Quantum state and circuit distinguishability with single-qubit measurements

# Quantum state and circuit distinguishability with single-qubit measurements

Tomoyuki Morimae ASRLD Unit, Gunma University, 1-5-1 Tenjin-cho Kiryu-shi Gunma-ken, 376-0052, Japan
###### Abstract

We show that the Quantum State Distinguishability (QSD), which is a QSZK-complete problem, and the Quantum Circuit Distinguishability (QCD), which is a QIP-complete problem, can be solved by the verifier who can perform only single-qubit measurements. To show these results, we use measurement-based quantum computing: the honest prover sends a graph state to the verifier, and the verifier can perform universal quantum computing on it with only single-qubit measurements. If the prover is malicious, he does not necessarily generate the correct graph state, but the verifier can verify the correctness of the graph state by measuring the stabilizer operators.

03.67.-a

## I Introduction

Measurement-based quantum computing MBQC () is a new model of quantum computing where universal quantum computing can be realized with only adaptive single-qubit measurements on a certain entangled state such as the graph state. Several applications of measurement-based quantum computing in quantum computational complexity theory have been obtained recently. For example, Ref. Matt () used measurement-based quantum computing to construct a multiprover interactive proof system for BQP with a classical verifier. Furthermore, Refs. MNS (); QAMsingle () used measurement-based quantum computing to show that the verifier needs only single-qubit measurements in QMA and QAM. The basic idea in these results is the verification of the graph state: prover(s) generate the graph state, and the verifier performs measurement-based quantum computing on it. By checking the stabilizer operators, the verifier can verify the correctness of the graph state. The idea of testing stabilizer operators was also used in Refs. FV (); Ji () to construct multiprover interactive proof systems for local Hamiltonian problems.

In this paper, we consider two promise problems, Quantum State Distinguishability (QSD) WatrousQSZK (), which is QSZK-complete, and Quantum Circuit Distinguishability (QCD) Rosgen (), which is QIP-complete. By using the idea of testing stabilizer operators, we show that these problems can be solved by the verifier who can do only single-qubit measurements. Proofs are similar to those of Refs. MNS (); QAMsingle () for QMA and QAM, but several new considerations are required since in protocols to solve QSD and QCD some parts of graph states are kept by the prover.

### i.1 Qsd

Definition: Quantum State Distinguishability (QSDWatrousQSZK ().

• Input: Quantum circuits and each acting on qubits and having specified output qubits.

• Promise: Let () be the mixed state obtained by tracing out the non-output qubits of . We have either or .

• Output: Accept if , reject if .

Here, is the trace norm. It was shown in Ref. WatrousQSZK () that if , the gap between and can be amplified to and for any polynomial . Therefore, in this paper, without loss of generality, we take and for any polynomial .

The problem is a quantum version of the SZK-complete problem, Statistical Difference SV (). The problem QSD and its complement are QSZK-complete for any constants and satisfying  WatrousQSZK (). In fact, as is shown in Ref. WatrousQSZK (), the prover can prove that two states and are far apart in the following way.

• The verifier uniformly randomly chooses , and sends to the prover.

• The prover performs any measurement to distinguish and , and sends the result to the verifier.

• The verifier accepts if and only if .

Let be the POVM performed by the prover. Then, the probability that the verifier accepts is

 pacc = 12Tr(Π0ρ0)+12Tr(Π1ρ1) = 12Tr(Π0ρ0)+12Tr((I−Π0)ρ1) = 12+12Tr(Π0ρ0)−12Tr(Π0ρ1) = 12+12Tr(Π0(ρ0−ρ1)) ≤ 12+14∥ρ0−ρ1∥1.

Therefore, for the YES case, by taking the optimal POVM,

 pacc = 12+14∥ρ0−ρ1∥1 ≥ 12+12(1−2−r+1) = 1−2−r,

and for the NO case, for any POVM,

 pacc ≤ 12+122−r+1 = 12+2−r.

The first result of the present paper is that QSD can be solved with the verifier who can do only single-qubit measurements. The idea is that the honest prover generates the graph state and sends a part of it to the verifier. The verifier can remotely generates or in the prover’s place by measuring his part. The verifier can also check that his part is the correct graph state by measuring stabilizer operators. A trade-off is that, as is shown in Fig. 1, in the above protocol, one polynomial-size quantum message from the verifier to the prover and one single-bit classical message from the prover to the verifier are enough, whereas in our protocol, one polynomial-size quantum message from the prover to the verifier, one polynomial-size classical message from the verifier to the prover, and a single-bit classical message from the prover to the verifier are necessary.

### i.2 Qcd

Definition: Quantum Circuit Distinguishability (QCDRosgen ().

• Input: mixed-state quantum circuits, and , both of -qubit input -qubit output.

• Yes: .

• No: .

Here,

 ∥Q0−Q1∥⋄≡maxX:∥X∥1=1∥∥(Q0⊗I⊗n)(X)−(Q1⊗I⊗n)(X)∥∥1

is the diamond norm. It was shown in Ref. Rosgen () that QCD is QIP-complete for any . In fact, the prover can proof that and are far apart in the diamond norm as follows. As is shown in Ref. Rosgen (), there is a state such that

 ∥Q0−Q1∥⋄=∥∥(Q0⊗I⊗s)(|ψ⟩⟨ψ|)−(Q1⊗I⊗s)(|ψ⟩⟨ψ|)∥∥1.

For the YES case, the prover sends a part of to the verifier. The verifier uniformly randomly chooses and applies on the part, and returns the state to the prover. The prover now has , and therefore he can learn by doing a measurement on the state with the probability . For the NO case, whatever state the prover sends to the verifier, the acceptance probability is less than .

Our second result is that QCD can be solved by the verifier who can perform only single-qubit measurements. As is shown in Fig. 2, our protocol has an advantage that the second quantum message from the verifier to the prover can be replaced with the classical message, as well as the fact that the verifier needs only single-qubit measurements.

Let us define the class QIP that is equivalent to QIP except that the verifier can perform only single-qubit measurements. Since quantum computing with measurements can be simulated by a unitary quantum computing, it is obvious that . On the other hand, our protocol that solves QCD is obviously in QIP, and therefore our result means . Hence, we have the result that . The result was shown in Ref. MNS (), and the result was shown in Ref. QAMsingle (). It was a remaining open problem whether . The present paper solves it.

## Ii Measurement-based quantum computing

For readers who are not familiar with measurement-based quantum computing MBQC (), we here explain basics of it. Let us consider a graph , where . The graph state on is defined by

 |G⟩≡(∏(i,j)∈ECZi,j)|+⟩⊗N,

where and is the CZ gate on the vertices and .

According to the theory of measurement-based quantum computing MBQC (), for any -width -depth quantum circuit , there exists a graph with and the graph state on it such that if we measure each qubit in , where is a certain subset of with , in certain bases adaptively, then the state of after the measurements is

 Bmx,zU|0m⟩

with uniformly randomly chosen and , where

 Bmx,z≡m⨂j=1XxjjZzjj.

This operator is called a byproduct operator, and its effect is corrected, since and can be calculated from measurement results. Hence we finally obtain the desired state .

The graph state is stabilized by

 gj≡Xj⨂i∈SjZi, (1)

for all , where is the set of nearest-neighbour vertices of th vertex. In other words,

 gj|G⟩=|G⟩

for all .

For , we define the state by

 gj|Gu⟩=(−1)uj|Gu⟩

for all . (Therefore, .) The set is an orthonormal basis of the -qubit Hilbert space. In fact, if , there exists such that . Then,

 ⟨Gu′|Gu⟩ = ⟨Gu′|gjgj|Gu⟩ = (−1)uj+u′j⟨Gu′|Gu⟩ = −⟨Gu′|Gu⟩,

and therefore .

## Iii Stabilizer test

We now explain the stabilizer test. (See also Refs. HM (); MNS (); QAMsingle ().) Consider the graph of Fig. 3. (For simplicity, we here consider the square lattice, but the result can be applied to any reasonable graph.) As is shown in Fig. 3, we define two subsets, and , of , where and . We also define a subset of by

 Vconnect≡{j∈V2|∃i∈V1 s.t. (i,j)∈E}.

In other words, is the set of vertices in that are connected to vertices in . We further define two subsets of :

 E1 ≡ {(i,j)∈E|i∈V1 and j∈V1}, Econnect ≡ {(i,j)∈E|i∈V1 and j∈V2}.

Finally, we define two subgraphs of :

 G′ ≡ (V1∪Vconnect,E1∪Econnect), G′′ ≡ (V1,E1).

The stabilizer test is the following test:

• Randomly generate an -bit string .

• Measure the operator

 sk≡∏j∈V1(g′j)kj,

where is the stabilizer operator, Eq. (1), of the graph state .

• If the result is , the test passes (fails).

Let be a pure state on . If the probability that passes the stabilizer test satisfies , then

 12∥∥|Ψ⟩⟨Ψ|−|Ψ′⟩⟨Ψ′|∥∥1≤√4ϵ−4ϵ2, (2)

where

 |Ψ′⟩≡W(|G′′⟩⊗|ξ⟩V2).

Here, is a certain state on and

 W≡∏(i,j)∈EconnectCZi,j.

The proof is given as follows. The probability that the state on passes the stabilizer test is

 ptest=12N1∑k∈{0,1}N1⟨Ψ|I+sk2|Ψ⟩.

If we use the relation

 ∏j∈V1I+g′j2=12N1∑k∈{0,1}N1sk,

the condition means

 ⟨Ψ|∏j∈V1I+g′j2|Ψ⟩≥1−2ϵ. (3)

Let be an orthonormal basis of -qubit Hilbert space, where . Then, is an orthonormal basis of the -qubit Hilbert space, and therefore, can be written as

 |Ψ⟩=∑u,tCu,tW|G′′u⟩⊗|ϕt⟩,

for certain coefficients . Let us define

where

 R≡∑t|C0N1,t|2≤1

is the normalization constant.

Let be the set of stabilizer operators of the graph state . Then, it is easy to check

 g′jW=Wg′′j

for all . Therefore,

 (∏j∈V1I+g′j2)|Ψ⟩ = W∏j∈V1I+g′′j2(∑u,tCu,t|G′′u⟩⊗|ϕt⟩) = W(∑tC0N1,t|G′′⟩⊗|ϕt⟩) = √R|Ψ′⟩.

Hence Eq. (3) means

 1−2ϵ ≤ √R⟨Ψ|Ψ′⟩ ≤ ⟨Ψ|Ψ′⟩.

Therefore,

 12∥∥|Ψ⟩⟨Ψ|−|Ψ′⟩⟨Ψ′|∥∥1 = √1−|⟨Ψ|Ψ′⟩|2 ≤ √1−(1−2ϵ)2 = √4ϵ−4ϵ2.

## Iv Qsd

In this section, we explain our protocol for QSD. Let us consider the graph of Fig. 4. Our protocol runs as follows:

• The prover generates a state on , and sends all black qubits to the verifier. If the prover is honest, . If the prover is malicious, can be any state.

• With probability , which is specified later, the verifier does the following.

• The verifier uniformly randomly chooses .

• The verifier performs the measurement-based quantum computing on the received qubits so that the state of qubits in the blue dotted box becomes , and the reduced state of the qubits in the red dotted box becomes .

• The verifier sends the prover and .

• The verifier measures qubits in the red dotted box and the black star qubits in the basis (in order to teleport the state to the white qubits that are connected to the star qubits), and sends the -basis measurement results to the prover.

• The verifier accepts if and only if .

We denote the acceptance probability by .

• With probability , the verifier does the stabilizer test by considering as the set of black circle qubits. The verifier accepts if and only if the stabilizer test passes. We denote the acceptance probability by .

First, let us consider the YES case, i.e., . In this case, the prover is honest, and therefore , which means if the verifier chooses the stabilizer test. If the verifier chooses the computation, after the all verifier’s measurements, the state of the white qubits that are connected to the star qubits becomes , where and can be calculated from the all classical information from the verifier. Therefore, the prover finally has , and the prover can learn by doing an appropriate POVM with an error probability less than . Hence the acceptance probability of the protocol is

 pacc = qpcomp+(1−q)ptest ≥ q(1−2−r)+(1−q)≡α.

Second, let us consider the NO case, namely, . If , where is a certain parameter that will be specified later, there is no guarantee that the prover generated the correct graph state. Therefore, in the worst case:

 pacc = qpcomp+(1−q)ptest ≤ q+(1−q)(1−ϵ)≡β1.

If , on the other hand, is close to

 |Ψ′⟩≡W(|G′′⟩⊗|ξ⟩)

in the sense of Eq. (2), where is a state on the star and white qubits, and is the unitary operator that applies gates on all edges that connect the qubits in the dotted red box and star qubits. For simplicity, let us assume that for the moment. Then, after the step 2-c of the protocol, the state of qubits in the red dotted box, star qubits, white qubits, and prover’s classical memory is

 W(Bkx,zρaBkx,z⊗|ξ⟩⟨ξ|)W†⊗|x,z⟩⟨x,z|.

However, since

 12∥∥W(Bkx,zρ0Bkx,z⊗|ξ⟩⟨ξ|)W†⊗|x,z⟩⟨x,z|−W(Bkx,zρ1Bkx,z⊗|ξ⟩⟨ξ|)W†⊗|x,z⟩⟨x,z|∥∥1 = 12∥ρ0−ρ1∥1 ≤ 2−r+1,

no POVM can distinguish and with a probability larger than . Therefore, for any that satisfies , the acceptance probability is

 pacc = qpcomp+(1−q)ptest ≤ q(12+2−r+√4ϵ−4ϵ2)+(1−q)≡β2.

If we define

 Δ1(q) ≡ α−β1=−q2−r+ϵ(1−q), Δ2(q) ≡ α−β2=q2−q2−r+1−q√4ϵ−4ϵ2,

then the optimal value of , which satisfies , is

 q∗≡ϵϵ+12−2−r−√4ϵ−4ϵ2

and the gap for this is

 Δ2(q∗) = ϵ(12−2−r+1−√4ϵ−4ϵ2)ϵ+12−2−r−√4ϵ−4ϵ2 ≥ ϵ(12−14−√4ϵ)ϵ+12 = 12−14−151+50 = 11020

if and .

## V Qcd

In this section, we explain our protocol for QCD. Let us consider the graph of Fig. 5. Our protocol runs as follows:

• The prover generates a state on and sends all black qubits to the verifier. If the prover is honest,

 |Ψ⟩=W1(|G1⟩⊗|ψ⟩),

where is the subgraph of that is obtained by removing all square vertices and all edges that connect the black square vertices and black circle vertices, is the state of the square qubits (black square qubits are those on which should be acted), and is the unitary operator applying gates on all edges that connect the black square qubits and black circle qubits. If the prover is malicious, can be any state.

• With probability , which is specified later, the verifier does the following.

• The verifier uniformly randomly chooses .

• The verifier does the measurement-based quantum computation so that the black circle qubits in the dotted red box and white square qubits becomes

 (Bmx,z⊗I)[(Qi⊗I)(|ψ⟩⟨ψ|)](Bmx,z⊗I).
• The verifier sends and to the prover.

• The verifier measures the black circle qubits in the red dotted box and black star qubits in the basis, and sends the measurement results to the prover.

• The verifier receives from the prover. The verifier accepts if and only if . We denote the acceptance probability by .

• With probability , the verifier does the stabilizer test by considering as the set of black circle qubits. The verifier accepts if and only if the test passes. We denote the acceptance probability by .

First, let us consider the YES case, i.e., . In this case, the prover is honest, and therefore, and

 pcomp = 12+14∥Q0−Q1∥⋄ ≥ 12+a4.

Therefore,

 pacc = qpcomp+(1−q)ptest ≥ q(12+a4)+(1−q)≡α.

Next let us consider the NO case, i.e., . If ,

 pacc = qpcomp+(1−q)ptest ≤ q+(1−q)(1−ϵ)≡β1.

If , on the other hand, is close to

 |Ψ′⟩=W(|G′′⟩⊗|ξ⟩)

in the sense of Eq. (2). Here, is the graph whose vertices are black circle qubits and whose edges are those connecting black circle qubits. The operator is the unitary operator applying gates on all edges that connect black circle qubits and the black star or black square qubits. The state is the state of the black star qubits, black square qubits, and white qubits. For the moment, let us assume that . After the step 2-c, the state of white qubits, star qubits, black circle qubits in the red dotted box, and prover’s classical memory is

 [W2(Bmx,z⊗I)(Qi⊗I)(|ξ⟩⟨ξ|)(Bmx,z⊗I)W†2]⊗|x,z⟩⟨x,z|,

where is the unitary operator applying gates on all edges that connects black circle qubits in the red dotted box and star qubits. However,

 ∥∥[W2(Bmx,z⊗I)(Q0⊗I)(|ξ⟩⟨ξ|)(Bmx,z⊗I)W†2]⊗|x,z⟩⟨x,z| = ∥∥(Q0⊗I)(|ξ⟩⟨ξ|)−(Q1⊗I)(|ξ⟩⟨ξ|)∥∥1 ≤ ∥Q0−Q1∥⋄,

and therefore, . Hence for any such that , the acceptance probability is

 pacc = qpcomp+(1−q)ptest ≤ q(12+b4+√4ϵ−4ϵ2)+(1−q)≡β2.

If we define

 Δ1(q) ≡ α−β1=−q2+qa4+ϵ(1−q), Δ2(q) ≡ α−β2=q(a−b)4−q√4ϵ−4ϵ2,

the optimal value of is

 q∗≡ϵ12+ϵ−√4ϵ−4ϵ2−b4,

and the gap is

 Δ2(q∗) = ϵ(a−b4−√4ϵ−4ϵ2)12+ϵ−√4ϵ−4ϵ2−b4 ≥ ϵ(a−b4−2√ϵ)12+ϵ = 11020

if we take , , and . Note that the error can be reduced by running the protocol in parallel, and using the Markov inequality argument JUW ().

###### Acknowledgements.
The author acknowledges Harumichi Nishimura, Hirotada Kobayashi, and Adam Bouland for discussion, and Grant-in-Aid for Scientific Research on Innovative Areas No.15H00850 of MEXT Japan, and the Grant-in-Aid for Young Scientists (B) No.26730003 of JSPS for the support.

## References

• (1) R. Raussendorf and H. J. Briegel, A one-way quantum computer. Phys. Rev. Lett. 86, 5188 (2001).
• (2) M. McKague, Interactive proofs for BQP via self-tested graph states. arXiv:1309.5675
• (3) T. Morimae, D. Nagaj, and N. Schuch, Quantum proofs can be verified using only single qubit measurements. Phys. Rev. A 93, 022326 (2016).
• (4) T. Morimae, Quantum Arthur-Merlin with single-qubit measurements. Phys. Rev. A 93, 062333 (2016).
• (5) J. F. Fitzsimons and T. Vidick, A multiprover interactive proof system for the local Hamiltonian problem. arXiv:1409.0260
• (6) Z. Ji, Classical verification of quantum proofs. arXiv:1505.07432
• (7) J. Watrous, Limits on the power of quantum statistical zero-knowledge. Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science, pp.459-468 (2002).
• (8) B. Rosgen and J. Watrous, On the hardness of distinguishing mixed-state quantum computations. Proceedings of the 20th Annual IEEE Conference on Computational Complexity, pp.344-354 (2005).
• (9) A. Sahai and S. Vadhan, A complete promise problem for statistical zero-knowledge. In Proceedings of the 38th Annual IEEE Symposium on the Foundations of Computer Science, pp.448-457 (1997).
• (10) M. Hayashi and T. Morimae, Verifiable measurement-only blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
• (11) R. Jain, S. Upadhyay, and J. Watrous, Two-message quantum interactive proofs are in PSPACE. arXiv:0905.1300
You are adding the first comment!
How to quickly get a good reply:
• Give credit where it’s due by listing out the positive aspects of a paper before getting into which changes should be made.
• Be specific in your critique, and provide supporting evidence with appropriate references to substantiate general statements.
• Your comment should inspire ideas to flow and help the author improves the paper.

The better we are at sharing our knowledge with each other, the faster we move forward.
The feedback must be of minimum 40 characters and the title a minimum of 5 characters