Experimental Cryptographic Verification for Near-Term Quantum Cloud Computing

Experimental Cryptographic Verification for Near-Term Quantum Cloud Computing


Recently, there are more and more organizations offering quantum-cloud services, where any client can access a quantum computer remotely through the internet. In the near future, these cloud servers may claim to offer quantum computing power out of reach of classical devices. An important task is to make sure that there is a real quantum computer running, instead of a simulation by a classical device. Here we explore the applicability of a cryptographic verification scheme that avoids the need of implementing a full quantum algorithm or requiring the clients to communicate with quantum resources. In this scheme, the client encodes a secret string in a scrambled IQP (instantaneous quantum polynomial) circuit sent to the quantum cloud in the form of classical message, and verify the computation by checking the probability bias of a class of ouput strings generated by the server. We implemented the scheme on a 5-qubit NMR quantum processor in the laboratory and a 5-qubit and 16-qubit processors of the IBM quantum cloud. We found that the experimental results of the NMR processor can be verified by the scheme with about error, after noise compensation by standard techniques. However, the fidelity of the IBM quantum cloud was too low to pass the test (about error). This verification scheme shall become practical when servers claim to offer quantum-computing resources that can achieve quantum supremacy.


Introduction.— Quantum computation promises a regime with unprecedented computational power over classical devices, offering numerous interesting applications, such as factorization Shor (), quantum simulation Feynman (1982); Lloyd (1996), and quantum machine learning Harrow et al. (2009); Lloyd et al. (2013). However, before quantum computers become prevalent to the public, one might expect that only organizations with sufficient resources could operate a full-scale quantum computer, analogous to today’s supercomputers. Furthermore, individuals who have demands for quantum computation could access the service through the internet, i.e., cloud quantum computing. In fact, several small-scale quantum cloud services have already been launched IBM QX team (); Rigetti Computing (); bri (), which can be operated by remote clients through the internet. As a result, many simulations performed from quantum cloud servers have been reported (see Ref. Coles et al. (2018) for a summary).

In the near future, it is not impossible that these clouds may claim to offer 100 or more working qubits and many layers for setting up quantum gates, where quantum supremacy Preskill (2012); Lund et al. (2017); Terhal (2018); Yung (2018) could be achieved. However, one may naturally ask, is there a real quantum computer behind the cloud? Or, would it just be a classical computer simulating quantum computation? For ordinary clients who only have control and access of classical computer, a natural task is to verify whether these cloud servers are truly quantum.

Alternatively, the question can be formalized as follows: is it possible for a purely-classical client to verify the output of a quantum prover? This question has been extensively explored for more than ten years. In 2004, Gottesman initialized this question, which Aaronson wrote down in his blog Got (). A straight-forward idea is to run a quantum algorithm solving certain NP problems, for example, Shor’s algorithm for integer factorization Shor (). Such problems might be hard for classical computation, but are easy for classical verification once the result is known. However, the challenge is that a full quantum algorithm typically requires thousands of qubits and quantum error correction to be implemented, which is out of question in the NISQ Preskill (2018) (Noisy Intermediate-Scale Quantum) era.

We should note that the verification problem may have different variations. For example, one may assume that the “classical” client may actually have a limited ability to perform quantum operations on a small number of qubits. This line of research has already attracted much attention  Broadbent et al. (2009, 2010); Aharonov et al. (2008a, b); Fitzsimons and Kashefi (2017); Fitzsimons et al. (2018). Without any quantum power, the client might still be able to verify delegated quantum computation which is spatially separated and entanglement can be shared Reichardt et al. (2013); Huang et al. (2017). Currently, this approach does not seem to fit the setting of the available quantum cloud services, but it does reveal the outstanding challenge for establishing a rigorous verification scheme based on a classical client interacting with a single server using only classical communication Aaronson et al. (2017).

Until recently, Mahadev has made important progresses through two papers Mahadev (2017, 2018), under an assumption that the learning-with-errors problem Regev (2005) is computationally hard even for quantum computer. The protocol allows a classical computer to interactively verify the results of an efficient quantum computation, achieving a fully-homomorphic encryption scheme for quantum circuits with classical keys. Despite these great efforts, we are still facing the problems of verifying near-term quantum clouds, which would be too noisy for implementing full quantum algorithms but may be capable of demonstrating quantum supremacy.

Here we report an experimental demonstration of a simple but powerful cryptographic verification protocol, originally proposed by Bremner and Shepherd Shepherd and Bremner (2009) in 2008. Our implementation was performed with a 5-qubit NMR quantum processor in the laboratroy. Additionally, we also benchmarked the performance of the verification scheme by actually implementing the protocol with the IBM quantum cloud processors IBM QX team ().

The verification protocol implemented is based on a simplified circuit model of quantum computation, called IQP (instantaneous quantum polynomial) model Shepherd and Bremner (2009); the qubits are always initialized in the ‘0’ state. The IQP circuits contain three parts. In the first and the last part, single-qubit Hadamard gates are applied to every qubit. The middle part of an IQP circuit does not contain an explicit temporal structure, in the sense that diagonal (and hence commuting) gates acting on single or multiple qubits are applied. On one hand, the IQP model represents a relatively resource-friendly computational model to be tested with near-term quantum devices. On the other hand, the IQP model has been proven to be hard for classical simulation Bremner et al. (2011, 2016), under certain computational assumptions similar to Boson sampling Aaronson and Arkhipov (2013).

Figure 1: Schematic representation of the protocol. Alice generates a description matrix, according to the construction of quadratic residue code. This description matrix has an associating secret vector and determines an -program circuit. Bob runs this circuit, measures and sends back the measurement data to Alice. From Bob’s data, Alice computes the probability bias , with respect to the secret vector , and sees whether it is close to 0.854, to decide whether Bob has a true quantum device or not.

Verification protocol.— In the cryptographic verification protocol Shepherd and Bremner (2009), there are two parties labeled as Alice (the client) and Bob (the server). Alice is assumed to be completely classical; she can only communicate with others through classical communication (e.g., internet). Suppose Bob claims to own a quantum computer and Alice is going to test it. In reality, of course, there is no need for Alice to inform Bob about her intention; she may just pretend to run a normal quantum program. The protocol can be succinctly summarized as follows (depicted by Fig. 1).

  1. Alice first generates a matrix (called X-program Shepherd and Bremner (2009)) associated with a secret string , which is only kept by Alice.

  2. Alice then translates the X-program into an IQP circuit of qubits, and sends the information about the IQP circuit to Bob.

  3. Bob returns the outputs to Alice in terms of the bit strings , which should follow the distribution of the IQP circuit, i.e., , if Bob is honest.

  4. Ideally, Alice should be able to determine if the probability distributions for a subset of strings orthogonal to the secret string, where , add up to an expected value 0.854. Otherwise, Bob fails to pass the test.

More specifically, the key quantity of interest is the following probability bias defined by,


where if it is true that , and otherwise. For a perfect quantum computation, the value of the probability bias should be . The best known classical algorithm Shepherd and Bremner (2009) would instead produce a value of 0.75, which is relevant when is sufficiently large. This quantum-classical gap in the probability bias makes it possible to apply such a resource-friendly cryptographic verification scheme for testing quantum cloud computing in the regime where quantum supremacy would be achieved.

Figure 2: IQP circuit for the X-program matrix (3). There are two layers of Hadamard gates at the beginning and the end of the circuit. The gates in between are all diagonal in the basis. stands for .

Overview.— To illustrate our experimental demonstrations, we shall first provide a concise and self-contained theoretical description of the cryptographic protocol. Particularly, the computer code implemented in the experiment is also provided online git () and supplementary materials; interested readers can readily reproduce our results with it, and can also apply it to generate X-programs of different variations for testing other quantum-cloud services.

Moreover, we also provide a theoretical extension of the original work Shepherd and Bremner (2009), transforming it into a form more familiar to the physics community. Specifically, we connect the probability bias in Eq. (1) with the Fourier coefficient of the probability of the output strings. As a result, we can express the probability bias through the -point correlation function (see Supplemental Materials):


Since the string is not known to Bob, the verification protocol can be regarded as a game where Alice tests the outcomes in terms of a particular correlation function unknown to Bob.

In addition, the representation of Eq. (2) provide a straight-forward way to understand why the redundant part of the X-program does not affect the probability bias—they commute with the -point correlation function.

A further consequence of Eq. (2) is that if one models Bremner et al. (2017); Yung and Gao (2017) the decoherence by a dephasing channel (with an error rate ) applied for each qubit at each time step, then the probability bias becomes , where is the Hamming weight of , that is the number of 1’s in .

On the other hand, our experimental data were taken separately from two different sources, namely a five-qubit NMR processor in the laboratory, and the IBM cloud services, aiming to benchmark the performances of the IQP circuit implementation under the laboratory conditions and that from the quantum-cloud service.

Our results show that the laboratory NMR quantum processor can be employed to verify the IQP circuit after noise compensation by standard technique, but the IBM quantum cloud was too noisy. The probability bias obtained from the IBM’s processors are close to 0.5, which is the result of uniform distribution. The main reason is that IBM’s system has many constraints on the connectivity between the physical qubits; we had to include many extra SWAP gates to complete the circuit, causing a severe decoherence problem.

Theoretical construction.— Here Alice’s secret vector of string is given by . An X-program can be represented by a matrix with binary values, which is constructed from the quadratic residue code (QRC) MacWilliams and Sloane (1977). In the experiment, the matrix associated with the X-program is given by the following (see Supplemental Material for the construction method),


Here the X-program has a layer of security for protecting the knowledge of the secret string from Bob. Explicitly, there are two parts in the matrix, (i) the main part and (ii) a redundant part. Columns in the main part are not orthogonal to the secret vector , i.e., , while columns in the redundant part are, i.e., . Both parts have to be changed if the secret string is changed.

However, an important property of the X-program is that the probability bias depends only on the main part. So Alice can append as many redundant columns that are orthogonal to to this matrix as she wishes. Of course, later she would need to scramble the columns, in order to hide the secret from Bob.

Next, the X-program has to be translated into an IQP cirucit Shepherd and Bremner (2009), which is a subclass of quantum circuits with commuting gates before and after the Hadamard gates. Equivalently, the unitary transformation associated with the IQP circuit can be casted as follows:


where , and is the effective Hamiltonian constructed by the elements of the X-program. For example, a column represents a term , where is a Pauli- acting on the -th qubit. As a result, the full Hamiltonian corresponding to reads,


Note that if we take , then the evolution can be simulated classically by the Gottesman-Knill algorithm Gottesman (1998). Fig. 2 shows the circuit diagram.

In the ideal case, the probability bias for the IQP circuit should be given by . If Bob outputs random bits, the value of the probability bias would be . However, although it is scrambled, the X-program is correlated with the secret string. The classical algorithm provided in Ref. Shepherd and Bremner (2009) can yield , which was conjectured to be optimal Shepherd and Bremner (2009). As a result, it becomes possible to verify the quantum hardware behind the quantum clouds by simply collecting the statistics of the outputs to check if we can get .

For the purpose of benchmarking, we performed a total of three separate implementations of the same X-program on an NMR quantum processor and on IBM quantum processors, including the 5-qubit one and the 16-qubit one IBM QX team ().

Figure 3: (a) Part of the peak values from the readout pulses. There are 80 groups of peak values in total and we only present the first 10 groups here. Each peak value is a linear combination of probabilities. (b) The ratio of the experimental value to the theoretical value of the -point correlation function in log scale, versus Hamming weights.

Verification with NMR in the laboratory.— The experiments with the NMR quantum processor were carried on a Bruker AV-400 spectrometer at 303K. The 5-qubit quantum processor consists of two nuclear spins and three nuclear spins in 1-bromo-2,4,5-trifluorobenzene dissolved in the liquid crystal N-(4-methoxybenzylidene)-4-butylaniline (MBBA) Shankar et al. (2014). The molecular structure and equilibrium spectra of nuclear spins are provided in the Supplemental Materials.

Figure 4: (a) Probability distributions from IBM quantum processors and the NMR processor. ibmqx4 is the 5-qubit processor and ibmqx5 is the 16-qubit one. (b) The probabilities are put into grids and the colors indicate their values according to the color scale on the right.

Starting from the thermal state , the NMR system is initially prepared in a pseudo-pure state (PPS) by the line-selective method Peng et al. (2001). Here represents the identity operator and is the polarization. Note that the identity operator is invariant under the unitary transformation, neither does it affect the measurement step. The state evolves the same way as a true pure state and generates the same signal up to a proportionality factor , so we can simply regard the as . After that, we implement the unitary transformation , followed by the readout pulses. To obtain the probability bias in the experiment, we need five readout pulses (i.e. a pulse on each qubit ) to reconstruct the diagonal elements of the density matrix of the final state, which are the probabilities in the computational basis. In the actual implementation, we packed the quantum circuit with the five readout pulses together into five shape pulses calculated by the gradient ascent pulse engineering (GRAPE) method Khaneja et al. (2005), with the length of each shape pulse being 37.5ms and the number of segments being 1500. All the pulses have theoretical fidelity over and are designed to be robust against the inhomogeneity of radio-frequency pulses.

From each readout pulse, we can obtain 16 linear equations, and each linear equation is a linear combination of the 32 probabilities. So we have 80 such linear equations of the form: (), where ’s are the peak values read out by our device. We present 10 of these peak values in Fig. 3 (a), and figure with all peak values can be found in Supplemental Material. The blue lines in Fig. 3 (a) are from the experiment on our NMR processor, and the red ones are from theorectical simulation without considering the noise effect. After solving those 80 linear euqations from NMR processor through the least square method, we obtain the corresponding probability distribution, as depicted in Fig. 4 (a) (the blue histogram). The probability bias from this raw distribution is 0.711.

The probability bias is connected to the -point correlation function through Eq. (2). If there is single-qubit dephasing noise on every qubits at each step, the -point correlation function will decay by a factor  Bremner et al. (2017); Yung and Gao (2017). Thus the ratio of the experimental -point correlation (which is from the raw distribution) to the theoretical value is . Fig. (3) (b) shows this ratio in log scale, versus Hamming weights of all possible . The slope of the linear fit is , from which we obtain an effective error rate .

We note that the whole duration of the dynamic evolution is 37.5 ms whereas the decoherence time is about 63 ms. Hence, the decay caused by the decoherence is not negligible. To compensate the effects of decoherence, we numerically simulate the decoherence effects including and processes. All the diagonal elements of the ideal final density matrix are multiplied by a exponential decay factor, and all the off-diagonal elements are multiplied by a exponential decay factor. In this way, we obtain 80 peak values after considering decoherence in our NMR processor, the first ten of which are shown as green lines in Fig. 3 (a) (the whole 80 peak values are put in Supplemental Material). The attenuation factor, i.e., the ratio of peak values with decoherence (green) to peak values without decoherence (red), is 0.5514. To compensate the effects of decoherence, peak values from actual experiment are divided by the attenuation factor. Then with a similar method by solving linear equations, we derive the probability bias compensated by noise: 0.832 0.030 (comparable with the theoretical value: 0.854).

Verification with IBM cloud.— As for experiments on IBM devices, we run the same circuits as in Fig. 2. However, due to the connectivity constraints IBM QX team (), we have to include several additional SWAPs to complete the circuit, which makes the whole circuit depth be about ; for example, CNOT gates can only be applied to a certain pairs of qubits. In our demonstration, we applied the verification algorithm for ibmqx4, a 5-qubit superconducting processor, and ibmqx5, a 16-qubit one, which are accessed via a software called QISKit. We collect specification of IBM devices in Supplemental Material, including the connectivity and coherence time. These data can also be found in Ref. IBM QX team ().

In Fig. 4 (a), the histogram in orange is the probability distribution from the experiment on ibmqx4, while the brown one is from ibmqx5. The probability biases from these two distributions are respectively 0.488 and 0.492, which are far from the expected value of 0.854. In fact, from a completely-mixed state, we can obtain a probability bias of 0.5. So the values of bias from these two quantum cloud services by IBM indicate that their final states are highly corrupted by decoherence. We concluded that the IBM cloud was too noisy to pass our test.

Fig. 4 (b) shows the comparison of the distributions. Each grid has 32 elements, corresponding to 32 probabilities. The color in each element indicates the concrete value, according to the color scale on the right. The distribution from the experiment run on NMR device is close to the theoretical prediction while the last two, which are distributions from IBM devices, are not.

Summary.— We have performed a proof-of-principle demonstration of a cryptographic verification scheme, using an NMR quantum processor and the IBM quantum cloud. The experimental results show that the fidelity of the quantum cloud service has to be significantly improved, in order to be testable with the verification method. In particular, the connectivity between the qubits imposes an extra overhead in the implementation of the scheme. For a large-scale implementation, it is the also important to determine numerically the size of IQP circuit that can no longer be simulable by classical computers, which is currently an open question.

Acknowledgement.— We acknowledge use of the IBM Q for this work. The views expressed are those of the authors and do not reflect the official policy or position of IBM or the IBM Q team. NY is supported in part by the Australian Research Council (Grant No. DE180100156). MHY is supported by Natural Science Foundation of Guangdong Province (2017B030308003) and the Guangdong Innovative and Entrepreneurial Research Team Program (No. 2016ZT06D348), and the Science Technology and Innovation Commission of Shenzhen Municipality (ZDSYS20170303165926217, JCYJ20170412152620376). XP, XC and XN acknowledge the support from the National Key Research and Development Program of China (2018YFA0306600), the National Key Basic Research Program of China (2014CB848700), National Natural Science Foundation of China (grants No. 11425523, 11375167, 11661161018, and 11227901), and Anhui Initiative in Quantum Information Technologies(grant No. AHY050000), and the Postdoctoral Science Foundation of China (No. 2018M632195).

Appendix A Supplemental Material

a.1 Quadratic-Residue-Code Construction

We briefly review the quadratic-residue-code (QRC) construction. For detailed proofs, we refer readers to Shepherd and Bremner (2009) and MacWilliams and Sloane (1977). Below, all linear algebraic objects (vectors, matrices, linear spaces, etc.) are over .

Related Classical Coding Theories

Definition 1.

(code and codeword) A code is a linear subspace of , and the elements of a code is called codeword. Denote “ is a codeword of ” as .

Given a matrix , the linear combination of its rows generate a code , and such a matrix is called generating matrix of . Generating matrices for a code are not unique.

Definition 2.

(quadratic residue) An integer is called a quadratic residue modulo if there exists an integer , s.t. .

Suppose is a prime such that divides . Consider a binary vector of length , the -th components of which is 1 if and only if is a quadratic residue modulo . The smallest example is , in which case such vector is . Rotate it, and we get a class of vectors, such as , , etc. This class of vectors generates a linear subspace , called quadratic residue code (QRC). For , the matrix below can be a generating matrix:

Here, the last rows form a basis, and the first row is just a linear combination of the basis, thereby leaving the code invariant. More explicitly, any vectors in the code space generated by can be written as , where .

Definition 3.

(Hamming weight) The Hamming weight of a codeword is the number of ’s that it has, denoted as .

If the Hamming wieght is even, then we say the codeword is even.

Definition 4.

(doubly even) A code is doubly even if all the codewords have Hamming weight a multiple of 4.

Definition 5.

(dual code and self-dual) For a code , the dual code is defined as . A code is self-dual if its dual code is itself.

Here, the inner product is over . It is clear that . The dimension of a self-dual code is with even.

We collect some results from classical coding theory in Lemma 1.

Lemma 1.

The dimension of QRC with respect to is . Append a single bit to every codeword of QRC (these bits are not necessarily the same for all codewords), to make them all even. The extended QRC is self-dual and doubly even.

The Quantum Value of Bias

We append columns whose 1-st component is 0 to , to make a larger matrix . Obviously, columns in are not orthogonal to , but the appending columns are. We interpret as an X-program, run it and calculate the bias in the direction of , then we have Shepherd and Bremner (2009)

Theorem 1.

Denote the code generated by as . Then the bias in the direction of is


where is the dimension of QRC and is the number of elements in QRC.

From the above formula, we know that the bias depends on the QRC instead of the matrix or . This means that we can append with arbitrarily many rows orthogonal to , without changing the the bias. Also, we can do row manipulation to , and the bias remains unchanged as long as we change correspondingly s.t. the appending rows are still orthogonal to . This can scramble the circuit and the secret vector in order to hide it. We write a code for generating the initial QRC matrix and scrambling, and put it at the end of this section as well as in Ref. git ().

From Lemma 1, we know that odd codewords in the original QRC have weight -1 modulo 4, and those of even parity have weight 0 modulo 4, since the extended QRC is doubly even. For a code, the number of even and odd codewords are equal. Thus in the summation is half the time 1 modulo 8, and half the time -1 modulo 8. So the bias (for ) is

This is the quantum value of bias.

The Optimal Classical Value of Bias

In Shepherd and Bremner (2009), a classical efficient algorithm was proposed to approximate the bias. The algorithm works as follows:

  1. Randomly pick 2 -bit vectors and . (Recall that is the number of qubits as well as the length of columns in .)

  2. Delete columns in that are orthogonal to , and denote the remaining rows as a matrix . Do the same to get .

  3. Denote the sum of rows in as . Then is the approximate result of .

By some simple calculation, we can show that  Shepherd and Bremner (2009). From Lemma 1, we know that the extended QRC is self-dual, which implies the even codewords in the extended QRC is orthogonal to all codewords. Since the extended QRC is obtained by appending a single bit to codewords in QRC to make them all even, the bit appended to even codewords in QRC is . So the even codewords in QRC is orthogonal to all codewords in QRC. If the inner product between two codewords is not zero, then they are all odd, which occurs with probability . Thus

This value is conjected to be the best that a classical computer can approximate efficiently.

Python Code for QRC Construction

import numpy as np
# set parameters, which can be changed by readers
q = 7 # q must satisfy 8 divides (q+1)
n = int((q+3)/2) # number of qubits
r = 3 # number of redundant rows
def ColAdd(A, i, j):
    add the j-th column of A to the i-th column
    if len(A.shape) == 1:
        A_i = A[i]
        A_j = A[j]
        A_i = (A_i + A_j)%2
        A[i] = A_i
        A_i = A[:,i]
        A_j = A[:,j]
        A_i = (A_i + A_j)%2
        A[:,i] = A_i
    return A
def Redund(n):
    generate a redundant row
    a = np.random.choice(2, n)
    a[0] = 0
    return a
def QuadResidue(q):
    return quadratic residues modulo q
    qr = []
    for m in range(q):
    return list(set(qr))
def Init(n, q, r):
    generate the matrix
    result = {}
    P_s = np.zeros([q,n], dtype = int)
    P_s[:,0] = np.ones(q, dtype = int)
    qr = QuadResidue(q)
    for m in range(n-1):
        for m1 in qr:
            P_s[(m1-1+m)%q , m+1] = 1
    P = P_s
    while r > 0:
        r -= 1
        row = Redund(n)
        if (row == np.zeros(n, dtype = int)).all():
            r += 1
        P = np.append(P, [row], axis = 0)
    result[”matrix”] = np.unique(P, axis = 0)   # delete redundant rows
    s = np.zeros(n, dtype = int)
    s[0] = 1
    result[”secret”] = s
    return result
def Scramble(result, times):
    scramble P and s
    P = result[”matrix”]
    s = result[”secret”]
    for m in range(times):
        l = list(range(n))
        i = np.random.choice(l)
        j = np.random.choice(l)
        P = ColAdd(P, i, j)
        s = ColAdd(s, j, i)
    result[”matrix”] = P
    result[”secret”] = s
    return result
result = Init(n, q, r) # generate the initial matrix
print(Scramble(result, 50)) # scramble 50 times,
# and print the matrix
# as well as the secret vector

a.2 Probability Bias and -point Correlation Functions

In this section, we first show the relation between bias, Fourier components and -point correlation functions. Then exploiting this relation, we show why the redundant part of has no effect on the value of probability bias. Originally, in Ref. Shepherd and Bremner (2009), this is proven through Theorem 1. Here, we provide a more straightforward and intuitive way to visualize this fact.

For a probability distribution , its Fourier coefficient is


from the normalization of . Denote , then the -point correlation function for the final state is

if is a pure state. Fig. (S1) shows the quantum circuit representation of . From this representation, we can see that it is actually the Fourier coefficient of (up to a normalization factor ):

where is the transition amplitude. Thus , and


It should be noted that this relation is general and not restricted to IQP circuits.

An X-program circuit can be represented by a matrix of binary values; its columns represent the gates, as in the Main Text. There are two parts in , the main part and the redundant part . We also split the Hamiltonaian read from into two part , where is translated from and is from . Then , since commutes with . Columns in the redundant part of are orthogonal to , which implies that commutes with and so does . For example, is orthogonal to , and . As for , it anticommutes with , so . Thus

which has no dependence on the redundant part. Together with Eq. (S3), we can see that the value of probability bias does not depend on the redundant part.

Figure S1: Quantum circuit representation of . Here, can be any quantum circuits. At the same time, this diagram can also be viewed as .

a.3 Noise effect on probability bias

Consider a simple noise model: single-qubit bit-flip channels applied to every qubits at the end of the circuits. This model is equivalent to the noise model described in the main text: dephasing channels on every qubit at each time step. Those dephasing channels in between commute with each other as well as the diagonal gates, so they accumulate and can be regarded as an effective single-qubit dephasing channel on every qubit. After commuting with the final layers of Hadamard gates, they become bit-flip channels. Below, we follow Ref. Yung and Gao (2017) to show that under this noise, , and hence from Eq. (S3), .

First, the effect of the measurement operator is , where . Note that commutes with . To prove it, we shall first suppose is a single-qubit state. Then

Thus the effect of can be viewed as flipping the measurement outcome with probability . Note that in the expansion of , is like , and they also form a linear space. In this linear space, we introduce a ‘Hadamard’ operator : for . Then

From the definition of , we can easily see that . The original expansion of has probabilities as its coefficients. To explore the effect of noise on Fourier coefficiets, we might want to change basis from to :

Thus in this new basis, the coefficient is exactly (up to a factor). Now, , which gives , and hence . Since , we have under this noise model.

a.4 Experimental Details

NMR processor

Figure S2: (a) Molecular structure and parameter of 1-bromo-2,4,5-trifluorobenzene. The diagonal and off-diagonal elements represent the chemical shifts and effective coupling constants in units of Hz, respectively. (b) Equilibrium spectra of nuclear spins. The numbers above the peaks are the indices of qubits.

The experiments run on NMR quantum processor were carried on a Bruker AV-400 spectrometer at 303K. The 5-qubit quantum processor consists of two nuclear spins and three nuclear spins in 1-bromo-2,4,5-trifluorobenzene dissolved in the liquid crystal N-(4-methoxybenzylidene)-4-butylaniline (MBBA). Figure S2 (a) shows the molecular structure and (b) shows equilibrium spectra of nuclear spins.

As we mention in the main text, we apply five readout pulses to reconstruct the probability distribution of the final state. Each pulse gives us 16 linear equations of probabilities of the form , where ’s are peak values read out by our device. There are 80 peak values in total, as shown in Fig. S3. The blue lines are from the experiment on our NMR processor, the green ones are from theoretical simulation with decoherence effect taken into account, and the red ones are from theoretical simulation without considering the noise effect. The method we use to simulate the decoherence effect on our NMR platform is described in the main text. By solving these 80 linear equations with the least square method, we obtained the corresponding probability distribution.

Errors from solving linear equations. These 80 peak values are raw data from experiment. We now discuss how solving linear equations will produce errors to the resulted probability distribution and hence the bias. Let’s consider a uniform random error in the range , which are added to each . Repeat this process 1000 times, we get 1000 groups of peak values, each of which are added a random number in the range . Then we derive 1000 different values of probability bias, and we calculate the stardand deviation, which equals to 0.0597. Do the same process agian, except that this time the error is in the range . The standard deviation in this case is 0.0298.

Figure S3: Peak values from five readout pulses. Each pulse creates 16 peak values, which are linear combination of probabilities, so there are 80 peak values for each kinds of data.

IBM Devices

We use ibmqx4 and ibmqx5 for our experiments. We collect some specification of IBM devices here, and readers can find more details in Ref. IBM QX team (). Fig. S4 shows the connectivity of the two IBM devices. There are 16 qubits in ibmqx5, and we used the first 5 qubits, indicated as the red circles in Fig. S4 (b). Table S1 (a) shows the frequency, relaxation time and coherence time of ibmqx4, and (b) shows those of ibmqx5. The IBM devices are calibrated constantly, so the and listed in Table S1 are only mean values over an interval, according to the version number in Ref. IBM QX team (). The number after the sign shows the standard deviation of the mean.

We access ibmqx4 through the website of IBM quantum experence and can edit the circuit on a graphical interface. Fig. S5 shows the circuit run on ibmqx4. This circuit is equivalent to that of Fig. 2 in the main text. but due to the connectivity constraints on the device, we need to add many SWAP gates to implement the protocol on ibmqx4. But for ibmqx5, we need to access it through QISKit, an open-source software based on python. The code used to construct the circuit is shown in Fig. S6, and the full version can be found in Ref. git ().

Figure S4: Connectivity of (a) ibmqx4 and (b) ibmqx5. Here means qubit controls qubit . The red circles in (b) are the qubits we use in our experiment.
Q0 Q1 Q2 Q3 Q4 Frequency (GHz) 5.24 5.30 5.35 5.43 5.18 48.81 0.68 50.24 0.66 42.52 0.51 40.09 0.94 55.52 0.96 28.09 0.41 60.24 1.12 34.92 0.51 14.24 0.21 27.09 0.37 \captionof tableFrequency, relaxation time () and coherence time () of ibmqx4. Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 Q11 Q12 Q13 Q14 Q15 Frequency (GHz) 5.26 5.40 5.28 5.08 4.98 5.15 5.31 5.25 5.12 5.16 5.04 5.11 4.95 5.09 4.87 5.11 37 4 35 4 48 6 46 5 49 8 49 4 44 7 37 4 49 7 48 5 28 21 45 7 50 7 48 6 36 3 48 7 31 5 58 10 64 7 70 15 74 24 50 5 74 12 49 7 68 19 88 14 49 36 86 16 33 3 82 12 65 6 89 17 \captionof tableFrequency, relaxation time () and coherence time () of ibmqx5.
Table S1: Specification of IBM devices.
Figure S5: The -program circuit run on ibmqx4. The green block is a SWAP gate.
# circuit for i in range(5):     qc.h(qr[i])  # Hadamard gate for i in [1,2,3]:     qc.tdg(qr[i])  # T-dagger # (0,0,0,1,1) qc.cx(qr[3], qr[4])  # CNOT with Q3 controling Q4 qc.tdg(qr[4]) qc.cx(qr[3], qr[4]) # (0,1,0,0,1) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) for i in [1,2,3,4]:     qc.h(qr[i]) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) for i in [1,2,3,4]:     qc.h(qr[i]) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) qc.cx(qr[2], qr[3]) qc.tdg(qr[3]) qc.cx(qr[2], qr[3]) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) for i in [1,2,3,4]:     qc.h(qr[i]) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) for i in [1,2,3,4]:     qc.h(qr[i]) qc.cx(qr[1], qr[2]) qc.cx(qr[3], qr[4]) # (0,1,1,1,0) qc.cx(qr[1], qr[2]) qc.cx(qr[2], qr[3]) qc.tdg(qr[3]) qc.cx(qr[2], qr[3]) qc.cx(qr[1], qr[2]) # (0,0,1,0,1) qc.cx(qr[3], qr[4]) for i in [3,4]:     qc.h(qr[i]) qc.cx(qr[3], qr[4]) for i in [3,4]:     qc.h(qr[i]) qc.cx(qr[3], qr[4]) qc.cx(qr[2], qr[3]) qc.tdg(qr[3]) qc.cx(qr[2], qr[3]) qc.cx(qr[3], qr[4]) for i in [3,4]:     qc.h(qr[i]) qc.cx(qr[3], qr[4]) for i in [3,4]:     qc.h(qr[i]) qc.cx(qr[3], qr[4]) # (0,0,1,1,0) qc.cx(qr[2], qr[3]) qc.tdg(qr[3]) qc.cx(qr[2], qr[3]) # (1,0,1,0,0) qc.cx(qr[1], qr[0]) for i in [0,1]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) for i in [0,1]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) qc.cx(qr[1], qr[2]) qc.tdg(qr[2]) qc.cx(qr[1], qr[2]) qc.cx(qr[1], qr[0]) for i in [0,1]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) for i in [0,1]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) # (1,0,0,1,0) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) for i in [0,1,2,3]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) for i in [0,1,2,3]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) qc.cx(qr[1], qr[2]) qc.tdg(qr[2]) qc.cx(qr[1], qr[2]) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) for i in [0,1,2,3]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) for i in [0,1,2,3]:     qc.h(qr[i]) qc.cx(qr[1], qr[0]) qc.cx(qr[2], qr[3]) for i in range(5):     qc.h(qr[i]) # measure for j in range(5):     qc.measure(qr[j], cr[j])
Figure S6: The python code to construct the -program circuit run on ibmqx5, with QISKit.


  1. thanks: These two authors contributed equally
  2. thanks: These two authors contributed equally


  1. P. Shor, in Proceedings 35th Annual Symposium on Foundations of Computer Science (IEEE Comput. Soc. Press).
  2. R. P. Feynman, Int. J. Theor. Phys. 21, 467 (1982).
  3. S. Lloyd, Science 273, 1073 (1996).
  4. A. W. Harrow, A. Hassidim,  and S. Lloyd, Phys. Rev. Lett. 103, 150502 (2009).
  5. S. Lloyd, M. Mohseni,  and P. Rebentrost, “Quantum algorithms for supervised and unsupervised machine learning,”  (2013), arXiv:1307.0411 .
  6. IBM QX team, “IBM Quantum Experience,” https://github.com/QISKit/qiskit-backend-informationibmqx4 V1.1.0 accessed Dec 2017; ibmqx5 V1.1.0 accessed May 2018.
  7. Rigetti Computing, devices specification http://docs.rigetti.com/en/latest/qpu.html.
  8. “Quantum in the Cloud,” University of Bristol, http://www.bristol.ac.uk/physics/research/quantum/engagement/qcloud/.
  9. P. J. Coles, S. Eidenbenz, S. Pakin, A. Adedoyin, J. Ambrosiano, P. Anisimov, W. Casper, G. Chennupati, C. Coffrin, H. Djidjev, D. Gunter, S. Karra, N. Lemons, S. Lin, A. Lokhov, A. Malyzhenkov, D. Mascarenas, S. Mniszewski, B. Nadiga, D. O’Malley, D. Oyen, L. Prasad, R. Roberts, P. Romero, N. Santhi, N. Sinitsyn, P. Swart, M. Vuffray, J. Wendelberger, B. Yoon, R. Zamora,  and W. Zhu,  (2018), arXiv:1804.03719 .
  10. J. Preskill, “Quantum computing and the entanglement frontier,”  (2012), arXiv:1203.5813 .
  11. A. P. Lund, M. J. Bremner,  and T. C. Ralph, npj Quantum Information 3, 15 (2017).
  12. B. M. Terhal, Nat. Phys. 14, 530 (2018).
  13. M.-H. Yung, Natl. Sci. Rev. , nwy072 (2018).
  14. At first sight, this seems a simple question. One may ask the quantum cloud to run a classical intractable task which is feasible for a quantum computer. This idea is not practical as it is equivalent to separating BQP (bounded-error quantum polynomial time) and P (polynomial time), one of the most important open problem in quantum complexity theory. See https://www.scottaaronson.com/blog/?p=284 for more detail. .
  15. J. Preskill, “Quantum Computing in the NISQ era and beyond,”  (2018), arXiv:1801.00862 .
  16. A. Broadbent, J. Fitzsimons,  and E. Kashefi, in 2009 50th Annual IEEE Symposium on Foundations of Computer Science (2009) pp. 517–526.
  17. A. Broadbent, J. Fitzsimons,  and E. Kashefi, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6154 LNCS, 43 (2010).
  18. D. Aharonov, M. Ben-Or,  and E. Eban,  (2008a), arXiv:0810.5375 .
  19. D. Aharonov, M. Ben-Or, E. Eban,  and U. Mahadev,  (2008b), arXiv:1704.04487 .
  20. J. F. Fitzsimons and E. Kashefi, Phys. Rev. A 96, 012303 (2017).
  21. J. F. Fitzsimons, M. Hajdušek,  and T. Morimae, Phys. Rev. Lett. 120, 040501 (2018).
  22. B. W. Reichardt, F. Unger,  and U. Vazirani, Nature 496, 456 (2013).
  23. H.-L. Huang, Q. Zhao, X. Ma, C. Liu, Z.-E. Su, X.-L. Wang, L. Li, N.-L. Liu, B. C. Sanders, C.-Y. Lu,  and J.-W. Pan, Phys. Rev. Lett. 119, 050503 (2017).
  24. S. Aaronson, A. Cojocaru, A. Gheorghiu,  and E. Kashefi,  (2017)arXiv:1704.08482 .
  25. U. Mahadev,  (2017), arXiv:1708.02130 .
  26. U. Mahadev,  (2018), arXiv:1804.01082 .
  27. O. Regev, in Proceedings of the Thirty-seventh Annual ACM Symposium on Theory of Computing, STOC ’05 (ACM, 2005) pp. 84–93.
  28. D. Shepherd and M. J. Bremner, Proc. R. Soc. A 465, 1413 (2009).
  29. M. J. Bremner, R. Jozsa,  and D. J. Shepherd, Proc. R. Soc. A 467, 459 (2011).
  30. M. J. Bremner, A. Montanaro,  and D. J. Shepherd, Phys. Rev. Lett. 117, 080501 (2016).
  31. S. Aaronson and A. Arkhipov, Theory Comput. 9, 143 (2013).
  32. Codes are available on https://gitlab.com/BinCheng/IQP_Experiment.
  33. M. J. Bremner, A. Montanaro,  and D. J. Shepherd, Quantum 1, 8 (2017).
  34. M.-H. Yung and X. Gao,  (2017)arXiv:1706.08913 .
  35. F. J. MacWilliams and N. J. A. Sloane, The theory of error-correcting codes (Elsevier, 1977).
  36. D. Gottesman,  (1998), arXiv:quant-ph/9807006 .
  37. R. Shankar, S. S. Hegde,  and T. Mahesh, Phys. Lett. A 378, 10 (2014).
  38. X. Peng, X. Zhu, X. Fang, M. Feng, K. Gao, X. Yang,  and M. Liu, Chem. Phys. Lett. 340, 509 (2001).
  39. N. Khaneja, T. Reiss, C. Kehlet, T. Schulte-Herbrüggen,  and S. J. Glaser, J. Magn. Reson. 172, 296 (2005).
Comments 0
Request Comment
You are adding the first comment!
How to quickly get a good reply:
  • Give credit where it’s due by listing out the positive aspects of a paper before getting into which changes should be made.
  • Be specific in your critique, and provide supporting evidence with appropriate references to substantiate general statements.
  • Your comment should inspire ideas to flow and help the author improves the paper.

The better we are at sharing our knowledge with each other, the faster we move forward.
The feedback must be of minimum 40 characters and the title a minimum of 5 characters
Add comment
Loading ...
This is a comment super asjknd jkasnjk adsnkj
The feedback must be of minumum 40 characters
The feedback must be of minumum 40 characters

You are asking your first question!
How to quickly get a good answer:
  • Keep your question short and to the point
  • Check for grammar or spelling errors.
  • Phrase it like a question
Test description