Resource-efficient verification of quantum computing using Serfling’s bound

Abstract

Verifying quantum states is central to certifying the correct operation of various quantum information processing tasks. In particular, in measurement-based quantum computing, checking whether correct graph states are generated is essential for reliable quantum computing. Several verification protocols for graph states have been proposed, but none of these are particularly resource efficient: multiple copies are required to extract a single state that is guaranteed to be close to the ideal one. The best protocol currently known requires O(n¹⁵) copies of the state, where n is the size of the graph state. In this paper, we construct a significantly more resource-efficient verification protocol for graph states that only requires O(n⁵ log n) copies. The key idea is to employ Serfling’s bound, which is a probability inequality in classical statistics. Utilizing Serfling’s bound also enables us to generalize our protocol for qudit and continuous-variable graph states. Constructing a resource-efficient verification protocol for them is non-trivial. For example, the previous verification protocols for qubit graph states that use the quantum de Finetti theorem cannot be generalized to qudit and continuous-variable graph states without tremendously increasing the resource overhead. This is because the overhead caused by the quantum de Finetti theorem depends on the local dimension. On the other hand, in our protocol, the resource overhead is independent of the local dimension, and therefore generalizing to qudit or continuous-variable graph states does not increase the overhead. The flexibility of Serfling’s bound also makes our protocol robust: our protocol accepts slightly noisy but still useful graph states.

Introduction

The verification of quantum states plays an important role in ensuring the integrity of a number of quantum technologies including quantum computing, quantum cryptography, and quantum simulations. Graph states are a particularly important class of quantum states, since they can be resource states for measurement-based quantum computation (MBQC).^{1,2,3,4,5,6,7,8} In the case of MBQC, the problem of verifying quantum computation reduces to simply certify the measurements and the resource state. In this paper, we consider the task of verifying these important resource states that include qubit graph states, qudit graph states, and continuous-variable (CV) graph states.

Let us consider the following general setup (as shown in Fig. 1): Bob has a universal quantum computer and he can prepare arbitrary quantum states. Alice, on the other hand, can only perform single-qubit measurements. She does not have any quantum memory and the ability to apply entangling gate operations. Therefore, Alice delegates the preparation of graph states to Bob. Bob generates an nN_total-qubit state ρ_B and sends it to Alice. The state ρ_B consists of N_total registers, and each register contains n qubits. If Bob is honest, then the state of each register received by Alice is the correct n-qubit graph state |G〉. In other words,

$$\rho _B = \left| G \right\rangle \left\langle G \right|^{ \otimes N_{{\mathrm{total}}}}.$$

(1)

If Bob is malicious, on the other hand, ρ_B can be any arbitrary nN_total-qubit state. Alice randomly chooses N_total − 1 registers and measures all of them. In such a scenario, is it possible to construct a protocol such that if these measurement results satisfy certain conditions, then the state of the remaining (i.e., unmeasured) single register is guaranteed to be close to the ideal state |G〉? If such a verification protocol is possible, Alice can safely use the verified register for her desired MBQC. If we consider the qudit (qumode) case, the word “qubit” in the explanation should be replaced with “qudit” (“qumode”).

Fig. 1

The schematic shows the setup considerd within this paper. Bob generates an nN_total-qubit state ρ_B that consists of N_total registers. Each register is represented by a box and contains n qubits. Bob sends the state ρ_B to Alice. Alice randomly chooses N_total − 1 registers, and measures each qubit of them. If the measurement results satisfy certain conditions, the unmeasured single register is guaranteed to be close to the ideal graph state |G〉. If Bob sends Alice each qubit of ρ_B one by one, and if Alice measures each qubit sequentially, Alice does not need any quantum memory. If we consider the qudit (qumode) case, the word “qubit” in the above explanation should be replaced with “qudit” (“qumode”)

This setup models usual experiments. Bob is regarded to be an experimental equipment that is expected to generate many copies of the n-qubit graph state |G〉, and Alice is an experimentalist who has constructed the equipment. She would like to check the correctness of the experimental equipment. In this case, it is unreasonable to assume that ρ_B is any state, since the “attack” by the experimental equipment is not a malicious one, but is due to natural noise. In other words,

$$\rho _B = {\cal{E}}\left( {\left| G \right\rangle \left\langle G \right|^{ \otimes N_{{\mathrm{total}}}}} \right),$$

(2)

where ${\cal{E}}$ is a completely positive trace-preserving (CPTP) map that represents certain noise caused by the interaction between the experimental equipment and the environment.

Due to the inherent asymmetry between Alice and Bob, the verification setup shown in Fig. 1 can also be considered as a cloud quantum computing scenario.^9,10 Imagine that Bob is the owner of a company, which provides a quantum computing service over the cloud, and Alice as a (computationally weak) client who wants to use the cloud service to perform her desired quantum operations. One way to achieve this task is that Bob generates graph states and send them to Alice one qubit at a time. Alice, who can only perform single-qubit measurements, measures each qubit, as it arrives, to perform her MBQC. Since Alice does not trust Bob, she has to verify the correctness of the graph states by herself. This situation is well modeled by taking ${\cal{E}}$ in Eq. (2) to be a general CPTP map, since Bob is restricted to non-adaptive attacks, which is equivalent to maliciously preparing the initial state.

Several verification protocols, including ones based on self-testing, have been proposed for graph states.^{11,12,13,14,15,16,17,18} However, all the previous protocols encounter at least one of the three problems described below. First, they are not resource efficient, i.e., N_total is large. For example, protocols of refs. ^11,12 use the idea of the quantum de Finetti theorem¹⁹ to make ρ_B close to independent and identically distributed (i.i.d.) copies of a single fixed state, but this comes at the cost of large overhead. Such protocols require N_total = O(n²¹) to complete the verification. There are some protocols that do not use the quantum de Finetti theorem,^13,14,15,16 but nonetheless N_total = O(n¹⁵) (for details, see the “Resource efficiency” subsection in the RESULTS section).

Second, although extensions to qudit or CV states are in principle possible for existing protocols^13,15,16 (and in fact, extensions to qudit systems are explicitly mentioned in refs. ^13,15,16), extending the previous verification protocols^11,12,17,18 to higher dimension without increasing N_total is highly non-trivial. In fact, in the case when the quantum de Finetti theorem is used for a qudit system with the qudit dimension d ≥ 3, for example, N_total depends on $\sqrt {\log d}$, and therefore if we take d → ∞ to construct a CV verification protocol, we come across the unpleasant consequence that N_total → ∞. Note that recently, in ref. ¹⁶, the generalization to qudit systems has been made without increasing N_total = O(n¹⁵). However, this resource overhead is large. Resource-efficient verification protocols for qudit and CV states are indispensable. In fact, there are many important qudit or CV quantum states such as the photon orbital angular momentum states²⁰ and the Gottesman-Kitaev-Preskill (GKP) states.²¹ Recently, large-scale CV entangled states composed of more than 10⁴ qumodes have been generated.²²

Finally, although many previous protocols^13,15,16,17 have an error tolerance, it is low or its evaluation is insufficient (for details, see the “Robustness” subsection in the RESULTS section). The error tolerance is an important feature of verification protocols due to the following reason: Even if Bob is honest, the state ρ_B that Alice receives might be slightly different from the ideal state $\left| G \right\rangle ^{ \otimes N_{{\mathrm{total}}}}$ because of the imperfections of Bob’s operations and the channel noise between Bob and Alice. These slightly perturbed states can still be useful for fault-tolerant computation. The acceptance of such states by Alice would lead to better verification protocols. A fault-tolerant verification protocol¹⁴ that accepts noisy but still error-correctable states has been proposed, but it can be only used for the bipartite graph states.

In this paper, we introduce a new verification protocol that overcomes all the three aforementioned problems. First, we show that our protocol is significantly more resource efficient than previous approaches, i.e., N_total = O(n⁵ log n). (Recall that the best known previous protocols need N_total = O(n¹⁵)^13,14,15,16). The key idea to achieve this efficiency is by employing Serfling’s bound.^23,24 Serfling’s bound is a probability inequality for the sum in sampling without replacement, and is often used in classical statistics (for details, see Lemma 1). Serfling’s bound has also been used in the security proofs of quantum key distribution,^24,25,26,27 but to the best of our knowledge, so far, Serfling’s bound has never been applied to the verification of quantum computation.

Second, our protocol can be generalized to qudit and CV graph states, while maintaining resource efficiency. As we have explained, constructing a resource-efficient qudit or CV verification protocol is non-trivial. The reason why we succeed in the construction is again because of Serfling’s bound; When we use Serfling’s bound for a qudit system with d ≥ 3, N_total is independent of d. Therefore, we can increase d without increasing N_total. Note that our verification protocol for CV graph states can also be generalized to CV weighted hypergraph states. Hypergraph states are generalizations of graph states, and “weighted” implies that a real number is associated with each hyperedge. The precise definition will be given in the “CV weighted hypergraph states” subsection in the RESULTS section. Several important CV states are weighted hypergraph states, such as the CV cluster state⁵ and the CV weighted toroidal lattice state,²⁸ and our protocol is useful for verifying these states. We also point out that our verification protocol for CV graph states can be used to construct a verifiable blind quantum computing protocol with CV states. To the best of our knowledge, no verifiable blind CV quantum computing protocol was known previously except for the protocol of ref. ²⁹. The protocol of ref. ²⁹ assumes that the malicious server is restricted to preparing i.i.d. copies of single-qumode states while the malicious server in our protocol can perform any CPTP map as an attack.

Finally, our protocol is robust to some extent against slight perturbations of quantum states. For example, in previous protocols,^13,15,16,17 all N_total − 1 registers have to pass a test in order for Alice to accept the remaining state as correct, which means that slightly perturbed but still useful states are rejected by Alice. In our protocol, on the other hand, Alice accepts even if some of the N_total − 1 registers fail a test. This relaxed acceptance criteria allows Alice to accept noisy but still useful resource states. As non-fault-tolerant small-scale quantum processors are becoming available,^30,31,32 our protocols may be useful to verify these near-term quantum computers.

In addition to the verification protocols for graph states mentioned above, there are other approaches to verifiable quantum computing. The protocols in refs. ^33,34 use trap based techniques to perform verifiable blind quantum computing. In their protocols, a client is required to prepare single-qubit states whereas single-qubit measurements are required in our setup. In order to make the client classical, several multi-server protocols have been proposed.^{35,36,37,38,39} Particularly, Coladangelo et al. have recently constructed two resource-efficient protocols for a classical client to verifiably delegate quantum computing to two non-communicating but entangled quantum servers.³⁸ Other multi-server protocols have also been proposed to make verification protocols device independent.^40,41 However, the assumption that servers do not communicate with each other is hard to impose in practice due to latency in real-world networks and the finite speed of quantum operations. Recently, Mahadev has shown that quantum computation can be verified by an entirely classical client even when only one quantum processor is available, under computational assumptions.⁴² Such protocols, however, necessitate extremely large quantum processors due to the relatively large key sizes necessary for cryptographic security.

Results

This section is organized as follows: first, as preliminaries, we review the definitions of qudit graph states and their stabilizer operators. Second, we construct a stabilizer test as a sub-protocol of our verification protocol. With respect to CV weighted hypergraph states, we also review their definitions and construct a stabilizer test. After that, based on the stabilizer tests, we propose our verification protocol, which is the main result of this paper. We also discuss the resource efficiency and the error tolerance of our verification protocol. Finally, we generalize our verification protocol so that it can be used to verify multiple quantum states simultaneously.

Qudit graph states

A graph G ≡ (V, E) is a pair of a set $V \equiv \left\{ {v_i} \right\}_{i = 1}^n$ of vertices and a set $E \equiv \left\{ {e_i} \right\}_{i = 1}^{|E|}$ of edges with n ≡ |V|. Here, |V| and |E| denote the number of elements of V and E, respectively. Let $\left\{ {|k\rangle } \right\}_{k = 0}^{d - 1}$ be an orthonormal basis in a d-dimensional Hilbert space, where d( ≥ 2) is finite. A qudit graph state |G_d〉 that corresponds to G is defined by

$$\left| {G_d} \right\rangle \equiv \left( {\mathop {\prod}\limits_{(i,j) \in E} {CZ_{ij}} } \right)\left| { + _d} \right\rangle ^{ \otimes n},$$

(3)

where

$$\left| { + _d} \right\rangle \equiv \frac{1}{{\sqrt d }}\mathop {\sum}\limits_{k = 0}^{d - 1} {\left| k \right\rangle }$$

(4)

is the +1 eigenvector of the generalized Pauli-X operator

$$X \equiv \mathop {\sum}\limits_{k = 0}^{d - 1} {\left| {k + 1\;({\mathrm{mod}}\;d)} \right\rangle } \left\langle k \right|,$$

(5)

and

$$CZ_{ij} \equiv {\mathop {\sum}\limits_{k = 0}^{d - 1}} {\mathop {\sum}\limits_{k^{\prime} = 0}^{d - 1} {{\mathrm{exp}}} } \left( {i2\pi \frac{kk^{\prime}}{d}} \right)\left| {kk^{\prime}} \right\rangle _{ij}\left\langle {kk^{\prime}} \right|_{ij}$$

(6)

is a qudit analogue of the controlled-Z (CZ) gate acting on the ith and the jth qudits. It is easy to confirm that when d = 2, a qudit graph state becomes a conventional qubit graph state. The ith stabilizer $g_i^{(d)}$ (with 1 ≤ i ≤ n) of |G_d〉 is given by

$$g_i^{(d)} \equiv \left( {\mathop {\prod} \limits_{(i,j) \in E} C{Z_{ij}}} \right){X_i}\left( {\mathop {\prod} \limits_{(i,j) \in E} CZ_{ij}^\dagger } \right)$$

(7)

$$= X_i\mathop {\prod}\limits_{v_j \in N^{(i)}} {Z_j},$$

(8)

where N⁽ⁱ⁾ is the set of neighbors of the ith vertex, and

$$Z_j \equiv \mathop {\sum}\limits_{k = 0}^{d - 1} {e^{i2\pi k/d}} \left| k \right\rangle \left\langle k \right|$$

(9)

is the generalized Pauli-Z operator acting on the jth qudit. It is easy to check that $g_i^{(d)}\left| {G_d} \right\rangle = \left| {G_d} \right\rangle$.

Stabilizer test for qudit graph states

Consider a stabilizer test which is an essential sub-protocol of our verification protocol for qudit graph states. Let ρ be an n-qudit quantum state. We define the stabilizer test for $g_i^{(d)}$ on ρ as follows: Alice measures X_i and Z_j for all j ∈ N⁽ⁱ⁾. Let x_i ∈ {0, …, d − 1} and z_j ∈ {0, …, d − 1} be the measurement outcomes of X_i and Z_j, respectively. We say that Alice passes the stabilizer test for $g_i^{(d)}$ on ρ if

$$x_i + \mathop {\sum}\limits_{j \in N^{(i)}} {z_j} \equiv 0\;({\mathrm{mod}}\;d).$$

(10)

Since the correct qudit graph state |G_d〉 always satisfies Eq. (11), it passes the stabilizer test for $g_i^{(d)}$ with unit probability for all i.

CV weighted hypergraph states

A weighted hypergraph G ≡ (V, E, Ω) is a triple of a set $V \equiv \{ v_i\} _{i = 1}^n$ of vertices, a set $E \equiv \left\{ {e_i} \right\}_{i = 1}^{|E|}$ of hyperedges, and a set $\Omega \equiv \left\{ {\Omega _i} \right\}_{i = 1}^{|E|}$ of weights, where n ≡ |V|. Here, a hyperedge is a set of vertices, and $\Omega _i \in {\Bbb R}$ represents the weight of the ith hyperedge. An edge is a special case of the hyperedge when |e| = 2, where |e| denotes the number of vertices linked to the hyperedge e. Let

$$\left| {G_{{\mathrm{CV}}}} \right\rangle \equiv \left( {\mathop {\prod}\limits_{j = 1}^{|E|} {CZ_{e_j}} (\Omega _j)} \right)\left| {0_p} \right\rangle ^{ \otimes n}$$

(11)

be a CV weighted hypergraph state corresponding to G, where $\left| {0_p} \right\rangle _{v_i}$ is a phase-squeezed state corresponding to the ith vertex, i.e., the eigenvector of the phase quadrature operator $\hat p \equiv - i(\hat a - \hat a^\dagger )/\sqrt 2$ corresponding to the eigenvalue 0, $\hat a$ $(\hat a^\dagger )$ is the boson annihilation (creation) operator,

$$CZ_{e_j}(\Omega _j) \equiv {\mathrm{exp}}\left( {i\Omega _j\mathop {\prod}\limits_{v_i \in e_j} {\hat x_i} } \right)$$

(12)

is a CV analogue of the CZ gate acting on qumodes corresponding to vertices in the hyperedge e_j, and $\hat x_i \equiv (\hat a_i + \hat a_i^\dagger )/\sqrt 2$ is the amplitude quadrature operator acting on the ith qumode. From Eqs. (12) and (13), it can be seen that when |e_j| = 2 for all j, a CV weighted hypergraph state becomes a CV weighted graph state. Since a hypergraph has at most 2ⁿ − 1 hyperedges, the time required to generate a hypergraph state is at most O(2ⁿ). Hereafter, we assume that |E| = poly(n), because states with superpolynomial scaling in n in general require greater than polynomial time to generate, which is considered inefficient. The ith stabilizer $g_i^{({\mathrm{C}}V)}$ (with 1 ≤ i ≤ n) of |G_CV〉 is defined by

$$g_i^{({\mathrm{CV}})} \equiv \left( {\mathop {\prod}\limits_{j = 1}^{|E|} {CZ_{e_j}} (\Omega _j)} \right)\hat p_i\left( {\mathop {\prod}\limits_{j = 1}^{|E|} {CZ_{e_j}} ( - \Omega _j)} \right),$$

(13)

where $\hat p_i$ is the phase quadrature operator acting on the ith qumode. Let E⁽ⁱ⁾ be the set of hyperedges that contain the ith vertex v_i. From Eq. (14),

$$g_i^{({\mathrm{CV}})} = \hat p_i - \mathop {\sum}\limits_{e_j \in E^{(i)}} {\Omega _j} \mathop {\prod}\limits_{v_k \in e_j - \{ v_i\} } {\hat x_k} ,$$

(14)

where we have used the Baker-Hausdorff lemma and the commutation relation $[\hat x,\,\hat p] = i$. It is easy to check that $g_i^{({\mathrm{CV}})}\left| {G_{{\mathrm{CV}}}} \right\rangle = 0\left| {G_{{\mathrm{CV}}}} \right\rangle$. Since the quadrature operators can be measured using homodyne measurements, and Ω are known, the measurement of $g_i^{({\mathrm{CV}})}$ can be accomplished using only homodyne measurements, which are single-qumode measurements.

Stabilizer test for CV weighted hypergraph states

The stabilizer test for CV weighted hypergraph states forms an essential sub-protocol of our CV verification protocol. Let ρ be an n-qumode quantum state. We define the stabilizer test for $g_i^{({\mathrm{CV}})}$ on ρ as follows: Alice measures $\hat p_i$ on the ith qumode and $\hat x_k$ on all qumodes in $\cup _{e_j \in E^{(i)}}e_j - \{ v_i\}$. Let $p_i \in {\Bbb R}$ and $x_k \in {\Bbb R}$ be the measurement outcomes of $\hat p_i$ and $\hat x_k$, respectively. We say that Alice passes the stabilizer test for $g_i^{({\mathrm{CV}})}$ on ρ if

$$p_i - \mathop {\sum}\limits_{e_j \in E^{(i)}} {\Omega _j} \mathop {\prod}\limits_{v_k \in e_j - \{ v_i\} } {x_k} = 0.$$

(15)

Here, we assume that measurements are infinitely accurate. However, as shown in the “Robustness” subsection in the RESULTS section, we can relax this assumption to some extent. Since we assume that |E| = poly(n), Alice can calculate the left-hand side of Eq. (16) in classical polynomial time. The correct CV weighted hypergraph state |G_CV〉 passes the stabilizer test for $g_i^{({\mathrm{CV}})}$ with unit probability for all i because the correct CV weighted hypergraph state |G_CV〉 always satisfies Eq. (16).

Main protocol

Our verification protocol for qudit graph states (CV weighted hypergraph states) runs as follows (see Fig. 2):

• 1. Bob sends an nN_total-qudit (qumode) state ρ_B to Alice as shown in Fig. 1. The state ρ_B consists of N_total registers, and each register stores n qudits (qumodes). If Bob is honest, the state of each register is |G_d〉 (|G_CV〉), i.e., $\rho _B = \left| {G_d} \right\rangle \left\langle {G_d} \right|^{ \otimes N_{{\mathrm{total}}}}$ ($\rho _B = \left| {G_{{\mathrm{CV}}}} \right\rangle \left\langle {G_{{\mathrm{CV}}}} \right|^{ \otimes N_{{\mathrm{total}}}}$). On the other hand, if he is malicious, ρ_B can be any arbitrary state.

• 2. Alice repeats the following for i = 1, …, n: she chooses N_test registers from the remaining N_total − (i − 1)N_test registers independently and uniformly at random, and then she performs the stabilizer tests for $g_i^{(d)}$ $(g_i^{({\mathrm{CV}})})$ on each of them. Let N_pass,i be the number of registers that pass the stabilizer test for $g_i^{(d)}$ $(g_i^{({\mathrm{CV}})})$.

• 3. Alice uniformly and randomly chooses a single register from the remaining N_total − nN_test registers that were not used for the stabilizer tests in step 2. We call the chosen single register the target register. Therefore, the averaged state of the target register is $\rho _{{\mathrm{tgt}}} \equiv \mathop {\sum}\limits_i {\rho _i} /(N_{{\mathrm{total}}} - nN_{{\mathrm{test}}})$, where ρ_i is the ith remaining register. All the other N_total − nN_test − 1 registers are discarded.

• 4. If

$$\mathop {\sum}\limits_{i = 1}^n {N_{{\mathrm{pass}},i}} \ge \left( {n - \frac{1}{{2n}}} \right)N_{{\mathrm{test}}},$$

(16)

she uses the target register for her MBQC, otherwise she discards the target register.

Fig. 2

The schematic shows our verification protocol. a The ideal case, i.e., $\rho _B = \left| G \right\rangle \left\langle G \right|^{ \otimes N_{{\mathrm{total}}}}$, where |G〉 ∈ {|G_d〉, |G_CV〉}. In this figure, |G〉 is represented by the five-vertex graph (n = 5). In the first repetition of step 2 of our protocol, Alice chooses N_test registers uniformly and independently at random from N_total registers. The chosen N_test registers are highlighted in green color. Alice performs the stabilizer test for $g_1 \in \{ g_1^{(d)},g_1^{({\mathrm{CV}})}\}$ on each of these chosen green registers. In the second repetition of step 2 of our protocol, Alice chooses N_test registers uniformly and independently at random from the remaining N_total − N_test registers. These chosen N_test registers are highlighted in blue color. Alice performs the stabilizer test for $g_2 \in \{ g_2^{(d)},g_2^{({\mathrm{CV}})}\}$ on each of these chosen blue registers. Alice repeats the same procedure n times. In the n-th repetition, i.e., in the last repetition, Alice chooses N_test registers uniformly and independently at random from the remaining N_total − (n − 1)N_test registers. These chosen N_test registers are highlighted in yellow color. Alice performs the stabilizer test for $g_n \in \{ g_n^{(d)},g_n^{({\mathrm{CV}})}\}$ on each of these chosen yellow registers. Finally, Alice chooses one register, which we call the target register, from the remaining N_total − nN_test registers. The target register is highlighted in red color. If the results of the stabilizer tests satisfy a certain condition (see step 4 of our protocol), the state ρ_tgt of the target register is guaranteed to be close to |G〉 with high probability. b In general, ρ_B can be any nN_total-qudit (qumode) state. The state ρ_B consists of N_total registers, and each register contains n qudits (qumodes). Each register is represented by a box. Any entanglement can be generated amongst registers, which is indicated by the purple “cloud” behind boxes

We will later show that our verification protocol gives the lower bound on the fidelity between the state ρ_tgt of the target register and the ideal graph state |G_d〉 (|G_CV〉) (see Theorem 1).

Note that in the above protocol, no quantum memory is needed for Alice. This is because Bob sends each qubit of ρ_B one by one to Alice, and she randomly chooses her action from the stabilizer tests, MBQC on the target register, and discarding. Most importantly, our protocol does not assume any i.i.d. property on the quantum state ρ_B. In other words, ρ_B can be any state, and we do not assume that $\rho _B = \sigma ^{ \otimes N_{{\mathrm{total}}}}$, where σ is an n-qudit (qumode) state.

To show that our protocol is valid, we now show its completeness and soundness. Intuitively, if Alice accepts the correct quantum state with high probability, we say that the verification protocol has the completeness. In other words, the completeness means that Alice does not mistakenly reject the correct quantum state. On the other hand, if the verification protocol guarantees that the accepted quantum state is close to the correct state with high probability, we say that the verification protocol has the soundness. That is, the soundness means that Alice does not mistakenly accept any quantum state that is far from the ideal state. It is not difficult to show the completeness of our protocol. In fact, when Bob is honest, i.e., when he sends $\left| {G_d} \right\rangle ^{ \otimes N_{{\mathrm{total}}}}$ $(\left| {G_{{\mathrm{CV}}}} \right\rangle ^{ \otimes N_{{\mathrm{total}}}})$ to Alice, she uses the target register for her MBQC in step 4 with unit probability, because $\mathop {\sum}\nolimits_{i = 1}^n {N_{{\mathrm{pass}},i}} = nN_{{\mathrm{test}}}$. With respect to the soundness, the following theorem holds:

Theorem 1

(Soundness) Let $N_{\mathrm{pass}} \equiv \mathop {\sum}\nolimits_{i = 1}^n {N_{\mathrm{pass},i}}$. If we set N_total = 2nN_test and $N_{\mathrm{test}} = \left\lceil {5n^4\log n/32} \right\rceil$, the n-qudit (qumode) averaged state ρ_tgt of the target register (over all random selections) satisfies, with probability at least 1 − n^1−5c/64,

$$\left\langle G \right|\rho _{{\mathrm{tgt}}}\left| G \right\rangle \ge 1 - \frac{{2\sqrt c }}{n} - 2n\left( {1 - \frac{{N_{{\mathrm{pass}}}}}{{n\left\lceil {5n^4\log n/32} \right\rceil }}} \right),$$

(17)

where $\left\lceil \cdot \right\rceil$ is the ceiling function, c is any constant satisfying 64/5 < c < (n − 1)²/4, n ≥ 9, and |G〉 ∈ {|G_d〉, |G_CV〉}.

We defer the detailed proof of Theorem 1 to the Supplementary Information Section A. A brief explanation of the proof is given in the METHODS section.

If Eq. (17) holds, Theorem 1 gives the non-trivial lower bound:

$$\left\langle G \right|\rho _{{\mathrm{tgt}}}\left| G \right\rangle \ge 1 - \frac{{2\sqrt c + 1}}{n}.$$

(18)

Hence Theorem 1 shows the soundness of our verification protocol.

Resource efficiency

To show the resource efficiency of our protocol, we compare it with the verification protocol of ref. ¹⁵, which can verify any graph state and is one of the most efficient protocols currently known. For simplicity, let us consider the situation where the quantum state ρ_B generated by Bob consists of N_total − 1 ideal states $\left| G \right\rangle ^{ \otimes (N_{{\mathrm{total}}} - 1)}$ and a single incorrect n-qudit (qumode) state η. In other words, $\rho _B = P[(\left| G \right\rangle \left\langle G \right|)^{ \otimes (N_{{\mathrm{total}}} - 1)} \otimes \eta ]$, where P is a permutation operator for registers. Bob knows that how P permutes $(\left| G \right\rangle \left\langle G \right|)^{ \otimes (N_{{\mathrm{total}}} - 1)} \otimes \eta$ while Alice does not. In this case, since N_pass ≥ nN_test − 1 holds with unit probability, Eq. (19) holds with probability at least 1 − n^1−5c/64. In order to satisfy this statement, our verification protocol requires $N_{{\mathrm{total}}} = 2n\left\lceil {5n^4\log n/32} \right\rceil$ registers. The verification protocol of ref. ¹⁵ guarantees the fidelity 1 − 1/(αM) with probability at least 1 − α using (N_total = )M registers. Here, α is an upper bound on the probability of a quantum state whose fidelity is less than 1 − 1/(αM) being selected as the target register. Therefore, if we require the protocol of ref. ¹⁵ to achieve the same fidelity and the probability as ours,

$$\left\{ \begin{array}{l}1 - \frac{1}{{\alpha M}} = 1 - \frac{{2\sqrt c + 1}}{n}\\ \alpha = n^{1 - 5c/64}\end{array} \right.$$

(19)

have to be satisfied. From these equations, we obtain

$$M = \frac{{n^{5c/64}}}{{2\sqrt c + 1}}.$$

(20)

For example, if c = 192, M = O(n¹⁵), which should be compared with our resource overhead N_total = O(n⁵ log n). In general, if c > 64, the order of M is larger than that of N_total, because if c > 64, M = O(n^t) and

$$t = \frac{{5c}}{{64}} > \frac{{5 \times 64}}{{64}} = 5$$

(21)

while N_total = O(n⁵ log n). (Note that n ≥ 18 is required to satisfy c > 64 because c < (n − 1)²/4). A similar argument holds for other previous protocols.^13,14,16

The reason why our protocol is more efficient than that of ref. ¹⁵ can be explained as follows: the fidelity F′ = 1 − 1/(αM) of their protocol depends on M and α, and therefore, M has to be increased in order to decrease the order of α while keeping the order of 1 − F′ same. Our fidelity, $F = 1 - (2\sqrt c + 1)/n$, also depends on N_total and the probability, because n does, but our fidelity also contains the constant c, which is independent of N_total. Therefore, by increasing c instead of increasing N_total, we can improve the order of the probability without increasing the order of 1−F. The existence of such an extra parameter c is the advantage of using Serfling’s bound. (The constant c comes from ν of Serfling’s bound via $\nu = \sqrt c /n^2$). Note that in general, it is difficult to compare our protocol with previous protocols without performing experiments. This is because the parameter N_pass in Theorem 1 is determined by experiment. In addition, it is also difficult to compare our protocol with other approaches mentioned in the last paragraph in the INTRODUCTION section. This is because their definitions of the soundness (verifiability) is different from ours. Our definition of the soundness relies on the fidelity between the ideal resource state and the actual one. On the other hand, their definitions do not (directly) rely on the fidelity.

Robustness

To investigate the error tolerance of our protocol, consider a simple example where all registers of ρ_B are in the same state σ, and the state σ is a slightly deviated state from the ideal state |G〉:

$$\sigma = \left( {1 - \epsilon } \right)\left| G \right\rangle \left\langle G \right| + \epsilon \eta ,$$

(22)

where $0 \,<\, \epsilon\, <\, 1$, and η is any n-qudit (qumode) state. In other words,

$$\rho _B = \sigma ^{ \otimes N_{{\mathrm{total}}}}.$$

(23)

When $\epsilon = 1/{\mathrm{poly}}(n)$, such σ is still useful for quantum computing, because

$$|{\mathrm{Tr}}[A\sigma ] - {\mathrm{Tr}}[A\left| G \right\rangle \left\langle G \right|]| \le ||\left( {1 - \epsilon } \right)\left| G \right\rangle \left\langle G \right| + \epsilon \eta - \left| G \right\rangle \left\langle G \right|||$$

(24)

$$\le 2\sqrt \epsilon,$$

(25)

where ||·|| is the trace norm, for any positive operator-valued measure (POVM) element A. Therefore, the output probability distribution of MBQC on σ is close to that on |G〉 within the 1/poly(n) error, which is sufficient enough to solve, for example, bounded error quantum polynomial time (BQP) decision problems.

When $\epsilon\, <\, O(1/(n^5\log n))$, our protocol can accept ρ_B of Eq. (24) with almost unit probability. In fact, by a direct calculation, our protocol accepts ρ_B with the probability

$$p_{{\mathrm{acc}}} \equiv \mathop {\sum}\limits_{k = 0}^{\left\lfloor {N_{{\mathrm{test}}}/(2n)} \right\rfloor } {\left( \begin{array}{c}nN_{{\mathrm{test}}}\\ k\end{array} \right)} (1 - \epsilon )^{nN_{{\mathrm{test}}} - k}\epsilon ^k,$$

(26)

where $\left\lfloor \cdot \right\rfloor$ is the floor function. From $p_{{\mathrm{acc}}}\, >\, (1 - \epsilon )^{nN_{{\mathrm{test}}}}$ and nN_test = O(n⁵ log n), if $\epsilon\, <\, O(1/(n^5\log n))$, p_acc approaches 1 in the limit of large n.

The acceptance probability p_acc of our protocol is higher than that of ref. ¹⁵, suggesting that our protocol is more robust than that of ref. ¹⁵. In fact, the protocol of ref. ¹⁵ accepts ρ_B of Eq. (24) with the probability

$$p^{\prime}_{{\mathrm{acc}}} \equiv (1 - \epsilon )^{M - 1}.$$

(27)

Therefore, if c > 64,

$$p_{\mathrm{acc}} > (1 - \epsilon )^{nN_{\mathrm{test}}} \ge (1 - \epsilon )^{M - 1} = p^{\prime}_{\mathrm{acc}},$$

(28)

where we have used Eq. (26) and the fact that nN_test ≤ M − 1, which is asymptotically true for large n when c > 64, because nN_test = N_total/2 = O(n⁵ log n) and M = O(n^t) where t > 5 from Eq. (22).

For simplicity, we have considered the tensor product of the same state σ as shown in Eq. (24). However, it is easy to confirm that a similar argument holds even when small entanglement is created among registers of ρ_B. Furthermore, since the errors considered above can also be treated as errors in measurements, we can relax the assumption where measurements are ideal to some extent.

Verification of multiple quantum states

In step 3 of our protocol, Alice chooses a single register, which we call the target register. What happens if she chooses $\tilde n$ registers, instead of a single register? We can show the following theorem:

Theorem 2

Let $N_{{\mathrm{pass}}} \equiv \mathop {\sum}\nolimits_{i = 1}^n {N_{{\mathrm{pass}},i}}$. If we set N_total = 2nN_test and $N_{{\mathrm{test}}} = \left\lceil {5n^4\log n/32} \right\rceil$, the averaged state $\tilde \rho _{{\mathrm{tgt}}}$ of $\tilde n$ target registers (over all random selections) satisfies, with probability at least 1 − n^1−5c/64,

$$\left\langle G \right|^{ \otimes \tilde n}\tilde \rho _{{\mathrm{tgt}}}\left| G \right\rangle ^{ \otimes \tilde n}\, \ge 1 - \frac{{(2\sqrt c + 2n^2 - 2nN_{{\mathrm{pass}}}/N_{{\mathrm{test}}})\tilde nN_{{\mathrm{test}}}}}{{nN_{{\mathrm{test}}} - (\tilde n - 1)}},$$

(29)

where $\left\lceil \cdot \right\rceil$ is the ceiling function, c is any constant satisfying $64/5 \,< \,c \,< \,[n/\tilde n - 32(\tilde n - 1)/(5\tilde nn^4\log n) - 1]^2/4$, $n \ge 9\tilde n$, $\tilde n = O(n^t)$, t < 1, and |G〉 ∈ {|G_d〉, |G_CV〉}.

If Eq. (17) holds, Theorem 2 gives the non-trivial lower bound:

$$\left\langle G \right|^{ \otimes \tilde n}\tilde \rho _{{\mathrm{tgt}}}\left| G \right\rangle ^{ \otimes \tilde n}\, \ge 1 - \frac{{(2\sqrt c + 1)5\tilde nn^4\log n}}{{5n^5\log n - 32(\tilde n - 1)}}.$$

(30)

Note that setting $\tilde n = 1$ in Theorem 2 results in Theorem 1. This implies that Theorem 1 is a special case of Theorem 2. In several tasks, such as sampling problems, Alice would like to have several copies of graph states. Theorem 2 is useful in such situations. In simple terms, Eq. (30) implies that Alice can obtain $\tilde n = O(n^t)$ quantum states with the fidelity 1 − O(1/n^1–t) using N_total = O(n⁵ log n) registers. For verifying a single quantum state, the resource overhead O(n^5−t log n) of our protocol is almost the same as that O(n⁴ log n) of some previous device-independent multi-server verification protocols.^40,41 Particularly, in the protocol of ref. ⁴⁰, the Azuma-Hoeffding bound^43,44 is used to achieve such overhead while we use Serfling’s bound. A proof of Theorem 2 is provided in the Supplementary Information Section B.

Discussion

We have proposed an efficient and robust verification protocol for any qudit graph state and any polynomial-time-generated CV weighted hypergraph state using Serfling’s bound. Our protocol is much more efficient than the existing verification protocols when the size of the quantum state, the guaranteed fidelity, and the probability are sufficiently large.

Our analysis which is based on Serfling’s bound is not directly applicable to the verification protocols for qubit hypergraph states.^11,12,16 This is mainly due to two reasons: (a) in our analysis, the required number N_total of registers is proportional to the number of measurement settings, which is n in our case. However, in some existing protocols,^11,12 the number of settings is more than poly(n). (b) The ratio of the number of randomly chosen registers in step 3 to that of the remaining registers must be less than O(1/(n⁴ log n)). This is crucial in order for Theorems 1 and 2 to work. In an existing protocol,¹⁶ the number of the remaining (unmeasured) register is only one. It would be interesting to apply our analysis to these existing verification protocols^11,12,16 by appropriately modifying them. However, we leave this as an open problem for further research.

If the open problem will be solved, our analysis would become more attractive. This is because hypergraph states are also resource states of MBQC.^8,45 Particularly, in ref. ⁴⁵, a hypergraph state $\left| {G_n^d} \right\rangle$ has been constructed such that it enables to perform universal MBQC with only Pauli-X and Z basis measurements. Note that the CV analogue of $\left| {G_n^d} \right\rangle$ can be efficiently verified using our protocol presented in this paper. This is because a CV hypergraph state is a special case of CV weighted hypergraph states.

Besides an application to the verification of universal quantum computing, our protocol can be applied to the verifiable blind quantum computing (VBQC) scenario. In VBQC, a client with weak quantum resources delegates an arbitrary quantum computing to a remote (universal) quantum server in such a way that the client’s privacy is preserved and at the same time the integrity of the server is verified. Almost all of the VBQC protocols can be divided into two types, i.e., remote state preparation (RSP) type³³ and measurement-only (MO) type.¹³ In the former type, the client is required to prepare single- or multi-qubit quantum states. On the other hand, in the latter one, the client is required to perform single-qubit projective measurements on the quantum states (usually graph states). A non-verifiable blind quantum computing (BQC) protocol using CV graph states has already been proposed for both types,⁴⁶ but a VBQC protocol using CV graph states has not yet been proposed. In this paper, we focus on the MO type because the homodyne measurement is generally considered to be significantly easier than the generation of highly squeezed states. By combining the original MO-type BQC protocol¹⁰ with our verification protocol of CV weighted hypergraph states, we construct a MO-type CV VBQC protocol as follows:

• 1. The quantum server generates N_total CV cluster states,⁵ and sends them to the client.

• 2. The client performs our CV verification protocol. If the verification protocol succeeds (If Eq. (17) holds), they proceed to the next step. Otherwise, the client aborts the protocol.

• 3. The client performs MBQC on the verified quantum states.

Note that this VBQC protocol requires no quantum memory for the client. Although the protocol above is phrased sequentially, when no quantum memory is used, the computation is actually interspersed with the test runs which themselves take place out of order. The decision to accept or reject is taken once all qumodes have been measured or discarded.

From the universality of the CV cluster state, it follows that our CV VBQC protocol has perfect correctness, i.e., the client can obtain the correct result if the server is honest. Next, our protocol is blind, i.e., the server cannot learn client’s inputs, algorithms, and outputs, because there does not exist any communication channel from the client to the server. Finally, the verifiability of our VBQC protocol follows from our CV verification protocol given in the RESULTS section.

In our CV VBQC protocol, we assume that the honest server sends the client an ideal CV graph state whose squeezing level is infinite. One possible approach to relax this assumption is to construct a test where even finitely squeezed states can pass with sufficiently high probability. Recently, Liu et al. have constructed a fidelity witness with respect to the tensor products of finitely squeezed cubic phase states.²⁹ Based on this fidelity witness, they have also proposed another CV VBQC protocol. Therefore, their VBQC protocol does not need infinitely squeezed states unlike our VBQC protocol. On the other hand, their protocol assumes that the malicious server is restricted to preparing i.i.d. copies of single-qumode states while the malicious server in our protocol can perform any CPTP map as the attack. It would be interesting to combine these two approaches to design better and more practical CV VBQC protocols.

Methods

In this section, we provide the primary mathematical tool used in the proof of Theorem 1 and an intuitive explanation of the proof. Our main tool is Serfling’s bound:

Lemma 1

(Serfling's bound ^23,24) Consider a set of binary random variables Y = (Y₁, Y₂, …, Y_T) with Y_j taking values in {0, 1} and T = N + K. Then, for any 0 < ' ν< 1,

$${\mathrm{Pr}}\left[ {\mathop {\sum}\limits_{j \in \bar {\Pi}} {Y_j} \ge \frac{N}{K}\mathop {\sum}\limits_{j \in {\Pi}} {Y_j} + N\nu } \right] \le {\mathrm{exp}}\left[ { - \frac{{2\nu ^2NK^2}}{{(N + K)(K + 1)}}} \right],$$

(31)

where Π is a set of K samples chosen independently and uniformly at random from Y without replacement. $\bar {\Pi}$ is the complementary set of Π.

Note that the sampling without replacement means that once a sample is selected, it is removed from the population in all subsequent selections.

In step 2 of our protocol, when i = 1, Alice measures the stabilizer operator $g_1 \in \{ g_1^{(d)},g_1^{({\mathrm{CV}})}\}$ for N_test samples of the set Π⁽¹⁾ that is uniformly and randomly chosen out of the total N_total registers. In this case when Alice passes the stabilizer test for g₁ on the jth register (1 ≤ j ≤ N_test), Y_j = 0; else Y_j = 1. Therefore, by setting K = N_test and T = N_total in Lemma 1, it reveals the upper bound

$$\frac{{N_{{\mathrm{total}}} - N_{{\mathrm{test}}}}}{{N_{{\mathrm{test}}}}}\mathop {\sum}\limits_{j \in {\Pi}^{(1)}} {Y_j} + (N_{{\mathrm{total}}} - N_{{\mathrm{test}}})\nu$$

(32)

on the number of registers that are not stabilized by g₁ in the remaining complementary set $\bar {\Pi}^{(1)}$, which includes N_total − N_test registers (for details, see the second paragraph of the proof in the Supplementary Information Section A).

Next, Alice performs the stabilizer tests for g₂ (when i = 2) by uniformly and randomly choosing N_test registers, which are in the set Π⁽²⁾, from N_total − N_test remaining registers. Similarly, in Lemma 1, by setting K = N_total and T = N_total − N_test, Alice can estimate that at most

$$\frac{N_{\mathrm{total}}-2N_{\mathrm{test}}}{N_{\mathrm{test}}}\sum\limits_{j \in \Pi^{(2)}} Y_{j}+(N_{\mathrm{total}}-2N_{\mathrm{test}})\nu$$

(33)

registers are not stabilized by g₂ in the remaining N_total − 2N_test registers that are not measured by g₁ and g₂.

From Eqs. (32) and (33), we find a lower bound

$$\begin{array}{c}(N_{\mathrm{total}}-2N_{\mathrm{test}})-\left[\frac{N_{\mathrm{total}}\,-\,N_{\mathrm{test}}}{N_{\mathrm{test}}}\sum\limits_{j \in \Pi^{(1)}} Y_{j}+\left(N_{\mathrm{total}}-N_{\mathrm{test}}\right){\nu}\right]\\-\left[\frac{N_{\mathrm{total}}\,-\,2N_{\mathrm{test}}}{N_{\mathrm{test}}}\sum\limits_{j \in \Pi^{(2)}} Y_{j}+\left(N_{\mathrm{total}}-2N_{\mathrm{test}}\right){\nu}\right]\end{array}$$

(34)

on the number of remaining N_total − 2N_test registers that are stabilized by both g₁ and g₂. In estimating this lower bound, we use the pigeonhole principle. In other words, we consider a worst case scenario where the remaining registers that are not stabilized by g₁ and g₂ do not completely overlap with each other.

Using the same argument recursively, Alice estimates a lower bound on the number of the remaining registers stabilized by all of $\left\{ {g_i} \right\}_{i = 1}^n$ in the remaining N_total − nN_test registers. Since only the ideal state |G〉 is stabilized by all the g_i with 1 ≤ i ≤ n, this bound gives a lower bound $N_{{\mathrm{cor}}}^{\mathrm{L}}$ on the number of the ideal states in the remaining registers. If $N_{{\mathrm{cor}}}^{\mathrm{L}}/(N_{{\mathrm{total}}} - nN_{{\mathrm{test}}})$ is large, the averaged fidelity of the target register is also large because Alice finally selects one registers uniformly at random from the remaining registers.