Self-guaranteed measurement-based quantum computation Masahito Hayashi1, 2, ∗ and Michal Hajduˇsek2, †
arXiv:1603.02195v1 [quant-ph] 1 Mar 2016
2
1 Graduate School of Mathematics, Nagoya University, Furocho, Chikusa-ku, Nagoya 464-860, Japan Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543
We introduce a new verification protocol for measurement-only blind quantum computation where the client can only perform single-qubit measurements and the server has sufficient ability to prepare a multi-qubit entangled state. Previous such protocols were limited by strong assumptions about the client’s quantum devices. We remove these assumptions by performing self-testing procedure to certify the initial entangled state prepared by the server as well as the operation of the client’s quantum devices. In the case of an honest server and client’s devices, the protocol produces the correct outcome of the quantum computation. Given a cheating server or malicious quantum devices, our protocol bounds the probability of the client accepting an incorrect outcome while introducing only modest overhead in terms of the number of copies of the initial state needed that scales as O(n4 log n), where n is the size of the initial universal resource.
I.
INTRODUCTION
Quantum computation offers a novel way of processing information and promises solution of some classically intractable problems ranging from factorization of large numbers [1] to simulation of quantum systems [2]. However, as quantum information processing technologies improve and basic operations in physical systems such as ion traps and superconducting qubits exceed fidelities required for fault-tolerant quantum computation [3, 4], a natural question of verifying the output of quantum computation arises. For problems such as factorization, this does not present an issue as verification takes the form of simple multiplication of numbers. On the other hand, verification of simulation of quantum systems may be as hard as the original problem itself [5]. Guaranteeing the output of a quantum computation may seem like a daunting task, particularly when considered in the context of quantum circuit model [6]. In this model, the computation takes form of a sequence of local and multi-local unitary operations applied to the quantum state resulting in a quantum output that is finally measured out to yield the classical result of the computation. In order to verify the correctness of the output it would appear that one needs to keep track of the entire dynamics, effectively classically simulating the quantum computation. This can of course be achieved only for the smallest of quantum systems due to the exponential increase in the dimensionality of the Hilbert space with increasing system size. Measurement-based model of quantum computation (MBQC) is equivalent to the quantum circuit model but uses non-unitary evolution to drive the computation [7]. In this model, the computation begins with preparation of a universal multi-qubit resource state and proceeds by local projective measurements on this state that use up the initial entanglement. In order to implement the
∗ †
[email protected] [email protected]
desired evolution corresponding to the unitary from the circuit model, the measurements must be performed in an adaptive way where future measurement bases depend on previous measurement outcomes. This imposes a temporal ordering on the measurements. One of the main differences between MBQC and the quantum circuit model is the clear split between preparation of the initial entangled resource state and the computation itself. This property suggests a natural approach to guaranteeing the outcome of the computation by splitting the verification process into two parts. Firstly, we have to verify the initial entangled multi-qubit resource state. Secondly, we must guarantee the correct operations of the measurement devices that drive the computation. The initial proposal of MBQC in [7] considered measurements in the X-Y plane of a qubit’s Bloch sphere at an arbitrary angle. This is not necessary as measurements at finite set of angles are sufficient to achieve approximate universality. We consider a particular approximately universal set of measurements given by Pauli observables X, Y and Z as well as √ measurements of the Hadamard observable (X + Y )/ 2 [8]. Recent years have seen a number of protocols that address the question of verification of quantum computation using MBQC [9–15] and some of these protocols were also demonstrated experimentally in 4-qubit systems using photons [16–18]. Verification protocols that do not utilize MBQC were considered in [19, 20] as well as new non-interactive approaches introduced in [21, 22]. Many of the above protocols rely crucially on the use of self-testing techniques to guarantee prepared states as well as to certify the operation of quantum devices. Selftesting, originally proposed in [23, 24], is a statistical test that compares measured correlations with the ideal ones and based on the closeness of these two cases draws conclusions whether the real devices behave as instructed under a particular definition of equivalence. Self-testing does not make any strong assumptions about the Hilbert space structure of the devices or the measurement operators corresponding to classical outcomes observed. The only assumption that is made is the usual requirement that the quantum devices are non-communicating.
2 Blind quantum computation introduced in [9, 10] is a protocol for quantum computation where the client (Alice) has limited quantum resources and wishes to delegate her computation to a server (Bob) who possesses a universal quantum computer. Particularly she wishes to do this in such a way that her computation along with its input and output remain hidden from Bob. Originally, [9, 10] considered the scenario where Alice had access to a source of single-qubits that she sent to Bob who entangled these qubits to create the initial resource state and then performed single-qubit measurements as instructed by Alice. We address the question of guaranteeing the outcome of a quantum computation by considering a specific approach to verification known as measurement-only blind quantum computation [11–13]. In this protocol, Bob prepares the universal initial resource state and sends it to Alice who is limited to single-qubit measurements. Inspired by techniques developed in [25, 26] we introduce a self-testing protocol that certifies two-colorable graph states acting as universal resources for MBQC and Alice’s measurement devices. Crucial component of our approach is the combination of stabilizer measurements on the resource prepared by Bob combined with measurements of CHSH-like correlations [27] that lead to selftesting. In [12], the authors showed how to guarantee the graph state using local measurements with trusted devices. Building on this result, we show how to guarantee local measurements on an untrusted two-colorable graph state of a large size. Before presenting the selftesting protocol for a general two-colorable state of arbitrary size, we consider the task of certifying untrusted quantum devices with the help of a two-qubit maximally entangled state. Note that we cannot guarantee the local measurements without the use of correlations present in entangled states.
II. SELF-TESTING OF MEASUREMENTS BASED ON TWO-QUBIT ENTANGLED STATE
As the first step, we consider a self-testing protocol of local measurements on the qubit system H1 when the untrusted state √12 (|0, +i+|1, −i) is prepared in the twoqubit system H1′ and H2′ . In the rest of our paper we denote untrusted states and operators with primes, such as |ψ ′ i and X ′ , in order to distinguish them from trusted states and devices which have no primes. Our protocol satisfies the following requirements related to our selftesting protocol for two-colorable graph state. (1-1): We need to identify measurements of X1 , Y1 , Z1 √ and (X1 + Y1 )/ 2 within a constant error ǫ. (1-2): We measure X1′ , Y1′ , Z1′ , A(i)′1 , B(i)′1 , and C(i)′1 for i = 0, 1 in the system H1′ , where A(i)′1 := X1′ +(−1)i Z1′ X ′ +(−1)i Y ′ √ , B(i)′1 := 1 √2 1 , and C(i)′1 := 2
FIG. 1. Representation of the self-testing procedure for the state √12 (|0, +i + |1, −i). The source prepares 17m copies of this state which are then randomly divided into 17 groups. Each group is then measured as described in (2-3) and (24). There are 9 measurement settings for system H′1 and 3 measurement settings for system H′2 . Each group is measured by one device acting on system H′1 and one device acting on system H′2 . Y1′ +(−1)i Z1′ √ . 2
(1-3): We measure only X2′ , Y2′ , and Z2′ in the system H2′ . (1-4): We prepare only O(δ −4 ) samples for the required precision level δ, whose definition will be given latter. Requirement (1-1) is needed for universal computation based on measurement-based quantum computation [8]. Two-colorable graph states can be partitioned into two subsets of non-adjacent qubits. In the rest of our paper, we refer to one of these subsets as black qubits while the other subset is referred to as white qubits. To realize the self-guaranteed MBQC of n-qubit two-colorable graph state with resource size O(n4 log n), we need the requirement (1-4). Indeed, McKague et al [25] already gave a self-testing protocol for the Bell state. However, their protocol requires much more resources than that in (1-4). The self-testing procedure is illustrated in FIG. 1 and is as follows, (2-1): We prepare 17m states |Φ′ i :=
√1 (|0, +i+|1, −i). 2
(2-2): We randomly divide 17m blocks into 17 groups, in which, the 1st - 17th groups are composed of m blocks. (2-3): We measure X1′ , Z1′ , Y1′ , A(0)′1 , A(0)′1 , A(1)′1 , A(1)′1 , B(0)′1 , B(0)′1 , B(1)′1 , B(1)′1 , C(0)′1 , C(0)′1 , C(1)′1 , C(1)′1 , X1′ , Y1′ in the system H1′ for the 1st - 17th groups. (2-4): We measure Z2′ , X2′ , Y2′ , X2′ , Z2′ , X2′ , Z2′ , Z2′ , Y2′ , Z2′ , Y2′ , Y2′ , X2′ , Y2′ , X2′ , Y2′ , Z2′ in the system H2′ for the 1st - 17th groups. (2-5): Based on the above measurements, we check the
3 following 8 inequalities for 8 average values: Av[X1′ Z2′ ] = 1,
Av[Z1′ X2′ ] = 1,
Av[Y1′ Y2′ ] = 1 √ c1 Av[A(0)′1 (X2′ + Z2′ ) + A(1)′1 (−X2′ + Z2′ )] ≥ 2 2 − √ m √ c1 ′ ′ ′ Av[B(0)1 (Z2 + Y2 )] ≥ 2 − √ 2 m √ c1 ′ ′ ′ Av[B(1)1 (Z2 − Y2 )] ≥ 2 − √ 2 m √ c1 Av[C(0)′1 (Y2′ + X2′ ) + C(1)′1 (Y2′ − X2′ )] ≥ 2 2 − √ m c1 ′ ′ ′ ′ Av[X1 Y2 + Y1 Z2 ] ≤ √ . 2 m Here, for example, the average value Av[A(0)′1 (X2′ + Z2′ ) + A(1)′1 (−X2′ + Z2′ )] is calculated from the outcomes of the 1st - 4th groups. This leads to the following theorem, which will be shown in Appendix A. Theorem 1. Given a significance level α and a detection probability β, there exists a pair of positive real numbers c1 and c2 satisfying the following condition. If we perfectly prepare the state √12 (|0, +i + |1, −i) and our measurement has no error, the test is passed with probability β. If the test is passed with the above c1 , there exists a isometry U : H′ 1 → H1 such that, with significance level α, we can guarantee that kU X1′ U † − X1 k ≤ δ
kU Y1′ U † − Y1 k kU Z1′ U † − Z1 k kU B(0)′1 U † − B(0)1 k where δ := level.
c2
1
m4
≤δ
≤δ
≤ δ,
(1) (2) (3) (4)
, which is called the required precision
Note that the significance level is the maximum passing probability when one of the conditions in (2-5) does not hold [28]. This shows how the measurements forming a approximately universal set for MBQC can be certified using a two-qubit state. Now we proceed to extend this scheme to two-colorable states of arbitrary size.
III.
SELF-TESTING OF A TWO-COLORABLE GRAPH STATE
For a two-colorable graph state |G′ i composed of n qubits, our protocol needs to prepare cm samples of the state |G′ i, where m is O(n4 log n). The constant c depends on the structure of the graph G. To specify it, we introduce two numbers lB and lW for a two-colorable graph G. Consider the set SB := {1, . . . , nB } of black sites and the set SW := {1, . . . , nW } of white sites. We
FIG. 2. Bipartition into black and white vertices with the black vertices partitioned into four subsets {SB,k }4k=1 . This partitioning can be constructed as follows. Start by considering the central black circle and black vertices represented by triangles and squares. Both triangles have two common neighbors with the central black circle and one common neighbor with each square. However the two triangles share no common neighbors with each other. Therefore the two vertices are in the same subset SB,k but the squares must be in a different subset. We continue to consider vertices represented by the pentagons and see that each shares a neighbor with one triangle, one square and the central circle. The only possible vertices left to consider are the circles in the four corners of the graph. They do not share any common neighbors with the central black circle or with each other and are in the same subset SB,k . This logic can be extended to two-dimensional lattice graphs of arbitrary size and gives lB ≤ 4.
denote the neighborhood of the site i by Ni . We divide the sites SB into lB subsets SB,1 , . . . , SB,lB such that N (SB,k ) ∩ N (SB,j ) = ∅ for k 6= j with N (SB,k ) := ∪i∈SB,k Ni . That is, elements of SB,k have no common neighbors, which is called the non-conflict condition. We choose the number lB as the minimum number satisfying the non-conflict condition. We also define the number lW for the white sites in the same way. For example, in the one-dimensional cluster state, lB ≤ 2. In the twodimensional cluster state, lB ≤ 4, also see FIG. 2. In the three-dimensional cluster state, lB ≤ 8. Based on this structure, testing of measurement devices on each site on SB,k can be reduced to the two-qubit case as follows. (3-1): We prepare 17m states |G′ i. (3-2): We measure Z ′ on all sites of SB \ SB,k for all copies. Then, we apply Z ′ operators on the remaining sites to correct applied Z ′ operators dependently of the outcomes. (3-3): For all i ∈ SB,k , we choose a site ji ∈ Ni . Then, we measure Z ′ on all sites of SW \ {ji }i∈SB,k for all copies. Then, we apply Z ′ operators on the remaining sites to correct applied Z ′ operators dependently of the outcomes. (3-4): Due to the above steps, the resultant state should be ⊗i∈SB,k |Φ′ iiji . Then, we apply the above selftesting procedure to all of {|Φ′ iiji }i∈SB,k . Since the above protocol verifies the measurement device on Block color sites in SB,k , we call it B-protocol with SB,k . We define W-protocol with SW,k .
4 Then, choosing c3 to be 2 + 16(lB + lW ), we propose our self-testing protocol as follows, (4-1): We prepare c3 m + 1 states |G′ i. (4-2): We randomly divide c3 m + 1 blocks into c3 + 1 groups. The first c3 groups are composed of m blocks and the final group is composed of a single block. Each block contains n qubits. (4-3): We measure Z ′ on the black sites and X ′ on the white sites for the 1st group and check that the outcome of X ′ measurements is the same as predicted from the outcomes of Z ′ measurements. (4-4): We repeat the above stabilizer test on the 2nd group but measure white sites in the Z ′ basis and black sites in X ′ basis. (4-5): We run B-protocol with SB,k for the 3 + 16(k − 1)-th - 2 + 16k-th groups. Notice that the first condition in Step (2-5) has been done in Step (43), we check only 16 remaining conditions in Step (2-5). We repeat this protocol for k = 1, . . . , lB . (4-6): We run W-protocol with SB,k for the 3 + 16lW + 16(k − 1)-th - 2 + 16lW + 16k-th groups as Step (4-5). We repeat this protocol for k = 1, . . . , lW . In the above protocol, steps (4-3) and (4-4) perform the stabilizer test given in [12] which certifies the graph state |Gi. For our self-testing, we need to guarantee local √ measurements of X1 , Y1 , Z1 and (X1 + Y1 )/ 2 for all sites. We need to pass around 16n tests with sufficiently large probability because each site requires 16 tests. Hence, we need to choose c1 to be c4 (log n)1/2 so that the passing probability for each test is βn , which leads to the following theorem. Theorem 2. Given a significance level α and a detection probability β, there exists a pair of positive real numbers c2 and c4 satisfying the following condition. If we perfectly prepare the state |Gi and our measurement has no error, the test is passed with probability β. If the test is passed with the above c4 , there exists an isometry Ui : H′ i → Hi such that, with significance level α, we can guarantee that kUi Xi′ Ui† − Xi k ≤ δ
kUi Yi′ Ui† − Yi k kUi Zi′ Ui† − Zi k kUi B(0)′i Ui† − B(0)i k
≤δ
≤δ
≤δ c2 Tr σ(I − P1′ ), Tr σ(I − P2′ ) ≤ m where δ :=
c2
1
m4
(5) (6) (7) (8) (9)
1
(log n) 4 , U := U1 ⊗ · · · ⊗ Un , σ is the
resultant state on the final group, and P1′ , P2′ are POVM elements corresponding to pass of Steps (4-3), (4-4).
Here, the conditions (5)–(8) follow from Theorem 1 and the condition (9) follows from the same discussion for the stabilizer test given in [12]. IV.
CERTIFICATION OF COMPUTATION RESULT
To guarantee the computation result, we need to guarantee that our computation operation is very close to the true operation based on Theorem 2. When {Mi }i is a POVM realized by an adaptive measurement on each site from X, Y , and B(0), as shown in Appendix B, Theorem 2 guarantees that kU Mi′ U † − Mi k ≤ 3nδ,
(10)
Mi is the ideal POVM. This inequality can be shown by a modification of a virtual unitary protocol composed of a collection of unitaries on each site controlled by another trusted system [15, Corollary 2]. Thus, as shown in Appendix C, (9) and (10) lead to r 2c2 † . (11) kU σU − |GihG|k1 ≤ 6nδ + m When Mj′ is the POVM element of all of outcomes corresponding to the correct computation result, we have |Tr (Mj′ σ − Mj |GihG|)|
≤|Tr (U Mj′ U † − Mj )U σU † | + |Tr Mj (U σU † − |GihG|)| r 2c2 . (12) ≤3nδ + 6nδ + m Thus, choosing m = O(n4 log n), we can achieve constant upper bound for the probability of accepting an incorrect output of the quantum computation. V.
DISCUSSION
The above analysis has been restricted to the case of two-colorable graph states. In fact, the non-conflict can be relaxed to the case of graph states which are not twocolarable as follows. Firstly, we remember that our analysis can be divided into two parts, testing of the measurement basis and testing of the graph state. The first part can be generalized as follows. Assume that we have k colors. For each color i = 1, . . . , k, we divide the set of sites with color i into subsets Si,1 , . . . , Si,li such that there is no common neighborhood with non-i color for each subset Si,j . In this case, we can generalized the B-protocol as explained in Appendix D. Then, applying this generalization to all colors in the protocol, we can extend the first part. To realize the second part, for each color i, we measure non-i color sites with Z basis and check whether the outcome of measurement X on the sites with color i is the same as the predicted one. We
5 repeat this protocol for all colors. Due to the construction whose detail is given in the supplementary materials, we obtain the same analysis as two-colorable case when the numbers l1 , . . . , lk are bounded. Further, in the two-colorable case, we can relax the non-conflict condition. That is, we can replace the nonconflict condition by a certain liner independence condi-
tion, as explained in Appendices E, F, and G. We have shown how the output of a quantum computation can be guaranteed in the context of measurementonly blind quantum computation. For a computation on an n-qubit graph state the resources needed to achieve a constant upper bound for probability of accepting a wrong outcome scale as O(n4 log n).
Appendix A: Bell state
We focus on the observables X := |1ih0| + |0ih1|, We consider the state
√1 (|0, +i 2
Y := i|1ih0| − i|0ih1|,
Z := |0ih0| − |1ih1|.
(A1)
+ |1, −i) on the composite system H1 ⊗ H2 . We also define X −Z X +Z √ , A(1) := √ , 2 2 X −Y X +Y B(0) := √ , B(1) := √ , 2 2 Y +Z Y −Z C(0) := √ , C(1) := √ . 2 2 A(0) :=
(A2) (A3) (A4)
Here, instead of the ideal systems H1 and H2 , we have the real systems H1′ and H2′ . Also, we assume that we can measure real observables X1′ , X2′ , Y1′ , Y2′ , Z1′ , Z2′ , A(0)′1 , A(1)′1 , B(0)′1 , B(1)′1 , C(0)′1 , and C(1)′1 . Here, we choose the real systems H1′ and H2′ sufficiently large so that our measurements are the projective decompositions of these observables. In the following, we prepare the real state |ψ ′ i on the composite system H1′ ⊗ H2′ . Proposition 1. When
√ hψ ′ |A(0)′1 X2′ + A(0)′1 Z2′ − A(1)′1 X2′ + A(1)′1 Z2′ |ψ ′ i ≥ 2 2 − ǫ1 √ hψ ′ |B(0)′1 Z2′ + B(0)′1 Y2′ + B(1)′1 Z2′ − B(1)′1 Y2′ |ψ ′ i ≥ 2 2 − ǫ2 √ hψ ′ |C(0)′1 Y2′ + C(0)′1 X2′ + C(1)′1 Y2′ − C(1)′1 X2′ |ψ ′ i ≥ 2 2 − ǫ3 , hψ ′ |X1′ Z2′ |ψ ′ i ≥ 1 − ǫ4 hψ ′ |Z1′ X2′ |ψ ′ i ≥ 1 − ǫ5 hψ ′ |Y1′ Y2′ |ψ ′ i ≥ 1 − ǫ6 , ′ ′ hψ |B(0)1 (Z2′ + Y2′ )|ψ ′ i ≥ 2 − ǫ7 , hψ ′ |X1′ Y2′ + Y1′ Z2′ |ψ ′ i ≤ ǫ8 , there exists a local isometry U : H1′ → H1 such that
1 2
ˆj ǫj j=1 c
and δ2 :=
P8
1 2
¯j ǫj j=1 c
+
(A7) (A8) (A9) (A10) (A11) (A12)
(A13)
≤ δ1
(A15)
kU B(0)′1 U † − P6
(A6)
kU X1′ U † − X1 k ≤ δ1 kU Y1′ U † − Y1 k kU Z1′ U † − Z1 k
where δ1 :=
(A5)
≤ δ1
X1 + Y1 √ k ≤ δ2 , 2
(A14)
(A16)
1 √ 14 2(ǫ4 + ǫ64 ), and cˆj and c¯j are constants.
Proof of Theorem 1: Now, using Proposition 1, we show Theorem 1 of the main body as follows. Given a significance level α, there exists a positive number c′′ > 0 satisfying the following. Once all of the conditions in Step ′′ (2-5) are satisfied, with the significance level α, we can guarantee the conditions (A5)-(A12) with ǫ4 , ǫ5 , ǫ6 = cm and ′′ ǫ1 , ǫ2 , ǫ3 , ǫ7 , ǫ8 = √c m . Therefore, using a suitable isometry U , with the significance level α, we can guarantee the 1
conditions (A13)-(A16) with δ1 , δ2 = O(m 4 ), which is the desired argument.
6 To show Proposition 1, we need several lemmas. Lemma 1. When √ hψ ′ |A(0)′1 X2′ + A(0)′1 Z2′ − A(1)′1 X2′ + A(1)′1 Z2′ |ψ ′ i ≥ 2 2 − ǫ1 √ hψ ′ |B(0)′1 Z2′ + B(0)′1 Y2′ + B(1)′1 Z2′ − B(1)′1 Y2′ |ψ ′ i ≥ 2 2 − ǫ2 √ hψ ′ |C(0)′1 Y2′ + C(0)′1 X2′ + C(1)′1 Y2′ − C(1)′1 X2′ |ψ ′ i ≥ 2 2 − ǫ3 ,
(A17) (A18) (A19)
we have
5
k(X2′ Z2′ + Z2′ X2′ )|ψ ′ ik ≤ 2ǫ′1 k(X2′ Y2′ + Y2′ X2′ )|ψ ′ ik ≤ 2ǫ′2 k(Y2′ Z2′ + Z2′ Y2′ )|ψ ′ ik ≤ 2ǫ′3 ,
(A20) (A21) (A22)
hψ ′ |X1′ Z2′ |ψ ′ i ≥ 1 − ǫ4 hψ ′ |Z1′ X2′ |ψ ′ i ≥ 1 − ǫ5 hψ ′ |Y1′ Y2′ |ψ ′ i ≥ 1 − ǫ6 ,
(A23) (A24) (A25)
k(X1′ − Z2′ )|ψ ′ ik ≤ ǫ′4 k(Z1′ − X2′ )|ψ ′ ik ≤ ǫ′5 k(Y1′ − Y2′ )|ψ ′ ik ≤ ǫ′6 ,
(A26) (A27) (A28)
1
where ǫ′j := 2 4 ǫj2 for j = 1, 2, 3. Lemma 1 follows from Theorem 2 of [25]. Lemma 2. When
we have
1
1
where ǫ′j := 2 2 ǫj2 for j = 4, 5, 6. Proof: Now, we make the spectral decomposition of X1′ Z2′ as X1′ Z2′ = P − (I − P ), where P is a projection. (A23) implies that hψ ′ |(I − P )|ψ ′ i ≤ ǫ24 . Schwarz inequality yields that 1 1 1 k(X1′ − Z2′ )|ψ ′ ik = k (I − X1′ Z2′ )|ψ ′ ik = k (P + (I − P ) − (P − (I − P )))|ψ ′ ik = k(I − P )|ψ ′ ik 2 2 2 r 1 1 ǫ4 = 2 2 ǫ42 . ≤ 2
(A29) (A30)
Similarly, we obtain other inequalities. Lemma 3. When hψ ′ |X1′ Z2′ |ψ ′ i ≥ 1 − ǫ4 hψ ′ |Y1′ Y2′ |ψ ′ i ≥ 1 − ǫ6 , hψ ′ |B(0)′1 (Z2′ + Y2′ )|ψ ′ i ≥ 2 − ǫ7 , hψ ′ |X1′ Y2′ + Y1′ Z2′ |ψ ′ i ≤ ǫ8 ,
(A31) (A32) (A33) (A34)
we have k(B(0)′1 −
Z2′ + Y2′ √ )|ψ ′ ik ≤ ǫ′7 2
(A35) (A36)
q√ √ √ where ǫ′7 := 2ǫ7 + 12 ǫ8 + ǫ4 + ǫ6 .
7 Proof: Since √ k(X1′ Z2′ − I)|ψ ′ ik ≤ 2 ǫ4 , √ k(Y1′ Y2′ − I)|ψ ′ ik ≤ 2 ǫ6 ,
(A37) (A38)
|hψ ′ |Z2′ Y2′ + Y2′ Z2′ |ψ ′ i − hψ ′ |Z2′ Y1′ + Y2′ X1′ |ψ ′ i| ≤khψ ′ |Z2′ Y2′ kk(I − Y1′ Y2′ )|ψ ′ ik + khψ ′ |Y2′ Z2′ kk(I − X1′ Z2′ )|ψ ′ ik √ √ ≤2 ǫ4 + 2 ǫ6 ,
(A39) (A40) (A41)
we have
Z2′ + Y2′ √ )|ψ ′ ik2 2 2 2 √ Z ′ + Y2′ + Z2′ Y2′ + Y2′ Z2′ ′ 2 |ψ i =hψ ′ |B(0)′1 − 2B(0)′1 (Z2′ + Y2′ ) + 2 2 √ Z ′ Y ′ + Y2′ Z2′ ′ =2 − hψ ′ | 2B(0)′1 (Z2′ + Y2′ ) + 2 2 |ψ i 2 √ √ √ 1 ≤2 − 2hψ ′ |B(0)′1 (Z2′ + Y2′ )|ψ ′ i + hψ ′ |Z2′ Y1′ + Y2′ X1′ |ψ ′ i + ǫ4 + ǫ6 2 √ √ √ 1 ≤2 − 2 + 2ǫ7 + ǫ8 + ǫ4 + ǫ6 2 √ √ √ 1 = 2ǫ7 + ǫ8 + ǫ4 + ǫ6 . 2 k(B(0)′1 −
(A42) (A43) (A44) (A45) (A46) (A47)
Lemma 4. When k(X2′ Z2′ + Z2′ X2′ )|ψ ′ ik ≤ 2ǫ′1 , k(X2′ Y2′ + Y2′ X2′ )|ψ ′ ik ≤ 2ǫ′2 , k(Y2′ Z2′ + Z2′ Y2′ )|ψ ′ ik ≤ 2ǫ′3 , k(X1′ − Z2′ )|ψ ′ ik ≤ ǫ′4 , k(Z1′ − X2′ )|ψ ′ ik ≤ ǫ′5 , k(Y1′ − Y2′ )|ψ ′ ik ≤ ǫ′6 , Z′ + Y ′ k(B(0)′1 − 2√ 2 )|ψ ′ ik ≤ ǫ′7 , 2
(A48) (A49) (A50) (A51) (A52) (A53) (A54)
there exists local isometries Uj : Hj′ → Hj for j = 1, 2 such that kU |ψ ′ i − |junki|ψik ≤ δ1′ , kU X1′ |ψ ′ i − X1 |junki|ψik ≤ δ1′ , kU Y1′ |ψ ′ i − Y1 |junki|ψik ≤ δ1′ , kU Z1′ |ψ ′ i − Z1 |junki|ψik ≤ δ1′ , kU X2′ |ψ ′ i − X2 |junki|ψik ≤ δ1′ , kU Y2′ |ψ ′ i − Y2 |junki|ψik ≤ δ1′ , kU Z2′ |ψ ′ i − Z2 |junki|ψik ≤ δ1′ , X1 + Y1 kU B(0)′1 |ψ ′ i − √ |junki|ψik ≤ δ2′ , 2
(A55) (A56) (A57) (A58) (A59) (A60) (A61) (A62) (A63)
where δ1′ :=
P6
′ ′ j=1 cj ǫj
and δ2′ :=
√ ′ 2δ1 + ǫ′7 and U := U2 U1 .
8 Proof: We set the initial state on H1 ⊗ H2 to be |0, +i. Define U1 := (|0ih0| + X1′ |1ih1|)H1 (|0ih0| + Z1′ |1ih1|)H1 and U2 := (|0ih0| + Z2′ |1ih1|)H2 (|0ih0| + X2′ |1ih1|)H2 , where H := |+ih0| + |−ih1| = |0ih+| + |1ih−|. Hence, we have U |ψ ′ i 1 = ((I + Z1′ )(I + X2′ )|ψ ′ i|0+i + Z2′ (I + Z1′ )(I − X2′ )|ψ ′ i|0−i 4 + X1′ (I − Z1′ )(I + X2′ )|ψ ′ i|1+i + X1′ Z2′ (I − Z1′ )(I − X2′ )|ψ ′ i|1−i). When |junki :=
√
2 4 (I
(A64) (A65) (A66)
+ Z1′ )(I + X2′ )|ψ ′ i, we have U |ψ ′ i − |junki|ψi 1 = (Z2′ (I + Z1′ )(I − X2′ )|ψ ′ i|0−i + X1′ (I − Z1′ )(I + X2′ )|ψ ′ i|1+i 4 + (X1′ Z2′ (I − Z1′ )(I − X2′ )|ψ ′ i − (I + Z1′ )(I + X2′ )|ψ ′ i)|1−i).
(A68)
kZ2′ (I + Z1′ )(I − X2′ )|ψ ′ i|0−ik =kZ2′ (I + Z1′ )(I − Z1′ )|ψ ′ i|0−ik + kZ2′ (I + Z1′ )(Z1′ − X2′ )|ψ ′ i|0−ik ≤2ǫ′5 , kX1′ (I − Z1′ )(I + X2′ )|ψ ′ i|1+ik ≤kX1′ (I − Z1′ )(X2′ − Z1′ )|ψ ′ i|1+ik ≤2ǫ′5 .
(A70) (A71) (A72) (A73) (A74) (A75)
(A67)
(A69)
We have
Since X1′ Z2′ (I − Z1′ )(I − X2′ )|ψ ′ i =Z2′ (I − X2′ )X1′ (I − Z1′ )|ψ ′ i = Z2′ (I − X2′ )X1′ (I − X2′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i =Z2′ (I − X2′ )(I − X2′ )Z2′ |ψ ′ i + Z2′ (I − X2′ )(I − X2′ )(Z2′ − X1′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i =2Z2′ (I − X2′ )Z2′ |ψ ′ i + 2Z2′ (I − X2′ )(Z2′ − X1′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i =2Z2′ Z2′ (I + X2′ )|ψ ′ i − 2Z2′ (Z2′ X2′ + X2′ Z2′ )|ψ ′ i + 2Z2′ (I − X2′ )(Z2′ − X1′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i =(I + X2′ )2 |ψ ′ i − 2Z2′ (Z2′ X2′ + X2′ Z2′ )|ψ ′ i + 2Z2′ (I − X2′ )(Z2′ − X1′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i =(I + X2′ )(I + Z1′ )|ψ ′ i) + (I + X2′ )(X2′ − Z1′ )|ψ ′ i − 2Z2′ (Z2′ X2′ + X2′ Z2′ )|ψ ′ i + 2Z2′ (I − X2′ )(Z2′ − X1′ )|ψ ′ i + Z2′ (I − X2′ )X1′ (X2′ − Z1′ )|ψ ′ i
(A76) (A77) (A78) (A79) (A80) (A81) (A82) (A83)
we have k(X1′ Z2′ (I − Z1′ )(I − X2′ )|ψ ′ i − (I + Z1′ )(I + X2′ )|ψ ′ i)k ≤(2 + 2)ǫ′5 + 2ǫ′1 + 4ǫ′4 .
(A84) (A85)
kU |ψ ′ i − |junki|ψik 1 1 ≤ (2ǫ′5 + 2ǫ′5 + 4ǫ′5 + 2ǫ′1 + 4ǫ′4 ) = (4ǫ′5 + ǫ′1 + 2ǫ′4 ). 4 2
(A86)
Thus,
(A87)
So, we obtain (A55). Inequalities (A56)-(A61) can be shown by using the anti-commutation relation and exchanging X1 , Y1 , Z1 and X2 , Y2 , Z2 . The the coefficients cj for δ are given by counting the number of these operations.
9 Now, we show (A62). We have X1 + Y1 √ |junki|ψik 2 Z2 + Y2 |junki|ψik =kU B(0)′1 |ψ ′ i − √ 2 Z′ + Y ′ Z2 + Y2 Z′ + Y ′ |junki|ψik ≤kU B(0)′1 |ψ ′ i − U 2√ 2 |ψ ′ ik + kU 2√ 2 |ψ ′ i − √ 2 2 2 Z′ + Y ′ 1 Z′ Z2 1 Y′ Y2 =k(B(0)′1 − 2√ 2 )|ψ ′ ik + √ kU √2 |ψ ′ i − √ |junki|ψik + √ kU √2 |ψ ′ i − √ |junki|ψik 2 2 2 2 2 2 2 √ ≤ǫ′7 + 2δ1′ . kU B(0)′1 |ψ ′ i −
(A88) (A89) (A90) (A91) (A92)
So, we obtain (A62). Lemma 5. The local isometries Uj : Hj′ → Hj for j = 1, 2 satisfy kU |ψ ′ i − |junki|ψik ≤ δ1′ , ≤ δ1′ , ≤ δ1′ , ≤ δ1′ , ≤ δ1′ , ≤ δ1′ , ≤ δ1′ , X1 + Y1 kU B(0)′1 |ψ ′ i − √ |junki|ψik ≤ δ2′ , 2
(A93) (A94) (A95) (A96) (A97) (A98) (A99)
kU X1′ |ψ ′ i − X1 |junki|ψik kU Y1′ |ψ ′ i − Y1 |junki|ψik kU Z1′ |ψ ′ i − Z1 |junki|ψik kU X2′ |ψ ′ i − X2 |junki|ψik kU Y2′ |ψ ′ i − Y2 |junki|ψik kU Z2′ |ψ ′ i − Z2 |junki|ψik
(A100) (A101)
for U := U2 U1 , we have √ kU1 X1′ U1† − X1 k ≤ 2 2δ1′ √ kU1 Y1′ U1† − Y1 k ≤ 2 2δ1′ √ kU1 Z1′ U1† − Z1 k ≤ 2 2δ1′ √ X1 + Y1 k ≤ 2(δ1′ + δ2′ ). kU1 B(0)′1 U1† − √ 2
(A102) (A103) (A104) (A105)
Proof: U1 X1′ U1† |ψi|junki
(A106)
=U2 U1 X1′ U1† U2† |junki|ψi =U2 U1 X1′ U1† U2† U2 U1 |ψ ′ i + U2 U1 X1′ U1† U2† (|junki|ψi − U2 U1 |ψ ′ i) =U2 U1 X1′ |ψ ′ i + U2 U1 X1′ U1† U2† (|junki|ψi − U2 U1 |ψ ′ i) =X1 |ψi|junki + (U2 U1 X1′ |ψ ′ i − X1 |junki|ψi) + U2 U1 X1′ U1† U2† (|junki|ψi
(A107) (A108) (A109) ′
− U2 U1 |ψ i).
(A110)
Hence, we obtain kU1 X1′ U1† |ψi − X1 |ψik ≤ 2δ1′ ,
(A111)
√ kU1 X1′ U1† − X1 k ≤ 2 2δ1′ .
(A112)
which implies that
So, we obtain (A102). Similarly, we obtain other inequalities. √ √ √ √ Proof of Proposition 1: Choose δ1 = 2 2δ1′ and δ2 = 2(δ1′ + δ2′ ) = 2((1 + 2)δ1′ + ǫ′7 ). Then, combining these lemmas, we obtain Proposition 1.
10 Appendix B: Error of POVM element: Proof of Inequality (10)
According to [15], we introduce n ideal trusted systems spanned by |0i, |1i although each untrusted system is spanned by |1i, | − 1i. Let Uj be the unitary on the trusted system. Let Vj be the unitary controlling the j-th untrusted system by the trusted system, which is defined as follows. The operators on the untrusted system are restricted to I and s operators {D(i) }si=1 such that their eigenvalues are 1 or −1 and P kU D(i) U † − D(i) k ≤ δ. In the main text, s = 3 and {D(i) }i = {X, Y, B(0)}. Then, we assume Vj has the form k∈Fn |kihk|Dj (k), where Dj (k) is one of I and {D(i) }i . According to FIG. 7 of [15], we define 2 Wj := Uj Vj Wj−1 , and W0 = U0 and U := U1 · · · Un . Proposition 2 ([15, Lemma 6] with modification). We have kU Wj′ U † − Wj k ≤ sjδ.
(B1)
Proof: We have ′ U Wj′ U † − Wj = U Uj′ U † Vj U Wj−1 U † − Uj Vj Wj−1
=(U Uj′ U †
−
′ Uj )Vj U Wj−1 U†
+
′ Uj Vj (U Wj−1 U†
− Wj−1 ).
(B2) (B3)
Due to induction, it is enough to show kU Uj′ U † − Uj k ≤ sδ.
(B4)
We have U Uj′ U † − Uj = U =
s X i=1
X
X
k∈Fn 2
k∈Fn 2 :Dj (k)=D(i)
|kihk|Dj (k)′ U † −
X
k∈Fn 2
|kihk|Dj (k)
′ |kihk|(U D(i) U † − D(i) )
(B5)
(B6)
For i, we have k
X
k∈Fn 2 :Dj (k)=D(i)
′ |kihk|(U D(i) U † − D(i) )k = k
X
k∈Fn 2 :Dj (k)=D(i)
′ |kihk|k · kU D(i) U † − D(i) k ≤ δ.
(B7)
So, we have (B4). Assume that our adaptive measurement is given as follows. Once we obtain the measured outcomes k1 , . . . , kj−1 , we measure Dj (k1 , . . . , kj−1 ) on the j-th system. To discuss such an adaptive measurement, we set the initial state |+i⊗n on the trusted system. Choose Uj as the application of the Hadamard operator H on the j-th trusted system. Then, we define X |k1 , . . . , kj−1 , 0ihk1 , . . . , kj−1 , 0| + Dj (k1 , . . . , kj−1 )|k1 , . . . , kj−1 , 1ihk1 , . . . , kj−1 , 1|. Vj := k1 ,...,kj−1
Then, we define the TP-CP map Λ from the untrusted n-qubit system to the trusted n-qubit system as Λ(ρ) := Tr UT Wn ρ ⊗ |+ih+|⊗n Wn† ,
(B8)
where Tr UT expresses the partial trace with respect to the untrusted system. Due to the construction, Λ(ρ) is the same as the output distribution when the above adaptive measurement is applied. Proposition 3 ([15, Corollary 2] with modification). For any state ρ, we have kU Λ′ (U † ρU )U † − Λ(ρ)k1 ≤ 2snδ.
(B9)
Hence, when Mi is a POVM element of an adaptive measurement, we have kU Mi′ U † − Mi k ≤ max Tr (U Mi′ U † − Mi )ρ ≤ 2snδ, ρ
(B10)
11 which implies inequality (10) of the main text. Proof: We have †
U Wj′ U † (ρ ⊗ |+ih+|⊗n )U Wj′ U † − Wj (ρ ⊗ |+ih+|⊗n )Wj†
=(U Wj′ U †
− Wj )(ρ ⊗ |+ih+|
⊗n
† )U Wj′ U †
+ Wj (ρ ⊗ |+ih+|
(B11) ⊗n
† )(U Wj′ U †
−
Wj† ).
(B12)
Also, we have †
k(U Wj′ U † − Wj )(ρ ⊗ |+ih+|⊗n )U Wj′ U † k1
≤k(U Wj′ U † kWj (ρ ⊗ ≤kWj (ρ ⊗ †
− Wj )kk(ρ ⊗ |+ih+|
⊗n
† )U Wj′ U † k1
(B13) =
† |+ih+|⊗n )(U Wj′ U † − Wj† )k1 † |+ih+|⊗n )k1 k(U Wj′ U † − Wj† )k
k(U Wj′ U †
− Wj )k ≤ snδ,
(B14) (B15) (B16)
=k(U Wj′ U † − Wj† )k ≤ snδ.
(B17)
Combining (B12), (B14), and (B17), we have †
kU Λ′ (U † ρU )U † − Λ(ρ)k1 ≤ kU Wj′ U † (ρ ⊗ |+ih+|⊗n )U Wj′ U † − Wj (ρ ⊗ |+ih+|⊗n )Wj† k1 ≤ 2snδ,
(B18)
where the first inequality follows from the information processing inequality with respect to the trace of the untrusted system. Hence, we obtain (B9) with s = 3. Appendix C: Error in the initial state: Proof of inequality (11)
In this section, we show a slightly stronger inequality than inequality (11) of main text: kU σU † − |GihG|k21 ≤ 4nδ +
2c2 m
(C1)
by assuming Inequalities (5)–(9) in Theorem 2. Now, we have the relation (a)
(b)
kU σU † − |GihG|k21 ≤ 1 − Tr hG|U σU † |Gi = Tr (I − |GihG|)U σU † ≤ Tr (I − P1 )U σU † + Tr (I − P2 )U σU † ,
(C2)
where (a) follows from the relation between the trace norm and the fidelity [29, (6.106)] and (b) follows from the inequality I − |GihG| ≤ (I − P1 ) + (I − P2 ). We can apply (B10) with s = 2 to Pi because Pi is a POVM element of an adaptive measurement based on X and Z. So, we have |Tr (U (I − Pi′ )U † − (I − Pi ))U σU † | = |Tr (U Pi′ U † − Pi )U σU † | ≤ kU P1′ U † − Pi k ≤ 2nδ.
(C3)
Thus, Inequality (9) in Theorem 2 implies Tr (I − Pi )U σU † = Tr ((I − Pi ) − U (I − Pi′ )U † )U σU † + Tr (I − Pi′ )σ ≤ 2nδ +
c2 . m
(C4)
The combination of (C2) and (C4) yields (C1). Appendix D: Self testing with multi-colorable graph
Now, we give a protocol for k-colorable graph state as follows. For each color i = 1, . . . , k, we divide the set Si of sites with color i into subsets Si,1 , . . . , Si,li such that there is no common neighborhood with non-i color for each subset Si,j . Then, as a generalization of B-protocol, we propose the i-protocol with the subset Si,j as follows. (3-1): We prepare 17m states |G′ i.
12 (3-2): We measure Z ′ on all sites of Si \ Si,j for all copies. Then, we apply Z ′ operators on the remaining sites to correct applied Z ′ operators dependently of the outcomes. (3-3): For all a ∈ Si,j , we choose a site ba ∈ Na . Then, we measure Z ′ on all sites of SW \ {ba }a∈Si,j for all copies. Then, we apply Z ′ operators on the remaining sites to correct applied Z ′ operators dependently of the outcomes. (3-4): Due to the above steps, the resultant state should be ⊗a∈Si,j |Φ′ iaba . Then, we apply the above self-testing procedure to all of {|Φ′ iaba }a∈Si,j . The above protocol verifies the measurement device on sites with i-th color. Then, applying this generalization to all colors in the protocol, we can extend the first part. To realize the second part, for each color i, we measure non-i color sites with Z basis and check whether the outcome of measurement X on the sites with color i is the same as the predicted one. Then, we denote the projection Qk corresponding to the passing event for this test by Qi . Hence, we have i=1 Qi = |GihG| because only the state |Gi can pass all of these tests. Thus, applying this test for all colors, we can test whether the state is the desired graph state. Pk Then, choosing c3 to be 16(k + i=1 li ), we propose our self-testing protocol as follows, (4-1): We prepare c3 m + 1 states |G′ i.
(4-2): We randomly divide c3 m + 1 blocks into k + c3 + 1 groups. The first c3 groups are composed of m blocks and the final group is composed of a single block. Each block contains n qubits. (4-3): For the first k groups, we apply the following test. For the i-th group, we measure Z ′ on the sites with non-i color and X ′ on the sites with i-th color, and check that the outcome of X ′ measurements is the same as predicted from the outcomes of Z ′ measurements. Pi−1 Pi−1 (4-4): We run the i-protocol with Si,j for the k + 16( i′ =1 li′ ) + 16(j − 1) + 1-th -k + 16( i′ =1 li′ ) + 16j-th groups. Notice that the first condition in Step (2-5) has been done in Step (4-3), we check only 16 remaining conditions in Step (2-5). We repeat this protocol for j = 1, . . . , li and i = 1, . . . , k. When we employ the above protocol for k-colorable case, the difference from the 2-colorable case is only the number of samples. we have the same analysis for the certification of computation result as the 2-colorable case. Appendix E: Relaxation of the non-conflict condition for two-colorable graph
Now, we relax our condition for two-colorable graph. We define a nB × nW binary symmetric matrix A = (ai,j ) called the graph matrix such that ai,j is 1 when the site i and j is connected, and it is zero otherwise. Generally, this matrix A is not full rank. We divide the sites SB = {1, . . . , nB } into LB subsets TB,1 , . . . , TB,LB such that the rank of the restricted matrix A to sites in TB,k is |TB,k |, i.e., row vectors of A whose index belong to TB,k are linearly independent. We choose the number LB as the minimum number satisfying this condition. We have that LB < lB which means that even when lB is not bounded, there is a possibility that LB is. We also define the number LW for the white sites in the same way. We can define B-protocol even for TB,k . To get the intuition for extended B-protocol for TB,k , we choose a suitable coordinate conversion acting only on the white sites so that the graph matrix on TB,k is the identity matrix. Hence, the problem is reduced to the tensor product of |TB,k | two-qubit states. In this case, the local measurements of X, Y , and Z on the new coordinate in the white sites can be realized by a combination of the local measurements on the original coordinate in the white sites and a linear data processing of their outcomes. Hence, B-protocol for TB,k is given as our self-testing of measurements based on two-qubit entangled state for all sites of TB,k . After the application of this coordinate conversion, it becomes impossible to measure a superposition of X, Y , and Z on the white qubits. Hence, the requirement (1-3) in main text is essential for this extension. McKague et al [25] already gave a self-testing protocol for the Bell state. However, their protocol does not satisfy the requirement (1-3) whereas our self-testing protocol for two-qubits can even be used for the subset TB,k . Appendix F: General property for two-colorable graph state
To define extended B-protocol for TB,k , we need several properties for two-colorable graph states. Assume that we have two colors B and W . We also assume the following, the system B has sites 1, . . . , nB and the system W has sites 1, . . . , nW .
13 For an invertible nB × nB matrix C, we define the unitary operator UC,Z,B as X
UC,Z,B :=
n z∈F2 B
|CziB
B hz|.
(F1)
Using the X basis states |xiX,B and the Y basis states |yiY,B , we define the unitary operators UC,X,B and UC,Y,B as UC,X,B :=
X
|CxiX,B
X,B hx|
(F2)
X
|CyiY,B
Y,B hy|.
(F3)
n
x∈F2 B
UC,Y,B :=
n y∈F2 B
Also, we define the vector 1 := (1, . . . , 1). Similarly, we can define UD,X,W , UD,Y,W , and UD,Z,W for an invertible nW × nW matrix D. Lemma 6. Then, for an invertible matrix C, we have the relation UC,X,B = U(C −1 )T ,Z,B ,
(F4)
UC,Z,B = U(C −1 )T ,Y,B ,
(F5)
When (C −1 )T 1 = 1, we have the relation
Notice that the condition (C −1 )T 1 = 1 is equivalent to C T 1 = 1 because (C −1 )T = (C T )−1 . Proof: We have UC,X,B |ziB X 1 |CxiX,B = n /2 2 B nB
(F6) X,B hx|
x∈F2
= =
1 2nB /2 1 2nB /2
which implies (F4). Notice that |yiY,B =
= = =
1 2nB /2 1 2nB /2 1 2nB /2 1 2nB /2
′
n x′ ∈F2 B
(−1)x ·z |xiB
(F7)
X
(−1)x·z |CxiX,B
(F8)
X
(−1)C
−1
(F9)
n x∈F2 B
x′ ·z
n x′ ∈F2 B
1 2nB /2
|x′ iX,B = |(C −1 )T ziB ,
y·z 1·z i |ziZ,B . z (−1)
P
UC,Z,B |ziB X 1 = n /2 |Cz ′ iZ,B 2 B nB ′ =
X
z ∈F2
(F10) Z,B hz
′
|
X z
X
(−1)y·z i1·z |CziX,B
X
(−1)y·C
X
(−1)(C
−1 T
X
(−1)(C
−1 T
n z∈F2 B
−1
z 1·C −1 z
n z∈F2 B
i
(−1)y·z i1·z |ziZ,B
) y·C −1 z (C −1 )T 1·z
i
n
) y·C −1 z 1·z
i
(F11) (F12)
|ziX,B
z∈F2 B
n z∈F2 B
Then,
(F13) |ziX,B
|ziX,B .
(F14) (F15)
14 Next, given the graph state |Gi, we define the nB × nW matrix A = (ai,j ) as follows. When the site j of W is connected to the site i of B, ai,j is 1. Otherwise, ai,j is zero. Then, we have |G; Ai =
1 2nW /2
X n
z∈F2 W
|AziX,B |ziW .
Then, when we measure W with the Z basis and obtain the outcome z, we obtain Az with the X measurement on B. Then, we have |G; Ai =
1 2nB /2
X
n z∈F2 B
|ziX,B |AT ziW
(F16)
because any vector z ′ ∈ Fn2 B satisfies B hz
= = =
′
|Gi X 1
2nB /2 1 2nB
n x∈F2 B
(F17) x·z ′ X,B hx|(−1)
(−1)Az·z /2
1 2nB /2
1
′
2nW /2
X n
z∈F2 W
1 2nW /2
X
n z∈F2 W
|AziX,B |ziW
|ziW
|AT z ′ iX,W .
(F18) (F19) (F20)
We also have UC,X,B |G; Ai = |G; CAi, UD−1 ,Z,W |G; Ai = |G; ADi,
(F21) (F22)
Now, we denote the outcome on B with the basis X by XB . We denote the outcome on B with the basis Z by ZB . We denote the outcome on B with the basis Y by YB . We denote the outcome on W with the basis X by XW . We denote the outcome on W with the basis Z by ZW . We denote the outcome on Y with the basis Y by YW . Then, we have the relations XB = AZW ,
T T . ZB A = XW
(F23)
Appendix G: Extended B-protocol
In this section, we give the extended B-protocol for TB,j with m rounds, which checks the measurement on the black sites. Let k be the rank of the matrix A. Let k ′ be the cardinality of TB,j . Adding k − k ′ elements from {1, . . . , nB } \ TB,j to TB,j , we define the set SˆB,j such that {ai }i∈SˆB,j are linear independent and the cardinality of SˆB,j is k. Without loss of generality, we assume that TB,j = {1, . . . , k ′ } and SˆB,j = {1, . . . , k}. So, there exists an invertible nW × nW matrix D such that AD has the following form. Ik 0 D. (G1) A= ∗ 0 We define Aˆ := AD−1 . Eq. (G1) does not depend on the choice of the 1-st ...,nW -th row vectors of D. So, we choose an invertible matrix D satisfying (G1) such that DT 1 = 1. So, we have Ik 0 ˆ Ik 0 ZW , (G2) DZW = XB = ∗ 0 ∗ 0 ˆ where ZˆW := DZW . Hence, UD,Z,W |G; Ai = |G; AD−1 i = |G; Ai.
15 Now, we introduce another nW sites 1, . . . , nW on the side W by applying UD,Z,W . We denote the measurement ˆ W,j , YˆW,j , ZˆW,j , which satisfies outcomes on these sites by X ZˆW,j = (DZW )j ,
ˆ W,j = (DT −1 XW )j , X
−1 YˆW,j = (DT YW )j .
(G3)
ˆ Once we observe ZB,k+1 , . . . , ZB,nB , Now, we assume that the true state is UD,Z,W |G; Ai = |G; AD−1 i = |G; Ai. the resultant state is Pn B
⊗ki=1 ZˆW,ij=k+1
a ˆ j,i ZB,j
PnB
|G; Ik i = ⊗ki=1 XB,ij=k+1
a ˆj,i ZB,j
|G; Ik i
(G4)
Since PnB
XB,i′ ZˆW,i′ ⊗ki=1 ZˆW,ij=k+1
a ˆ j,i ZB,j
PnB
|G; Ik i = ⊗ki=1 ZˆW,ij=k+1
PnB
Pn B
ˆ W,i′ ⊗k Zˆ j=k+1 aˆj,i ZB,j |G; Ik i = (−1) ZB,i′ X i=1 W,i
j=k+1
= (−1)
j=k+1
PnB
YB,i′ YˆW,i′ ⊗ki=1 ZˆW,ij=k+1
a ˆ j,i ZB,j
a ˆ j,i′ ZB,j
Pn B
a ˆ j,i′ ZB,j
Pn B
a ˆ j,i′ ZB,j
Pn B
a ˆ j,i′ ZB,j
|G; Ik i = (−1)
j=k+1
= (−1)
j=k+1
Pn B
a ˆj,i ZB,j
XB,i′ ZˆW,i′ |G; Ik i = ⊗ki=1 ZˆW,ij=k+1
a ˆ j,i ZB,j
Pn B
a ˆ j,i ZB,j ˆ W,i′ |G; Ik i ⊗ki=1 ZˆW,ij=k+1 ZB,i′ X Pn B
a ˆ j,i ZB,j ⊗ki=1 ZˆW,ij=k+1 |G; Ik i, Pn B a ˆ j,i ZB,j ⊗ki=1 ZˆW,ij=k+1 YB,i′ YˆW,i′ |G; Ik i Pn B a ˆ j,i ZB,j ⊗ki=1 ZˆW,ij=k+1 |G; Ik i,
|G; Ik i, (G5) (G6) (G7) (G8) (G9)
we have XB,i = ZˆW,i ,
ˆ W,i + ZB,i = X
nB X
YB,i = YˆW,i +
a ˆj,i ZB,j ,
j=k+1
nB X
a ˆj,i ZB,j
(G10)
j=k+1
for i = 1, . . . , k, where a ˆj,i is the matrix entries of A. That is, we have XB,i = (DZW )i ,
ZB,i = (DT
−1
XW )i +
nB X
YB,i = (DT
a ˆj,i ZB,j ,
−1
YW )i +
j=k+1
nB X
a ˆj,i ZB,j .
(G11)
j=k+1
Based on these relations, we define AB,i (0) :=
X
Ai ( n
z=(zk+1 ,...,znB )∈F2 B
AB,i (1) :=
nB X
−k
j=k+1
X
Ai (1 +
X
Bi (
X
Bi (1 +
n −k z=(zk+1 ,...,znB )∈F2 B
BB,i (1) :=
n
z=(zk+1 ,...,znB )∈F2 B
CB,i (0) := CB,i (1) :=
nB X
j=k+1
nB X
a ˆj,i zj ) ⊗ |zihz|
(G12)
(G13)
(G14)
(G15)
PnB
a ˆ j,i zj
Ci (0) ⊗ |zihz|
(G16)
PnB
a ˆ j,i zj
Ci (1) ⊗ |zihz|.
(G17)
X
(−1)
X
(−1)
n −k z=(zk+1 ,...,znB )∈F2 B
a ˆj,i zj ) ⊗ |zihz|
a ˆj,i zj ) ⊗ |zihz|
j=k+1
−k
n −k z=(zk+1 ,...,znB )∈F2 B
nB X
j=k+1
n −k z=(zk+1 ,...,znB )∈F2 B
BB,i (0) :=
a ˆj,i zj ) ⊗ |zihz|
j=k+1
j=k+1
B-Protocol with m rounds. ′ ˆ ′ AB,i (0)′ + Zˆ ′ AB,i (0)′ − X ˆ ′ AB,i (0)′ + Zˆ ′ AB,i (1)′ for i = 1, . . . , k ′ . B1: The CHSH test: We measure TB,i,1 := X W,i W,i W,i W,i We repeat them m times. We denote the observed sample mean by TB,i,1 .
16 ′ ′ ′ ′ ′ B2: The CHSH test: We measure TB,i,2 := ZˆW,i BB,i (0)′ + YˆW,i BB,i (0)′ + ZˆW,i BB,i (1)′ − YˆW,i BB,i (1)′ for i = 1, . . . , k ′ . We repeat them m times. We denote the observed sample mean by TB,i,2 . ′ ′ ˆ ′ CB,i (0)′ + Yˆ ′ CB,i (1)′ − X ˆ ′ CB,i (1)′ for i = 1, . . . , k ′ . B3: The CHSH test: We measure TB,i,3 := YˆW,i CB,i (0)′ + X W,i W,i W,i We repeat them m times. We denote the observed sample mean by TB,i,3 . ′ ′ ˆ′ B4: Test: We measure TB,i,4 := YB,i YW,i for i = 1, . . . , k ′ . We repeat them m times. We check that they are −1. We define the random variable TB,i,4 to be 1 when it is passed. Otherwise, we define it to be 0. ′ ′ ′ B5: Test: We measure TB,i,5 := XB,i ZˆW,i for i = 1, . . . , k ′ . We repeat them m times. We check that they are 1. We define the random variable TB,i,5 to be 1 when it is passed. Otherwise, we define it to be 0. ′ ′ ˆ ′ for i = 1, . . . , k ′ . We repeat them m times. We check that they are 1. We B6: Test: We measure TB,i,6 := ZB,i X W,i define the random variable TB,i,6 to be 1 when it is passed. Otherwise, we define it to be 0. ′ ′ ′ B7: We measure TB,i,7 := ZˆW,i BB,i (0)′ + YˆW,i BB,i (0)′ for i = 1, . . . , k ′ . We repeat them m times. We denote the observed sample mean by TB,i,7 . ′ ′ ˆ′ ′ ˆ′ B8: We measure TB,i,8 := XB,i YW,i + YB,i ZW,i for i = 1, . . . , k ′ . We repeat them m times. We denote the observed sample mean by TB,i,8 .
Since Steps B5 and B6 have been done by Steps (3-3) and (3-4) of the main protocol, we do not need this step. B7 has been already done during B2. Hence, totally, we need (4 + 4 + 4 + 1 + 2)m = 15m samples for B-protocol for TB,j . Similarly, we can define W-protocol.
[1] P. W. Shor, in Foundations of Computer Science, 1994 Proceedings., 35th Annual Symposium on (IEEE, 1994) pp. 124–134. [2] S. Lloyd, Science 273, 1173 (1996). [3] T. P. Harty, D. T. C. Allcock, C. J. Ballance, L. Guidoni, H. A. Janacek, N. M. Linke, D. N. Stacey, and D. M. Lucas, Phys. Rev. Lett. 113, 220501 (2014). [4] R. Barends, J. Kelly, A. Megrant, A. Veitia, D. Sank, E. Jeffrey, T. C. White, J. Mutus, A. G. Fowler, B. Campbell, Y. Chen, Z. Chen, B. Chiaro, A. Dunsworth, C. Neill, P. O’Malley, P. Roushan, A. Vainsencher, J. Wenner, A. N. Korotkov, A. N. Clelan, and J. A. Martinis, Nature 508, 500 (2014). [5] S. Aaronson, in Proceedings of the forty-second ACM symposium on Theory of computing (ACM, 2010) pp. 141–150. [6] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information (Cambridge University Press, 2000). [7] R. Raussendorf and H. J. Briegel, Phys. Rev. Lett. 86, 5188 (2001). [8] V. Danos and E. Kashefi, in Proceedings of the 3rd International Workshop on Quantum Programming Languages (QPL 2005), Vol. 170 (2007) pp. 95–100. [9] A. Broadbent, J. F. Fitzsimons, and E. Kashefi, in Foundations of Computer Science, 2009. FOCS’09. 50th Annual IEEE Symposium on (IEEE, 2009) pp. 517–526. [10] J. F. Fitzsimons and E. Kashefi, “Unconditionally verifiable blind computation,” (2012), arXiv:quant-ph/1203.5217. [11] T. Morimae and K. Fujii, Phys. Rev. A 87, 050301 (2013). [12] M. Hayashi and T. Morimae, Phys. Rev. Lett. 115, 220502 (2015). [13] T. Morimae, Phys. Rev. A 89, 060302 (2014). [14] M. Hajduˇsek, C. A. P´erez-Delgado, and J. F. Fitzsimons, (2015), arXiv:quant-ph/1502.02563. [15] M. McKague, “Interactive proofs for BQP via self-tested graph states,” (2013), arXiv:quant-ph/1309.5675. [16] S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, Science 335, 303 (2012). [17] S. Barz, J. F. Fitzsimons, E. Kashefi, and P. Walther, Nature Physics 9, 727 (2013). [18] C. Greganti, M.-C. Roehsner, S. Barz, T. Morimae, and P. Walther, New J. Phys. 18, 013020 (2016). [19] B. W. Reichardt, F. Unger, and U. Vazirani, Nature 496, 456 (2013). [20] A. Gheorghiu, E. Kashefi, and P. Wallden, New J. Phys. 17, 083040 (2015). [21] J. F. Fitzsimons and M. Hajduˇsek, “Post hoc verification of quantum computation,” (2015), arXiv:quant-ph/1512.04375. [22] D. Hangleiter, M. Kliesch, M. Schwarz, and J. Eisert, “Direct certification of a class of quantum simulations,” (2016), arXiv:quant-ph/1602.00703. [23] D. Mayers and A. Yao, in Foundations of Computer Science, 1998. Proceedings. 39th Annual Symposium on (IEEE, 1998) pp. 503–509. [24] D. Mayers and A. Yao, Quantum Inf. Comput. 4, 273 (2004). [25] M. McKague, T. H. Yang, and V. Scarani, J. Phys. A: Math. Theor. 45, 455304 (2012). [26] M. McKague, “Self-testing graph states,” in Theory of Quantum Computation, Communication, and Cryptography: 6th Conference, TQC 2011 (Springer Berlin Heidelberg, 2014) pp. 104–120.
17 [27] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969). [28] E. L. Lehmann and J. P. Romano, Testing Statistical Hypotheses (Springer-VerlagNew York, 2008). [29] M. Hayashi, S. Ishizaka, A. Kawachi, G. Kimura, and T. Ogawa, Introduction to Quantum Information (Springer-Verlag Berlin Heidelberg, 2008).
