Quantum verification of NP problems with single photons and linear optics

Quantum computing is seeking to realize hardware-optimized algorithms for application-related computational tasks. NP (nondeterministic-polynomial-time) is a complexity class containing many important but intractable problems like the satisfiability of potentially conflict constraints (SAT). According to the well-founded exponential time hypothesis, verifying an SAT instance of size n requires generally the complete solution in an O(n)-bit proof. In contrast, quantum verification algorithms, which encode the solution into quantum bits rather than classical bit strings, can perform the verification task with quadratically reduced information about the solution in \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\tilde O(\sqrt n )$$\end{document}O~(n) qubits. Here we realize the quantum verification machine of SAT with single photons and linear optics. By using tunable optical setups, we efficiently verify satisfiable and unsatisfiable SAT instances and achieve a clear completeness-soundness gap even in the presence of experimental imperfections. The protocol requires only unentangled photons, linear operations on multiple modes and at most two-photon joint measurements. These features make the protocol suitable for photonic realization and scalable to large problem sizes with the advances in high-dimensional quantum information manipulation and large scale linear-optical systems. Our results open an essentially new route toward quantum advantages and extend the computational capability of optical quantum computing.

Here we exploit the advantages of photonics to realize a new regime of quantum algorithm -the quantum verification machine (QVM) of nondeterministic polynomialtime (NP) problems.
The complexity class NP, which is the set of decision problems verifiable in polynomial time by a deterministic Turing machine, encompasses many natural decision and optimization problems.By definition, NP can be abstracted as a proof system which models computation as exchange of messages between the prover and the verifier.Verifying the correctness of a proof is a foundational computational model underpinning both the complexity theory and applications such as delegated computation.Specifically, we focus on the verification of the first discovered and most extensively studied NP-complete prob-lem -the Boolean satisfiability problem (SAT) [25], that is, the problem of asking whether a given Boolean formula with n variables has a satisfying assignment.The NP-completeness signifies that any NP problem can be efficiently reduced to this problem.Corresponding to the problem of satisfying potentially conflict constraints, SAT has found numerous applications in circuit design, mode checking, automated proving and artificial intelligence [26].Under the widely believed exponential time hypothesis (ETH) [27], which asserts that the best algorithm for solving 3-SAT (a representative form of SAT) runs in time 2 γn for some constant γ > 0, verifying 3-SAT requires at least O(n) bits.Otherwise the verifier can simply enumerate over all possible proofs which yield a sub-exponential algorithm for solving 3-SAT.Surprisingly, this bound on proof length no longer applies if quantum bits are used in proofs and verified by quantum computers.This perception rapidly aroused substantial efforts on quantum verification of NP(-complete) problems [28][29][30][31][32][33][34][35].In this line, Aaronson et al. proposed a protocol of proving 3-SAT with O( √ n) unentangled quantum states each of O(log n) qubits [28] and variants of the protocol have also been developed [30,32].However, to date a complete demonstration of quantum verification algorithm is still missing.
In this work, we report the first experimental quantum verification of SAT with single photons and linear optics, by implementing a modified version of recent proposals [34].We present a scalable design of reconfigurable optical circuits in which quantum proofs are mapped to single photons distributed in optical modes.The experiment demonstrates faithful verification of NP problems  (2)].On the basis of the given SAT instance, the two Merlins send unentangled, identical proof states to Arthur, who checks the proof on his quantum computer and makes an "accept" or "reject" decision.b, The architecture of quantum circuit for the satisfiability and uniformity test.The design comprises proof encoding, tunable permutations and measurement on the modes.These operations are mainly based on tunable two-mode transformations u combined with mode splitting and routing.With the input of single photons, the circuit can verify the satisfiability of a set of clauses or the uniformity on random matchings.c, Experimental setup for the satisfiability test and uniformity test.Merlins prepare single photons distributed in the polarization and path modes, encoding the assignment in the single-photon states as quantum witnesses.Arthur then applies permutations and interferences on these modes with linear optics.Note only states from one Merlin are required for the two tests.The output modes are detected by single-photon avalanche diodes (SPADs) and registered by a time tagger.BBO, β-barium borate crystal; BD, calcite beam displacer; P, polarizer; IF, interference filter; SMF, single mode fibre; PBS, polarizing beam-splitter.
in terms of a complete analysis on the satisfiable instance, unsatisfiable instance and cheating prover cases.Our work links the remarkable proof systems in computer science to the manipulation and detection of photons, which foreshadows further investigations of a variety of computational models in the photonic regime.

Results
Quantum verification algorithm of the satisfiability problem.An instance of SAT is formalized as the conjunction of a set of clauses φ = c 1 ∧ c 2 ... ∧ c j , each of which is the disjunction of a set of literals l 1 ∨ l 2 ... ∨ l m .A literal could be a variable x i or a negation of a variable ¬x i .In 3-SAT instances, each clause has exactly 3 literals.The quantum verification of 3-SAT corresponds to the complexity class Quantum Merlin-Arthur [QMA(K)], as the quantum analogue of NP [36][37][38].In this scheme, K non-communicating, omniscient provers (called Merlins) send K unentangled quantum proofs to a skeptical, computationally bounded verifier Arthur to convince Arthur the instance is satisfiable (see Fig. 1a).Arthur checks the proof in his computing machines and decide whether to accept or reject the proof.Two properties are required in a QMA protocol: (i) Completeness: if the instance is satisfiable, there exist a proof such that Arthur accepts with at least some high probability c; (ii) Soundness: if the instance is not satisfiable, for any proof Arthur accepts with at most some probability s.
The protocol firstly reduces the 3-SAT instance to a 2-out-of-4 SAT instance where each clause contains four variables x i , x j , x k , x l and is satisfied if two of them are true, i.e. x i + x j + x k + x l = 2.In the verification, Merlins are supposed to send Arthur K = O( √ n) identical, unentangled quantum states [28], each of the form where |i = â † i |0 and â † i is the creation operator on mode i.Here x 1 , x 2 , ..., x n ∈ {0, 1} n is an assignment of the n variables.A state of such form is called a proper state.The n-dimensional quantum state can be equivalently described by log n qubits revealing at most log n bits information by measurements on the state.To check whether the assignment x satisfies the clauses, Arthur can choose some clauses (i, j, k, l) at random and measure the K copies of |ψ in a basis with a projection on |c = (|i +|j +|k +|l )/2 for each clause.For each copy Arthur will get a probability of observing the outcome |c Then Arthur rejects the proof if he gets the outcome |c for at least one copy and accepts it otherwise.With this Satisfiability Test, Arthur will have p c = 0 if and some constant non-zero probability otherwise.An issue is that Merlins may cheat Arthur by sending him improper state, for example concentrating the amplitude in a subset of the basis {|i } such that the Satisfiability Test passes even the instance is not satisfiable.To tackle this problem Arthur can perform Uniformity Test: he randomly chooses a matching M on the set {1, ..., n} such that the set is partitioned into n/2 groups of the form (i, j), then measures each copy of the state |ψ in the basis with {|i + |j , |i − |j } for each (i, j) ∈ M .Only if the state is proper (i.e. the amplitudes are equal), one of the two outcomes will never occur.With the statistics on the outcomes, Arthur rejects the proof if two outcomes {|i + |j , |i − |j } both occur for a same (i, j) ∈ M .Here the K copies are used to obtain sufficient statistics on the outcomes to make a decision.
As the verification requires multiple copies of the state, another possible way for Merlins to cheat is to send different states rather than identical copies.For this reason, Arthur performs Symmetry Test: a swap test between two states, which accepts with certainty if the two states are identical and has a constant probability to reject when the two-state overlap is under a certain threshold.The QMA(K) protocol may be significantly reduced by simulating the K Merlins with a single Merlin who sends a product state of the K copies |ψ ⊗K , yet in this case Arthur needs to guarantee the unentanglement among the K subsystems.To this end Arthur can ask for the proof state |ψ ⊗K ∈ C d ⊗K from another Merlin and conduct a Product Test [32], which applies the swap test to each of the K pairs of corresponding subsystems of the two states.The proof will be accepted if all the swap tests pass and rejected otherwise.With the help of the product test, we can simulate the K-prover protocol with only 2 Merlins, which corresponds to the complexity result QMA(K)=QMA(2) for K ≥ 2 [32].
Overall, Arthur performs one of the four aforementioned tests with constant probability (e.g.1/4 each).As a consequence, we have an efficient quantum algorithm to verify SAT with perfect completeness and constant soundness, using two unentangled proofs of length O( √ n log n) qubits (see Materials and methods for a summary of the protocol).
Photonic implementation of the quantum verification machine.To realize the verification algorithm in photonic regime, we devise optical circuits for the four tests and experimentally implement the circuit in the case n = 6.The proofs from the two Merlins are unentangled photons generated by a parametric down-conversion process while the K copies of the state |ψ correspond to photons generated sequentially at different time.In our experiment the K copies sent by a same Merlin are identical due to the fact that the apparatus to prepare the states is fixed within the duration of the experiment.For each copy we encode the n-dimensional quantum state in the polarization and path degrees of freedom of the photon.1) encoding the assignment x 1 x 2 x 3 x 4 x 5 x 6 .When x i = 0 the phase on mode i is 0, whereas x i = 1 the phase is π.
Figure 1b depicts the circuit design for the satisfiability test and uniformity test.The circuit comprises a sequence of stages, each of which involves a set of two-mode configurable transformations u combined with mode splitting or routing (see Materials and methods for details).Starting from proof encoding, Merlin firstly splits the input single photon into an equal superposition over n modes and encodes the assignment x into the K copies of the state.Each state is then sent to successive tunable permutation modules, which select the modes corresponding to the chosen clause (i, j, k, l) or group the modes into a random matching M .Finally, the measurement and decision module performs either projection on the certain state |c or two-mode interferences on the certain matching M .The two-mode transformations u are implemented by half-wave plates (see Fig. 1c), of which the optical axes can be set in different angles to perform different two-mode sub-operations such as Pauli-X, Pauli-Z and Hadamard gates With appropriate configurations of these gates, the circuit can perform different permutations and interferences on the optical modes.By changing the settings of the wave plates to prepare the 64 proper states and verify the 15 clauses, we measure the probabilities p c for all the 64 × 15 cases (Fig. 2a), which are consistent with the theoretical satisfiability of the clauses (Fig. 2b).The satisfying proofs manifest nearly zero outcome probabilities (0.28% in average), whereas all the unsatisfying proofs manifest significant outcome probabilities exceeding the probabilities of the satisfying cases by two orders of magnitude (larger than 13.47%).Regarding the uniformity test, we show the rejection probabilities when testing the 64 proper states for the 15 matchings with K = 3 in Fig. 2c.The results exhibit a high probability of 98.67% to accept in average.For the case that Merlins send improper states, we run the uniformity test for proof states of the form |ψ im (θ) = (cos θ, sin θ, cos θ, sin θ, cos θ, sin θ)/ √ 3 with different numbers of copies K = 3, 4, 5, 6 (Fig. 2d).Here (α 1 , α 2 , α 3 , α 4 , α 5 , α 6 ) denotes a state with complex amplitudes α i in mode |i , i.e. n i=1 α i |i .An increase in the rejection probability is observed with the transition from proper states to highly improper states, which fits the numerical simulations.On the other hand, higher rejection probabilities are obtained for improper states when increasing the number of copies K.In addition, we determine the average statistical fidelity between the theoretical and experimental projection probabilities (p the c and p exp c ) to be 0.9988 ± 0.0024 (see Fig. 2e), which justifies the excellent agreements between experimental results and theoretical calculations.
To demonstrate the verification of specific instances, we concentrate on the instances including 8 clauses, in which there are 15 8 = 6435 instances.According to the satisfiability of the clauses (Fig. 2b), 90 instances are satisfiable (each with two solutions) and 6345 instances are unsatisfiable.Figure 3 visualizes the results of verifying a satisfiable instance φ 1 (illustrated in Fig. 3a) and an unsatisfiable instance φ 2 (illustrated in Fig. 3b).As Merlins aim to make Arthur accept the proof, for the satisfiable instance φ 1 Merlins will honestly send the proof encoding one of the two satisfying assignments.In this case the proof states successfully pass both tests with high probabilities (p sat r = 0.64% and p uni r = 1.31%, averaging over the two states), as shown in Fig. 3c.
For the unsatisfiable instance φ 2 , we consider situa- The satisfiable instance The unsatisfiable instance For the satisfiable instance φ1, Merlins will send proof states encoding the correct solution thus we show the results for the two satisfying proof states (red bars).For the unsatisfiable instance φ2, we test different cases consisting of sending the 64 proper states (blue bars), a deliberate cheating state |ψ ch1 in order to pass the satisfiability test (yellow bars), and improper states |ψim(θ) (grey bars).The number of copies K = 3 is adopted in the verification and the rejection probabilities are obtained by repeating each test 5000 times.
tions where Merlins send different types of states (Fig. 3c).Firstly we perform the two tests with all the 64 proper states.The verifier attains rejection probabilities p sat r larger than 11.50% and up to 95.72% in the satisfiability test although these proofs could probably pass the uniformity test (p uni r = 1.30% averaging over the 64 proper states).Secondly we realize cheating Merlins by sending deliberately designed improper states in order to pass the satisfiability test.As an example, we construct the state |ψ ch1 = (1, −3, 1, 1, 1, 1)/ √ 14 (as well as |ψ ch2 = (−3, 1, 1, 1, 1, 1)/ √ 14 for instances given in the Supplementary Information), for which the projection probability p c of verifying any of the eight clauses in φ 2 theoretically equals zero.Consequently, |ψ ch1 reaches a rejection probability p sat r = 0.44% of the same order of magnitude as in the satisfiable case.Nevertheless, Arthur can detect the cheating with the help of the uniformity test, in which a rejection probability of 31.90% is obtained.This result justifies the necessity of the uniformity test.Finally the verification is also executed by sending just improper states |ψ im (θ) with θ = {−π/6, −π/12, 0, π/12, π/6}, which exhibit considerable rejection probabilities in both tests.We conclude from the results that for all the three cases, evident rejection probabilities are observed in at least one of the two tests.The typical realizations indicate close to perfect completeness and constant soundness and thereby experimentally achieve a clear completeness-soundness gap for the quantum verification (see Supplementary Information for more examples and results).Experimental imperfections, including the limited interference visibilities, phase fluctuations and errors in the operations, lead to deviations of the outcome probabilities from ideal ones for the satisfying proof states and thereby imperfect completeness for the protocol.In real-world applications of the QVM, of particular importance is the amplification of the completeness-soundness gap.For this reason we also demonstrate the amplification of the success probability for the instances φ 1 and φ 2 , of which the protocol and results are given in the Supplementary Information.
The symmetry test and the product test require optical swap test [39], which can be implemented with a multi-mode Hong-Ou-Mandel (HOM) interference (Fig. 12a) [40].Our experiment uses a non-polarizing beamsplitter (NPBS) to perform the two-photon interferences on the six optical modes distributed in both polarization and path degrees of freedom.In the optical swap test, the probability of rejection is where |ψ 1 and |ψ 2 are the photonic states in the two input ports of the NPBS.We register all the 6 2 = 15 coincidence channels, in which the 6 one-side channels (the two photons are detected in the same output port of the NPBS) correspond to the "accept" outcome and the 9 two-side channels (the two photons are detected in different output ports of the NPBS) correspond to the "reject" outcome.We change the path difference between the two states with a delay line and observe the highdimensional two-photon HOM interference.The HOM interference of identical proper states (Fig. 12b) manifests peaks for the "accept" outcomes and dips for the "reject" outcomes, resulting in a high acceptance probability of (97.48 ± 0.56)%.This result guarantees a high probability to accept in product test, as an experimental demonstration of the reduction from QMA(K) to QMA(2).To demonstrate the performance of the symmetry test, we apply the optical swap test to different combinations of states, as shown in Fig. 12c.On the basis of the outcome probabilities over the detector patterns, it can be concluded that considerable probabilities are obtained in the "reject" outcomes if the two states are not the same.The theoretical predictions also agree with the experimental results.

Discussion
The results of the four tests, which constitute a complete quantum verification of SAT, highlight the capability of photonic machines to realize a new type of quantum advantage on the computational space [41].
Through the lens of computational complexity, the quantum provers reveal O( √ n log n)-bit information, whereas classical provers in the best algorithm need to reveal O(n) bits, not better than simply writing down the complete solution.The quantum verification machines driven by Õ( √ n) qubits can efficiently carry out the classically impossible computation, breaking through the O(n)-bit limit for classical algorithms imposed by ETH.If we in turn focus on the task of NP verification with limited information, a classical computer with an O( √ n log n)bit message runs in exponential time 2 O(n− √ n log n) just assuming ETH, whereas the quantum algorithm runs in a polynomial-time overhead [34].Consequently, QVMs will show an exponential speed-up over classical computers with limited information.Developments on quantum computation pursue provable quantum-classical separation.As ETH is a well-founded complexity-theoretic conjecture in computer science, our result foreshadows a desirable route towards realizing quantum advantages in an useful problem under a "fine-grained" complexity assumption [4].
We have demonstrated the quantum verification algorithm of the satisfiability problem with two unentangled quantum witnesses, using single photons and tunable optical circuits.By combining algorithmic designs and experimental realizations, we optimize the whole architecture of the optical circuit and realize faithful verification of instances with high accuracies and scalability.Our demonstration extends the capability of optical quantum computing into the significant computational model of proof verification.Scaling up the scheme, which requires large scale programmable linear-optical systems and precise control of experimental imperfections, is an appealing route towards quantum advantage.With current advances in photonic technologies [8][9][10]42], we expect this scheme can be scaled to larger problem sizes in the near future.Among substantial prospects, we envision quantum verification machines can stimulate experimental studies of various proof systems (QMA, QAM, QIP, MIP* etc [36-38, 43, 44]), inspire future developments of verifier-based quantum algorithms, and find applications in cloud-based quantum computing [45][46][47][48].Our work opens a new avenue in the utility of photonic NISQ devices and adds a key ingredient to the investigation towards answering valuable questions on both computational complexity and quantum physics.

Materials and methods
Quantum verification algorithm.The class Quantum Merlin-Arthur [QMA(K)] consists of the set of decision problems having K unentangled polynomial-size quantum proofs that can be verified on a quantum computer in polynomial time.As the quantum analogue of the complexity class nondeterministic-polynomial-time (NP), QMA(K) has received extensive interests and many natural problems are proven to be in the class, such as N -representability [49] in quantum chemistry.Formally, a language L is in QMA(K) c,s if there exists a polynomial-time quantum algorithm V such that, for all inputs x ∈ {0, 1} n : (i) Completeness.If x ∈ L, there exists K witnesses with poly(n) qubits each, such that V outputs "accept" with probability at least c.
(ii) Soundness.If x / ∈ L, V outputs "accept" with probability at most s for all proof states.
Our quantum verification algorithm is a modified version of the recent proposals [28,32,34].The protocol proceeds as follows.
Given a 2-out-of- Photon source.
Frequency-doubled light pulses (∼150 fs duration, 415 nm central wavelength) originating from a Ti:Sapphire laser (76 MHz repetition rate; Coherent Mira-HP) pump a beta barium borate (β-BBO) crystal phase-matched for type-II beamlike spontaneous parametric downconversion (SPDC) to produce degenerate photon pairs (830 nm central wavelength).The photon pairs are spectrally filtered by interference filters (IF) with 3 nm full-width at half-maximum and collected into single mode fibres (SMF).The pump power is set to ∼150 mW to ensure a low probability of emitting two photon pairs.By detecting one of the pair via a singlephoton avalanche diode, we characterize the second order correlation function of heralded single photons to be g (2) (0) = 0.041 ± 0.008.A Hong-Ou-Mandel interference visibility V = 0.969 ± 0.004 is observed, indicating a great indistinguishability between the two photons.The high indistinguishability guarantees a good performance of the optical swap test.See Supplementary Information for details about the g (2) (0) measurements and the HOM interference.
Optical circuit.In the satisfiability test and uniformity test, Arthur merely requires to measure the quantum proof |ψ ⊗K from one Merlin (Merlin 1 in the experiments), therefore the optical circuit shown in Fig. 1b is designed to perform local operations with the input of a single photon in each measurement.The single photons generated in the SPDC source are firstly delivered to polarization controllers and polarizers to prepare horizontally polarized states and then directed towards the optical circuit.The circuit is divided into three stages: (i) proof encoding; (ii) a sequence of tunable permutations; (iii) measurement and decision.
In Stage (i), firstly the input single photon passes the splitting module and evolves to an equal superposition on n/2 optical modes Here |0 denotes the vacuum state.This evolution is experimentally realized by a sequence of wave plates and calcite beam displacers.The following operation is a combination of n/2 two-mode transformations {u j (θ j )}, which constitute an n-mode transformation Each two-mode transformation u j (θ j ) can be written as where the angle of the optical axis of the corresponding half-wave plate is θ j /2.Each wave plate can be configured into one of the four different angles to prepare equal superposition encoding the assignment of the two variables (x 2j−1 , x 2j ) as 00,01,10 or 11.As a result, the overall transformation U can prepare arbitrary proper states.For the cheating Merlins, the wave plates are set into angles differing from the honest case to implement an unequal splitting and (or) a different transformation U .The details on proof encoding are given in the Supplementary Information.Stage (ii) comprises a sequence of tunable permutations, each consisting of a transformation U and a mode routing.In this case the two-mode transformations {u j (θ j )} are set to two-mode X or Z operations to permutate the two modes or not.The operation of the mode routing is equivalent to a fixed permutation.For example, one of the permutation matrix for mode routing in our experiment can be described as The combination of the aforementioned two operations enables programmable permutation P • U on the n optical modes.With a sequence of O(n) tunable permutation modules, the circuit can be programmed to perform all the permutations required for the two tests (See Supplementary Information for details).
In Stage (iii), the first layer of two-mode transformations {u j (θ j )} are all configured as two-mode Hadamard pairs of the two optical modes (2j − 1, 2j).The following mode routing rearranges the optical modes to enable possible further interferences required by the satisfiability test.This routing is realized by a high extinctionratio polarizing beam-splitter (PBS).Two different types of configurations are adopted for the second layer of {u j (θ j )} depending on which of the satisfiability test and uniformity test is applied.If the uniformity test is chosen, all the transformations in this layer are set to Z gates or identity operators I = 1 √ n 1 0 0 1 (without placing any operation on the two modes), which do not perform any interference.Therefore each mode corresponds to an outcome of the form |i ± |j for a certain matching M in terms of the permutation.Arthur will reject the proof when the outcomes {|i + |j , |i − |j } both occur, that is, the two detectors (1,4), (2,5) or (3,6) labelled in Fig. 1c both click among the measurements on K copies.For the satisfiability test, part of transformations in the last layer of {u j (θ j )} are set into two-mode Hadamard operations to further interfere two adjacent modes after the aforementioned mode routing.Finally, one of the output modes (the "rejection mode") for a group (i, j, k, l) corresponds to the outcome |i +|j +|k +|l , thus Arthur can decide to reject or accept the proof based on whether the detector coupled to the rejection mode clicks (see Supplementary Information for details).
The whole experimental set-up can form various Jamin-Lebedeff interferometers for different permutations and transformations.The beam displacers are strictly aligned and calibrated in order to maintain high interference visibilities for the interferometers when altering the permutations and transformations.The interference visibility for this type of interferometers is measured to be 99.4%.Each of the six output modes of the circuit is coupled to a single-photon avalanche diode (Excelitas Technologies, SPCM-800-FC).Detection events are recorded by a time-correlated single-photon counting system (Swabian Instruments, Time Tagger Ultra) with a coincidence window of 4 ns.We register the measurement results of 5000 × K photons for each test to provide the rejection probabilities shown in the figures.
Optical swap test.Two single photons are injected into two proof encoding modules respectively to prepare the two quantum states |ψ 1 and |ψ 2 , which yield the input field Here |0 1 and |0 2 represent the vacuum state for the two input sides.Then the two single-photon states interfere at the 50:50 NPBS for a multi-mode HOM interference.
To observe the HOM interference, the fibre coupler labelled in Fig. 12a is moved by an electronically controlled translation stage (Thorlabs PT1-Z8) to change the relative delay between the wave packets of the two photons.
The relationships between the creation operators for the input fields and output fields of the NPBS can be written as By substituting equation ( 6) into equation ( 5), we obtain the output field For indistinguishable photons, the resulting output state can be represented as Here |1 i , 1 j 3 denotes the state with one photon in mode i and another photon in mode j for the output port 3. The right side of equation ( 8) contains three terms, where the first two correspond to the one-side terms (two photons are in the same output port) and the last one corresponds to the two-side terms (one photon in the output port 3 and another photon in the output port 4).The probability of finding a "two-side" outcome is considering the overlap between the two states is The probability p swap r is consistent with the probability of finding a "reject" outcome in a swap test.In the experiment, each path mode of the output is attached to a SPAD, therefore the two polarization modes in the same path are detected by the same detector.This reduces the number of outcomes from n 2 to n/2 2 .The coincidence channels {1, 2}, {1, 3}, {2, 3}, {4, 5}, {4, 6}, {5, 6} correspond to the "accept" outcome (here {i, j} denotes a coincidence channel between detectors i and j as labelled in Fig. 12a).We also add photon number resolving detection by attaching a fiber beam-splitter (Thorlabs TN830R5F2) and an additional SPAD to two path modes.This scheme is capable of detecting more events on the "accept" outcome (see Supplementary Information for detailed results).(|h 1 + |v 1 )/ √ 2 and we displace the horizontal polarization with another BD to realize the superposition of three path modes.
(2) Initialize the phase differences between the three path modes to zero.This is achieved by adjusting the tilt of each beam-displacer and confirmed by monitoring the interference between different path modes with a classical laser light.
(3) After passing the splitting module, the single photonic state undergoes a combination of three unitary transformations u j (θ j ).The unitary transformations are implemented by three half-wave plates with electronicallycontrolled rotation stages (Newport PR50PP).Each wave plate is configured into one of the four angles (−67.5 • , −22.5 • , 22.5 • , 67.5 • or −22.5 • , 22.5 • , 67.5 • , 112.5 • ) to realize one of the four sub-operations Each sub-operation prepares a certain polarization corresponding to the encoding of two variables (see Fig. 6b).For example, the polarization states {(|h 2} correspond to the encoding of the assignments 00,01,10,11 into the subspace of the proof state respectively.Consequently, the three reconfigurable wave plates enable the encoding of all the 64 possible assignments into the proof state (i.e., the 64 proper states).Note the proof state can also be prepared into improper states by setting the wave plates in the proof encoding stage into other angles.
Arthur's computation machine.For each copy of the proof state, Arthur firstly performs the tunable permutations on the optical modes in Stage (ii).As explained in the main text, each module of tunable permutation is composed of a layer of unitary transformations {u j (θ j )} and a mode routing P .In our experiment, the unitary transformations can be set into different operations such as by different settings of the wave plates (see Fig. 7a).Regarding the mode routing (see Fig. 7c, the first box), we can set the wave plates in each module to realize one of the two permutation matrices 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 The configurations of the wave plates for implementing the two permutation matrices are depicted in Fig. 8.Note the operations of the aforementioned two routing modules have negative values −1 in some of the elements in actual implementations, due to the fact that a Pauli-Z sub-operation (a half-wave plate aligned in 0 • ) adds a relative π phase  IG. 9.
The detailed settings of the measurement and decision stage.(a) The settings of the wave plates to realize the measurement "SAT1", which performs projection on the modes (1,2,3,4) after the permutation.(b) The settings of the wave plates to realize the measurement "SAT2", which performs projection on the modes (3,4,5,6) after the permutation.(c) The settings of the wave plates to realize the measurement "UNI", which performs interference between the pairs of optical modes after the permutation.
in one of the two optical modes.Yet in the following design of configurations we have take the phases added by all the wave plates into consideration to eliminate the effect, therefore the modules equivalently realize the permutations P 0 and P 1 .In our experiments, Stage (ii) utilizes two modules of the tunable permutations, as shown in Fig. 8a.The two layers of unitary transformations are denoted as {u j ).The two mode routing modules are normally set into P 0 for the cases of verifying 14 clauses and all the 15 matchings, whereas the first mode routing is set into P s for the case of verifying the clause (1,2,5,6).The detailed configurations of waveplates to implement the 15 projections and the 15 matchings are given in Table I and Table II respectively.
In Stage (iii), Arthur resorts to one of the three types of measurements depending on which test is chosen and which permutation is performed.The settings of the three types of measurements are depicted in Fig. 9.For all the three types of measurements, the state firstly undergoes a layer of unitary transformations set into H operations and a mode routing (Fig. 7c, the second box).The permutation matrix for this mode routing (in the measurement and decision part) can be described as 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 For the satisfiability test, Arthur then performs the measurement "SAT1" or "SAT2", depending on which four variables are verified (upper or lower).For the uniformity test, Arthur performs the measurement "UNI" to interfere the pairs of the optical modes.
Experimental imperfections.In the satisfiability test, each combination of a proof state and a verified clause corresponds to a rejection probability p c .To characterize the experimental errors, we calculate the average statistical fidelity between the theoretical and experimental projection probabilities (p the c and p exp c ).The limited interference visibility and the phase fluctuations, together with the systematic errors in the operations, are responsible for the deviations and result in a non-zero projection probability for the satisfying proofs.The alignments of BDs are pre-calibrated to achieve interference visibilities exceeding 99% and the path differences within the interferometers are tuned to  For the satisfiable instance φ3, Merlins will send states encoding the correct solution thus we show the results for the two satisfying proof states (red bars).For the unsatisfiable instance φ4, we test different cases consisting of sending the 64 proper states (blue bars), a deliberate cheating proof state |ψ ch2 in order to pass the satisfiability test (yellow bars), improper states |ψim(θ) (grey bars).The number of copies K = 3 is adopted in the verification.accept, which confirm the nearly perfect completeness of the protocol.In addition, we also give the results for the 90 cheating cases where Merlins send the states |ψ ch1 or |ψ ch2 in Fig. 11b.The rejection probabilities for these cheating cases are in the same order of magnitude as the probabilities for verifying satisfiable instances.
Optical swap test.The results of the Hong-Ou-Mandel (HOM) interference shown in the main text are based on the detection events of the 15 two-fold coincidence channels.Here we observe the HOM interference for all the 15 outcomes, as illustrated in Fig. 12.The interferences for the 6 "accept" channels manifest peaks whereas the interferences for the 9 "reject" channels manifest dips.In visualizing the results of the HOM interference in Fig. 4b in the main text, a factor of 3/2 is applied to the probability of the "accept" outcome to compensate the events that two photons trigger the same detector.To demonstrate the detection of events that two photons are in the same path, we also implement the optical swap test with additional detectors, as depicted in Fig. 13.The additional detectors add photon-number resolution to two of the optical paths.Under this detection scheme, we perform the optical swap tests on states that are the same as in the main text.For the case that the two states are the same, higher acceptance probability is observed compared the results with 6 detectors.

AMPLIFICATION OF THE SUCCESS PROBABILITY
For practical use of verification algorithms, a problem of particular interest is the ability to amplify the success probability of Arthur's decision.It has been conjectured and proven that any QMA(2) protocol can be amplified to exponentially small error [28,32].Here we resort to an amplification protocol proposed in Ref. [28] to demonstrate the amplification of the success probability.The main idea is to repeat the original verification protocol a certain number of times and then output an answer based on specific criteria.For example, Merlins and Arthur firstly run the verification protocol T times, then Arthur accepts if at least (c + s)T /2 runs of the verification algorithm output "accept" and rejects otherwise.Here c and s represent completeness and soundness of the original protocol respectively.As an example, we perform the amplification protocol in verifying the satisfiability of instances φ 1 and  Fiber beam-splitters FIG. 13.Optical swap test with additional detectors.The HOM interference scheme is as described in the main text (Fig. 4a).Two 50:50 fiber beam-splitters are attached to the middle optical path in the two output sides respectively.Additional SPADs are also coupled to the outputs of the fiber beam-splitters.The two-fold coincidences for the clicks of the 8 detectors are registered.

FIG. 1 .
FIG.1.Quantum verification machine.a, The two-prover Quantum Merlin-Arthur protocol [QMA(2)].On the basis of the given SAT instance, the two Merlins send unentangled, identical proof states to Arthur, who checks the proof on his quantum computer and makes an "accept" or "reject" decision.b, The architecture of quantum circuit for the satisfiability and uniformity test.The design comprises proof encoding, tunable permutations and measurement on the modes.These operations are mainly based on tunable two-mode transformations u combined with mode splitting and routing.With the input of single photons, the circuit can verify the satisfiability of a set of clauses or the uniformity on random matchings.c, Experimental setup for the satisfiability test and uniformity test.Merlins prepare single photons distributed in the polarization and path modes, encoding the assignment in the single-photon states as quantum witnesses.Arthur then applies permutations and interferences on these modes with linear optics.Note only states from one Merlin are required for the two tests.The output modes are detected by single-photon avalanche diodes (SPADs) and registered by a time tagger.BBO, β-barium borate crystal; BD, calcite beam displacer; P, polarizer; IF, interference filter; SMF, single mode fibre; PBS, polarizing beam-splitter.

FIG. 2 .
FIG. 2. Validation of the satisfiablity test and uniformity test.a, The experimentally measured projection probabilities pc when verifying the 15 clauses (rows) with the 64 proper states (columns).Here the proof states from left to right are |000000 , |100000 ..., |111111 , while the verified clauses from top to down are (1, 2, 3, 4), (1, 2, 3, 5)..., (3, 4, 5, 6).(i, j, k, l) denotes the clause xi + xj + x k + x l = 2. b, The satisfiability of the 15 clauses for the 64 assignments.An assignment x may satisfies (white) or unsatisfies (blue) a certain clause.c, The measured rejection probabilities p uni r of the uniformity test for the 64 proper states × 15 matchings when the number of copies K = 3. d, The rejection probability p uni r of the uniformity test for improper states of the form |ψim(θ) = (cos θ, sin θ, cos θ, sin θ, cos θ, sin θ)/ √ 3.Here we take the results for the matching {(1, 2), (3, 4), (5, 6)} under different numbers of copies as an example.For each θ we run the test 5000 times and collect the measurement outcomes of 5000 × K photons to acquire the rejection probability p uni r .The results given by numerical simulations are shown as solid lines.Error bars are uncertainties assuming Poisson count statistics.e, The statistical fidelities Fc = p the c p exp

FIG. 4 .
FIG. 4. The optical swap test.a, Experimental scheme.Two single photons are injected into the setup and prepared as two quantum proofs |ψ1 and |ψ2 .The two states |ψ1 and |ψ2 are interfered at a non-polarizing beam-splitter (NPBS), and the interference results are read out by detectors.A time tagger registers single-shot events from all the two-fold coincidence channels.The path difference between the two photons can be changed by a delay line to observe the interference.b, Multidimensional Hong-Ou-Mandel (HOM) interference.Solid lines are curve fittings of the data to a Gaussian multiplied by a sinc function.A HOM interference dip (peak) is observed for the rejection (corrected acceptance) probabilities.Error bars are uncertainties assuming Poisson count statistics.c, The results of the swap test for typical cases: the two states are proper and the same (the first panel); the two states are proper but not the same (the second and third panels), one of the state is proper and the another is improper (the fourth and fifth panels).Each panel shows the experimental (red and blue bars) and theoretical (yellow and grey bars) outcome probabilities on the 15 coincidence channels.The percentage labelled in each panel denotes the rejection probability of the swap test p swap r .

FIG. 7 .FIG. 8 .
FIG.7.The correspondence between the circuit operations and the experimental setups.(a-c) The experimental implementations of the unitary transformation, the mode splitting and the mode routing.
respectively and the overall transformations are thus U

FIG. 11
FIG. 11.(a) The rejection probabilities of the satisfiability test for all the 90 satisfiable instances.For each instance, there are two satisfying assignments (proof states), which are denoted as red bars and blue bars respectively.(b) The rejection probabilities of the satisfiability test for the cheating cases.In each case, Merlins send |ψ ch1 (yellow bars) or |ψ ch2 (green bars) as proof states.

φ 2 FIG. 14 .
FIG. 14.The results of optical swap test with additional detectors for typical cases: (a) the two states are proper and identical; (b,c) the two states are proper but not identical, (d,e) one of the state is proper and the another is improper.Each panel shows the experimental (red and blue bars) and theoretical (yellow and grey bars) outcome probabilities on the 28 coincidence channels.

FIG. 15 .
FIG.15.The amplification of the completeness-soundness gap.Each marker represents the rejection probability of a proof in verifying the example satisfiable instance φ1 (circle, blue) and the example unsatisfiable instance φ2 (square, red) in the main text.The success probability of the verification (green area) increases with the increase of the number of repetition.
The optical modes {|1 , |2 , |3 , |4 , ..., |n } are mapped to {|h 1 , |v 1 , |h 2 , |v 2 , ..., |v n/2 }, where |h j (|v j ) denotes the horizontal (vertical) polarization in path j.In the following we use |x 1 x 2 x 3 x 4 x 5 x 6 to represent a proper state given in equation ( 4 SAT instance φ, each of the two Merlins sends to Arthur a quantum state in C n ⊗K (with K subsystems).The two quantum states are denoted as |ϕ 1 and |ϕ 2 respectively.Arthur performs one of the following four tests, each with probability 1/4.(1) Satisfiability Test.Arthur randomly chooses a block containing a set of clauses such that no variable appears more than once.Then Arthur measures each of the K subsystems from Merlin 1 in a basis corresponding to the clauses in the block.For each clause (i, j, k, l), Arthur performs the projection on |c = (|i + |j + |k + |l )/2.Symmetry Test.Arthur chooses the subsystem 1 and another randomly chosen subsystem from Merlin 1, and performs a swap test on the two states.If the swap test passes, accept.Otherwise, reject.(4) Product Test.Arthur performs swap test on each of the K pairs of corresponding subsystems of |ψ 1 and |ψ 2 , and accepts if all of the swap tests pass.Otherwise, reject.