Quantum state and circuit distinguishability with singlequbit measurements
Abstract
We show that the Quantum State Distinguishability (QSD), which is a QSZKcomplete problem, and the Quantum Circuit Distinguishability (QCD), which is a QIPcomplete problem, can be solved by the verifier who can perform only singlequbit measurements. To show these results, we use measurementbased quantum computing: the honest prover sends a graph state to the verifier, and the verifier can perform universal quantum computing on it with only singlequbit measurements. If the prover is malicious, he does not necessarily generate the correct graph state, but the verifier can verify the correctness of the graph state by measuring the stabilizer operators.
pacs:
03.67.aI Introduction
Measurementbased quantum computing MBQC () is a new model of quantum computing where universal quantum computing can be realized with only adaptive singlequbit measurements on a certain entangled state such as the graph state. Several applications of measurementbased quantum computing in quantum computational complexity theory have been obtained recently. For example, Ref. Matt () used measurementbased quantum computing to construct a multiprover interactive proof system for BQP with a classical verifier. Furthermore, Refs. MNS (); QAMsingle () used measurementbased quantum computing to show that the verifier needs only singlequbit measurements in QMA and QAM. The basic idea in these results is the verification of the graph state: prover(s) generate the graph state, and the verifier performs measurementbased quantum computing on it. By checking the stabilizer operators, the verifier can verify the correctness of the graph state. The idea of testing stabilizer operators was also used in Refs. FV (); Ji () to construct multiprover interactive proof systems for local Hamiltonian problems.
In this paper, we consider two promise problems, Quantum State Distinguishability (QSD) WatrousQSZK (), which is QSZKcomplete, and Quantum Circuit Distinguishability (QCD) Rosgen (), which is QIPcomplete. By using the idea of testing stabilizer operators, we show that these problems can be solved by the verifier who can do only singlequbit measurements. Proofs are similar to those of Refs. MNS (); QAMsingle () for QMA and QAM, but several new considerations are required since in protocols to solve QSD and QCD some parts of graph states are kept by the prover.
i.1 Qsd
Definition: Quantum State Distinguishability (QSD) WatrousQSZK ().

Input: Quantum circuits and each acting on qubits and having specified output qubits.

Promise: Let () be the mixed state obtained by tracing out the nonoutput qubits of . We have either or .

Output: Accept if , reject if .
Here, is the trace norm. It was shown in Ref. WatrousQSZK () that if , the gap between and can be amplified to and for any polynomial . Therefore, in this paper, without loss of generality, we take and for any polynomial .
The problem is a quantum version of the SZKcomplete problem, Statistical Difference SV (). The problem QSD and its complement are QSZKcomplete for any constants and satisfying WatrousQSZK (). In fact, as is shown in Ref. WatrousQSZK (), the prover can prove that two states and are far apart in the following way.

The verifier uniformly randomly chooses , and sends to the prover.

The prover performs any measurement to distinguish and , and sends the result to the verifier.

The verifier accepts if and only if .
Let be the POVM performed by the prover. Then, the probability that the verifier accepts is
Therefore, for the YES case, by taking the optimal POVM,
and for the NO case, for any POVM,
The first result of the present paper is that QSD can be solved with the verifier who can do only singlequbit measurements. The idea is that the honest prover generates the graph state and sends a part of it to the verifier. The verifier can remotely generates or in the prover’s place by measuring his part. The verifier can also check that his part is the correct graph state by measuring stabilizer operators. A tradeoff is that, as is shown in Fig. 1, in the above protocol, one polynomialsize quantum message from the verifier to the prover and one singlebit classical message from the prover to the verifier are enough, whereas in our protocol, one polynomialsize quantum message from the prover to the verifier, one polynomialsize classical message from the verifier to the prover, and a singlebit classical message from the prover to the verifier are necessary.
i.2 Qcd
Definition: Quantum Circuit Distinguishability (QCD) Rosgen ().

Input: mixedstate quantum circuits, and , both of qubit input qubit output.

Yes: .

No: .
Here,
is the diamond norm. It was shown in Ref. Rosgen () that QCD is QIPcomplete for any . In fact, the prover can proof that and are far apart in the diamond norm as follows. As is shown in Ref. Rosgen (), there is a state such that
For the YES case, the prover sends a part of to the verifier. The verifier uniformly randomly chooses and applies on the part, and returns the state to the prover. The prover now has , and therefore he can learn by doing a measurement on the state with the probability . For the NO case, whatever state the prover sends to the verifier, the acceptance probability is less than .
Our second result is that QCD can be solved by the verifier who can perform only singlequbit measurements. As is shown in Fig. 2, our protocol has an advantage that the second quantum message from the verifier to the prover can be replaced with the classical message, as well as the fact that the verifier needs only singlequbit measurements.
Let us define the class QIP that is equivalent to QIP except that the verifier can perform only singlequbit measurements. Since quantum computing with measurements can be simulated by a unitary quantum computing, it is obvious that . On the other hand, our protocol that solves QCD is obviously in QIP, and therefore our result means . Hence, we have the result that . The result was shown in Ref. MNS (), and the result was shown in Ref. QAMsingle (). It was a remaining open problem whether . The present paper solves it.
Ii Measurementbased quantum computing
For readers who are not familiar with measurementbased quantum computing MBQC (), we here explain basics of it. Let us consider a graph , where . The graph state on is defined by
where and is the CZ gate on the vertices and .
According to the theory of measurementbased quantum computing MBQC (), for any width depth quantum circuit , there exists a graph with and the graph state on it such that if we measure each qubit in , where is a certain subset of with , in certain bases adaptively, then the state of after the measurements is
with uniformly randomly chosen and , where
This operator is called a byproduct operator, and its effect is corrected, since and can be calculated from measurement results. Hence we finally obtain the desired state .
The graph state is stabilized by
(1) 
for all , where is the set of nearestneighbour vertices of th vertex. In other words,
for all .
For , we define the state by
for all . (Therefore, .) The set is an orthonormal basis of the qubit Hilbert space. In fact, if , there exists such that . Then,
and therefore .
Iii Stabilizer test
We now explain the stabilizer test. (See also Refs. HM (); MNS (); QAMsingle ().) Consider the graph of Fig. 3. (For simplicity, we here consider the square lattice, but the result can be applied to any reasonable graph.) As is shown in Fig. 3, we define two subsets, and , of , where and . We also define a subset of by
In other words, is the set of vertices in that are connected to vertices in . We further define two subsets of :
Finally, we define two subgraphs of :
The stabilizer test is the following test:

Randomly generate an bit string .

If the result is , the test passes (fails).
Let be a pure state on . If the probability that passes the stabilizer test satisfies , then
(2) 
where
Here, is a certain state on and
The proof is given as follows. The probability that the state on passes the stabilizer test is
If we use the relation
the condition means
(3) 
Let be an orthonormal basis of qubit Hilbert space, where . Then, is an orthonormal basis of the qubit Hilbert space, and therefore, can be written as
for certain coefficients . Let us define
where
is the normalization constant.
Let be the set of stabilizer operators of the graph state . Then, it is easy to check
for all . Therefore,
Hence Eq. (3) means
Therefore,
Iv Qsd
In this section, we explain our protocol for QSD. Let us consider the graph of Fig. 4. Our protocol runs as follows:

The prover generates a state on , and sends all black qubits to the verifier. If the prover is honest, . If the prover is malicious, can be any state.

With probability , which is specified later, the verifier does the following.

The verifier uniformly randomly chooses .

The verifier performs the measurementbased quantum computing on the received qubits so that the state of qubits in the blue dotted box becomes , and the reduced state of the qubits in the red dotted box becomes .

The verifier sends the prover and .

The verifier measures qubits in the red dotted box and the black star qubits in the basis (in order to teleport the state to the white qubits that are connected to the star qubits), and sends the basis measurement results to the prover.

The verifier receives the answer bit from the prover.

The verifier accepts if and only if .
We denote the acceptance probability by .


With probability , the verifier does the stabilizer test by considering as the set of black circle qubits. The verifier accepts if and only if the stabilizer test passes. We denote the acceptance probability by .
First, let us consider the YES case, i.e., . In this case, the prover is honest, and therefore , which means if the verifier chooses the stabilizer test. If the verifier chooses the computation, after the all verifier’s measurements, the state of the white qubits that are connected to the star qubits becomes , where and can be calculated from the all classical information from the verifier. Therefore, the prover finally has , and the prover can learn by doing an appropriate POVM with an error probability less than . Hence the acceptance probability of the protocol is
Second, let us consider the NO case, namely, . If , where is a certain parameter that will be specified later, there is no guarantee that the prover generated the correct graph state. Therefore, in the worst case:
If , on the other hand, is close to
in the sense of Eq. (2), where is a state on the star and white qubits, and is the unitary operator that applies gates on all edges that connect the qubits in the dotted red box and star qubits. For simplicity, let us assume that for the moment. Then, after the step 2c of the protocol, the state of qubits in the red dotted box, star qubits, white qubits, and prover’s classical memory is
However, since
no POVM can distinguish and with a probability larger than . Therefore, for any that satisfies , the acceptance probability is
If we define
then the optimal value of , which satisfies , is
and the gap for this is
if and .
V Qcd
In this section, we explain our protocol for QCD. Let us consider the graph of Fig. 5. Our protocol runs as follows:

The prover generates a state on and sends all black qubits to the verifier. If the prover is honest,
where is the subgraph of that is obtained by removing all square vertices and all edges that connect the black square vertices and black circle vertices, is the state of the square qubits (black square qubits are those on which should be acted), and is the unitary operator applying gates on all edges that connect the black square qubits and black circle qubits. If the prover is malicious, can be any state.

With probability , which is specified later, the verifier does the following.

The verifier uniformly randomly chooses .

The verifier does the measurementbased quantum computation so that the black circle qubits in the dotted red box and white square qubits becomes

The verifier sends and to the prover.

The verifier measures the black circle qubits in the red dotted box and black star qubits in the basis, and sends the measurement results to the prover.

The verifier receives from the prover. The verifier accepts if and only if . We denote the acceptance probability by .


With probability , the verifier does the stabilizer test by considering as the set of black circle qubits. The verifier accepts if and only if the test passes. We denote the acceptance probability by .
First, let us consider the YES case, i.e., . In this case, the prover is honest, and therefore, and
Therefore,
Next let us consider the NO case, i.e., . If ,
If , on the other hand, is close to
in the sense of Eq. (2). Here, is the graph whose vertices are black circle qubits and whose edges are those connecting black circle qubits. The operator is the unitary operator applying gates on all edges that connect black circle qubits and the black star or black square qubits. The state is the state of the black star qubits, black square qubits, and white qubits. For the moment, let us assume that . After the step 2c, the state of white qubits, star qubits, black circle qubits in the red dotted box, and prover’s classical memory is
where is the unitary operator applying gates on all edges that connects black circle qubits in the red dotted box and star qubits. However,
and therefore, . Hence for any such that , the acceptance probability is
If we define
the optimal value of is
and the gap is
if we take , , and . Note that the error can be reduced by running the protocol in parallel, and using the Markov inequality argument JUW ().
Acknowledgements.
The author acknowledges Harumichi Nishimura, Hirotada Kobayashi, and Adam Bouland for discussion, and GrantinAid for Scientific Research on Innovative Areas No.15H00850 of MEXT Japan, and the GrantinAid for Young Scientists (B) No.26730003 of JSPS for the support.References
 (1) R. Raussendorf and H. J. Briegel, A oneway quantum computer. Phys. Rev. Lett. 86, 5188 (2001).
 (2) M. McKague, Interactive proofs for BQP via selftested graph states. arXiv:1309.5675
 (3) T. Morimae, D. Nagaj, and N. Schuch, Quantum proofs can be verified using only single qubit measurements. Phys. Rev. A 93, 022326 (2016).
 (4) T. Morimae, Quantum ArthurMerlin with singlequbit measurements. Phys. Rev. A 93, 062333 (2016).
 (5) J. F. Fitzsimons and T. Vidick, A multiprover interactive proof system for the local Hamiltonian problem. arXiv:1409.0260
 (6) Z. Ji, Classical verification of quantum proofs. arXiv:1505.07432
 (7) J. Watrous, Limits on the power of quantum statistical zeroknowledge. Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science, pp.459468 (2002).
 (8) B. Rosgen and J. Watrous, On the hardness of distinguishing mixedstate quantum computations. Proceedings of the 20th Annual IEEE Conference on Computational Complexity, pp.344354 (2005).
 (9) A. Sahai and S. Vadhan, A complete promise problem for statistical zeroknowledge. In Proceedings of the 38th Annual IEEE Symposium on the Foundations of Computer Science, pp.448457 (1997).
 (10) M. Hayashi and T. Morimae, Verifiable measurementonly blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
 (11) R. Jain, S. Upadhyay, and J. Watrous, Twomessage quantum interactive proofs are in PSPACE. arXiv:0905.1300