## Abstract

The main promise of quantum computing is to efficiently solve certain problems that are prohibitively expensive for a classical computer. Most problems with a proven quantum advantage involve the repeated use of a black box, or oracle, whose structure encodes the solution. One measure of the algorithmic performance is the query complexity, i.e., the scaling of the number of oracle calls needed to find the solution with a given probability. Few-qubit demonstrations of quantum algorithms, such as Deutsch–Jozsa and Grover, have been implemented across diverse physical systems such as nuclear magnetic resonance, trapped ions, optical systems, and superconducting circuits. However, at the small scale, these problems can already be solved classically with a few oracle queries, limiting the obtained advantage. Here we solve an oracle-based problem, known as learning parity with noise, on a five-qubit superconducting processor. Executing classical and quantum algorithms using the same oracle, we observe a large gap in query count in favor of quantum processing. We find that this gap grows by orders of magnitude as a function of the error rates and the problem size. This result demonstrates that, while complex fault-tolerant architectures will be required for universal quantum computing, a significant quantum advantage already emerges in existing noisy systems.

## Introduction

The limited size of engineered quantum systems and their extreme susceptibility to noise sources have made it hard so far to establish a clear advantage of quantum over classical computing. Although the classical success probability has been exceeded in two-qubit demonstrations of the Deutsch–Jozsa^{1} and Grover^{2} algorithms, the required number of oracle queries has so far remained comparable. A promising avenue to highlight a quantum advantage is offered by a new family of algorithms designed for machine learning.^{3,4,5,6} In this class of problems, artificial intelligence methods are employed to discern patterns in large amounts of data, with little or no knowledge of underlying models. A particular learning task, known as binary classification, is to identify an unknown mapping between a set of bits onto 0 or 1. An example of binary classification is identifying a hidden parity function,^{7, 8} defined by the unknown bit-string ** k**, which computes

*f*(

**,**

*D***) =**

*k***mod 2 on a register of**

*D · k**n*data bits

**= {**

*D**D*

_{1},

*D*

_{2}…,

*D*

_{ n }} (Fig. 1a). The result, i.e., 0 (1) for even (odd) parity, is mapped onto the state of an additional bit

*A*. The learner has access to the output register of an

*example oracle*circuit that implements

*f*on random input states, on which he/she has no control. Repeated queries of the oracle allow the learner to reconstruct

**. However, any physical implementation suffers from errors, both in the oracle execution itself and in readout of the register. In the presence of errors, the problem becomes hard. Assuming that every bit introduces an equal error probability, the best known algorithms have a number of queries growing as 𝒪(**

*k**n*) and runtime growing almost exponentially with

*n*.

^{7,8,9}In view of the classical hardness of learning parity with noise (LPN), parity functions have been suggested as keys for secure and computationally easy authentication.

^{10, 11}

The picture is different when the oracle is implemented by a quantum circuit and the algorithm can process quantum superpositions of input states. In this case, applying a coherent operation on all qubits after an oracle query ideally creates the entangled state

In particular, when *A* is measured to be in |1〉, |*D*〉 will be projected onto |** k**〉. With constant error per qubit, learning from a quantum oracle requires a number of queries that scales as 𝒪(log

*n*), and has a total runtime that scales as 𝒪(

*n*).

^{12}This gives the quantum algorithm an exponential advantage in query complexity and a super-polynomial advantage in runtime.

In this work, we implement a LPN problem in a superconducting quantum circuit using up to five qubits, realizing the experiment proposed in Ref. 12. We construct a parity function with bit-string ** k** using a series of CNOT gates between the ancilla and the data qubits (Fig. 1b). We then present two classes of learners for

**and compare their performance. The first class simply measures the output qubits in the computational basis and analyzes the results. The measurement collapses the state into a random {**

*k***,**

*D**f*(

*D**,*

**)} basis state, reproducing an example oracle of the classical LPN problem. The second class performs some quantum computation (coherent operations), followed by classical analysis, to infer the solution. We show that, beyond a minimum complexity of the problem, the quantum approach outperforms the classical one. Furthermore, as the classical problem becomes rapidly intractable as noise is added to the output register, the performance gap widens.**

*k*## Results

The quantum device used in our experiment consists of five superconducting transmon qubits, *A*, *D*
_{1}, …, *D*
_{4}, and seven microwave resonators (Fig. 1c). Five of the resonators are used for individual control and readout of the qubits, to which they are dispersively coupled.^{13} The center qubit *A* plays the role of the result and is coupled to the data register {*D*
_{
i
}} via the remaining two resonators. This coupling allows the implementation of cross-resonance (CR) gates^{14} between *A* (used as control qubit) and each *D*
_{
i
} (target), constituting the primitive two-qubit operation for the circuit in Fig. 1b (full gate decomposition in the Supplementary Information). Each qubit is measured by probing its respective readout resonator with a near-resonant microwave pulse. The output signals are then demodulated and integrated at room temperature to produce the homodyne voltages $\left\{{V}_{{D}_{1}},\dots {V}_{{D}_{n}},{V}_{A}\right\}$ (see Supplementary Information for the detailed experimental setup).

To implement a uniform random example oracle for a particular ** k**, we first prepare the data qubits in a uniform superposition (Fig. 1b). Preparing such a state ensures that all parity examples are produced with equal probability and is also key in generating a quantum advantage. We then implement the oracle as a series of CNOT gates, each having the same target qubit

*A*and a different control qubit

*D*

_{ i }for each

*k*

_{ i }= 1. Finally, the state of all qubits is read out (with the optional insertion of Hadamard gates, see discussion below). The oracle mapping to the device is limited by imperfections in the two-qubit gates, with average fidelities 88–94%, characterized by randomised benchmarking

^{15}(see Supplementary Table S1). Readout errors in the register ${\eta}_{{D}_{i}}$, defined as the average probability of assigning a qubit to the wrong state, are limited to 20–40% by the onset of inter-qubit crosstalk at higher measurement power (see data in the Supplementary Information). A Josephson parametric amplifier

^{16}in front of the amplification chain of

*A*suppresses its low-power readout error to

*η*

_{A}= 5%.

Having implemented parity functions with quantum hardware, we now proceed to interrogate an oracle *N* times and assess our capability to learn the corresponding ** k**. We start with oracles with register size

*n*= 2, involving

*D*

_{1},

*D*

_{2}, and

*A*. We consider two classes of learning strategies, classical (

*C*) and quantum (

*Q*). In

*C*, we perform a projective measurement of all qubits right after execution of the oracle. This operation destroys any coherence in the oracle output state, thus making any analysis of the result classical. The measured homodyne voltages $\left\{{V}_{{D}_{1}},\dots {V}_{{D}_{n}},{V}_{A}\right\}$ are converted into binary outcomes, using a calibrated set of thresholds (see Methods). Thus, for every query, we obtain a binary string {

*a*,

*d*

_{1},

*d*

_{2}}, where each bit is 0 (1) for the corresponding qubit detected in |0〉 (|1〉). Ideally,

*a*is the linear combination of

*d*

_{1},

*d*

_{2}expressed by the string

**(Fig. 1a). However, both the gates comprising the oracle and qubit readout are prone to errors (see values in the Supplementary Information). To find the**

*k***that is most likely to have produced our observations, at each query**

*k**m*we compute the expected

*ã*

_{ k,m }=

*d*_{ m }·

**mod 2 for the measured**

*k***= {**

*D**d*

_{1},

*d*

_{2}}

_{ m }and the 4 possible values of

**. We then select the**

*k***which minimizes the Hamming distance to the measured results**

*k**a*

_{1},…,

*a*

_{ N }of

*N*queries, i.e., ${\sum}_{m=1}^{N}\mid {a}_{m}-{\xe3}_{\mathbf{k},m}\mid $.

^{7}In the case of a tie,

**is randomly chosen among those producing the minimum distance. As expected, the error probability**

*k**p*of obtaining the correct answer decreases with

*N*(Fig. 2a). Interestingly, the difficulty of the problem depends on

**and increases with the number of**

*k**k*

_{ i }= 1. This can be intuitively understood as needing to establish a higher correlation between data qubits when the weight of

**increases.**

*k*

Our second approach (*Q*) takes advantage of the quantum correlations between ancilla and data qubits at the output of the oracle. Instead of directly measuring the qubits as above, we first apply a Hadamard gate on each. These local operations generate quantum interference between terms in the superposition state, ideally producing the desired result (Eq. (1)). This technique is widely used in quantum algorithms to increase the probability of obtaining the desired outcomes.^{17} In this case, whenever A is measured to be in |1〉 (with 50% probability), the data register will ideally be projected onto the solution, |*D*
_{1},*D*
_{2}〉 = |*k*
_{1},*k*
_{2}〉. We therefore digitize and postselect our results on the outcomes where *a* = 1 and perform a bit-wise majority vote on ${\left\{{d}_{1},{d}_{2}\right\}}_{1\dots \xd1}$. Despite every individual query being subject to errors, the majority vote is effective in determining ** k** (Fig. 2b). We assess the performance of the two solvers by comparing the number of queries

*N*

_{1%}required to reach

*p*= 0.01 (Fig. 2c). Whereas

*Q*performs comparably or worse than

*C*for

**= 00, 01 or 10,**

*k**Q*requires less than half as many queries as

*C*for the hardest oracle,

**= 11. We note that, while these results are specific to the lowest oracle and readout errors we can achieve, a systematic advantage of quantum over classical learning will become clear in the following.**

*k*So far we have adhered to a literal implementation of the classical LPN problem, where each output can only be either 0 or 1. However, the actual measurement results are the continuous homodyne voltages $\left\{{V}_{{D}_{1}},\dots {V}_{{D}_{n}},{V}_{A}\right\}$, each having mean and variance determined by the probed qubit state and by the measurement efficiency.^{13} This additional resource can be exploited to improve the learner’s capabilities. A more effective strategy for *C* uses Bayesian estimation to calculate the probability of any possible ** k** for the measured output voltages, and select the most probable (see Methods). This approach is expensive in classical processing time (scaling exponentially with

*n*), but drastically reduces the error probability $\overline{p}$, averaged over all

**, at any**

*k**N*(Fig. 3). To improve on

*Q*, we still postselect the oracle queries on the digitized outcome

*a*= 1. Then, instead of digitizing the corresponding $\left\{{V}_{{D}_{i}}\right\}$ as above, we digitize their averages $\left\{\u27e8{V}_{{D}_{i}}\u27e9\right\}$, obtaining our best guess for

**(see Methods). This procedure simply replaces the majority vote between multiple noisy observations with a single observation, with variance reduced by the number of postselected queries. Using the analog results, not only does**

*k**Q*retain an advantage over

*C*(smaller

*p*for given

*N*), but it does so without introducing an overhead in classical processing.

The superiority of *Q* over *C* becomes even more evident when the oracle size *n* grows from 2 to 3 data qubits (Fig. 3b). Whereas *Q* solutions are marginally affected, the best *C* solver demands almost an order of magnitude higher *N* to achieve a target error. Maximizing the resources available in our quantum hardware, we observe an even larger gap for oracles with *n* = 4 (data in the Supplementary Information), suggesting a continued increase of quantum advantage with the problem size.

As predicted, quantum parity learning surpasses classical learning in the presence of noise. To investigate the impact of noise on learning, we introduce additional readout error on either *A* or on all *D*
_{
i
}. This can be easily done by tuning the amplitude of the readout pulses, effectively decreasing the signal-to-noise ratio.^{18} When the ancilla assignment error probability *η*
_{A} grows (Fig. 4a), the number of queries ${\overline{N}}_{\mathrm{1\%}}$ (the average of *N*
_{1%} over all ** k**) required by the

*C*solver increases by up to 2 orders of magnitude in the measured range (see also data in the Supplementary Information). Conversely, using

*Q*, ${\overline{N}}_{\mathrm{1\%}}$ only changes by a factor of ~3. Key to this performance gap is the optimization of the digitization threshold for $\left\{\u27e8{V}_{{D}_{i}}\u27e9\right\}$ at each value of

*η*

_{A}(see Methods). When

*η*

_{A}is increased, an interesting question is whether postselection on

*V*

_{ A }remains always beneficial. In fact, for

*η*

_{A}> 0.25, it becomes more convenient to ignore

*V*

_{ A }and use the totality of the queries (

*Q*′ in Fig. 4a).

Similarly, we step the readout error of the data qubits, with average *η*
_{D}, while setting *η*
_{A} to the minimum. Not only does *Q* outperform *C* at every step, but the gap widens with increasing *η*
_{D}.

The computational advantage of quantum learning, which appears in the reduction of the number of oracle calls, is even more significant when accounting for the post-processing time. For example, finding ** k** at

*η*

_{A}= 0.44 with 1% error (Fig. 4a) takes

*C*about 10 times longer in post-processing relative to

*Q*. Moreover, the processing time for

*C*grows exponentially with

*n*, as the Bayesian solver must track probabilities for each possible

**. Conversely,**

*k**Q*consists only of binary comparisons (for postselection on

*A*), averages, and a final digitization (for

**), thus scaling linearly with**

*D**n*.

Finally, to verify that our results are not limited to highly noisy systems, we have implemented all 4-bit ** k** on a second device with lower gate and readout errors, particularly for ${\eta}_{{D}_{i}}$. Whereas the required number of queries is greatly reduced for both learners, the performance gap remains in favor of

*Q*(see Supplementary Information).

## Discussion

A numerical model including the measured *η*
_{A},*η*
_{D}, qubit decoherence, and gate errors (see Supplementary Information) modeled as depolarization noise is in very good agreement with the measured *N*
_{1%} at all *η*
_{A},*η*
_{D}. This model allows us to extrapolate *N*
_{1%} to the extreme cases of zero and maximum noise. Obviously, when *η*
_{D} = 0.5, readout of the data register contains no information, and *N*
_{1%} consequently diverges. On the other hand a random ancilla result (*η*
_{A} = 0.5) does not prevent a quantum learner from obtaining ** k**. In this limit, the predicted factor of ~2 in ${\overline{N}}_{\mathrm{1\%}}$ between

*Q*and

*Q*′ can be intuitively understood as

*Q*indiscriminately discards half of the queries, while

*Q*′ uses all of them. (See Supplementary Information for theoretical bounds on the scaling of ${\overline{N}}_{\mathrm{1\%}}$ for different solvers.)

It is worth noting that the quantum advantage here demonstrated is not limited to a noisy realization of the oracle. Lower gate errors, as achieved by a future fault-tolerant processor, will reduce *N*
_{1%} for both *Q* and *C* solvers. Nevertheless, for a given oracle, classical learning will remain more susceptible to measurement errors (*η*
_{A},*η*
_{D}), preserving the performance gap with *Q*.^{12}

In conclusion, we have implemented a LPN algorithm in a quantum setting. We have demonstrated a superior performance of quantum learning compared to its classical counterpart, where the performance gap increases with added noise in the query outcomes. A quantum learner, with the ability of physically manipulating the output of a quantum oracle, is expected to find the hidden ** k** with a logarithmic number of queries and linear runtime as function of the problem size, whereas a passive classical observer would require a linear number of queries and nearly exponential runtime. We have shown that the difference in classical and quantum queries required for a target error rate grows with the oracle size in the experimentally accessible range, and that quantum learning is much more robust to noise. We expect that future experiments with increased oracle size will further demarcate a quantum advantage, in support of the predicted asymptotic behavior. Furthermore, our experiment provides a novel method to benchmark the performance of a quantum algorithm using the same hardware to construct the equivalent classical problem. As prototype quantum computers continue to grow, we expect this approach to become increasingly useful in determining the quantum advantage attainable in complex problems.

## Methods

### Pulse calibration

Single- and two-qubit pulses are calibrated by an automated routine, executed periodically during the experiments. For each qubit, first the transition frequency is calibrated with Ramsey experiments. Second, *π* and *π*/2 pulse amplitudes are calibrated using a phase estimation protocol.^{19} The pulse amplitudes, modulating a carrier through an *I*/*Q* mixer (diagram in the Supplementary Information) are adjusted at every iteration of the protocol until the desired accuracy or signal-to-noise limit is reached. Pulses have a Gaussian envelope in the main quadrature and derivative-of-Gaussian in the other, with DRAG parameter^{20} calibrated beforehand using a sequence amplifying phase errors.^{21} A CR_{
i
} gate^{14, 22} on qubits {*A*,*D*
_{
i
}} consists of two pulses applied on *A* at the *D*
_{
i
} frequency, separated by a refocusing *π* pulse on *A*. For some frequency conditions (mainly that the qubit-qubit detuning is smaller than their anharmonicity), this sequence implements a *D*
_{
i
} rotation, controlled by *A*. The gate is calibrated in a two-step procedure, determining first the optimum duration and then the optimum phase corresponding to the unitary $C{R}_{i}={Z}_{A}{X}_{{D}_{i}}\left(\pi \mathrm{\u22152}\right)$.

### Experimental setup

A detailed schematic of the experimental setup is illustrated in the Supplementary Information. For each qubit, signals for readout and control are delivered to the corresponding resonator through an individual line through the dilution refrigerator. For an efficient use of resources, we apply frequency division multiplexing^{23} to generate the five measurement tones by sideband modulation of three microwave sources. Moreover, the same pair of BBN APS (arbitrary waveform generators) channels produce the readout pulses for {*D*
_{1},*D*
_{2}}, and another one for {*D*
_{3},*D*
_{4}}. Similarly, the output signals are pairwise combined at base temperature, limiting the number of HEMTs and digitizer channels to three. The attenuation on the input lines, distributed at different temperature stages, is a compromise between suppression of thermal noise impinging on the resonators (affecting qubit coherence) and the input power required for CR gates.

### Gate sequence

CNOT gates can be decomposed in terms of CR gates using the relation ${\mathrm{CNOT}}_{12}=\left({Z}_{90}^{-}\otimes {X}_{90}^{-}\right){\mathrm{CR}}_{12}$.^{24} Moreover, the role of control and target qubits are swapped, using CNOT_{12} = (*H*
_{1}⊗*H*
_{2})CNOT_{21}(*H*
_{1}⊗*H*
_{2}). The first of these *H* gates is absorbed into state preparation for the LPN sequence (Fig. 1a and Supplementary Information). Similarly, when two CNOTs are executed back to back, two consecutive *H* gates on *A* are canceled out. In order to maintain the oracle identical in *C* and *Q*, we do not compile the *H* gates in the CNOTs with those applied before measurement in *Q*.

### Sample size

For each set of oracle ** k**, readout errors

*η*

_{A},

*η*

_{D}, solver type, and register size

*n*, we measure the result of 100,000 oracle queries. Each set is accompanied by

*n*+2 calibration points (averaged 10,000 times), providing the distributions of ${V}_{A},{V}_{{D}_{1}},\dots ,{V}_{{D}_{n}}$ for the collective ground state and for single-qubit excitations (

*n*data and 1 ancilla qubit). These distributions are then used to determine the optimum digitization threshold (for digital solvers) or as input to the Bayesian estimate in

*C*. To obtain

*p*(

*N*), we resample the full data set with 2000–4000 random subsets of each size

*N*.

### Statistical analysis

Error bars are obtained by first computing the credible intervals for *p* at each set {*N*,** k**,

*η*

_{A},

*η*

_{D}}. These intervals are computed with Jeffreys beta distribution prior $\mathrm{Beta}\left(\frac{1}{2},\frac{1}{2}\right)$ for Bernoulli trials, with a credible level of 100%−(100–95%)/8≈99.36%. This ensures that, under a union bound, the average of estimates for 8 different

**is inside the credible interval with a probability of at least 95%. We then perform antitonic regression on the upper and lower bounds of the credible intervals to ensure monotonicity as function of**

*k**N*, and find the intercept to

*p*= 0.01 for each

**. The bounds on the value ${\overline{N}}_{\mathrm{1\%}}$ averaged over**

*k***is computed by interval arithmetic on the credible intervals of**

*k**N*

_{1%}for each

**.**

*k*### Classical solver with Bayesian estimate

An improved classical solver for the LPN problem can be constructed when the oracle provides an analog output. Approximating the distributions of each bit value as Gaussian^{25} (neglecting qubit transitions during readout), this solver corresponds to a Bayesian estimate of ** k** after a series of observations of the data and ancilla bits. More formally, taking a uniform prior distribution for all binary strings produced by the oracle, one computes the (unnormalized) posterior

*p*(

*D*

_{ i }) distribution for each data bit

*D*

_{ i }the output of the oracle,

The (unnormalized) posterior distribution ${p}_{m}\left(\mathit{k}\mid {V}_{\mathrm{D}},{V}_{A}\right)$ for ** k** after the

*m*th query, on the other hand, is given by

where *p*
_{0}(** k**) is the prior distribution. Here and above, $\left\{{V}_{{D}_{1}},\dots {V}_{{D}_{n}},{V}_{A}\right\}$ are rescaled to have mean 0 and 1 for the corresponding qubit in |0〉 and |1〉, respectively. Iterating this procedure (while updating

*p*(

**) at each iteration), and then choosing the most probable ${\mathit{k}}_{\mathrm{Bayes}}=\mathrm{a}rg\underset{\mathbf{k}}{max}p\left(k\right)$, one obtains an estimate for**

*k***.**

*k*### Analog quantum solver with postselection on *A*

While postselection on *A* is performed equally on both digital (Fig. 2) and analog (Figs. 3 and 4) *Q* solvers, in the analog case all postselected $\left\{{V}_{{D}_{i}}\right\}$ are averaged together. Finally, the results $\left\{\u27e8{V}_{{D}_{i}}\u27e9\right\}$ are digitized to determine the most likely ** k**. The choice of digitization threshold for each

*D*

_{ i }depends on: a) the readout voltage distributions

*ρ*

_{0}and

*ρ*

_{1}for the two basis states, each characterized by a mean

*μ*and a variance

*σ*

^{2}; b)

*η*

_{A}. Ideally (

*η*

_{A}= 0 and perfect oracle), the distribution of each query output ${V}_{{D}_{i}}$ matches

*ρ*

_{0}(

*ρ*

_{1}) for

*k*

_{i}= 0(1). When

*η*

_{A}> 0, the distribution for

*k*

_{i}= 1 becomes the mixture ${\rho}_{{k}_{i}\mathrm{=1}}={\eta}_{\mathrm{A}}{\rho}_{0}+\left(1-{\eta}_{\mathrm{A}}\right){\rho}_{1}$. This mixture has mean (1−

*η*

_{A})

*μ*

_{1}+

*η*

_{A}

*μ*

_{0}and variance $\left(1-{\eta}_{\mathrm{A}}\right){\sigma}_{1}^{2}+{\eta}_{\mathrm{A}}{\sigma}_{0}^{2}-2{\eta}_{\mathrm{A}}\left(1-{\eta}_{\mathrm{A}}\right){\mu}_{0}{\mu}_{1}$. Instead, ${\rho}_{{k}_{i}\mathrm{=0}}={\rho}_{0}$ independently of

*η*

_{A}. We approximate the expected distribution of the mean $\u27e8{V}_{{D}_{i}}\u27e9$ with a Gaussian having average and variance obtained from ${\rho}_{{k}_{i}\mathrm{=0}}\left({\rho}_{{k}_{i}\mathrm{=1}}\right)$ for

*k*

_{ i }= 0(1). Finally, we choose the digitization threshold for ${V}_{{D}_{i}}$ which maximally discriminates these two Gaussian distributions. We note that the number of queries scales the variance of both distributions equally and therefore does not affect the optimum threshold. Furthermore, this calibration protocol is independent of the oracle (see Supplementary Information).

### Analog quantum solver without postselection

The analysis without ancilla (*Q*′) closely follows the steps outlined in the last paragraph. For the purpose of extracting the optimum digitization thresholds, we consider *η*
_{A} = 0.5 in the expressions above. This corresponds to an equal mixture of *ρ*
_{0} and *ρ*
_{1} when *k*
_{
i
} = 1.

### Data deposition and code availability

The full dataset and the Julia^{26} code used for this analysis are available at https://doi.org/10.5281/zenodo.268731.

## References

- 1.
Yamamoto, T. et al. Quantum process tomography of two-qubit controlled-Z and controlled-NOT gates using superconducting phase qubits.

*Phys. Rev. B***82**, 184515 (2010). - 2.
Dewes, A. et al. Quantum speeding-up of computation demonstrated in a superconducting two-qubit processor.

*Phys. Rev. B***85**, 140503 (2012). - 3.
Schuld, M., Sinayskiy, I. & Petruccione, F. An introduction to quantum machine learning.

*Contemp. Phys*.**56**, 172–185 (2015). - 4.
Manzano, D., Pawowski, M. & Brukner, Č. The speed of quantum and classical learning for performing the k-th root of NOT.

*New J. Phys*.**11**, 113018 (2009). - 5.
Lloyd, S., Mohseni, M. & Rebentrost, P. Quantum algorithms for supervised and unsupervised machine learning.

*arXiv:quant-ph/1307.0411*(2013). - 6.
Wiebe, N., Granade, C., Ferrie, C. & Cory, D. G. Hamiltonian learning and certification using quantum resources.

*Phys. Rev. Lett*.**112**, 190501 (2014). - 7.
Angluin, D. & Laird, P. Learning from noisy examples.

*Mach. Learn*.**2**, 343–370 (1988). - 8.
Blum, A., Kalai, A. & Wasserman, H. Noise-tolerant learning, the parity problem, and the statistical query model.

*J. ACM***50**, 506–519 (2003). - 9.
Lyubashevsky V. The Parity Problem in the Presence of Noise, Decoding Random Linear Codes, and the Subset Sum Problem. In Approximation, Randomization and Combinatorial Optimization. Algorithms and Techniques. Lecture Notes in Computer Science, vol. 3624 (eds Chekuri, C., Jansen, K., Rolim, J. D. P. & Trevisan, L.) (Springer, Berlin, Heidelberg, 2005).

- 10.
Hopper, N. J. & Blum, M. Secure human identification protocols. In

*Advances in Cryptology — ASIACRYPT 2001*, vol. 2248. Lecture Notes in Computer Science, (eds Boyd, C.) 52–66 (Springer, Berlin, Heidelberg, 2001). - 11.
Pietrzak, K. Cryptography from Learning Parity with Noise. In

*SOFSEM 2012: Theory and Practice of Computer Science. SOFSEM 2012*. Lecture Notes in Computer Science, vol. 7147. (eds Bieliková, M., Friedrich, G., Gottlob, G., Katzenbeisser, S. & Turán, G.) (Springer, Berlin, Heidelberg, 2012). - 12.
Cross, A. W., Smith, G. & Smolin, J. A. Quantum learning robust against noise.

*Phys. Rev. A***92**, 012327 (2015). - 13.
Blais, A., Huang, R.-S., Wallraff, A., Girvin, S. M. & Schoelkopf, R. J. Cavity quantum electrodynamics for superconducting electrical circuits: An architecture for quantum computation.

*Phys. Rev. A***69**, 062320 (2004). - 14.
Rigetti, C. & Devoret, M. Fully microwave-tunable universal gates in superconducting qubits with linear couplings and fixed transition frequencies.

*Phys. Rev. B***81**, 134507 (2010). - 15.
Magesan, E., Gambetta, J. M. & Emerson, J. Characterizing quantum gates via randomized benchmarking.

*Phys. Rev. A***85**, 042311 (2012). - 16.
Hatridge, M., Vijay, R., Slichter, D. H., Clarke, J. & Siddiqi, I. Dispersive magnetometry with a quantum limited SQUID parametric amplifier.

*Phys. Rev. B***83**, 134501 (2011). - 17.
Cleve, R., Ekert, A., Macchiavello, C. & Mosca, M. Quantum algorithms revisited.

*Proc. R. Soc. Lond. A***454**, 339–354 (1998). - 18.
Vijay, R., Slichter, D. H. & Siddiqi, I. Observation of quantum jumps in a superconducting artificial atom.

*Phys. Rev. Lett*.**106**, 110502 (2011). - 19.
Kimmel, S., Low, G. H. & Yoder, T. J. Robust calibration of a universal single-qubit gate set via robust phase estimation.

*Phys. Rev. A***92**, 062315 (2015). - 20.
Motzoi, F., Gambetta, J. M., Rebentrost, P. & Wilhelm, F. K. Simple pulses for elimination of leakage in weakly nonlinear qubits.

*Phys. Rev. Lett*.**103**, 110501 (2009). - 21.
Lucero, E. et al. Reduced phase error through optimized control of a superconducting qubit.

*Phys. Rev. A***82**, 042339 (2010). - 22.
Chow, J. M. et al. Universal quantum gate set approaching fault-tolerant thresholds with superconducting qubits.

*Phys. Rev. Lett*.**109**, 060501 (2012). - 23.
Jerger, M. et al. Frequency division multiplexing readout and simultaneous manipulation of an array of flux qubits.

*Appl. Phys. Lett*.**101**, 042604 (2012). - 24.
Chow, J. M. et al. Implementing a strand of a scalable fault-tolerant quantum computing fabric.

*Nature Comm***5**, 4015 (2014). - 25.
Gambetta, J., Braff, W. A., Wallraff, A., Girvin, S. M. & Schoelkopf, R. J. Protocols for optimal readout of qubits using a continuous quantum nondemolition measurement.

*Phys. Rev. A***76**, 012325 (2007). - 26.
Bezanson, J., Edelman, A., Karpinski, S. & Shah, V. B. Julia: a fresh approach to numerical computing.

*arXiv:cs/1411.1607*(2014). - 27.
Córcoles, A. et al. Demonstration of a quantum error detection code using a square lattice of four superconducting qubits.

*Nat. Comm***6**, 6979 (2015).

## Acknowledgements

We thank George A. Keefe and Mary B. Rothwell for device fabrication, T. Ohki for technical assistance, H. Krovi for discussions, and I. Siddiqi for providing the Josephson parametric amplifier. This research was funded by the Office of the Director of National Intelligence (ODNI), Intelligence Advanced Research Projects Activity (IARPA), through the Army Research Office contract no. W911NF-10-1-0324. All statements of fact, opinion or conclusions contained herein are those of the authors and should not be construed as representing the official views or policies of IARPA, the ODNI, or the U.S. Government.

## Author information

### Affiliations

#### Raytheon BBN Technologies, Cambridge, MA, 02138, USA

- Diego Ristè
- , Marcus P. da Silva
- , Colm A. Ryan
- & Blake R. Johnson

#### IBM T.J. Watson Research Center, Yorktown Heights, NY, 10598, USA

- Andrew W. Cross
- , Antonio D. Córcoles
- , John A. Smolin
- , Jay M. Gambetta
- & Jerry M. Chow

### Authors

### Search for Diego Ristè in:

### Search for Marcus P. da Silva in:

### Search for Colm A. Ryan in:

### Search for Andrew W. Cross in:

### Search for Antonio D. Córcoles in:

### Search for John A. Smolin in:

### Search for Jay M. Gambetta in:

### Search for Jerry M. Chow in:

### Search for Blake R. Johnson in:

### Contributions

C.A.R. and B.R.J. developed the BBN APS and the data acquisition software, D.R. and A.D.C. carried out the experiment, D.R., M.P.S., and B.R.J. performed the data analysis, M.P.S. implemented the solvers and developed the theoretical models, D.R. and M.P.S. wrote the manuscript with comments from the other authors, A.W.C. and J.A.S. contributed to the initial design of the experiment, B.R.J., J.M.C., and J.M.G. supervised the project.

### Competing interests

The authors declare no competing interests.

### Corresponding author

Correspondence to Diego Ristè.

## Electronic supplementary material

## About this article

### Publication history

#### Received

#### Revised

#### Accepted

#### Published

### DOI

https://doi.org/10.1038/s41534-017-0017-3

### Rights and permissions

**Open Access** This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.