A Childs

A Mantri

BW Reichardt

P Arrighi

PW Shor

S Barz

T Morimae

T Sueki

V Giovannetti

This is an extended abstract of the presentation made at CSR 2017. Complete details can be found in our upcoming pape

Gheorghiu, Alexandru

Kapourniotis, Theodoros

Kashefi, Elham

Edinburgh Research Explorer

     Edinburgh Research Explorer                                      Verification of Quantum Computation and the Price of TrustCitation for published version:Gheorghiu, A, Kapourniotis, T & Kashefi, E 2017, Verification of Quantum Computation and the Price ofTrust. in P Weil (ed.), Computer Science -- Theory and Applications: 12th International Computer ScienceSymposium in Russia, CSR 2017, Kazan, Russia, June 8-12, 2017, Proceedings. Lecture Notes inComputer Science, vol. 10304, Springer International Publishing, Cham, pp. 15-19, 12th InternationalComputer Science Symposium in Russia , Kazan, Russian Federation, 8/06/17. DOI: 10.1007/978-3-319-58747-9_3Digital Object Identifier (DOI):10.1007/978-3-319-58747-9_3Link:Link to publication record in Edinburgh Research ExplorerDocument Version:Peer reviewed versionPublished In:Computer Science -- Theory and Applications: 12th International Computer Science Symposium in Russia, CSR2017, Kazan, Russia, June 8-12, 2017, ProceedingsGeneral rightsCopyright for the publications made accessible via the Edinburgh Research Explorer is retained by the author(s)and / or other copyright owners and it is a condition of accessing these publications that users recognise andabide by the legal requirements associated with these rights.Take down policyThe University of Edinburgh has made every reasonable effort to ensure that Edinburgh Research Explorercontent complies with UK legislation. If you believe that the public display of this file breaches copyright pleasecontact openaccess@ed.ac.uk providing details, and we will remove access to the work immediately andinvestigate your claim.Download date: 05. Apr. 2019Verification of quantum computationand the price of trustAlexandru Gheorghiu∗1, Theodoros Kapourniotis†1,2, andElham Kashefi‡1,31School of Informatics, University of Edinburgh, UK2Department of Physics, University of Warwick, UK3CNRS LIP6, Universite´ Pierre et Marie Curie, ParisQuantum computers promise to efficiently solve not only problems believed to beintractable to classical computers [1], but also problems for which verifying the solution isconsidered intractable [2]. In particular, there are problems in the complexity class BQP,i.e. solvable in polynomial time by a quantum computer, that are believed to be outside ofNP, the class of problems for which checking the solution can be performed in polynomialtime by a classical computer. This raises the question of how one can verify whetherquantum computers are indeed producing correct results. Answering this question leadsto quantum verification, which has been highlighted as a significant challenge on the roadto scalable quantum computing technology. Verification is pertinent to both medium-sized quantum computers, expected to be developed in under a decade, but also to futurequantum cloud supercomputers used by remote users. It is also relevant for experimentsof quantum mechanics, where the size of the system involved is beyond the regime ofclassical simulation. In this paper we attempt to categorize the different methods ofquantum verification that have appeared in recent years. Since most of them are basedon cryptographic primitives and treat quantum devices as untrusted entities, we highlighta general trade-off between trust assumptions and complexity.The setting in which quantum verification has been studied extensively is that ofinteractive proof systems. This involves two distinct entities: a trusted party called theverifier (also known as client), tasked with verifying the correctness of a computation andan untrusted party called the prover (also known as server), who runs the computationand attempts to convince the verifier of the result. Formally, for some language L ∈ BQPthe verifier wants to know, for an input x, whether x ∈ L or x 6∈ L. The prover is tryingto convince the verifier that one of these statements is true usually by demonstratingthat it has performed the correct quantum computation. To ensure this, in a typical runof a verification protocol, the verifier asks the prover to not only perform the quantumcomputation, but also a series of trials that will be used to test his behaviour. Cryp-tographic methods are applied so that the prover cannot distinguish the tests from thecomputation and try to cheat selectively. This class of protocols constitutes the majority∗Email: a.gheorghiu@sms.ed.ac.uk†Email: t.kapourniotis@warwick.ac.uk‡Email: ekashefi@inf.ed.ac.uk1of verification protocols developed so far. For this reason, in our paper, we will primarilyreview these types of approaches. It is worth mentioning that all techniques reviewed inthis paper assume that the prover can deviate in any possible way that follows the lawsof quantum mechanics.Essential to the effectiveness of a verification protocol is the ascription of trust tosome of the used devices. Ideally, one wants to restrict the trust to the classical com-puter which the verifier controls. However, all existing approaches require some extratrust assumptions on the quantum devices or the channels involved in the protocol. Forinstance, protocols in which the verifier interacts with a single quantum prover requirethe verifier to posses a trusted quantum device. If there is more than one prover, theverifier can indeed be fully classical, but then the provers are forbidden from interactingwith each other. Our goal in this paper is to highlight the trade-off between the trustassumptions of each verification technique and the required resources to achieve the samelevel of confidence in the verification.Figure 1: Prepare and send verification protocolWe proceed by first considering protocols which make use of cryptographic primitivesand have information-theoretic security. These protocols are divided into two broadcategories:1. Prepare and send/receive and measure protocols. These are protocols in which theverifier and the prover exchange qubits through some quantum channel. As thename suggests, the verifier either prepares and sends qubits to the prover [3, 4, 5, 6,7, 8] or, alternatively, receives qubits from the prover and measures them [9, 10, 11].In the first case, the verifier relies on the uncertainty principle and the no-cloningtheorem to ensure that the prover cannot distinguish tests from computations.In the second case, the verifier uses a type of cut-and-choose technique to decidewhether to test the prover or perform a computation using the received states. Inboth cases, the essential element is the fact that the prover is oblivious to some partof the delegated computation. This property is commonly referred to as blindness[12, 13, 14, 15, 16, 17, 18, 19] and is a shared feature of most verification protocols.A schematic illustration of a prepare and send protocol is shown in Figure 1.2. Entanglement-based protocols. These are protocols in which entangled states areshared either between the verifier and the prover [20, 21] or between multiple provers[22, 23]. One of the main reasons for considering the entanglement-based setting2is because it can lead to device-independent verification. In other words, becauseof the remarkable properties of non-local correlations, it is possible to verify aquantum computation in a situation in which all quantum devices are untrusted.It is, however, necessary to assume that the quantum devices sharing entanglementare not communicating throughout the protocol. In this case, the verifier needs totest not only the prover performing the computation, but also any other quantumdevice that is sharing entanglement. Depending on the trust assumptions aboutthe shared entangled states as well as the measurement devices we notice differentscalings for the communication complexity of the protocols as we show in the tablebelow.aaaaaaaaaaaaMeasurementsEntanglementTrusted Semi-trusted UntrustedTrusted O(N) O(N2) O(N13log(N))Untrusted O(N2) O(N2) O(N64)We then also consider protocols which are not based in cryptography, but are moreakin to quantum state certification. These are known as post-hoc verification protocols[24, 25, 26] and can also be categorized as either receive and measure or entanglement-based. While the cryptographic protocols aim to test the operations performed by theprover(s) towards achieving universal quantum computation, post-hoc protocols simplycheck quantum witnesses for decision problems. In other words, deciding whether someinput x belongs or not to a language L ∈ BQP reduces to performing a two-outcomemeasurement of a quantum witness state |ψ〉. The protocols either have the prover sendthis state to the verifier to be measured, or the verifier coordinates a set of entangledprovers to prepare and measure |ψ〉.In both the previously mentioned cryptographic and post-hoc protocols, there are nolimiting assumptions about the computational powers of the provers. In other words,even though we regard them as BQP machines, verification is possible even if the proversare computationally unbounded. Recently, however, verification protocols have beenproposed for settings in which the provers are limited to a sub-universal model of quantumcomputations. The two that we review are for the one-pure-qubit model [27] and theinstantaneous quantum polynomial-time model (or IQP) [28, 29].Lastly, we address the issue of fault-tolerance [30]. This entails the ability to performverification in a setting where quantum devices and quantum states are subject to noisethat scales with the size of the system. Achieving fault-tolerant verification is crucial forthe practical applicability of these protocols and their use in near-future experiments ofquantum supremacy (attempting to demonstrate the “supraclassical power” of quantumcomputing).By categorizing and analysing the resources required in each protocol, while at thesame time making the trust assumptions explicit, we illustrate the bigger picture ofquantum verification in the delegated setting. This highlights the significant overlapbetween quantum computation, cryptography and complexity theory and can serve as aguide for the development and improvement of future protocols.3References[1] Peter W Shor. Polynomial-time algorithms for prime factorization and discrete log-arithms on a quantum computer. SIAM review, 41(2):303–332, 1999.[2] Dorit Aharonov, Vaughan Jones, and Zeph Landau. A polynomial quantum algo-rithm for approximating the jones polynomial. In Proceedings of the thirty-eighthannual ACM symposium on Theory of computing, pages 427–436. ACM, 2006.[3] Dorit Aharonov, Michael Ben-Or, and Elad Eban. Interactive proofs for quantumcomputations. In Proceedings of Innovations in Computer Science 2010, ICS2010,pages 453–, 2010.[4] Joseph F Fitzsimons and Elham Kashefi. Unconditionally verifiable blind computa-tion. arXiv preprint arXiv:1203.5217, 2012.[5] Anne Broadbent. How to verify a quantum computation. arXiv preprintarXiv:1509.09180, 2015.[6] Stefanie Barz, Joseph F Fitzsimons, Elham Kashefi, and Philip Walther. Experi-mental verification of quantum computation. Nature Physics, 9(11):727–731, 2013.[7] Theodoros Kapourniotis, Vedran Dunjko, and Elham Kashefi. On optimis-ing quantum communication in verifiable quantum computing. arXiv preprintarXiv:1506.06943, 2015.[8] Elham Kashefi and Petros Wallden. Optimised resource construction for verifiablequantum computation. arXiv preprint arXiv:1510.07408, 2015.[9] Tomoyuki Morimae. Measurement-only verifiable blind quantum computing withquantum input verification. arXiv preprint arXiv:1606.06467, 2016.[10] Masahito Hayashi and Tomoyuki Morimae. Verifiable measurement-only blind quan-tum computing with stabilizer testing. arXiv preprint arXiv:1505.07535, 2015.[11] Masahito Hayashi and Michal Hajdusek. Self-guaranteed measurement-based quan-tum computation. arXiv preprint arXiv:1603.02195, 2016.[12] Pablo Arrighi and Louis Salvail. Blind quantum computation. International Journalof Quantum Information, 4(05):883–898, 2006.[13] A. Childs. Secure assisted quantum computation. Quant. Inf. Compt., 5(6):456,2005.[14] Anne Broadbent, Joseph Fitzsimons, and Elham Kashefi. Universal blind quantumcomputation. In Foundations of Computer Science, 2009. FOCS’09. 50th AnnualIEEE Symposium on, pages 517–526. IEEE, 2009.[15] Atul Mantri, Carlos A Perez-Delgado, and Joseph F Fitzsimons. Optimal blindquantum computation. Physical review letters, 111(23):230502, 2013.[16] Carlos A Perez-Delgado and Joseph F Fitzsimons. Overcoming efficiency constraintson blind quantum computation. arXiv preprint arXiv:1411.4777, 2014.4[17] Vittorio Giovannetti, Lorenzo Maccone, Tomoyuki Morimae, and Terry GRudolph. Efficient universal blind quantum computation. Physical review letters,111(23):230501, 2013.[18] Tomoyuki Morimae and Keisuke Fujii. Blind quantum computation protocol in whichalice only makes measurements. Physical Review A, 87(5):050301, 2013.[19] Takahiro Sueki, Takeshi Koshiba, and Tomoyuki Morimae. Ancilla-driven universalblind quantum computation. Physical Review A, 87(6):060301, 2013.[20] Alexandru Gheorghiu, Elham Kashefi, and Petros Wallden. Robustness anddevice independence of verifiable blind quantum computing. arXiv preprintarXiv:1502.02571, 2015.[21] Michal Hajdusek, Carlos A Perez-Delgado, and Joseph F Fitzsimons.Device-independent verifiable blind quantum computation. arXiv preprintarXiv:1502.02563, 2015.[22] Ben W Reichardt, Falk Unger, and Umesh Vazirani. Classical command of quantumsystems. Nature, 496(7446):456–460, 2013.[23] Matthew McKague. Interactive proofs for BQP via self-tested graph states, 2013.arXiv:1309.5675.[24] Joseph F Fitzsimons and Michal Hajdusˇek. Post hoc verification of quantum com-putation. arXiv preprint arXiv:1512.04375, 2015.[25] Tomoyuki Morimae and Joseph F Fitzsimons. Post hoc verification with a singleprover. arXiv preprint arXiv:1603.06046, 2016.[26] D Hangleiter, M Kliesch, M Schwarz, and J Eisert. Direct certification of a class ofquantum simulations. arXiv preprint arXiv:1602.00703, 2016.[27] Theodoros Kapourniotis, Elham Kashefi, and Animesh Datta. Blindness and ver-ification of quantum computation with one pure qubit. In 9th Conference on theTheory of Quantum Computation, Communication and Cryptography (TQC 2014),volume 27, pages 176–204, 2014.[28] Daniel Mills, Anna Pappa, Theodoros Kapourniotis, and Elham Kashefi. Infor-mation theoretically secure hypothesis test for temporally unstructured quantumcomputation. Ongoing work, 2017.[29] Theodoros Kapourniotis and Animesh Datta. Nonadaptive fault-tolerant verificationof quantum supremacy with noise. Ongoing work, 2017.[30] Peter W Shor. Fault-tolerant quantum computation. In Foundations of ComputerScience, 1996. Proceedings., 37th Annual Symposium on, pages 56–65. IEEE, 1996.5

Verification of Quantum Computation and the Price of Trust

Abstract

Similar works

Full text

Available Versions

Edinburgh Research Explorer

Crossref

Archive Ouverte en Sciences de l'Information et de la Communication