* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download Quantum Turing Test
Boson sampling wikipedia , lookup
Ensemble interpretation wikipedia , lookup
Wave–particle duality wikipedia , lookup
Relativistic quantum mechanics wikipedia , lookup
Topological quantum field theory wikipedia , lookup
Renormalization wikipedia , lookup
Quantum dot cellular automaton wikipedia , lookup
Algorithmic cooling wikipedia , lookup
Basil Hiley wikipedia , lookup
Renormalization group wikipedia , lookup
Theoretical and experimental justification for the Schrödinger equation wikipedia , lookup
Double-slit experiment wikipedia , lookup
Bohr–Einstein debates wikipedia , lookup
Scalar field theory wikipedia , lookup
Delayed choice quantum eraser wikipedia , lookup
Particle in a box wikipedia , lookup
Quantum field theory wikipedia , lookup
Quantum decoherence wikipedia , lookup
Hydrogen atom wikipedia , lookup
Quantum electrodynamics wikipedia , lookup
Coherent states wikipedia , lookup
Quantum dot wikipedia , lookup
Density matrix wikipedia , lookup
Bell test experiments wikipedia , lookup
Path integral formulation wikipedia , lookup
Copenhagen interpretation wikipedia , lookup
Probability amplitude wikipedia , lookup
Measurement in quantum mechanics wikipedia , lookup
Quantum fiction wikipedia , lookup
Symmetry in quantum mechanics wikipedia , lookup
Many-worlds interpretation wikipedia , lookup
Orchestrated objective reduction wikipedia , lookup
Quantum entanglement wikipedia , lookup
Bell's theorem wikipedia , lookup
History of quantum field theory wikipedia , lookup
Quantum group wikipedia , lookup
Interpretations of quantum mechanics wikipedia , lookup
Quantum computing wikipedia , lookup
EPR paradox wikipedia , lookup
Quantum machine learning wikipedia , lookup
Quantum cognition wikipedia , lookup
Quantum state wikipedia , lookup
Hidden variable theory wikipedia , lookup
Canonical quantization wikipedia , lookup
Quantum Turing Test Elham Kashefi Feynman Vision - 82 Quantum Computing as the technology for simulating quantum systems Spectacular Progress from complexity theory to cryptography from simulation to sampling from tomography to implementation from foundation to interpretation proving what we are actually performing and observing is indeed quantum Quantum Algorithms - Speed Up Superpositions Non-local Correlations Interference &'()*'+,(-./01*2+3 4-(3315(-,67*70+1)13*158 $;<=; !"#"$% 4-(3315(-,90/:(:1-13*158 9C 9E $;<=; 9D !"#"$% &'()*'+8 !C !E $;<=; !D >?$";"@A #AB<;"@A !"#"$% ! Deutsch’s problem Quantum Algorithms - History 1985 - Deutsch-Jozsa demonstrated the first speed up a boolean function f : {0, 1}n ! {0, 1} determine if it is constant or balanced nput:Given A boolean function Output: Determine if f is constant or balanced Deutsch’s problem Uf : |xi(|0i s ✓ ⇢ 1 |1i)X if f (x) =f (x) |xi(|0i 0 |1i) ! |f i = p |xi(|0i2n |1i) if f((x)1)= 1 |xi ◆ x2{0,1}n 0 1 ✓ ◆ X X 1 • |f i for any |0i constant |1i 1 |0i |1i corresponding function is orthogonal to the f (x) @ A p p Uf : p n |xi ! p n ( 1) |xi 2balanced 2 2 x2{0,1} 2 constant The state for any function is orthogonal to staten for any function. x2{0,1}n the state for any balanced function • Measurement on |f i which distinguishes balanced from constant X 1 Hn : |xi ! p n ( 1)x·y |yi 2 y2{0,1}n Deutsch’s problem Quantum Algorithms - History 1985 - Deutsch-Jozsa demonstrated the first speed up Simo a boolean function f : {0, 1}n ! {0, 1} determine if it is constant or balanced nput:Given A boolean function Suppose we are given function 2 − 1 f : {0, 1 Output: Determine if f is constant or balanced Simon’s Algorithm there is an a ∈ {0, 1}n with a $= 0n such that 1994 - Simon’s Problem all f (x +with a) =thef (x). we are given function 2 − 1 f : {0,⇢ 1}n → {0, 1}n , specified byFor a black promise that Given a function finds a •such thatx box, |xi(|0i |1i) if f (x) = 0 |1i) that ! f : |xi(|0i a ∈ {0, 1}n Uwith a $= 0n such |xi(|0i |1i) if f (x) = 1 • If f (x) = f (y) then either x = y or y = s all x f (x + a) = f (x).✓ X ◆ 0 Breakthrough X 1 ✓ ◆ 1 |0i |1i 1 |0i is |1ito determine a. It should The f (x) challenge @ A p p Uf : p n |xi ! p n ( 1) |xi (x) = f (y) then either x = y or y = x + a. 2 2 x2{0,1}n 2 x2{0,1}n (probabilistic) 2computer. This is because the such that f (x) = f (y). And the best an algorit 1994be- Shor’s Period enge is to determine a. It should intuitively clearFinding that thisProblem is a difficult task for a classical birthday paradox (actually its converse), the stic) computer. This is because cannot determine a until the it finds two inputs x and y n/2 Given an n-bit integer,the findalgorithm the prime factorisation. Breaks RSA cryptosystem 2 inputs. By contrast, we will show an effi f (x) = f (y). And the best an algorithm can do is try random inputs x until it finds a match. By the 1. Use fiftof set up random pre-image state aradox (actually its converse), the chance of this is negligible is probed on many fewer than s. By contrast, we will show an efficient quantum algorithm. φ = 1/ Quantum Algorithms - History The Zoo - Stephen Jordan - 175 papers http://math.nist.gov/quantum/zoo Buchman-Williams cryptosystem Elliptic curve cryptography Algebraic and Number Theoretic Algorithms Exponential Speed Up: Factoring, Discrete-log, Pell's Equation, Principal Ideal, Unit Group, Class Group, Gauss Sums, Matrix Elements of Group Representations Oracular Algorithms Broad Application: Unstructured Search, Amplitude Amplification, Collision Finding, Hidden subgroup Problem, Formula Evaluation, Linear Systems, Group Isomorphism, Network Flows Approximation and Simulation Algorithms Inspired by Physic : Quantum Walk, Quantum Simulation, Knot Invariants, Partition Functions, Adiabatic Optimization, Simulated Annealing Quantum Algorithms - Perspective Quantum Simulators One controllable quantum system to investigate another, less accessible one tackling problems that are too demanding for classical computers Ultracold quantum gases, Trapped ions, Photonic, Superconducting circuits Refuting the Strong Church-Turing Thesis Our communication today is secure only if we cannot build a large scale quantum computer Quantum Cryptography - Security Quantum cryptography relies on the laws of quantum mechanics to offer unconditional security Measurement perturbs the system Uncertainty Principles No Cloning No perturbation No measurement No eavesdropping Quantum Cryptography - History Wiesner 1983 The first link between secrecy and quantum physics quantum money Bennett and Brassard 1984, Ekert 1991 Public key distribution problem Cleve, Gottesman and Lo, 1999; Crepeau, Gottesman and Smith, 2005 Quantum Secret Sharing Quantum Cryptography - History Lo, Chau, Mayers 1997 Impossibility of quantum bit commitment Damgaard et al., 2005, 2007; Wehner, Schaffner and Terhal, 2008 New paradigms of bounded-storage models Gottesman and Chuang 2001 Quantum digital signature Kitaev 2003, Chailloux and Kerenidis 2009 Perfect quantum coin flipping is impossible, but better than classical protocols exist Broadbent, Fitzsimons and Kashefi 2009 Unconditionally secure quantum delegated computation Quantum Cryptography - Perspective Quantum Key Distribution Networks SECOQC: 2008, 200 km of standard fibre optic cable to interconnect six locations across Vienna and St Poelten Quantum Cryptography - Perspective Quantum Key Distribution Networks DARPA: 10-node, has been running since 2004 in Massachusetts BBN Technologies, Harvard University, Boston University and QinetiQ Tokyo QKD Network: 7 partners NEC, Mitsubishi Electric, NTT and NICT, Toshiba Research Europe Ltd. (UK), Id Quantique (Switzerland) and All Vienna China and Austria Earth - Satellite QKD Secure Cloud Computing How to make cloud computing safe? A model for enabling convenient, on-demand network access to a shared pool of configurable computing resources X Y Limited Client Untrusted Server Y F(X) F(Y) F(Y) Secure Cloud Computing Rivest, Adleman and Dertouzos 1979 Can we process encrypted data without decrypting it first ? Fully homomorphic encryption Classical: Gentry 2009 Only computational security assumption of limited computational power of the adversary Quantum: Broadbent, Fitzsimons, and Kashefi 2009 Unconditional security Qcomputing + Qcryptography = Blind Q Computing Classical Communication Classical Computer random single qubit generator Unconditional Perfect Privacy Server learns nothing about client’s computation Dan E. Browne†1 my, University College London, E 6BT, United Kingdom. 8, 2008) Measurement-based Quantum Computing ntangled states exploited in measurement-based of the classical computer that controls the meanal resource power, leading naturally to a notion Program is encoded in the classical control computer computation. Surprisingly, the Greenbergerroblems emerge naturally as optimal examples. Computation Power is encoded in the entanglement n the violation of local realistic models and the control controlcomputer computer measurement measurement site sites resource resource state state FIG. 1: The control computer provides one bit of classical information (downward arrows) to each site (circles in the resource state) determining the choice of measurement basis. After the measurement, one bit of classical information (upward arrow), such as the outcome of the binary measurement, Hide • Angles of measurements • Results of Measurements is measurements. If we were to H J( + ⇥ + r⇤) use this principle for blind quantum Computation computing, Alice would have to reve Protocol 1 Universal Blind Quantum to reveal information about the 2. Bob’s preparation ✓ ◆ structure of the underlying graph state. We introduce a new family of st niversal Blind Quantum Computation y of states called the brickwork |± ⇧ 1. Alice’s +⇥+r⇤preparation 1Y plane measurements and J( + ⇥ +1) r⇤)which are universal s+r states (Figure for X − screates 2. .{0, 1} ;an X entangled J(↵) nts and each thus do not require the 2.1 Bob state from all ⇤r paration For column x = 1, . , n 1 initial computational basis Other universal graph states P measurements. Universal Blind Quantum Computings states for that do not require ⌫ iθ1, x,y {|+ ⇧} umn x = . . . , n p(⌫) Tr (Pincorrect B(⌫)) ✏ in the ⇤r For each row y = 1, . . . , m ⇥ applying ctrl-Z gates between qubits (|0! + e |1!) | θ = 0, π/4, . . . , 7π/4} and sends ⌫ initial computational basis measurements have appeared [CLN05]. x,y 5]. ✓ ◆ ! " i↵1 w y = 1, . . . , m iθthat x,y ! To best of our knowledge, this is the first time a new functio √ unctionality has beenDefinition achieved |+⇥the ⌥ prepares 1 (e 1.1 Alice |ψ ! ∈ { + = (|0! + e |1!) | θ = 0, 1). x,y R x,y θ ! " x,y 0 1 2 due to MBQC appear in |+to X = ( Ũ , {⌅ }) 1 iθ ⇥ ⌥MS08]). x,y x,y thanks MBQC (other theoretical advances ! ear in [RHG06, From i↵ | θx,y = 0, π/4, . . . , 7π/4 repares the |ψx,yqubits ! ∈R {to+Bob. |1!) θx,y =1 √2 (|0! + 1e e as tremendous potential for of the a conceptual point view, shows that MBQC has trem 3. Interaction and measurement B Cour contribution 1 0 B C bits to Bob. |± ⌥ ✓ |± ⌥ +⇥+r⇤ ✓ +⇥+r⇤ development of new protocols, and maybe even of algorithms. 2.allBob’s preparation @ A 1 received qubits, according to their indices, For each column x = 1, . . . , n by paration 1.3 Outline of Protocols 1 y = state 2.1in Bob creates an entangled from all received qubits, acco ubits order to create a brickwork state G (see n×m For each row 1, . . . , m {|+ ⌥} ⇥ {|+ ⌥} ⇥ quantum computation given as eates anapplying entangled state from all received qubits, toa quant their ctrl-Z gates between qubits inaccording order to create ab The outline of the main is◆as "the follows. Alice has in mind random single qubit generator ✓protocol ✓ ◆ X Z i↵ i↵ : preparation and computation. where s = s = 0. 3.1 Alice computes 1qubits e inφorder 1There e0,y √= ! (Ũbetween " ng ctrl-Z gates the to create a brickwork stat Definition 1). a measurement pattern on a brickwork state. are two stages: prepa 1 1 x,y 0,y X , {⌅ }) iθ |1# | x,y +2 mly from {1/ 2 |0# + e i↵ i↵ 2 e 1 e 1 In X the=preparation stage, Alice prepares single qubits chosen randomly fr ion 1). ( Ũ , {⌅ }) x,y 3.2 Alice chooses r ∈ {0, 1} and computes 3.g all Interaction and measurement the qubits, Bob entangles x,y R θ = 0, π/4, 2π/4,s.X . . , 7π/4}Z and sends them to Bob. After receiving all t x,y ⌅column = ( 1) ⌅the s,x,y ⇤ ✓ ◆ reveals upper on x,y. + For them each x = 1, . . n ny and measurement x,y bounds according toX thetransmits brickwork state. Note that this unavoidably reve 3.3 Alice δ to Bob. Bob measures 1 x,y s J(↵) e length of the input and depth s1, Z For each row y = . . . , m umn xdimensions = 1, . . . , n s 2 {0, 1} ; X x,y of Alice’s underlying graph state, that correspond to the lengt ⌅ = ( 1) ⌅ + s ⇤ x,y x,y x,y 1 = 0. k state, it does not reveal 3.4 Bob transmits the result s ∈ {0, 1} to A ⌅R {0, 1} any x,y " X Z w y3.1 =of1,Alice .the . .r,x,y m computation. However, to where due s0,y = universality s0,y ◆= 0. of the brickwork stat computes φfor " stage involves interaction: ✓ x,y utes δadditional + If θ!x,yrXx,y + πr . i↵ 3.5 = 1 above, Alice flips s ; otherwise x,y =" φx,y x,y information on Alice’s computation. The computation stage Z x,y 1 (e " ! " " ical 3.2 message to Bob to tell him where s = s = 0. omputes φ Alice r0,y ∈R0,y {0, 1} and computes δx,y = φx,y + θ!x,y + π x,y⌅chooses r {0, 1} x,y x,y R ! ! i↵ each layer of the for1 eache qubit, Alice sends a classical m " sures in the basis { +brickwork , −state, performs the measurement and δx,y δx,y }. " !+perfor hooses rAlice {0, 1} and computes δBob =measures φx,y +.. θ!x,y + πr . x,y ∈Rtransmits x,y x,y 3.3 δ to Bob. in the basis { x,y in which basis of the X − Y plane he should measure the qubit. Bob " ! " δx,y ds will depend on these values. . to Alice. ! ! 3.4 Bob transmits the result s ∈ {0, 1} to Alice. communicates the outcome; Alice’s choice of angles in future ransmits δ to Bob. Bob measures in the basis { + , −δrounds }. will x,y x,y utely chosen so that, no matter δ := s + r x,y x,y x,y x,y rwise shesx,y does nothing. The universality of Protocol 1 follows from the Alice’s classical messages astutely c 3.5Importantly, Ifthe =is1computing above, Alice sx,yand ; otherwise she doesare nothing. pattern. If rAlice ansmits result sx,y ∈ quantum {0, 1} flips tostates Alice. x,y ame as a measurement in the |+φ+θ ! , |−φ+θ ! basis on Z(θ) |ψ! (see Appendix A), and since + θ + πr, if r = 0, Bob’s measurement has J( the + ⇥same + r⇤)effect as Alice’s target measurement; if all Alice needs to do is flip the outcome. ⇥r now define and prove the security of the protocol. Intuitively, we wish to prove that whatever Blindness chooses to do (including arbitrary deviations from the protocol), his knowledge on Alice’s um computation does not increase. Note,|+ however that Bob does learn the dimensions of the ⇥⇧ work state, giving an upper bound on the size of Alice’s computation. This is unavoidable: ple adaptation of the proof of Theorem|±2 +⇥+r⇤ from ⇧[AFK89], confirms this. We incorporate otion of leakage in our definition of blindness. A quantum delegated computation protocol protocol by which Alice interacts quantumly {|+⇥ ⇧}with Bob in order to obtain the result of a utation, U (x), where X = (Ũ , x) is Alice’s input with Ũ being a description of U . Protocoldelegated P on input leaks most X = (Ũ , {⌅on nition 2. Let P be a quantum computation input X at and let L(X) be any function x,y }) input. We say that a quantum delegated computation protocol is blind while leaking at most Given distribution of classical information in if, on Alice’s input X, for any2.fixed Y =the L(X), the following two hold when givendescribed Y: information by Bob independent of of X. obtained by Bob obtained in P is fixed andisindependent ➡ The distribution of the classical he distribution of the classical information obtained by Bob in P is independent of X. Definition 2 captures the intuitive notion Bob’s view of 2. Given the distribution of classical information described in 1, the statethat of the quantum sy The quantum is fixed fixed andgiven independent of X. (when Y his view consists of classical and quant ➡ obtained by Bob state in P is and independent of 5 ); since distribution of the classical information should not depend on Definition 2 captures the intuitive that Bob’s view of the protocol dependsyo choice notion of the classical information, the stateshould of the not quantum (when given Y ); since his view consists of classical quantum information, this means tha and not depend on Xand (given Y ). We are now ready to state distribution of the classical information should not depend X dimension (given Y ) and that for any that in Protocol 1, (n, m) isonthe of the brickwork choice of the classical information, the state of the quantum system should be uniquely determ and not depend on X (given Theorem Y ). We are3now ready to state and prove theorem. (Blindness). Protocol 1 is our blindmain while leaking R a that in Protocol 1, (n, m) is the dimension of the brickwork state. Proof. Let (n, m) (the dimension of the brickwork state) be Theorem 3 (Blindness). Protocol 1 is blind while leaking atthat mostBob’s (n, m). the brickwork state guarantees creating of the gra Quarter/Half-wave Plate BBO crystal Polarization Controller Experimental Implementation Polarizing Beam Splitter Filter Barz, Kashefi, Broadbent, Fitzsimons, Zeilinger, Walther, Science 2012 4 1 a c b d 2 3 2 3 Alice Bob Experimental Implementation Client: limited computational power Quantum server: full power of Quantum Computation Entangles qubits Prepares random qubits Measurement instruction for server Initial rotation of the qubit Target rotation Computes measurement angles Random bit flip Experimental Implementation Client: limited computational power Quantum server: full power of Quantum Computation Entangles qubits Prepares random qubits Y X Measurement in X-Y plane Computes measurement angles Decryption: Output 1 1 0 of the computation 0 Z 0, 1 Quantum Cloud Quantum computing could head to 'the cloud', study says Girls lock-up quantum security Almost as intriguingly, the research has been carried out by a team three of them being women. The Blind Quantum Security Eschaton Quantum computers "can decrypt any non-quantum method near-instantly, in theory, rendering all existing forms of encryption obsolete," Enderle pointed out. "This will make the concerns surrounding Iran's nuclear efforts seem trivial by comparison if a [foreign] country gets there first." Blind Q Computing World CC Other approaches D. Aharonov, M. Ben-Or, and E. Eban, ICS 10 (2010) A. Childs, Quant. Inf. Compt. (2005) P. Arrighi and L. Salvail, Int. J. Quant. Inf. (2006) Approximate Protocol Dunjko, Kashefi, Leverrier, PRL, 2012 Robust Protocol Morimae, Dunjko, Kashefi, arXiv:1009.3486 Morimae, Fujii, Nature Communications, 2012 Morimae, PRL, 2012 Minimal Protocol Dunjko, Kashefi, Markham Composable Protocol Dunjko, Fitzsimons, Portmann, Renner, arXiv:1301.3662 (2013) Other Models Datta, Kapourtionis, Kashefi, One-clean qubit Still requires 2n parameters for a classical computer to simulate it Big Picture How do we verify the Solution ? BQP NP Can we verify it with a classical Computer ? BPP Blind Computation with BPP* Alice Not all the problem in NP can be computed blindly with a BPP Alice • Abadi, Feigenbaum and Kilian The Ultimate Challenge Quantum Verification Should we pay $10000000 for a quantum computer That kind of tests work only for a specific problem. We don’t know if all the questions that quantum computer can solve are classically testable Simple test: We ask the box to factor a big number Exponential World Hilbert space is a huge place. What makes quantum not classical makes its verification not classical either n particles = 2n parameters Quantum Turing Test |± Proof System +⇥+r⇤ ⌦ {|+⇥ ⌦} X = (Ũ , {⌅x,y }) sX x,y Verifier ⌅x,y = ( 1) ⌅x,y + Prover Z sx,y ⇤ rx,y ⌥R {0, 1} Yes X satisfies some property ⇥x,y ⌥R {0,NP· ·- ·problems , 7⇤/4} sx,y := sx,y + rx,y |± Interactive Proofs +⇥+r⇤ ⌦ {|+⇥ ⌦} All problems X = (Ũ , {⌅x,y }) sX x,y Verifier ⌅x,y = ( 1) ⌅x,y + Prover Z sx,y ⇤ rx,y ⌥R {0, 1} Prover can cheat with exponentially small probability Yes X satisfies some property ⇥x,y ⌥R {0, · · · , 7⇤/4} sx,y := sx,y + rx,y {|+⇥ ⌦} Can we Classically test Quantum Mechanics ? X = (Ũ , {⌅x,y }) Classical Verifier ⌅x,y = ( sX x,y Z 1) ⌅x,y + sx,y ⇤ Quantum Prover rx,y ⌥R {0, 1} Yes X satisfies some property ⇥x,y ⌥R {0, · · · , 7⇤/4} Gottesman (04) - Vazirani (07)- Aaronson $25 Challenge (07) Does every language in the class BQP admit an interactive protocol s := s +r where the prover is in BQP BPP? x,yand the verifier x,y is in x,y Verification • Correctness: in the absence of any interference, client accepts and the output is correct • Soundness: Client rejects an incorrect output, except with probability at most exponentially small in the security parameter Fitzsimons and Kashefi, arXiv:1203.5217, 2012 um Authentication m = 2d + 1. In this case, the code can detect d errors. Also, Ck is self dual [BOCG+ 06], namely, the cod is equal to the dual code subspace. si si Z Z Eons = Mi J( )vs ZiAuthentication = Xj Mi J( ij Verification ) Eij uantum Authentication + CG adapted 02]).from A quantum Barnum authentication et. al. [BCG+scheme 02]). A(QAS) quantum is aauthenticatio pair of efinitions ther quantum with aalgorithms set of|⌅⌥ classical A and keys B together KEve such that: with a set of classical keys K suc + n 3.1 (adapted from Barnum et. al. [BCG 02]). A quantum authentication scheme (QAS) is a pair o Alice Bob eal (QAS) is algorithms a pair ofA and B together with a set of classical keys K such that: time quantum sMinput and an a key m-qubit k ∈ Kmessage and outputs system a transmitted M and a keysystem k ∈ KTand of m outputs +d at akes as input an m-qubit a transmitted system T of m + Z(⇥ message) system M and a key k ∈ K and outputs Detect error bits. d system T of m + d # # # k ∈ K and outputs two systems: akes as input the (possibly altered) transmitted system T a classical Crepeau, Gottesman, Smith and Tapp, tted input system the (possibly T and aaltered) classical transmitted key k ∈ and KBarnum, system and outputs Tkey and two a classical systems: key aFOCS02 k∈ qubit message state M , and a single qubit V which indicate whether the state is considered valid or erroneou J(⇥) message which indicate Mcalled , and whether single the state qubit Vfixed considered which indicate valid whether or erroneous. the state isb eVbasis statesstate of V are |V a AL$ , |ABR$. For ais k we denote the corresponding super-operators utputs a denote and BkFor . two BR$. states of aVsystems: fixed are called k we |V AL$the , |ABR$. corresponding For a fixed super-operators k we denote the by cor ed. valid or erroneous. ka pure state |ψ$, consider the following test on the joint system M, V : output a 1 if the first m qubits are i ng sby or ifsuper-operators the last qubit is in state i |ABR$, otherwise, output 0. The corresponding projections are: |ψ$ eeststate on the |ψ$,joint consider following 1 if the joint first system m qubits M,are V :inoutpu(2 P1 system = the |ψ$ M, %ψ| ⊗VIV :+output (IM test − |ψ$aon %ψ|) ⊗ the |ABR$ %ABR| ⇤ otherwise, ⌅ projections |ψ$ e wise, last qubit output is 0. in The state corresponding |ABR$, output are: 0. The corresponding pr P = (I − |ψ$ %ψ|) ⊗ |V AL$ %V AL| (3 M 1 e first m qubits0 are in ⌥ are: me is secure if for all possible input states |ψ$0and for all possible interventions by the adversary, the expecte |ψ$ 1 1 ⌥ ⇤ ⇤ |ψ$ (|00⌥ + |11⌥) = + (I − |ψ$ P %ψ|) = ⊗ |ABR$ |ψ$ %ψ| %ABR| ⊗ I + (I − |ψ$ %ψ|) ⊗ |ABR$ (2) %ABR VB’s output Mto the space V M defined by P is high: 1 12 ⇧ ⌃ 2 0 ly(n) length uniformly at random. The map from k to the group element represented as a product of Cliffo ' um Authentication mnerators = 2d +can 1. be In computed this case, the code canpolynomial detect d errors. in classical time. Also, C is self dual [BOCG 06], namely, the cod + k |k · f (α ). . .k · f (α )$ 1 1 m m is equal to the dual code subspace. T raux [U ⇤ I ⇥ J(⇤in ⇥ ⇤aux0 )I † † ⇥ J ⇤ U ] |0 s Z ci ⇤(0)=a ⇥ |+⌥⌃+| ) E P out = POcPEG (⇤ in V rI G O def (f )≤d,f J( ) E † ]= Mi J( ) Zi ij 2ons Signed Polynomial Codes i 0 = T r [U (⇤ ⇥ ⇤ )U Verification aux vs Authentication in aux = si Xj (1) Z Mi uantum Authentication r background on polynomial quantum codes see Appendix+A. + + an detect d errors. Also, C is self dual [BOCG 06], namely, theofcode k al. [BCG scheme CG adapted 02]).from A quantum Barnum authentication et. 02]). A (QAS) quantum is a authenticatio pair † † |+ m 0 )I swith T+r06]) [U ⇤ I ⇥ J(⇤ ⇥ ⇥ J ⇤ U ] i ⇤aux aux in efinition 2.3 ([BOCG The signed polynomial code respect to a string k ∈ {±1} (denoted Ck ) i efinitions P = M Z |⌅⌥ Eve ther with aalgorithms set of classical Aiand keys B together K such with a set of classical keys K suc i i that: † : quantum +⇤ ' 0 )U ] r [U (⇤ ⇥ n 3.1 (adapted= from T Barnum et. al. [BCG 02]). scheme (QAS) is a pair o aux in auxA quantum authentication $ % 1 def Alice Bob k $Sa = & eal (QAS) is a pair of |k1 · f (αkeys · f (α 1 ). . .k m )$ time quantum algorithms A and B together with a set of classical Kmsuch that: d q fsystem sMinput and an a key m-qubit k |+ ∈ Kmessage and outputs a transmitted M and a keysystem k ∈ KTand of m outputs +d at :def (f )≤d,f (0)=a s s ik ∈ K i |+ s akes as input an m-qubit message system M and a key and outputs a transmitted system T of m + i P E = M X E X Z(⇥ ) ij ij i detect i j j Detect error[BOCG+ 06], namely, P = M Z e use m = 2d + 1. In this case, the code can d errors. Also, C is self dual k i i i bits. d system T toofthemdual +code d subspace. bspace is equal # # # k ∈ K and outputs two systems: akes as input the (possibly altered) transmitted system T a classical tted input system the (possibly T and aaltered) classical transmitted key k ∈ and Ksystem and outputs Tkey andtwo a classical systems: key a k∈ |0 message state M , and |+ si s whether si the state qubit a single qubit V which indicate considered valid or erroneou Z Zsi is i P J( ) E = M J( ) Z = X M J( ) E J(⇥) message V which state indicate M , and whether a single the state qubit is V considered which indicate valid whether or erroneous. the state is ij ij i i P E = M X E X Quantum Authentication i i j e basis states of V are called |V AL$ , |ABR$. For a fixed k we denote the corresponding super-operators b ij ij i i j j + systems: a utputs two and B . [BCG 02]). A quantum authentication is a the pair of kFor BR$. states of aV fixed are called k we denote |V AL$ the , |ABR$. corresponding Forscheme a fixed super-operators k(QAS) we denote by cor 1 valid Definitions ed or erroneous. together with a settheoffollowing classical K system such M, that: Eve = Server test onkeys the joint V : output a 1 if the first m qubits are i ka.pure|0state |ψ$, consider + siTheAcorresponding si authentication Z efinition 3.1 qubit (adapted fromby Barnum otherwise, et. al.|⌅⌥ [BCG 02]). quantum ng Client or ifsuper-operators the last is in state |ABR$, output 0. are:E (QAS) is a i J( )scheme P J( ) E = M J( ) Z = X M Zsprojections ij i K such that: ij i time quantum algorithms i a set of classical j lynomial A iand B together with keys stem and a|ψ$key k the ∈ M, Kfollowing and outputs aon transmitted system Tare of :m +d eest state onMthe |ψ$, joint consider system V : output test a 1 if the the joint first system m qubits M, V in outpu P1an m-qubit = |ψ$message %ψ| ⊗ IVsystem + (IMM−and |ψ$a%ψ|) |ABR$ (2 • A takes as input key ⊗ k∈ K and%ABR| outputs a transmitted system T o ⇤ ⌅ |ψ$ e wise, last qubit output is 0. in The state corresponding |ABR$, otherwise, projections output are: 0. The corresponding pr qubits. P = (I − |ψ$ %ψ|) ⊗ |V AL$ %V AL| (3 M 1 e first m qubits0 are in Z(⇥U|⌅⌥) Detect error # # ⌥ • isBsecure takes as input (possibly altered) transmitted system T and a classical key k ∈ K and outputs two a sy are: me ifsystem for allthe possible input states |ψ$ and for all possible interventions by the adversary, the expecte nsmitted T and a classical key k ∈ K and outputs two systems: 0 |ψ$ 1 1 ⌥ ⇤ ⇤ |ψ$ m-qubit message state M , and a single qubit V which indicate whether the state is considered valid or er (|00⌥ + |11⌥) = + (I − |ψ$ P %ψ|) = ⊗ |ABR$ |ψ$ %ψ| %ABR| ⊗ I + (I − |ψ$ %ψ|) ⊗ |ABR$ (2) %ABR VB’s output Mto the space V M defined by P is high: 1 ⇧0super-oper ⌃ 1 ubit which whether the state considered valid or2 erroneous. TheVbasis states indicate of V are called |V AL$ , |ABR$. For a2isfixed k we denote the corresponding X s Z ⇤ ⇥x,y ⌥R {0, · ·⌅· |0⌦, , 7⇤/4} x,y ⌅ |1⌦ = ( 1) + s x,y x,y x,y Adding Traps BPP ⇧ QNC sx,y := sx,y +rrx,y x,y⌥RNC {0,2 1} ⇧ QNC1 |+⇥ ⌦, | ⇥⌦ Measurements ⇥x,y ⌥Trap · · · , 7⇤/4} R {0, |0⌦, |1⌦ ⇥ |+ ⌦ ⌃ s = 0 M QNC ⇥ BPP ⇧s := s + r x,y x,y 2 1 x,y NC ⇧ QNC M ⇥| ⌦ ⌃ s = 1 ⇥ |+⇥ ⌦, | ⇥⌦ |0⌦, |1⌦ M ⇥ |+⇥ ⌦ ⇥ M | |0⌦, |1⌦ ⇥⌦ BPP ⇧ QNC Trap 2 1 positions and NC ⇧ QNC Measurement angles 3 |+ ⌦, | ⌦ ⇥ ⇥ ⌃ s=0 remain hidden M ⇥ |+⇥ ⌦ ⌃ s = 0 ⌃ s=1 ε-Verification pting an incorrect outcome density operator. Any outcome density operato or is contained within the subspace of correct and incorrect outcome state Aliceprojected intoBob any server’s strategy the intuitiv obabilistically a correct or anFor incorrect state. Hence probability of client accepting an P ⌫ to be verifiable if the corresponding outcome state is far from any inco ⌫ . incorrect outcome density p(⌫) Tr (Pincorrect B(⌫)) ✏ random parameters 9. ⌫ . lowing the approach .of [28], we first define the notion of correctness operator is bounded by ε: ⌫ n 8. Let Pincorrect beB(⌫) the projection onto the subspace of all the possible inc density operatorof of classical and random quantum output erator for the fixed choice Alice’s variables denoted with ⌫, that i ⌫ Pincorrect = (I | ⌫ ideal i h ⌫ ideal |) ⌦ |rt⌫ i hrt⌫ | ⌫ Accept Key ch i h | = T r (B (⌫)). Let p(⌫) be the probability of Alice 0 i62{O[{t}} deal ideal parameterized by ⌫, that is the probability of choosing a position i amo P ⌫ the graph to be the trap⌫ position as a random variable t) and p(⌫) Tr (P(denoted incorrect B(⌫)) ✏ g random variables , r, x, ✓ (as defined in Definition 6). Given 0 ✏ < o be ✏-verifiable, if for any choice of Bob’s strategy (denoted by j) the prob Verification with single trap Theorem. Protocol is (1 − 1/2N)-verifiable in general, and in the case of purely classical output it is (1 − 1/N)-verifiable, where N is the total number of qubits in the protocol. Probability Amplification To increase the probability of any local error being detected O(N) many traps in random locations To increase the minimum weight of any operator which leads to an incorrect outcome Fault-Tolerance P P1 H P= MComp Challenge: Traps break the graph 2. 1. 5. 2. Y 5. Y Y Y Z P H Z Z MComp P= Z Z Z MReduce MComp Z Z = K̃5 2. Y Z Z Y Z Z 3. Z Y Z Z MReduceZ Z Z Z ZZ Y Z Z Z ZZ Z Z MP Z MReduce P1 Z M6. P Z Z P1 7. Z Z MA MA Z Z 7. P2 Z Z MP MP Z Z Z K̃5 P3 Z Z Z Z P3 Z Z Z Z Z P3 4. 3. Required 3D lattice for Raussendorf, Harrington Topological Z and Goyal Z error-correcting Z Z code with defect Z Zthickness Z d Z Z 6. MP K̃5 4. Z Z Z Z Y 3. Z Z Y Z Z Z Y K̃5 P K̃5 3. Y P1 Y P 6. P MReduce Z Z P1 6. Y Z Y 2. P1 Z Y H = MComp Probability Amplification 1. H P3 Z Z P3 Probability Amplification K̃15 P3 6. K̃5 K̃5 P1P1 P2 P 2 MP K̃15 P3 P3 K̃5 K̃5 7. K̃5 P2 Probability Amplification MP K̃5 P3 7. M tocol 8. In this figure we replace the Raussendorf-Harringtona simpler computation, as to include a full encoding yields Off to Vienna P3 7. M What can we do with 4-qubits 2 FIG. 1: Concept of a quantum prover interactive proof system based on blind quantum computing. The verifier wants to find out if the prover can indeed perform quantum computations. While the question if a classical verifier can test a quantum system is still open, it was shown that a verifier that has access to certain quantum resources can verify quantum computations. Here, in the framework of blind quantum computing, the verifier needs the ability to generate single qubits and to transmit them to the prover. After the transmission of the qubits, the verifier and the prover exchange two-way classical communication. Restricting to Classical Input and Output trapification trapification A Complete new proof of verification was required Pauli ( i ) C ⌦C ⌦C ⌦C C ⌦C ⌦C ⌦A C ⌦C ⌦A⌦C C ⌦C ⌦A⌦A C ⌦A⌦C ⌦C C ⌦A⌦C ⌦A C ⌦A⌦A⌦C C ⌦A⌦A⌦A A⌦C ⌦C ⌦C A⌦C ⌦C ⌦A A⌦C ⌦A⌦C A⌦C ⌦A⌦A A⌦A⌦C ⌦C A⌦A⌦C ⌦A A⌦A⌦A⌦C A⌦A⌦A⌦A Trap Stabilizer Measurement X ⌦I⌦Y ⌦Y Y ⌦X ⌦X ⌦Y Y ⌦Y 3 3 7 7 7 7 3 3 3 7 7 3 7 3 3 7 7 7 3 3 3 3 7 7 7 3 3 7 3 7 7 3 Overall ⌦I⌦X 3 7 3 7 7 3 7 3 7 3 7 3 3 7 3 7 3 7 7 7 7 7 7 7 7 3 7 7 7 7 7 7 Table 4: Pauli terms in the deviation operator U and whether or not they are detected by a particular trap setup or not. Although there are 256 distinct 4-qubit Pauli operators, including the identity, these can be grouped into 16 Summery Only 4 qubit computation can be verified and a particular type of attack cannot be detected ! What about D-Wave Problem Verification of 2-qubit entanglement Blind Verification of Entanglement Blind Verification of Entanglement Barz, Fitzsimons, Kashefi, Walther, Nature Physics 2013 Quantum Turing Test We can test efficiently a quantum computer But we need quantum randomness Perspective What is the lower bound Model independent Verification Is Nature Classically verifiable Quantum Turing Test Quantum Zero-Knowledge Proof; Adiabatic UBQC; BBP vs BQP theory Unconditionally Secure Cloud Computing; Hybrid Quantum-Classical Homomorphic Encryption Efficient Process Tomography;Testing Commercial Qubits with Scientific Qubits Blind Bell Test; Blind Contextuality Test; Distinguishing Relativistic Effects from Quantum Effects theory practice practice UBQC with superconducting qubits Computational lab lab UBQC and Verification Implementation with Photonic Qubits and Coherent Pulses Interactive Proof Quantum Turing Test Blind Trapification Measurement-based QC Physical