Multi-client distributed blind quantum computation with the Qline architecture

Universal blind quantum computing allows users with minimal quantum resources to delegate a quantum computation to a remote quantum server, while keeping intrinsically hidden input, algorithm, and outcome. State-of-art experimental demonstrations of such a protocol have only involved one client. However, an increasing number of multi-party algorithms, e.g. federated machine learning, require the collaboration of multiple clients to carry out a given joint computation. In this work, we propose and experimentally demonstrate a lightweight multi-client blind quantum computation protocol based on a recently proposed linear quantum network configuration (Qline). Our protocol originality resides in three main strengths: scalability, since we eliminate the need for each client to have its own trusted source or measurement device, low-loss, by optimizing the orchestration of classical communication between each client and server through fast classical electronic control, and compatibility with distributed architectures while remaining intact even against correlated attacks of server nodes and malicious clients.


I. INTRODUCTION
Despite the increasing technological progress in the manipulation of many-qubit systems [1][2][3], providing quantum computing as a service for end-users poses several challenges, including scalability, privacy, and integrity.Indeed, in order to achieve true quantum advantage from emerging devices, they must scale up beyond the current monolithically designed noisy intermediatescale quantum regime.As of today, the only viable solution being pursued by all qubit platforms is modularity and interconnected architecture, where photonic links are considered the best option.Moreover, it is also clear that quantum machines need to be integrated into cloud services or data centers, allowing multiple clients to connect locally or globally to access these devices.In such a context, the issue of keeping the computation and data protected from malicious parties will be a key challenge for such large-scale adaptation.Notably, photonic links to quantum servers enable the capability of achieving informational security for delegated computing, known as blind quantum computing (BQC), which is not achievable using only classical communication between client and server [4].Such a protocol builds on the measurement-based model for quantum computation [5,6] that exploits mid-circuit measurements for teleportation-based quantum computing on encrypted quantum states sent to a remote server via a quantum link [7,8].Over the last decade, many BQC protocols have been proposed [9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24], together with proof-of-concept experimental demonstrations in different settings [25][26][27][28][29][30][31][32][33].However, the challenge of multiclient settings has been explored only theoretically due to the high resource requirements of the proposed protocols [34][35][36][37][38].
Yet, a growing number of classical delegated computing tasks require that multiple clients collaborate to carry out a joint func-tion, e.g.federated machine learning tasks [39,40].Notably, quantum counterparts of such algorithms have been proposed as well [41], including a federated quantum machine learning protocol based on BQC [42].
In this paper, we propose a modular lightweight distributed architecture for multi-client BQC based on the recently proposed Qline quantum network link configuration [43], that enables scalable client insertion.With such an architecture in mind, we present a tailor-made multi-party blind quantum computing protocol such that the clients in the Qline only own trusted single qubit rotation devices, while the overall protocol still provides privacy for the joint computation performed by several users on the cloud.In the Qline network architecture, the quantum resource is first generated by a potentially untrusted server, then distributed to the clients, such that each client can apply arbitrary single-qubit operations on the incoming qubits and, at the end of the line, measured by a second again potentially untrusted server.An analogous architecture was first introduced in [44] for quantum-assisted secret sharing, and later used for various tasks such as quantum key distribution or secure computation [45][46][47].The main advantages of such a structure reside in the possibility to integrate it easily into larger-scale networks, its compatibility with key establishment protocols [43], and its low hardware complexity.In order to simplify the resource requirements of the multi-client BQC protocol in [34,38], we show that, within such an architecture, it is enough that each client in the Qline adds a new layer of encryption to the flying qubits that will be used as the common key for their later private joint computation on the remote server.Such collaboration may be typical, for instance, of privacy-preserving machine learning algorithms where each client's input data and parameters related to the algorithm should remain private to all parties.To implement it, we employ a fibered photonic platform equipped with genuine measurement adaptivity to enable deterministic computation [5].Within this setup, we are able to show the blindness and the correctness of the protocol, in both cases where the function to be computed has a classical or a quantum output.Our experimental Figure 1.Conceptual scheme of BQC.In the BQC protocol, a client randomly prepares n qubits and sends them to a quantum server.The server uses the qubits to form a resource state and, at each of the O(n) rounds of the computation, it measures one qubit in the measurement basis given by the client.Then, it gives back the measurement outcome to the client, who decides accordingly on the next measurement basis.Figure inspired by [48].The details of BQC are presented in Protocol S4 of the Supplementary Information.
proof-of-concept demonstrates a two-client scenario that can be easily extended to larger and more complex quantum networks featuring any number of clients at arbitrary distances.

II. A MULTI-CLIENT BQC PROTOCOL
In this section, we describe in detail the protocol proposed and successfully implemented in this work.It is built on the theoretical premises in [34,38], and tailored to a Qline architecture [43].Differently from the single client original protocol of [7] depicted in Fig. 1, the results of [34,38] enable multi-client BQC by exploiting secure multi-party computation (SMPC), whose aim is to allow several users to collaboratively compute a joint function on their private data.The classical SMPC functionality enables coordination of the parties in a delegated quantum computing task, such that the full computation details are blind not only to the server, but also to potentially dishonest clients that collude with it.However, implementing such functionality would need additional rounds of classical communication among the clients and server, during which it would be unfeasible to coherently store the quantum state.Therefore, to optimize the storage time, in our implementation, we substitute classical SMPC with a trusted third party (TTP) that mediates the communication between the clients and the server reducing the number of rounds, while the blindness of the protocol is still proven against any strict subset of colluding malicious adversaries.In this way, the quantum state needs to be stored for significantly shorter times than if using full classical SMPC, thus enabling our first proof-of-concept experimental demonstration of a twoclient BQC.To motivate our experimental design, this section is divided into two parts: the first one is devoted to the description of a two-client example, which we implemented experimentally demonstrating the key building blocks that are required for a fully scalable solution.In the second part, we present the extension to the n clients case and universal quantum computing resources.

A. The two-client protocol
Consider Alice and Bob wish to run a joint computation on a remote server.Alice has private classical data x 1 and x 2 while Bob has private gate parameters ϕ 1 and ϕ 2 , and the target joint circuit is as shown in Fig. 2a.This is a typical building block of any large-scale privacy-preserving QML, such as the one proposed in [41].In what follows we demonstrate the steps to make the above joint computation both distributed and secure as shown in Fig. 2b.

State preparation.
A source of maximally entangled bipartite states, S 1 , distributes two-qubit states along two quantum channels, of the form: Alice receives the two qubits, and applies single-qubit zrotations of angles θ A i to them, randomly chosen in the set A = {0, π/4, 2π/4,... 7π/4}.This will hide (via quantum onetime padding) her classical input data which would be encoded on these qubits via Z xi operations.Moreover, she chooses two random bits r A 1 , r A 2 that will later hide the outcome of the computation.She communicates her secret parameters to the TTP.She then sends her two encrypted qubits to the second client, Bob, who applies further random θ B 1 , θ B 2 z-rotations, again chosen from the set A to one-time pad his private algorithm parameter ϕ 1 , ϕ 2 .Bob also chooses two random bits r B 1 , r B 2 for the encryption of the output as well.He then communicates his secret parameters to the TTP.From now on, we will use the following definitions: θ i = θ A i +θ B i and r i = r A i ⊕r B i .The resulting quantum state at this stage is the following: This state is then sent to server S 2 .
Interaction and measurement stage.From now on, the clients and S 2 only communicate classically, through the TTP.The protocol requires two rounds, one for each qubit to be measured.The blind measurement angle δ i at the i−th round, for i = 1, 2, is computed by the TTP according to the formula: where m true 0 = 0 and m true 1 = m 1 ⊕r 1 .Analogously to the first measurement outcome, the outcome of the second measurement is decrypted according to the formula: m true 2 = m 2 ⊕r 2 before giving it back to the clients.A slight change in the protocol is needed in the case where a quantum function is computed, i.e. the output qubit must be prepared by the clients in the state |+⟩ [7].The correctness of the protocol is straightforward and can be directly obtained from [7,10,38].However, the security proof is more subtle compared to previous works that were based on trusted state preparation for each client.We first present the generalization of our protocol and then provide the full proof of security that is applicable to this special case as well.The same computation of the circuit presented in a) is encrypted to preserve the privacy of each party's information.In our two-client BQC protocol, a quantum channel connects a source of bipartite quantum states to two clients disposed along the Qline.Each client chooses their secret parameters θ j i , r j i , xi, ϕi, for i = 1, 2 and j = A, B, and applies z-rotations to both qubits.All secret parameters and measurement outcomes pass through a TTP to compute the transformed measurement bases δi and the corrected outcomes.At the end of the line, the quantum state is sent to the server S2 to carry out the desired computation, which is carried out through two rounds of classical communication between clients, TTP, and the server S2. c) Generalization of our architecture to m Qlines with n clients distributed along them.In a Qline, a quantum state source distributes single qubits and each client applies random rotations to all qubits.At the end of the line, a powerful quantum server employs the received qubits to generate the resource state for the computation and calculate a joint function.

B. Generalization to the multi-client scenario
In this section, we generalize our protocol to a scenario where n clients want to perform a joint computation on a possibly larger resource state.Blindness should be guaranteed for any single honest client.We consider the target computation to be defined as a measurement pattern [5] by the measurement angles (ϕ v ) v∈V , where v ∈ V ranges over all qubits in the resource graph state.These angles can be fixed and publicly known, or jointly input by any subset of clients.In the latter case, blindness holds for the measurement angles as well.The input qubits I ⊂ V are partitioned into sets (I j ) j∈{1,...,n} , where I j belongs to the j-th client who has the bit string x j ∈ {0,1} |Ij | as input.To keep each client's input blind, it is required that each qubit in the resource state travels once along the Qline and accumulates random rotations by all clients, as depicted in Fig. 2c.In this way, a resource state on m = |V | qubits would require m Qlines.However, this process may be (partially) parallelized, in the sense that multiple qubits can be sent along the Qline at once -as long as the clients can perform the necessary rotations in parallel as well.After the server received the qubits that have passed through the Qline, it follows a standard execution of the BQC protocol (Protocol S4 of the Supplementary Information.As all communication from this point forward is entirely classical, the TTP governs the instructions to the server for the remainder of the protocol.A detailed description of the full multi-client protocol on scalable resource states is given in Protocol 1.

Protocol 1: Multi-Client Blind Quantum Computation
Public Information: • A graph G = (V,E,I,O) with input and output vertices I and O, respectively.
• A partial order ⪯ on the set V of vertices. Inputs: • The n clients collaboratively input a set of angles (ϕv)v∈V , and a flow f on G compatible with ⪯. • The orchestrator and the server have no inputs.

Protocol:
1.The n clients send all of their inputs to the orchestrator.
2. The orchestrator and the server perform the BQC Protocol S4.For every |+ θ ⟩-state that the orchestrator would need to send to the server, they instead perform the following: (a) The server prepares a |+⟩-state.
(b) All parties perform one execution of the Collaborative Remote State Rotation Protocol S5, where the server uses the |+⟩-state as an input, and the orchestrator inputs the angle θ.
(c) The server uses the output state in the BQC Protocol S4.
3. The orchestrator distributes the classical output among the clients.The server sends the output qubits in O to the designated clients, with the orchestrator providing the decryption keys.
Note that the orchestrator from Protocol 1 must be trusted, but is an entirely classical party.To remove all trust assumptions on this party, it can be replaced with any composably secure classical SMPC protocol which is performed by the clients and the server.Moreover, much of the calculations that the orchestrator needs to perform, including the sampling of random coins and the evaluation of the formulae for the corrected measure-ment angles, can be done in a classical pre-processing step.The computation during the quantum phase then boils down to the choice of one of two possible measurement angles based on the previously reported measurement outcomes.Finally, it is worth mentioning that the requirement that every client has access to each Qline can be weakened when accepting stronger trust assumptions.Blindness holds as long as there exists at least one honest client along each Qline.Therefore, even if not every client participates at each Qline, blindness is still guaranteed if we restrict the adversarial patterns to not corrupt all clients along any Qline at once.
In the concrete case of our experiment, the graph G is a two-qubit cluster state, that is, V = {1, 2}.Both qubits are Alice's input qubits, so I 1 = I = V , while Bob has no input qubits (I 2 = ∅) but chooses the measurement angles (ϕ 1 ,ϕ 2 ).We consider two different computations: in the first case, we interpret both measurement outcomes as the classical output of the computation, while in the second case, we consider the second qubit to be the quantum output of the computation, hence O = {2}.

C. Security
In our protocol, the clients' quantum abilities are restricted to receiving single-qubit states, applying a random z-rotation to it, and forwarding it to the next client or server.From the perspective of an honest client, this behavior is exactly captured by the Remote State Rotation (RSR) functionality introduced in [11].The latter showed that RSR can indeed be used in the context of the BQC protocol to delegate a universal quantum computation with perfect blindness.This immediately implies the security of the proposed protocol with a single honest client and an untrusted server, as the instructions of the protocols exactly coincide.By a similar argument, security can be shown for the two-client and multi-client generalizations.In the spirit of the security proof in [34], the sequential rotations of a single qubit by all clients along the Qline can be seen as a collaborative version of RSR where the role of the RSR-client is now taken by an entirely classical trusted virtual party, the orchestrator.The entire execution of the protocol then becomes one run of the BQC protocol between the orchestrator and the server.Finally, in real-world implementations, the orchestrator can be replaced by a classical SMPC protocol.Security follows by composition of the above-mentioned building blocks which have all been proven to be composably secure in the Abstract Cryptography framework [49].Further details about the security analysis of the full protocol, including a formal security proof, are provided in Sec.S1 of the Supplementary Information.

III. EXPERIMENTAL APPARATUS
In Fig. 3 we describe the experimental apparatus we employ to implement the two-client protocol.A detailed time scheme of the protocol is reported in Sec.S2 of the Supplementary Information.
Photon source.A Sagnac-based source of polarizationentangled photons, i.e. server S 1 , generates pairs of photons in the state defined in Eq. ( 1), where we encode the computational basis vector |0⟩ in the photons' horizontal polarization (|H⟩), and |1⟩ in the vertical one (|V ⟩).The photon pairs are sent to the clients who apply their random rotations.The resulting state after these transformations is defined in Eq. ( 2).
Clients' preparation.At each run of the protocol, we set all random parameters through an ID Quantique quantum random number generator (QRNG).Both clients use liquid crystals (LCs) to apply their rotations, which are set in this preparation stage.The TTP is made up of a computer linked to a fast electronic circuit and stores all clients' parameters.With such information, the TTP pre-computes the measurement angle δ 1 , and the first measurement station is set accordingly.Moreover, the TTP also pre-computes the two possible values for δ 2 , considering that the first outcome is still unknown, namely δ ± 2 = θ 2 +x 2 π+r 2 π±ϕ 2 , to speed up the measurement step of the protocol.
Measurement.The two photons are sent to server S 2 of Fig. 3 where measurements of the form M (δ) = cos(δ)σ x +sin(δ)σ y are performed.The first one is made up of a quarter-wave plate (QWP), a half-wave plate (HWP), and a polarizing beam splitter (PBS).The two single-photon avalanche photodiodes (APD) of the first measurement station are connected to a fast electronic circuit that selects δ + 2 or δ − 2 , according to the corrected outcome of the first measurement, m true 1 = m 1 ⊕ r 1 .In the second measurement station, we substitute the QWP with a Pockels cell (PC), i.e. a fast electro-optical modulator that performs the identity when no voltage is applied, while applying a phase shift between orthogonal polarizations when a voltage is applied.The second photon is delayed with respect to the first one by using a ≈ 65 m single-mode fiber to enable feed-forward in the second measurement station.Finally, the second outcome is corrected according to m true 2 = m 2 ⊕r 2 .Further details about the feedforward system can be found in Sec.S4 of the Supplementary Information.All events are collected through a coincidence box that records as two-fold coincidences all detector clicks occurring in a given time window.

IV. RESULTS
Blindness of the protocol.To show that the server cannot gain any information about the outcome of the computation, we suppose that the clients want to compute a given quantum function whose outcome is represented by the second qubit.We repeated the experiment for both qubits of the cluster state, but we show in the main text only the resulting density matrix for the second qubit.Details about the blindness of the first qubit can be found in Sec.S5 of the Supplementary Information.We demonstrate blindness of the second qubit by keeping the measurement angle δ 1 = π fixed and by averaging over all density matrices resulting in the output qubit for different initial rotation angles θ j 1 , where j = A,B, namely 64 combinations.The density matrix in Fig. 4a shows the resulting quantum state, which has a fidelity with a single-qubit completely mixed state To make the clients' choices random, the clients' secret parameters are chosen by means of a quantum random number generator (QRNG).Then, the two photons are sent to Server 2 (S2).While the second photon is delayed through a ≈ 65 m-long single-mode fiber, the first photon is measured, by using a sequence of a quarter-wave plate (QWP), a half-wave plate (HWP), and a polarizing beam splitter (PBS).The second measurement station, instead, is composed of a Pockels cell (PC), a HWP, and a PBS.A fast data elaboration system, constituted by a computer and a fast electronic circuit, embodies the TTP.The two detectors of the first measurement station are linked to such a system, that directly activates the PC with a suitable high-voltage (HV) pulse according to the desired second measurement basis.All outcomes are collected through a coincidence box that records as two-fold coincidences all events occurring in a given time window.
amounting to F 2 = 0.99870±0.00003,while the measured Von Neumann entropy is S 2 = 0.9963±0.0001, to be compared with the expected value of 1 for a completely mixed single-qubit state.Furthermore, we demonstrate the blindness of the whole initial two-qubit cluster state, by averaging over all density matrices corresponding to 64 combinations of the initial z-rotations, for parameters θ A 1 and θ B 2 , while keeping θ B 1 , θ A 2 = 0. We stress that these combinations are enough to demonstrate blindness, as the random rotations on each qubit still take all possible values in the set A. For the two-qubit state, whose density matrix is shown in Fig. 4b, we estimated a fidelity F = 0.99433±0.00003with the completely mixed state and with a Von Neumann entropy of S = 1.9836±0.0001, to be compared with the expected value of 2 for a completely mixed two-qubit state.All density matrices are retrieved from raw experimental data through quantum state tomography [50].Further details about the blindness of the second qubit and the full initial state are reported in Secs.S6-S7 of the Supplementary Information.
Correctness of the protocol.Let us now consider the scenario where the clients want to compute a quantum function.In this case, we take the second qubit as the outcome of the computation, by preparing it in the state |+⟩.We perform the computation ϕ 1 = π/4, with input bits x 1 , x 2 set to 0. We set the clients' secret parameters as θ A 1 = π/2, θ B 1 = π/4 and r A 1 = r B 1 = 0. We show our results in Fig. 5.The estimated fidelity with the ideal state amounts to F π/4 = 0.972 ± 0.003.In Sec.S5-S6 of the Supplementary Information, we show instances of single-qubit quantum state tomographies of the two qubits and their fidelity with respect to the theoretical expectations.We then demonstrate the correctness of the computation for classical functions.The algorithm performed over input data x 1 , x 2 is characterized by the two true measurement angles ϕ 1 , ϕ 2 .Choosing x 1 or x 2 equal to 1 has simply the effect of inverting the minima and the maxima of the distributions.In Fig. 6, we show ten different probability distributions obtained by trying ten different combinations of the algorithm parameters (ϕ 1 , ϕ 2 , x 1 , x 2 ), and the comparison with the ideal and the noisy model case.All the obtained results are in good agreement with our noisy model and follow qualitatively the ideal expectations.Small deviations from the expected values are mainly due to the visibility of the quantum state at the end of the Qline and to imperfections coming from the non-ideal electro-optical modulators employed, i.e. the LCs and the PC (further details about our noisy model are in Sec.S8 of the Supplementary Information).

V. DISCUSSION
In this work, we proposed a multi-client version of the BQC protocol [7] and experimentally demonstrated it in a two-client setting.We first simplified the protocol described in [34,38] to tailor it to the photonic Qline network introduced in [43].To this end, we studied a photonic platform equipped with a source of polarization-entangled photon pairs, an active feed-forward system, and a fiber-based structure to connect the involved parties.In our scheme, the clients only need to apply single-qubit rotations.Within this setup, we computed the outcomes of ten different classical functions, by changing the input data and the algorithm, and compared the results with a noisy model compat- ible with our experimental conditions.Also, we demonstrated the correctness of the protocol when the function to be computed has a quantum output.Finally, we showed that the server cannot gain any information about the inputs of the clients or the outcome of the computation.
Scalability.Our proof-of-concept demonstration can represent a step forward toward the realization of a scalable and secure quantum cloud access infrastructure with multiple clients.Indeed, in a real-world protocol, the necessary classical communication as part of the SMPC in between the measurements would considerably increase the time latency, in particular, if run over a slow network, such as the internet.Therefore, to make the experimental realization of the proposed protocol feasible, we replaced the SMPC with a fast electronic data elaboration circuit to both reduce the communication rounds and compensate for the absence of a quantum memory.This allowed us to reduce the delay between measurements to a manageable level.Scaling up the size of the computation would require more qubits and their communication from the photon source past all clients to the server.In principle, this could be realized in two ways that can eventually be combined.First, the qubits could be sent all at once, which would require the clients to be able to apply rotations to multiple states at once.Alternatively, the qubits could be sent sequentially, one at a time.However, this second option would require the ability to store or delay them until the clients were able to adjust their rotation gates since every qubit is rotated by a different angle.In our demonstration, we opted for the first option as it represented the optimal way to minimize time latency and, consequently, photon loss.Moreover, the choice of adopting an optimized feed-forward system for measurement adaptivity in our setup is not only crucial to

Real part
Imaginary part ensure blind and deterministic computation, but also to scale up the protocol.Indeed, post-selection schemes would require an exponentially growing number of measurements depending on the dimension of the quantum system, which would affect significantly the possibility of applications to larger quantum systems.
Future work.While our implementation guarantees the privacy of the inputs provided by the clients, the outcome of the computation is not verified.We leave the addition of verification to the proposed protocol as future work.One possible path towards verification with Qline architecture might be the employment of the novel dummyless testing technique from [34].However, as of now, the question whether states prepared by rotation-only clients are sufficient for verification remains open, as [11] only showed that this kind of states are enough to achieve blindness.
We believe that this work has insightful implications both from a theoretical and an experimental point of view.From a theoretical perspective, it constitutes a strong encouragement toward the development of collaborative computational algorithms over distributed quantum networks, as well as investigations about their verification.From an experimental point of view, instead, it represents a step forward toward the applications of photonic linear quantum networks as building blocks for more complex networks, toward the realization of a large and densely connected quantum cloud.Figure 6.Computation of a classical function.In this bar plot, we show ten different measurement angles and Alice's input combinations (ϕ1, ϕ2, x1, x2).In the grey region, we kept the algorithm fixed while changing the input data, to show the changes in both the expected and experimental distributions.In the white region, instead, we changed both algorithms and input data.The uncertainties on the experimental frequencies were obtained assuming Poissonian statistics, and the black bars correspond to one standard deviation.The eventual absence of black bars means that the uncertainty was too small to be visible in this plot.

VI. METHODS
Photon pairs are generated in a parametric down-conversion source, composed of a 25-mm-thick periodically-poled Potassium Titanyl Phosphate (ppKTP) crystal inside a Sagnac interferometer.The source uses a Toptica continuous-wave diode laser with a wavelength equal to 405 nm.Both photons are generated at a wavelength equal to 810 nm.To test the quality of the bipartite state generated by S 1 , we perform a CHSH Bell test [51] and obtain a Bell parameter equal to 2.752 ± 0.006.The generated photons are filtered in wavelength and spatial mode by using, respectively, narrow-band filters and singlemode fibers.The PC is a LiNbO 3 crystal made by the Shangai Institute of Ceramics having a rise-time equal to 90 ns.A fast electronic circuit transforms signals coming from the detectors of the first measurement station into high-voltage calibrated pulses, needed to activate the PC.The amount of delay on the second photon was evaluated considering the response time of the detectors, the speed of the signal transmission through a single-mode fiber, whose refraction index is ≈ 1.45, and the activation time of the PC.Therefore, we used a ≈ 65 m long single-mode fiber that allows a delay of ≈ 320 ns of the second photon with respect to the first.The voltages applied to the PC to insert a phase shift equal to π/4, π/2, 3π/4 were, respectively, V π/4 = 650 V, V π/2 = 850 V, V 3π/4 = 1100 V. Further details about the feed-forward system are given in Sec.S4 of the Supplementary Information.Our experiment is performed shot-by-shot, namely, each event of our data takings is characterized by a different randomly chosen set of initial parameters θ j i ,r j i , for i = 1, 2 and j = A, B, while the algorithm (ϕ i , x i , for i = 1, 2) is kept fixed for each data taking.

AUTHOR CONTRIBUTIONS
B. P., D. L., L. L., G. C., N. S., M. K., F. S., and E. K. contributed to developing the ideas and discussions explored in the paper.B. P., D. L., M. K., and E. K. contributed to the design of the protocols.B. P., L. L., G. C., G. M., N. S., and F. S. contributed to the experimental implementation.All authors contributed equally to the writing, editing, and final revision of the paper.

Protocol S4: Blind Quantum Computation
Public Information: • A graph G = (V, E, I, O) with input and output vertices I and O, respectively.
• A partial order ⪯ on the set V of vertices.

Inputs:
• The client has as input a classical bit string x ∈ {0, 1} |I| .It further inputs a set of angles (ϕv)v∈V , and a flow f on G compatible with ⪯. • The server has no inputs.

Protocol:
1.For all v ∈ V , the client samples an angle θ(v) ←R A uniformly at random, prepares the single-qubit state |+ θ(v) ⟩, and sends it to the server.
2. The server applies the entangling operation according to the graph G, i.e., for every edge {v, w} ∈ E, the server applies the two-qubit gate CZvw.
3. For all v ∈ V \ O, such that the partial order ⪯ is respected, the client and the server perform the following interactive steps: (a) The client uses the previous (corrected) measurement outcomes to compute the corrected angle ϕ ′ (v) from ϕ(v) according to the flow f .4. The client outputs the bit string (m ′ (v)) v∈V \O .The server further sends the qubits in O to the client, who decrypts them (using θ(v), r(v) and m ′ (v) as keys) and keeps them as additional output.

Protocol S5: Collaborative Remote State Rotation
Inputs: • The n clients have no input.
• The orchestrator has as input an angle θ ∈ A.
• The server receives as input a single-qubit quantum state ρ. Protocol: 1.For j = 1, . . ., n, client j samples uniformly at random θj ←R A, and sends θj to the orchestrator.
3. For j = 1, . . ., n, client j applies the operation Rz(θj) to the received quantum state and forwards it to the next client.After applying its own rotation, client n forwards the final state to the server.
4. The orchestrator computes θ ′ = θ − n j=1 θj (mod 2π) and sends θ ′ to the server.5.The server applies the operation Rz(θ ′ ) to the single-qubit state that it received from client n, and keeps the resulting state as its output.
malicious coalition of the server and n−1 clients.Because the protocol and the ideal resource are sufficiently symmetric in the enumeration of the clients, we can assume without loss of generality that the first client behaves honestly.The construction of the simulator for this scenario is given as Simulator S6.It remains to be shown that the views of the distinguisher in the real world where it has access to the inputs θ, ρ and to the views of all malicious parties, and in the ideal world where it has access to the inputs θ, ρ and to the interfaces to the simulator are perfectly equal.These two views can be summarized as follows: Simulator S6: Malicious server and clients 2, . . ., n Behavior of the simulator: 1.The simulator expects angles θj ∈ A for j = 2, . . ., n from the malicious clients, and a single-qubit quantum state ρ from the malicious server.
2. The simulator forwards ρ to the ideal functionality described by Resource S1, and receives the state ρ ′ from it.
3. It samples uniformly at random the angle θ1 ←R A.
4. It applies the operation Rz(θ1) to ρ ′ and returns the resulting quantum state to the malicious server.
Since θ 1 is chosen uniformly at random by the simulator in the ideal world, we can substitute it by θ 1 − θ without changing the view of the distinguisher.This yields:

Real world
Ideal world Clearly, these two distributions are identical, which proves that the views of the distinguisher in the two worlds are perfectly indistinguishable.
It now remains to piece together all building blocks to obtain the security of the full protocol.
Theorem S4.The Multi-Client Blind Quantum Computation Protocol 1 of the main text, where the orchestrator is replaced by a classical SMPC resource between all other parties, perfectly constructs Resource S3 against malicious coalitions of at most the server and n − 1 clients.
Proof.After having established the security of all building blocks, this proof is straightforward and works by repeated application of the general composition principle in Theorem S1, analogously to the proof of [2, Theorem 5].
Retracing the steps of the construction of the protocol in question, we begin by replacing the classical SMPC resource by a trusted classical party, the orchestrator.This step does not incur any security loss.
Next, Theorem S3 allows us to replace every execution of Protocol S5 by one call to Resource S1, with zero security loss.
Finally, Theorem S2 establishes that the remaining protocol between orchestrator and server is indeed a secure construction of the Blind Delegated Quantum Computing Resource S2.Keeping in mind that the orchestrator additionally is in charge of collecting the clients' inputs and distributing the outcome of the computation, this protocol is indeed a perfect realization of Resource S3.
Remark S1 (Removing redundant correction steps).When considering the realization of a resource by itself, the final correction step in Protocol S5 is indeed necessary, as this is the only way for the simulator to transmit the correct quantum state to the server.However, when using the protocol in the context of UBQC, this correction step can be combined with the corrections that are anyway present in the BQC protocol, and do hence not need to be performed as a separate round of communication.This observation is similar to the one made by [2] in the context of Collaborative RSP and QSMPC.
Remark S2 (Varying the location of the entangling step).The security of the protocol is independent of whether the qubits are entangled before or after their communication along the Qline.Therefore, both setups in which the photon source creates cluster states and the server performs only adaptive measurements, as well as setups in which the photon source emits unentangled qubits, and entanglement and measurements are performed by the server are possible.Even combinations of both, in which part of the entanglement is created before, and part after the Qline, are conceivable.

S2. TIME SCHEME OF THE EXPERIMENTAL PROTOCOL
At the beginning of each round of the protocol, the clients Alice and Bob set their liquid crystals (LCs) according to the phase shifts they want to apply to their qubits (the θ j i random parameters) and communicate all their secret parameters to the system dedicated to the TTP.With this information, the TTP computes the measurement angle S6.BLINDNESS OF THE SECOND QUBIT In this section, we report the details of the demonstration of the blindness of the second qubit.To show it, we fixed the measurement angle δ 1 = π and averaged the resulting density matrices for the second qubit over all possible clients' rotation angles of the first qubit, namely 64 possible combinations.Here, as an instance, we report the quantum state tomographies for eight combinations and their comparison with the theoretical expectations, where Alice keeps her rotation angle fixed at θ A 1 = π, while Bob varies it.The quantum state tomographies shown also confirm the correctness of the protocol in the case of the computation of a quantum function.Indeed, each of these density matrices can be seen as the case where the first computation angle amounts to ϕ 1 = δ 1 − θ A 1 − θ B 1 , where δ 1 = π and θ A 1 = π.
initial state by averaging over all density matrices resulting from varying θ A 1 , θ B 2 in the set A.

Figure 2 .
Figure 2. Conceptual scheme of the two-client BQC and distributed quantum computing over a Qline architecture.a) The desired joint quantum circuit computation where x1 and x2 are Alice's private input data and ϕ1 and ϕ2 the private angles of Bob's algorithm.b)The same computation of the circuit presented in a) is encrypted to preserve the privacy of each party's information.In our two-client BQC protocol, a quantum channel connects a source of bipartite quantum states to two clients disposed along the Qline.Each client chooses their secret parameters θ j i , r j i , xi, ϕi, for i = 1, 2 and j = A, B, and applies z-rotations to both qubits.All secret parameters and measurement outcomes pass through a TTP to compute the transformed measurement bases δi and the corrected outcomes.At the end of the line, the quantum state is sent to the server S2 to carry out the desired computation, which is carried out through two rounds of classical communication between clients, TTP, and the server S2. c) Generalization of our architecture to m Qlines with n clients distributed along them.In a Qline, a quantum state source distributes single qubits and each client applies random rotations to all qubits.At the end of the line, a powerful quantum server employs the received qubits to generate the resource state for the computation and calculate a joint function.

Figure 3 .
Figure 3. Experimental apparatus.The state defined in Eq. (1) is generated through a Sagnac-based source of entangled photons, where horizontal polarization (|H⟩) encodes the state |0⟩ while vertical polarization (|V ⟩) encodes the state |1⟩.The photons are first sent to Alice and Bob who performs single-qubit rotations by means of liquid crystals (LC).To make the clients' choices random, the clients' secret parameters are chosen by means of a quantum random number generator (QRNG).Then, the two photons are sent to Server 2 (S2).While the second photon is delayed through a ≈ 65 m-long single-mode fiber, the first photon is measured, by using a sequence of a quarter-wave plate (QWP), a half-wave plate (HWP), and a polarizing beam splitter (PBS).The second measurement station, instead, is composed of a Pockels cell (PC), a HWP, and a PBS.A fast data elaboration system, constituted by a computer and a fast electronic circuit, embodies the TTP.The two detectors of the first measurement station are linked to such a system, that directly activates the PC with a suitable high-voltage (HV) pulse according to the desired second measurement basis.All outcomes are collected through a coincidence box that records as two-fold coincidences all events occurring in a given time window.

Figure 4 .
Figure 4. Demonstration of blindness.a) Density matrix of the second qubit averaged over all possible θ A 1 and θ B 1 configurations.b) Density matrix of the two-qubit initial state, averaged over all possible values of θ A 1 and θ B 2 .

Figure 5 .
Figure 5. Computation of a quantum function.In this figure, we show the results of the computation of a quantum function.Bob chose ϕ1 = π/4, while the clients' random parameters are θ A 1 = π/2 and θ B 1 = π/4.Both input bits x1, x2 are set to 0. The first qubit is thus measured in the basis δ1 = π.The experimental density matrix is shown in light blue, while the theoretical one is shown in red.