Experimental Cryptographic Verification for NearTerm Quantum Cloud Computing
Abstract
Recently, there are more and more organizations offering quantumcloud services, where any client can access a quantum computer remotely through the internet. In the near future, these cloud servers may claim to offer quantum computing power out of reach of classical devices. An important task is to make sure that there is a real quantum computer running, instead of a simulation by a classical device. Here we explore the applicability of a cryptographic verification scheme that avoids the need of implementing a full quantum algorithm or requiring the clients to communicate with quantum resources. In this scheme, the client encodes a secret string in a scrambled IQP (instantaneous quantum polynomial) circuit sent to the quantum cloud in the form of classical message, and verify the computation by checking the probability bias of a class of ouput strings generated by the server. We implemented the scheme on a 5qubit NMR quantum processor in the laboratory and a 5qubit and 16qubit processors of the IBM quantum cloud. We found that the experimental results of the NMR processor can be verified by the scheme with about error, after noise compensation by standard techniques. However, the fidelity of the IBM quantum cloud was too low to pass the test (about error). This verification scheme shall become practical when servers claim to offer quantumcomputing resources that can achieve quantum supremacy.
Introduction.— Quantum computation promises a regime with unprecedented computational power over classical devices, offering numerous interesting applications, such as factorization Shor (), quantum simulation Feynman (1982); Lloyd (1996), and quantum machine learning Harrow et al. (2009); Lloyd et al. (2013). However, before quantum computers become prevalent to the public, one might expect that only organizations with sufficient resources could operate a fullscale quantum computer, analogous to today’s supercomputers. Furthermore, individuals who have demands for quantum computation could access the service through the internet, i.e., cloud quantum computing. In fact, several smallscale quantum cloud services have already been launched IBM QX team (); Rigetti Computing (); bri (), which can be operated by remote clients through the internet. As a result, many simulations performed from quantum cloud servers have been reported (see Ref. Coles et al. (2018) for a summary).
In the near future, it is not impossible that these clouds may claim to offer 100 or more working qubits and many layers for setting up quantum gates, where quantum supremacy Preskill (2012); Lund et al. (2017); Terhal (2018); Yung (2018) could be achieved. However, one may naturally ask, is there a real quantum computer behind the cloud? Or, would it just be a classical computer simulating quantum computation? For ordinary clients who only have control and access of classical computer, a natural task is to verify whether these cloud servers are truly quantum.
Alternatively, the question can be formalized as follows: is it possible for a purelyclassical client to verify the output of a quantum prover? This question has been extensively explored for more than ten years. In 2004, Gottesman initialized this question, which Aaronson wrote down in his blog Got (). A straightforward idea is to run a quantum algorithm solving certain NP problems, for example, Shor’s algorithm for integer factorization Shor (). Such problems might be hard for classical computation, but are easy for classical verification once the result is known. However, the challenge is that a full quantum algorithm typically requires thousands of qubits and quantum error correction to be implemented, which is out of question in the NISQ Preskill (2018) (Noisy IntermediateScale Quantum) era.
We should note that the verification problem may have different variations. For example, one may assume that the “classical” client may actually have a limited ability to perform quantum operations on a small number of qubits. This line of research has already attracted much attention Broadbent et al. (2009, 2010); Aharonov et al. (2008a, b); Fitzsimons and Kashefi (2017); Fitzsimons et al. (2018). Without any quantum power, the client might still be able to verify delegated quantum computation which is spatially separated and entanglement can be shared Reichardt et al. (2013); Huang et al. (2017). Currently, this approach does not seem to fit the setting of the available quantum cloud services, but it does reveal the outstanding challenge for establishing a rigorous verification scheme based on a classical client interacting with a single server using only classical communication Aaronson et al. (2017).
Until recently, Mahadev has made important progresses through two papers Mahadev (2017, 2018), under an assumption that the learningwitherrors problem Regev (2005) is computationally hard even for quantum computer. The protocol allows a classical computer to interactively verify the results of an efficient quantum computation, achieving a fullyhomomorphic encryption scheme for quantum circuits with classical keys. Despite these great efforts, we are still facing the problems of verifying nearterm quantum clouds, which would be too noisy for implementing full quantum algorithms but may be capable of demonstrating quantum supremacy.
Here we report an experimental demonstration of a simple but powerful cryptographic verification protocol, originally proposed by Bremner and Shepherd Shepherd and Bremner (2009) in 2008. Our implementation was performed with a 5qubit NMR quantum processor in the laboratroy. Additionally, we also benchmarked the performance of the verification scheme by actually implementing the protocol with the IBM quantum cloud processors IBM QX team ().
The verification protocol implemented is based on a simplified circuit model of quantum computation, called IQP (instantaneous quantum polynomial) model Shepherd and Bremner (2009); the qubits are always initialized in the ‘0’ state. The IQP circuits contain three parts. In the first and the last part, singlequbit Hadamard gates are applied to every qubit. The middle part of an IQP circuit does not contain an explicit temporal structure, in the sense that diagonal (and hence commuting) gates acting on single or multiple qubits are applied. On one hand, the IQP model represents a relatively resourcefriendly computational model to be tested with nearterm quantum devices. On the other hand, the IQP model has been proven to be hard for classical simulation Bremner et al. (2011, 2016), under certain computational assumptions similar to Boson sampling Aaronson and Arkhipov (2013).
Verification protocol.— In the cryptographic verification protocol Shepherd and Bremner (2009), there are two parties labeled as Alice (the client) and Bob (the server). Alice is assumed to be completely classical; she can only communicate with others through classical communication (e.g., internet). Suppose Bob claims to own a quantum computer and Alice is going to test it. In reality, of course, there is no need for Alice to inform Bob about her intention; she may just pretend to run a normal quantum program. The protocol can be succinctly summarized as follows (depicted by Fig. 1).

Alice first generates a matrix (called Xprogram Shepherd and Bremner (2009)) associated with a secret string , which is only kept by Alice.

Alice then translates the Xprogram into an IQP circuit of qubits, and sends the information about the IQP circuit to Bob.

Bob returns the outputs to Alice in terms of the bit strings , which should follow the distribution of the IQP circuit, i.e., , if Bob is honest.

Ideally, Alice should be able to determine if the probability distributions for a subset of strings orthogonal to the secret string, where , add up to an expected value 0.854. Otherwise, Bob fails to pass the test.
More specifically, the key quantity of interest is the following probability bias defined by,
(1) 
where if it is true that , and otherwise. For a perfect quantum computation, the value of the probability bias should be . The best known classical algorithm Shepherd and Bremner (2009) would instead produce a value of 0.75, which is relevant when is sufficiently large. This quantumclassical gap in the probability bias makes it possible to apply such a resourcefriendly cryptographic verification scheme for testing quantum cloud computing in the regime where quantum supremacy would be achieved.
Overview.— To illustrate our experimental demonstrations, we shall first provide a concise and selfcontained theoretical description of the cryptographic protocol. Particularly, the computer code implemented in the experiment is also provided online git () and supplementary materials; interested readers can readily reproduce our results with it, and can also apply it to generate Xprograms of different variations for testing other quantumcloud services.
Moreover, we also provide a theoretical extension of the original work Shepherd and Bremner (2009), transforming it into a form more familiar to the physics community. Specifically, we connect the probability bias in Eq. (1) with the Fourier coefficient of the probability of the output strings. As a result, we can express the probability bias through the point correlation function (see Supplemental Materials):
(2) 
Since the string is not known to Bob, the verification protocol can be regarded as a game where Alice tests the outcomes in terms of a particular correlation function unknown to Bob.
In addition, the representation of Eq. (2) provide a straightforward way to understand why the redundant part of the Xprogram does not affect the probability bias—they commute with the point correlation function.
A further consequence of Eq. (2) is that if one models Bremner et al. (2017); Yung and Gao (2017) the decoherence by a dephasing channel (with an error rate ) applied for each qubit at each time step, then the probability bias becomes , where is the Hamming weight of , that is the number of 1’s in .
On the other hand, our experimental data were taken separately from two different sources, namely a fivequbit NMR processor in the laboratory, and the IBM cloud services, aiming to benchmark the performances of the IQP circuit implementation under the laboratory conditions and that from the quantumcloud service.
Our results show that the laboratory NMR quantum processor can be employed to verify the IQP circuit after noise compensation by standard technique, but the IBM quantum cloud was too noisy. The probability bias obtained from the IBM’s processors are close to 0.5, which is the result of uniform distribution. The main reason is that IBM’s system has many constraints on the connectivity between the physical qubits; we had to include many extra SWAP gates to complete the circuit, causing a severe decoherence problem.
Theoretical construction.— Here Alice’s secret vector of string is given by . An Xprogram can be represented by a matrix with binary values, which is constructed from the quadratic residue code (QRC) MacWilliams and Sloane (1977). In the experiment, the matrix associated with the Xprogram is given by the following (see Supplemental Material for the construction method),
(3) 
Here the Xprogram has a layer of security for protecting the knowledge of the secret string from Bob. Explicitly, there are two parts in the matrix, (i) the main part and (ii) a redundant part. Columns in the main part are not orthogonal to the secret vector , i.e., , while columns in the redundant part are, i.e., . Both parts have to be changed if the secret string is changed.
However, an important property of the Xprogram is that the probability bias depends only on the main part. So Alice can append as many redundant columns that are orthogonal to to this matrix as she wishes. Of course, later she would need to scramble the columns, in order to hide the secret from Bob.
Next, the Xprogram has to be translated into an IQP cirucit Shepherd and Bremner (2009), which is a subclass of quantum circuits with commuting gates before and after the Hadamard gates. Equivalently, the unitary transformation associated with the IQP circuit can be casted as follows:
(4) 
where , and is the effective Hamiltonian constructed by the elements of the Xprogram. For example, a column represents a term , where is a Pauli acting on the th qubit. As a result, the full Hamiltonian corresponding to reads,
(5) 
Note that if we take , then the evolution can be simulated classically by the GottesmanKnill algorithm Gottesman (1998). Fig. 2 shows the circuit diagram.
In the ideal case, the probability bias for the IQP circuit should be given by . If Bob outputs random bits, the value of the probability bias would be . However, although it is scrambled, the Xprogram is correlated with the secret string. The classical algorithm provided in Ref. Shepherd and Bremner (2009) can yield , which was conjectured to be optimal Shepherd and Bremner (2009). As a result, it becomes possible to verify the quantum hardware behind the quantum clouds by simply collecting the statistics of the outputs to check if we can get .
For the purpose of benchmarking, we performed a total of three separate implementations of the same Xprogram on an NMR quantum processor and on IBM quantum processors, including the 5qubit one and the 16qubit one IBM QX team ().
Verification with NMR in the laboratory.— The experiments with the NMR quantum processor were carried on a Bruker AV400 spectrometer at 303K. The 5qubit quantum processor consists of two nuclear spins and three nuclear spins in 1bromo2,4,5trifluorobenzene dissolved in the liquid crystal N(4methoxybenzylidene)4butylaniline (MBBA) Shankar et al. (2014). The molecular structure and equilibrium spectra of nuclear spins are provided in the Supplemental Materials.
Starting from the thermal state , the NMR system is initially prepared in a pseudopure state (PPS) by the lineselective method Peng et al. (2001). Here represents the identity operator and is the polarization. Note that the identity operator is invariant under the unitary transformation, neither does it affect the measurement step. The state evolves the same way as a true pure state and generates the same signal up to a proportionality factor , so we can simply regard the as . After that, we implement the unitary transformation , followed by the readout pulses. To obtain the probability bias in the experiment, we need five readout pulses (i.e. a pulse on each qubit ) to reconstruct the diagonal elements of the density matrix of the final state, which are the probabilities in the computational basis. In the actual implementation, we packed the quantum circuit with the five readout pulses together into five shape pulses calculated by the gradient ascent pulse engineering (GRAPE) method Khaneja et al. (2005), with the length of each shape pulse being 37.5ms and the number of segments being 1500. All the pulses have theoretical fidelity over and are designed to be robust against the inhomogeneity of radiofrequency pulses.
From each readout pulse, we can obtain 16 linear equations, and each linear equation is a linear combination of the 32 probabilities. So we have 80 such linear equations of the form: (), where ’s are the peak values read out by our device. We present 10 of these peak values in Fig. 3 (a), and figure with all peak values can be found in Supplemental Material. The blue lines in Fig. 3 (a) are from the experiment on our NMR processor, and the red ones are from theorectical simulation without considering the noise effect. After solving those 80 linear euqations from NMR processor through the least square method, we obtain the corresponding probability distribution, as depicted in Fig. 4 (a) (the blue histogram). The probability bias from this raw distribution is 0.711.
The probability bias is connected to the point correlation function through Eq. (2). If there is singlequbit dephasing noise on every qubits at each step, the point correlation function will decay by a factor Bremner et al. (2017); Yung and Gao (2017). Thus the ratio of the experimental point correlation (which is from the raw distribution) to the theoretical value is . Fig. (3) (b) shows this ratio in log scale, versus Hamming weights of all possible . The slope of the linear fit is , from which we obtain an effective error rate .
We note that the whole duration of the dynamic evolution is 37.5 ms whereas the decoherence time is about 63 ms. Hence, the decay caused by the decoherence is not negligible. To compensate the effects of decoherence, we numerically simulate the decoherence effects including and processes. All the diagonal elements of the ideal final density matrix are multiplied by a exponential decay factor, and all the offdiagonal elements are multiplied by a exponential decay factor. In this way, we obtain 80 peak values after considering decoherence in our NMR processor, the first ten of which are shown as green lines in Fig. 3 (a) (the whole 80 peak values are put in Supplemental Material). The attenuation factor, i.e., the ratio of peak values with decoherence (green) to peak values without decoherence (red), is 0.5514. To compensate the effects of decoherence, peak values from actual experiment are divided by the attenuation factor. Then with a similar method by solving linear equations, we derive the probability bias compensated by noise: 0.832 0.030 (comparable with the theoretical value: 0.854).
Verification with IBM cloud.— As for experiments on IBM devices, we run the same circuits as in Fig. 2. However, due to the connectivity constraints IBM QX team (), we have to include several additional SWAPs to complete the circuit, which makes the whole circuit depth be about ; for example, CNOT gates can only be applied to a certain pairs of qubits. In our demonstration, we applied the verification algorithm for ibmqx4, a 5qubit superconducting processor, and ibmqx5, a 16qubit one, which are accessed via a software called QISKit. We collect specification of IBM devices in Supplemental Material, including the connectivity and coherence time. These data can also be found in Ref. IBM QX team ().
In Fig. 4 (a), the histogram in orange is the probability distribution from the experiment on ibmqx4, while the brown one is from ibmqx5. The probability biases from these two distributions are respectively 0.488 and 0.492, which are far from the expected value of 0.854. In fact, from a completelymixed state, we can obtain a probability bias of 0.5. So the values of bias from these two quantum cloud services by IBM indicate that their final states are highly corrupted by decoherence. We concluded that the IBM cloud was too noisy to pass our test.
Fig. 4 (b) shows the comparison of the distributions. Each grid has 32 elements, corresponding to 32 probabilities. The color in each element indicates the concrete value, according to the color scale on the right. The distribution from the experiment run on NMR device is close to the theoretical prediction while the last two, which are distributions from IBM devices, are not.
Summary.— We have performed a proofofprinciple demonstration of a cryptographic verification scheme, using an NMR quantum processor and the IBM quantum cloud. The experimental results show that the fidelity of the quantum cloud service has to be significantly improved, in order to be testable with the verification method. In particular, the connectivity between the qubits imposes an extra overhead in the implementation of the scheme. For a largescale implementation, it is the also important to determine numerically the size of IQP circuit that can no longer be simulable by classical computers, which is currently an open question.
Acknowledgement.— We acknowledge use of the IBM Q for this work. The views expressed are those of the authors and do not reflect the official policy or position of IBM or the IBM Q team. NY is supported in part by the Australian Research Council (Grant No. DE180100156). MHY is supported by Natural Science Foundation of Guangdong Province (2017B030308003) and the Guangdong Innovative and Entrepreneurial Research Team Program (No. 2016ZT06D348), and the Science Technology and Innovation Commission of Shenzhen Municipality (ZDSYS20170303165926217, JCYJ20170412152620376). XP, XC and XN acknowledge the support from the National Key Research and Development Program of China (2018YFA0306600), the National Key Basic Research Program of China (2014CB848700), National Natural Science Foundation of China (grants No. 11425523, 11375167, 11661161018, and 11227901), and Anhui Initiative in Quantum Information Technologies(grant No. AHY050000), and the Postdoctoral Science Foundation of China (No. 2018M632195).
Appendix A Supplemental Material
a.1 QuadraticResidueCode Construction
We briefly review the quadraticresiduecode (QRC) construction. For detailed proofs, we refer readers to Shepherd and Bremner (2009) and MacWilliams and Sloane (1977). Below, all linear algebraic objects (vectors, matrices, linear spaces, etc.) are over .
Related Classical Coding Theories
Definition 1.
(code and codeword) A code is a linear subspace of , and the elements of a code is called codeword. Denote “ is a codeword of ” as .
Given a matrix , the linear combination of its rows generate a code , and such a matrix is called generating matrix of . Generating matrices for a code are not unique.
Definition 2.
(quadratic residue) An integer is called a quadratic residue modulo if there exists an integer , s.t. .
Suppose is a prime such that divides . Consider a binary vector of length , the th components of which is 1 if and only if is a quadratic residue modulo . The smallest example is , in which case such vector is . Rotate it, and we get a class of vectors, such as , , etc. This class of vectors generates a linear subspace , called quadratic residue code (QRC). For , the matrix below can be a generating matrix:
Here, the last rows form a basis, and the first row is just a linear combination of the basis, thereby leaving the code invariant. More explicitly, any vectors in the code space generated by can be written as , where .
Definition 3.
(Hamming weight) The Hamming weight of a codeword is the number of ’s that it has, denoted as .
If the Hamming wieght is even, then we say the codeword is even.
Definition 4.
(doubly even) A code is doubly even if all the codewords have Hamming weight a multiple of 4.
Definition 5.
(dual code and selfdual) For a code , the dual code is defined as . A code is selfdual if its dual code is itself.
Here, the inner product is over . It is clear that . The dimension of a selfdual code is with even.
We collect some results from classical coding theory in Lemma 1.
Lemma 1.
The dimension of QRC with respect to is . Append a single bit to every codeword of QRC (these bits are not necessarily the same for all codewords), to make them all even. The extended QRC is selfdual and doubly even.
The Quantum Value of Bias
We append columns whose 1st component is 0 to , to make a larger matrix . Obviously, columns in are not orthogonal to , but the appending columns are. We interpret as an Xprogram, run it and calculate the bias in the direction of , then we have Shepherd and Bremner (2009)
Theorem 1.
Denote the code generated by as . Then the bias in the direction of is
(S1) 
where is the dimension of QRC and is the number of elements in QRC.
From the above formula, we know that the bias depends on the QRC instead of the matrix or . This means that we can append with arbitrarily many rows orthogonal to , without changing the the bias. Also, we can do row manipulation to , and the bias remains unchanged as long as we change correspondingly s.t. the appending rows are still orthogonal to . This can scramble the circuit and the secret vector in order to hide it. We write a code for generating the initial QRC matrix and scrambling, and put it at the end of this section as well as in Ref. git ().
From Lemma 1, we know that odd codewords in the original QRC have weight 1 modulo 4, and those of even parity have weight 0 modulo 4, since the extended QRC is doubly even. For a code, the number of even and odd codewords are equal. Thus in the summation is half the time 1 modulo 8, and half the time 1 modulo 8. So the bias (for ) is
This is the quantum value of bias.
The Optimal Classical Value of Bias
In Shepherd and Bremner (2009), a classical efficient algorithm was proposed to approximate the bias. The algorithm works as follows:

Randomly pick 2 bit vectors and . (Recall that is the number of qubits as well as the length of columns in .)

Delete columns in that are orthogonal to , and denote the remaining rows as a matrix . Do the same to get .

Denote the sum of rows in as . Then is the approximate result of .
By some simple calculation, we can show that Shepherd and Bremner (2009). From Lemma 1, we know that the extended QRC is selfdual, which implies the even codewords in the extended QRC is orthogonal to all codewords. Since the extended QRC is obtained by appending a single bit to codewords in QRC to make them all even, the bit appended to even codewords in QRC is . So the even codewords in QRC is orthogonal to all codewords in QRC. If the inner product between two codewords is not zero, then they are all odd, which occurs with probability . Thus
This value is conjected to be the best that a classical computer can approximate efficiently.
Python Code for QRC Construction
a.2 Probability Bias and point Correlation Functions
In this section, we first show the relation between bias, Fourier components and point correlation functions. Then exploiting this relation, we show why the redundant part of has no effect on the value of probability bias. Originally, in Ref. Shepherd and Bremner (2009), this is proven through Theorem 1. Here, we provide a more straightforward and intuitive way to visualize this fact.
For a probability distribution , its Fourier coefficient is
(S2) 
from the normalization of . Denote , then the point correlation function for the final state is
if is a pure state. Fig. (S1) shows the quantum circuit representation of . From this representation, we can see that it is actually the Fourier coefficient of (up to a normalization factor ):
where is the transition amplitude. Thus , and
(S3) 
It should be noted that this relation is general and not restricted to IQP circuits.
An Xprogram circuit can be represented by a matrix of binary values; its columns represent the gates, as in the Main Text. There are two parts in , the main part and the redundant part . We also split the Hamiltonaian read from into two part , where is translated from and is from . Then , since commutes with . Columns in the redundant part of are orthogonal to , which implies that commutes with and so does . For example, is orthogonal to , and . As for , it anticommutes with , so . Thus
which has no dependence on the redundant part. Together with Eq. (S3), we can see that the value of probability bias does not depend on the redundant part.
a.3 Noise effect on probability bias
Consider a simple noise model: singlequbit bitflip channels applied to every qubits at the end of the circuits. This model is equivalent to the noise model described in the main text: dephasing channels on every qubit at each time step. Those dephasing channels in between commute with each other as well as the diagonal gates, so they accumulate and can be regarded as an effective singlequbit dephasing channel on every qubit. After commuting with the final layers of Hadamard gates, they become bitflip channels. Below, we follow Ref. Yung and Gao (2017) to show that under this noise, , and hence from Eq. (S3), .
First, the effect of the measurement operator is , where . Note that commutes with . To prove it, we shall first suppose is a singlequbit state. Then
Thus the effect of can be viewed as flipping the measurement outcome with probability . Note that in the expansion of , is like , and they also form a linear space. In this linear space, we introduce a ‘Hadamard’ operator : for . Then
From the definition of , we can easily see that . The original expansion of has probabilities as its coefficients. To explore the effect of noise on Fourier coefficiets, we might want to change basis from to :
Thus in this new basis, the coefficient is exactly (up to a factor). Now, , which gives , and hence . Since , we have under this noise model.
a.4 Experimental Details
NMR processor
The experiments run on NMR quantum processor were carried on a Bruker AV400 spectrometer at 303K. The 5qubit quantum processor consists of two nuclear spins and three nuclear spins in 1bromo2,4,5trifluorobenzene dissolved in the liquid crystal N(4methoxybenzylidene)4butylaniline (MBBA). Figure S2 (a) shows the molecular structure and (b) shows equilibrium spectra of nuclear spins.
As we mention in the main text, we apply five readout pulses to reconstruct the probability distribution of the final state. Each pulse gives us 16 linear equations of probabilities of the form , where ’s are peak values read out by our device. There are 80 peak values in total, as shown in Fig. S3. The blue lines are from the experiment on our NMR processor, the green ones are from theoretical simulation with decoherence effect taken into account, and the red ones are from theoretical simulation without considering the noise effect. The method we use to simulate the decoherence effect on our NMR platform is described in the main text. By solving these 80 linear equations with the least square method, we obtained the corresponding probability distribution.
Errors from solving linear equations. These 80 peak values are raw data from experiment. We now discuss how solving linear equations will produce errors to the resulted probability distribution and hence the bias. Let’s consider a uniform random error in the range , which are added to each . Repeat this process 1000 times, we get 1000 groups of peak values, each of which are added a random number in the range . Then we derive 1000 different values of probability bias, and we calculate the stardand deviation, which equals to 0.0597. Do the same process agian, except that this time the error is in the range . The standard deviation in this case is 0.0298.
IBM Devices
We use ibmqx4 and ibmqx5 for our experiments. We collect some specification of IBM devices here, and readers can find more details in Ref. IBM QX team (). Fig. S4 shows the connectivity of the two IBM devices. There are 16 qubits in ibmqx5, and we used the first 5 qubits, indicated as the red circles in Fig. S4 (b). Table S1 (a) shows the frequency, relaxation time and coherence time of ibmqx4, and (b) shows those of ibmqx5. The IBM devices are calibrated constantly, so the and listed in Table S1 are only mean values over an interval, according to the version number in Ref. IBM QX team (). The number after the sign shows the standard deviation of the mean.
We access ibmqx4 through the website of IBM quantum experence and can edit the circuit on a graphical interface. Fig. S5 shows the circuit run on ibmqx4. This circuit is equivalent to that of Fig. 2 in the main text. but due to the connectivity constraints on the device, we need to add many SWAP gates to implement the protocol on ibmqx4. But for ibmqx5, we need to access it through QISKit, an opensource software based on python. The code used to construct the circuit is shown in Fig. S6, and the full version can be found in Ref. git ().
Footnotes
 thanks: These two authors contributed equally
 thanks: These two authors contributed equally
References
 P. Shor, in Proceedings 35th Annual Symposium on Foundations of Computer Science (IEEE Comput. Soc. Press).
 R. P. Feynman, Int. J. Theor. Phys. 21, 467 (1982).
 S. Lloyd, Science 273, 1073 (1996).
 A. W. Harrow, A. Hassidim, and S. Lloyd, Phys. Rev. Lett. 103, 150502 (2009).
 S. Lloyd, M. Mohseni, and P. Rebentrost, “Quantum algorithms for supervised and unsupervised machine learning,” (2013), arXiv:1307.0411 .
 IBM QX team, “IBM Quantum Experience,” https://github.com/QISKit/qiskitbackendinformation, ibmqx4 V1.1.0 accessed Dec 2017; ibmqx5 V1.1.0 accessed May 2018.
 Rigetti Computing, devices specification http://docs.rigetti.com/en/latest/qpu.html.
 “Quantum in the Cloud,” University of Bristol, http://www.bristol.ac.uk/physics/research/quantum/engagement/qcloud/.
 P. J. Coles, S. Eidenbenz, S. Pakin, A. Adedoyin, J. Ambrosiano, P. Anisimov, W. Casper, G. Chennupati, C. Coffrin, H. Djidjev, D. Gunter, S. Karra, N. Lemons, S. Lin, A. Lokhov, A. Malyzhenkov, D. Mascarenas, S. Mniszewski, B. Nadiga, D. O’Malley, D. Oyen, L. Prasad, R. Roberts, P. Romero, N. Santhi, N. Sinitsyn, P. Swart, M. Vuffray, J. Wendelberger, B. Yoon, R. Zamora, and W. Zhu, (2018), arXiv:1804.03719 .
 J. Preskill, “Quantum computing and the entanglement frontier,” (2012), arXiv:1203.5813 .
 A. P. Lund, M. J. Bremner, and T. C. Ralph, npj Quantum Information 3, 15 (2017).
 B. M. Terhal, Nat. Phys. 14, 530 (2018).
 M.H. Yung, Natl. Sci. Rev. , nwy072 (2018).
 At first sight, this seems a simple question. One may ask the quantum cloud to run a classical intractable task which is feasible for a quantum computer. This idea is not practical as it is equivalent to separating BQP (boundederror quantum polynomial time) and P (polynomial time), one of the most important open problem in quantum complexity theory. See https://www.scottaaronson.com/blog/?p=284 for more detail. .
 J. Preskill, “Quantum Computing in the NISQ era and beyond,” (2018), arXiv:1801.00862 .
 A. Broadbent, J. Fitzsimons, and E. Kashefi, in 2009 50th Annual IEEE Symposium on Foundations of Computer Science (2009) pp. 517–526.
 A. Broadbent, J. Fitzsimons, and E. Kashefi, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) 6154 LNCS, 43 (2010).
 D. Aharonov, M. BenOr, and E. Eban, (2008a), arXiv:0810.5375 .
 D. Aharonov, M. BenOr, E. Eban, and U. Mahadev, (2008b), arXiv:1704.04487 .
 J. F. Fitzsimons and E. Kashefi, Phys. Rev. A 96, 012303 (2017).
 J. F. Fitzsimons, M. Hajdušek, and T. Morimae, Phys. Rev. Lett. 120, 040501 (2018).
 B. W. Reichardt, F. Unger, and U. Vazirani, Nature 496, 456 (2013).
 H.L. Huang, Q. Zhao, X. Ma, C. Liu, Z.E. Su, X.L. Wang, L. Li, N.L. Liu, B. C. Sanders, C.Y. Lu, and J.W. Pan, Phys. Rev. Lett. 119, 050503 (2017).
 S. Aaronson, A. Cojocaru, A. Gheorghiu, and E. Kashefi, (2017), arXiv:1704.08482 .
 U. Mahadev, (2017), arXiv:1708.02130 .
 U. Mahadev, (2018), arXiv:1804.01082 .
 O. Regev, in Proceedings of the Thirtyseventh Annual ACM Symposium on Theory of Computing, STOC ’05 (ACM, 2005) pp. 84–93.
 D. Shepherd and M. J. Bremner, Proc. R. Soc. A 465, 1413 (2009).
 M. J. Bremner, R. Jozsa, and D. J. Shepherd, Proc. R. Soc. A 467, 459 (2011).
 M. J. Bremner, A. Montanaro, and D. J. Shepherd, Phys. Rev. Lett. 117, 080501 (2016).
 S. Aaronson and A. Arkhipov, Theory Comput. 9, 143 (2013).
 Codes are available on https://gitlab.com/BinCheng/IQP_Experiment.
 M. J. Bremner, A. Montanaro, and D. J. Shepherd, Quantum 1, 8 (2017).
 M.H. Yung and X. Gao, (2017), arXiv:1706.08913 .
 F. J. MacWilliams and N. J. A. Sloane, The theory of errorcorrecting codes (Elsevier, 1977).
 D. Gottesman, (1998), arXiv:quantph/9807006 .
 R. Shankar, S. S. Hegde, and T. Mahesh, Phys. Lett. A 378, 10 (2014).
 X. Peng, X. Zhu, X. Fang, M. Feng, K. Gao, X. Yang, and M. Liu, Chem. Phys. Lett. 340, 509 (2001).
 N. Khaneja, T. Reiss, C. Kehlet, T. SchulteHerbrüggen, and S. J. Glaser, J. Magn. Reson. 172, 296 (2005).