Sample complexity of device-independently certified "quantum supremacy"

TL;DR

This paper investigates the difficulty of certifying quantum sampling experiments, showing that non-interactive classical certification requires exponentially many samples due to the distributions' properties, impacting claims of quantum supremacy.

Contribution

It proves that non-interactive certification of quantum sampling distributions demands exponential resources, highlighting fundamental limitations for certifying quantum supremacy experiments.

Findings

Non-interactive certification requires exponential samples.

Sampling distributions have small second moments.

Certification difficulty applies to boson sampling, IQP, and random circuits.

Abstract

Results on the hardness of approximate sampling are seen as important stepping stones towards a convincing demonstration of the superior computational power of quantum devices. The most prominent suggestions for such experiments include boson sampling, IQP circuit sampling, and universal random circuit sampling. A key challenge for any such demonstration is to certify the correct implementation. For all these examples, and in fact for all sufficiently flat distributions, we show that any non-interactive certification from classical samples and a description of the target distribution requires exponentially many uses of the device. Our proofs rely on the same property that is a central ingredient for the approximate hardness results: namely, that the sampling distributions, as random variables depending on the random unitaries defining the problem instances, have small second moments.

Equations

$$c_1\cdot \max \left\{\frac{1}{ϵ},\frac{1}{{ϵ}^2}\Vert P_{-2ϵ}^{-\max }{\Vert }_{2/3}\right\}$$

$$c_2\cdot \max \left\{\frac{1}{ϵ},\frac{1}{{ϵ}^2}\Vert P_{-ϵ/16}^{-\max }{\Vert }_{2/3}\right\}$$

$$\begin{array}{rl}{p}_0^{-\frac{1}{2}}& {\left(1-ϵ-p_0\right)}^{3/2}\le \Vert P_{-ϵ}^{-\max }{\Vert }_{2/3}\\ & \le \left(1-p_0\right)\Vert P_{-ϵ}^{-\max }{\Vert }_0^{\frac{1}{2}}.\end{array}$$

$$\frac{1}{{ϵ}^2}(2^n\delta {)}^{1/4},$$

$$H_{\alpha }(P):=\frac{\alpha }{1-\alpha }\log \Vert P{\Vert }_{\alpha }.$$

$$Q=P$$

$$\Vert P-Q{\Vert }_1>ϵ$$

$$\begin{array}{rl}{2}^{\frac{1}{2}{H}_{\infty }(P)}& {\left(1-ϵ-2^{-H_{\infty }(P)}\right)}^{3/2}\le \Vert P_{-ϵ}^{-\max }{\Vert }_{2/3}\\ & \le \left(1-2^{-H_{\infty }(P)}\right)\Vert P_{-ϵ}^{-\max }{\Vert }_0^{\frac{1}{2}}.\end{array}$$

$$s_{\min }^2$$

$$s_{\mathrm{suf}}\le c_1\frac{1-\frac{ϵ}{16}}{{ϵ}^2}\sqrt{s}$$

$$x^{2/3}\ge \frac{{x^{\ast }}^{2/3}}{x^{\ast }}x={x^{\ast }}^{-1/3}x$$

$$\Vert \tilde{P}{\Vert }_{2/3}^{2/3}$$

$$=\Vert \tilde{P}{\Vert }_{\infty }^{-1/3}\Vert \tilde{P}{\Vert }_1.$$

$$\Vert v{\Vert }_p\le s^{\frac{1}{p}-\frac{1}{q}}\Vert v{\Vert }_q,$$

$$\Vert P_{-ϵ}^{-\max }{\Vert }_{2/3}\le \Vert P_{-ϵ}^{-\max }{\Vert }_0^{\frac{1}{2}}\Vert P_{-ϵ}^{-\max }{\Vert }_1.$$

$$\Vert P_{-ϵ}^{-\max }{\Vert }_{2/3}$$

$$\ge \Vert (P_{\upharpoonright \mathcal{F}}{)}_{-ϵ}^{-\max }{\Vert }_{2/3}$$

$$=P(\mathcal{F})\Vert (P_{\upharpoonright \mathcal{F}}{)}_{-ϵ}^{-\max }/P(\mathcal{F}){\Vert }_{2/3}$$

$$=P(\mathcal{F})\Vert (P_{\mathcal{F}}{)}_{-ϵ/P(\mathcal{F})}^{-\max }{\Vert }_{2/3}.$$

$$\begin{array}{rl}\exists \alpha ,& \gamma >0:\forall n\in {\mathbb{Z}}_{+}\text{ and }\forall S\in {\mathcal{E}}_n:\\ & \underset{U\sim {\mu }_n}{\mathrm{Pr}}\left(P_U(S)\ge \frac{\alpha }{|{\mathcal{E}}_n|}\right)\ge \gamma .\end{array}$$

$$\mathrm{Pr}(Z>a\mathbb{E}[Z])\ge (1-a{)}^2\frac{\mathbb{E}[Z{]}^2}{\mathbb{E}[Z^2]},$$

$$H_{\infty }(P_U)\ge \frac{1}{2}\left(\log \delta -\log \sum _{S\in {\mathcal{E}}_n}{\mathbb{E}}_{U\sim {\mu }_n}[P_U(S{)}^2]\right).$$

$$H_2(P_U)$$

$$\ge -\log \left(\frac{1}{\delta }\cdot {\mathbb{E}}_{U\sim {\mu }_n}\left[\sum _{S\in {\mathcal{E}}_n}{P}_U(S{)}^2\right]\right).$$

$$H_{\alpha }(P)\ge H_{\infty }(P)\ge \frac{\alpha -1}{\alpha }{H}_{\alpha }(P),$$

$$s_{\min }\in \Omega \left(2^n/{ϵ}^2\right).$$

$$s_{\min }$$

$$U_W=\exp \left[\mathrm{i}\left(\sum _{i<j}{w}_{i,j}{X}_i{X}_j+\sum _i{w}_{i,i}{X}_i\right)\right],$$

$$E_W[|⟨S|U_W|0⟩{|}^4]\le 3\cdot 2^{-2n}.$$

$$H_{\infty }(P_{U_W})\ge \frac{1}{2}\left(n+\log \frac{\delta }{3}\right),$$

$${\mathbb{E}}_{p\sim P_{\mathrm{PT}}}[p^2]=\frac{2}{|{\mathcal{E}}_n|(|{\mathcal{E}}_n|+1)}.$$

$${\mathbb{E}}_{U\sim \mu }[|⟨S|U|S_0⟩{|}^4]\le \frac{2(1+\tilde{\epsilon })}{|{\mathcal{E}}_n|(|{\mathcal{E}}_n|+1)}.$$

Full text

I Introduction

Quantum sampling devices have been hailed as promising candidates for the demonstration of “quantum (computational) supremacy”111 Acknowledging the recent debate, we use the term “quantum (computational) supremacy” strictly in its established technical meaning Preskill (2013). Preskill (2013). The goal of any such experiment is to unambiguously demonstrate that quantum devices can solve some tasks both faster and with a more favourable scaling of the computational effort than any classical machine. At the same time, in the near term it is bound to use those small and computationally restricted quantum devices that are available before the arrival of universal, scalable, and fault-tolerant quantum computers. This challenge has sparked a flurry of experimental activity Spring et al. (2013); Tillmann et al. (2013); Broome et al. (2013); Crespi et al. (2013); Carolan et al. (2014); Spagnolo et al. (2014) and prompted the development of better classical sampling schemes for exact Clifford and Clifford (2018); Neville et al. (2017) and imperfect realizations Gogolin et al. (2013); Bremner et al. (2017); Oszmaniec and Brod (2018); Renema et al. (2018). Due to the reality of experimental imperfections, the key theoretical challenge — achieved in Refs. Aaronson and Arkhipov (2013a); Boixo et al. (2018); Bremner et al. (2016); Bouland et al. (2019); Gao et al. (2017); Bermejo-Vega et al. (2018); Hangleiter et al. (2018); Bouland et al. (2018); Yoganathan et al. (2018) using Stockmeyer’s approximate counting algorithm Stockmeyer (1985) — is to prove that even approximately sampling from the output distribution of the quantum device is classically hard.

In any such demonstration, the issue of certification is of outstanding importance Shepherd and Bremner (2009); Gogolin et al. (2013); Aaronson and Arkhipov (2013b); Aolita et al. (2015); Hangleiter et al. (2017); Bouland et al. (2019): To demonstrate something non-trivial, one not only needs to build a device that is designed to sample approximately from a classically hard distribution but at the same time, one needs to ensure from a feasible number of uses of the device (or its parts) that it actually achieves the targeted task. How can one convince a skeptical certifier that a quantum device, which supposedly does something no classical machine can do, actually samples from a distribution that is close enough to the ideal target distribution?

The arguably most elegant and most convincing certification would be one based on purely classical data, ideally only the samples produced by the device and a description of the target distribution. Such certification would be free of additional complexity-theoretic assumptions and device-independent, in that it would be agnostic to all implementation details of the device and would directly certify that the classically defined sampling problem was solved.

In this work, we rigorously prove for a broad range of sampling problems, specifically for boson sampling Aaronson and Arkhipov (2013a), universal random circuit sampling Boixo et al. (2018); Bouland et al. (2019), IQP circuit sampling Shepherd and Bremner (2009); Bremner et al. (2016), and sampling from post-selected-universal 2-designs Hangleiter et al. (2018); Nakata et al. (2014, 2017); Yoganathan et al. (2018); Bouland et al. (2018) that they cannot be efficiently certified from classical samples and a description of the target probability distribution. Ironically, it turns out that the same property of a distribution that allows to prove the known approximate-hardness results also forbids their non-interactive sample-efficient device independent certification, to the effect that with the known proof methods both properties cannot be achieved simultaneously in such schemes. We directly bound the sample complexity of certification, which means that we automatically also lower bound the computational complexity and that our results cannot be circumvented by increasing the classical computational power of the certifier222This makes our results conceptually different from the observation of Brandão. This observation is based on a result by Trevisan, Tulsiani, and Vadhan Trevisan et al. (2009), was reported by Aaronson and Arkhipov Aaronson and Arkhipov (2013b) and shows the following: For most unitaries $U$ drawn from the Haar measure, and any fixed circuit size $T$, there exists a classical “cheating” circuit of size polynomially larger than $T$, whose output distribution can not be distinguished from the corresponding boson sampling distribution by any “distinguisher” circuit of size $T$..

The specific question of certification we focus on here is (see Figure 1): Given unlimited computational power and a full description of the target distribution, how many samples from an unknown distribution are required to guarantee that this distribution is either identical to the target distribution or at least some preset distance away from it? This problem of distinguishing one (target) distribution from all sufficiently different alternatives is known as identity testing Goldreich (2017) in the property testing literature. Identity testing is an easier task than its robust version in which the certifier is moreover required to accept a constant-size region around the target distribution Valiant and Valiant (2010); Aolita et al. (2015). At the same time, it is much harder than mere state-discrimination, where the task is to differentiate between two fixed distributions.

Lower bounds on the sample complexity of restricted state-discrimination scenarios Gogolin et al. (2013) prompted the development of schemes Aaronson and Arkhipov (2013b) that allow to corroborate and build trust in experiments Spagnolo et al. (2014); Carolan et al. (2014); Walschaers et al. (2016). This helped spark interest in the problem of device-independent certification — on which there had not been much progress since Shepherd and Bremner (2009). In contrast to previous work Gogolin et al. (2013), here, the certifier is given a full description of the target distribution333 In particular, the certifier is given the value of all target probabilities to arbitrary precision.

and unlimited computational power.

Our proofmakes use of a key property for the proof of hardness of approximate sampling, namely an upper bound on the second moments of the output probabilities with respect to the choice of a random unitary specifying the instance of the sampling problem. The bound on the second moments implies that the probabilities are concentrated around the uniform distribution and hence an anti-concentration property. This anti-concentration allows lifting results on the hardness of approximate sampling up to relative errors to ones for additive errors — provided relative-error approximation of the output probabilities is hard on average. It is thus a key property to prove hardness in the physically relevant case of approximate sampling that prevents a purely classical non-interactive certification of the output distribution, see Figure 2.

A central ingredient to our proof is a recent result by Valiant and Valiant (2017) specifying the optimal sample complexity of certifying a known target distribution $P$. It can be stated as follows. Fix a preset distance $\epsilon>0$ up to which we want to certify. Now, suppose we receive samples from a device that samples from an unknown probability distribution $Q$. Then — for some constants $c_{1},c_{2}$ — it requires at least

[TABLE]

and at most

[TABLE]

many samples to distinguish the case $P=Q$ from the case $\|P-Q\|_{1}\geq\epsilon$ with high probability. Here $\|\cdot\|_{1}$ denotes the $\ell_{1}$-norm reflecting the total-variation distance. The central quantity determining the sample complexity of certification is thus the quasi-norm $\|P_{-\epsilon}^{-\max}\|_{2/3}$ which is defined as follows. First, find the truncated distribution $P_{-\epsilon}^{-\max}$ by removing the tail of the target distribution $P$ with weight at most $\epsilon$ as well as its largest entry, see Figure 3. Then, take the $\ell_{2/3}$-norm as given by $\|x\|_{2/3}=(\sum_{i}|x_{i}|^{2/3})^{3/2}$ for a vector $x$ with entries $x_{i}$.

We now proceed in two steps. First, we show lower and upper bounds on the quantity $\|P_{-\epsilon}^{-\max}\|_{2/3}$ in terms of the largest probability $p_{0}$ occurring in $P$ and its support $\|P_{-\epsilon}^{-\max}\|_{0}$ as given by

[TABLE]

Then it follows from Eqs. (1) and (3) that the sample complexity of certifying a distribution $P$ up to a constant total-variation distance $\epsilon$ is essentially lower bounded by $1/\sqrt{p_{0}}$. Hence, if $P$ is exponentially flat in the sense that the largest probability is exponentially small in the problem size (here, the number of particles), $\epsilon$-certification requires exponentially many samples. Conversely, if $P_{-\epsilon/16}^{-\max}$ is supported on polynomially many outcomes only, sample-efficient certification is possible by the converse bound (2).

Second, we connect this result to the output distributions of “quantum supremacy” schemes. In all schemes that rely on the Stockmeyer argument, the problem instances are defined in terms of a unitary that is randomly chosen from some restricted family, e.g., linear optical circuits in the case of boson sampling Aaronson and Arkhipov (2013a) or random universal circuits Boixo et al. (2018); Bouland et al. (2019) in a qubit architecture . Specifically, we prove that with high probability over the choice of the random unitary, the distribution over outputs associated with this unitary is exponentially flat.

Putting everything together we obtain lower bounds on the sample complexity of certification for boson sampling, IQP circuit sampling and random universal circuit sampling with (sufficiently many) $n$ particles. In all of these cases, the sample complexity scales at least as fast as

[TABLE]

with probability at least $1-\delta$ over the random choice of the unitary.

The upshot is: a key ingredient of the proof of approximate sampling hardness as effected by the random choice of the unitary prohibits sample-efficient certification.

We show that one cannot hope for purely classical, non-interactive, device-independent certification of the proposed quantum sampling problems. This highlights the importance of devising alternative schemes of certification, or improved hardness results for more peaked distributions. We hope to stimulate research in such directions.

A particularly promising avenue of this type of certification has been pioneered by Shepherd and Bremner (2009): By allowing the certifier to choose the classical input to the sampling device rather than drawing it fully at random, it is under some plausible cryptographic assumptions possible to efficiently certify the correct implementation of a quantum sampler from its classical outcomes. This is facilitated by checking a previously hidden bias in the obtained samples and has been achieved for a certain family of IQP circuits Shepherd and Bremner (2009). However, in contrast to Ref. Bremner et al. (2016), there is no approximate sampling hardness result for this family.

Focusing on so-called relational problems as opposed to sampling problems, it has been argued via new complexity-theoretic conjectures that the task HOG of outputting the heavy outcomes of a quantum circuit (those outcomes with probability weight larger than the median of its output distribution) is classically intractable Aaronson and Chen (2017). Clearly, this task is sample-efficiently checkable via its in-built bias, but still requires exponential classical computation to determine the probabilities of the obtained samples, which are compared to the median.

Taking a pragmatic stance, one can make additional assumptions on the device. In fact, only recently has it been shown Bouland et al. (2019) that cross-entropy measures Boixo et al. (2018) provide direct bounds on the total-variation distance provided the entropy of the real distribution is larger than that of the target distribution. One might also be content with weaker notions of certification in total-variation distance such as the certification of a coarse-grained version of the full output distribution Wang and Duan (2016). Coarse-graining procedures are practically useful as corroboration schemes when distinguishing against plausible alternative distributions such as the uniform distribution, but of course fail to certify against adversarial distributions on the full sample space. All such approaches yield sample-efficient certificates that require exponential computational effort, rendering them feasible at least for intermediate-scale devices.

Another way to certify a sampling device is the certification of the entire machine from its components. However, such schemes need to make assumptions about the absence of unwanted influences between the components such as crosstalk. In a similar vein, one can make use of implementation details and give the certifier some quantum capabilities such as access to a small quantum computer Wiebe et al. (2014), the ability to manipulate single qubits Mills et al. (2018), or to measure the output quantum state in different bases with trusted quantum detectors Hangleiter et al. (2017); Bădescu et al. (2017) to devise certificates even in non-iid. settings Takeuchi and Morimae (2018). In this way, one can partially trade-in the simplicity of sampling schemes for better certifiability.

It is interesting to note the connection of our result with results on classical simulation. Similarly to our findings for the case of certification, Schwarz and Van den Nest (2013) find that for certain natural families of quantum circuits (including IQP circuits) classical simulation is possible for highly concentrated distributions, but impossible for flat ones, see Figure 4. This again gives substance to the interesting connection between superior computational power, the flatness of the distribution and the impossibility of an efficient certification.

Curiously, at the same time, the property that prohibits sample-efficient certification is by no means due to the hardness of the distribution. It is merely the flatness of the distribution on an exponential-size sample space as effected by the random choice of the unitary that is required for the approximate hardness argument via Stockmeyer’s algorithm and standard conjectures. The uniform distribution on an exponentially large sample space, which is classically efficiently samplable, can also not be sample-efficiently certified.

A further noteworthy connection is that to Shor’s algorithm. The output distribution of the quantum part of Shor’s algorithm is typically spread out over super-polynomially many outcomes and can hence neither be efficiently simulated via the algorithm of Schwarz and Van den Nest (2013), nor certified as we show here. However, after the classical post-processing, the output distribution is strongly concentrated on few outcomes — the factors — from which one can verify the correct working of the algorithm. A certification of the intermediate distribution is simply not necessary to demonstrate a quantum speedup in Shor’s algorithm, as its speedup is derived from it solving a problem in $\mathsf{NP}$ and not from it sampling close to a hard distribution. This shows that while intermediate steps of a computation might not be certifiable, the final outcome may well be. Whether this is enough to demonstrate a speedup depends on the nature of the hardness argument. In fact, the abovementioned task HOG Aaronson and Chen (2017) bears many similarities to factoring and its certifiability from the outcomes of the algorithm.

We hope that our result will stimulate research into new ways of proving hardness of approximate sampling tasks that are more robust than those based on anti-concentration, as well as into devising alternative verification schemes possibly based on mild and physically reasonable assumptions on the sampling device or the verifier.

II Setup and definitions

Let us begin the technical part of this work by setting the notation. We use the Landau symbols $O$ and $\Omega$ for asymptotic upper and lower bounds and $\Theta$ for their conjunction. For any $j\in\mathbb{Z}^{+}$ we employ the short hand notation $[j]\coloneqq\{1,\dots,j\}$ for the range. By $\log$ we denote the logarithm to basis $2$. For any vector $x\in\mathbb{R}^{n}$ we define $\|x\|_{\infty}\coloneqq\max_{i\in[n]}|x_{i}|$ and $\|x\|_{p}\coloneqq\left(\sum_{i=1}^{n}|x_{i}|^{p}\right)^{1/p}$ for $0<p<\infty$ and take $\|x\|_{0}\coloneqq|\{i\in[n]:x_{i}\neq 0\}|$ to denote the number of non-zero elements of $x$. Thus, $\|\cdot\|_{p}$ is the standard $\ell_{p}$-norm whenever $p\geq 1$. For $p\in(0,1)$, $\|\cdot\|_{p}$ no longer satisfies the triangle inequality, but it is obviously absolutely homogeneous and still defines a quasinorm. We will also make use of the $\alpha$-Rényi entropies, which for any probability vector $P=(p_{1},\ldots,p_{n}),\,p_{i}\geq 0,\,\sum_{i}p_{i}=1$ and $0\leq\alpha\leq\infty,\alpha\neq 1$ are defined to be

[TABLE]

We refer to $H_{\infty}(P)=-\log\max_{i\in[n]}p_{i}$ as the min-entropy of $P$.

We are now in the position to formalize the notion of a test that certifies that a given device indeed samples from a distribution sufficiently close to a given target distribution. More precisely, we consider a family of sample spaces $\mathcal{E}_{n}$ with $n\in\mathbb{Z}^{+}$. The parameter $n$ will be the natural problem size in the concrete examples below. The object of interest is a classical algorithm $\mathcal{T}_{n}$ which receives a description of a target distribution $P_{n}$ over $\mathcal{E}_{n}$, and a sequence $\mathcal{S}\sim Q^{s}$ of $s$ samples $S_{1},\ldots,S_{s}\in\mathcal{E}_{n}$ that have been drawn i.i.d. from some distribution $Q$ over $\mathcal{E}_{n}$ and must output $1$ or [math] for “accept” or “reject”, respectively. We illustrate this notion of certification in Figure 1.

Definition 1** (Certification test).**

For any $n$ let $P$ be a (target) probability distribution on a sample space $\mathcal{E}$. We call $\mathcal{T}:\mathcal{E}^{s}\to\{0,1\}$ an $\epsilon$-certification test of $P$ from $s$ samples if the following completeness and soundness conditions are satisfied for any distribution $Q$ over $\mathcal{E}$:

[TABLE]

For a family $\{P_{n}\}$ of probability distributions we call a family of tests $\{\mathcal{T}_{n}\}$ a sample-efficient $\epsilon$-certification test if for every $n$ $\mathcal{T}_{n}$ is an $\epsilon$-certification test from $s\in O({\mathsf{poly}}(n,1/\epsilon))$ samples.

Our notion of certification is device-independent in the sense that it does not assume anything about the internal working of the sampler (not even whether it is quantum or classical), but uses only the classical samples it outputs and a classical description of the target distribution. Among such device-independent certification scenarios, our scenario is the most general one in the sense that the certifier is given all the information contained in the target distribution. In particular, it is crucial that we explicitly allow the certification test $\mathcal{T}_{n}$ to depend on all details of the target distribution $P_{n}$.

As we are not concerned with the computational complexity of the test, but only its sample complexity, we allow the certification algorithm unlimited computational power. In particular, it does not matter how exactly $\mathcal{T}_{n}$ is given access to a description of $P_{n}$, but for the sake of concreteness $\mathcal{T}_{n}$ can be thought of as having access to an oracle that provides the probabilities $P_{n}(S)$ of all $S\in\mathcal{E}_{n}$ up to arbitrary precision. Sample-efficiency is clearly a necessary requirement for computational efficiency of a test, as any test takes at least the time it needs to read in the required number of samples, so that lower bounds on the sample complexity are stronger than such on the computational complexity.

We note that our notion of certification corresponds to what in the literature on property testing Goldreich (2017) is called identity testing with a fixed target distribution. It stands in contrast to the previously considered task of state discrimination Gogolin et al. (2013); Aaronson and Arkhipov (2013b), where the task is to decide from which of two given distributions $P$ or $Q$ a device samples. $\epsilon$-certification in the sense of Definition 1 is more demanding in the sense that $P$ has to be distinguished from all distributions $Q$ such that $\|P-Q\|_{1}\geq\epsilon$. It is precisely this type of certification that is necessary to convince a skeptic of “quantum supremacy” via, say boson sampling, as the hardness results on approximate boson sampling only cover distributions within a small ball in $\ell_{1}$-norm around the ideal target distribution. A device sampling from a distribution further away from the ideal distribution, might still be doing something classically intractable, but this cannot be concluded from the hardness of approximate boson sampling.

III No certification of flat distributions

This section is concerned with the question of whether distributions with a high min-entropy can be certified in a sample-efficient way. The main insights into this question come from a work by Valiant and Valiant (2017) on property testing, which gives a sample-optimal certification test (up to constant factors) for any fixed distribution $P$, as well as a lower bound on the sample complexity of certification. The result is stated in terms of an $\ell_{2/3}$-norm of a vector obtained from the distribution. Our main technical contribution is to find bounds on these quasi-norms that are relevant in the context of certifying “quantum supremacy” distributions.

To state the main result of Ref. Valiant and Valiant (2017), we adapt their following notation and illustrate it in Figure 3. For any vector of non-negative numbers $P$,

1. (i)

let $P^{-\mathrm{max}}$ be the vector obtained from $P$ by setting the largest entry to zero, and 2. (ii)

let $P_{-\epsilon}$ be the vector obtained from $P$ by iteratively setting the smallest entries to zero, while the sum of the removed entries remains upper bounded by $\epsilon>0$.

It turns out that the optimal sample complexity for $\epsilon$-certifying any distribution $P$ is essentially given by $\frac{1}{\epsilon^{2}}\|P_{-\epsilon}^{-\mathrm{max}}\|_{2/3}$. The intuition is that any $\epsilon$ deviation from $P$ that is contained in either the largest probability or the tail of the distribution is easily detected. Intuitively, this is because a constant deviation in these parts of the distribution will be visible in the samples obtained with high probability Valiant and Valiant (2017). More precisely, the following upper and lower bounds on the sample complexity of certification hold:

Theorem 2** (Optimal certification tests Valiant and Valiant (2017)).**

There exist constants $c_{1},c_{2}>0$ such that for any $\epsilon>0$ and any target distribution $P$, there exists an $\epsilon$-certification test from $c_{1}\,\max\{\frac{1}{\epsilon},\frac{1}{\epsilon^{2}}\,\|P_{-\epsilon/16}^{-\mathrm{max}}\|_{{2/3}}\}$ many samples, but there exists no $\epsilon$-certification test from fewer than $c_{2}\,\max\{\frac{1}{\epsilon},\frac{1}{\epsilon^{2}}\,\|P_{-2\epsilon}^{-\mathrm{max}}\|_{{2/3}}\}$ samples.

We note that $\|P_{-\epsilon}^{-\mathrm{max}}\|_{{2/3}}\leq\|P\|_{{2/3}}$ for any $P$, and in many cases the former is only a constant factor away from the latter. We obtain the following general bounds on $\|P_{-\epsilon}^{-\mathrm{max}}\|_{{2/3}}$ in terms of the min-entropy and support of $P$:

Lemma 3** (Bounds on $\|P_{-\epsilon}^{-\mathrm{max}}\|_{{2/3}}$).**

[TABLE]

To get a feeling for what these bounds imply, let us consider two special cases and sufficiently small $\epsilon$. If for some constant $\kappa$ it holds that $H_{\infty}(P)=\log(\kappa\,|\mathcal{E}_{n}|)$, they imply the following lower bound on the required minimal number of samples, $s_{\mathrm{min}}$:

[TABLE]

For all distributions whose min-entropy is essentially given by the logarithm of the size $|\mathcal{E}_{n}|$ of the sample space, the sample complexity for certification thus scales at least as the square root of that size. If, on the contrary, $P_{-\epsilon/16}$ has support on at most $s\geq\|P_{-\epsilon/16}\|_{0}$ many probabilities we have the following upper bound

[TABLE]

on the number of samples $s_{\mathrm{suf}}$ that is sufficient for $\epsilon$-certification. This bound implies that distributions supported only on polynomially many outcomes can be certified from polynomially many samples.

Proof of Lemma 3.

For the lower bound, we use that concavity of the function $x\mapsto x^{2/3}$ implies that for any fixed $x^{\ast}>0$ and any $0\leq x\leq x^{\ast}$ we have

[TABLE]

and thus for any (not necessarily normalized) $\tilde{P}\coloneqq(\tilde{p}_{1},\dots,\tilde{p}_{\tilde{n}})$ with $\tilde{p}_{i}\geq 0$

[TABLE]

Using this for $\tilde{P}=P_{-\epsilon}^{-\mathrm{max}}$ and that both $\|P_{-\epsilon}^{-\mathrm{max}}\|_{\infty}\leq\|P\|_{\infty}$ and $\|P_{-\epsilon}^{-\mathrm{max}}\|_{1}\geq 1-\epsilon-\|P\|_{\infty}$ finally implies the lower bound.

For the upper bound, we use that for any vector $v$ and $0<p<q\leq\infty$ (see, e.g., Ref. (Foucart and Rauhut, 2013, Eq. (A.3)))

[TABLE]

where $s\geq\|v\|_{0}$. Inserting $p=2/3$ and $q=1$, one obtains for $v=P_{-\epsilon}^{-\mathrm{max}}$

[TABLE]

∎

Valiant and Valiant’s result Valiant and Valiant (2017) also has immediate consequences on the certifiability of post-selected probability distributions, such as those arising in boson sampling Aaronson and Arkhipov (2013a). A certification algorithm has to distinguish the target distribution $P$ from all probability distributions that are at least $\epsilon$-far away from $P$. That is true, in particular, for distributions that differ from $P$ by at least $\epsilon$ in $\ell_{1}$-norm only on some part $\mathcal{F}$ of the sample space, but are identical with $P$ on its complement $\mathcal{F}^{c}$. Intuitively one can expect that to distinguish such distributions, samples from $\mathcal{F}^{c}$ do not help. One might hence expect that it should be possible to lower bound the sample complexity of certifying the full distribution by the sample complexity of the post-selected distribution on some subspace $\mathcal{F}$ of the sample space, at least as long as the post-selection probability is not too low.

To make this intuition precise, define for any probability distribution $P$ and any subset $\mathcal{F}\subset\mathcal{E}$ the restriction $P_{\restriction\mathcal{F}}\coloneqq(p_{i})_{i\in\mathcal{F}}$ of $P$ to $\mathcal{F}$ (no longer normalized), as well as the post-selected probability distribution $P_{\mathcal{F}}\coloneqq P_{\restriction\mathcal{F}}/P(\mathcal{F})$, with post-selection probability $P(\mathcal{F})\coloneqq\|P_{\restriction\mathcal{F}}\|_{1}$.

Lemma 4** (Lower bounds with post-selected distributions).**

Let $P$ be a probability distribution on $\mathcal{E}$. Then with $c_{2}$ the constant from Theorem 2 and for any $\epsilon>0$ and $\mathcal{F}\subset\mathcal{E}$, there exists no $\epsilon$-certification test of $P$ from fewer than $c_{2}\max\{\frac{1}{\epsilon},\frac{1}{\epsilon^{2}}P(\mathcal{F})\,\|(P_{\mathcal{F}})_{-2\epsilon/P(\mathcal{F})}^{-\max}\|_{2/3}\}$ samples.

Proof of Lemma 4.

For any $\mathcal{F}\subset\mathcal{E}$ we have

[TABLE]

Here, the first inequality becomes an equality in case $\mathcal{F}$ contains the support of $P_{-\epsilon}^{-\max}$. The second inequality becomes an equality whenever the smallest probabilities with weight not exceeding $\epsilon$ as well as the largest probability lie inside of $\mathcal{F}$. Finally, the last equality follows from the fact that when renormalizing $P_{\restriction\mathcal{F}}$ we also need to renormalize the subtracted total weight $\epsilon$ by the same factor. The claim then straightforwardly follows from Theorem 2. ∎

A non-trivial bound for the sample complexity is therefore achieved only in case the post-selected subspace has at least weight $P(\mathcal{F})>2\epsilon$. This is due to the strength of Valiant and Valiant’s result Valiant and Valiant (2017) in that a part of the distribution with total weight $2\epsilon$ does not influence the minimally required sample complexity of $\epsilon$-certification and this part might just be supported on $\mathcal{F}$.

IV “Quantum supremacy” distributions cannot be certified

We will now apply the result of the previous section to the case of certifying “quantum supremacy” distributions. As a result, we find that prominent schemes aimed at demonstrating “quantum supremacy”, most importantly boson sampling, cannot be certified from polynomially many classical samples and a description of the target distribution alone. To be more concrete, in the context of “quantum supremacy”, there has recently been an enormous activity aiming to devise simple sampling schemes, which show a super-polynomial speedup over any classical algorithm even if the sampling is correct only up to a constant $\ell_{1}$-norm error Aaronson and Arkhipov (2013a); Bremner et al. (2016); Boixo et al. (2018); Miller et al. (2017); Gao et al. (2017); Bermejo-Vega et al. (2018); Bouland et al. (2018); Morimae (2017); Hangleiter et al. (2018). The method used to prove all the aforementioned speedups is the proof technique pioneered by Terhal and DiVincenzo Terhal and DiVincenzo (2004) for the case of exact sampling, which is based on an application of Stockmeyer’s approximate counting algorithm Stockmeyer (1985). Stockmeyer’s algorithm is used to prove that, conditioned on a conjecture on the average-case hardness of certain problems, the polynomial hierarchy would collapse if the respective distribution could be sampled efficiently classically. To extend this proof technique to the case of approximate sampling up to an (additive) $\ell_{1}$-norm error requires an additional property on the sampled distribution, namely, anti-concentration Aaronson and Arkhipov (2013a); Bremner et al. (2016).

More precisely, the aforementioned tasks all fit the following schema: Given the problem size $n$, start from a reference state vector $|{S_{0}}\rangle$ from a Hilbert space $\mathcal{H}_{n}$ and apply a unitary $U$ drawn with respect to some measure $\mu_{n}$ on the corresponding unitary group. The resulting state is then measured in the computational basis, thereby resulting in outcome $S$ with probability $P_{U}(S)\coloneqq|\langle{S}|U|{S_{0}}\rangle|^{2}$. One then says that the distribution over $P_{U}$ induced by this procedure anti-concentrates if

[TABLE]

In words this roughly means: For any $n$ the induced distribution over $P_{U}$ has the property that for any fixed outcome $S$ it does not become too unlikely that the probability of getting that outcome is much smaller than it would be for the uniform distribution.

It is intuitive that due to normalization, anti-concentration also implies that not too much of the probability weight can be concentrated in few outcomes, hence the name. This is however slightly misleading, as anti-concentration does not in itself imply a that $P_{U}$ also needs to have a high min-entropy with high probability. To see this, take any $\alpha,\gamma(\alpha)$-anti-concentrating scheme of drawing probability distributions $P_{U}$. Construct $\tilde{P}_{U}$ from $P_{U}$ by dividing all probabilities in half and adding their joint weight to $P_{U}(0)$. The resulting scheme to construct $\tilde{P}_{U}$ is now still $\alpha/2,\gamma(\alpha)$-anti-concentrating, but has min-entropy $H_{\infty}(\tilde{P}_{U})\leq\log(2)$ with probability one.

However, most known proofs of anti-concentration Bremner et al. (2016, 2017); Aaronson and Arkhipov (2013b); Hangleiter et al. (2018) (with the notable exception of Morimae’s hardness result Morimae (2017)444There, Morimae proves anti-concentration for the output distribution so-called one-clean qubit model (DQC1) in a direct manner. ) rely on the Paley-Zygmund inequality

[TABLE]

for a random variable $Z\geq 0$ with finite variance and $0\leq a\leq 1$. Anti-concentration is then proved by deriving a bound on the second moment of the distribution $\{P_{U}(S)\}_{U\sim\mu_{n}}$, and, as we will see in the next section, the same second moment bound that is used to derive anti-concentration implies a high min-entropy. We lay out the proof structure and the role that second moments play in Figure 2.

IV.1 Second moments bound the min-entropy

We now turn to showing that with high probability over the choice of $U$, the second moment of the distribution $\{P_{U}(S)\}_{U\sim\mu_{n}}$ (for fixed $S$) — implying the anti-concentration property (20) — yields a lower bound on the min-entropy of the output distribution $P_{U}$ of any fixed unitary $U$ with high probability. Lemma 3 then implies that distributions with exponentially (in $n$) small second moments cannot be certified from polynomially many samples with high probability. Thus, the very property that implies sampling hardness of a distribution $P_{U}$ up to an additive total-variation distance error also implies that the same distribution cannot be efficiently certified from classical samples only.

Lemma 5** (Tail bound for the min-entropy).**

For any $n\in\mathbb{Z}^{+}$, let $P_{U}$ be a distribution on $\mathcal{E}_{n}$ induced via $P_{U}(S)=|\langle{S}|U|{S_{0}}\rangle|^{2}$, $U\sim\mu_{n}$ by a corresponding measure $\mu_{n}$ on the unitary group. Then, with probability at least $1-\delta$ over the choice of $U\sim\mu_{n}$,

[TABLE]

The following arguments used to derive the lemma, in fact, hold for more general families of probability distributions $P_{U}$ where $U$ need not be unitary without any scaling in $n$.

Proof of Lemma 5.

We proceed as follows: First, we prove a lower bound on the typical Rényi-2-entropy of $P_{U}$ using the second moment of $\{P_{U}\}_{U\sim\mu_{n}}$, and then use equivalence of the $\alpha$-Rényi entropies for $\alpha>1$.

Analogously to Ref. (Aaronson and Arkhipov, 2013b, App. 11), we use Markov’s inequality to obtain that with probability at least $1-\delta$ over the choice of $U$, we have

[TABLE]

What is more, one can show that all $\alpha$-Rényi entropies for $\alpha>1$ are essentially equivalent and in particular Wilming et al. (2018)

[TABLE]

for any distribution $P$ on $\mathcal{E}_{n}$ from which the claim follows555We show Eq. (25) as well as an alternative proof for Lemma 5 in Section A.. ∎

We note that, indeed, the notion of anti-concentration as formalized in Eq. (20) in itself does not necessarily imply that the output distribution of every (or most) fixed unitaries have high min-entropy. This is because anti-concentration merely requires that the tails of the distribution have sufficient (constant) weight, while allowing for few large probabilities. Nevertheless, in prominent cases, an anti-concentration result derives from bounds on the $2$-Rényi entropy.

IV.2 “Quantum supremacy” distributions are flat

We now apply our results to the most prominent examples of “quantum supremacy” schemes — boson sampling Aaronson and Arkhipov (2013a), IQP circuits Bremner et al. (2016), and universal random circuits Boixo et al. (2018). We will conclude from Lemmas 3–5 that these schemes cannot be efficiently certified from polynomially many samples only. In the following, we show that for all of these schemes with output distribution $P_{U}$ we have that $H_{\infty}(P_{U})\in\Omega(n)$ and hence that the minimal sample complexity for certification scales exponentially in $n$. More precisely, both for boson sampling and the qubit-based schemes mentioned above all of which we precisely define below in Sections V.1–V.3, we obtain the following lower bounds.

Theorem 6** (Lower bounds on certifying boson sampling).**

Let $0<\epsilon<1/2$, $n\in\mathbb{Z}_{+}$ sufficiently large and $m\in\Theta(n^{\nu})$. Under the conditions on $\nu$ used in Ref. Aaronson and Arkhipov (2013a) to prove the hardness of approximate boson sampling, and with high probability over the random choice of the unitary, there exists no $\epsilon$-certification test of boson sampling with $n$ photons in $m$ modes from $s<s_{\min}$ many samples, where

[TABLE]

In Section V.3, we discuss in detail the conditions under which Aaronson and Arkhipov’s hardness argument Aaronson and Arkhipov (2013a) holds and provide a full version of the theorem as Theorem 9. The key ingredient for this to be the case is the closeness of the measure obtained by taking $n\times n$-submatrices of Haar random unitaries $U\in U(m)$ and the Gaussian measure on $n\times n$-matrices. This is provably the case for $\nu>5$, but is conjectured to hold even for $\nu>2$ Aaronson and Arkhipov (2013a). Our bound on $s_{\min}$ (see Theorem 9) holds with exponentially high probability (in $n$) for $\nu>3$. In the case $\nu>2$ our result holds only with polynomially high probability and fails to cover a small set of the instances. The argument proving Theorem 6 easily extends to certain variants of quantum Fourier sampling Fefferman and Umans (2015), the output probabilities of which are also given by permanents of nearly Gaussian matrices.

Theorem 7** (Lower bounds on certifying random qubit schemes).**

For $0<\epsilon<1/2$ and sufficiently large $n$, with probability at least $1-\delta$, there exists no $\epsilon$-certification test from $s<s_{\min}$ many samples for

1. a.

IQP circuit sampling on $n$ qubits, where

[TABLE] 2. b.

$\tilde{\varepsilon}$-approximate spherical 2-design sampling on $n$ qubits, and in particular, depth-$(O(n^{2})+O(n\log 1/\tilde{\varepsilon}))$* local random universal circuits, where*

[TABLE]

The result of Theorem 7 applies to any circuit family $\mathcal{U}$ such that $\{U|{S_{0}}\rangle\}_{U\sim\mathcal{U}}$ forms a relative $\tilde{\varepsilon}$-approximate spherical 2-design, for which the second moments are upper bounded as in Eq. (33). This applies, in particular, to the random universal circuits of Refs. Brandão et al. (2016); Harrow and Low (2009); Boixo et al. (2018); Bouland et al. (2019) as well as other families of random circuits that have been proposed for the demonstration of “quantum supremacy” such as Clifford circuits with magic-state inputs Hangleiter et al. (2018); Yoganathan et al. (2018), diagonal unitaries Hangleiter et al. (2018); Nakata et al. (2014) and conjugated Clifford circuits Bouland et al. (2018).

Proofs of Theorems 6 and 7.

We use Theorem 2 and Lemmas 3–5 as well as the lower bounds (50), (31), and (34) on the min-entropy of the respective output distributions as given in the following sections. What is more, we use that for $0<\epsilon<1/2$ and sufficiently large $n$ the term $(1-2\epsilon-2^{-H_{\infty}(P_{U})})^{3/2}$ can be lower-bounded by a constant and, hence, be dropped inside the $\Omega$. ∎

V Details on random sampling schemes and proofs of Theorems 6 and 7

We now turn to describing details on distributions arising from boson sampling, IQP circuits and universal random circuits, and present the proofs of the aforementioned theorems.

V.1 IQP circuits

An IQP circuit Shepherd and Bremner (2009) is a quantum circuit of commuting gates that is drawn uniformly at random from the family $\mathcal{U}_{n,\mathrm{IQP}}$ on $n$ qubits. The sample space is therefore given by $\mathcal{E}_{n}=\{0,1\}^{n}$. This family as formulated by Bremner, Montanaro, and Shepherd Bremner et al. (2016) is defined by a set of angles $A$, e.g., $A=\{0,\pi/8,\ldots,7\pi/8\}$. An instance $U_{W}\in\mathcal{U}_{n,\mathrm{IQP}}$ with $W\coloneqq(w_{i,j})_{i,j=1,\ldots,n}$ and $w_{i,j}\in A$ drawn uniformly at random, is then given by the following prescription

[TABLE]

where $X_{i}$ is the Pauli-$X$ matrix acting on site $i$. In other words, on every edge $(i,j)$ of the complete graph on $n$ qubits a gate $\exp(\mathrm{i}w_{i,j}X_{i}X_{j})$ with edge weight $w_{i,j}$ and on every vertex $i$ a gate $\exp(\mathrm{i}w_{i,i}X_{i})$ with vertex weight $w_{i,i}$ is performed.

For the output distribution of IQP circuits, Bremner et al. (Bremner et al., 2016, Appendix F) prove the second-moment bound

[TABLE]

By Lemma 5, this implies the following min-entropy bound

[TABLE]

which holds with probability at least $1-\delta$ over the choice of $U_{W}$.

V.2 Universal random circuits and spherical 2-designs

A universal random circuit on $n$ qubits is defined by a universal gate set $\mathcal{G}$ comprising one- and two-qubit gates which give rise to the depth-$N$ family $\mathcal{U}_{\mathcal{G},N}$. A circuit $U\in\mathcal{U}_{\mathcal{G},N}$ is then constructed according to the standard prescription of choosing one- or two-qubit gates $G\in\mathcal{G}$ and the qubits they are applied to at random Brandão et al. (2016), or according to some more specific prescription such as the one of Boixo et al. (2018).

For the case of the random universal circuits of Ref. Boixo et al. (2018) there is evidence that the output distribution of fixed instances is essentially given by an exponential (Porter-Thomas) distribution $P_{\mathrm{PT}}$ whose second moment is given by (Hangleiter et al., 2018, Eq. (8))

[TABLE]

This is provably true for the local random universal circuits investigated by Brandão, Harrow, and Horodecki Brandão et al. (2016) by the fact that the resulting circuit family forms a relative $\tilde{\varepsilon}$-approximate unitary 2-design $\mu$ in depth $O(n^{2})+O(n\log 1/\tilde{\varepsilon})$ Brandão et al. (2016) so that

[TABLE]

Likewise, for any circuit family $\mathcal{U}_{n}$ on $n$ qubits such that $\{U|{0}\rangle\}_{U\sim\mathcal{U}_{n}}$ forms a relative $\tilde{\varepsilon}$-approximate spherical 2-design, the second moments are bounded as in Eq. (33). For all such circuit families, using Lemma 5, we thus obtain the min-entropy bound

[TABLE]

which holds with probability at least $1-\delta$ over the choice of $U$.

V.3 Boson sampling

In the boson sampling problem $n\geq 1$ photons are injected into the first $n$ of $m\in{\mathsf{poly}}(n)$ modes which are transformed in a linear-optical network via a mode transformation given by a Haar-random unitary $U\in U(m)$ and then measured in the Fock basis. The sample space of boson sampling is given by

[TABLE]

i.e., the set of all sequences of non-negative integers of length $m$ which sum to $n$. Its output distribution $P_{\mathrm{bs},U}$ is

[TABLE]

Here, the state vector $|{S}\rangle$ is the Fock space vector corresponding to a measurement outcome $S\in\Phi_{m,n}$, $|{1_{n}}\rangle$ is the initial state vector with $1_{n}\coloneqq(1,\dots,1,0,\dots,0)$, and $\varphi(U)$ the Fock space (metaplectic) representation of the implemented mode transformation $U$.

The distribution $P_{\mathrm{bs},U}$ can be expressed Scheel (2004); Aaronson and Arkhipov (2013a) as

[TABLE]

in terms of the permanent of the matrix $U_{S}\in\mathbb{C}^{n\times n}$ constructed from $U$ by discarding all but the first $n$ columns of $U$ and then, for all $j\in[m]$, taking $s_{j}$ copies of the $j^{\text{th}}$ row of that matrix (deviating from Aaronson and Arkhipov’s notation Aaronson and Arkhipov (2013a)). Here, the permanent for a matrix $X=(x_{j,k})\in\mathbb{C}^{n\times n}$ is defined similarly to the determinant but without the negative signs as

[TABLE]

where $\operatorname{Sym}([n])$ is the symmetric group acting on $[n]$. It is a known fact that calculating the permanent of a matrix to high precision is a problem that is $\mathsf{\#P}$-hard Valiant (1979), while its close cousin, the determinant, is computable in polynomial time. In fact, computing the permanent exactly (or with exponential precision) is also $\mathsf{\#P}$-hard on average for randomly chosen Gaussian matrices Lipton (1991); Aaronson and Arkhipov (2013a). In Ref. Aaronson and Arkhipov (2013a) this connection is exploited to show that, up to plausible complexity-theoretic conjectures, approximately sampling from the boson sampling distribution is classically intractable with high probability over the choice of $U$ if $m$ is scaled appropriately with $n$.

The main part of the hardness proof of Ref. Aaronson and Arkhipov (2013a) is to prove the classical hardness of sampling from the post-selected boson sampling distribution $P_{\mathrm{bs},U}^{*}$. The post-selected distribution $P_{\mathrm{bs},U}^{*}$ is obtained from $P_{\mathrm{bs},U}$ by discarding all output sequences $S$ with more than one boson per mode, i.e., all $S$ which are not in the set of collision-free sequences

[TABLE]

The hardness of sampling from the full boson sampling distribution follows from the fact that for the relevant scalings of $m$ with $n$ the post-selection can be done efficiently in the sense that on average at least a constant fraction of the outcome sequences is collision-free (Theorem 13.4 in Ref. Aaronson and Arkhipov (2013a)).

More precisely, the actual result proved in Ref. (Aaronson and Arkhipov, 2013a, Theorem 1.3) states that unless certain complexity-theoretic conjectures fail, there exists no classical algorithm that can sample from a distribution $Q$ satisfying $\|Q-P_{\mathrm{bs},U}\|_{1}\leq\epsilon$ in time ${\mathsf{poly}}(n,1/\epsilon)$. This result requires that $m\in\Omega(n^{5}\log(n)^{2})$, but it is conjectured that $m$ growing slightly faster than $\Omega(n^{2})$ is sufficient for hardness. In fact, at the same time, a faster than quadratic scaling is necessary for the proof strategy to work.

The key technical ingredient in the proof strategy underlying these requirements is the following result: if $m$ grows sufficiently fast with $n$, the measure induced on $U\sim\mu_{H}$ by the map $g_{S}=(U\mapsto U_{S})$ for collision-free $S\in\Phi_{m,n}^{*}$, i.e., the measure induced by taking $n\times n$-submatrices of unitaries $U\in U(m)$ chosen with respect to the Haar measure $\mu_{H}$ is close to the complex Gaussian measure $\mu_{G}(\sigma)$ with mean zero and standard deviation $\sigma=1/\sqrt{m}$ on $n\times n$-matrices. Given this result, Stockmeyer’s algorithm could be applied to the samples obtained from $P_{\mathrm{bs},U}^{*}$ in order to infer the probabilities $P_{\mathrm{bs},U}^{*}(S)$ and thus solve a $\mathsf{\#P}$-hard problem, as these probabilities can be expressed as the permanent of a Gaussian matrix. Since the closeness of those measures is the essential ingredient, also suitably large scaling of $m$ with $n$ is crucial for the hardness argument.

The formal statement of closeness of measures proved in Ref. Aaronson and Arkhipov (2013a) implies the following:

Lemma 8** (implied by Ref. (Aaronson and Arkhipov, 2013a, Theorem 5.2)).**

There exists a constant $C>0$ such that for every $\nu>5$ and every measurable $f:\mathbb{C}^{n\times n}\to\left[0,1\right]$ and every $m\in\Omega(m^{\nu})$ it holds that for all $S\in\Phi^{*}_{m,n}$

[TABLE]

At the same time, it is known from Ref. Jiang (2006) (see also Ref. (Aaronson and Arkhipov, 2013a, Section 5.1 and 6.2)) that if $m\leq c\,n^{\nu}$ with $\nu\leq 2$ and $c\in O(1)$ the two measures $\mu_{H}\circ g_{S}^{-1}$ and $\mu_{G(1/\sqrt{m})}$ are no longer close for large $n$. One may hope Aaronson and Arkhipov (2013a) that there exists a constant $c>0$ such that Theorem 5.2 in Ref. Aaronson and Arkhipov (2013a) and hence their hardness result as well as our Lemma 8 hold for any $m\geq c\,n^{\nu}$ with $\nu>2$. What we show is that even under this optimistic assumption efficient certification from classical samples is impossible, if the post-selection probability is large enough. This rules out many further cases for which one can hope to prove a hardness result by the same method.

Theorem 9** (Lower bounds on certifying boson sampling (full version)).**

Let $\nu>2$, $0<\epsilon<1/2$, $n\in\mathbb{Z}_{+}$ sufficiently large and $m\in\Theta(n^{\nu})$. Assume there exists a constant $C>0$ such that the assertion (40) of Lemma 8 holds. Then:

1. a.

With probability at least $1-\delta-2n^{2}/(m\zeta)$ over the choice of Haar-random unitaries $U\sim\mu_{H}$ there exists no $\epsilon$-certification test for boson sampling with $n$ photons in $m$ modes, from $s<s_{\mathrm{min}}$ many samples, where

[TABLE]

and $c>0$ is the implicit constant in (48). 2. b.

For $\nu>3$, with probability at least $1-\exp(-\Omega(n^{\nu-2-1/n}))$ over the Haar-random choice of $U\sim\mu_{H}$, there exists no $\epsilon$-certification test for boson sampling with $n$ photons in $m$ modes, where

[TABLE]

We remark that our results for the boson sampling distribution leave open the possiblity of sample-efficient $\epsilon$-certification for those instances of boson sampling with $2<\nu\leq 3$ in the regime in which the probability weight of the collision-free subspace is very small. For instance, this is the case whenever $1/{\mathsf{poly}}(n)\leq P_{\mathrm{bs},U}(\Phi_{m,n}^{*})\leq 2\epsilon$. This is because the bound (41) becomes trivial for $1-\zeta\leq 2\epsilon$.

However, our result fully covers the regime in which boson sampling is provably hard as shown in Ref. Aaronson and Arkhipov (2013a).

Proof of Theorem 9a.

The proof proceeds along the same lines as the proofs of Theorem 7 and is based on direct applications of Lemma 4 to the collision-free subspace and the min-entropy bound (22) from Lemma 5 to the post-selected boson sampling distribution $P_{\mathrm{bs},U}^{*}$ with post-selection onto the collision-free subspace $\Phi_{m,n}^{*}\subset\Phi_{m,n}$.

To apply Lemmas 4 and 5 simultaneously we need to account both for the probability weight of the collision-free subspace and large probabilities, however. To account for the probability weight of the collision-free subspace we use a simple application of Markov’s inequality to (Aaronson and Arkhipov, 2013a, Theorem 13.4) (restated as Lemma 10 in Section B),

[TABLE]

This shows that the total probability weight of the collision-free subspace is at least $1-\zeta$ with probability at least $1-2n^{2}/(m\zeta)$. We then apply a union bound argument to obtain

[TABLE]

In the next step, we use that the distribution of post-selected boson sampling is given by $P_{\mathrm{bs},U}^{*}=(P_{\mathrm{bs},U})_{\restriction\Phi_{m,n}^{*}}/P_{\mathrm{bs},U}(\Phi_{m,n}^{*})$. Consequently, with probability at least $1-\delta-{2n^{2}}/({\zeta m})$ the boson sampling distribution $P_{\mathrm{bs},U}$ restricted to the collision-free subspace has both of the desired properties – a large min-entropy and a probability weight of at least $1-\zeta$ of the collision-free subspace.

Let us now compute the min-entropy for the collision-free subspace. For all samples $S\in\Phi_{m,n}^{*}$, Ref. (Aaronson and Arkhipov, 2013a, Lemma 8.8) implies that there exists $C>0$ such that for $m\in\Theta(n^{\nu})$ with any $\nu>2$ for which the assertion of Lemma 8 holds, the following second moment bound also holds666The version of Ref. (Aaronson and Arkhipov, 2013a, Lemma 8.8) can be obtained from Eq. (45) from Lemma 8, normalizing the Gaussian measure $\mu_{G}$, and noting that $\operatorname{\mathbb{E}}_{X\sim\mu_{G}(1)}[|\operatorname{Perm}(X)|^{2}]=n!$.:

[TABLE]

To obtain a lower bound on the min-entropy of the distribution $P_{\mathrm{bs},U}^{*}$ on the collision-free subspace we use that

[TABLE]

Applying Lemma 5 together with the second moment bound (45), the union bound (44), the bound

[TABLE]

on the size of the collision-free subspace and Stirling’s formula yields

[TABLE]

which holds with probability $1-\delta-2n^{2}/(m\zeta)$ over the choice of $U\sim\mu_{H}$.

We note that $2^{-H_{\infty}(P_{\mathrm{bs},U}^{*})}\in o(1)$; hence this term can be neglected when applying Eq. (8) in Lemma 3. Applying Lemmas 3 and 4, and the min-entropy bound (48) we obtain that the sample complexity for $\epsilon$-certifying boson-sampling scales as

[TABLE]

with probability at least $1-\delta-2n^{2}/(\zeta m)$, where $c$ is the implicit constant in (48). This completes the proof of Theorem 9a.

∎

Note that the bound (45) is essential for the hardness argument of Aaronson and Arkhipov (2013a). Therefore a central ingredient to the hardness argument of Aaronson and Arkhipov (2013a) also prohibits sample-efficient certification of boson sampling.

It is important to stress that the boson sampling hardness proof Aaronson and Arkhipov (2013a) covers only those instances $U_{S}$ of boson sampling for which one can efficiently post-select on the collision-free outcomes. This is the case for those $U\sim\mu_{H}$ for which the probability weight of $\Phi_{m,n}^{*}$ is not smaller than polynomially small in $n$, i.e., $P_{\mathrm{bs},U}(\Phi_{m,n}^{*})\in\Omega(1/{\mathsf{poly}}(n))$. Our proof method for Theorem 9a thus permits sample-efficient certification for a small fraction of the instances, in particular, those instances of $U\sim\mu_{H}$ for which $2\epsilon\geq P_{\mathrm{bs},U}(\Phi_{m,n}^{*})>1/{\mathsf{poly}}(n)$.

In part b of the theorem we can close this gap by extending the bound (48) on the min-entropy of the post-selected distribution $P_{\mathrm{bs},U}^{*}$ to the full output distribution $P_{\mathrm{bs},U}$, however, at the cost of restricting to $\nu>3$. This removes the need to use Lemma 4 and hence the dependence on the probability weight of the collision-free subspace. In the remaining case with $2<\nu\leq 3$ hardness results have not been obtained, but it is conceivable that a hardness argument can be made.

Proof of Theorem 9b.

Gogolin et al. Gogolin et al. (2013) have proven the following strong lower bound on the min-entropy of the boson sampling distribution (see Theorem 11 in Section C for a restatement)

[TABLE]

which holds whenever the condition of the theorem are fulfilled and in addition $\nu>3$. In the proof, the probability measure induced on the matrices $U_{S}$ is related to a certain Gaussian measure $\mu_{G_{S}(\sigma)}$. Then, the min-entropy bound is proven using a trivial upper bound to the permanent as well as measure concentration for $\mu_{G_{S}(\sigma)}$. A simple application of Theorem 2 and Lemma 3 concludes the proof. ∎

VI Conclusion

We have shown that probability distributions with a high min-entropy cannot be certified from polynomially many samples, even when granting the certifier unlimited computational power and a full description of the target distribution. Our result applies to the problem of certifying quantum sampling problems as proposed to demonstrate a quantum speedup in a non-interactive device-independent fashion. We discuss the ironic situation that the very property that crucially contributes to the proof of approximate sampling hardness via Stockmeyer’s algorithm and the Paley-Zygmund inequality — the second moments of the sampled distribution — forbids sample-efficient classical verification. Our results highlight the importance of devising more elaborate certification schemes that allow for interaction between certifier and prover, invoke further complexity-theoretic assumptions or such on the sampling device, and/or grant the certifier some small amount of quantum capacities.

Acknowledgements

We are grateful to Adam Bouland who pointed us to the literature on property testing and thus provided the missing clue for finishing this project. We would like to thank Ashley Montanaro, Bill Fefferman, Tomoyuki Morimae, Martin Schwarz, and Juan Bermejo-Vega for fruitful discussions and Aram Harrow and Anand Natarajan for sharing an early version of their related work. Finally, we would like to thank two anonymous referees for their thorough proof-checking and interesting questions which helped improve the manuscript.

D. H. and J. E. acknowledge support from the ERC (TAQ), the Templeton Foundation, the DFG (EI 519/14-1, EI 519/9-1, EI 519/7-1, CRC 183), and the European Union’s Horizon 2020 research and innovation programme under grant agreement No. 817482 (PASQUANS). C. G. acknowledges support by the European Union’s Marie Skłodowska-Curie Individual Fellowships (IF-EF) programme under GA: 700140 as well as financial support from ARO under contract W911NF-14-1-0098 (Quantum Characterization, Verification, and Validation), the Spanish Ministry MINECO (National Plan 15 Grant: FISICATEAMO No. FIS2016-79508-P, SEVERO OCHOA No. SEV-2015-0522), Fundació Cellex, Generalitat de Catalunya (Grants No. SGR 874 and No. 875, CERCA Programme, AGAUR Grant No. 2017 SGR 1341 and CERCA/Program), ERC (CoG QITBOX and AdG OSYRIS), EU FETPRO QUIC, EU STREP program EQuaM (FP7/2007–2017, Grant No. 323714), and the National Science Centre, Poland-Symfonia Grant No. 2016/20/W/ST4/00314.

Appendix

In the following, we (re)state some facts and earlier results in order to make this work self-contained.

Appendix A Proofs for bounding the min-entropy

Here, we provide some details and proofs to statements made in Section IV.1. First, we show the equivalence of the Rényi entropies (25) proceeding analogously to Ref. Wilming et al. (2018): we simply use that for $\alpha>1$ and $p_{0}=\|P\|_{\infty}$ we have $p_{0}^{\alpha}\leq\sum_{i}p_{i}^{\alpha}$. Hence,

[TABLE]

We also provide an alternative proof of Lemma 5 based on the proof of Ref. (Gogolin et al., 2013, Theorem 13).

Alternative proof of Lemma 5.

We begin the proof by noting that

[TABLE]

Using the union bound (also known as Boole’s inequality) we obtain that for every $\delta>0$

[TABLE]

Next, using Markov’s inequality we can bound

[TABLE]

which concludes the proof. ∎

Appendix B Probability weight of the collision-free subspace

We recapitulate a bound of Aaronson and Arkhipov (2013a) on the probability weight of the collision-free subspace.

Lemma 10** ((Aaronson and Arkhipov, 2013a, Theorem 13.4)).**

Let $\mu_{H}$ be the Haar measure on $U(m)$ and $m\geq n$. Then

[TABLE]

Appendix C The min-entropy bound for boson sampling

Here, we provide a slightly improved proof of the following min-entropy bound for boson sampling from (Gogolin et al., 2013, Theorem 12).

Theorem 11** (Min-entropy bound for boson sampling (Gogolin et al., 2013, Theorem 12)).**

Let $\nu>3$ and assume that the assertion (40) of Lemma 8 holds. Then, the boson sampling output distribution $P_{\mathrm{bs},U}$ satisfies for $n$ bosons in $m\in\Theta(n^{\nu})$ modes

[TABLE]

The proof crucially uses the closeness of the Gaussian measure to the post-selected Haar measure as expressed by Lemma 8. Lemma 8, however, is not quite strong enough for proving Theorem 9, as we must be able to control all of $\Phi_{m,n}$ and not only the collision-free subspace $\Phi^{*}_{m,n}$. Fortunately, the above lemma extends naturally to all $S\in\Phi_{m,n}$ for the same scaling of $m$ with $n$ for which a version of Lemma 8 holds.

To state this extension we need some notation first: For every sequence $S$, let $\tilde{S}$ be the sequence obtained from $S$ by removing all the zeros, i.e,

[TABLE]

Further, let $\mu_{G_{S}(\sigma)}$ be the probability measure on $\mathbb{C}^{n\times n}$ obtained by drawing the real and imaginary part of every entry of a $|\tilde{S}|\times n$ matrix independently from a Gaussian distribution with mean zero and standard deviation $\sigma$ and then for all $j\in[|\tilde{S}|]$ taking $\tilde{s}_{j}$ copies of the $j^{\text{th}}$ row of this matrix. We can prove the following multiplicative error bound on the closeness of this measure and the Haar measure $\mu_{H}$ for all $S\in\Phi_{m,n}$:

Lemma 12** (Multiplicative error bound).**

Let $f:\mathbb{C}^{n\times n}\to\left[0,1\right]$ be measurable, then for any $m,n$ such that

[TABLE]

is true for some constant $C>0$, it holds that

[TABLE]

Proof.

Let $S\in\Phi_{m,n}$, define $\tilde{S}$ as in Eq. (59) and $m^{\prime}\coloneqq|\tilde{S}|$. Define $v$ to be the sequence containing $\tilde{s}_{j}$ times the integer $j$ for every $j\in[m^{\prime}]$ in increasing order and $w$ the sequence containing the positions of each of the first of the repeated rows in $U_{S}$, i.e.,

[TABLE]

The sequence $v$ defines a linear embedding $\eta:\mathbb{C}^{m^{\prime}\times n}\to\mathbb{C}^{n\times n}$ component wise by

[TABLE]

i.e., $\eta(Y)$ has $s_{j}$ copies of the $j$-th row of $Y$. The sequence $w$, in turn, defines a linear projection $\pi:\mathbb{C}^{n\times n}\to\mathbb{C}^{m^{\prime}\times n}$ by

[TABLE]

in particular, $\pi(U_{S})$ contains only the first out of each series of the repeated rows in $U_{S}$. Note that $\eta\circ\pi:\mathbb{C}^{n\times n}\to\mathbb{C}^{n\times n}$ is a projection onto the subspace of matrices that have the same repetition structure as $U_{S}$. Let

[TABLE]

then $f_{S}(U_{S})=f(U_{S})$ only depends on the first of the repeated rows in $U_{S}$ and is independent of all the other rows. Since the Haar measure is permutation-invariant we have

[TABLE]

Hence, using Lemma 8 in the second step, we obtain

[TABLE]

which finishes the proof. ∎

In addition to the multiplicative error bound we need the following concentration result for the Gaussian measure $\mu_{G_{S}(\sigma)}$, which implies that even the largest entry of a matrix drawn from $\mu_{G_{S}(\sigma)}$ is unlikely to be much larger than $\sigma$.

Lemma 13** (Concentration of the Gaussian measure $\mu_{G_{S}(\sigma)}$).**

For all $n,m\in\mathbb{Z}^{+}$, all $S\in\Phi_{m,n}$ and all $\xi>0$ it holds that

[TABLE]

where

[TABLE]

is the complementary error function.

Proof.

For Gaussian random variables we have

[TABLE]

This implies that

[TABLE]

At the same time, for all $S\in\Phi_{m,n}$ and $\xi>0$ it holds that

[TABLE]

because the repetition of entries in $X\sim\mu_{G_{S}(\sigma)}$ only increases the chance of not having an exceptionally large entry. ∎

As a last ingredient we need to bound the size

[TABLE]

of the sample space $\Phi_{m,n}$ of boson sampling (recall Eq. (35)). It grows faster than than exponentially with $n$, but if for some $\nu\geq 1$ and $c\geq 0$ it holds that $m\leq c\,n^{\nu}$, then

[TABLE]

We now have all the ingredients rederive the desired min-entropy bound in Theorem 11.

Proof of Theorem 11.

Using the union bound (also known as Boole’s inequality) in the first step we obtain that for every $\epsilon>0$

[TABLE]

We now apply Lemma 12 to the indicator function

[TABLE]

and the $S$ for which the maximum in Eq. (82) is attained, to obtain

[TABLE]

The definition of the permanent (recall Eq. (38)) implies that

[TABLE]

Hence, for every $S\in\Phi_{m,n}$ and every $\epsilon>0$

[TABLE]

Plugging this into Eq. (84), using Lemma 13 with $\xi=\left(\sqrt{\epsilon}/n!\right)^{1/n}$ and the bound on $|\Phi_{m,n}|$ from Eq. (78) we arrive at

[TABLE]

Bounding the complementary error function by Ermolova and Haggman (2004)

[TABLE]

we obtain

[TABLE]

If $x$ is large enough such that

[TABLE]

the geometric series in Eq. (91) converges and we get the simple bound

[TABLE]

To satisfy Eq. (92) for large $n$, it is sufficient that $x$ grows slightly faster than $\sqrt{\log(n^{2})}$ and we hence need to demand a growth slightly faster than $\log(n^{2})$ from the argument of the square root in the error function in Eq. (87). Because of the bound $n!\leq\mathrm{e}^{1-n}\,n^{n+1/2}$ (a variant of Stirling’s approximation) we have for the argument of that square root in Eq. (87)

[TABLE]

Demanding $\nu>2$ is hence all we need to be able to use the bound (93) for large $n$. With the convenient choice $\epsilon=2^{-2n}$ it hence follows that for all $\nu>2$

[TABLE]

The argument of the $O(\cdot)$ is dominated by the product $n^{(\nu-1)n}\exp(-c\,\mathrm{e}^{-2/n+2}\,n^{\nu-2-1/n}/8)$, which decays for large increasing $n$ only for $\nu>3$. More precisely, there are constants $n_{0}\in\mathbb{N}$ and $C_{1},C_{2},C_{3}>0$ such that for $n\geq n_{0}$

[TABLE]

where the last inequality holds only for $\nu>3$ since the logarithm grows slower than any power law with positive exponent. This completes the proof.

∎