Fine-grained quantum computational supremacy

I Introduction

Quantum computing is believed to outperform classical computing. In fact, quantum advantages have been shown in terms of, for example, the communication complexity comm1 ; comm2 . Regarding the time complexity, however, the ultimate goal, $B Q P \neq B P P$ , seems to be extremely hard to show because of the $P \neq P S P A C E$ barrier complexity_zoo .

Mainly three types of approaches exist to demonstrate quantum speedups over classical computing. First approach is to construct quantum algorithms that are faster than known best classical algorithms. For example, quantum computing can do factoring Shor and simulations of quantum many-body dynamics Iulia , etc. faster than known best classical algorithms. (Classical best algorithms can be, however, updated Tang .) Second approach is to study the query complexity. Quantum computing has been shown to require fewer oracle queries than classical computing Simon ; Grover .

Third one, which has been actively studied recently, is to reduce classical simulatabilities of quantum computing (in terms of sampling) to certain unlikely collapses of conjectures in classical computational complexity theory, such as the infiniteness of the polynomial-time hierarchy. Several sub-universal quantum computing models have been proposed, such as the depth-four circuits TD , the Boson Sampling model BS , the IQP model IQP1 ; IQP2 , the one-clean qubit model (or the DQC1 model) KL ; MFF ; M ; Kobayashi ; KobayashiICALP , the random gate model random , and the HC1Q model HC1Q . (Definitions of the IQP model, DQC1 model, and HC1Q model are given later.) It has been shown that if output probability distributions of these models are classically sampled in polynomial-time, then the polynomial-time hierarchy collapses. The polynomial-time hierarchy is not believed to collapse in classical complexity theory, and therefore if we conjecture the infiniteness of the polynomial-time hierarchy, the reductions suggest quantum computational supremacy of those sub-universal models.

In this paper, we first focus on the DQC1 model, which is defined as follows.

Definition 1

The $N$ -qubit DQC1 model with a unitary $U$ is the following quantum computing model.

The initial state is

$| 0 ⟩ ⟨ 0 | \otimes \frac{I^{\otimes N - 1}}{2^{N - 1}},$

where $I \equiv | 0 ⟩ ⟨ 0 | + | 1 ⟩ ⟨ 1 |$ is the two-dimensional identity operator.
The unitary operator $U$ is applied on the initial state to generate the state

$U (| 0 ⟩ ⟨ 0 | \otimes \frac{I^{\otimes N - 1}}{2^{N - 1}}) U^{†} .$
The first qubit is measured in the computational basis. If the output is 0 (1), then accept (reject).

Note that throughout this paper we consider only $p o l y (N)$ -size $U$ without explicitly mentioning it. The DQC1 model was originally introduced by Knill and Laflamme to model the NMR quantum computing KL , and since then many results have been obtained on the model KL ; Poulin1 ; Poulin2 ; ShorJordan ; Passante ; JordanWocjan ; JordanAlagic ; MFF ; M ; Kobayashi ; nonclean ; KobayashiICALP

. For example, the DQC1 model can solve several problems whose classical efficient solutions are not known, such as the spectral density estimation

KL , testing integrability Poulin1 , calculations of the fidelity decay Poulin2 , and approximations of Jones and HOMFLY polynomials ShorJordan ; Passante ; JordanWocjan . The acceptance probability

p_{a c c}

of the

N

-qubit DQC1 model with a unitary

U

p_{a c c} \equiv T r [(| 0 ⟩ ⟨ 0 | \otimes I^{\otimes N - 1}) U (| 0 ⟩ ⟨ 0 | \otimes \frac{I^{\otimes N - 1}}{2^{N - 1}}) U^{†}] .

It is known that if $p_{a c c}$ is classically sampled in polynomial-time within a multiplicative error $ϵ < 1$ , then the polynomial-time hierarchy collapses to the second level Kobayashi ; KobayashiICALP .

Definition 2

We say that $p_{a c c}$ is classically sampled in time $T$ within a multiplicative error $ϵ$ if there exists a classical probabilistic algorithm that runs in time $T$ such that

| p_{a c c} - q_{a c c} | \leq ϵ p_{a c c},

where $q_{a c c}$ is the acceptance probability of the classical algorithm.

In this way, previous quantum supremacy results prohibit classical polynomial-time sampling of the DQC1 model based on the infiniteness of the polynomial-time hierarchy. A shortcoming is, however, that a possibility of exponential-time or even superpolynomial-time classical sampling is not excluded: the acceptance probability $p_{a c c}$ of the $N$ -qubit DQC1 model could be classically sampled in, say, $2^{0.0001 N}$ time.

In this paper, we show fine-grained quantum supremacy of the DQC1 model. We assume certain complexity conjectures, and show that the acceptance probability $p_{a c c}$ of the DQC1 model cannot be classically sampled within a multiplicative error $ϵ < 1$ in certain exponential or sub-exponential time (depending on conjectures). More precisely, in Sec. II, we introduce three conjectures, Conjecture 1, Conjecture 2, and Conjecture 3. Conjecture 1 seems to be more stable than Conjecture 2, and Conjecture 2 seems to be more stable than Conjecture 3. Conjecture 1 prohibits classical sampling of the $N$ -qubit DQC1 model in sub-exponential time of $N$ (Theorem 1), while other two conjectures prohibit classical sampling of the $N$ -qubit DQC1 model in $2^{(1 - a) N + o (N)}$ time for any $a > 0$ (Theorem 3 and Theorem 4).

We also show similar fine-grained quantum supremacy results for another sub-universal quantum computing model, namely, the Hadamard-classical circuit with one-qubit (HC1Q) model, which is defined as follows.

Definition 3

The $N$ -qubit HC1Q model with a classical reversible circuit $C : {0, 1}^{N} \to {0, 1}^{N}$ is the following quantum computing model.

The initial state is $| 0^{N} ⟩$ , where $| 0^{N} ⟩$ means $| 0 ⟩^{\otimes N}$ .
The operation

$(H^{\otimes N - 1} \otimes I) C (H^{\otimes N - 1} \otimes I)$

is applied on the initial state. Here,

$H \equiv \frac{1}{\sqrt{2}} (| 0 ⟩ + | 1 ⟩) ⟨ 0 | + \frac{1}{\sqrt{2}} (| 0 ⟩ - | 1 ⟩) ⟨ 1 |$

is the Hadamard gate, and the classical circuit $C$ is applied “coherently”.
Some qubits are measured in the computational basis.

Note that throughout this paper we consider only $p o l y (N)$ -size $C$ without explicitly mentioning it. The HC1Q model is in the second level of the Fourier hierarchy FH2 where several useful circuits, such as those for Shor’s factoring algorithm Shor and Simon’s algorithm Simon , are placed. Furthermore, it was shown in Ref. HC1Q that output probability distributions of the HC1Q model cannot be classically sampled in polynomial-time within a multiplicative error $ϵ < 1$ unless the polynomial-time hierarchy collapses to the second level. We show that under the fine-grained complexity conjectures, the output probability distributions of the HC1Q model cannot be classically sampled within a multiplicative error $ϵ < 1$ in certain exponential or sub-exponential time (depending on conjectures). As in the case of the DQC1 model, Conjecture 1 prohibits classical sampling of the $N$ -qubit HC1Q model in sub-exponential time of $N$ (Theorem 2), while Conjecture 3 prohibits classical sampling of the $N$ -qubit HC1Q model in $2^{(1 - a) N + o (N)}$ time for any $a > 0$ (Theorem 5).

There are some previous results AaronsonChen ; Huang ; Dalzell that showed quantum computational supremacy based on other conjectures than the infiniteness of the polynomial-time hierarchy. In particular, Ref. Dalzell showed fine-grained quantum supremacy of the IQP model, QAOA model, and Boson Sampling model. For details, see Sec. IV.

Finally, in this paper, we also study universal quantum computing with Clifford and $T$ gates, where

T \equiv | 0 ⟩ ⟨ 0 | + e^{i π / 4} | 1 ⟩ ⟨ 1 |,

and Clifford gates are $H$ ,

	$S$	$\equiv$	$\| 0 ⟩ ⟨ 0 \| + i \| 1 ⟩ ⟨ 1 \|,$
	$C Z$	$\equiv$	$I^{\otimes 2} - 2 \| 11 ⟩ ⟨ 11 \| .$

For an $N$ -qubit quantum circuit $V$ that consists of only Clifford and $T$ gates, we define the acceptance probability $p_{a c c}$ by

p_{a c c} \equiv | ⟨ 0^{N} | V | 0^{N} ⟩ |^{2} .

Due to the Gottesman-Knill theorem GK , $p_{a c c}$ can be exactly calculated in $p o l y (N)$ time if $V$ contains at most $O (log (N))$ number of $T$ gates. The brute-force classical calculation of $p_{a c c}$ needs time that scales in an exponential of $t$ , where $t$ is the number of $T$ gates.

In Sec. II, we introduce two conjectures, Conjecture 4 and Conjecture 5. Conjecture 4 is equivalent to so-called the exponential-time hypothesis (ETH) IPZ01 . Under Conjecture 4, we show that $p_{a c c}$ cannot be classically calculated in $2^{o (t)}$ time within an additive error smaller than $2^{- \frac{3 t + 14}{7}}$ (Theorem 6). Conjecture 5 is a ${c o C}_{=} P ⊈ N P$ -version of Conjecture 4, and it allows us to show that $p_{a c c}$ cannot be classically sampled in $2^{o (t)}$ time within a multiplicative error $ϵ < 1$ (Theorem 7). There is a classical algorithm that computes $p_{a c c}$ within a constant multiplicative error and in $\sim 2^{β t}$ time with a non-trivial factor $β ≃ 0.47$ BravyiGosset . Our second result (Theorem 7) therefore suggests that improving $2^{β t}$ to some sub-exponential time, say $2^{\sqrt{t}}$ , is impossible. Note that Ref. DalzellPhD showed that $β$ must be $β > 1 / 135 ≃ 0.0074$ under the conjecture,

MAJ-ZEROS \notin Σ_{3} T I M E (\frac{2^{n / 5}}{92} - \frac{n}{8}),

where MAJ-ZEROS is the problem of deciding whether $g a p (f) > 0$ or not for given a degree-3 polynomial $f$ in $n$ variables over the field $F_{2}$ .

Theorem 6 considers the hardness of calculating output probability distributions (i.e., the strong simulation) in terms of $t$ -scaling, while Ref. Huang considered that in terms of $N$ -scaling. It was shown in Ref. Huang that if SETH is true then calculating output probability amplitudes of a certain $N$ -qubit quantum computation within the additive error $2^{- N + 1}$ needs $2^{N - o (N)}$ -time. Note that the strong simulation, i.e., calculating output probability distributions of quantum computing within an exponentially small additive error, is $#$ P-hard, which means that hard even for quantum computing. However, it is still meaningful to study strong simulations of quantum computing because several quantum computing models, such as Clifford circuits and match-gate circuits match , are known to be strongly simulatable.

The Pauli-based computation (PBC) BravyiSmithSmolin is a universal quantum computing model closely related to the Clifford $+ T$ quantum computing, which is defined as follows.

Definition 4

The $t$ -qubit Pauli-based quantum computation (PBC) is the following quantum computing model.

The initial state is $| H ⟩^{\otimes t}$ , where

$| H ⟩ \equiv cos \frac{π}{8} | 0 ⟩ + sin \frac{π}{8} | 1 ⟩$

is a magic state.
Non-destructive Pauli measurements are done adaptively.
The measurement results are finally classically processed.

Under Conjecture 5, we show that output probability distributions of the $t$ -qubit PBC cannot be classically sampled within a multiplicative error $ϵ < 1$ in $2^{o (t)}$ time (Theorem 8).

Ii Conjectures

In this section, we introduce conjectures. First let us consider the following three conjectures.

Conjecture 1

Let $A$ be any non-deterministic $T (n)$ -time algorithm such that the following holds: given (a description of) a polynomial-size Boolean circuit $f : {0, 1}^{n} \to {0, 1}$ , $A$ accepts if $g a p (f) \neq 0$ and rejects if $g a p (f) = 0$ , where

g a p (f) \equiv \sum x \in {0, 1}^{n} (- 1)^{f (x)} .

Then, for any constant $a > 0$ , $T (n) > 2^{(1 - a) n}$ holds for infinitely many $n$ .

Conjecture 2

It is the same as Conjecture 1 except that the Boolean circuit $f$ is of logarithmic depth.

Conjecture 3

Let $A$ be any non-deterministic $T (n)$ -time algorithm such that the following holds: given (a description of) a polynomial-size classical reversible circuit $C : {0, 1}^{n + ξ} \to {0, 1}^{n + ξ}$ that consists of only NOT and TOFFOLI, $A$ accepts if $g a p (C) \neq 0$ and rejects if $g a p (C) = 0$ , where

g a p (C) \equiv \sum x \in {0, 1}^{n} (- 1)^{C_{n + ξ} (x 0^{ξ})},

and $C_{n + ξ} (x 0^{ξ}) \in {0, 1}$ is the last bit of $C (x 0^{ξ}) \in {0, 1}^{n + ξ}$ . Then, for any constant $a > 0$ , $T (n) > 2^{(1 - a) n}$ holds for infinitely many $n$ .

These conjectures are considered as strong (fine-grained) versions of the conjecture, ${c o C}_{=} P ⊈ N P$ , which is believed because ${c o C}_{=} P \subseteq N P$ leads to the collapse of the polynomial-time hierarchy to the second level Kobayashi ; KobayashiICALP . Here, ${c o C}_{=} P$ is defined as follows.

Definition 5

A language $L$ is in ${c o C}_{=} P$

if and only if there exists a non-deterministic polynomial-time Turing machine such that if

x \in L

then the number of accepting paths is not equal to that of rejecting paths, and if

x \notin L

then they are equal.

These conjectures should be justified by the following arguments. First of all, it is true that direct connections between our conjectures and SETH IP01 ; IPZ01 (or NSETH CGIMPS ) are not clear, because acceptance criteria are different. (Our conjectures are based on gap functions, while SETH and NSETH are on $#$

P functions.) However, at this moment, the only known way of deciding

g a p (f) \neq 0

g a p (f) = 0

is to solve

#

SAT problems. Even if

f

is restricted to

k

-CNF, the current fastest algorithm CW to solve

#

SAT satisfies

a \to 0

k \to \infty

, and therefore it is true for more general circuits such as NC circuits or general polynomial-size Boolean circuits. As is shown in Lemma 1 below, Conjecture 3 can be based on SETH (

k

-CNF). Conjecture 2, which can be based on NC-SETH AHVWW16 , can be considered as more stable than Conjecture 3, since NC circuits are more general than

k

-CNF. Furthermore, Conjecture 1 can be considered as more stable than Conjecture 2, because general polynomial-size Boolean circuits are more general than NC circuits.

As is shown in Sec. III, Conjecture 1 prohibits only sub-exponential-time classical sampling for the DQC1 model (Theorem 1) and the HC1Q model (Theorem 2). Conjecture 2, on the other hand, prohibits exponential-time sampling for the DQC1 model (Theorem 3). Conjecture 3 with $ξ = o (n)$ also prohibits exponential-time sampling both for the DQC1 model (Theorem 4) and the HC1Q model (Theorem 5).

Lemma 1

For any $k$ -CNF $f : {0, 1}^{n} \to {0, 1}$ with $k = o (n)$ , there exists a classical reversible circuit $C : {0, 1}^{n + ξ} \to {0, 1}^{n + ξ}$ that uses only TOFFOLI and NOT such that $ξ = o (n)$ , and $C_{n + ξ} (x 0^{ξ}) = f (x)$ for any $x \in {0, 1}^{n}$ .

Its proof is given in Sec. V.

In order to study Clifford- $T$ quantum computing, we also introduce the following two conjectures.

Conjecture 4

Any (classical) deterministic algorithm that decides whether $# f > 0$ or $# f = 0$ for given (a description of) a 3-CNF with $m$ clauses, $f : {0, 1}^{n} \to {0, 1}$ , needs $2^{Ω (m)}$ time. Here,

# f \equiv \sum x \in {0, 1}^{n} f (x)

Conjecture 5

Any non-deterministic algorithm that decides whether $g a p (f) \neq 0$ or $g a p (f) = 0$ for given (a description of) a 3-CNF with $m$ clauses, $f : {0, 1}^{n} \to {0, 1}$ , needs $2^{Ω (m)}$ time. Here

g a p (f) \equiv \sum x \in {0, 1}^{n} (- 1)^{f (x)} .

Conjecture 4 is equivalent to so-called the exponential-time hypothesis (ETH) IPZ01 . Conjecture 5 is a ${c o C}_{=} P ⊈ N P$ -version of Conjecture 4. As we have said, the only known way of deciding $g a p (f) \neq 0$ or $g a p (f) = 0$ is to solve the $#$ SAT problems, and therefore Conjecture 5 could be justified by ETH.

As is shown in Sec. III, Conjecture 4 shows that calculating $p_{a c c}$ of Clifford- $T$ quantum computing needs $2^{Ω (t)}$ -time, where $t$ is the number of $T$ gates (Theorem 6). Conjecture 5 shows that classical sampling of $p_{a c c}$ needs $2^{Ω (t)}$ -time (Theorem 7).

Iii Results

Based on conjectures introduced in the previous section, we now show fine-grained quantum supremacy results. Proofs of the following theorems are given in Sec. V.

First, with Conjecture 1, we can show the following two results.

Theorem 1

Assume that Conjecture 1 is true. Then for any constant $a > 0$ and for infinitely many $n$ , there exists an $N$ -qubit DQC1 model, where $N = p o l y (n)$ , whose acceptance probability $p_{a c c}$ cannot be classically sampled in time $2^{(1 - a) n}$ within a multiplicative error $ϵ < 1$ .

Theorem 2

Assume that Conjecture 1 is true. Then for any constant $a > 0$ and for infinitely many $n$ , there exists an $N$ -qubit HC1Q model, where $N = p o l y (n)$ , whose acceptance probability $p_{a c c}$ cannot be classically sampled in time $2^{(1 - a) n}$ within a multiplicative error $ϵ < 1$ .

Note that although we know $N = p o l y (n)$ , we do not know the degree of the polynomial. For example, $N$ might be $N = n^{10}$ , and in this case, theorems say that the $N$ -qubit DQC1 model and the $N$ -qubit HC1Q model cannot be classically sampled in $2^{(1 - a) N^{\frac{1}{10}}}$ -time, which is superpolynomial (sub-exponential) but not exponential.

Second, with Conjecture 2, we can show the following result.

Theorem 3

Assume that Conjecture 2 is true. Then for any constant $a > 0$ and for infinitely many $N$ , there exists an $N$ -qubit DQC1 model whose acceptance probability $p_{a c c}$ cannot be classically sampled in time $2^{(1 - a) (N - 3)}$ within a multiplicative error $ϵ < 1$ .

Finally, with Conjecture 3, we can show the following two results.

Theorem 4

Assume that Conjecture 3 is true for $ξ = o (n)$ . Then for any constant $a > 0$ and for infinitely many $N$ , there exists an $N$ -qubit DQC1 model whose acceptance probability $p_{a c c}$ cannot be classically sampled in time $2^{(1 - a) N + o (N)}$ within a multiplicative error $ϵ < 1$ .

Theorem 5

Assume that Conjecture 3 is true for $ξ = o (n)$ . Then for any constant $a > 0$ and for infinitely many $N$ , there exists an $N$ -qubit HC1Q model whose acceptance probability $p_{a c c}$ cannot be classically sampled in time $2^{(1 - a) N + o (N)}$ within a multiplicative error $ϵ < 1$ .

The above three theorems, Theorem 3, Theorem 4, and Theorem 5, prohibit exponential-time sampling of the DQC1 model and the HC1Q model.

For Clifford- $T$ quantum computing, we can show the following two results. (Theorem 6 was also shown in Ref. Huang2 independently.)

Theorem 6

Assume that Conjecture 4 is true. Then for infinitely many $t$ there exists Clifford- $T$ quantum circuit with $t$ $T$ gates whose acceptance probability $p_{a c c}$ cannot be calculated in $2^{o (t)}$ time within an additive error smaller than $2^{- \frac{3 t + 14}{7}}$ .

Theorem 7

Assume that Conjecture 5 is true. Then for infinitely many $t$ there exists a Clifford- $T$ quantum circuit with $t$ $T$ gates whose acceptance probability $p_{a c c}$ cannot be classically sampled in $2^{o (t)}$ time within a multiplicative error $ϵ < 1$ .

For the PBC, we show the following result.

Theorem 8

Assume that Conjecture 5 is true. Then, for infinitely many $t$ there exists a $t$ -qubit PBC whose output probability distributions cannot be classically sampled in $2^{o (t)}$ time within a multiplicative error $ϵ < 1$ .

Iv Discussion

In this section, we give several discussions.

iv.1 Optimality of Theorem 5

The acceptance probability of any $N$ -qubit HC1Q model can be calculated in $2^{N + log (p o l y (N)) - 1}$ time. Theorem 5 is therefore optimal. In fact, by a straightforward calculation,

			$⟨ z \| (H^{\otimes N - 1} \otimes I) C (H^{\otimes N - 1} \otimes I) \| 0^{N} ⟩$
		$=$	$\frac{1}{2^{N - 1}} \sum x \in {0, 1}^{N - 1} (- 1)^{\sum_{j = 1}^{N - 1} z_{j} C_{j} (x 0)} δ_{z_{N}, C_{N} (x 0)}$

for any reversible circuit $C : {0, 1}^{N} \to {0, 1}^{N}$ and $z \in {0, 1}^{N}$ , where $C_{j} (x 0) \in {0, 1}$ is the $j$ th bit of $C (x 0) \in {0, 1}^{N}$ . If $C$ is $p o l y (N)$ size, each term of the exponential sum can be computed in $p o l y (N)$ time, and to sum all of them needs $2^{N - 1}$ time. The total time is therefore

p o l y (N) \times 2^{N - 1} = 2^{N + log (p o l y (N)) - 1} .

iv.2 $H$ and classical gates

When we consider quantum computing over Clifford and $T$ gates, we are interested in the number $t$ of $T$ gates, because $T$ gates are “quantum resources”. In a similar way, when we consider quantum computing over classical gates and $H$ , we are interested in the number $h$ of $H$ gates. Since the number $h$ of $H$ in the $N$ -qubit HC1Q model is $h = 2 (N - 1)$ , Theorem 5 leads to the following corollary.

Corollary 1

Assume that Conjecture 3 is true for $ξ = o (n)$ . Then for any constant $a > 0$ and for infinitely many $h$ , there exists a quantum circuit with classical gates and $h$ $H$ gates whose output probability distributions cannot be classically sampled in time $2^{(1 - a) \frac{h}{2} + o (h)}$ within a multiplicative error $ϵ < 1$ .

Actually, we can show a similar result based on Conjecture 1:

Theorem 9

Assume that Conjecture 1 is true. Then for any constant $a > 0$ and for infinitely many $h$ , there exists a quantum circuit with classical gates and $h$ $H$ gates whose output probability distributions cannot be classically sampled in time $2^{(1 - a) (\frac{h}{2} - \frac{1}{2})}$ within a multiplicative error $ϵ < 1$ .

Its proof is given in Sec. V.

For the strong simulation, we can show the following.

Theorem 10

Assume that SETH is true. Then, for any constant $a > 0$ and for infinitely many $h$ , there exists an $N$ -qubit quantum circuit $V$ over classical gates and $h$ $H$ gates such that $N = p o l y (h)$ and the classical exact calculation of $∥ (I^{\otimes N - 1} \otimes | 1 ⟩ ⟨ 1 |) V | 0^{N} ⟩ ∥^{2}$ cannot be done in deterministic $2^{(1 - a) h}$ time.

Its proof is given in Sec. V. Here, SETH asserts as follows.

Conjecture 6 (Seth)

Let $A$ be any classical deterministic $T (n)$ -time algorithm such that the following holds: given (a description of) a CNF, $f : {0, 1}^{n} \to {0, 1}$ , with at most $c n$ clauses, $A$ accepts if $# f > 0$ and rejects if $# f = 0$ , where

# f \equiv \sum x \in {0, 1}^{n} f (x) .

Then, for any constant $a > 0$ , there exists a constant $c > 0$ such that $T (n) > 2^{(1 - a) n}$ holds for infinitely many $n$ .

iv.3 Fine-grained supremacy for the IQP model

Ref. Dalzell showed a fine-grained result on the hardness of classically sampling output probability distributions of the IQP model within a multiplicative error. Here, the IQP model is defined as follows IQP1 .

Definition 6

The $N$ -qubit IQP model with a unitary $D$ is the following quantum computing model, where $D$ consists of only $Z$ -diagonal gates (such as $Z$ , $C Z$ , $C C Z$ , and $e^{i θ Z}$ , etc.).

The initial state is $| 0^{N} ⟩$ .
The operation $H^{\otimes N} D H^{\otimes N}$ is applied on the initial state.
All qubits are measured in the computational basis.

To show the fine-grained quantum supremacy of the IQP model, they used the conjecture, so-called poly3-NSETH $(a)$ , which is the same as Conjecture 1 except that $f$ is restricted to be polynomials over the field $F_{2}$ with degree at most 3. An advantage of restricting $f$ to be polynomials is that IQP circuits can calculate polynomials over $F_{2}$ without introducing any ancilla qubit. (For the QAOA model, $n$ ancilla qubits are necessary Dalzell .) Because of this advantage, exponential-time classical sampling is prohibited for the IQP model. However, a disadvantage of poly3-NSETH $(a)$ is that it is violated when $a < 0.0035$ Tamaki . It was argued in Ref. Dalzell that improving the algorithm of Ref. Tamaki will not rule out poly3-NSETH $(a)$ with $a \geq 0.5$ , and therefore they conjecture poly3-NSETH $(a)$ for $a \geq 0.5$ . Since general Boolean circuits cannot be efficiently represented by systems of equations of polynomials, the technique of Ref. Tamaki cannot be used for general Boolean circuits of Conjecture 1.

iv.4 $H$ , $T$ , and $C z$ gates

Strong simulation of the IQP is possible for $a < 0.0035$ by reducing the problem to counting the number of solutions of polynomials Tamaki . By using a similar technique, we can show the following.

Theorem 11

Let $U$ be an $N$ -qubit $p o l y (N)$ -size quantum circuit over $H$ , $T$ , and $C Z$ . For any $a, b \in {0, 1}^{N}$ , $⟨ a | U | b ⟩$ can be exactly calculated in deterministic $2^{0.972173 h + o (h)}$ time, where $h$ is the number of $H$ gates in $U$ .

It proof is given in Sec. V.

iv.5 Fine-grained supremacy of the Boson sampling model

Ref. Dalzell also studied fine-grained quantum supremacy of the Boson Sampling model. They introduced the conjecture, so-called per-int-NSETH $(b)$ , which states that deciding whether the permanent of a given $n \times n$ integer matrix is nonzero needs non-deterministic $2^{b n}$ time. In this case, no value of $b < 1$ is ruled out by known algorithms Dalzell . It is not clear how per-int-NSETH $(b)$ and our conjectures are related with each other. At least we can show by using Ryser’s formula and Chinese remainder theorem that if $# f$ of $n$ -variable Boolean circuits are calculated in time $2^{(1 - a) n}$ , then permanents of $n \times n$ integer matrices are calculated in $2^{(1 - a) n}$ time.

iv.6 Restricting to CNF

In Conjecture 1, we have assumed that $f$ is any polynomial-size Boolean circuit. It is still reasonable to consider Conjecture 1 with restricting $f$ to be $k$ -CNF formulas while keeping the $a > 0$ condition. (In fact, at this moment, the only known way of deciding whether $g a p (f) \neq 0$ or $g a p (f) = 0$ is to solve $# S A T$ problems. The current fastest algorithm CW to solve $# S A T$ of $k$ -CNF does not contradict to the condition $a > 0$ .) In this case, required quantum circuits should be simpler than those for general polynomial-size Boolean circuits.

iv.7 Nseth

Conjectures of the present paper and poly3-NSETH $(a)$ of Ref. Dalzell are fine-grained versions of ${c o C}_{=} P ⊈ N P$ . It is interesting to ask whether we can use NSETH CGIMPS , which is a fain-grained version of $c o N P ⊈ N P$ , to show fine-grained quantum supremacy. Here, NSETH is defined as follows.

Conjecture 7 (Nseth)

# f \equiv \sum x \in {0, 1}^{n} f (x) .

Then, for any constant $a > 0$ , $T (n) > 2^{(1 - a) n}$ holds for infinitely many $n$ .

At this moment, we do not know whether we can show any fine-grained quantum supremacy result under NSETH. At least, we can show that proofs of our theorems (and those of Ref. Dalzell ) cannot be directly applied to the case of NSETH. To see it, let us consider the following “proof”. (For details, see Sec. V.) Given a Boolean circuit $f : {0, 1}^{n} \to {0, 1}$ , we first construct an $m \equiv n + ξ$ qubit quantum circuit $V$ such that $0 < η < 1$ if $# f = 0$ , and $η = 0$ if $# f > 0$ , where $ξ = p o l y (n)$ and $η \equiv | ⟨ 0^{m} | V | 0^{m} ⟩ |^{2}$ . By using Lemma 3, we next construct the $N \equiv m + 2 = n + ξ + 2$ qubit DQC1 model whose acceptance probability is

p_{a c c} = \frac{4 η (1 - η)}{2^{m}} .

Then, if we assume that $p_{a c c}$ is classically sampled within a multiplicative error $ϵ < 1$ and in $2^{(1 - a) n}$ time, then NSETH is violated.

This “proof” seems to work, but actually we do not know how to construct such $V$ . In fact, the following lemma suggests that we cannot construct such $V$ .

Lemma 2

If such $V$ exists, then $c o N P \subseteq {c o C}_{=} P$ .

However, there is an oracle $A$ such that ${c o N P}^{A} ⊈ {c o C}_{=} P^{A}$ Beigel . A proof of Lemma 2 is given in Sec. V.

We do not know whether our conjectures can be reduced to more standard ones, such as SETH and NSETH. At least, we can show that Conjecture 1 is reduced to UNSETH (Unique NSETH) that is equal to NSETH (Conjecture 7) except that $# f = 1$ is promised for the no case. It means that if UNSETH is true, then Conjecture 1 is also true. In fact, for a given polynomial-size Boolean circuit $f : {0, 1}^{n} \to {0, 1}$ , define the polynomial-size Boolean circuit $g : {0, 1}^{n + 1} \to {0, 1}$ by

g (x, x_{n + 1}) = [x_{n + 1} \land ¯ f (x)] \lor [{¯ x}_{n + 1} \land (\land_{j = 1}^{n} x_{j})]

for any $x \in {0, 1}^{n}$ . Then,

	$g a p (g)$	$=$	$\sum x \in {0, 1}^{n} \sum x_{n + 1} \in {0, 1} (- 1)^{g (x, x_{n + 1})}$
		$=$	$2^{n} - 2 + \sum x \in {0, 1}^{n} (- 1)^{¯ f (x)},$

and therefore if $# f = 0$ then $g a p (g) \neq 0$ and if $# f = 1$ then $g a p (g) = 0$ .

iv.8 Other conjectures

In addition to SETH, NC-SETH, and NSETH, there exists another conjecture, $\oplus$ -SETH, which asserts that for any $a > 0$ there exists a large integer $k$ such that $k$ -CNF- $\oplus$ SAT cannot be computed in time $O (2^{(1 - a) n})$ ParitySETH . Here, $k$ -CNF- $\oplus$ SAT is the problem of computing the number of satisfying assignments of a given $k$ -CNF formula modulo two. It is interesting to study whether we can find any fine-grained quantum supremacy based on $\oplus$ -SETH. It is also open whether we can show any fine-grained quantum supremacy under other conjectures that are not based on SAT, such as 3-SUM 3-SUM and All-Pairs Shortest Paths problem (APSP) APSP .

iv.9 Additive error sampling

In this paper we have considered multiplicative error sampling. It is known that output probability distributions of several sub-universal quantum computing models, such as the Boson Sampling model BS , the IQP model IQP2 , the random gate model random , and the DQC1 model M , cannot be classically sampled in polynomial time within an additive error unless the polynomial-time hierarchy collapses to the third level. (In addition, two additional conjectures, so-called the average-case-hardness conjecture and the anti-concentration conjecture, are required for the Boson Sampling model. For the IQP model, the random gate model, and the DQC1 model, the anti-concentration conjecture is not a conjecture but a proven lemma.) Here, additive error sampling is defined as follows.

Definition 7

We say that a probability distribution ${p_{z}}_{z}$ is classically sampled in time $T$ within an additive error $ϵ$ if there exists a classical probabilistic algorithm that runs in time $T$ such that

\sum z | p_{z} - q_{z} | \leq ϵ,

where $q_{z}$ is the probability that the classical algorithm outputs $z$ .

It is an important open question whether any fine-grained version of those additive-error results is possible or not.

iv.10 Stabilizer rank

We can also show lowerbounds of the stabilizer rank BravyiSmithSmolin , which is defined as follows.

Definition 8 (Stabilizer rank)

The stabilizer rank $χ (| ψ ⟩)$ of an $n$ -qubit pure state $| ψ ⟩$ is the smallest integer $k$ such that $| ψ ⟩$ can be written as

| ψ ⟩ = k \sum j = 1 c_{j} C_{j} | 0^{n} ⟩,

(1)

where each $c_{j}$ is a coefficient and each $C_{j}$ is a Clifford circuit.

Note that the original definition of the stabilizer rank (Definition 8) does not care about computational complexity of ${c_{j}}_{j}$ and ${C_{j}}_{j}$ : the minimum of $k$ is taken over all decompositions of $| ψ ⟩$ in the form of Eq. (1). In this paper, however, we consider only decompositions in the form of Eq. (1) such that there exists a $p o l y (n)$ -time classical deterministic algorithm that, on input $j$ , outputs $c_{j}$ and a classical description of $C_{j}$ . Such an additional restriction is relevant when we study the stabilizer rank in the context of classical simulations of quantum computing.

The stabilizer rank is directly connected to the time complexity of classical simulations of quantum computing. For example, by using the well-known gadget

(I \otimes | 0 ⟩ ⟨ 0 |) (I \otimes H) C Z (I \otimes H) (| ψ ⟩ \otimes | A ⟩) = \frac{1}{\sqrt{2}} T | ψ ⟩,

where

| A ⟩ \equiv \frac{1}{\sqrt{2}} (| 0 ⟩ + e^{i \frac{π}{4}} | 1 ⟩)

is a magic state, we can easily show that for any universal quantum circuit $U$ that uses Clifford gates and $t$ $T$ gates, there exists a Clifford circuit $V$ such that

⟨ 0^{n} | U | 0^{n} ⟩ = \sqrt{2^{t}} ⟨ 0^{n + t} | V (| 0^{n} ⟩ \otimes | A ⟩^{\otimes t}) .

Since

			$⟨ 0^{n + t} \| V (\| 0^{n} ⟩ \otimes \| A ⟩^{\otimes t})$
		$=$	$χ (\| A ⟩^{\otimes t}) \sum j = 1 c_{j} ⟨ 0^{n + t} \| V (I^{\otimes n} \otimes C_{j}) \| 0^{n + t} ⟩,$

and each $⟨ 0^{n + t} | V (I^{\otimes n} \otimes C_{j}) | 0^{n + t} ⟩$ can be computed in $p o l y (n + t) = p o l y (n)$ time, the value $⟨ 0^{n} | U | 0^{n} ⟩$ can be calculated in $χ (| A ⟩^{\otimes t}) p o l y (n)$ time (assuming that there exists a classical $p o l y (n)$ -time algorithm that, on input $j$ , outputs $c_{j}$ and classical description of $C_{j}$ ). In this way, the stabilizer rank is directly connected to the time complexity of classical simulations. We do not know how to calculate the exact value of the stabilizer rank, and therefore finding better upperbounds of the stabilizer rank is essential. Several non-trivial upperbounds are known BravyiSmithSmolin , such as $χ (| A ⟩^{\otimes 6}) \leq 7$ , which means

χ (| A ⟩^{\otimes t}) \leq 2^{t \frac{{log}_{2} 7}{6}} ≃ 2^{0.468 t} .

It is open how much can be we improve this upperbound. If we believe $B Q P \neq B P P$ , it is clear that $χ (| A ⟩^{\otimes t}) \leq p o l y (t)$ is impossible. It was conjectured in Ref. BravyiSmithSmolin that $χ (| A^{\otimes t} ⟩) \geq 2^{Ω (t)}$ . Only known lowerbound is the very weak one BravyiSmithSmolin

χ (| A^{\otimes t} ⟩) \geq Ω (t^{\frac{1}{2}}),

which is not enough to show the conjecture.

Based on Conjecture 4 (ETH), we can show the following.

Theorem 12

Assume that Conjecture 4 is true. Let $| Ψ ⟩$ be a resource of $t$ Toffoli gates. Then, $χ (| Ψ ⟩) \geq 2^{Ω (t)}$ .

Its proof is given in Sec. V. Here, the meaning of the statement “ $| Ψ ⟩$ is a resource of $t$ Toffoli gates” is defined as follows.

Definition 9

Let $g$ be a non-Clifford gate (such as $T$ , $C C Z$ , or $T O F F O L I$ ). We say that an $r$ -qubit state $| Ψ ⟩$ is a resource of $t$ $g$ gates if the following three conditions are all satisfied.

$r = p o l y (t)$ .
For any $n$ -qubit quantum circuit $U$ over Clifford gates and $t$ $g$ gates, there exists an $(n + r)$ -qubit Clifford circuit $V$ such that

$\frac{(I^{\otimes n} \otimes | 0 ⟩ ⟨ 0 |^{\otimes r}) V (| 0^{n} ⟩ \otimes | Ψ ⟩)}{∥ (I^{\otimes n} \otimes | 0 ⟩ ⟨ 0 |^{\otimes r}) V (| 0^{n} ⟩ \otimes | Ψ ⟩) ∥} = U | 0^{n} ⟩ .$
The quantity

$∥ (I^{\otimes n} \otimes | 0 ⟩ ⟨ 0 |^{\otimes r}) V (| 0^{n} ⟩ \otimes | Ψ ⟩) ∥$

is computable in $p o l y (r)$ time.

For example, it is easy to verify that $| A ⟩^{\otimes t}$ is the resource of $t$ $T$ gates.

In particular, if we take

	$\| Ψ ⟩$	$=$	$\| C C Z ⟩^{\otimes t},$
	$\| Ψ ⟩$	$=$	$\| A ⟩^{\otimes 7 t},$

where $| C C Z ⟩$ is the resource of a single $C C Z$ gate, in Theorem 12, we obtain the following corollary.

Corollary 2

	$χ (\| C C Z ⟩^{\otimes t}) \geq 2^{Ω (t)},$
	$χ (\| A ⟩^{\otimes t}) \geq 2^{Ω (t)} .$

V Proofs

In this section, we provide proofs postponed.

v.1 Proof of Lemma 1

A $k$ -CNF $f : {0, 1}^{n} \to {0, 1}$ consists of AND, OR, and NOT, where

$A N D (a, b)$	$=$	$a b,$
$O R (a, b)$	$=$	$1 - (1 - a) (1 - b),$
$N O T (a)$	$=$	$a \oplus 1,$

for any $a, b \in {0, 1}$ . An AND gate can be simulated by a TOFFOLI gate by using a single ancilla bit initialized to 0 (Fig. 1, left). An OR gate can be simulated by a TOFFOLI gate and NOT gates by using a single ancilla bit initialized to 0 (Fig. 1, right).

Figure 1: Left: A simulation of an AND gate with a TOFFOLI gate. Right: A simulation of an OR gate with a TOFFOLI gate and NOT gates.

Let us define the counter operator $Λ_{+}^{r}$ by

Λ_{+}^{r} (| a ⟩ \otimes | b ⟩) = | a ⟩ \otimes | b + a (m o d 2^{r}) ⟩,

where $a \in {0, 1}$ and $b \in {0, 1, 2, . . ., 2^{r} - 1}$ . The counter operator $Λ_{+}^{r}$ can be constructed with $r$ generalized TOFFOLI gates. For example, the construction for $r = 4$ is given in Fig. 2. It is clear from the induction that $Λ_{+}^{r}$ for general $r$ is constructed in a similar way. Each generalized TOFFOLI gate can be decomposed as a linear number of TOFFOLI gates with a single uninitialized ancilla bit that can be reused Barenco , and therefore a single $Λ_{+}^{r}$ requires a single uninitialized ancilla bit.

Figure 2: The counter operator $Λ_{+}^{r}$ with $r = 4$ .

By using the counter operators, let us construct the circuit of Fig 3, which computes the $3$ -CNF,

(x_{1} \lor {¯ x}_{2} \lor x_{3}) \land (x_{2} \lor x_{3} \lor x_{4}) .

For a $k$ -CNF, $f : {0, 1}^{n} \to {0, 1}$ , it is clear from the figure that

$k - 1$ ancilla bits initialized to 0 are necessary to calculate the value of a single clause. However, since these ancilla bits are reset to 0 after evaluating a clause, these ancilla bits are reusable.
To count the number of clauses that is 1, $log (L + 1)$ ancilla bits are necessary, where $L$ is the number of clauses. Note that $log (L + 1) = o (n)$ , because

$log (L + 1)$ $\leq$ $log (L) + 1$

$\leq$ $log \frac{2 n (2 n - 1) . . . (2 n - k + 1)}{k!} + 1$

$\leq$ $k + k log n - k log k + 1.$
Each counter operator needs a single uninitialized ancilla bit. Since it is reusable, only a single ancilla bit is enough throughout the computation. This ancilla bit can also be used for the final $log (L + 1)$ -bit TOFFOLI.
Finally, a single ancilla bit that encodes $f (x)$ is necessary.

Hence, in total, the number $ξ$ of ancilla bits required is

ξ = k - 1 + log (L + 1) + 1 + 1 = o (n) .

Figure 3: A circuit that evaluates $(x_{1} \lor {¯ x}_{2} \lor x_{3}) \land (x_{2} \lor x_{3} \lor x_{4})$ . Each circuit in a red dotted box is the reversible OR gate.

v.2 Proof of Theorem 1

Let $f : {0, 1}^{n} \to {0, 1}$ be (a description of) a polynomial-size Boolean circuit. Let $ξ$ be the number of AND and OR gates in $f$ . Since $f$ is polynomial-size, $ξ = p o l y (n)$ . Then by simulating each AND and OR in $f$ with TOFFOLI and NOT, we can construct the $(n + ξ)$ -qubit unitary operator $U$ that uses only $X$ and TOFFOLI such that

U (| x ⟩ \otimes | 0^{ξ} ⟩) = | j u n k (x) ⟩ \otimes | f (x) ⟩

for any $x \in {0, 1}^{n}$ , where $j u n k (x) \in {0, 1}^{n + ξ - 1}$ is a certain bit string whose detail is irrelevant here. Define the $(n + ξ)$ -qubit unitary operator $V$ by

V \equiv (H^{\otimes n + ξ}) (I^{\otimes n + ξ - 1} \otimes Z) U (H^{\otimes n} \otimes I^{\otimes ξ}) .

Then, it is clear that

η \equiv | ⟨ 0^{n + ξ} | V | 0^{n + ξ} ⟩ |^{2} = \frac{g a p (f)^{2}}{2^{2 n + ξ}} .

If $g a p (f) \neq 0$ then $0 < η < 1$ . If $g a p (f) = 0$ then $η = 0$ . From Lemma 3 given below, by taking $m = n + ξ$ , we can construct the $N^{'} \equiv n + ξ + 1$ qubit DQC1 model such that its acceptance probability is

p_{a c c} = \frac{4 η (1 - η)}{2^{n + ξ}} .

If $g a p (f) \neq 0$ then $p_{a c c} > 0$ . If $g a p (f) = 0$ then $p_{a c c} = 0$ . An $m$ -qubit TOFFOLI can be decomposed into a linear number of TOFFOLI gates with a single ancilla qubit Barenco . In the construction, the ancilla qubit is not necessarily initialized, and therefore the completely-mixed state $I / 2$ can be used. Hence the $N^{'}$ -qubit DQC1 model can be simulated by the $N \equiv N^{'} + 1 = n + ξ + 2$ qubit DQC1 model.

Assume that there exists a classical probabilistic algorithm that samples $p_{a c c}$ within a multiplicative error $ϵ < 1$ and in time $2^{(1 - a) n}$ . It means that

| p_{a c c} - q_{a c c} | \leq ϵ p_{a c c},

where $q_{a c c}$ is the acceptance probability of the classical algorithm. If $g a p (f) \neq 0$ then

q_{a c c} \geq (1 - ϵ) p_{a c c} > 0,

and if $g a p (f) = 0$ then

q_{a c c} \leq (1 + ϵ) p_{a c c} = 0.

It means that there exists a non-deterministic algorithm running in time $2^{(1 - a) n}$ such that if $g a p (f) \neq 0$ then accepts and if $g a p (f) = 0$ then rejects. However, it contradicts to Conjecture 1.

Lemma 3

Kobayashi Let $V$ be a quantum circuit acting on $m$ qubits. From $V$ , let us construct the $(m + 1)$ -qubit DQC1 circuit of Fig. 4. Then, the acceptance probability $p_{a c c}$ of the DQC1 model (i.e., the probability of obtaining 0 in the computational-basis measurement), is

p_{a c c} = \frac{4 η (1 - η)}{2^{m}},

where $η \equiv | ⟨ 0^{m} | V | 0^{m} ⟩ |^{2}$ .

A proof of Lemma 3 is obtained by a straightforward calculation Kobayashi .

Figure 4: The $(m + 1)$ -qubit DQC1 model constructed from an $m$ -qubit unitary $V$ . The line with the slash $/$ means the set of $m$ qubits. A gate acting on this line is applied on each qubit. The first qubit is measured in the computational basis. If the measurement result is 0, as is indicated in the figure, we accept. Otherwise, reject.

v.3 Proof of Theorem 2

For given (a description of) a Boolean circuit $f : {0, 1}^{n} \to {0, 1}$ , we again construct the $(n + ξ)$ -qubit unitary operator $U$ such that

U (| x ⟩ \otimes | 0^{ξ} ⟩) = | j u n k (x) ⟩ \otimes | f (x) ⟩

for any $x \in {0, 1}^{n}$ , where $ξ = p o l y (n)$ and $j u n k (x) \in {0, 1}^{n + ξ - 1}$ is a bit string. Note that $U$ uses only $X$ and TOFFOLI. Consider the $N^{'} \equiv n + ξ + 1$ qubit HC1Q circuit in Fig. 5. By a straightforward calculation, the probability of obtaining the result $0^{n} 0^{ξ - 1} 11$ , which we define as the acceptance probability $p_{a c c}$ , is

p_{a c c} = \frac{g a p (f)^{2}}{2^{2 n + 2 ξ}} .

Then, if $g a p (f) \neq 0$ , $p_{a c c} > 0$ . If $g a p (f) = 0$ , $p_{a c c} = 0$ . The $ξ$ -qubit TOFFOLI used in the circuit of Fig. 5 can be decomposed into a linear number of TOFFOLI gates with a single uninitialized ancilla qubit, which can be $| + ⟩$ state Barenco . Therefore, the $N^{'}$ -qubit HC1Q model is simulated by the $N \equiv N^{'} + 1 = n + ξ + 2$ qubit HC1Q model.

Assume that there exists a classical probabilistic algorithm that samples $p_{a c c}$ in time $2^{(1 - a) n}$ and within a multiplicative error $ϵ < 1$ :

| p_{a c c} - q_{a c c} | \leq ϵ p_{a c c},

where $q_{a c c}$ is the acceptance probability of the classical algorithm. Then, if $g a p (f) \neq 0$ ,

q_{a c c} \geq (1 - ϵ) p_{a c c} > 0,

and if $g a p (f) = 0$ ,

q_{a c c} \leq (1 + ϵ) p_{a c c} = 0.

It means that deciding $g a p (f) \neq 0$ or $g a p (f) = 0$ can be done in non-deterministic $2^{(1 - a) n}$ time, which contradicts to Conjecture 1.

Figure 5: The $(n + ξ + 1)$ -qubit HC1Q circuit used for the proof. The first line with the slash $/$ means the set of $n$ qubits. The second line with the slash $/$ means the set of $ξ - 1$ qubits. A gate acting on these lines is applied on each qubit. All qubits are measured in the computational basis. If the measurement result is $0^{n} 0^{ξ - 1} 11$ , as is indicated in the figure, we accept. Otherwise, reject.

v.4 Proof of Theorem 3

It is known that Cosentino any logarithmic depth Boolean circuit $f : {0, 1}^{n} \to {0, 1}$ (that consists of AND, OR, and NOT) can be implemented with a polynomial-size quantum circuit $U$ acting on $n + 1$ qubits such that

U (| x ⟩ \otimes | b ⟩) = e^{i g (x)} | x ⟩ \otimes | f (x) \oplus b ⟩

for all $x \in {0, 1}^{n}$ and $b \in {0, 1}$ , where $g$ is a certain function. Let us define the $(n + 1)$ -qubit unitary $V$ by

V \equiv (H^{\otimes n} \otimes I) U^{†} (I^{\otimes n} \otimes Z) U H^{\otimes n + 1} .

Then,

η \equiv | ⟨ 0^{n + 1} | V | 0^{n + 1} ⟩ |^{2} = \frac{g a p (f)^{2}}{2^{2 n + 1}} .

From now on the same proof holds as the proof of Theorem 1 with $ξ = 1$ . Therefore, we can construct the $N$ -qubit DQC1 model with $N = n + 3$ such that its acceptance probability $p_{a c c}$ satisfies $p_{a c c} > 0$ when $g a p (f) \neq 0$ , and $p_{a c c} = 0$ when $g a p (f) = 0$ . If $p_{a c c}$ is classically sampled within a multiplicative error $ϵ < 1$ in $2^{(1 - a) (N - 3)} = 2^{(1 - a) n}$ -time, Conjecture 2 is violated.

v.5 Proof of Theorem 4

For a given polynomial-size classical reversible circuit $C : {0, 1}^{n + ξ} \to {0, 1}^{n + ξ}$ that consists of only NOT and TOFFOLI, its quantum version, $U$ , works as

U (| x ⟩ \otimes | 0^{ξ} ⟩) = | j u n k (x) ⟩ \otimes | C_{n + ξ} (x 0^{ξ}) ⟩

for any $x \in {0, 1}^{n}$ , where $j u n k (x) \in {0, 1}^{n + ξ - 1}$ is a bit string (it is actually the first $n + ξ - 1$ bits of $C (x 0^{ξ})$ .) Therefore, the same proof as that of Theorem 1 holds by considering $C_{n + ξ} (x 0^{ξ})$ as $f (x)$ . Hence we can construct the $N$ -qubit DQC1 model with $N = n + ξ + 2$ whose acceptance probability cannot be classically sampled within a multiplicative error $ϵ < 1$ in $2^{(1}$

$log (L + 1)$	$\leq$	$log (L) + 1$
	$\leq$	$log \frac{2 n (2 n - 1) . . . (2 n - k + 1)}{k!} + 1$
	$\leq$	$k + k log n - k log k + 1.$