Shadow Tomography Against Adversaries

TL;DR

This paper investigates adversarial robustness in single-copy shadow tomography, establishing lower bounds, proposing a nearly optimal algorithm, and demonstrating improved robustness and efficiency over previous methods.

Contribution

It introduces a simple, robust shadow tomography algorithm that nearly matches lower bounds and improves adversarial robustness and sample complexity.

Findings

Lower bound of error b5=(b3 ext{min}\u007b ext{,} ext{d})

Proposed algorithm achieves error b5=(b3 ext{max} ext{O}_i ext{HS})

Sample complexity matches classical shadows without corruption

Abstract

We study single-copy shadow tomography in the adversarial robust setting, where the goal is to learn the expectation values of $M$ observables $O_1, \ldots, O_M$ with $\varepsilon$ accuracy, but $\gamma$-fraction of the outcomes can be arbitrarily corrupted by an adversary. We show that all non-adaptive shadow tomography algorithms must incur an error of $\varepsilon=\tilde{\Omega}(\gamma\min\{\sqrt{M}, \sqrt{d}\})$ for some choice of observables, even with unlimited copies. Unfortunately, the classical shadows algorithm by [HKP20] and naive algorithms that directly measure each observable suffer even more. We design an algorithm that achieves an error of $\varepsilon=\tilde{O}(\gamma\max_{i\in[M]}\|O_i\|_{HS})$, which nearly matches our worst-case error lower bound for $M\ge d$ and guarantees better accuracy when the observables have stronger structure. Remarkably, the algorithm only needs $n=\frac{1}{\gamma^2}\log(M/\delta)$ copies to achieve that error with probability at least $1-\delta$, matching the sample complexity of the classical shadows algorithm that achieves the same error without corrupted measurement outcomes. Our algorithm is conceptually simple and easy to implement. Classical simulation for fidelity estimation shows that our algorithm enjoys much stronger robustness than [HKP20] under adversarial noise. Finally, based on a reduction from full-state tomography to shadow tomography, we prove that for rank $r$ states, both the near-optimal asymptotic error of $\varepsilon=\tilde{O}(\gamma\sqrt{r})$ and copy complexity $\tilde{O}(dr^2/\varepsilon^2)=\tilde{O}(dr/\gamma^2)$ can be achieved for adversarially robust state tomography, closing the large gap in [ABCL25] where optimal error can only be achieved using pseudo-polynomial number of copies in $d$.