# Fine-grained quantum supremacy of the one-clean-qubit model

The one-clean-qubit model (or the DQC1 model) is a restricted model of quantum computing where all but a single input qubits are maximally mixed. It is known that output probability distributions of the DQC1 model cannot be classically sampled in polynomial-time unless the polynomial-time hierarchy collapses. In this paper, we show that even superpolynomial-time and exponential-time classical samplings are impossible under certain fine-grained complexity conjectures. We also show similar fine-grained quantum supremacy results for the Hadamard-classical circuit with one-qubit (HC1Q) model, which is another sub-universal model with a classical circuit sandwiched by two Hadamard layers.

## Authors

• 14 publications
• 5 publications
01/07/2019

### Fine-grained quantum computational supremacy

It is known that several sub-universal quantum computing models cannot b...
02/22/2019

### Depth-scaling fine-grained quantum supremacy based on SETH and qubit-scaling fine-grained quantum supremacy based on Orthogonal Vectors and 3-SUM

We first show that under SETH and its variant, strong and weak classical...
06/22/2020

### Efficiently generating ground states is hard for postselected quantum computation

Although quantum computing is expected to outperform universal classical...
05/18/2021

### Fine-Grained View on Bribery for Group Identification

Given a set of agents qualifying or disqualifying each other, group iden...
10/02/2019

### Practical Period Finding on IBM Q – Quantum Speedups in the Presence of Errors

We implemented Simon's quantum period finding circuit for functions F_2^...
05/31/2015

### Manufacturing Pathway and Experimental Demonstration for Nanoscale Fine-Grained 3-D Integrated Circuit Fabric

At sub-20nm technologies CMOS scaling faces severe challenges primarily ...
11/28/2017

### Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

It is a long-standing open problem whether quantum computing can be veri...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## I Introduction

Quantum computing is believed to outperform classical computing. In fact, quantum advantages have been shown in terms of, for example, the communication complexity comm1 ; comm2 . Regarding the time complexity, however, the ultimate goal, , seems to be extremely hard to show because of the barrier complexity_zoo .

Mainly three types of approaches exist to demonstrate quantum speedups over classical computing. First approach is to construct quantum algorithms that are faster than known best classical algorithms. For example, quantum computing can do factoring Shor and simulations of quantum many-body dynamics Iulia , etc. faster than known best classical algorithms. (Classical best algorithms can be, however, updated Tang .) Second approach is to study the query complexity. Quantum computing has been shown to require fewer oracle queries than classical computing Simon ; Grover .

Third one, which has been actively studied recently, is to reduce classical simulatabilities of quantum computing (in terms of sampling) to certain unlikely collapses of conjectures in classical computational complexity theory, such as the infiniteness of the polynomial-time hierarchy. Several sub-universal quantum computing models have been proposed, such as the depth-four circuits TD , the Boson Sampling model BS , the IQP model IQP1 ; IQP2 , the one-clean qubit model (or the DQC1 model) KL ; MFF ; M ; Kobayashi ; KobayashiICALP , the random gate model random , and the HC1Q model HC1Q . (Definitions of the IQP model, DQC1 model, and HC1Q model are given later.) It has been shown that if output probability distributions of these models are classically sampled in polynomial-time, then the polynomial-time hierarchy collapses. The polynomial-time hierarchy is not believed to collapse in computer science, and therefore if we conjecture the infiniteness of the polynomial-time hierarchy, the reductions suggest quantum computational supremacy of those sub-universal models.

In this paper, we first focus on the DQC1 model, which is defined as follows.

###### Definition 1

The -qubit DQC1 model with a unitary is the following quantum computing model.

• The initial state is

 |0⟩⟨0|⊗I⊗N−12N−1,

where is the two-dimensional identity operator.

• The unitary operator is applied on the initial state to generate the state

 U(|0⟩⟨0|⊗I⊗N−12N−1)U†.
• The first qubit is measured in the computational basis. If the output is 0 (1), then accept (reject).

Note that throughout this paper we consider only -size without explicitly mentioning it. The DQC1 model was originally introduced by Knill and Laflamme to model the NMR quantum computing KL , and since then many results have been obtained on the model KL ; Poulin1 ; Poulin2 ; ShorJordan ; Passante ; JordanWocjan ; JordanAlagic ; MFF ; M ; Kobayashi ; nonclean ; KobayashiICALP

. For example, the DQC1 model can solve several problems whose classical efficient solutions are not known, such as the spectral density estimation

KL , testing integrability Poulin1 , calculations of the fidelity decay Poulin2 , and approximations of Jones and HOMFLY polynomials ShorJordan ; Passante ; JordanWocjan . The acceptance probability of the -qubit DQC1 model with a unitary is

 pacc≡Tr[(|0⟩⟨0|⊗I⊗N−1)U(|0⟩⟨0|⊗I⊗N−12N−1)U†].

It is known that if is classically sampled in polynomial-time within a multiplicative error , then the polynomial-time hierarchy collapses to the second level Kobayashi ; KobayashiICALP .

###### Definition 2

We say that is classically sampled in time within a multiplicative error if there exists a classical probabilistic algorithm that runs in time such that

 |pacc−qacc|≤ϵpacc,

where is the acceptance probability of the classical algorithm.

In this way, previous quantum supremacy results prohibit classical polynomial-time sampling of the DQC1 model based on the infiniteness of the polynomial-time hierarchy. A shortcoming is, however, that a possibility of exponential-time or even superpolynomial-time classical sampling is not excluded: the acceptance probability of the -qubit DQC1 model could be classically sampled in, say, time.

In this paper, we show fine-grained quantum supremacy of the DQC1 model. We assume certain complexity conjectures, and show that the acceptance probability of the DQC1 model cannot be classically sampled within a multiplicative error in certain exponential or superpolynomial time (depending on conjectures). More precisely, in Sec. II, we introduce three conjectures, Conjecture 1, Conjecture 2, and Conjecture 3. Conjecture 1 seems to be more stable than Conjecture 2, and Conjecture 2 seems to be more stable than Conjecture 3. Conjecture 1 prohibits classical sampling of the -qubit DQC1 model in sub-exponential time of (Theorem 1), while other two conjectures prohibit classical sampling of the -qubit DQC1 model in time for any (Theorem 3 and Theorem 4).

We also show similar fine-grained quantum supremacy results for another sub-universal quantum computing model, namely, the Hadamard-classical circuit with one-qubit (HC1Q) model, which is defined as follows.

###### Definition 3

The -qubit HC1Q model with a classical reversible circuit is the following quantum computing model.

• The initial state is , where means .

• The operation

 (H⊗N−1⊗I)C(H⊗N−1⊗I)

is applied on the initial state. Here,

 H≡1√2(|0⟩+|1⟩)⟨0|+1√2(|0⟩−|1⟩)⟨1|

is the Hadamard gate, and the classical circuit is applied “coherently”.

• Some qubits are measured in the computational basis.

Note that throughout this paper we consider only -size without explicitly mentioning it. The HC1Q model is in the second level of the Fourier hierarchy FH2 where several useful circuits, such as those for Shor’s factoring algorithm Shor and Simon’s algorithm Simon , are placed. Furthermore, it was shown in Ref. HC1Q that output probability distributions of the HC1Q model cannot be classically sampled in polynomial-time within a multiplicative error unless the polynomial-time hierarchy collapses to the second level. We show that under the fine-grained complexity conjectures, the output probability distributions of the HC1Q model cannot be classically sampled within a multiplicative error in certain exponential or superpolynomial time (depending on conjectures). As in the case of the DQC1 model, Conjecture 1 prohibits classical sampling of the -qubit HC1Q model in sub-exponential time of (Theorem 2), while Conjecture 3 prohibits classical sampling of the -qubit HC1Q model in time for any (Theorem 5).

There are some previous results AaronsonChen ; Huang ; Dalzell that showed quantum computational supremacy based on other conjectures than the infiniteness of the polynomial-time hierarchy. In particular, Ref. Dalzell showed fine-grained quantum supremacy of the IQP model, QAOA model, and Boson Sampling model. For details, see Sec. IV.

Finally, in this paper, we also study universal quantum computing with Clifford and gates, where

 T≡|0⟩⟨0|+eiπ/4|1⟩⟨1|,

and Clifford gates are ,

 S ≡ |0⟩⟨0|+i|1⟩⟨1|, CZ ≡ I⊗2−2|11⟩⟨11|.

For an -qubit quantum circuit that consists of only Clifford and gates, we define the acceptance probability by

 pacc≡|⟨0N|V|0N⟩|2.

Due to the Gottesman-Knill theorem GK , can be exactly calculated in time if contains at most number of gates. The brute-force classical calculation of needs time that scales in an exponential of , where is the number of gates.

In Sec. II, we introduce two conjectures, Conjecture 4 and Conjecture 5. Conjecture 4 is equivalent to so-called the exponential-time hypothesis (ETH) IPZ01 . Under Conjecture 4, we show that cannot be classically calculated in time within an additive error smaller than (Theorem 6). Conjecture 5 is a -version of Conjecture 4, and it allows us to show that cannot be classically sampled in time within a multiplicative error (Theorem 7). There is a classical algorithm that computes within a constant multiplicative error and in time with a non-trivial factor  BravyiGosset . Our second result (Theorem 7) therefore suggests that improving to some sub-exponential time, say , is impossible. Note that Ref. DalzellPhD showed that must be under the conjecture, .

Theorem 6 considers the hardness of calculating output probability distributions (i.e., the strong simulation) in terms of -scaling, while Ref. Huang considered that in terms of -scaling. It was shown in Ref. Huang that if SETH is true then calculating output probability amplitudes of a certain -qubit quantum computation within the additive error needs -time. Note that the strong simulation, i.e., calculating output probability distributions of quantum computing within an exponentially small additive error, is P-hard, which means that hard even for quantum computing. However, it is still useful to study strong simulations of quantum computing because several quantum computing models, such as Clifford circuits and match-gate circuits match , are known to be strongly simulatable.

## Ii Conjectures

In this section, we introduce conjectures. First let us consider the following three conjectures.

###### Conjecture 1

Let be any non-deterministic -time algorithm such that the following holds: given (a description of) a polynomial-size Boolean circuit , accepts if and rejects if , where

 gap(f)≡∑x∈{0,1}n(−1)f(x).

Then, for any constant , holds for infinitely many .

###### Conjecture 2

It is the same as Conjecture 1 except that the Boolean circuit is of logarithmic depth.

###### Conjecture 3

Let be any non-deterministic -time algorithm such that the following holds: given (a description of) a polynomial-size classical reversible circuit that consists of only NOT and TOFFOLI, accepts if and rejects if , where

 gap(C)≡∑x∈{0,1}n(−1)Cn+ξ(x0ξ),

and is the last bit of . Then, for any constant , holds for infinitely many .

These conjectures are considered as strong (fine-grained) versions of the conjecture, , which is believed because leads to the collapse of the polynomial-time hierarchy to the second level Kobayashi ; KobayashiICALP . Here, is defined as follows.

###### Definition 4

A language is in

if and only if there exists a non-deterministic polynomial-time Turing machine such that if

then the number of accepting paths is not equal to that of rejecting paths, and if then they are equal.

These conjectures should be justified by the following arguments. First of all, it is true that direct connections between our conjectures and SETH IP01 ; IPZ01 (or NSETH CGIMPS ) are not clear, because acceptance criteria are different. (Our conjectures are based on gap functions, while SETH and NSETH are on

P functions.) However, at this moment, the only known way of deciding

or is to solve SAT problems. Even if is restricted to -CNF, the current fastest algorithm CW to solve SAT satisfies as , and therefore it is true for more general circuits such as NC circuits or general polynomial-size Boolean circuits. As is shown in Lemma 1 below, Conjecture 3 can be based on SETH (-CNF). Conjecture 2, which can be based on NC-SETH AHVWW16 , can be considered as more stable than Conjecture 3, since NC circuits are more general than -CNF. Furthermore, Conjecture 1 can be considered as more stable than Conjecture 2, because general polynomial-size Boolean circuits are more general than NC circuits.

As is shown in Sec. III, Conjecture 1 prohibits only sub-exponential-time classical sampling for the DQC1 model (Theorem 1) and the HC1Q model (Theorem 2). Conjecture 2, on the other hand, prohibits exponential-time sampling for the DQC1 model (Theorem 3). Conjecture 3 with also prohibits exponential-time sampling both for the DQC1 model (Theorem 4) and the HC1Q model (Theorem 5).

###### Lemma 1

For any -CNF with , there exists a classical reversible circuit that uses only TOFFOLI and NOT such that , and for any .

Its proof is given in Sec. V.

In order to study Clifford- quantum computing, we also introduce the following two conjectures.

###### Conjecture 4

Any (classical) deterministic algorithm that decides whether or for given (a description of) a 3-CNF with clauses, , needs time. Here,

 #f≡∑x∈{0,1}nf(x)
###### Conjecture 5

Any non-deterministic algorithm that decides whether or for given (a description of) a 3-CNF with clauses, , needs time. Here

 gap(f)≡∑x∈{0,1}n(−1)f(x).

Conjecture 4 is equivalent to so-called the exponential-time hypothesis (ETH) IPZ01 . Conjecture 5 is a -version of Conjecture 4. As we have said, the only known way of deciding or is to solve the SAT problems, and therefore Conjecture 5 could be justified by ETH.

As is shown in Sec. III, Conjecture 4 shows that calculating of Clifford- quantum computing needs -time, where is the number of gates (Theorem 6). Conjecture 5 shows that classical sampling of needs -time (Theorem 7).

## Iii Results

Based on conjectures introduced in the previous section, we now show fine-grained quantum supremacy results. Proofs of the following theorems are given in Sec. V.

First, with Conjecture 1, we can show the following two results.

###### Theorem 1

Assume that Conjecture 1 is true. Then for any constant and for infinitely many , there exists an -qubit DQC1 model, where , whose acceptance probability cannot be classically sampled in time within a multiplicative error .

###### Theorem 2

Assume that Conjecture 1 is true. Then for any constant and for infinitely many , there exists an -qubit HC1Q model, where , whose acceptance probability cannot be classically sampled in time within a multiplicative error .

Note that although we know , we do not know the degree of the polynomial. For example, might be , and in this case, theorems say that the -qubit DQC1 model and the -qubit HC1Q model cannot be classically sampled in -time, which is superpolynomial (sub-exponential) but not exponential.

Second, with Conjecture 2, we can show the following result.

###### Theorem 3

Assume that Conjecture 2 is true. Then for any constant and for infinitely many , there exists an -qubit DQC1 model whose acceptance probability cannot be classically sampled in time within a multiplicative error .

Finally, with Conjecture 3, we can show the following two results.

###### Theorem 4

Assume that Conjecture 3 is true for . Then for any constant and for infinitely many , there exists an -qubit DQC1 model whose acceptance probability cannot be classically sampled in time within a multiplicative error .

###### Theorem 5

Assume that Conjecture 3 is true for . Then for any constant and for infinitely many , there exists an -qubit HC1Q model whose acceptance probability cannot be classically sampled in time within a multiplicative error .

The above three theorems, Theorem 3, Theorem 4, and Theorem 5, prohibit exponential-time sampling of the DQC1 model and the HC1Q model.

For Clifford- quantum computing, we can show the following two results.

###### Theorem 6

Assume that Conjecture 4 is true. Then for infinitely many there exists Clifford- quantum circuit with gates whose acceptance probability cannot be calculated in time within an additive error smaller than .

###### Theorem 7

Assume that Conjecture 5 is true. Then for infinitely many there exists a Clifford- quantum circuit with gates whose acceptance probability cannot be classically sampled in time within a multiplicative error .

## Iv Discussion

In this paper, we have shown fine-grained quantum supremacy of the DQC1 model and the HC1Q model based on other complexity conjectures than the infiniteness of the polynomial-time hierarchy. We have also studied -complexity of Clifford+ quantum computing.

Note that the acceptance probability of any -qubit HC1Q model can be calculated in time. Theorem 5 is therefore optimal. In fact, by a straightforward calculation,

 ⟨z|(H⊗N−1⊗I)C(H⊗N−1⊗I)|0N⟩ = 12N−1∑x∈{0,1}N−1(−1)∑N−1j=1zjCj(x0)δzN,CN(x0)

for any reversible circuit and , where is the th bit of . If is size, each term of the exponential sum can be computed in time, and to sum all of them needs time. The total time is therefore

 poly(N)×2N−1=2N+log(poly(N))−1.

When we consider quantum computing over Clifford and gates, we are interested in the number of gates, because gates are “quantum resources”. In a similar way, when we consider quantum computing over classical gates and , we are interested in the number of gates. Since the number of in the -qubit HC1Q model is , Theorem 5 leads to the following corollary.

###### Corollary 1

Assume that Conjecture 3 is true for . Then for any constant and for infinitely many , there exists a quantum circuit with classical gates and gates whose output probability distributions cannot be classically sampled in time within a multiplicative error .

Actually, we can show a similar result based on Conjecture 1:

###### Theorem 8

Assume that Conjecture 1 is true. Then for any constant and for infinitely many , there exists a quantum circuit with classical gates and gates whose output probability distributions cannot be classically sampled in time within a multiplicative error .

Its proof is given in Sec. V.

Ref. Dalzell showed a fine-grained result on the hardness of classically sampling output probability distributions of the IQP model within a multiplicative error. Here, the IQP model is defined as follows IQP1 .

###### Definition 5

The -qubit IQP model with a unitary is the following quantum computing model, where consists of only -diagonal gates (such as , , , and , etc.).

• The initial state is .

• The operation is applied on the initial state.

• All qubits are measured in the computational basis.

To show the fine-grained quantum supremacy of the IQP model, they used the conjecture, so-called poly3-NSETH, which is the same as Conjecture 1 except that is restricted to be polynomials over the field with degree at most 3. An advantage of restricting to be polynomials is that IQP circuits can calculate polynomials over without introducing any ancilla qubit. (For the QAOA model, ancilla qubits are necessary Dalzell .) Because of this advantage, exponential-time classical sampling is prohibited for the IQP model. However, a disadvantage of poly3-NSETH is that it is violated when  Tamaki . It was argued in Ref. Dalzell that improving the algorithm of Ref. Tamaki will not rule out poly3-NSETH with , and therefore they conjecture poly3-NSETH for . Since general Boolean circuits cannot be efficiently represented by systems of equations of polynomials, the technique of Ref. Tamaki cannot be used for general Boolean circuits of Conjecture 1.

Ref. Dalzell also studied fine-grained quantum supremacy of the Boson Sampling model. They introduced the conjecture, so-called per-int-NSETH, which states that deciding whether the permanent of a given integer matrix is nonzero needs non-deterministic time. In this case, no value of is ruled out by known algorithms Dalzell . It is not clear how per-int-NSETH and our conjectures are related with each other. At least we can show by using Ryser’s formula and Chinese remainder theorem that if of -variable Boolean circuits are calculated in time , then permanents of integer matrices are calculated in time.

In Conjecture 1, we have assumed that is any polynomial-size Boolean circuit. It is still reasonable to consider Conjecture 1 with restricting to be -CNF formulas while keeping the condition. (In fact, at this moment, the only known way of deciding whether or is to solve problems. The current fastest algorithm CW to solve of -CNF does not contradict to the condition .) In this case, required quantum circuits should be simpler than those for general polynomial-size Boolean circuits.

Conjectures of the present paper and poly3-NSETH of Ref. Dalzell are fine-grained versions of . It is interesting to ask whether we can use NSETH CGIMPS , which is a fain-grained version of , to show fine-grained quantum supremacy. Here, NSETH is defined as follows.

###### Conjecture 6

Let be any non-deterministic -time algorithm such that the following holds: given (a description of) a polynomial-size Boolean circuit , accepts if and rejects if , where

 #f≡∑x∈{0,1}nf(x).

Then, for any constant , holds for infinitely many .

At this moment, we do not know whether we can show any fine-grained quantum supremacy result under NSETH. At least, we can show that proofs of our theorems (and those of Ref. Dalzell ) cannot be directly applied to the case of NSETH. To see it, let us consider the following “proof”. (For details, see Sec. V.) Given a Boolean circuit , we first construct an qubit quantum circuit such that if , and if , where and . By using Lemma 3, we next construct the qubit DQC1 model whose acceptance probability is

 pacc=4η(1−η)2m.

Then, if we assume that is classically sampled within a multiplicative error and in time, then NSETH is violated.

This “proof” seems to work, but actually we do not know how to construct such . In fact, the following lemma suggests that we cannot construct such .

###### Lemma 2

If such exists, then .

However, there is an oracle such that  Beigel . A proof of Lemma 2 is given in Sec. V.

We do not know whether our conjectures can be reduced to more standard ones, such as SETH and NSETH. At least, we can show that Conjecture 1 is reduced to UNSETH (Unique NSETH) that is equal to NSETH (Conjecture 6) except that is promised for the no case. It means that if UNSETH is true, then Conjecture 1 is also true. In fact, for a given polynomial-size Boolean circuit , define the polynomial-size Boolean circuit by

 g(x,xn+1)=[xn+1∧¯f(x)]∨[¯xn+1∧(∧nj=1xj)]

for any . Then,

 gap(g) = ∑x∈{0,1}n∑xn+1∈{0,1}(−1)g(x,xn+1) = 2n−2+∑x∈{0,1}n(−1)¯f(x),

and therefore if then and if then .

In addition to SETH, NC-SETH, and NSETH, there exists another conjecture, -SETH, which asserts that for any there exists a large integer such that -CNF-SAT cannot be computed in time  ParitySETH . Here, -CNF-SAT is the problem of computing the number of satisfying assignments of a given -CNF formula modulo two. It is interesting to study whether we can find any fine-grained quantum supremacy based on -SETH.

In this paper we have considered multiplicative error sampling. It is known that output probability distributions of several sub-universal quantum computing models, such as the Boson Sampling model BS , the IQP model IQP2 , the random gate model random , and the DQC1 model M , cannot be classically sampled in polynomial time within an additive error unless the polynomial-time hierarchy collapses to the third level. (In addition, two additional conjectures, so-called the average-case-hardness conjecture and the anti-concentration conjecture, are required for the Boson Sampling model. For the IQP model, the random gate model, and the DQC1 model, the anti-concentration conjecture is not a conjecture but a proven lemma.) Here, additive error sampling is defined as follows.

###### Definition 6

We say that a probability distribution is classically sampled in time within an additive error if there exists a classical probabilistic algorithm that runs in time such that

 ∑z|pz−qz|≤ϵ,

where is the probability that the classical algorithm outputs .

It is an important open question whether any fine-grained version of those additive-error results is possible or not.

## V Proofs

In this section, we provide proofs postponed.

### v.1 Proof of Lemma 1

A -CNF consists of AND, OR, and NOT, where

 AND(a,b) = ab, OR(a,b) = 1−(1−a)(1−b), NOT(a) = a⊕1,

for any . An AND gate can be simulated by a TOFFOLI gate by using a single ancilla bit initialized to 0 (Fig. 1, left). An OR gate can be simulated by a TOFFOLI gate and NOT gates by using a single ancilla bit initialized to 0 (Fig. 1, right).

Let us define the counter operator by

 Λr+(|a⟩⊗|b⟩)=|a⟩⊗|b+a (mod 2r)⟩,

where and . The counter operator can be constructed with generalized TOFFOLI gates. For example, the construction for is given in Fig. 2. It is clear from the induction that for general is constructed in a similar way. Each generalized TOFFOLI gate can be decomposed as a linear number of TOFFOLI gates with a single uninitialized ancilla bit that can be reused Barenco , and therefore a single requires a single uninitialized ancilla bit.

By using the counter operators, let us construct the circuit of Fig 3, which computes the -CNF,

 (x1∨¯x2∨x3)∧(x2∨x3∨x4).

For a -CNF, , it is clear from the figure that

• ancilla bits initialized to 0 are necessary to calculate the value of a single clause. However, since these ancilla bits are reset to 0 after evaluating a clause, these ancilla bits are reusable.

• To count the number of clauses that is 1, ancilla bits are necessary, where is the number of clauses. Note that , because

 log(L+1) ≤ log(L)+1 ≤ log2n(2n−1)...(2n−k+1)k!+1 ≤ k+klogn−klogk+1.
• Each counter operator needs a single uninitialized ancilla bit. Since it is reusable, only a single ancilla bit is enough throughout the computation. This ancilla bit can also be used for the final -bit TOFFOLI.

• Finally, a single ancilla bit that encodes is necessary.

Hence, in total, the number of ancilla bits required is

 ξ=k−1+log(L+1)+1+1=o(n).

### v.2 Proof of Theorem 1

Let be (a description of) a polynomial-size Boolean circuit. Let be the number of AND and OR gates in . Since is polynomial-size, . Then by simulating each AND and OR in with TOFFOLI and NOT, we can construct the -qubit unitary operator that uses only and TOFFOLI such that

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|f(x)⟩

for any , where is a certain bit string whose detail is irrelevant here. Define the -qubit unitary operator by

 V≡(H⊗n+ξ)(I⊗n+ξ−1⊗Z)U(H⊗n⊗I⊗ξ).

Then, it is clear that

 η≡|⟨0n+ξ|V|0n+ξ⟩|2=gap(f)222n+ξ.

If then . If then . From Lemma 3 given below, by taking , we can construct the qubit DQC1 model such that its acceptance probability is

 pacc=4η(1−η)2n+ξ.

If then . If then . An -qubit TOFFOLI can be decomposed into a linear number of TOFFOLI gates with a single ancilla qubit Barenco . In the construction, the ancilla qubit is not necessarily initialized, and therefore the completely-mixed state can be used. Hence the -qubit DQC1 model can be simulated by the qubit DQC1 model.

Assume that there exists a classical probabilistic algorithm that samples within a multiplicative error and in time . It means that

 |pacc−qacc|≤ϵpacc,

where is the acceptance probability of the classical algorithm. If then

 qacc≥(1−ϵ)pacc>0,

and if then

 qacc≤(1+ϵ)pacc=0.

It means that there exists a non-deterministic algorithm running in time such that if then accepts and if then rejects. However, it contradicts to Conjecture 1.

###### Lemma 3

Kobayashi Let be a quantum circuit acting on qubits. From , let us construct the -qubit DQC1 circuit of Fig. 4. Then, the acceptance probability of the DQC1 model (i.e., the probability of obtaining 0 in the computational-basis measurement), is

 pacc=4η(1−η)2m,

where .

A proof of Lemma 3 is obtained by a straightforward calculation Kobayashi .

### v.3 Proof of Theorem 2

For given (a description of) a Boolean circuit , we again construct the -qubit unitary operator such that

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|f(x)⟩

for any , where and is a bit string. Note that uses only and TOFFOLI. Consider the qubit HC1Q circuit in Fig. 5. By a straightforward calculation, the probability of obtaining the result , which we define as the acceptance probability , is

 pacc=gap(f)222n+2ξ.

Then, if , . If , . The -qubit TOFFOLI used in the circuit of Fig. 5 can be decomposed into a linear number of TOFFOLI gates with a single uninitialized ancilla qubit, which can be state Barenco . Therefore, the -qubit HC1Q model is simulated by the qubit HC1Q model.

Assume that there exists a classical probabilistic algorithm that samples in time and within a multiplicative error :

 |pacc−qacc|≤ϵpacc,

where is the acceptance probability of the classical algorithm. Then, if ,

 qacc≥(1−ϵ)pacc>0,

and if ,

 qacc≤(1+ϵ)pacc=0.

It means that deciding or can be done in non-deterministic time, which contradicts to Conjecture 1.

### v.4 Proof of Theorem 3

It is known that Cosentino any logarithmic depth Boolean circuit (that consists of AND, OR, and NOT) can be implemented with a polynomial-size quantum circuit acting on qubits such that

 U(|x⟩⊗|b⟩)=eig(x)|x⟩⊗|f(x)⊕b⟩

for all and , where is a certain function. Let us define the -qubit unitary by

 V≡(H⊗n⊗I)U†(I⊗n⊗Z)UH⊗n+1.

Then,

 η≡|⟨0n+1|V|0n+1⟩|2=gap(f)222n+1.

From now on the same proof holds as the proof of Theorem 1 with . Therefore, we can construct the -qubit DQC1 model with such that its acceptance probability satisfies when , and when . If is classically sampled within a multiplicative error in -time, Conjecture 2 is violated.

### v.5 Proof of Theorem 4

For a given polynomial-size classical reversible circuit that consists of only NOT and TOFFOLI, its quantum version, , works as

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|Cn+ξ(x0ξ)⟩

for any , where is a bit string (it is actually the first bits of .) Therefore, the same proof as that of Theorem 1 holds by considering as . Hence we can construct the -qubit DQC1 model with whose acceptance probability cannot be classically sampled within a multiplicative error in -time. Since ,

 2(1−a)(N−ξ−2)=2(1−a)N+o(N).

### v.6 Proof of Theorem 5

It is the same as the proof of Theorem 2 by replacing with .

### v.7 Proof of Theorem 6

For a given 3-CNF with clauses, , let us construct the unitary operator such that

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|f(x)⟩

for any , where is a certain bit string, and consists of only NOT and TOFFOLI. Such is constructed by replacing each AND and OR in with TOFFOLI. The 3-CNF contains OR gates and AND gates. The replacement of a single AND (or OR) gate with TOFFOLI needs a single ancilla qubit initialized to 0, and therefore

 ξ=2m+m−1=3m−1.

Let us define the circuit by

 V≡(H⊗n+ξ−1⊗X)U(H⊗n⊗I⊗ξ).

Then

 pacc≡|⟨0n+ξ|V|0n+ξ⟩|2=(#f)222n+ξ−1.

The circuit has TOFFOLI gates. A single TOFFOLI gate can be represented by Clifford gates and seven gates. Therefore has gates, which means . Assume that is calculated within an additive error smaller than and in time. Then, since

 123t+147≤12×122n+ξ−1

and

 2o(t)=2o(t+721)=2o(m),

it means that or can be decided in time, which contradicts to Conjecture 4.

### v.8 Proof of Theorem 7

For a given 3-CNF with clauses, , let us construct the same unitary operator such that

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|f(x)⟩

for any , where is a certain bit string, consists of only NOT and TOFFOLI, and . Let us define the circuit by

 V≡H⊗n+ξ(I⊗n+ξ−1⊗Z)U(H⊗n⊗I⊗ξ).

Then

 pacc≡|⟨0n+ξ|V|0n+ξ⟩|2=gap(f)222n+ξ.

Since has gates, if can be classically sampled within a multiplicative error in time, it means or is decided in non-deterministic time, which contradicts to Conjecture 5.

### v.9 Proof of Theorem 8

Given a polynomial-size Boolean circuit , construct the unitary that consists of only NOT and TOFFOLI such that

 U(|x⟩⊗|0ξ⟩)=|junk(x)⟩⊗|f(x)⟩

for any by replacing each AND and OR of with TOFFOLI, where is the number of AND and OR gates in and is a certain bit string. From , we can construct such that

 V(|x⟩⊗|0ξ⟩⊗|0⟩)=|x⟩⊗|0ξ⟩⊗|f(x)⟩

for any . In fact, with a CNOT gate, we can copy the value of to an additional ancilla qubit as

 |junk(x)⟩⊗|f(x)⟩⊗|0⟩→|junk(x)⟩⊗|f(x)⟩⊗|f(x)⟩.

We then apply so that

 U†(|junk(x)⟩⊗|f(x)⟩)⊗|f(x)⟩=|x⟩⊗|0ξ⟩⊗|f(x)⟩.

Then if we define by

 W≡(H⊗n⊗I⊗ξ⊗H)V(H⊗n⊗I⊗ξ+1),

we obtain

 |⟨0n+ξ1|W|0n+ξ+1⟩|2=gap(f)222n+1,

which cannot be classically sampled within a multiplicative error in time, where is the number of in .

### v.10 Proof of Lemma 2

Assume that a language is in coNP. Then, if then , and if then , where is a certain Boolean circuit. By the assumption, we can construct the quantum circuit . Then, if then , and if then . It means that coNP is in , where is equivalent to NQP except that the decision quantum circuit is the DQC1 model. Here NQP is a quantum version of NP, and defined as follows.

###### Definition 7

A language is in NQP if and only if there exists a uniformly-generated family of polynomial-size quantum circuits such that if then and if then , where is the acceptance probability of .

It is known that  Kobayashi ; KobayashiICALP , and therefore we have shown .

###### Acknowledgements.
TM thanks Francois Le Gall, Seiichiro Tani, and Yuki Takeuchi for discussions. TM thanks Harumichi Nishimura for discussion and letting him know Ref. Beigel . TM thanks Yasuhiro Takahashi for letting him know Ref. Cosentino . TM is supported by MEXT Q-LEAP, JST PRESTO No.JPMJPR176A, and the Grant-in-Aid for Young Scientists (B) No.JP17K12637 of JSPS. ST is supported by JSPS KAKENHI Grant Numbers 16H02782, 18H04090, and 18K11164.

## References

• (1)

H. Buhrman, R. Cleve, and A. Wigderson, Quantum vs. classical communication and computation. Proceedings of the 30th Annual ACM Symposium on Theory of Computing, p.63 (1998).

• (2) R. Raz, Exponential separation of quantum and classical communication complexity. Proceedings of the 31st Annual ACM Symposium on Theory of Computing, p.358 (1999).
• (3) For definitions of complexity classes, see the complexity zoo. https://complexityzoo.uwaterloo.ca/Complexity_Zoo
• (4) P. W. Shor, Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.124 (1994).
• (5) I. M. Georgescu, S. Ashhab, and F. Nori, Quantum simulation. Rev. Mod. Phys. 86, 153 (2014).
• (6) E. Tang, A quantum-inspired classical algorithm for recommendation systems, arXiv:1807.04271
• (7) L. K. Grover, Quantum mechanics helps in searching for a needle in haystack. Phys. Rev. Lett. 79, 325 (1997).
• (8) D. R. Simon, On the power of quantum computation. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.116 (1994).
• (9) B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and Arthur-Merlin games. Quant. Inf. Comput. 4, 134 (2004).
• (10) S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of Computing 9, 143 (2013).
• (11) M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011).
• (12) M. J. Bremner, A. Montanaro, and D. J. Shepherd, Average-case complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, 080501 (2016).
• (13) E. Knill and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998).
• (14) T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of