throughout the polynomial protocol is not necessarily the correct authenticated state (i.e. the authentication of the state which would result by applying the Q-CIRCUIT instance $U$). This can be seen by observing the form of $\rho^{k}_{g(\Delta_{i-1})}$. Note that if the projection $\left|\Delta_{i-1}\right>\left<\Delta_{i-1}\right|$ acted directly on the state, it would indeed be the correct state. However, the projection acts after the attack $U_{g(\Delta_{i-1})}$, which implies that if $U_{g(\Delta_{i-1})}$ acts non trivially on register $\mathcal{V}_{i}$, $\rho^{k}_{g(\Delta_{i-1})}$ will not necessarily be the correct authenticated state.

Before we proceed with the proof of soundness, we will write down the state at the start of round 1 as an example of how Claim 6.1 works. At the start of round 1, the state shared between the verifier and the prover is:

[TABLE]

where $\rho^{k}$ is the initial state of the qudits sent to the prover and $V_{0}$ is the unitary attack of the prover applied at the end of round 0. Note that as the prover and verifier performed the Clifford operator $\tilde{Q}_{0}$, the verifier updated his initial Pauli keys to account for this operator (as described in Section 6.1). This is why the Pauli operator $Z^{z}X^{x}$ acts after $\tilde{Q}_{0}$ on $\rho^{k}$ in equation 154. As you can see, Claim 6.1 holds for $i=1$.

We now proceed with the proof of soundness. Claim 6.1 implies that at the start of the final round, round $L+1$, the joint state of the prover’s registers, $\mathcal{P}_{L+1}$ and the environment $\mathcal{E}$, and the verifier’s registers, $\mathcal{V}_{L+1}$ and the key register containing the sign key and Pauli keys of qudits in $\mathcal{P}_{L+1}$, is:

[TABLE]

As in previous rounds, the verifier decodes the final authenticated qudit sent by the prover, with both the Pauli and sign key. Let $\mathcal{F}$ denote the register containing the final authenticated qudit. Let $\mathcal{P}_{final}$ denote the register of the remaining authenticated qudits (this contains all qudits in $\mathcal{P}_{L+1}$ except those in register $\mathcal{F}$). Let $\mathcal{V}_{final}=\mathcal{F}\cup\mathcal{V}_{L+1}$ be the register containing all qudits sent to the verifier during the protocol.

Corollary 6.2

The state shared between the prover and verifier after the decoding of register $\mathcal{F}$ is:

[TABLE]

where $\hat{z}=(z_{1},z)$, $\hat{x}=(x_{1},x)$ and

[TABLE]

*Proof: *The only change between this state and equation 155 is the decoding of register $F$ (by applying the inverse Pauli key and the signed polynomial decoding $D_{k}^{\dagger}$). Observe that $W_{\Delta_{L},\hat{z},\hat{x}}^{L+1}$ and $V_{\Delta_{L},\hat{z},\hat{x},k}$ differ only to the left of $U_{g(\delta)}$; nothing changes to the right. This is because in the state above, we are averaging over all Pauli operators acting on registers $\mathcal{V}_{final}$ and $\mathcal{P}_{final}$ and in equation 155 we are averaging over all Pauli operators acting on registers $\mathcal{V}_{L+1}$ and $\mathcal{P}_{L+1}$. To see that this is the same, observe that

[TABLE]

To the left of $U_{g(\delta)}$, one additional register ($F$) is decoded first by the corresponding Pauli keys (which is reflected by the replacement of $(Z^{z_{1}}X^{x_{1}})_{\mathcal{V}_{L+1}}^{\dagger}$ with $(Z^{z_{1}}X^{x_{1}})_{\mathcal{V}_{final}}^{\dagger}$) and then by $D_{k}^{\dagger}$. The projection does not change (as indicated by $\mathcal{I}_{\mathcal{F}}$ in the projection) as we are only decoding register $\mathcal{F}$. $\Box$

Note that the verifier only holds the first key register (containing $\tau_{final}(z,x,k)$) and register $\mathcal{V}_{final}$. Recall that our goal is to show that for the Q-CIRCUIT instance $U$, if the first qudit of $U\left|0\right>^{\otimes n}$ is 0 with probability $1-\gamma$, the verifier will either abort or not accept the final decoded measurement result with probability $\geq 1-(\gamma+\epsilon)$. For this purpose, we define the following projection on $\mathcal{V}_{final}=\mathcal{F}\cup\mathcal{V}_{L+1}$:

[TABLE]

The first term in the above projection describes the space of valid measurement results (i.e. strings which interpolate to low degree polynomials). The second term describes the space of a final qudit which is accepted and decodes to 1. We would like to show that

[TABLE]

In other words, if the decoded measurement result of the final qudit does not yield 1, the verifier rejects or aborts with high probability. Each block of $m$ qudits in the register $\mathcal{V}_{L+1}$ is projected onto $\mathcal{I}^{\otimes d+1}\otimes\left|0\right>\left<0\right|^{\otimes d}$ as we are not looking for a specific decoded value in the measurement registers; we are only checking that the measurement results are valid.

Observe that in order to bound soundness, we only need to look at $\rho_{L+1}$ on $\mathcal{V}_{final}$; the key register containing $\tau_{final}(z,x,k)$ was unnecessary. This is because the keys $z,x$ acting on $\mathcal{P}_{final}$ will not be used; that register is never sent to the verifier. Also, the verifier no longer needs to remember the sign key, since it has already been used to decode the qudits in $\mathcal{V}_{final}$. Therefore, the verifier can trace out the first register containing $\tau_{final}(z,x,k)$.

Before continuing to prove equation 159, we can simplify $\rho_{L+1}|_{\mathcal{V}_{final}}$:

Claim 6.3** (Final State)**

$\rho_{L+1}|_{\mathcal{V}_{final}}$* is equal to*

[TABLE]

where

[TABLE]

and $\mbox{Tr}_{\mathcal{P}_{final}}(\rho_{g(\Delta_{L})}^{k})=\sigma_{g(\Delta_{L})}^{k}$,

[TABLE]

and

[TABLE]

Starting from the form of $\rho_{L+1}$ in equation 156 in Corollary 6.2, we show this claim by first summing over $z,x$ (this can be done since $\tau_{final}(z,x,k)$ is traced out), which has the effect of mixing register $\mathcal{P}_{final}$, as shown in the Pauli mixing lemma, Lemma 4.5 (which is analogous to Lemma 4.4 and also proven in Appendix B). Next, we can use $z_{1},x_{1}$ to decohere (or remove all cross terms of) the part of $U_{g(\Delta_{L})}$ acting on register $\mathcal{V}_{final}$ (by applying Lemma 5.1).

Now let’s return to our goal of proving equation 159. With the above state simplification, we are now proving:

[TABLE]

We first consider terms $\sigma_{k}^{P}$ for which $P$ is trivial (i.e. $P$ consists only of $Z$ and $\mathcal{I}$ operators). To prove the following claim, we first observe that trivial Pauli operators have no effect on measurement results, since they commute with the verifier’s decoding process (application of $D_{k}^{\dagger}$ and the inverse Pauli keys). Given this observation, we can see that the prover’s decoded final answer will be 0 with probability $1-\gamma$ (as it should be), and therefore we can upper bound the projection of the state onto $\hat{\Pi}_{0}$:

Claim 6.4** (Trivial Deviation)**

For trivial $P$,

[TABLE]

Next, we consider terms $\sigma_{k}^{P}$ for which $P$ is non trivial. By using Lemma 5.2, which implies that $P$ can produce a non zero trace (after the state is projected onto $\hat{\Pi}_{0}$) for at most 2 values of $k$, we show:

Claim 6.5** (Nontrivial Deviation)**

For non trivial $P$,

[TABLE]

By combining both claims, we obtain:

[TABLE]

The final equality follows because:

[TABLE]

by Lemma 3.3. $\Box$

6.6 Proof of Claim 6.1 (Polynomial QPIP State Evolution)

*Proof: * We will prove this claim by induction. The base case (round 1) is proven already in Section 6.5, equation 154. We assume the claim holds in round $i$ and show that it holds in round $i+1$. By the inductive hypothesis, we have the state shared by the prover and verifier in round $i$ is:

[TABLE]

where $\hat{z}=(z_{1},z)$, $\hat{x}=(x_{1},x)$ and

[TABLE]

Recall that the verifier holds register $\mathcal{V}_{i}$ and registers $\mathcal{P}_{i}$ and $E$ are held by the prover. When the prover measures and sends the verifier his measurement results, the verifier decodes them with both the Pauli keys and the sign key (as in equation 147) to obtain $\delta_{i}\in F_{q}^{3m}$. The shared state at this point is:

[TABLE]

where

[TABLE]

Note that $\Delta_{i}=(\delta_{i},\Delta_{i-1})$, where $\delta_{i}\in F_{q}^{3m}$ ($\delta_{i}$ is the measurement result obtained in round $i$) and $\Delta_{i-1}\in F_{q}^{|\mathcal{V}_{i}|}$ (measurement results from previous rounds). The key difference here is that we have taken $3m$ qudits from register $R_{i}$ and added them to register $\mathcal{V}_{i}$ to create registers $R_{i+1}$ and $M_{i+1}$. We have also removed the Pauli keys corresponding to the newly measured qudits from the first register; the verifier traces out these keys after decoding as he no longer needs them.

The remainder of round $i$ consists of the prover and verifier performing the Clifford gate $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$. To show that the shared state in round $i+1$ is of the form described in Claim 6.1, we need to replace $\rho^{k}_{g(\Delta_{i-1})}$ with $\rho^{k}_{g(\Delta_{i})}$ in equation 170. This can be done by determing how the application of $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ changes the state. Recall that:

[TABLE]

In order to replace $\rho^{k}_{g(\Delta_{i-1})}$ with $\rho^{k}_{g(\Delta_{i})}$, we need to commute $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ past $T_{\Delta_{i},\hat{z},\hat{x},k}$. First observe that $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ operates on the register held by the prover, $R_{i+1}$, and therefore commutes with operators acting on register $M_{i+1}$. However, it does not commute with $U_{g(\Delta_{i-1})}$. To take care of this issue, observe that:

[TABLE]

Now the rightmost part of the above expression, $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$, is acting on the Pauli operator $(Z^{z}X^{x})_{R_{i+1}}$ which is acting on $\rho^{k}_{g(\Delta_{i-1})}$. If the verifier updates his Pauli keys for register $R_{i+1}$ (as is part of the protocol for performing a Clifford operation, described in Section 6.1), $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ can be commuted past the Pauli operator:

[TABLE]

As described in more detail in Section 6.1, applying the Clifford operator $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ involves both the prover applying the operator to the authenticated states and the verifier updating his Pauli keys from $Z^{z}X^{x}$ to $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}Z^{z}X^{x}(\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})})^{\dagger}$ (this is a Pauli since $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$ is a Clifford).

Now $\tilde{Q}_{i}\tilde{C}_{g(\delta_{i})}$, is acting directly on $\rho^{k}_{g(\Delta_{i-1})}$ so we have:

[TABLE]

Note that this is still a state encoded with the signed polynomial code (hence the superscript $k$), since the Clifford operators are logical operators on the signed polynomial encoding. Finally, the prover can apply another attack $V_{g(\Delta_{i})}$. Note that this attack acts only on the registers held by the prover ($R_{i+1}$ and $E$) and therefore can be shifted past operators acting on register $M_{i+1}$ in $T_{\Delta_{i},\hat{z},\hat{x},k}$. We now set:

[TABLE]

The prover’s state at the end of the round is then:

[TABLE]

where

[TABLE]

$\Box$

6.7 Proof of Claim 6.3 (Final State)

*Proof: * Recall that we start with the state given in equation 156 in Corollary 6.2:

[TABLE]

where $\hat{z}=(z_{1},z)$, $\hat{x}=(x_{1},x)$ and

[TABLE]

Our goal is to determine the form of the state after tracing out the first register (the key register) and registers $\mathcal{P}_{final}$ and $E$. We begin by tracing out the key register, which allows us to sum over $z,x\in F_{q}^{|\mathcal{P}_{final}|}$. We are also allowed to sum over $k$, but we will keep $k$ fixed while we simplify the state. The state can then be written as:

[TABLE]

By Lemma 4.5, this has the effect of mixing register $\mathcal{P}_{final}$. The state is now:

[TABLE]

where

[TABLE]

and

[TABLE]

Next, we observe that the Pauli encoding/decoding of $Z^{z_{1}}X^{x_{1}}$ on register $\mathcal{V}_{final}$ has the effect of decohering (removing cross terms of) the part of $U_{g(\Delta_{L})}$ that is acting on $\mathcal{V}_{final}$, as shown in Lemma 5.1.

Applying the lemma with:

[TABLE]

we can simplify the prover’s decoded state to:

[TABLE]

where the above state also has a factor of $\frac{1}{q^{|\mathcal{P}_{final}|}}$.

We trace out registers $\mathcal{P}_{final}$ and $E$ since the verifier will not look at these registers:

[TABLE]

where $\alpha_{P,\Delta_{L}}=\frac{1}{q^{|\mathcal{P}_{final}|}}\mbox{Tr}(U_{P}^{g(\Delta_{L})}(\mathcal{I}_{\mathcal{P}_{final}}\otimes\rho_{\mathcal{E}})(U_{P}^{g(\Delta_{L})})^{\dagger})$. $\Box$

6.8 Proofs of Claim 6.4 and Claim 6.5 (Trivial and Nontrivial Deviation)

6.8.1 Necessary Claims

For both proofs, we require the three following claims. The first is regarding the state $\sigma_{a}^{k}=\mbox{Tr}_{\mathcal{P}_{final}}(\rho_{a}^{k})$ (for $a\in F_{q}^{3L})$, where $\rho_{a}^{k}$ is defined in Claim 6.1 (in equation 153) and $\sigma_{a}^{k}$ is first defined in Claim 6.3. The claim below considers the unauthenticated version of the state ($\sigma_{a}$). In other words, if $\sigma_{a}^{\prime}$ is $\sigma_{a}$ with $m-1$ auxiliary 0 qudits appended to each individual qudit, then:

[TABLE]

This equality follows from the definition of the encoding circuit (Definition 2.7).

Claim 6.6

For $a\in F_{q}^{3L}$ and $\sigma_{a}$ as defined in Claim 6.3 we claim that

[TABLE]

where $\left|\psi\right>_{a,a}=U\left|0\right>^{\otimes n}$.

The second claim involves conjugation properties of the encoding circuit $E_{k}$ (see Definition 2.7) with respect to trivial Pauli operators:

Claim 6.7

For a trivial Pauli operator $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$,

[TABLE]

where $(\hat{\Pi}_{0})_{\mathcal{F}}$ is defined in equation 158 as

[TABLE]

and for $a=(a(1),\ldots,a(3L))\in F_{q}^{3L}$

[TABLE]

The final claim simplifies the expression for $\mbox{Tr}(\hat{\Pi}_{0}\sigma_{k}^{P})$:

Claim 6.8

For all $P=Z^{z}X^{x}\in\mathbbm{P}_{|\mathcal{V}_{final}|}$, and for $\sigma_{k}^{P}$ as defined in Claim 6.3 (equation 161),

[TABLE]

where $(\hat{\Pi}_{0})_{\mathcal{F}}$ is defined in equation 158 as

[TABLE]

and for $a=(a(1),\ldots,a(3L))\in F_{q}^{3L}$

[TABLE]

We now proceed to proving Claims 6.4 and 6.5, and then we prove the claims listed above.

6.8.2 Proof of Claim 6.4 (Trivial Deviation)

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:trivialsoundness}}$:    Our goal in this proof is to show

[TABLE]

for a trivial Pauli operator $P$ acting on $\mathcal{V}_{final}$. We will show that for all $k$,

[TABLE]

By Claim 6.8 (and by the fact that $P$ is a trivial Pauli operator and therefore has no $X$ operator), we have

[TABLE]

where (as defined in equation 187) for $a=(a(1),\ldots,a(3L))\in F_{q}^{3L}$

[TABLE]

and (as defined in equation 158):

[TABLE]

We note that $\sigma_{a}^{k}$ is the density matrix $\sigma_{a}$ encoded with the signed polynomial code; i.e. if $\sigma_{a}^{\prime}$ is the density matrix $\sigma_{a}$ with $m-1$ auxiliary 0 qudits appended to each individual qudit, we have:

[TABLE]

It follows that

[TABLE]

Observe that the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ does not alter the auxiliary 0 qudits; it acts as $\mathcal{I}^{\otimes d}\otimes\left|0\right>\left<0\right|^{\otimes d}$ on each set of $m-1$ auxiliary qudits. Therefore, we can trace out all of the auxiliary qubits (and also remove the corresponding operators from the projections). Tracing out the auxiliary qudits from $\sigma_{a}^{\prime}$ simply results in $\sigma_{a}$. $\Pi_{G_{a}}$ can be replaced by $\left|a\right>\left<a\right|$, and $(\hat{\Pi}_{0})_{\mathcal{F}}$ can be replaced by $\left|1\right>\left<1\right|$. The resulting expression is:

[TABLE]

Claim 6.6 implies that the state $\sigma_{a}$ can be written as

[TABLE]

where $\left|\psi\right>_{a,a}=U\left|0\right>^{\otimes n}$. Given this information about $\sigma_{a}$, we can continue:

[TABLE]

The last inequality follows because measuring $U\left|0\right>$ results in 0 with probability $\geq 1-\gamma$ and 1 otherwise.

Remark 6.1

Note that if $U\left|0\right>$ resulted in 0 with probability exactly $1-\gamma$, the last inequality would be replaced by an equality (which would replace the inequality in the statement of the claim with an equality). Also note that if in equation 202 the projection $\left|1\right>\left<1\right|$ was replaced by $\mathcal{I}$, the next line would be the same, except $\gamma$ would be replaced by 1 and the inequality by an equality. These two facts will be useful in the proof of Claim 8.2, which is required for the proof of the polynomial version of Corollary 1.11 (Corollary 1.12)

$\Box$

6.8.3 Proof of Claim 6.5 (Nontrivial Deviation)

We now prove Claim 6.5.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:nontrivialsoundness}}$:    Our goal in this proof is to show that for a non trivial Pauli operator $P=Z^{z}X^{x}\in\mathbbm{P}_{|\mathcal{V}_{final}|}$,

[TABLE]

To do this, we will show that at most 2 terms in the above sum over $k$ can be non zero; each of those terms can be at most

[TABLE]

The claim follows. We begin by using Claim 6.8 to write:

[TABLE]

where (as defined in equation 187) for $a=(a(1),\ldots,a(3L))\in F_{q}^{3L}$

[TABLE]

and (as defined in equation 158):

[TABLE]

Note that the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ includes the projection of each block of $m$ qudits onto $\mathcal{I}^{\otimes d+1}\otimes\left|0\right>\left<0\right|^{\otimes d}$; it can be written as:

[TABLE]

where

[TABLE]

Intuitively, this implies that the non trivial Pauli operator $P$ must preserve the authenticated state (up to trivial operators) on every block of $m$ qudits in order end up in the subspace defined by $\hat{\Pi}_{0}^{A}$. Using similar reasoning as used in the proof of Lemma 5.2, we should be able to say that $P$ can only do this for at most 2 sign keys at a time. This intuition is formalized in Corollary 6.9, which follows from Lemma 5.2 and is proven immediately after this proof:

Corollary 6.9

For a non trivial Pauli operator $X^{x}\in\mathbbm{P}_{tm}$ and a density matrix $\sigma$ on $m$ qudits, there exist at most 2 sign keys $k\in\{-1,1\}^{m}$ (which are the same regardless of $\sigma$) for which the following expression

[TABLE]

can be non zero. If $X^{x}=X^{x_{1}}\otimes\cdots\otimes X^{x_{t}}$ for $x_{i}\in F_{q}^{m}$ and the expression above is non zero, $X^{x_{i}}$ must be $k$-correlated for all $i$.

This corollary implies that $\mbox{Tr}(\hat{\Pi}_{0}^{A}\sigma_{k}^{P})$ (where $\hat{\Pi}_{0}^{A}$ is defined in equation 210) is non zero for at most 2 sign keys. Fix one sign key for which $\mbox{Tr}(\hat{\Pi}_{0}^{A}\sigma_{k}^{P})$ is non zero. We will now simplify the expression in equation 206 for this fixed sign key $k$.

[TABLE]

Now due to Corollary 6.9, we know that $X^{x}$ is $k$-correlated (see Definition 5.4). Because $X^{x}$ maps an authenticated state to a different authenticated state, it is by definition equal to a logical Pauli operator $\tilde{X}^{x_{k}}$, so it maps $\sigma_{a}^{k}$ to $\sigma_{a,x_{k}}^{k}=(X^{x_{k}}\sigma_{a}(X^{x_{k}})^{\dagger})^{k}$:

[TABLE]

where the equality follows because $\sigma_{a,x_{k}}^{k}$ is the density matrix $\sigma_{a,x_{k}}$ encoded with the signed polynomial code, and $\sigma_{a,x_{k}}^{\prime}$ is the density matrix $\sigma_{a,x_{k}}$ with $m-1$ auxiliary 0 qudits appended to each qudit of $\sigma_{a,x_{k}}$. Note that the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ does not alter the auxiliary 0 qudits, as it acts on each set of $m-1$ 0 qudits as $\mathcal{I}^{\otimes d}\otimes\left|0\right>\left<0\right|^{\otimes d}$. Then we can trace out all the auxiliary 0 qudits and also remove them from the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$. The projection is now simply $\left|a\right>\left<a\right|\otimes\left|1\right>\left<1\right|$ and we have:

[TABLE]

Now we use Claim 6.6 to write $\sigma_{a}$ as

[TABLE]

where $\left|\psi\right>_{a,a}=U\left|0\right>^{\otimes n}$. Let $\sigma_{a,l,l^{\prime}}=\mbox{Tr}_{\mathcal{P}_{final}}(\left|\psi\right>_{a,l}\left<\psi\right|_{a,l^{\prime}})$ and let $X^{x_{k}}=X^{x_{k}}_{\mathcal{V}_{L+1}}\otimes X^{x_{k}}_{\mathcal{F}}$. Now we have:

[TABLE]

where we have obtained the second to last equality because $l=l^{\prime}=a-x_{k}$ in order for $\mbox{Tr}(\left|a\right>\left<a\right|(X^{x_{k}}\left|l\right>\left<l^{\prime}\right|(X^{x_{k}})^{\dagger}))$ to be 1 (otherwise the trace will be 0). The last equality is obtained because $\sigma_{a,a-x_{k},a-x_{k}}$ is a density matrix.

Remark 6.2

Note that the final inequality would still hold if the projection $\left|1\right>\left<1\right|$ was replaced by $\mathcal{I}$; this fact will be useful in the proof of Claim 8.3, which is required for the proof of the polynomial version of Corollary 1.11 (Corollary 1.12).

$\Box$

Proof of $\bf{Corollary\ref{soundnesstrivialpaulis}}$:    Let $X^{x}=X^{x_{1}}\otimes\cdots\otimes X^{x_{t}}$. We show that if there exists an $i$ for which $X^{x_{i}}$ is not $k$-correlated,

[TABLE]

[TABLE]

where the equality follows due to the fact that $\sigma^{k}$ is the density matrix $\sigma$ encoded with the signed polynomial code. It follows by Claim 5.4 that the expression can be non zero for at most 2 sign keys, which completes the proof. Note that it is implied that the choice of $k$ for which the expression is non zero is independent of $\sigma$; it is dependent only on whether $X^{x}$ is $k$-correlated or not. Assume there exists an $i$ for which $X^{x_{i}}$ is not $k$-correlated. By Claim 5.7 we can break down $X^{x_{i}}$ into a product of a $k$-correlated operator $Q_{k}$ and an uncorrelated operator $\hat{Q}_{k}$. By equation 116, we know that $\hat{Q}_{k}$ can be written as

[TABLE]

where $(\hat{x_{i}}_{d+2},\ldots,\hat{x_{i}}_{m})\neq 0^{d}$ since $X^{x_{i}}$ is not $k$-correlated. Now we can refer to equation 118 to write:

[TABLE]

Returning to the expression above (equation 221), but just the leftmost part of the expression which operates on the $i^{th}$ register of $\sigma$, we have:

[TABLE]

Plugging in the expression for $E_{k}^{\dagger}\hat{Q}_{k}E_{k}$ from equation 223, we have

[TABLE]

Observe that $Q_{k}$ is $k$-correlated; by definition, it preserves a state authenticated with a sign key. Then the rightmost part of equation 226 is simply $E_{k}^{\dagger}$ acting on an authenticated state. When $E_{k}^{\dagger}$ acts on an arbitrary authenticated density matrix, it performs the following map:

[TABLE]

It follows that the above expression (equation 226) contains the inner product below:

[TABLE]

which must be equal to 0 since $(\hat{x_{i}}_{d+2},\ldots,\hat{x_{i}}_{m})\neq 0^{d}$. $\Box$

6.8.4 Proofs of Necessary Claims

We begin with Claim 6.6.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{cl:finalstatedescription}}$:    Recall that we are considering the unauthenticated state $\sigma_{a}$ (defined in Claim 6.3), where $\sigma_{a}=\mbox{Tr}_{\mathcal{P}_{final}}(\rho_{a})$, for $a=(a_{1},\ldots,a_{L})$ ($a_{i}\in F_{q}^{3}$) and, as defined in Claim 6.1 (in equation 153),

[TABLE]

Note that $\rho_{a}$ is a pure state and can be written as $\left|\psi_{a}\right>\left<\psi_{a}\right|$ (since $\rho$ consists of $n$ 0 qudits and $L$ resource states). Fact 6.1 states that $\left|\psi_{a}\right>$ can be written as:

[TABLE]

where $\left|\psi\right>_{a,a}=U\left|0\right>^{\otimes n}$ (recall that $U$ is the Q-CIRCUIT instance which the prover was asked to apply). It follows that the state $\sigma_{a}$ can be written as

[TABLE]

$\Box$ We proceed to proving Claim 6.7.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:trivialcommute}}$:    Recall that we would like to prove

[TABLE]

for a trivial Pauli operator $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$, where $\Pi_{G_{a}}$ is defined in equation 187 and $(\hat{\Pi}_{0})_{\mathcal{F}}$ is defined in 158. In other words, we want to show that the Pauli operator $(E_{k}^{\dagger})^{\otimes|\mathcal{V}_{final}|}PE_{k}^{\otimes|\mathcal{V}_{final}|}$ commutes with the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ when $P$ is trivial. Observe that

[TABLE]

must be trivial in the registers $1,d+2,\ldots,m$; only registers $d+2,\ldots,m$ can be non trivial. This follows from the definition of $E_{k}$ (see Section 2.5.2). In more detail, $E_{k}^{\dagger}$ consists of SUM and multiplication operations (which compose $D_{k}^{\dagger}$) followed by Fourier operations. As shown in Section 2.4 (in equations 21 and 23), the SUM and multiplication operators in $D_{k}^{\dagger}$ map trivial operators to trivial operators by conjugation. The Fourier operators, which flip $Z$ and $X$ operators, act only on registers $2,\ldots,d+1$, so only these registers can be mapped to non trivial operators.

Note that trivial operators commute with standard basis projections, and $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ acts with standard basis projections on registers $1,d+2,\ldots,m$ for each block of $m$ registers. Since $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$ acts as $\mathcal{I}$ on registers $2,\ldots,d+1$ for each block of $m$ registers, the non trivial portion of $(E_{k}^{\dagger})^{\otimes|\mathcal{V}_{final}|}PE_{k}^{\otimes|\mathcal{V}_{final}|}$ also commutes with $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$. $\Box$

Finally, we prove Claim 6.8.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{cl:simplifyingsoundness}}$:    Recall that our goal is to prove the following equality for all $P=Z^{z}X^{x}\in\mathbbm{P}_{|\mathcal{V}_{final}|}$:

[TABLE]

where $\sigma_{k}^{P}$ was defined as follows in Claim 6.3:

[TABLE]

and the projection $\hat{\Pi}_{0}$ acting on $\mathcal{V}_{final}=\mathcal{V}_{L+1}\cup F$ was defined in equation 158 as follows:

[TABLE]

Before continuing, note that the projection $\hat{\Pi}_{0}$ makes it unnecessary to sum over all $\Delta_{L}$ in the expression for $\sigma_{k}$; we can instead sum over a subset of $\Delta_{L}$, and split the sum according to the value $a\in F_{q}^{3L}$ of $g(\Delta_{L})$:

[TABLE]

where

[TABLE]

Instead of summing over all $\Delta_{L}\in F_{q}^{|\mathcal{V}_{L+1}|}$, we have restricted to $\Delta_{L}\in\cup_{a}G_{a}$. This is because $\Delta_{L}$ must equal $((s_{1},0^{d}),\ldots,(s_{3L},0^{d}))$ to give a non zero trace when projected onto $\hat{\Pi}_{0}$. Next, since $\left|\Delta_{L}\right>\left<\Delta_{L}\right|\otimes\mathcal{I}_{\mathcal{F}}$ commutes with $\hat{\Pi}_{0}$, we can remove $\left|\Delta_{L}\right>\left<\Delta_{L}\right|\otimes\mathcal{I}_{\mathcal{F}}$ from the right hand side of equation 237 (due to the cyclic nature of trace), obtaining:

[TABLE]

where for $a=(a(1),\ldots,a(3L))\in F_{q}^{3L}$

[TABLE]

We can further simplify to:

[TABLE]

because

[TABLE]

Recall (from 31) that

[TABLE]

It follows that:

[TABLE]

The commutation in the final equality occurs because of the structure of $(\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}})$; for each set of $m$ registers, it acts as identity on registers $2,\ldots,d+1$ in the set. Plugging in the equality obtained above, we obtain:

[TABLE]

Note that we have removed the terms corresponding to $((\mathcal{I}\otimes F^{\otimes d}\otimes\mathcal{I}^{\otimes d})^{\dagger})^{\otimes|\mathcal{V}_{final}|}$; these terms canceled due to the cyclic nature of trace, since they were present on both ends of the above expression.

To complete the claim, we need to show that $P=Z^{z}X^{x}$ can be replaced by $X^{x}$. To begin, observe that in the expression for $\sigma_{k}^{P}$, we can replace

[TABLE]

with

[TABLE]

By Claim 6.7, we know that the Pauli operator $(E_{k}^{\dagger})^{\otimes|\mathcal{V}_{final}|}Z^{z}E_{k}^{\otimes|\mathcal{V}_{final}|}$ can be commuted past the projection $\Pi_{G_{a}}\otimes(\hat{\Pi}_{0})_{\mathcal{F}}$. Note that since we have now pulled the Pauli operator

[TABLE]

past the projection, we can remove it from the expression, due to the cyclic nature of trace. $\Box$

7 Blind QPIP

In this section, we will prove the following theorem:

Theorem 1.8   Theorem 1.1 holds also in a blind setting, namely, the prover does not get any information regarding the function being computed and its input.

To begin, we define blindness:

Definition 7.1

[AS06, BFK08, Chi01]** Secure blind quantum computation is a process where a server computes a function for a client and the following properties hold:

• •

Blindness*: The prover gets no information beyond an upper bound on the size of the circuit. Formally, in a blind computation scheme for a set of circuits $\mathfrak{C}_{n}$ which take as input strings in $\{0,1\}^{n}$, the prover’s reduced density matrix is identical for every $C\in\mathfrak{C}_{n}$ and input $x\in\{0,1\}^{n}$.*

• •

Security*: Completeness and soundness hold the same way as in QAS (Definition 2.1).*

We use the QPIP protocols for Q-CIRCUIT in order to provide a blind QPIP for any language in BQP. To do this, we require a universal circuit. Roughly, a universal circuit acts on input bits and control bits. The control bits can be thought of as a description of a circuit that should be applied to the input bits. Universal circuits can be formally defined as follows:

Definition 7.2

For a circuit $U$ acting on $n$ qubits, let $c(U)\in\{0,1\}^{k}$ be the canonical (classical) description of $U$. The universal circuit $\mathfrak{U}_{n,k}$ acts in the following way:

[TABLE]

Constructing such a circuit is an easy exercise. We would like the universal circuit to simulate any circuit made of Toffoli and Hadamard gates on $n$ qubits - it is well known that such circuits are quantum universal. Assume there is an upper bound of $m$ gates in the circuit. The universal circuit is split up into $m$ layers. Each layer $i$ consists of every possible gate on the $n$ input qubits, and each such gate is controlled by 1 qubit. Only 1 of these control qubits will be set to 1, based on which is the $i^{th}$ gate applied in $U$.

 

To perform a blind computation, the verifier will compute, with the prover’s help, the result of the universal circuit acting on input and control bits. It follows that to prove blindness, we need to show that the input to the universal circuit is hidden from the prover. To do this, we show that the prover’s density matrix in both the Clifford and polynomial schemes remains independent of the input (to the universal circuit) throughout the computation. We begin with the Clifford scheme.

Theorem 1.9 (Blindness of the Clifford based QPIP)  The state of the prover in the Clifford based QPIP (Protocol 4.1) is independent of the input to the circuit which is being computed throughout the protocol.

Proof of $\bf{Theorem\leavevmode\nobreak\ \ref{thm:blindclifford}}$:    We do not need to consider the prover’s extra space, since that contains no information about the input. We need only consider the qubits sent to the prover by the verifier. Whenever the prover receives a state from the verifier (at the beginning of the protocol and during the protocol), the verifier has chosen new, independent keys to encode the state using the Clifford QAS. Therefore, each density matrix sent to the prover by the verifier is the maximally mixed state (by Lemma 4.4) regardless of the input. This remains true throughout the protocol, since when the prover sends a register to the verifier, the verifier returns a completely mixed state, independent of the remaining registers. It follows that the prover’s state (other than his extra space) is always described by the completely mixed state. $\Box$

 

We now consider the polynomial QPIP.

Theorem 1.10 (Blindness of the Polynomial Based QPIP)  *The state of the prover in the polynomial based QPIP (Protocol 6.1) remains independent of the input to the circuit which is being computed throughout the protocol.

*We remark that the proof of this fact turns out to be rather cumbersome, because we are relying on the randomness provided by the measurement results to prove blindness. In fact, the proof can be greatly simplified by adding additional randomness to the Toffoli states (intuitively, this adds a one time pad to the decoded measurement results sent to the prover). However, it is interesting to note that this additional randomness is not needed for blindness, and that the randomness of the measurement results is indeed enough.

 

Proof of $\bf{Theorem\leavevmode\nobreak\ \ref{thm:blindpolynomial}}$:    This case is more complicated, due to the classical interaction in each round. Without the classical interaction, the prover’s initial state is just the maximally mixed state, due to the Pauli keys (by Lemma 4.5), so blindness follows easily in this case. Returning to the case in which there is classical interaction, we need to show that the joint quantum state and classical information of the prover are independent of the input to the computation. Recall that each message sent back by the verifier is a decoded measurement result which is required in order to apply the Toffoli gate. We will argue that due to the way the Toffoli gate is applied (see Section 2.3.1 and Fact 6.1), the decoded measurement results are uniformly random regardless of the input. This implies that revealing the decoded measurement result leaks no information about the input. We now proceed to prove this formally.

 

We will show that at the start of the final round (round $L+1$) the prover’s state (which includes the classical messages from the verifier) is independent of the input. As given in Claim 6.1 and equation 155 the joint state of the prover’s registers, $\mathcal{P}_{L+1}$, the environment $\mathcal{E}$, the verifier’s registers, $\mathcal{V}_{L+1}$ and the key register containing the sign key and Pauli keys of qudits in $\mathcal{P}_{L+1}$, is:

[TABLE]

where

[TABLE]

[TABLE]

where $U_{g(\Delta_{L})}$ is a unitary operator dependent on $g(\Delta_{L})$, $\rho_{\mathcal{E}}$ is the initial state of the prover’s environment and

[TABLE]

for $\Delta_{L}=(\delta_{1},\ldots,\delta_{L})\in F_{q}^{|\mathcal{V}_{L+1}|}$ and where $\rho^{k}$ is the initial density matrix, containing an authentication of the input state on $n$ qudits and authentications of $L$ Toffoli states on 3 qudits each.

 

First, since we are only considering the prover’s state, we can trace out the verifier’s registers $\mathcal{V}_{L+1}$ and the first register containing the keys. This gives the following state:

[TABLE]

Next, the sum over $z,x\in F_{q}^{|\mathcal{P}_{L+1}|}$ allows us to use the Pauli mixing lemma (Lemma 4.5) to replace $\rho_{g(\Delta_{L})}^{k}$ with

[TABLE]

We can now rewrite the prover’s state as:

[TABLE]

where

[TABLE]

[TABLE]

Since $\rho_{g(\Delta_{L})}^{k}$ is a pure state, it can be written as $\left|\psi_{g(\Delta_{L})}\right>^{k}\left<\psi_{g(\Delta_{L})}\right|^{k}$. Recall from Fact 6.1 that the unauthenticated state $\left|\psi_{g(\Delta_{L})}\right>$ can be written as

[TABLE]

Given this form of the unauthenticated state, we revert back to analyzing the authenticated state, which is:

[TABLE]

Since $\mathcal{V}_{L+1}$ corresponds to the first register in the above sum (containing the authentication of $l$) and $\mathcal{P}_{L+1}$ corresponds to the register containing the authentication of $\left|\psi\right>_{g(\Delta_{L}),l}$, we have:

[TABLE]

In the following claim (which we prove after this proof), we show that once we plug in the above expression into the prover’s state as given in Equation 258, the state is only non zero when $l=l^{\prime}$. To see this, observe that summing over $z_{1},x_{1}\in F_{q}^{|\mathcal{V}_{L+1}|}$ results in decohering (removing cross terms of) the part of $U_{g(\Delta_{L})}$ acting on register $\mathcal{V}_{L+1}$ by the Pauli decoherence lemma (Lemma 5.1). Then due to the standard basis projection onto $\left|\Delta_{L}\right>\left<\Delta_{L}\right|$, the state will be zero unless $l=l^{\prime}$.

Claim 7.1

The following expression (from equation 258), which represents the prover’s state at the start of round $L+1$

[TABLE]

is equal to

[TABLE]

where

[TABLE]

and

[TABLE]

The above state is the same regardless of the input density matrix $\rho^{k}$; therefore, we have shown blindness for the polynomial scheme. $\Box$

 

We proceed to the proof of the claim.

 

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{cl:blindnessdecoherence}}$:    We begin with

[TABLE]

where

[TABLE]

and

[TABLE]

We can now apply the Pauli decoherence lemma (Lemma 5.1) with the decomposition of $U_{g(\Delta_{L})}$ as given in equation 266 (and with $Z^{z_{1}}X^{x_{1}}$ playing the role of $Q$ in the lemma) to simplify the state in equation 268 to:

[TABLE]

where

[TABLE]

Now we can plug in the expression for $\mbox{Tr}_{\mathcal{P}_{L+1}}(\rho_{g(\Delta_{L})}^{k})$ from equation 263 to obtain:

[TABLE]

Plugging this in to equation 271 we obtain:

[TABLE]

where

[TABLE]

Observe that $\mu_{\Delta_{L},l,l^{\prime},P,k}$ is only non zero when $l=l^{\prime}$. This follows due to two observations. First, note that

[TABLE]

is a standard basis projection, because $\left|\Delta_{L}\right>\left<\Delta_{L}\right|$ is a standard basis projection, and $D_{k}$ consists only of sum and multiplication operations (see Claim 2.6). Next, note that if we have a standard basis projection $S$ acting on a matrix $P\left|\psi\right>\left<\psi^{\prime}\right|P^{\dagger}$ in register $\mathcal{V}_{L+1}$, where $\left|\psi\right>=\sum_{i}\alpha_{i}\left|i\right>$ and $\left|\psi^{\prime}\right>=\sum_{i}\beta_{i}\left|i\right>$, we need not consider the cross terms of $\left|\psi\right>\left<\psi^{\prime}\right|$:

[TABLE]

Since the authenticated states $(\left|l\right>\left<l^{\prime}\right|)^{k}$ consists only of cross terms unless $l=l^{\prime}$, this implies that $l$ must equal $l^{\prime}$ in order for $\mu_{\Delta_{L},l,l^{\prime},P,k}$ to be non zero. Therefore, we can now write equation 274 as

[TABLE]

Since $\mbox{Tr}((\left|\psi\right>_{g(\Delta_{L}),l}\left<\psi\right|_{g(\Delta_{L}),l})^{k})=1$, the above expression is equal to

[TABLE]

$\Box$

8 Interpretation of Results

In this section, we prove Corollary 1.11.

8.1 Clifford QPIP

Corollary 8.1

For the Clifford QPIP protocol (Protocol 4.1) with security parameter $\epsilon$ (where $\epsilon=\frac{1}{2^{e}}$ by definition), if the verifier does not abort with probability $\geq\beta$ then the trace distance between the final density matrix conditioned on the verifier’s acceptance and that of the correct state is at most $\frac{\epsilon}{\beta}$

Proof of $\bf{Corollary\ref{corol:cliffordconfidence}}$:    The final state of the protocol before the verifier’s cheat detection can be written as (see Eq. 62):

[TABLE]

where $s$ represents the weight of the prover’s attack on the identity, $A$ is the space of all computational qubits other than the first, and $\rho_{N+1}$ is the correct final state of the protocol:

[TABLE]

where $\rho$ is equal to the initial density matrix. Note that $\rho_{N+1}$ includes the auxiliary 0 states, but the circuit does not act on the auxiliary 0 states (so it includes $\mathcal{I}$ operators which we have not included for ease of notation). We can instead write

[TABLE]

where $\rho^{\prime}$ is the input state $\rho$ without the auxiliary 0’s. Then

[TABLE]

where $A^{\prime}$ is the space of all compuational qubits other than the first (but excluding the auxiliary 0’s).

 

We now rewrite the state from equation Eq. 281:

[TABLE]

Let $V\subset\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$ be the set of Pauli operators which pass the cheat detection procedure (i.e. preserve the auxiliary 0 states). Assume the verifier declares the computation valid with probability $\beta$. After he declares the computation valid (and we trace out the auxiliary 0 states), his state is:

[TABLE]

Then the trace distance to the correct state $\rho_{C}$ is:

[TABLE]

where the first inequality follows by convexity of trace distance and the final inequality follows from the same argument used to prove the security of the Cliford QAS- more specifically, see the explanation preceding equation 44. $\Box$

8.2 Polynomial QPIP

We now continue to the polynomial QPIP. In this setting, we are concerned with the trace distance between density matrices after measurement. This is because the verifier in the polynomial QPIP protocol only performs a classical verification circuit; therefore, he cannot detect phase attacks on the correct state. Once the state is measured, phase attacks have no effect on the state. For this purpose, let $\sigma_{M}$ represent a density matrix $\sigma$ on one qudit after measurement:

[TABLE]

We will require the following fact:

Fact 8.1

For all density matrices $\rho,\sigma$ on 1 qudit,

[TABLE]

We require a bit more notation before stating the corollary. Recall that the register $\mathcal{V}_{final}$, which is the register of containing the $3mL+m$ qudits held by the verifier at the end of the protocol, is equal to $\mathcal{V}_{L+1}\cup\mathcal{F}$. We will only be interested in the first qudit of register $\mathcal{F}$; this is the qudit which contains the final result of the circuit. For this purpose, we introduce the following notation. For a density matrix $\sigma$ on $\mathcal{V}_{final}$, let $\sigma^{\prime}=\mbox{Tr}_{2,\ldots,m}(\mbox{Tr}_{\mathcal{V}_{L+1}}(\sigma))$.

 

Corollary 1.12  * For the polynomial QPIP protocol (Protocol 6.1) with security parameter $\epsilon$ (where $\epsilon=\frac{1}{2^{m-1}}$ by definition), assume the verifier aborts with probability at most $1-\beta$. Then the trace distance between the final measured density matrix conditioned on the verifier’s acceptance ($\sigma_{M}^{\prime}$) and that of the correct measured state ($\rho_{C}$) is at most $\frac{2\epsilon}{\beta}$.*

 

Proof of $\bf{Corollary\ref{corol:polyconfidence}}$:    Recall the final state on register $\mathcal{V}_{final}$ held by the verifier (before the verifier checks for errors, but after he decodes) from Claim 6.3:

[TABLE]

where

[TABLE]

and $\mbox{Tr}_{\mathcal{P}_{final}}(\rho_{g(\Delta_{L})}^{k})=\sigma_{g(\Delta_{L})}^{k}$,

[TABLE]

and

[TABLE]

We begin by conditioning on the verifier’s acceptance, by applying the projection

[TABLE]

on the state and then re-normalizing. The projection above represents the verifier’s test of checking that the last $d$ qudits of each block of $m$ qudits are 0 (for a reminder of why this is the test and how the protocol works, see Protocol 6.1). The resulting state after conditioning on acceptance (where $\beta$ is the probability of acceptance) is

[TABLE]

where

[TABLE]

and

[TABLE]

Our goal is to show that the trace distance $T(\sigma_{M}^{\prime},\rho_{C})$ between $\rho_{C}$ and $\sigma_{M}^{\prime}$ is at most $\frac{2\epsilon}{\beta}$. Note that the expression in equation 298 is a convex sum over density matrices; this is because $\sigma_{k}^{P}$ is an unnormalized density matrix. To see this, observe that $\sigma_{k}^{P}$ (written in equation 293) is a sum over terms of the following form: there is a density matrix ($\sigma_{g(\Delta_{L})}^{k}$), followed by a unitary operation $(D_{k}^{\dagger})^{\otimes|\mathcal{V}_{final}|}P$, followed by a projection. Each term has a non negative coefficient ($\alpha_{P,g(\Delta_{L})}$ from equation 294). Therefore, by convexity of trace distance, we can upper bound the trace distance as follows:

[TABLE]

Next, we will require two claims (which we prove immediately after the current proof). The first claim shows that when $P$ is a trivial Pauli operator, it preserves the correct final state on the first qudit of register $\mathcal{F}$:

Claim 8.2

For all trivial $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$ (i.e. $P$ consisting of only $Z$ and $\mathcal{I}$ operators):

[TABLE]

The next claim shows that if $P$ is a non trivial Pauli operator, the trace distance will still be small; intuitively, this is because the state with attack operator $P$ can only pass the verifier’s test for 2 (out of $2^{m}$) sign keys:

Claim 8.3

For all non trivial $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$:

[TABLE]

Given the two claims, we can further simplify the bound in equation 301 by first using Claim 8.2 to remove trivial Pauli operators from the expression (let $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}^{T}$ be the set of all non trivial Pauli operators):

[TABLE]

The second inequality follows from Claim 8.3. Next, we can use Lemma 3.3, which provides the following equality:

[TABLE]

Continuing with the upper bound, we obtain:

[TABLE]

which completes the proof. $\Box$

8.2.1 Proof of Claim 8.2

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{cl:trivialdensitymatrix}}$:    We would like to show that for all trivial $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$ (i.e. $P$ consisting of only $Z$ and $\mathcal{I}$ operators):

[TABLE]

To do so, we need to show that for all $k$,

[TABLE]

where $p_{1}$ is the probability that the correct state outputs 1 when measured. The reason the above statement is equivalent to equation 312 is because we are considering the measured density matrices; therefore, we need only prove that both density matrices obtain 1 with the same probability to prove that the trace distance is 0.

 

Recall from equation 299 that:

[TABLE]

Plugging this in to equation 313, we obtain:

[TABLE]

where the second equality follows because $(\mathcal{I}^{\otimes|\mathcal{V}_{final}|}\otimes\left|1\right>\left<1\right|\otimes\mathcal{I}^{\otimes m-1})$ commutes with $(\hat{\Pi}_{0})_{\mathcal{V}_{final}}$ and due to the cyclic nature of trace. The third equality follows due to the following equality:

[TABLE]

where we recall (from equation 158) that

[TABLE]

and (from equation 296) that

[TABLE]

Next, Claim 6.4 gives the following inequality:

[TABLE]

Note that Claim 6.4 is not stated in this format. The first difference is that instead of $p_{1}$, the claim has $\gamma$; this is simply the probability that the circuit applied by the honest prover outputs 1, which is $p_{1}$ in this case. The second is that the statement of the claim also has a summation over $k$. However, in the proof of the claim, that summation is not used at all; the claim is shown for individual elements of the sum over $k$, and the sum over $k$ is only used in the statement. Finally, Claim 6.4 has an inequality rather than an equality; see Remark 6.1 for why it is okay to use equality in this setting.

 

Finally, we claim that $\gamma_{k}^{P}=\frac{1}{q^{3L}}\sum\limits_{a\in F_{q}^{3L}}\alpha_{P,a}$. Given this claim, we have

[TABLE]

which completes the proof, since we have proven the equality in equation 313.To see why $\gamma_{k}^{P}$ satisfies the above equality, recall from equation 300 that

[TABLE]

We can again apply Claim 6.4 here; the two differences are that we are using $(\hat{\Pi}_{0})_{\mathcal{V}_{final}}$ rather than $\hat{\Pi}_{0}$ and that we require equality rather than inequality. The difference between these two projections is that the latter projects the first qudit of $\mathcal{F}$ onto $\left|1\right>\left<1\right|$. See Remark 6.1 for why the claim still applies, but with $\gamma$ in the statement of the claim replaced by 1 and the inequality replaced by equality, which gives

[TABLE]

$\Box$

8.2.2 Proof of Claim 8.3

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{cl:nontrivialdensitymatrix}}$:    We would like to show that for all non trivial $P\in\mathbbm{P}_{|\mathcal{V}_{final}|}$:

[TABLE]

First, we use Fact 8.1 and then upper bound the trace distance by 1 to obtain:

[TABLE]

Next, note that by the definition of $\gamma_{k}^{P}$ in equation 300

[TABLE]

where the final inequality follows from Claim 6.5. Note that in Claim 6.5 the projection is $\hat{\Pi}_{0}$ rather than $(\hat{\Pi}_{0})_{\mathcal{V}_{final}}$. Recall (from equation 158) that

[TABLE]

and (from equation 296)

[TABLE]

The difference between the two is that the first qudit of register $\mathcal{F}$ is projected onto $\left|1\right>\left<1\right|$ in $\hat{\Pi}_{0}$ and onto $\mathcal{I}$ in $(\hat{\Pi}_{0})_{\mathcal{V}_{final}}$. However, the proof of Claim 6.5 holds if $\hat{\Pi}_{0}$ is replaced with $(\hat{\Pi}_{0})_{\mathcal{V}_{final}}$; see Remark 6.2. $\Box$

9 Acknowledgements

D.A. thanks Oded Goldreich, Madhu sudan and Guy Rothblum for exciting and inspiring conversations that eventually led to this work. E.E. thanks Avinatan Hassidim for stimulating and refining ideas, particularly about fault tolerance. We also thank Gil Kalai, David DiVincenzo and Ari Mizel, for stimulating questions and clarifications, and Daniel Gottesman for many helpful ideas and remarks, and in particular, for his help in proving Theorem 1.4.

Appendix A A Symmetric Definition of QPIP

Here we provide the definition of $\textsf{QPIP}_{\kappa}^{sym}$ and then prove Corollary 1.3 and Corollary 1.13. We begin with the definition of $\textsf{QPIP}_{\kappa}^{sym}$:

Definition A.1

A language $\mathcal{L}$ is in the class symmetric quantum prover interactive proof $(\textsf{QPIP}_{\kappa}^{sym})$ with completeness $c$ and soundness $s$ (where $c-s$ is constant) if there exists an interactive protocol with the following properties:

• •

The prover $\mathds{P}$ and verifier $\mathds{V}$ are exactly the same as in the definition of $\textsf{QPIP}_{\kappa}$ (Definition 1.1). Namely, a BQP machine and quantum-classical hybrid machine for the prover and verifier respectively.

• •

Communication is identical to the $\textsf{QPIP}_{\kappa}$ definition.

• •

The verifier has three possible outcomes: 1, 0, and ABORT:

• –

1*: The verifier is convinced that $x\in\mathcal{L}$.*

• –

0*: The verifier is convinced that $x\notin\mathcal{L}$.*

• –

ABORT*: The verifier caught the prover cheating.*

• •

Completeness*: $\forall x\in\{0,1\}^{*}$, after interacting with $\mathds{P}$, the verifier’s outcome is correct with high probability:*

[TABLE]

where $\mathbbm{1}_{\mathcal{L}}$ is the indicator function of $\mathcal{L}$, $r$ represents the randomness used by the verifier, and $\left[\mathds{V},\mathds{P}\right](x,r)$ is the verifier’s outcome after using randomness $r$ and interacting with $\mathds{P}$ on input $x$.

• •

Soundness*: For all provers $\mathds{P}^{\prime}$ (with the same description as $\mathds{P}$) and for all $x\in\{0,1\}^{*}$, the verifier is mistaken with bounded probability, that is:*

[TABLE]

We now prove Corollary 1.3:

Proof of $\bf{Corollary\ref{thm:mainsym}}$:    We will prove that $\textsf{QPIP}_{c}=\textsf{QPIP}_{c}^{sym}$. It follows from the definitions of $\textsf{QPIP}_{c}$ (Definition 1.1) and $\textsf{QPIP}_{c}^{sym}$ (Definition A.1) that $\textsf{QPIP}_{c}\subseteq\textsf{QPIP}_{c}^{sym}$. We obtain the other direction by showing that for any language $\mathcal{L}$, if $\mathcal{L}$ is in $\textsf{QPIP}_{c}$ then $\mathcal{L},\mathcal{L}^{c}\in\textsf{QPIP}_{c}^{sym}$. First note that if $\mathcal{L}$ is in $\textsf{QPIP}_{c}$, then so is $\mathcal{L}^{c}$, since BQP is closed under complement and ${\sf BQP}\ =\textsf{QPIP}_{c}$ by Theorem 1.2. Let $\mathds{V}_{\mathcal{L}},\mathds{P}_{\mathcal{L}}$ denote the $\textsf{QPIP}_{c}$ verifier and prover for the language $\mathcal{L}$. By the assumption, there exists such a pair for both $\mathcal{L}$ and $\mathcal{L}^{c}$. We define the pair ${\widetilde{\mathds{P}}}$ and ${\widetilde{\mathds{V}}}$ to be $\textsf{QPIP}_{c}^{sym}$ verifier and prover in the following way: on the first round the prover ${\widetilde{\mathds{P}}}$ sends to ${\widetilde{\mathds{V}}}$  “yes” if $x\in\mathcal{L}$ and “no” otherwise. Now, both ${\widetilde{\mathds{P}}}$ and ${\widetilde{\mathds{V}}}$ behave according to $\mathds{V}_{\mathcal{L}},\mathds{P}_{\mathcal{L}}$ if “yes” was sent or according to $\mathds{V}_{\mathcal{L}^{c}},\mathds{P}_{\mathcal{L}^{c}}$ otherwise. Soundness and completeness follow immediately from the definition.

$\Box$

 

Finally, we prove Corollary 1.13:

Proof of $\bf{Corollary\ref{corol:bqpsepbpp}}$:    This corollary uses $\textsf{QPIP}^{sym}$ rather than QPIP (recall from Corollary 1.3 that $\textsf{QPIP}^{sym}={\sf BQP}$). First note that if we run $\textsf{QPIP}^{sym}$ (either the polynomial based or Clifford based protocol) on an instance $x$ drawn from $D$ and the verifier does not abort with probability $\beta$, the probability that the verifier outputs the incorrect answer is at most $\frac{2\epsilon}{\beta}+\gamma$, by Corollary 1.11 and Corollary 1.12. We need to amplify this probability so that the verifier outputs the incorrect answer with probability which is at most inverse exponential in $n$. If we can do so, the corollary follows since any BPP machine would err with non-negligible probability on instances drawn from $D$, by assumption. Therefore, the prover cannot be simulated by a BPP machine.

 

To amplify the probability of outputting an incorrect answer, we run $\textsf{QPIP}^{sym}$ polynomially many times (in $n$) and take the output to be the majority of the output values, ignoring runs on which the verifier aborted. Since $\beta$ is constant, if we repeat the protocol polynomially many times, we expect to collect polynomially many output values (we fail to do so with probability $p$ which is inverse exponential $n$). Since each output is correct with probability $1-(\frac{2\epsilon}{\beta}+\gamma)>\frac{1}{2}$, by taking the majority of these output values, we can reduce the error of the output to be $p^{\prime}$, which is inverse exponential in $n$. The overall probability of error is then $(1-p)p^{\prime}+p$, which is inverse exponential in $n$. $\Box$

Appendix B Clifford and Pauli Operators

Here are some useful lemmas about Clifford/Pauli operators. We first prove the Pauli mixing lemma:

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{paulimix}\textbf{ (Pauli Mixing)}}$:    First, we write $\rho$ as:

[TABLE]

It follows that:

[TABLE]

Next, observe that:

[TABLE]

This expression is 0 if $i\neq j$. If $i=j$, we obtain $q^{n}\mathcal{I}$. Plugging in this observation to the above expression, we have:

[TABLE]

$\Box$

Now we prove the Clifford mixing lemma:

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{cliffordmix}\textbf{ (Clifford Mixing)}}$:    To prove this lemma, we observe that applying a random Clifford includes applying a random Pauli, and the lemma then follows from Lemma 4.5. In more detail, we have the following equality for all $Q\in\mathbbm{P}_{n}$:

[TABLE]

Now we have:

[TABLE]

Regrouping terms, we have

[TABLE]

By Lemma 4.5 (with $q=2$) the above expression is equal to:

[TABLE]

$\Box$

Appendix C Clifford Technical Details

Here we prove Lemma 3.4, Lemma 3.5 and Lemma 3.6, which were used to prove Lemma 3.2 (and Lemma 3.5 is also used to prove Lemma 5.1).

 

Lemma 3.4  (Pauli Partitioning by Cliffords) For every $P,Q\in\mathbbm{P}_{m}\setminus\{\mathcal{I}\}$ it holds that : $\left|\left\{C\in\mathfrak{C}_{m}|C^{\dagger}PC=Q\right\}\right|=\frac{\left|\mathfrak{C}_{m}\right|}{\left|\mathbbm{P}_{m}\right|-1}=\frac{\left|\mathfrak{C}_{m}\right|}{4^{m}-1}$.

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{mix}}$:    We first claim that for every $Q,P\in\mathbbm{P}_{m}\setminus\mathcal{I}$ there exists $D\in\mathfrak{C}_{m}$ such that $D^{\dagger}PD=Q$. We will prove this claim by induction. Specifically, we show that starting from any non identity Pauli operator one can, using conjunction by Clifford group operator reach the Pauli operator $X\otimes\mathcal{I}^{\otimes m-1}$.

We first notice that the swap operation is in $\mathfrak{C}_{2}$ since it holds that:

[TABLE]

Furthermore, we recall that $K^{\dagger}(XZ)K\propto X$ and $H^{\dagger}ZH=X$. Therefore, any non identity Pauli $P=P_{1}{\otimes{\ldots}\otimes}P_{m}$ can be transformed using $SWAP,H$ and $K$ to the form: $X^{\otimes k}\otimes\mathcal{I}^{\otimes m-k}$ (up to a phase and for some $k\geq 1$). To conclude we use:

[TABLE]

which reduces the number of $X$ operations at hand. Applying this sufficiently many times results in reaching the desired form. Since this holds for any non-identity Pauli operators: $P,Q$ we know there are $C,D\in\mathfrak{C}_{m}$ such that:

[TABLE]

therefore $CD^{\dagger}$ is the operator we looked for.

Given $P^{\prime}\in\mathbbm{P}_{m}\setminus\mathcal{I}$, define $A_{P^{\prime},Q}$ as follows $A_{P^{\prime},Q}\stackrel{{\scriptstyle\mathrm{def}}}{{=}}\left\{C\in\mathfrak{C}_{m}|C^{\dagger}P^{\prime}C=Q\right\}$. We will show that $|A_{P^{\prime},Q}|$ is independent of $P^{\prime}$. Now fix $P^{\prime}\in\mathbbm{P}_{m}\setminus\mathcal{I}$ and let $D\in\mathfrak{C}_{m}$ be one of the operators for which the following equality holds: $D^{\dagger}P^{\prime}D=Q$. Then it holds that for all $Q^{\prime}\in\mathbbm{P}_{m}\setminus\mathcal{I}$, $D^{\dagger}C\in A_{Q^{\prime},Q}\iff C\in A_{P^{\prime},Q^{\prime}}$. Therefore $|A_{Q^{\prime},Q}|=|A_{P^{\prime},Q^{\prime}}|$ for all non identity $P^{\prime},Q^{\prime}$ and $Q$. Using the fact that $|A_{P^{\prime},Q^{\prime}}|=|A_{Q^{\prime},P^{\prime}}|$, it follows that $|A_{P^{\prime},Q^{\prime}}|$ is independent of $Q^{\prime}$ and $P^{\prime}$.

Now note that the sets $\{A_{P^{\prime},Q^{\prime}}\,:\forall P^{\prime}\}$ form a partition of $\mathfrak{C}_{m}$. These sets clearly do not intersect. Observe that for each $C\in\mathfrak{C}_{m}$, there exists $P^{\prime}\in\mathbbm{P}_{m}\setminus\mathcal{I}$ such that $P^{\prime}=CQ^{\prime}C^{\dagger}$. Since all the sets in the partition have the same size, we obtain:

[TABLE]

which concludes the proof. $\Box$

 

Lemma 3.5  (Pauli Twirl) Let $P\neq P^{\prime}$ be generalized Pauli operators. For any density matrix $\rho^{\prime}$ on $m^{\prime}>m$ qubits it holds that

[TABLE]

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{pauliTw}}$:    Let $P\neq P^{\prime}$ be generalized Pauli operator $P=X^{a}Z^{b}$ and $P^{\prime}=X^{a^{\prime}}Z^{b^{\prime}}$.

[TABLE]

We use the fact that $Z^{d}X^{c}=\omega_{q}^{dc}X^{c}Z^{d}$ (see Definition 2.2) and some algebra:

[TABLE]

To conclude the proof we recall that $a\neq a^{\prime}$ or $b\neq b^{\prime}$, hence one of the above sums vanishes.

$\Box$

 

Lemma 3.6  (Clifford Twirl) Let $P\neq P^{\prime}$ be Pauli operators. For any density matrix $\rho^{\prime}$ on $m^{\prime}>m$ qubits it holds that

[TABLE]

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{clifTw}}$:    Notice that applying a random Clifford operator “includes” the application of a random Pauli:

[TABLE]

Equality holds for any $Q\in\mathfrak{C}_{n}$ since it is nothing but a change of order of summation.

[TABLE]

By Lemma 3.5 (with $q=2$), we know that this expression is 0 if $C^{\dagger}PC\neq C^{\dagger}P^{\prime}C$. $\Box$

Appendix D Logical Gates on Signed Polynomial Codes

In this section we prove that the logical operators given in Section 2.5.1 behave as claimed. We first prove that the logical $X$ operator is correct.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:logicalx}}$:    We can easily verify that applying $X^{k_{1}x}\otimes\cdots\otimes X^{k_{m}x}$ is the logical ${\widetilde{X}}_{k}^{x}$ operation:

[TABLE]

Setting $f^{\prime}(\alpha)=f(\alpha)+x$:

[TABLE]

$\Box$

We now prove that the logical SUM operator is correct.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:logicalsum}}$:

[TABLE]

We set $g(\alpha)=f(\alpha)+h(\alpha)$

[TABLE]

$\Box$

We proceed to the proof of the lemma needed for the logical Fourier transform.

Proof of $\bf{Lemma\leavevmode\nobreak\ \ref{inter}}$:    A polynomial $p$ of degree $\leq m-1$ is completely determined by it’s values in the points $\alpha_{i}$. We write $p$ as in the form of the Lagrange interpolation polynomial: $f(x)=\sum_{i}\prod_{j\neq i}\frac{x-\alpha_{j}}{\alpha_{i}-\alpha_{j}}f(\alpha_{j})$. Therefore, we set $c_{i}=\prod_{j\neq i}\frac{-\alpha_{j}}{\alpha_{i}-\alpha_{j}}$ and notice that it is independent of $p$, and the claim follows. $\Box$

We continue to the proof of the logical Fourier transform.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:fourier}}$:    We denote $\left|kf\right>=\left|k_{1}f(\alpha_{1}),{\ldots},k_{m}f(\alpha_{m})\right>$

[TABLE]

We think of the $b_{i}$’s as defining a signed polynomial $g$ of degree $\leq m-1$ that is $k_{i}g(\alpha_{i})=b_{i}$ and split the sum according to $g(0)$:

[TABLE]

We temporarily restrict our view to polynomials $g$ with degree at most $m-d-1$ and therefore the polynomial $fg$ has degree at most $m-1$. We use Lemma 2.3 on $fg$:

[TABLE]

Going back to Eq. 362:

[TABLE]

Where the summation is over all $f,g$ such that $f(0)=a$ and $g(0)=b$ while the degrees of $f$ and $g$ are at most $d$ and $m-d-1$ respectively.

The sum does not depend on $f$ and there are exactly $q^{d}$ polynomials $f$ in the sum, therefore, we can write the expression as :

[TABLE]

Since the above expression has norm 1, if follows that the coefficients that we temporally ignored at Eq. 361 all vanish. $\Box$

Finally, we prove that the logical $Z$ operator is correct.

Proof of $\bf{Claim\leavevmode\nobreak\ \ref{claim:logicalz}}$:

[TABLE]

$\Box$

Appendix E Notation Tables

We begin with notation used for both the Clifford and polynomial protocols, and then proceed to notation used only in the polynomial protocol (beginning with the sign key $k$, Definition 2.6).

[TABLE]