Download Quantum Turing Test

Quantum Turing Test
Elham Kashefi
Feynman Vision - 82
Quantum Computing as the technology for simulating quantum systems
Spectacular Progress
from complexity theory to cryptography
from simulation to sampling
from tomography to implementation
from foundation to interpretation
proving what we are actually performing and observing is indeed quantum
Quantum Algorithms - Speed Up
Superpositions
Non-local Correlations
Interference
&'()*'+,(-./01*2+3
4-(3315(-,67*70+1)13*158
$;<=;
!"#"$%
4-(3315(-,90/:(:1-13*158
9C
9E
$;<=;
9D
!"#"$%
&'()*'+8
!C
!E
$;<=;
!D
>?$";"@A
#AB<;"@A
!"#"$%
!
Deutsch’s problem
Quantum Algorithms - History
1985 - Deutsch-Jozsa demonstrated the first speed up
a boolean
function f : {0, 1}n ! {0, 1} determine if it is constant or balanced
nput:Given
A boolean
function
Output: Determine if f is constant or balanced
Deutsch’s problem
Uf : |xi(|0i
s
✓
⇢
1 |1i)X if f (x) =f (x)
|xi(|0i
0
|1i) ! |f i = p
|xi(|0i2n |1i) if f((x)1)= 1 |xi
◆
x2{0,1}n
0
1
✓
◆
X
X
1 • |f i for any
|0i constant
|1i
1
|0i
|1i corresponding
function
is
orthogonal
to
the
f (x)
@
A
p
p
Uf : p n
|xi
! p n
( 1)
|xi
2balanced
2
2 x2{0,1}
2 constant
The
state for any
function is orthogonal
to
staten for any
function.
x2{0,1}n
the state for any balanced function
• Measurement on |f i which distinguishes balanced from constant
X
1
Hn : |xi ! p n
( 1)x·y |yi
2 y2{0,1}n
Deutsch’s problem
Quantum Algorithms - History
1985 - Deutsch-Jozsa demonstrated the first speed up
Simo
a boolean
function f : {0, 1}n ! {0, 1} determine if it is constant or balanced
nput:Given
A boolean
function
Suppose we are given function 2 − 1 f : {0, 1
Output: Determine if f is constant or balanced
Simon’s Algorithm
there is an a ∈ {0, 1}n with a $= 0n such that
1994 - Simon’s Problem
all
f (x +with
a) =thef (x).
we are given
function
2 − 1 f : {0,⇢
1}n → {0, 1}n , specified
byFor
a black
promise that
Given
a function
finds a •such
thatx box,
|xi(|0i
|1i)
if
f
(x)
=
0
|1i) that
!
f : |xi(|0i
a ∈ {0, 1}n Uwith
a $= 0n such
|xi(|0i |1i) if f (x) = 1
• If f (x) = f (y) then either x = y or y =
s
all x f (x + a) = f (x).✓
X
◆
0
Breakthrough
X
1
✓
◆
1
|0i |1i
1
|0i is
|1ito determine a. It should
The
f (x) challenge
@
A
p
p
Uf : p n
|xi
! p n
( 1)
|xi
(x) =
f (y)
then
either
x
=
y
or
y
=
x
+
a.
2
2 x2{0,1}n
2 x2{0,1}n
(probabilistic) 2computer. This is because the
such that f (x) = f (y). And the best an algorit
1994be- Shor’s
Period
enge is to determine a. It should
intuitively
clearFinding
that thisProblem
is a difficult task for a classical
birthday paradox (actually its converse), the
stic) computer.
This
is because
cannot
determine
a until the
it finds
two
inputs x and y
n/2
Given an
n-bit
integer,the
findalgorithm
the prime
factorisation.
Breaks
RSA
cryptosystem
2 inputs. By contrast, we will show an effi
f (x) = f (y). And the best an algorithm can do is try random inputs x until it finds a match. By the
1. Use fiftof set
up random
pre-image
state
aradox (actually its converse), the chance of this is negligible
is probed
on many
fewer than
s. By contrast, we will show an efficient quantum algorithm.
φ = 1/
Quantum Algorithms - History
The Zoo - Stephen Jordan - 175 papers
http://math.nist.gov/quantum/zoo
Buchman-Williams cryptosystem
Elliptic curve cryptography
Algebraic and Number Theoretic Algorithms
Exponential Speed Up: Factoring, Discrete-log, Pell's Equation, Principal Ideal, Unit
Group, Class Group, Gauss Sums, Matrix Elements of Group Representations
Oracular Algorithms
Broad Application: Unstructured Search, Amplitude Amplification, Collision Finding,
Hidden subgroup Problem, Formula Evaluation, Linear Systems, Group Isomorphism, Network Flows
Approximation and Simulation Algorithms
Inspired by Physic : Quantum Walk, Quantum Simulation, Knot Invariants,
Partition Functions, Adiabatic Optimization, Simulated Annealing
Quantum Algorithms - Perspective
Quantum Simulators
One controllable quantum system to investigate another, less accessible one
tackling problems that are too demanding for classical computers
Ultracold quantum gases, Trapped ions, Photonic, Superconducting circuits
Refuting the Strong Church-Turing Thesis
Our communication today is secure only if
we cannot build a large scale quantum computer
Quantum Cryptography - Security
Quantum cryptography relies on the laws of quantum mechanics
to offer unconditional security
Measurement perturbs the system
Uncertainty Principles
No Cloning
No perturbation
No measurement
No eavesdropping
Quantum Cryptography - History
Wiesner 1983
The first link between secrecy and quantum physics quantum money
Bennett and Brassard 1984, Ekert 1991
Public key distribution problem
Cleve, Gottesman and Lo, 1999; Crepeau, Gottesman and Smith, 2005
Quantum Secret Sharing
Quantum Cryptography - History
Lo, Chau, Mayers 1997
Impossibility of quantum bit commitment
Damgaard et al., 2005, 2007; Wehner, Schaffner and Terhal, 2008
New paradigms of bounded-storage models
Gottesman and Chuang 2001
Quantum digital signature
Kitaev 2003, Chailloux and Kerenidis 2009
Perfect quantum coin flipping is impossible, but better than classical protocols exist
Broadbent, Fitzsimons and Kashefi 2009
Unconditionally secure quantum delegated computation
Quantum Cryptography - Perspective
Quantum Key Distribution Networks
SECOQC: 2008, 200 km of standard fibre optic cable to
interconnect six locations across Vienna and St Poelten
Quantum Cryptography - Perspective
Quantum Key Distribution Networks
DARPA: 10-node, has been running since 2004 in Massachusetts
BBN Technologies, Harvard University, Boston University and QinetiQ
Tokyo QKD Network: 7 partners NEC, Mitsubishi Electric, NTT and NICT,
Toshiba Research Europe Ltd. (UK), Id Quantique (Switzerland) and All Vienna
China and Austria Earth - Satellite QKD
Secure Cloud Computing
How to make cloud computing safe?
A model for enabling convenient, on-demand network access to
a shared pool of configurable computing resources
X
Y
Limited Client
Untrusted Server
Y
F(X)
F(Y)
F(Y)
Secure Cloud Computing
Rivest, Adleman and Dertouzos 1979
Can we process encrypted data without decrypting it first ?
Fully homomorphic encryption
Classical: Gentry 2009
Only computational security
assumption of limited computational power of the adversary
Quantum: Broadbent, Fitzsimons, and Kashefi 2009
Unconditional security
Qcomputing + Qcryptography = Blind Q Computing
Classical Communication
Classical Computer
random single qubit generator
Unconditional Perfect Privacy
Server learns nothing about client’s computation
Dan E. Browne†1
my, University College London,
E 6BT, United Kingdom.
8, 2008)
Measurement-based Quantum Computing
ntangled states exploited in measurement-based
of the classical computer that controls the meanal resource power, leading naturally to a notion
Program
is encoded in the classical control computer
computation. Surprisingly,
the Greenbergerroblems emerge naturally as
optimal examples.
Computation
Power is encoded in the entanglement
n the violation of local realistic models and the
control
controlcomputer
computer
measurement
measurement
site
sites
resource
resource state
state
FIG. 1: The control computer provides one bit of classical
information (downward arrows) to each site (circles in the resource state) determining the choice of measurement basis.
After the measurement, one bit of classical information (upward arrow), such as the outcome of the binary measurement,
Hide
• Angles of measurements
• Results of Measurements
is measurements.
If we were to
H
J(
+
⇥
+
r⇤)
use
this
principle
for
blind
quantum Computation
computing, Alice would have to reve
Protocol
1
Universal
Blind
Quantum
to reveal information
about
the
2.
Bob’s
preparation
✓
◆
structure
of
the
underlying
graph
state.
We
introduce
a new family of st
niversal
Blind
Quantum
Computation
y
of
states
called
the
brickwork
|±
⇧
1. Alice’s
+⇥+r⇤preparation
1Y plane measurements and
J(
+ ⇥ +1)
r⇤)which are universal
s+r
states
(Figure
for
X
−
screates
2. .{0,
1} ;an
X entangled
J(↵)
nts
and each
thus
do
not require
the
2.1
Bob
state
from
all
⇤r
paration
For
column
x
=
1,
.
,
n
1
initial
computational
basis
Other
universal graph states
P measurements.
Universal
Blind
Quantum
Computings
states
for
that
do
not
require
⌫
iθ1,
x,y
{|+
⇧}
umn
x
=
.
.
.
,
n
p(⌫)
Tr
(Pincorrect
B(⌫))
 ✏ in the
⇤r
For
each
row
y
=
1,
.
.
.
,
m
⇥
applying
ctrl-Z
gates
between
qubits
(|0!
+
e
|1!)
|
θ
=
0,
π/4,
.
.
.
,
7π/4}
and
sends
⌫
initial
computational
basis
measurements
have
appeared
[CLN05].
x,y
5].
✓
◆
!
" i↵1
w
y
=
1,
.
.
.
,
m
iθthat
x,y
!
To
best
of
our
knowledge,
this
is
the
first
time
a
new
functio
√
unctionality
has
beenDefinition
achieved
|+⇥the
⌥ prepares
1
(e
1.1 Alice
|ψ
!
∈
{
+
=
(|0!
+
e
|1!)
|
θ
=
0,
1).
x,y
R
x,y
θ
!
"
x,y
0
1
2 due to MBQC appear in
|+to
X
=
(
Ũ
,
{⌅
})
1
iθ
⇥ ⌥MS08]).
x,y
x,y
thanks
MBQC
(other
theoretical
advances
!
ear
in
[RHG06,
From
i↵ | θx,y = 0, π/4, . . . , 7π/4
repares the
|ψx,yqubits
! ∈R {to+Bob.
|1!)
θx,y =1 √2 (|0! + 1e
e
as tremendous
potential
for of
the
a conceptual
point
view,
shows that MBQC has trem
3.
Interaction
and
measurement
B
Cour contribution
1
0
B
C
bits
to
Bob.
|±
⌥
✓
|±
⌥
+⇥+r⇤
✓
+⇥+r⇤
development
of
new
protocols,
and
maybe
even
of
algorithms.
2.allBob’s
preparation
@
A
1
received
qubits,
according
to
their
indices,
For each column x = 1, . . . , n by
paration
1.3
Outline
of
Protocols
1 y = state
2.1in
Bob
creates
an
entangled
from
all received
qubits, acco
ubits
order
to
create
a
brickwork
state
G
(see
n×m
For
each
row
1,
.
.
.
,
m
{|+
⌥}
⇥
{|+
⌥}
⇥
quantum
computation
given
as
eates
anapplying
entangled
state
from
all received
qubits,
toa quant
their
ctrl-Z
gates
between
qubits
inaccording
order
to create
ab
The
outline
of
the
main
is◆as "the
follows.
Alice
has
in
mind
random
single qubit
generator
✓protocol
✓
◆
X
Z
i↵
i↵
:
preparation
and
computation.
where
s
=
s
=
0.
3.1
Alice
computes
1qubits
e inφorder
1There
e0,y
√=
! (Ũbetween
"
ng ctrl-Z
gates
the
to
create
a
brickwork
stat
Definition
1).
a measurement
pattern
on
a
brickwork
state.
are
two
stages:
prepa
1
1
x,y
0,y
X
,
{⌅
})
iθ |1# |
x,y
+2
mly from
{1/
2
|0#
+
e
i↵
i↵
2
e
1
e
1
In X
the=preparation
stage,
Alice
prepares
single
qubits
chosen
randomly
fr
ion
1).
(
Ũ
,
{⌅
})
x,y
3.2
Alice
chooses
r
∈
{0,
1}
and
computes
3.g all
Interaction
and
measurement
the
qubits,
Bob
entangles
x,y
R
θ = 0, π/4, 2π/4,s.X
. . , 7π/4}Z and sends them to Bob. After receiving all t
x,y
⌅column
= ( 1)
⌅the
s,x,y
⇤
✓ ◆
reveals
upper
on
x,y. +
For them
each
x
=
1,
.
.
n
ny and
measurement
x,y bounds
according
toX thetransmits
brickwork state.
Note
that
this
unavoidably
reve
3.3
Alice
δ
to
Bob.
Bob
measures
1
x,y
s J(↵)
e length
of the
input
and
depth
s1,
Z
For
each
row
y
=
.
.
.
,
m
umn
xdimensions
=
1,
.
.
.
,
n
s
2
{0,
1}
;
X
x,y
of
Alice’s
underlying
graph
state,
that
correspond
to
the
lengt
⌅
=
(
1)
⌅
+
s
⇤
x,y
x,y
x,y
1
=
0.
k state, it does
not
reveal
3.4
Bob
transmits
the
result
s
∈
{0,
1}
to
A
⌅R {0,
1} any
x,y
"
X
Z
w
y3.1
=of1,Alice
.the
. .r,x,y
m
computation.
However,
to
where due
s0,y
= universality
s0,y ◆= 0. of the brickwork stat
computes φfor
"
stage
involves
interaction:
✓
x,y
utes δadditional
+ If
θ!x,yrXx,y
+ πr
.
i↵
3.5
=
1
above,
Alice
flips
s
;
otherwise
x,y =" φx,y
x,y
information
on
Alice’s
computation.
The
computation
stage
Z
x,y
1
(e
"
!
"
"
ical 3.2
message
to
Bob
to
tell
him
where
s
=
s
=
0.
omputes
φ
Alice
r0,y
∈R0,y
{0, 1} and computes
δx,y = φx,y + θ!x,y + π
x,y⌅chooses
r
{0,
1}
x,y
x,y
R
!
!
i↵
each
layer
of the
for1 eache qubit,
Alice sends a classical m
"
sures
in
the
basis
{ +brickwork
, −state,
performs
the
measurement
and
δx,y
δx,y }.
"
!+perfor
hooses
rAlice
{0, 1}
and
computes
δBob
=measures
φx,y
+.. θ!x,y
+
πr
.
x,y ∈Rtransmits
x,y
x,y
3.3
δ
to
Bob.
in
the
basis
{
x,y
in
which
basis
of
the
X
−
Y
plane
he
should
measure
the
qubit.
Bob
" !
" δx,y
ds will
depend on these values.
.
to
Alice.
!
!
3.4
Bob
transmits
the
result
s
∈
{0,
1}
to
Alice.
communicates
the
outcome;
Alice’s
choice
of
angles
in
future
ransmits
δ
to
Bob.
Bob
measures
in
the
basis
{
+
,
−δrounds
}. will
x,y
x,y
utely
chosen
so
that,
no
matter
δ
:=
s
+
r
x,y
x,y
x,y
x,y
rwise shesx,y
does
nothing.
The
universality
of
Protocol
1
follows
from
the
Alice’s
classical messages
astutely c
3.5Importantly,
Ifthe
=is1computing
above,
Alice
sx,yand
; otherwise
she doesare
nothing.
pattern.
If rAlice
ansmits
result
sx,y ∈ quantum
{0,
1} flips
tostates
Alice.
x,y
ame as a measurement in the |+φ+θ ! , |−φ+θ ! basis on Z(θ) |ψ! (see Appendix A), and since
+ θ + πr, if r = 0, Bob’s measurement has
J( the
+ ⇥same
+ r⇤)effect as Alice’s target measurement; if
all Alice needs to do is flip the outcome.
⇥r
now define and prove the security of the protocol.
Intuitively, we wish to prove that whatever
Blindness
chooses
to do (including arbitrary deviations from the protocol), his knowledge on Alice’s
um computation does not increase. Note,|+
however
that Bob does learn the dimensions of the
⇥⇧
work state, giving an upper bound on the size of Alice’s computation. This is unavoidable:
ple adaptation of the proof of Theorem|±2 +⇥+r⇤
from ⇧[AFK89], confirms this. We incorporate
otion of leakage in our definition of blindness. A quantum delegated computation protocol
protocol by which Alice interacts quantumly
{|+⇥ ⇧}with Bob in order to obtain the result of a
utation, U (x), where X = (Ũ , x) is Alice’s input with Ũ being a description of U .
Protocoldelegated
P on input
leaks
most
X = (Ũ , {⌅on
nition 2. Let P be a quantum
computation
input
X at
and
let L(X) be any function
x,y })
input. We say that a quantum delegated computation protocol is blind while leaking at most
Given
distribution
of classical
information
in
if, on Alice’s input X, for any2.fixed
Y =the
L(X),
the following
two hold
when givendescribed
Y:
information
by Bob
independent of
of X.
obtained
by Bob obtained
in P is fixed
andisindependent
➡ The distribution of the classical
he distribution of the classical information obtained by Bob in P is independent of X.
Definition
2 captures
the intuitive
notion
Bob’s
view of
2. Given the distribution of classical
information
described
in 1, the
statethat
of the
quantum
sy
The quantum
is fixed
fixed
andgiven
independent
of X.
(when
Y
his view consists of classical and quant
➡
obtained
by Bob state
in P is
and
independent
of
5 ); since
distribution of the classical information should not depend on
Definition 2 captures the intuitive
that Bob’s
view of the protocol
dependsyo
choice notion
of the classical
information,
the stateshould
of the not
quantum
(when given Y ); since his view
consists
of classical
quantum
information,
this means
tha
and
not depend
on Xand
(given
Y ). We
are now ready
to state
distribution of the classical information
should not
depend
X dimension
(given Y ) and
that
for any
that in Protocol
1, (n,
m) isonthe
of the
brickwork
choice of the classical information, the state of the quantum system should be uniquely determ
and not depend on X (given Theorem
Y ). We are3now
ready to state
and prove
theorem.
(Blindness).
Protocol
1 is our
blindmain
while
leaking R
a
that in Protocol 1, (n, m) is the dimension of the brickwork state.
Proof. Let (n, m) (the dimension of the brickwork state) be
Theorem 3 (Blindness). Protocol
1 is blind
while
leaking atthat
mostBob’s
(n, m).
the brickwork
state
guarantees
creating of the gra
Quarter/Half-wave Plate
BBO crystal
Polarization Controller
Experimental Implementation
Polarizing Beam Splitter
Filter
Barz, Kashefi, Broadbent, Fitzsimons, Zeilinger, Walther, Science 2012
4
1
a
c
b
d
2
3
2
3
Alice
Bob
Experimental Implementation
Client:
limited computational power
Quantum server:
full power of Quantum Computation
Entangles qubits
Prepares random qubits
Measurement instruction for server
Initial rotation of the qubit
Target rotation
Computes measurement angles Random bit flip
Experimental Implementation
Client:
limited computational power
Quantum server:
full power of Quantum Computation
Entangles qubits
Prepares random qubits
Y
X
Measurement in X-Y plane
Computes measurement angles
Decryption:
Output
1
1 0
of the computation
0
Z
0, 1
Quantum Cloud
Quantum computing could head to 'the cloud', study says
Girls lock-up quantum security
Almost as intriguingly, the research has been carried out by a team three of them being women.
The Blind Quantum Security Eschaton
Quantum computers "can decrypt any non-quantum method near-instantly, in theory, rendering all
existing forms of encryption obsolete," Enderle pointed out. "This will make the concerns surrounding
Iran's nuclear efforts seem trivial by comparison if a [foreign] country gets there first."
Blind Q Computing World
CC
Other approaches
D. Aharonov, M. Ben-Or, and E. Eban, ICS 10 (2010)
A. Childs, Quant. Inf. Compt. (2005)
P. Arrighi and L. Salvail, Int. J. Quant. Inf. (2006)
Approximate Protocol
Dunjko, Kashefi, Leverrier, PRL, 2012
Robust Protocol
Morimae, Dunjko, Kashefi, arXiv:1009.3486
Morimae, Fujii, Nature Communications, 2012
Morimae, PRL, 2012
Minimal Protocol
Dunjko, Kashefi, Markham
Composable Protocol
Dunjko, Fitzsimons, Portmann, Renner, arXiv:1301.3662 (2013)
Other Models
Datta, Kapourtionis, Kashefi, One-clean qubit
Still requires 2n parameters
for a classical computer
to simulate it
Big Picture
How do we verify the
Solution ?
BQP
NP
Can we verify it with a
classical Computer ?
BPP
Blind Computation
with BPP* Alice
Not all the problem in NP
can be computed blindly
with a BPP Alice
• Abadi, Feigenbaum and Kilian
The Ultimate Challenge
Quantum Verification
Should we pay $10000000 for
a quantum computer
That kind of tests work only
for a specific problem.
We don’t know if all the questions
that quantum computer can solve
are classically testable
Simple test: We ask the box to factor a big number
Exponential World
Hilbert space is a huge place.
What makes quantum not classical
makes its verification not classical either
n particles = 2n parameters
Quantum Turing Test
|±
Proof System
+⇥+r⇤ ⌦
{|+⇥ ⌦}
X = (Ũ , {⌅x,y })
sX
x,y
Verifier
⌅x,y = ( 1)
⌅x,y +
Prover
Z
sx,y ⇤
rx,y ⌥R {0, 1}
Yes X satisfies some property
⇥x,y ⌥R {0,NP· ·- ·problems
, 7⇤/4}
sx,y := sx,y + rx,y
|±
Interactive Proofs
+⇥+r⇤ ⌦
{|+⇥ ⌦}
All problems
X = (Ũ , {⌅x,y })
sX
x,y
Verifier
⌅x,y = ( 1)
⌅x,y +
Prover
Z
sx,y ⇤
rx,y ⌥R {0, 1}
Prover can cheat with
exponentially small probability
Yes X satisfies some property
⇥x,y ⌥R {0, · · · , 7⇤/4}
sx,y := sx,y + rx,y
{|+⇥ ⌦}
Can we Classically test Quantum Mechanics ?
X = (Ũ , {⌅x,y })
Classical Verifier
⌅x,y = (
sX
x,y
Z
1) ⌅x,y + sx,y ⇤
Quantum Prover
rx,y ⌥R {0, 1}
Yes X satisfies some property
⇥x,y ⌥R {0, · · · , 7⇤/4}
Gottesman (04) - Vazirani (07)- Aaronson $25 Challenge (07)
Does every language in the class BQP admit an interactive protocol
s
:= s
+r
where the prover is in BQP
BPP?
x,yand the verifier
x,y is in
x,y
Verification
• Correctness: in the absence of any interference, client accepts
and the output is correct
• Soundness: Client rejects an incorrect output, except with
probability at most exponentially small in the security parameter
Fitzsimons and Kashefi, arXiv:1203.5217, 2012
um Authentication
m = 2d + 1. In this case, the code can detect d errors. Also, Ck is self dual [BOCG+ 06], namely, the cod
is equal to the dual code subspace.
si
si
Z
Z
Eons
= Mi J( )vs
ZiAuthentication
= Xj Mi J(
ij Verification
) Eij
uantum Authentication
+
CG
adapted
02]).from
A quantum
Barnum authentication
et. al. [BCG+scheme
02]). A(QAS)
quantum
is aauthenticatio
pair of
efinitions
ther
quantum
with aalgorithms
set of|⌅⌥
classical
A and
keys
B together
KEve
such that:
with a set of classical keys K suc
+
n 3.1 (adapted from Barnum
et.
al.
[BCG
02]). A quantum authentication
scheme (QAS) is a pair o
Alice
Bob
eal (QAS)
is algorithms
a pair ofA and B together with a set of classical keys K such that:
time quantum
sMinput
and an
a key
m-qubit
k ∈ Kmessage
and outputs
system
a transmitted
M and a keysystem
k ∈ KTand
of m
outputs
+d at
akes as input an m-qubit
a transmitted system T of m +
Z(⇥ message) system M and a key k ∈ K and outputs
Detect error
bits.
d system T of m + d
#
#
# k ∈ K and outputs two systems:
akes
as
input
the
(possibly
altered)
transmitted
system
T
a classical
Crepeau,
Gottesman,
Smith and Tapp,
tted
input
system
the (possibly
T and aaltered)
classical
transmitted
key k ∈ and
KBarnum,
system
and
outputs
Tkey
and
two
a classical
systems:
key
aFOCS02
k∈
qubit message state M , and a single qubit V which indicate whether the state is considered valid or erroneou
J(⇥)
message
which
indicate
Mcalled
, and
whether
single
the state
qubit
Vfixed
considered
which
indicate
valid
whether
or erroneous.
the state isb
eVbasis
statesstate
of V are
|V a
AL$
, |ABR$.
For ais
k we denote
the
corresponding
super-operators
utputs
a denote
and
BkFor
. two
BR$.
states
of aVsystems:
fixed
are called
k we
|V AL$the
, |ABR$.
corresponding
For a fixed
super-operators
k we denote the
by cor
ed. valid or erroneous.
ka pure state |ψ$, consider the following test on the joint system M, V : output a 1 if the first m qubits are i
ng
sby
or ifsuper-operators
the last qubit is in state
i |ABR$, otherwise, output 0. The corresponding projections are:
|ψ$
eeststate
on the
|ψ$,joint
consider
following
1 if
the
joint
first
system
m qubits
M,are
V :inoutpu(2
P1 system
= the
|ψ$ M,
%ψ|
⊗VIV :+output
(IM test
− |ψ$aon
%ψ|)
⊗ the
|ABR$
%ABR|
⇤ otherwise,
⌅ projections
|ψ$
e
wise,
last
qubit
output
is
0.
in
The
state
corresponding
|ABR$,
output
are:
0.
The
corresponding
pr
P
=
(I
−
|ψ$
%ψ|)
⊗
|V
AL$
%V
AL|
(3
M
1
e first m qubits0 are in
⌥
are:
me
is secure
if
for
all
possible
input
states
|ψ$0and for all possible interventions by the adversary, the expecte
|ψ$
1
1
⌥
⇤
⇤
|ψ$
(|00⌥
+
|11⌥)
=
+
(I
−
|ψ$
P
%ψ|)
=
⊗
|ABR$
|ψ$
%ψ|
%ABR|
⊗
I
+
(I
−
|ψ$
%ψ|)
⊗
|ABR$
(2)
%ABR
VB’s output
Mto the space
V
M
defined
by
P
is
high:
1
12 ⇧ ⌃
2
0
ly(n) length
uniformly at random. The map from k to the group element represented as a product of Cliffo
'
um
Authentication
mnerators
= 2d +can
1. be
In computed
this case, the
code canpolynomial
detect d errors.
in classical
time. Also, C is self dual [BOCG 06], namely, the cod
+
k
|k
·
f
(α
).
.
.k
·
f
(α
)$
1
1
m
m
is equal to the dual
code
subspace.
T raux [U ⇤ I ⇥ J(⇤in ⇥ ⇤aux0 )I
†
†
⇥
J
⇤
U
]
|0
s
Z
ci
⇤(0)=a
⇥
|+⌥⌃+|
)
E
P
out = POcPEG (⇤
in
V
rI
G
O
def
(f
)≤d,f
J(
)
E
† ]= Mi J( ) Zi
ij
2ons
Signed
Polynomial
Codes
i
0
=
T
r
[U
(⇤
⇥
⇤
)U
Verification
aux vs Authentication
in
aux
=
si
Xj
(1)
Z
Mi
uantum
Authentication
r background
on polynomial quantum codes see Appendix+A.
+
+
an
detect
d
errors.
Also,
C
is
self
dual
[BOCG
06],
namely,
theofcode
k al. [BCG scheme
CG
adapted
02]).from
A quantum
Barnum
authentication
et.
02]).
A
(QAS)
quantum
is
a
authenticatio
pair
†
†
|+
m
0 )I
swith
T+r06])
[U
⇤
I
⇥
J(⇤
⇥
⇥
J
⇤
U
]
i ⇤aux
aux
in
efinition
2.3 ([BOCG
The
signed
polynomial
code
respect
to
a
string
k
∈
{±1}
(denoted Ck ) i
efinitions
P
=
M
Z
|⌅⌥
Eve
ther
with aalgorithms
set of classical
Aiand
keys
B together
K such
with a set of classical keys K suc
i i that:
†
: quantum
+⇤ ' 0 )U ]
r
[U
(⇤
⇥
n 3.1 (adapted=
from T
Barnum
et.
al.
[BCG
02]).
scheme (QAS) is a pair o
aux
in
auxA quantum authentication
$
%
1
def
Alice
Bob
k
$Sa = &
eal (QAS)
is
a
pair
of
|k1 · f (αkeys
· f (α
1 ). . .k
m )$
time quantum algorithms A and B together
with a set of classical
Kmsuch
that:
d
q fsystem
sMinput
and an
a key
m-qubit
k |+
∈ Kmessage
and outputs
a transmitted
M
and a keysystem
k ∈ KTand
of m
outputs
+d at
:def (f )≤d,f
(0)=a
s
s
ik ∈ K
i
|+
s
akes as input an m-qubit
message
system
M
and
a
key
and
outputs
a transmitted
system T of m +
i
P
E
=
M
X
E
X
Z(⇥
)
ij
ij
i detect
i
j
j
Detect
error[BOCG+ 06], namely,
P
=
M
Z
e
use
m
=
2d
+
1.
In
this
case,
the
code
can
d
errors.
Also,
C
is
self
dual
k
i
i
i
bits.
d system
T toofthemdual
+code
d subspace.
bspace
is equal
#
#
# k ∈ K and outputs two systems:
akes
as
input
the
(possibly
altered)
transmitted
system
T
a classical
tted
input
system
the (possibly
T and aaltered)
classical
transmitted
key k ∈ and
Ksystem
and
outputs
Tkey
andtwo
a classical
systems: key
a k∈
|0 message state M , and |+
si s whether
si the state
qubit
a single
qubit V which indicate
considered valid or erroneou
Z
Zsi is
i
P
J(
)
E
=
M
J(
)
Z
=
X
M
J(
)
E
J(⇥)
message
V
which
state
indicate
M
,
and
whether
a
single
the
state
qubit
is
V
considered
which
indicate
valid
whether
or
erroneous.
the
state
is
ij
ij
i
i
P
E
=
M
X
E
X
Quantum
Authentication
i
i
j
e basis states of V are called
|V
AL$
,
|ABR$.
For
a
fixed
k
we
denote
the
corresponding
super-operators
b
ij
ij
i
i
j
j
+ systems: a
utputs
two
and
B
.
[BCG
02]).
A
quantum
authentication
is a the
pair
of
kFor
BR$.
states
of aV
fixed
are called
k we
denote
|V AL$
the
, |ABR$.
corresponding
Forscheme
a fixed
super-operators
k(QAS)
we denote
by cor
1 valid
Definitions
ed
or
erroneous.
together
with
a settheoffollowing
classical
K system
such M,
that:
Eve
=
Server
test onkeys
the joint
V
:
output
a 1 if the first m qubits are i
ka.pure|0state |ψ$, consider
+
siTheAcorresponding
si authentication
Z
efinition
3.1 qubit
(adapted
fromby
Barnum otherwise,
et.
al.|⌅⌥
[BCG
02]).
quantum
ng
Client
or ifsuper-operators
the
last
is
in
state
|ABR$,
output
0.
are:E (QAS) is a
i J( )scheme
P
J( ) E = M J( ) Z = X M Zsprojections
ij
i K such that: ij
i time quantum algorithms
i a set of classical
j
lynomial
A iand B together with
keys
stem
and
a|ψ$key
k the
∈ M,
Kfollowing
and
outputs
aon
transmitted
system
Tare
of :m
+d
eest
state
onMthe
|ψ$,
joint
consider
system
V
:
output
test
a
1
if
the
the
joint
first
system
m
qubits
M,
V
in
outpu
P1an m-qubit
= |ψ$message
%ψ| ⊗ IVsystem
+ (IMM−and
|ψ$a%ψ|)
|ABR$
(2
• A takes as input
key ⊗
k∈
K and%ABR|
outputs a transmitted
system
T
o
⇤
⌅
|ψ$
e
wise,
last
qubit
output
is
0.
in
The
state
corresponding
|ABR$,
otherwise,
projections
output
are:
0.
The
corresponding
pr
qubits.
P
=
(I
−
|ψ$
%ψ|)
⊗
|V
AL$
%V
AL|
(3
M
1
e first m qubits0 are in
Z(⇥U|⌅⌥)
Detect
error
#
#
⌥
• isBsecure
takes as
input
(possibly
altered)
transmitted
system
T
and
a
classical
key
k
∈
K
and
outputs
two a
sy
are:
me
ifsystem
for allthe
possible
input
states
|ψ$
and
for
all
possible
interventions
by
the
adversary,
the
expecte
nsmitted
T
and
a
classical
key
k
∈
K
and
outputs
two
systems:
0
|ψ$
1
1 ⌥
⇤
⇤
|ψ$
m-qubit
message
state
M
,
and
a
single
qubit
V
which
indicate
whether
the
state
is
considered
valid
or er
(|00⌥
+
|11⌥)
=
+
(I
−
|ψ$
P
%ψ|)
=
⊗
|ABR$
|ψ$
%ψ|
%ABR|
⊗
I
+
(I
−
|ψ$
%ψ|)
⊗
|ABR$
(2)
%ABR
VB’s output
Mto the space
V
M
defined
by
P
is
high:
1
⇧0super-oper
⌃
1
ubit
which
whether
the state
considered
valid
or2 erroneous.
TheVbasis
states indicate
of V are called
|V AL$ , |ABR$.
For a2isfixed
k we denote the
corresponding
X
s
Z ⇤
⇥x,y ⌥R {0, · ·⌅· |0⌦,
, 7⇤/4}
x,y ⌅
|1⌦
=
(
1)
+
s
x,y
x,y
x,y
Adding Traps
BPP ⇧ QNC
sx,y := sx,y +rrx,y
x,y⌥RNC
{0,2 1}
⇧ QNC1
|+⇥ ⌦, |
⇥⌦
Measurements
⇥x,y ⌥Trap
· · · , 7⇤/4}
R {0,
|0⌦, |1⌦
⇥ |+ ⌦ ⌃ s = 0
M
QNC ⇥
BPP ⇧s := s + r
x,y
x,y
2
1 x,y
NC ⇧ QNC
M ⇥| ⌦ ⌃ s = 1
⇥
|+⇥ ⌦, |
⇥⌦
|0⌦, |1⌦
M ⇥ |+⇥ ⌦
⇥
M |
|0⌦, |1⌦
⇥⌦
BPP ⇧ QNC
Trap
2
1 positions and
NC ⇧ QNC
Measurement angles
3
|+
⌦,
|
⌦
⇥
⇥
⌃ s=0
remain hidden
M ⇥ |+⇥ ⌦ ⌃ s = 0
⌃ s=1
ε-Verification
pting an incorrect outcome density operator. Any outcome density operato
or is contained within the subspace of correct and incorrect outcome state
Aliceprojected intoBob
any server’s
strategy
the intuitiv
obabilistically
a correct or anFor
incorrect
state.
Hence
probability
of client
accepting
an
P ⌫
to be verifiable
if the
corresponding
outcome
state
is
far
from
any
inco
⌫
.
incorrect outcome density
p(⌫) Tr (Pincorrect
B(⌫))  ✏
random
parameters
9.
⌫
.
lowing the approach .of [28], we first define the
notion
of
correctness
operator is bounded by ε:
⌫
n 8. Let Pincorrect
beB(⌫)
the projection onto the subspace of all the possible inc
density
operatorof
of classical
and random
quantum output
erator for the fixed
choice
Alice’s
variables denoted with ⌫, that i
⌫
Pincorrect
= (I
|
⌫
ideal i h
⌫
ideal |)
⌦ |rt⌫ i hrt⌫ |
⌫
Accept
Key ch
i
h
|
=
T
r
(B
(⌫)).
Let
p(⌫)
be
the
probability
of
Alice
0
i62{O[{t}}
deal
ideal
parameterized by ⌫, that is the probability of choosing a position i amo
P
⌫
the graph to be the trap⌫ position
as a random variable t) and
p(⌫) Tr (P(denoted
incorrect B(⌫))  ✏
g random variables , r, x, ✓ (as defined in Definition 6). Given 0  ✏ <
o be ✏-verifiable, if for any choice of Bob’s strategy (denoted by j) the prob
Verification with single trap
Theorem. Protocol is (1 − 1/2N)-verifiable in general, and in
the case of purely classical output it is (1 − 1/N)-verifiable,
where N is the total number of qubits in the protocol.
Probability Amplification
To increase the probability of any local error being detected
O(N) many traps in random locations
To increase the minimum weight of any operator which leads to an incorrect outcome
Fault-Tolerance
P
P1
H
P=
MComp
Challenge: Traps break the graph
2.
1.
5. 2.
Y
5.
Y
Y
Y
Z
P
H
Z
Z
MComp
P=
Z
Z
Z
MReduce
MComp
Z
Z
=
K̃5
2.
Y
Z
Z
Y
Z
Z
3.
Z
Y
Z
Z
MReduceZ
Z
Z
Z
ZZ
Y
Z
Z
Z
ZZ
Z
Z
MP
Z
MReduce
P1
Z
M6.
P
Z
Z
P1
7.
Z
Z
MA
MA
Z
Z
7.
P2
Z
Z
MP
MP
Z
Z
Z
K̃5
P3
Z
Z
Z
Z
P3
Z
Z
Z
Z
Z
P3
4.
3.
Required 3D lattice for Raussendorf,
Harrington
Topological
Z and Goyal
Z
error-correcting
Z
Z code with defect
Z
Zthickness
Z
d
Z
Z
6.
MP
K̃5
4.
Z
Z
Z
Z
Y
3.
Z
Z
Y
Z
Z
Z
Y
K̃5
P
K̃5
3.
Y
P1
Y
P
6.
P
MReduce
Z
Z
P1
6.
Y
Z
Y
2.
P1
Z
Y
H
=
MComp
Probability Amplification
1.
H
P3 Z
Z
P3
Probability Amplification
K̃15
P3
6.
K̃5
K̃5
P1P1
P2 P
2
MP
K̃15
P3
P3
K̃5
K̃5
7.
K̃5
P2
Probability Amplification
MP
K̃5
P3
7.
M
tocol 8. In this figure we replace the Raussendorf-Harringtona simpler computation, as to include a full encoding yields
Off to Vienna
P3
7.
M
What can we do with 4-qubits
2




FIG. 1: Concept of a quantum prover interactive proof system based on blind quantum computing. The verifier wants to find
out if the prover can indeed perform quantum computations. While the question if a classical verifier can test a quantum system
is still open, it was shown that a verifier that has access to certain quantum resources can verify quantum computations. Here,
in the framework of blind quantum computing, the verifier needs the ability to generate single qubits and to transmit them to
the prover. After the transmission of the qubits, the verifier and the prover exchange two-way classical communication.
Restricting to Classical Input and Output


trapification




trapification




A Complete new proof of verification was required
Pauli ( i )
C ⌦C ⌦C ⌦C
C ⌦C ⌦C ⌦A
C ⌦C ⌦A⌦C
C ⌦C ⌦A⌦A
C ⌦A⌦C ⌦C
C ⌦A⌦C ⌦A
C ⌦A⌦A⌦C
C ⌦A⌦A⌦A
A⌦C ⌦C ⌦C
A⌦C ⌦C ⌦A
A⌦C ⌦A⌦C
A⌦C ⌦A⌦A
A⌦A⌦C ⌦C
A⌦A⌦C ⌦A
A⌦A⌦A⌦C
A⌦A⌦A⌦A
Trap Stabilizer Measurement
X ⌦I⌦Y ⌦Y Y ⌦X ⌦X ⌦Y Y ⌦Y
3
3
7
7
7
7
3
3
3
7
7
3
7
3
3
7
7
7
3
3
3
3
7
7
7
3
3
7
3
7
7
3
Overall
⌦I⌦X
3
7
3
7
7
3
7
3
7
3
7
3
3
7
3
7
3
7
7
7
7
7
7
7
7
3
7
7
7
7
7
7
Table 4: Pauli terms in the deviation operator U and whether or not they are
detected by a particular trap setup or not. Although there are 256 distinct
4-qubit Pauli operators, including the identity, these can be grouped into 16
Summery
Only 4 qubit computation can be verified
and
a particular type of attack cannot be detected !
What about D-Wave Problem
Verification of 2-qubit entanglement
Blind Verification of Entanglement
Blind Verification of Entanglement
Barz, Fitzsimons, Kashefi, Walther, Nature Physics 2013












Quantum Turing Test
We can test efficiently a quantum computer
But we need quantum randomness
Perspective
What is the lower bound
Model independent Verification
Is Nature Classically verifiable
Quantum Turing Test
Quantum Zero-Knowledge Proof;
Adiabatic UBQC; BBP vs BQP
theory
Unconditionally Secure
Cloud Computing;
Hybrid Quantum-Classical
Homomorphic Encryption
Efficient Process
Tomography;Testing
Commercial Qubits
with Scientific Qubits
Blind Bell Test; Blind Contextuality
Test; Distinguishing Relativistic
Effects from Quantum Effects
theory
practice
practice
UBQC with superconducting qubits
Computational
lab
lab
UBQC and Verification Implementation with
Photonic Qubits and Coherent Pulses
Interactive Proof
Quantum
Turing
Test
Blind Trapification
Measurement-based QC
Physical