Building trust for continuous variable quantum states

TL;DR

This paper introduces new methods for certifying and verifying continuous variable quantum states using heterodyne measurements, providing reliable, assumption-free protocols with analytical confidence intervals and without data reconstruction.

Contribution

It presents a novel certification method for continuous variable quantum states and an efficient verification protocol that does not assume identical copies or trust in the state source.

Findings

Reliable certification yields density matrix elements with confidence intervals

Verification protocol works against fully malicious adversaries

Method avoids data reconstruction and discrete binning

Abstract

In this work we develop new methods for the characterisation of continuous variable quantum states using heterodyne measurement in both the trusted and untrusted settings. First, building on quantum state tomography with heterodyne detection, we introduce a reliable method for continuous variable quantum state certification, which directly yields the elements of the density matrix of the state considered with analytical confidence intervals. This method neither needs mathematical reconstruction of the data nor discrete binning of the sample space, and uses a single Gaussian measurement setting. Second, beyond quantum state tomography and without its identical copies assumption, we promote our reliable tomography method to a general efficient protocol for verifying continuous variable pure quantum states with Gaussian measurements against fully malicious adversaries, i.e., making no assumptions whatsoever on the state generated by the adversary. These results are obtained using a new analytical estimator for the expected value of any operator acting on a continuous variable quantum state with bounded support over the Fock basis, computed with samples from heterodyne detection of the state.

Figures

Equations

$$Q_{\rho }(\alpha )=\frac{1}{\pi }\mathrm{Tr}\left(|\alpha ⟩⟨\alpha |\rho \right)=\mathrm{Tr}\left({\Pi }_{\alpha }\rho \right),$$

$${\mathcal{L}}_{k,l}(z)=e^{z{z}^{\ast }}\frac{(-1{)}^{k+l}}{\sqrt{k!}\sqrt{l!}}\frac{{\partial }^{k+l}}{\partial z^k\partial z^{\ast l}}{e}^{-z{z}^{\ast }},$$

$$f_A(z,\eta )=\frac{1}{\eta }{e}^{\left(1-\frac{1}{\eta }\right)z{z}^{\ast }}\sum _{k,l=0}^E\frac{A_{kl}}{\sqrt{{\eta }^{k+l}}}{\mathcal{L}}_{k,l}\left(\frac{z}{\sqrt{\eta }}\right),$$

$$K_A=\sum _{k,l=0}^E|A_{kl}|\sqrt{(k+1)(l+1)}.$$

$$\left|\mathrm{Tr}\left(A\rho \right)-\underset{\alpha \leftarrow Q_{\rho }}{\mathbb{E}}[f_A(\alpha ,\eta )]\right|\le \eta K_A,$$

$$\left|F\left(\Psi ,\rho \right)-\underset{\alpha \leftarrow Q_{\rho }}{\mathbb{E}}[f_{\Psi }(\alpha ,\eta )]\right|$$

$${\rho }_{kl}^{ϵ}=\frac{1}{n}\sum _{i=1}^n{f}_{|l⟩⟨k|}\left({\alpha }_i,ϵ/K_{|l⟩⟨k|}\right),$$

$$\left|{\rho }_{kl}-{\rho }_{kl}^{ϵ}\right|\le ϵ+{ϵ}^{\prime },$$

$$1-4\text{smashoperator}[]\sum _{0\le k\le l\le E}\exp \left[-\frac{n{ϵ}^{2+k+l}{ϵ}^{\prime 2}}{4C_{kl}}\right],$$

$$C_{kl}={\left[(k+1)(l+1)\right]}^{1+\frac{k+l}{2}}{2}^{|l-k|}\left(\genfrac{}{}{0ex}{}{\max (k,l)}{\min (k,l)}\right)$$

$$\mathrm{Pr}[\text{incorrect}|\text{accept}]=\frac{\mathrm{Pr}[\text{incorrect}\cap \text{accept}]}{\mathrm{Pr}[\text{accept}]},$$

$$F_{\Psi }(\rho )={\left[\frac{1}{n}\sum _{i=1}^n{f}_{\Psi }\left({\alpha }_i,ϵ/(m{K}_{\Psi })\right)\right]}^m,$$

$$\left|F({\Psi }^{\otimes m},{\rho }^{\otimes m})-F_{\Psi }(\rho )\right|\le ϵ+{ϵ}^{\prime },$$

$$1-\left(P_{\text{support}}^{iid}+P_{\text{Hoeffding}}^{iid}\right),$$

$$P_{\text{support}}^{iid}=\frac{(s+1{)}^{3/2}}{n}\exp \left[\frac{(s+1{)}^2}{n+1}\right],$$

$$P_{\text{Hoeffding}}^{iid}=2\exp \left[-\frac{n{ϵ}^{2+2E}{ϵ}^{\prime 2}}{2m^{4+2E}{C}_{\Psi }^2}\right],$$

$$C_{\Psi }=\sum _{k,l=0}^E|{\psi }_k{\psi }_l|{\left(\frac{ϵ}{m}\right)}^{E-\frac{k+l}{2}}{K}_{\psi }^{1+\frac{k+l}{2}}\sqrt{2^{|l-k|}\left(\genfrac{}{}{0ex}{}{\max (k,l)}{\min (k,l)}\right)}$$

$$F_{\Psi }(\rho )={\left[\frac{1}{n-4q-m}\text{smashoperator}[]\sum _{i=1}^{n-4q-m}{f}_{\Psi }\left({\alpha }_i,ϵ/(m{K}_{\Psi })\right)\right]}^m,$$

$$\left|F\left({\Psi }^{\otimes m},{\rho }^m\right)-F_{\Psi }(\rho )\right|\le ϵ+{ϵ}^{\prime }+P_{deFinetti},$$

$$1-\left(P_{\text{support}}+P_{\text{deFinetti}}+P_{\text{choice}}+P_{\text{Hoeffding}}\right),$$

$$P_{\text{support}}=8k^{3/2}\exp \left[-\frac{k}{9}{\left(\frac{q}{n}-\frac{2s}{k}\right)}^2\right],$$

$$P_{\text{deFinetti}}=q^{(E+1{)}^2/2}\exp \left[-\frac{2q(q+1)}{n}\right],$$

$$P_{\text{choice}}=\frac{m(4q+m-1)}{n-4q},$$

$$P_{\text{Hoeffding}}=2\left(\genfrac{}{}{0ex}{}{n-4q}{4q}\right)\exp \left[-\frac{n-8q}{2m^{4+2E}}{\left(\frac{{ϵ}^{1+E}{ϵ}^{\prime }}{C_{\Psi }}-\frac{8q{m}^{2+E}}{n-4q-m}\right)}^2\right],$$

$$\Vert P_{{\Psi }^{\otimes m}}^{\mathcal{O}}-P_{{\rho }^m}^{\mathcal{O}}{\Vert }_{tvd}\le D({\Psi }^{\otimes m},{\rho }^m)\le \sqrt{\beta },$$

$$\mathrm{Tr}(A\rho )=\int Q_{\rho }(\alpha )P_A(\alpha )d^2\alpha .$$

$$\underset{\alpha \leftarrow Q_{\rho }}{\mathbb{E}}[f_A(\alpha ,\eta )]=\int Q_{\rho }(\alpha )f_A(\alpha ,\eta )d^2\alpha ,$$

$$\mathrm{Pr}\left[\left|\frac{1}{n}\sum _{i=1}^{n}f(z_i)-\underset{z\leftarrow D}{\mathbb{E}}[f(z)]\right|\ge \lambda \right]\le 2\exp \left[-\frac{n{\lambda }^2}{2M^2}\right].$$

$$1-{\Pi }_{\le E}=\text{smashoperator}[]\sum _{n=E+1}^{+\infty }|n⟩⟨n|\le \frac{2}{\pi }\text{smashoperator}[]{\int }_{|\alpha {|}^2\ge E}^{}|\alpha ⟩⟨\alpha |d^2\alpha ,$$

$$F(\rho ,\sigma )=\mathrm{Tr}\left(\sqrt{\sqrt{\sigma }\rho \sqrt{\sigma }}\right).$$

Full text

Building trust for continuous variable quantum states

Ulysse Chabaud111Corresponding author

  

Tom Douce

  

Frédéric Grosshans

  

Elham Kashefi

  

Damian Markham

1 Introduction

Out of the many properties featured by quantum physics, the impossibility to perfectly determine an unknown state [9] is specially interesting. This property is at the heart of quantum cryptography protocols such as quantum key distribution [5]. On the other hand, it makes certification of the correct functioning of quantum devices a challenge, since the output of such devices can only be determined approximately, through repeated measurements over numerous copies of the output states. With rapidly developing quantum technologies for communication, simulation, computation and sensing, the ability to assess the correct functioning of quantum devices is of major importance, for near-term systems, the so-called Noisy Intermediate-Scale Quantum (NISQ) devices [26], and for the more sophisticated devices.

Depending on the desired level of trust, various methods are available for certifying the output of quantum devices. In the following, the task of checking the output state of a quantum device is denoted tomography for state independent methods, when i.i.d. behaviour is assumed, certification for a given a target state, when i.i.d. behaviour is assumed, and verification for a given target state, with no assumption whatsoever, and in particular without the i.i.d. assumption.

Quantum state tomography [10] is an important technique which aims at reconstructing a good approximation of the output state of a quantum device by performing multiple rounds of measurements on several copies of said output states. Given an ensemble of identically prepared systems, with measurement outcomes from the same observable, one can build up a histogram, from which a probability density can be estimated. According to Born’s rule, this probability density is the square modulus of the state coefficients, taken in the basis corresponding to the measurement. However, a single measurement setting cannot yield the full state information since the phase of its coefficients are then lost. Many sets of measurements on many subensembles must be performed and combined to reconstruct the density matrix of the state. The data do not yield the state directly, but rather indirectly through data analysis. Quantum state tomography assumes an independent and identically distributed (i.i.d.) behaviour for the device, i.e., that the density matrix of the output state considered is the same at each round of measurement. This assumption may be relaxed with a tradeoff in the efficiency of the protocol [8].

A certification task corresponds to a setting where one wants to benchmark an industrial quantum device, or check the output of a physical experiment. On the other hand, a verification task corresponds to a cryptographic scenario, where the device to be tested is untrusted, or the quantum data is given by a potentially malicious party, for example in the context of delegated quantum computing. In the latter case, the task of quantum verification is to ensure that either the device behaved properly, or the computation aborts with high probability. While delegated computing is a natural platform for the emerging NISQ devices, one can provide a physical interpretation to this adversarial setting by emphasising that we aim for deriving verification schemes that make no assumptions whatsoever about the noise model of the underlying systems. Various methods for verification of quantum devices have been investigated, in particular for discrete variable quantum information [15], and they provide different efficiencies and security parameters depending on the computational power of the verifier. The common feature for all of these approaches is to utilise some basic obfuscation scheme that allows to reduce the problem of dealing with a fully general noise model, or a fully general adversarial deviation of the device, to a simple error detection scheme [34].

In this work, we consider the setting of quantum information with continuous variables [20], in which quantum states live in an infinite-dimensional Hilbert space. Using continuous variable systems for quantum computation and more general quantum information processing is a powerful alternative to the discrete variable case. Firstly, it is compatible with standard network optics technology, where more efficient measurements are available. Secondly, it allows for unprecedented scaling in entanglement, with entangled states of up to tens of thousands of subsystems reported [37] generated deterministically.

A continuous variable quantum process or state can be described by a quasi-probability distribution in phase space, often the Wigner function [35], but also the Husimi $Q$ function or the Glauber–Sudarshan $P$ function [7]. This allows for a simple and experimentally relevant classification of quantum states: those with a Gaussian quasiprobability distibutions are called Gaussian states, and the others non-Gaussian states. By extension, operations mapping Gaussian states to Gaussian states are also called Gaussian. These Gaussian operations and states are the ones implementable with linear optics and quadratic non-linearities [6], and are hence relatively easy to construct experimentally. However, it is well known that for many important applications, Gaussian operations and Gaussian states are not sufficient. This takes the forms of no-go theorems for distillation and error correction [11, 13, 23], and the fact that all Gaussian computations can be simulated efficiently classically [4]. Furthermore, it is not possible to demonstrate non-locality or contextuality—which are increasingly understood to be important resources in quantum information—in the Gaussian regime.

For continuous variable quantum devices, checking that the output state is close to a target state may be done with linear optics using optical homodyne tomography [21]. This method allows to reconstruct the Wigner function of a generic state using only Gaussian measurements, namely homodyne detection. Because of the continuous character of its outcomes, one must proceed to a discrete binning of the sample space, in order to build probability histograms. Then, the state representation in phase space is determined by a mathematical reconstruction.

For cases where we have a specific target state, more efficient options are possible. For multimode Gaussian states, more efficient certification methods have been derived with Gaussian measurements [2]. These methods involve the computation of a fidelity witness, i.e., a lower bound on the fidelity, from the measured samples. The cubic phase state certification protocol of [19] also introduces a fidelity witness and is an example of certification of a specific non-Gaussian state with Gaussian measurements, which assumes an i.i.d. state preparation. The verification protocol for Gaussian continuous variable weighted hypergraph states of [32] removes this assumption, again for this specific family of states.

2 Results

In this work we address two main issues. Firstly, existing continuous variable state tomography methods are not reliable in the sense of [8], because errors coming from the reconstruction procedure are indistinguishable from errors coming from the data. Secondly, to the best of our knowledge there is no Gaussian verification protocol for non-Gaussian states without i.i.d. assumption (a possible route using Serfling’s bound was mentioned in Ref. [19] for removing the i.i.d. assumption for their protocol).

We thus introduce a general receive-and-measure protocol for building trust for continuous variable quantum states, using solely Gaussian measurements, namely heterodyne detection [12, 33]. This protocol allows to perform reliable continuous variable quantum state tomography based on heterodyne detection, with analytical confidence intervals, which we refer to as heterodyne tomography in what follows. This tomography technique only requires a single fixed measurement setting, compared to homodyne tomography. This protocol also provides a means for certifying continuous variable quantum states with an energy test, under the i.i.d. assumption. Finally, the same protocol also allows to verify continuous variable states, without the i.i.d. assumption. For these three applications, the measurements performed are the same. It is only the number of subsystems to be measured and the classical post-processing performed that differ from one application to another.

We detail the structure of the protocol in the following. We give an estimator for the expected value of any operator acting on a state with bounded support over the Fock basis (Theorem 4.1) by deriving an approximate version of the optical equivalence theorem for antinormal ordering [7]. The estimate is expressed as an expected value under heterodyne detection. Similar estimates have been obtained in the context of imperfect heterodyne detection [24, 25]. We go beyond these works in different respects: using this result, we introduce a reliable heterodyne tomography method and compute analytical bounds on its efficiency (Theorem 5.1). We then derive a receive-and-measure certification protocol (against i.i.d. adversary) for continuous variable quantum states, with Gaussian measurements (Theorem 6.1). We further promote this certification technique to a verification protocol against fully malicious adversary (Theorem 7.1), using a de Finetti reduction for infinite-dimensional systems [29].

3 Description of the protocol

Continuous variable quantum states live in an infinite-dimensional Hilbert space $\mathcal{H}$, spanned by the Fock basis $\{\ket{n}\}_{n\in\mathbb{N}}$, and are equivalently represented in phase space by their Husimi $Q$ function [7], a smoother relative of the Wigner function. Given a single-mode state $\rho$, its $Q$ function is defined as:

[TABLE]

for all $\alpha\in\mathbb{C}$, where $\ket{\alpha}$ is a coherent state and where $\{\Pi_{\alpha}\}_{\alpha\in\mathbb{C}}=\left\{\frac{1}{\pi}\ket{\alpha}\!\bra{\alpha}\right\}_{\alpha\in\mathbb{C}}$ is the Positive Operator Valued Measure for heterodyne detection.

This detection, also called double homodyne or eight-port homodyne [12], consists in splitting the measured state with a beamsplitter, and measuring both ends with homodyne detection (Fig. 1). This corresponds to a joint noisy measurement of quadratures $q$ and $p$. This is a Gaussian measurement, which yields two real outcomes, corresponding to the real and imaginary parts of $\alpha$. The $Q$ function of a single-mode state thus is a probability density function over $\mathbb{C}$ and measuring a state with heterodyne detection amounts to sampling from its $Q$ function.

Using this detection, one may acquire knowledge about an unknown continuous variable quantum state. More precisely, we define the following receive-and-measure protocol, depicted in Fig. 2: given a quantum state $\rho^{n}$ over $n$ subsystems, measure some of the subsystems with heterodyne detection. Then, post-process the samples obtained to retrieve information about the remaining subsystems. The number subsystems to be measured and the post-processing performed depend on the application considered.

We show in the following sections how this protocol may be used to perform reliable tomography, certification and verification of continuous variable quantum states, and we detail the corresponding choices of subsystems and the classical post-processing for each task.

4 Heterodyne estimator

This section contains our main technical result, an estimator for the expected value of an operator acting on a state with bounded support over the Fock basis, from samples of heterodyne detection of the state. From this result, we derive various protocols in the following sections, ranging from tomography to state verification.

We denote by $\underset{\alpha\leftarrow D}{\mathbb{E}}[f(\alpha)]$ the expected value of a function $f$ for samples drawn from a distribution $D$. Let us introduce for $k,l\geq 0$ the polynomials

[TABLE]

for $z\in\mathbb{C}$, which are, up to a normalisation, the Laguerre $2$D polynomials, appearing in particular in the expressions of Wigner function of Fock states [36]. For any operator $A=\sum_{k,l=0}^{+\infty}{A_{kl}\ket{k}\!\bra{l}}$ and all $E\in\mathbb{N}$, we define with these polynomials the function

[TABLE]

for all $z\in\mathbb{C}$, and all $0<\eta<1$. We omit the dependency in $E$ for brevity. The function $z\mapsto f_{A}(z,\eta)$, being a polynomial multiplied by a converging Gaussian function, is bounded over $\mathbb{C}$. With the same notations, we also define the following constant:

[TABLE]

The optical equivalence theorem for antinormal ordering [7] gives an equivalence between the expectation value of an operator in Hilbert space and the expectation value of its Glauber-Sudarshan $P$ function. The $P$ function is however highly singular in general and our results are based instead on the following approximate version of this equivalence when the $P$ function is replaced by the bounded function $f$:

Theorem 4.1**.**

Let $E\in\mathbb{N}$ and let $0<\eta<\frac{2}{E}$. Let also $A=\sum_{k,l=0}^{+\infty}{A_{kl}\ket{k}\!\bra{l}}$ be an operator and let $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\!\bra{l}}$ be a density operator with bounded support. Then,

[TABLE]

where the function $f$ and the constant $K$ are defined in Eqs. (41) and (42).

For all theorems, the proof techniques are given in section 9 and the detailed proofs may be found in the appendix. This result provides an estimator for the expected value of any operator $A$ acting on a continuous variable state $\rho$ with bounded support over the Fock basis. This estimator is the expected value of a bounded function $f_{A}$ over samples drawn from the probability density corresponding to a Gaussian measurement of $\rho$, namely heterodyne detection. The optical equivalence theorem for antinormal ordering corresponds to the limit $\eta\to 0$. The right hand side of Eq. (5) is an energy bound, which depends on the operator $A$, the value $E$ and the precision parameter $\eta$.

When the operator $A$ is the density matrix of a continuous variable pure state $\ket{\Psi}$, the previous estimator approximates the fidelity $F(\Psi,\rho)=\braket{\Psi}{\rho}{\Psi}$ between $\ket{\Psi}\!\bra{\Psi}$ and $\rho$. With the same notations:

Corollary 4.2**.**

Let $E\in\mathbb{N}$ and let $0<\eta<\frac{2}{E}$. Let also $\ket{\Psi}\!\bra{\Psi}=\sum_{k,l=0}^{+\infty}{\psi_{k}\psi_{l}^{*}\ket{k}\!\bra{l}}$ be a normalised pure state and let $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\!\bra{l}}$ be a density operator with bounded support. Then,

[TABLE]

where the function $f_{A}$ and the constant $K_{A}$ are defined in Eqs. (41) and (42), for $A=\ket{\Psi}\!\bra{\Psi}$.

This result provides an estimator for the fidelity between any target pure state $\ket{\Psi}$ and any continuous variable (mixed) state $\rho$ with bounded support over the Fock basis. This estimator is the expected value of a bounded function $f_{\Psi}$ over samples drawn from the probability density corresponding to a Gaussian measurement of $\rho$, namely heterodyne detection. The right hand side of Eq. (6) is an energy bound, which may be refined depending on the expression of $\ket{\Psi}$. In particular, the second bound is independent of the target state $\ket{\Psi}$. The assumption of bounded support makes sense for tomography, but not necessarily in an adversarial setting. We will relax this condition for the certification and verification protocols in the following, and indeed estimate the energy bound from the heterodyne measurements. Errors in this estimation are taken into account in the confidence statements.

Given these results, one may choose a target pure state $\ket{\Psi}$, and measure with heterodyne detection various copies of the output (mixed) state $\rho$ of a quantum device with bounded support over the Fock basis. Then, using the samples obtained, one may estimate the expected value of $f_{\Psi}$, thus obtaining an estimate of the fidelity between the states $\ket{\Psi}\!\bra{\Psi}$ and $\rho$. Using this result, we introduce a reliable method for performing continuous variable quantum state tomography using heterodyne detection.

5 Reliable continuous variable state tomography

Continuous variable quantum state tomography methods usually make two assumptions: firstly that the measured states are independent identical copies (i.i.d. assumption, for independently and identically distributed), and secondly that the measured states have a bounded support over the Fock basis [21]. With the same assumptions, we present a reliable method for state tomography with heterodyne detection which has the advantage of providing analytical confidence intervals. Our method directly provides estimates of the elements of the state density matrix, phase included. As such, neither mathematical reconstruction of the phase, nor binning of the sample space is needed, since the samples are used only to compute expected values of bounded functions. Moreover, only a single fixed Gaussian measurement setting is needed, namely heterodyne detection (Fig. 1).

For tomographic application, all copies of the state are measured. For $n\geq 1$, let $\alpha_{1},\dots,\alpha_{n}\in\mathbb{C}$ be samples from heterodyne detection of $n$ copies of a quantum state $\rho$. For $\epsilon>0$ and $k,l\in\mathbb{N}$, we define

[TABLE]

where the function $f_{A}$ and the constant $K_{A}$ are defined in Eqs. (41) and (42), for $A=\ket{l}\!\bra{k}$, and where $\epsilon>0$ is a free parameter. The quantity $\rho^{\epsilon}_{kl}$ is the average of the function $f_{\ket{l}\!\bra{k}}$ over the samples $\alpha_{1},\dots,\alpha_{n}$. The next result shows that this estimator approximates the matrix element $k,l$ of this state with high probability. We use the notations of Theorem 4.1.

Theorem 5.1** (Reliable heterodyne tomography).**

Let $\epsilon,\epsilon^{\prime}>0$, $n\geq 1$ and $\alpha_{1},\dots,\alpha_{n}$ be samples obtained by measuring with heterodyne detection $n$ copies of a state $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\!\bra{l}}$ with bounded support, for $E\in\mathbb{N}$. Then

[TABLE]

for all $0\leq k,l\leq E$, with probability greater than

[TABLE]

where the estimate $\rho^{\epsilon}_{kl}$ is defined in Eq. (7) and where

[TABLE]

is a constant independent of $\rho$.

In light of this result, the principle for performing reliable heterodyne tomography is straightforward and as follows: $n$ identical copies $\rho^{\otimes n}$ of the output quantum state of a physical experiment or quantum device are measured with heterodyne detection, yielding the values $\alpha_{1},\dots,\alpha_{n}$. These values are used to compute the estimates $\rho^{\epsilon}_{kl}$, defined in Eq. (7), for all $k,l$ in the range of energy of the experiment. Then, Theorem 5.1 directly provides confidence intervals for all these estimates of $\rho_{kl}$, the matrix elements of the density operator $\rho$, without the need for a binning of the sample space or any additional data reconstruction, using a single measurement setting. For a desired precision $\epsilon$ and a failure probability $\delta$, the number of samples needed scales as $n=\operatorname{poly}(1/\epsilon,\log(1/\delta))$.

Both homodyne and heterodyne quantum state tomography assume a bounded support over the Fock basis for the output state considered, i.e., that all matrix elements are equal to zero beyond a certain value, and that the output quantum states are i.i.d., i.e., that all measured output states are independent and identical. While these assumptions are natural when looking at the output of a physical experiment, corresponding to a noisy partially trusted quantum device with bounded energy, they may be questionable in the context of untrusted devices. We remove these assumptions in what follows: we first drop the bounded support assumption, deriving a certification protocol for continuous variable quantum states of an i.i.d. device with heterodyne detection ; then, we drop both assumptions, deriving a general verification protocol for continuous variable quantum states against an adversary who can potentially be fully malicious.

6 State certification with Gaussian measurements

Given an untrusted source of quantum states, the purpose of state certification and state verification protocols is to check whether if its output state is close to a given target state, or far from it. To achieve this, a verifier tests the output state of the source. Ideally, one would like to obtain an upper bound on the probability that the state is not close from the target state, given that it passed a test. However, this is known to be impossible without prior knowledge of the tested state distribution [15]. Indeed, writing this conditional probability

[TABLE]

in a situation where the device always produces a bad output state, it is rejected by the verifier’s test most of the time, so the acceptance probability is very small and the conditional probability is equal to $1$. Therefore, the quantity that will always be bounded in certification and verification protocols, in which one does not have prior knowledge of the device, is the joint probability that the tested state is not close to the target state and that it passes the test. Equivalently, we obtain lower bounds on the probability that the tested state is close to the target state or that it fails the test.

We first consider the certification of the output of an i.i.d. quantum device, i.e., which output state is the same at each round. However, we do not assume that the output states of the device have bounded support over the Fock basis anymore. This is instead ensured probabilistically using the samples from heterodyne detection.

Our continuous variable quantum state certification protocol is then as follows: let $\ket{\Psi}$ be a target pure state, of which one wants to certify $m$ copies. The values $s$ and $E$ are free parameters of the protocol. One instructs the i.i.d. device to prepare $n+m$ copies of $\ket{\Psi}$, and the device outputs an i.i.d. (mixed) state $\rho^{\otimes(n+m)}$. One keeps $m$ copies $\rho^{\otimes m}$, and measures the $n$ others with heterodyne detection, obtaining the samples $\alpha_{1},\dots,\alpha_{n}$. One records the number $r$ of samples such that $|\alpha_{i}|^{2}>E$. We refer to this step as support estimation. For a given $\epsilon>0$, one also computes with the same samples the estimate

[TABLE]

where the function $f_{A}$ and the constant $K_{A}$ are defined in Eqs. (41) and (42), for $A=\ket{\Psi}\!\bra{\Psi}$, and where $\epsilon>0$ is a free parameter. The next result quantifies how close this estimate is from the fidelity between the remaining $m$ copies of the output state $\rho^{\otimes m}$ of the tested device and $m$ copies of the target state $\ket{\Psi}\!\bra{\Psi}^{\otimes m}$.

Theorem 6.1** (Gaussian certification of continuous variable quantum states).**

Let $\epsilon,\epsilon^{\prime}>0$, let $s\leq n$, and let $\alpha_{1},\dots,\alpha_{n}$ be samples obtained by measuring with heterodyne detection $n$ copies of a state $\rho$. Let $E$ in $\mathbb{N}$, and let $r$ be the number of samples such that $|\alpha_{i}|^{2}>E$. Let also $\ket{\Psi}$ be a pure state. Then for all $m\in\mathbb{N}^{*}$,

[TABLE]

or $r>s$, with probability greater than

[TABLE]

where

[TABLE]

[TABLE]

where the estimate $F_{\Psi}(\rho)$ is defined in Eq. (12), and where

[TABLE]

is a constant independent of $\rho$, with the constant $K$ defined in Eq. (4).

This results implies that the quantity $F_{\Psi}(\rho)$ is a good estimate of the fidelity $F(\Psi^{\otimes m},\rho^{\otimes m})$, or the score at the support estimation step is higher than $s$, with high probability. The values of the energy parameters $E$ and $s$ should be chosen to guarantee completeness, i.e., that if the correct state $\ket{\Psi}$ is sent, then $r\leq s$ with high probability.

This theorem is valid for all continuous variable target pure states $\ket{\Psi}$, and the failure probability may be greatly reduced depending on the expression of $\ket{\Psi}$. The number of samples needed for certifying a given number of copies $m$ with a precision $\epsilon$ and a failure probability $\delta$ scales as $n=\text{poly}(m,1/\epsilon,1/\delta)$. Note that the same protocol may be used to obtain reliable estimates of $\,\mathrm{Tr}(A\rho)$ for any operator $A$ under the i.i.d. assumption, by setting $m=1$ and replacing $\Psi$ by $A$ in Eq. (12).

This certification protocol is promoted to a verification protocol in the following section, by removing the i.i.d. assumption.

7 State verification with Gaussian measurements

We now consider an adversarial setting, where a verifier delegates the preparation of a continuous variable quantum state to a potentially malicious party, called the prover. One could see the verifier as the experimentalist in the laboratory and the prover as the noisy device, where we aim not to make any assumptions about its correct functionality or noise model. Given the absence of any direct error correction mechanism that permits a fault tolerant run of the device, the aim of verification is to ensure that a wrong outcome is not being accepted. In the context of state verification, this amounts to making sure that the output state of the tested device is close to an ideal target state.

The prover is not supposed to have i.i.d. behaviour. In particular, when asked for various copies of the same state, the prover may actually send a large state entangled over all subsystems, possibly also entangled with a quantum system on his side. In that case, the certification protocol derived in the previous section is not reliable. With usual tomography measurements, the number of samples needed for a given precision of the fidelity estimate scales exponentially in the number of copies to verify. This is an essential limitation of quantum tomography techniques, because they check all possible correlations between the different subsystems.

However we prove that, because of the symmetry of the protocol, the verifier can assume that the prover is sending permutation-invariant states, i.e., states that are invariant under any permutation of their subsystems. With a specific support estimation step, reduced states of permutation-invariant states are close to mixture almost-i.i.d. states, i.e., states that are i.i.d. on almost all subsystems. At the heart of this reduction is the de Finetti theorem for infinite-dimensional systems of [29], which allows restricting to an almost-i.i.d. prover.

Our verification protocol is then as follows: the verifier wants to verify $m$ copies of a target pure state $\ket{\Psi}$. The values $n$, $k$, $q$, $s$ and $E$ are free parameters of the protocol. The prover is instructed to prepare $n+k$ copies of $\ket{\Psi}$ and send them to the verifier. The verifier picks $k$ subsystems at random and measures them with heterodyne detection, obtaining the samples $\beta_{1},\dots,\beta_{k}$, and records the number $r$ of values $|\beta_{i}|^{2}>E$. The verifier discards $4q$ subsystems at random and measures all the others but $m$ chosen at random with heterodyne detection, obtaining the samples $\alpha_{1},\dots,\alpha_{n-4q-m}$. Finally, the verifier computes with these samples the estimate

[TABLE]

where the function $f_{A}$ and the constant $K_{A}$ are defined in Eqs. (41) and (42), for $A=\ket{\Psi}\!\bra{\Psi}$ and where $\epsilon>0$ is a free parameter. Note that this estimate is identical to the one defined in Eq. (12), replacing $n$ by $n-4q-m$.

Theorem 7.1** (Gaussian verification of continuous variable quantum states).**

Let $n\geq 1$, let $s\leq k$, and let $\rho^{n+k}$ be a state over $n+k$ subsystems. Let $\beta_{1},\dots,\beta_{k}$ be samples obtained by measuring $k$ subsystems at random with heterodyne detection and let $\rho^{n}$ be the remaining state after the measurement. Let $E$ in $\mathbb{N}$, and let $r$ be the number of samples such that $|\beta_{i}|^{2}>E$. Let also $q\geq m$, and let $\rho^{m}$ be the state remaining after discarding $4q$ subsystems of $\rho^{n}$ at random, and measuring $n-4q-m$ other subsystems at random with heterodyne detection, yielding the samples $\alpha_{1},\dots,\alpha_{n-4q-m}$. Let $\epsilon,\epsilon^{\prime}>0$ and let $\ket{\Psi}$ be a target pure state. Then,

[TABLE]

or $r>s$, with probability greater than

[TABLE]

where

[TABLE]

[TABLE]

[TABLE]

[TABLE]

where the estimate $F_{\Psi}(\rho)$ is defined in Eq. (18), and where $C_{\Psi}$ is a constant independent of $\rho$ defined in Eq. (17).

This result implies that the quantity $F_{\Psi}(\rho)$ is a good estimate of the fidelity $F(\Psi^{\otimes m},\rho^{m})$, or the score at the support estimation step is higher than $s$, with high probability. Like for the certification protocol, the values of the energy parameters $E$ and $s$ should be chosen by the verifier to guarantee completeness, i.e., that if the prover sends the correct state $\ket{\Psi}$, then $r\leq s$ with high probability.

For specific choices of the free parameters of the protocol either the estimate $F_{\Psi}(\rho)$ is polynomially precise in $m$, or $r>s$, with polynomial probability in $m$, with $n,k,q=\text{poly}(m)$. In particular, the efficiency of the protocol may be greatly refined by taking into account the expression of $\ket{\Psi}$ in the Fock basis, and optimizing over the free parameters.

This verification protocol let the verifier gain confidence about the precision of the estimate of the fidelity in Eq. (18). If the value of the estimate is close enough to $1$, the verifier may decide to use the state to run a computation. Indeed, statements on the fidelity of a state allow inferring the correctness of any trusted computation done afterwards using this state. Let $\beta>0$, and let $\mathcal{O}$ be the observable corresponding to the result of the trusted computation performed on $\rho^{m}$, the reduced state over $m$ subsystems instead of $\ket{\Psi}^{\otimes m}$, $m$ copies of the target state $\ket{\Psi}$. In other words, $\mathcal{O}$ encodes the resources which the verifier can perform perfectly (ancillary states, evolution and measurements), the imperfections being encoded in $\rho$. Then, $F\left(\Psi^{\otimes m},\rho^{m}\right)\geq 1-\beta$ implies the following bound on the total variation distance between the probability densities of the computation output of the actual and the target computations:

[TABLE]

by standard properties of the trace distance $D$ [14]. What this means is that the distribution of outcomes for the state $\rho^{m}$ sent by the prover is almost indistinguishable from the distribution of outcomes for $m$ copies of the ideal state $\ket{\Psi}$, when the fidelity is close enough to one.

8 Discussion

Determining an unknown continuous variable quantum state is especially difficult since it is described by possibly infinitely many complex parameters. Existing methods like homodyne quantum state tomography require many different measurement settings, and heavy classical post-processing. For that purpose, we have introduced a reliable method for heterodyne quantum state tomography, which uses heterodyne detection as a single Gaussian measurement setting, and allows the retrieval of the density matrix of an unknown quantum state without the need for data reconstruction nor binning of the sample space. For data reconstruction methods such as Maximum Likelihood, errors from the reconstruction procedure are usually indistinguishable from errors coming from the tested quantum device. For that reason, such methods do not extend well to the task of verification, unlike our method.

Building on these tomography techniques, and with the addition of cryptographic techniques such as the de Finetti theorem, we have derived a protocol for verifying various copies of a continuous variable quantum state, without i.i.d. assumption, with Gaussian measurements. This protocol is robust, as it directly gives a confidence interval on an estimate of the fidelity between the tested state and the target pure state. We emphasize that, while the target state is pure, the tested state is not required to be pure.

Our verification protocol is complementary to the approach of [32], in which a measurement-only verifier performs continuous variable quantum computing by delegating the preparation of Gaussian cluster states to a prover, and has to perform non-Gaussian measurements. In our approach, the measurement-only verifier may perform continuous variable quantum computing by delegating the preparation of non-Gaussian states to the prover, and has to perform Gaussian measurement, which are much easier to perform experimentally.

Our protocol may be tailored to different uses and assumptions, from tomography to verification, simply by changing the classical post-processing. We expect this protocol to be useful for the validation of continuous variable quantum devices in the NISQ [26] era and onwards.

In particular, an interesting perspective would be fine-tuning the various parameters of the protocol for specific target states in order to optimise its efficiency, thus reducing the number of samples needed for a given confidence interval. Another interesting prospect would be extending our main technical result, Theorem 4.1, which applies to operators, to quantum maps. Also, in the case where the operator is the density matrix of a target pure state, our result provide an estimate for the fidelity, and it would be interesting to extend this to target mixed states.

9 Proof techniques

This section contains the primary mathematical tools used in the proofs of the theorems, along with some intuition. The full technical proofs are detailed in the appendix.

The function $z\mapsto f_{A}(z,\eta)$ defined in Eq. (3) for $\eta>0$ is a bounded approximation of the Glauber-Sudarshan function $P_{A}$ of the operator $A$. This approximation is parametrised by a precision $\eta$, and a cutoff value $E$. The optical equivalence theorem for antinormal ordering [7] reads

[TABLE]

Given that

[TABLE]

we can expect that $\underset{\alpha\leftarrow Q_{\mathrlap{\rho}}}{\mathbb{E}}[f_{A}(\alpha,\eta)]$ is an approximation of $\,\mathrm{Tr}(A\rho)$ parametrised by $\eta$ and $E$. Theorem 4.1 makes this statement precise. We refer the reader to appendix B for a detailed proof.

The proof of Theorem 5.1 combines Theorem 4.1 with Hoeffding inequality [17], which quantifies the speed of convergence of the sample mean towards the expected value of a bounded i.i.d. random variable:

Lemma 9.1**.**

(Hoeffding) Let $\lambda>0$, let $n\geq 1$, let $z_{1},\dots,z_{n}$ be i.i.d. complex random variables from a probability density $D$ over $\mathbb{R}$, and let $f:\mathbb{C}\mapsto\mathbb{R}$ such that $|f(z)|\leq M$, for $M>0$ and all $z\in\mathbb{C}$. Then

[TABLE]

The proof then follows by applying this inequality for $D=Q_{\rho}$, and $f=f_{\ket{k}\bra{l}}$, for all values of $k,l$ between [math] and $E$, together with the union bound. We refer the reader appendix C for a detailed proof.

Theorem 6.1 removes the bounded support assumption and its proof is similar to the one of Theorem 5.1, with the addition of a support estimation step, using samples from heterodyne detection. The main result utilised here is the fact that for all $E$ [18]

[TABLE]

where $\Pi_{\leq E}$ is the projector onto the space of states of support bounded by $E$. This result allows to bound the probability of having a large support and obtaining a low score at the support estimation step. We refer the reader to appendix D for a detailed proof.

The proof of Theorem 7.1 is the most technical. This proof combines three main ingredients: a support estimation step for permutation-invariant states using samples from heterodyne detection, the de Finetti reduction from [29], and a refined version of Hoeffding inequality for superpositions of almost-i.i.d. states under a product measurement. We refer the reader to appendix E for a detailed proof.

Appendix A Preliminary material

The fidelity between two states $\rho,\sigma$ is defined as [22]

[TABLE]

When at least one of the two states is a pure state, this expression reduces to

[TABLE]

We write the Schatten $1$-norm of a bounded operator $T$ as

[TABLE]

The fidelity is related to the trace distance $D(\rho,\sigma)=\frac{1}{2}\|\rho-\sigma\|_{1}=\frac{1}{2}\,\mathrm{Tr}(|\rho-\sigma|)$ by [14]

[TABLE]

The trace distance verifies

[TABLE]

where $P_{\rho}^{\mathcal{O}}$ (resp. $P_{\sigma}^{\mathcal{O}}$) is the probability density associated to measuring the observable $\mathcal{O}$ for the state $\rho$ (resp. $\sigma$), and where the maximum of the total variation distance $\|\cdot\|_{tvd}$ is taken over all observables. We introduce the following result:

Lemma 1**.**

Let $0<\beta<1$. Let $\rho_{1},\rho_{2}$ be two states such that $F(\rho_{1},\rho_{2})>1-\beta$. Let $\ket{\Phi}$ be a pure state, then

[TABLE]

Proof A.1**.**

Let us write $P^{\Phi}_{\rho_{1}}$ and $P^{\Phi}_{\rho_{2}}$ the probability distributions associated to the binary measurement $\{\ket{\Phi}\bra{\Phi},I-\ket{\Phi}\bra{\Phi}\}$ of the states $\rho_{1}$ and $\rho_{2}$, respectively. Then, $P^{\Phi}_{\rho_{1}}(0)+P^{\Phi}_{\rho_{1}}(1)=P^{\Phi}_{\rho_{2}}(0)+P^{\Phi}_{\rho_{2}}(1)=1$, and

[TABLE]

Hence,

[TABLE]

where we used Eqs. (33) and (34).

We also introduce the following simple results :

Lemma 2**.**

Let $\eta>0$ and $a,b\in[0,1]$ such that $|a-b|\leq\eta$. Then for all $m\geq 1$,

[TABLE]

Proof A.2**.**

With the notations of the lemma,

[TABLE]

Let $E\in\mathbb{N}$, we write $\mathcal{H}$ the single-mode infinite-dimensional separable Hilbert space with the countable Fock basis $\{\ket{n}\}_{n\in\mathbb{N}}$, and $\bar{\mathcal{H}}=\text{span}(\ket{0},\dots\ket{E})$ the Hilbert space of states with bounded support over the Fock basis of size at most $E+1$, which has dimension $E+1$.

We denote by $\underset{\alpha\leftarrow D}{\mathbb{E}}[f(\alpha)]$ the expected value of a function $f$ for samples drawn from a distribution $D$.

Let us introduce for $k,l\geq 0$ the polynomials

[TABLE]

for all $z\in\mathbb{C}$, which are, up to a normalisation, the Laguerre $2$D polynomials, appearing in particular in the expressions of Wigner function of Fock states [36]. For any operator $A=\sum_{k,l=0}^{+\infty}{A_{kl}\ket{k}\bra{l}}$ and all $E\in\mathbb{N}$, we define from these polynomials the function

[TABLE]

for all $z\in\mathbb{C}$, and all $0<\eta<1$. We omit the dependencies in $E$. The function $z\mapsto f_{A}(z,\eta)$, being a polynomial multiplied by a converging Gaussian function, is bounded over $\mathbb{C}$. With the same notations, we also define the following constant:

[TABLE]

Appendix B Proof of Theorem 4.1 and Corollary 4.2

The function $f_{A}$ defined in Eq. (41) is a bounded approximation of the Glauber-Sudarshan function $P_{A}$ of the operator $A$. This approximation is parametrised by a precision $\eta$, and a cutoff value $E$. The optical equivalence theorem for antinormal ordering [7] reads

[TABLE]

Given that

[TABLE]

we can expect that $\underset{\alpha\leftarrow Q_{\mathrlap{\rho}}}{\mathbb{E}}[f_{A}(\alpha,\eta)]$ is an approximation of $\,\mathrm{Tr}(A\rho)$ parametrised by $\eta$ and $E$. Theorem 4.1 makes this statement more precise, and we prove it in the following.

B.1 Proof of Theorem 4.1

We recall Theorem 4.1 from the main text:

Theorem 1**.**

Let $E\in\mathbb{N}$ and let $0<\eta<\frac{2}{E}$. Let also $A=\sum_{k,l=0}^{+\infty}{A_{kl}\ket{k}\bra{l}}$ be an operator and let $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\bra{l}}$ be a density operator with bounded support. Then,

[TABLE]

where $f_{A}$ is defined in Eq. (41) and $K_{A}$ is defined in Eq. (42).

Proof B.1**.**

With Eq. (41) we obtain

[TABLE]

where we used in the second line the fact that $\rho$ has a bounded support over the Fock basis. This shows that it is sufficient to prove the theorem for $A=\ket{l}\bra{k}$, for all $k,l$ from [math] to $E$. We first introduce the following result:

Lemma 3**.**

For all $0\leq k,l\leq E$,

[TABLE]

Proof B.2**.**

Let us fix $k,l$ in $0,\dots,E$. By Eqs. (40) and (41) we have, for all $z\in\mathbb{C}$,

[TABLE]

Moreover, for all $\alpha\in\mathbb{C}$,

[TABLE]

Combining these expressions we obtain

[TABLE]

Setting $\alpha=re^{i\theta}$, we have $d^{2}\alpha=rdrd\theta$ and the integral on the last line may be computed as

[TABLE]

where we used $\int_{0}^{+\infty}{r^{2t+1}e^{-\frac{r^{2}}{\eta}}}=\frac{1}{2}t!\eta^{t+1}$ for $t=\frac{k+l+m+n}{2}-p$, which is obtained directly by induction and integration by parts (note that for $k-l=m-n$, and $p\leq\min(k,l)$, we have indeed $t\in\mathbb{N}$). Hence,

[TABLE]

Now for $k\leq l$ we have, for all $q\in\mathbb{N}$ (see, e.g., result 7.1 of [16]),

[TABLE]

When $k\leq l$, Eq (52) thus yields

[TABLE]

where we used that within the summation $m-n=k-l$. This formula is also valid for $l\leq k$, with the same reasoning. We finally obtain, for any $k,l$ in $0,\dots,E$

[TABLE]

Using Lemma 47, we obtain

[TABLE]

where we set $s=m-k=n-l=\frac{m+n-k-l}{2}$ in the third line, and where we used $|\rho_{s+k,s+l}|\leq\sqrt{\rho_{s+k,s+k}}\sqrt{\rho_{s+l,s+l}}$ in the last line, since $\rho$ is a positive semidefinite matrix. In order to obtain an upper bound independent of $\rho$, we now show for all $s$ that $\eta^{s}\sqrt{\binom{s+k}{k}\binom{s+l}{l}}\leq\eta\sqrt{(k+1)(l+1)}$ for $\eta\leq\frac{2}{E}$. For all $k,l$ in $0,\dots,E$ and for all $s$ in $2,\dots,E-\max({k,l})$, we have

[TABLE]

This in turn implies that for all $s$ in $2,\dots,E-\max({k,l})$

[TABLE]

since we assumed $\eta\leq\frac{2}{E}$. Hence by induction, for all $s$ in $2,\dots,E-\max({k,l})$,

[TABLE]

Combining this with Eq. (56) yields

[TABLE]

for all $k,l$ in $0,\dots,E$, where we used Cauchy-Schwarz inequality and the fact that $\,\mathrm{Tr}(\rho)=1$. Together with Eq. (46) we obtain

[TABLE]

by Eq. (42).

B.2 Proof of Corollary 4.2

We recall Corollary 4.2 from the main text:

Corollary 1**.**

Let $E\in\mathbb{N}$ and let $0<\eta<\frac{2}{E}$. Let also $\ket{\Psi}\bra{\Psi}=\sum_{k,l=0}^{+\infty}{\Psi_{k}\Psi_{l}^{*}\ket{k}\bra{l}}$ be a normalised pure state and let $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\bra{l}}$ be a density operator with bounded support. Then,

[TABLE]

where the function $f$ is defined in Eq. (41) and the constant $K$ in Eq. (42).

Proof B.3**.**

In order to prove Corollary 4.2, we apply Theorem 4.1 for $A=\ket{\Psi}\bra{\Psi}$ a pure state. We obtain

[TABLE]

where we used Cauchy-Schwarz inequality, and $\sum_{n=0}^{E}{|\psi_{n}|^{2}}\leq\,\mathrm{Tr}(\ket{\Psi}\bra{\Psi})=1$. Since $\ket{\Psi}$ is a pure state, we have $F(\Psi,\rho)=\braket{\Psi}{\rho}{\Psi}$, which concludes the proof.

Appendix C Proof of Theorem 5.1

Let $\epsilon,\epsilon^{\prime}>0$, let $n\geq 1$, and let $\bm{\alpha}=\alpha_{1},\dots,\alpha_{n}$ be samples obtained by measuring with heterodyne detection $n$ copies of a state $\rho=\sum_{k,l=0}^{E}{\rho_{kl}\ket{k}\bra{l}}$ with bounded support, for $E\in\mathbb{N}$. Let us define

[TABLE]

where the function $f$ and the constant $K$ are defined in Eqs. (41) and (42). In this section, we prove the following result:

Theorem 2**.**

For all $0\leq k,l\leq E$,

[TABLE]

with probability greater than $1-4\smashoperator[]{\sum_{0\leq k\leq l\leq E}^{}}\exp\left[{-\frac{N\epsilon^{2+k+l}\epsilon^{\prime 2}}{4C_{kl}}}\right]$, where

[TABLE]

The law of large numbers ensures that the sample average from independently and identically distributed (i.i.d.) random variables converges to the expected value of these random variables, when the number of samples goes to infinity. The following lemma refines this statement and quantifies the speed of convergence:

Lemma 4**.**

(Hoeffding) Let $\lambda>0$, let $n\geq 1$, let $z_{1},\dots,z_{n}$ be i.i.d. complex random variables from a probability density $D$ over $\mathbb{R}$, and let $f:\mathbb{C}\mapsto\mathbb{R}$ such that $|f(z)|\leq M$, for $M>0$ and all $z\in\mathbb{C}$. Then

[TABLE]

This comes directly from Hoeffding inequality [17] applied to the real bounded i.i.d. random variables $f(z_{1}),\dots,f(z_{N})$. When dealing with complex random variables, we use the following result instead:

Lemma 5**.**

(Hoeffding for complex random variables) Let $\lambda>0$, let $n\geq 1$, let $z_{1},\dots,z_{n}$ be i.i.d. complex random variables from a probability density $D$ over $\mathbb{C}$, and let $f:\mathbb{C}\mapsto\mathbb{C}$ such that $|f(z)|\leq M$, for $M>0$ and all $z\in\mathbb{C}$. Then

[TABLE]

Proof C.1**.**

For all $a>0$ and all $z\in\mathbb{C}$, $|z|=\sqrt{\operatorname{Re}{(z)}^{2}+\operatorname{Im}{(z)}^{2}}\geq a$ implies $|\operatorname{Re}{(z)}|\geq a/\sqrt{2}$ or $|\operatorname{Im}{(z)}|\geq a/\sqrt{2}$. Hence,

[TABLE]

so applying twice Lemma 67 for the real random variables $\operatorname{Re}{(f(z))}$ and $\operatorname{Im}{(f(z))}$, respectively, yields Lemma 68.

In order to prove Theorem 5.1, we apply Lemma 68 to the functions $z\mapsto f_{\ket{k}\bra{l}}(z,\eta)$ defined in Eq. (41). We first need to bound them:

Lemma 6**.**

For all $k,l\geq 0$, define

[TABLE]

Then for all $k,l$ and all $z\in\mathbb{C}$,

[TABLE]

Proof C.2**.**

For $k$ or $l>E$ the inequality is trivial. For all $k,l\leq E$ and all $z\in\mathbb{C}$,

[TABLE]

where we used Eq. (40). Now for all $z\in\mathbb{C}^{*}$ and all $a>0$ we have [36]

[TABLE]

where

[TABLE]

are the generalised Laguerre polynomials [1], defined for $\alpha\in\mathbb{R}$ and $n\in\mathbb{N}$. Plugging this relation into Eq. (72) we obtain

[TABLE]

for all $z\in\mathbb{C}$. The generalised Laguerre polynomials are bounded as [30]

[TABLE]

for all $x\geq 0$, all $\alpha\geq 0$ and all $n\in\mathbb{N}$, and as

[TABLE]

for all $x\geq 0$, all $\alpha\leq-\frac{1}{2}$ and all $n\in\mathbb{N}$.

Let $a>0$. Assuming $k<l$, we have $|z|^{l-k}\leq a^{l-k}$ for $|z|\leq a$, and $|z|^{k-l}\leq a^{k-l}$ for $|z|\geq a$. Thus, the first line of Eq. (75), together with Eq. (76), give

[TABLE]

for $|z|\leq a$ and $k<l$. Similarly, the second line of Eq. (75), together with Eq. (77), give

[TABLE]

for $|z|\geq a$ and $k<l$. These two last bounds (78, 79) are equal for $a^{l-k}=(2\eta)^{\frac{l-k}{2}}\sqrt{(l-k)!}$, yielding the bound

[TABLE]

for all $z\in\mathbb{C}$ and $k<l$. For $l<k$ the same reasoning gives

[TABLE]

Finally, for $k=l$ the previous bounds also hold, by combining Eqs. (75) and (76), and this proves Lemma 71.

Let $k,l\geq 0$, $n\in\mathbb{N}$ and $\epsilon^{\prime}>0$. Applying Lemma 68 to the function $f_{\ket{l}\bra{k}}$, with the bound from Lemma 71 yields

[TABLE]

Applying Theorem 4.1 for $A=\ket{l}\bra{k}$ we also obtain

[TABLE]

Let $\alpha_{1},\dots,\alpha_{n}$ be samples from the $Q$-function of $\rho$. Combining Eqs. (82) and (83), we obtain with the triangular inequality

[TABLE]

with probability greater than

[TABLE]

We have $K_{\ket{k}\bra{l}}=\sqrt{(k+1)(l+1)}$ by Eq. (42). Taking $\eta=\frac{\epsilon}{K_{\ket{k}\bra{l}}}$ yields

[TABLE]

with probability greater than

[TABLE]

where we defined

[TABLE]

Now this holds for $0\leq k,l\leq E$. Together with the union bound, this proves the theorem.

∎

Appendix D Proof of Theorem 6.1

In this section, we detail the proof of Theorem 6.1, which goes along the same lines as the one of Theorem 5.1, given in Section C, with the addition of a support estimation step for i.i.d. states.

D.1 Support estimation for i.i.d. states

Let us define the following operators for $E\geq 0$:

[TABLE]

where $\Pi_{\leq E}=\sum_{n=0}^{E}{\ket{n}\bra{n}}$ is the projector onto the Hilbert space $\bar{\mathcal{H}}$ of states with less than $E$ photons, and

[TABLE]

where $\ket{\alpha}$ is a coherent state. We have the following result, proven in [18] by expanding $T$ in the Fock basis:

[TABLE]

In particular,

[TABLE]

The probability $P_{r}$ that exactly $r$ among $n$ values of $|\alpha_{i}|^{2}$ are bigger than $E$ and $n-r$ values are lower, and that the projection $\Pi_{\leq E}$ of the state $\rho$ onto the Hilbert space $\bar{\mathcal{H}}$ of states with less than $E$ photons fails is bounded as

[TABLE]

where we used $1-x\leq e^{-x}$ and $(r+1)!\geq\sqrt{2\pi(r+1)}(r+1)^{r+1}e^{-(r+1)}$. For $s\in\mathbb{N}$, and for all $r\leq s$,

[TABLE]

hence the probability that at most $s$ among $n$ values of $|\alpha_{i}|^{2}$ are bigger than $E$, and that the projection $\Pi_{\leq E}$ of the state $\rho$ onto the Hilbert space $\bar{\mathcal{H}}$ of states with less than $E$ photons fails is bounded by

[TABLE]

For $1\ll s\ll n$, this implies that either $\rho$ is contained in a lower dimensional subspace, or the score at the support estimation step is higher than $s$, with high probability.

D.2 Proof of Theorem 6.1

Let $\epsilon,\epsilon^{\prime}>0$, let $n\geq 1$, and let $\bm{\alpha}=\alpha_{1},\dots,\alpha_{n}$ be samples obtained by measuring with heterodyne detection $n$ copies of a state $\rho$. Let $E$ in $\mathbb{N}$, and let $r$ be the number of samples such that $|\alpha_{i}|^{2}>E$. Let also $\ket{\Psi}$ be a pure state. Let us define

[TABLE]

where the function $f$ and the constant $K$ are defined in Eqs. (41) and (42). Then:

Theorem 3**.**

For all $m,s\leq n$,

[TABLE]

or $r>s$, with probability greater than

[TABLE]

where

[TABLE]

and

[TABLE]

with

[TABLE]

We first consider the case of $m=1$, from which we deduce the general case.

Let us write $\ket{\Psi}=\sum_{n\geq 0}\psi_{n}\ket{n}$. For $\eta>0$, the function $z\mapsto f_{\Psi}(z,\eta)$ is real-valued, since $\ket{\Psi}\bra{\Psi}$ is hermitian. It is bounded as

[TABLE]

where we used Lemma 71, and where we defined

[TABLE]

Applying Lemma 67 to the real-valued function $z\mapsto f_{\Psi}(z,\eta)$ thus yields

[TABLE]

for $\epsilon^{\prime},\eta>0$, where the probability is over i.i.d. samples from heterodyne detection of $\rho$.

In what follows, we first assume that $\rho\in\bar{\mathcal{H}}$. By Corollary 4.2 we have

[TABLE]

Combining Eqs. (103) and (104) yields

[TABLE]

with probability greater than $1-2\exp\left[{-\frac{n\eta^{2+2E}\epsilon^{\prime 2}}{2M_{\Psi}^{2}(\eta)}}\right]$. Setting $\eta=\frac{\epsilon}{K_{\Psi}}$ yields

[TABLE]

with probability greater than $1-2\exp\left[{-\frac{n\epsilon^{2+2E}\epsilon^{\prime 2}}{2C_{\Psi,1}^{2}(\epsilon)}}\right]$, where we defined

[TABLE]

Combining Lemma 38 and Eq. (106) we obtain

[TABLE]

with probability greater than $1-2\exp\left[{-\frac{n\epsilon^{2+2E}\epsilon^{\prime 2}}{2C^{2}_{\Psi,1}(\epsilon)}}\right]$. Note that we excluded the pathological case $\frac{1}{n}\sum_{i=1}^{n}{f_{\Psi}(\alpha_{i},\epsilon/K_{\Psi})}>1$: when that is the case we instead set $\frac{1}{n}\sum_{i=1}^{n}{f_{\Psi}(\alpha_{i},\epsilon/K_{\Psi})}=1$. The target state $\Psi$ is pure so $F(\Psi^{\otimes m},\rho^{\otimes m})=F\left(\Psi,\rho\right)^{m}$. Hence, replacing $\epsilon$ and $\epsilon^{\prime}$ by $\epsilon/m$ and $\epsilon^{\prime}/m$, respectively, gives

[TABLE]

with probability greater than

[TABLE]

where $F_{\Psi}(\rho)=\left[\frac{1}{n}\sum_{i=1}^{n}{f_{\Psi}\left(\alpha_{i},\frac{\epsilon}{mK_{\Psi}}\right)}\right]^{m}$ and where

[TABLE]

Until now we have assumed $\rho\in\bar{\mathcal{H}}$. By Eq. (95), the probability that at most $s$ among $n$ values of $|\alpha_{i}|^{2}$ are bigger than $E$, and that the projection $\Pi_{\leq E}$ of the state $\rho$ onto the Hilbert space $\bar{\mathcal{H}}$ of states with less than $E$ photons fails is bounded by

[TABLE]

With the union bound we thus obtain

[TABLE]

or $r>s$, with probability greater than $1-\left(P^{iid}_{\text{support}}+P_{\text{Hoeffding}}^{iid}\right)$.

∎

Appendix E Proof of Theorem 7.1

In this section, we detail the proof of Theorem 7.1. Compared to the case of the previous section, the i.i.d. states are replaced with permutation-invariant states, which makes the proof more technical. We recall the protocol and the theorem in the following.

The verifier wants to verify $m$ copies of a target pure state $\ket{\Psi}$. The numbers $n$, $k$, $q$, and $E$ are free parameters of the protocol. The verifier instructs the prover to prepare $n+k$ copies of $\ket{\Psi}$. Let us write $\rho^{n+k}$ the state received by the verifier. It picks $k$ subsystems at random and measures them with heterodyne detection, obtaining the samples $\beta_{1},\dots,\beta_{k}$. It records the number $r$ of values $|\beta_{i}|^{2}>E$. It discards $4q$ subsystems at random and measures all the others but $m$ chosen at random with heterodyne detection, obtaining the samples $\alpha_{1},\dots,\alpha_{n-4q-m}$. Finally, the verifier computes with these samples the estimate

[TABLE]

where the function $f$ and the constant $K$ are defined in Eqs. (41) and (42), and where $\epsilon>0$ is a free parameter.

Theorem 4**.**

Let $\epsilon,\epsilon^{\prime}>0$. For all $s\leq k$,

[TABLE]

or $r>s$, with probability greater than

[TABLE]

where

[TABLE]

[TABLE]

[TABLE]

and

[TABLE]

with

[TABLE]

The proof builds upon and generalises results from [27, 28, 29], and follows these steps:

• •

Support estimation: with probability arbitrarily close to $1$, most of the subsystems of the permutation-invariant state $\rho^{n-q}$ lie in a lower dimensional subspace, or the score of the state $\rho^{n+k}$ at the support estimation step is high (section E.1) ;

• •

De Finetti reduction: any permutation-invariant state with most of its subsystems in a lower dimensional subspace admits a purification in the symmetric subspace that still has most of its subsystems in a lower dimensional subspace. This purification is well approximated by a mixture of almost-i.i.d. states (section E.2) ;

• •

Hoeffding inequality for almost-i.i.d. states: mixture of almost-i.i.d. states can be certified in a similar fashion as i.i.d. states (section E.3).

We conclude the proof in section E.4 by combining the previous points.

E.1 Support estimation for permutation-invariant states

We first derive a support estimation step for permutation-invariant states. We will use in this section the following operators, already introduced in Section D.1: for $E\geq 0$:

[TABLE]

where $\Pi_{\leq E}=\smashoperator[]{\sum_{n=0}^{E}}{\ket{n}\bra{n}}$ is the projector onto the Hilbert space $\bar{\mathcal{H}}$ of states with at most $E$ photons, and

[TABLE]

where $\ket{\alpha}$ is a coherent state. We also recall the following result, from Eq. (91), proven in [18]:

[TABLE]

We recall a few notations and results from [28]: let $\mathcal{A}=\{A_{0},A_{1}\},\mathcal{B}=\{B_{0},B_{1}\}$ be two binary POVMs over $\mathcal{H}$. Define for $\delta>0$,

[TABLE]

In particular,

[TABLE]

by Eq. (124). We recall the following result (Lemma III.1. of [28]):

Lemma 7**.**

Let $n\geq 2k$, let $\delta>0$, let $\mathcal{A}=\{A_{0},A_{1}\}$ and $\mathcal{B}=\{B_{0},B_{1}\}$ be two binary POVMs over $\mathcal{H}$, and let $x_{1},\dots,x_{n+k}$ the $(n+k)$-partite classical outcome of the measurement $\mathcal{A}^{\otimes n}\otimes\mathcal{B}^{\otimes k}$ applied to any permutation-invariant state $\rho^{n+k}$. Then

[TABLE]

This result is a refined version of Serfling’s bound [31]. It relates the outcomes of a measurement on some subsystems of a symmetric state with the outcomes of a related measurement on the rest of the subsystems. With this technical Lemma, we derive in what follows a support estimation step for permutation-invariant states using samples from heterodyne detection.

Let $\rho^{n+k}$ be a state over $n+k$ subsystems. Applying a random permutation to this state and measuring its last $k$ subsystems with heterodyne detection is equivalent to measuring $k$ subsystems at random. We thus assume in the following that the state $\rho^{n+k}$ is a permutation-invariant state, without loss of generality, and that the verifier measures its last $k$ subsystems with heterodyne detection.

Let $\mathcal{T}=\{1-T,T\}$ and $\mathcal{U}=\{1-U,U\}$. Let $x_{1},\dots,x_{n+k}$ the $(n+k)$-partite classical outcome of the measurement $\mathcal{U}^{\otimes n}\otimes\mathcal{T}^{\otimes k}$ applied to the permutation-invariant state $\rho^{n+k}$ sent by the prover. A value $x_{i}=1$ for $i\in 1,\dots,n$ means that the projection of the $i^{th}$ subsystem onto $\bar{\mathcal{H}}$ failed, while a value $x_{j}=1$ for $j\in n+1,\dots,n+k$ means that the value $|\beta|^{2}$ obtained when measuring the $j^{th}$ subsystem with heterodyne detection was bigger than $E$. In particular, the number of values $\beta_{i}$ satisfying $|\beta_{i}|^{2}>E$, is expressed as $x_{n+1}+\dots+x_{n+k}$. Let $\mathcal{T}_{\leq s}^{k}$ be the event that at most $s$ of the $k$ values $\beta_{i}$ satisfy $|\beta_{i}|^{2}>E$, and let $\mathcal{F}_{q}^{n}$ be the event that the projection onto $\bar{\mathcal{H}}$ fails for more than $q$ subsystems of the remaining state $\rho^{n}$. Then:

Lemma 8**.**

[TABLE]

where $P_{\text{support}}=8k^{3/2}\exp\left[{-\frac{k}{9}\left(\frac{q}{n}-\frac{2s}{k}\right)^{2}}\right]$.

Proof E.1**.**

With Eq. (126), we have for all $\delta>0$

[TABLE]

Taking $\delta_{0}=\frac{1}{3}\left(\frac{q}{n}-\frac{2s}{k}\right)$ we obtain

[TABLE]

so if $x_{1}+\dots+x_{n}>q$ and $x_{n+1}+\dots+x_{n+k}\leq s$, then

[TABLE]

Hence,

[TABLE]

where we used Lemma 127 for $\mathcal{A}=\mathcal{U}$ and $\mathcal{B}=\mathcal{T}$.

Recall that $\bar{\mathcal{H}}$ is the Hilbert space of states with at most $E$ photons, of dimension $E+1$. For $q\leq n$, let us define the set of permutation-invariant states over $n$ subsystems, with at most $q$ subsystems out of this lower dimensional subspace (introduced in [29]):

[TABLE]

where the union is taken over all permutations. Lemma 8 then gives

[TABLE]

where $\mathcal{F}_{q}^{n}$ is the event that the projection of $\rho^{n}$ (the remaining state after the support estimation step) onto $\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$ fails, and where $P_{\text{support}}=8k^{3/2}\exp\left[{-\frac{k}{9}\left(\frac{q}{n}-\frac{2s}{k}\right)^{2}}\right]$. For $1\ll q\ll n$ and $q/n\ll s/k$, this implies that either $\rho^{n}$ has most of its subsystems in a lower dimensional subspace, or the score at the support estimation step is higher than $s$, with high probability.

E.2 De Finetti reduction

We recall in this section two results from [29].

• •

The first result says that any permutation-invariant state with most of its subsystems in a lower dimensional subspace has a purification in the symmetric subspace that still has most of its subsystems in a lower dimensional subspace. Formally, for $n\in\mathbb{N}$, and given a Hilbert space $\mathcal{K}$, let us write Sym${}^{n}(\mathcal{K})=\{\phi\in\mathcal{K}^{\otimes n},\text{ }\pi\phi=\phi\text{ }(\forall\pi)\}$ the symmetric subspace of a Hilbert space $\mathcal{K}^{\otimes n}$, then (Lemma 3 of [29]):

Lemma 9**.**

For all $q\leq n$, any permutation-invariant state $\rho^{n}\in\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$ has a purification $\tilde{\rho}^{n}$ in $\mathrm{Sym}^{n}(\mathcal{H}\otimes\mathcal{H})\bigcap\mathcal{S}^{n}_{(\bar{\mathcal{H}}\otimes\bar{\mathcal{H}})^{\otimes n-2q}}$.

The states of the form $\ket{v}^{\otimes n}$ are the so-called i.i.d. states. For all $n,r\geq 0$ and all $\ket{v}\in\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, the set of almost-i.i.d. states along $\ket{v}$, $\mathcal{S}^{n}_{v^{\otimes n-r}}$, is defined as the span of all vectors that are, up to reorderings, of the form $\ket{v}^{\otimes n-r}\otimes\ket{\phi}$, for an arbitrary $\phi\in\left(\mathcal{H}\otimes\mathcal{H}\right)^{\otimes r}$. In the following, we simply refer to these states as almost-i.i.d. states (which becomes relevant when $r\ll n$).

• •

The second result is a de Finetti theorem for states in $\mathrm{Sym}^{n}(\mathcal{H}\otimes\mathcal{H})\bigcap\mathcal{S}^{n}_{(\bar{\mathcal{H}}\otimes\bar{\mathcal{H}})^{\otimes n-2q}}$, which says that reduced states from them are well approximated by mixtures of almost-i.i.d. states. Formally (Theorem 4 of [29], applied to $\mathcal{K}=\mathcal{H}\otimes\mathcal{H}$ and $\bar{\mathcal{K}}=\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, with dim$(\bar{\mathcal{K}})=(E+1)^{2}$):

Theorem 5**.**

Let $\tilde{\rho}^{n}\in\mathrm{Sym}^{n}(\mathcal{H}\otimes\mathcal{H})\bigcap\mathcal{S}^{n}_{(\bar{\mathcal{H}}\otimes\bar{\mathcal{H}})^{\otimes n-2q}}$ and let $\tilde{\rho}^{n-4q}=\mathrm{Tr}_{4q}(\tilde{\rho}^{n})$. Then, there exist a finite set $\mathcal{V}$ of unit vectors $\ket{v}\in\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, a probability distribution $\{p_{v}\}_{v\in\mathcal{V}}$ over $\mathcal{V}$, and almost-i.i.d. states $\tilde{\rho}_{v}^{n-4q}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$ such that

[TABLE]

Given a state $\rho^{n}\in\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$, applying Theorem 135 to the purification $\tilde{\rho}^{n}$ given by Lemma 9 shows that the reduced state $\tilde{\rho}^{n-4q}$ is close in fidelity to a mixture of states that are i.i.d. on $n-8q$ subsystems.

E.3 Hoeffding inequality for almost-i.i.d. states

We recall here Lemma 67, in the context of a product measurement applied to an i.i.d. state $\ket{v}\bra{v}^{\otimes n}$:

Lemma 10**.**

(Hoeffding) Let $M>0\in\mathbb{R}$ and let $f:\mathbb{C}\mapsto\mathbb{R}$ be a function bounded as $|f(\alpha)|<M$ for all $\alpha\in\mathbb{C}$. Let $\lambda>0$, let $p\in\mathbb{N}^{*}$, and let $\ket{v}\in\mathcal{H}$. Let $\mathcal{M}=\{\mathcal{M}_{\alpha}\}_{\alpha\in\mathbb{C}}$ be a POVM on $\mathcal{H}$ and let $D_{\ket{v}}$ be the probability density function of the outcomes of the measurement $\mathcal{M}$ applied to $\ket{v}\bra{v}$. Then

[TABLE]

where the probability is taken over the outcomes $\bm{\alpha}=(\alpha_{1},\dots,\alpha_{p})$ of the product measurement $\mathcal{M}^{\otimes p}$ applied to $\ket{v}\bra{v}^{\otimes p}$.

The next result gives an equivalent statement for almost-i.i.d. states along a state $\ket{v}$, measured with a product measurement. It generalises Theorem 4.5.2 of [27], where the probability distributions over finite sets, corresponding to product measurements with finite number of outcomes, are replaced by continuous variable probability densities, corresponding to product measurements with continuous variable outcomes. Frequencies estimators are also replaced with estimators of expected values of bounded functions. We will use this result for the POVM corresponding to a product heterodyne detection.

Lemma 11**.**

Let $M>0\in\mathbb{R}$ and let $f:\mathbb{C}\mapsto\mathbb{R}$ be a function bounded as $|f(\alpha)|\leq M$ for all $\alpha\in\mathbb{C}$. Let $\mu>0$ and $1\leq m\leq r<t$ such that

[TABLE]

Let also $\ket{v}\in\bar{\mathcal{H}}$ and $\ket{\Phi}\in\mathcal{S}^{t}_{v^{\otimes t-r}}$. Let $\mathcal{M}=\{\mathcal{M}_{\alpha}\}_{\alpha\in\mathbb{C}}$ be a POVM on $\mathcal{H}$ and let $D_{\ket{v}}$ be the probability density function of the outcomes of the measurement $\mathcal{M}$ applied to $\ket{v}\bra{v}$. Then

[TABLE]

where the probability is taken over the outcomes $\bm{\alpha}=(\alpha_{1},\dots,\alpha_{t-m})$ of the product measurement $\mathcal{M}^{\otimes t-m}$ applied to $\ket{\Phi}\bra{\Phi}$.

In essence, this lemma says that a product measurement on all but $m$ subsystems of an almost-i.i.d. state along a state $\ket{v}$ will yield statistics that are similar to the ones that would be obtained by measuring the i.i.d. state $\ket{v}^{\otimes t-m}$.

Proof E.2**.**

$\ket{\Phi}\in\mathcal{S}^{t}_{v^{\otimes t-r}}$, so by Lemma 4.1.6 of [27], there exist a finite set $\mathcal{S}$ of size at most $\binom{t}{r}$, a family of states $\ket{\tilde{\Phi}^{s}}\in\mathcal{H}^{\otimes r}$ for $s\in\mathcal{S}$, complex amplitudes $\{\gamma_{s}\}_{s\in\mathcal{S}}$ and permutations $\{\pi_{s}\}_{s\in\mathcal{S}}$ over $[1,\dots,t]$ such that

[TABLE]

With the notations of the Lemma, let us define for $\mu>0$:

[TABLE]

We recall here Lemma of 4.5.1 of [27]:

Lemma 12**.**

Let $|\mathcal{X}|$ be a finite set and $\ket{\psi}=\sum_{x\in\mathcal{X}}{\ket{\psi^{x}}}$, and let $A$ be a non-negative operator. Then

[TABLE]

In particular, using Eq. (139) and this Lemma when $A$ is a POVM element of the product measurement $\mathcal{M}_{\bm{\alpha}}\equiv\mathcal{M}_{\alpha_{1}}\otimes\dots\otimes\mathcal{M}_{\alpha_{t-m}}$, we obtain:

[TABLE]

where we write $\bm{\alpha}\leftarrow\ket{\chi}$ to indicate that $\bm{\alpha}=(\alpha_{1},\dots,\alpha_{t-m})$ is distributed according to the outcomes of the product measurement $\mathcal{M}^{\otimes(t-m)}$ applied to $\ket{\chi}$.

Let $\bm{\alpha}\leftarrow\ket{\Phi^{s}}$. We have $\ket{\Phi^{s}}=\pi_{s}(\ket{v}^{\otimes t-r}\otimes\ket{\tilde{\Phi}^{s}})$, and in particular $(\alpha_{\pi_{s}(1)},\dots,\alpha_{\pi_{s}(t-r)})$ is distributed according to the outcomes of the product measurement $\mathcal{M}^{\otimes t-r}$ applied to $\ket{v}^{\otimes t-r}$. We also have, for $|f|\leq M$,

[TABLE]

where we used $r\geq m$.

Now for all $s\in\mathcal{S}$,

[TABLE]

where we used triangular inequality in the second line, Eq. (143) in the third line and Lemma 10 in the fourth line with $p=t-r$ and $\lambda=\mu-\frac{2rM}{t-m}>0$. Combining this last equation with Eq. (142), and using $|\mathcal{S}|\leq\binom{t}{r}$ we finally obtain,

[TABLE]

We recall the bound on $z\mapsto f_{\Psi}(z,\eta)$ obtained in Section D for $\eta>0$, detailed in Eq. (102): for all $\alpha\in\mathbb{C}$,

[TABLE]

where

[TABLE]

Let $\mu,\eta>0$, $E\in\mathbb{N}$, let $\ket{v}\in\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, and let $\ket{\Phi_{v}}^{n-4q}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$. Applying Lemma 11 for the real-valued function $f_{\Psi}$, for $t=n-4q$, for $r=4q$, for $D_{\ket{v}}=Q_{\ket{v}\bra{v}}$, and with the bound from Eq. (146), we obtain

[TABLE]

where the probability is over the outcomes of a product heterodyne measurement of the first $n-4q-m$ subsystems of $\ket{\Phi_{v}}^{n-4q}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$.

E.4 Proof of Theorem 7.1

Let $\ket{\Psi}\bra{\Psi}$ be the target pure state, and let $\rho^{n+k}$ be a state sent over $n+k$ subsystems. Let $\beta_{1},\dots,\beta_{k}$ be samples obtained by measuring $k$ subsystems at random of $\rho^{n+k}$ with heterodyne detection. Let $\rho^{n}$ be the remaining state after the support estimation step. In what follows, we first assume that $\rho^{n}\in\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$.

Let $\rho^{n-4q}$ be the state obtained from $\rho^{n}$ by tracing over the first $4q$ subsystems. In that case, by section E.2, there exist a finite set $\mathcal{V}$ of unit vectors $\ket{v}\in\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, a probability distribution $\{p_{v}\}_{v\in\mathcal{V}}$ over $\mathcal{V}$, and almost-i.i.d. states $\tilde{\rho}_{v}^{n-4q}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$ such that

[TABLE]

where $\rho_{v}^{n-4q}$ is the remaining state after tracing over the purifying subsystems, since the fidelity is non-decreasing under quantum operations [3]. We also obtain

[TABLE]

where $\rho^{m}$ (resp. $\rho_{v}^{m}$) is the remaining state after measuring the first $n-4q-m$ subsystems of $\rho^{n-4q}$ (resp. $\rho_{v}^{n-4q}$) with heterodyne detection.

Let $\alpha_{1},\dots,\alpha_{n-4q-m}$ be the samples obtained by measuring the first $n-4q-m$ subsystems of $\rho^{n-4q}$ with heterodyne detection. The verifier computes the estimate (114)

[TABLE]

and whenever $F_{\Psi}\geq 1$ we instead set $F_{\Psi}=1$. Let us define the completely positive map $\mathcal{E}$ on $\mathcal{H}^{n-4q}$ associated to the classical post-processing of the protocol as:

[TABLE]

The sum ranges over the values that the estimate may take. With Eq. (149) and Lemma 35 we obtain

[TABLE]

The trace distance is non-increasing under quantum operations, so Eq. (153) implies

[TABLE]

Using the definition of the map $\mathcal{E}$, we obtain a bound in total variation distance:

[TABLE]

where $P$ denotes the probability distributions for the values of the estimates $F_{\Psi}(\rho)$ and $F_{\Psi}\left(\sum_{v\in\mathcal{V}}{p_{v}\rho_{v}^{n-4q}}\right)$. In particular, this bound implies that for all $\lambda>0$,

[TABLE]

and thus

[TABLE]

With Eq. (150) and Lemma 35 we obtain

[TABLE]

where $\Psi^{\otimes m}$ is $m$ copies of the target pure state $\ket{\Psi}$. With the triangular inequality,

[TABLE]

where we used Eq. (158) in the last line. With Eq. (157) we obtain, for all $\lambda>0$

[TABLE]

By linearity of the probabilities, it suffices to bound $\,\mathrm{Pr}\left[\left|F(\Psi^{\otimes m},\Phi^{m})-F_{\Psi}(\Phi)\right|>\mu\right]$, for $\mu=\lambda-q^{\frac{(E+1)^{2}}{2}}\exp\left[{-\frac{2q(q+1)}{n}}\right]$, where $\ket{\Phi}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$, for $\ket{v}\in\bar{\mathcal{H}}\otimes\bar{\mathcal{H}}$, and where $\Phi^{m}$ is the state obtained from $\ket{\Phi}\bra{\Phi}$ by measuring the first $n-4q-m$ subsystems with heterodyne detection and tracing over the purifying subsystems.

Lemma 13**.**

Let $\ket{\Phi}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$. For all $\epsilon^{\prime}>0$,

[TABLE]

where

[TABLE]

Proof E.3**.**

Let $\alpha_{1},\dots,\alpha_{n-4q-m}$ be samples obtained by measuring the first $n-4q-m$ subsystems of $\ket{\Phi}\bra{\Phi}$ with heterodyne detection. We have (114)

[TABLE]

and

[TABLE]

*where we used Lemma 38. We bound these last three terms in the following.

When selecting at random $m$ subsystems from an almost-i.i.d. state over $n-4q$ subsystems which is i.i.d. on $n-8q$ subsystems, the probability that all of the selected states are from the $n-8q$ i.i.d. subsystems is

[TABLE]

and we have

[TABLE]

where we used $1-(1-x)^{a}\leq ax$ for all $a\geq 1$ and $x\in[0,1]$. In particular, for $\ket{\Phi}\in\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$, and $\Phi^{m}$ its reduced state over $m$ modes chosen at random, we have

[TABLE]

with probability greater than $1-\frac{m(4q+m-1)}{n-4q}$, where we used the definition of $\mathcal{S}^{n-4q}_{v^{\otimes n-8q}}$, and Eq. (166). Using Lemma 35, the first term in Eq. (164) vanishes with probability greater than:

[TABLE]

The bound for the second term is given by Corollary 4.2 applied to the state $\ket{v}$, for $\eta=\frac{\epsilon}{mK_{\Psi}}$:

[TABLE]

The bound for the third term is probabilistic, given by Eq. (148), for $\eta=\frac{\epsilon}{mK_{\Psi}}$ and $\mu=\frac{\epsilon^{\prime}}{m}$. For all $\epsilon^{\prime}>0$,

[TABLE]

We now bring together the previous bounds in order to prove Lemma 162. Combining Eqs. (164), (168), (169) and (170) yields

[TABLE]

where

[TABLE]

Combining Eq. (160) and Lemma 162, we finally obtain

[TABLE]

Setting $P_{\text{Hoeffding}}=2\binom{n-4q}{4q}\exp\left[{-\frac{n-8q}{2m^{4+2E}}\left(\frac{\epsilon^{1+E}\epsilon^{\prime}}{C_{\Psi}}-\frac{8qm^{2+E}}{n-4q-m}\right)^{2}}\right]$, $P_{\text{choice}}=\frac{m(4q+m-1)}{n-4q}$ and $P_{\text{deFinetti}}=q^{\frac{(E+1)^{2}}{2}}\exp\left[{-\frac{2q(q+1)}{n}}\right]$, we obtain

[TABLE]

Until now we have assumed $\rho^{n}\in\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$. By section E.1,

[TABLE]

where $\mathcal{F}_{q}^{n}$ is the event that the projection of $\rho^{n}$ (the remaining state after the support estimation step) onto $\mathcal{S}^{n}_{\bar{\mathcal{H}}^{\otimes n-q}}$ fails, where $\mathcal{T}_{\leq s}^{k}$ is the event that at most $s$ of the $k$ values $\beta_{i}$ from the support estimation step satisfy $|\beta_{i}|^{2}>E$, and where $P_{\text{support}}=8k^{3/2}\exp\left[{-\frac{k}{9}\left(\frac{q}{n}-\frac{2s}{k}\right)^{2}}\right]$. With the union bound we thus obtain

[TABLE]

where

[TABLE]

∎

The variables $\epsilon,\epsilon^{\prime},n,m,q,k,s,E$ are free parameters of the protocol. Let us fix, e.g., $E=O(1)$, $s=O(1)$, $n=O\left(m^{19+8E}\right)$, $k=O(m^{19+8E}),q=O\left(m^{10+4E}\right)$, and $\epsilon=\epsilon^{\prime}=O(\frac{1}{m})$. Then, with Theorem 7.1, either the estimate $F_{\Psi}(\rho)$ of the fidelity $F(\Psi^{\otimes m},\rho^{m})$ is polynomially precise (in $m$), or the score at the support estimation step is higher than $s$, with polynomial probability (in $m$), by plugging the different scalings in Eq. (177).