# Impossibility of blind quantum sampling for classical client

Blind quantum computing enables a client, who can only generate or measure single-qubit states, to delegate quantum computing to a remote quantum server in such a way that the input, output, and program are hidden from the server. It is an open problem whether a completely classical client can delegate quantum computing blindly. In this paper, we show that if a completely classical client can blindly delegate sampling of subuniversal models, such as the DQC1 model and the IQP model, then the polynomial-time hierarchy collapses to the third level. Our delegation protocol is the one where the client first sends a polynomial-length bit string to the server and then the server returns a single bit to the client. Generalizing the no-go result to more general setups is an open problem.

There are no comments yet.

## Authors

• 14 publications
• 8 publications
• 6 publications
• 7 publications
04/24/2018

### Rational proofs for quantum computing

It is an open problem whether a classical client (verifier) can delegate...
05/09/2018

### Interactive Proofs with Polynomial-Time Quantum Prover for Computing the Order of Solvable Groups

In this paper we consider what can be computed by a user interacting wit...
11/12/2019

### Sumcheck-based delegation of quantum computing to rational server

Delegated quantum computing enables a client with a weak computational p...
07/03/2020

### Security Limitations of Classical-Client Delegated Quantum Computing

Secure delegated quantum computing allows a computationally weak client ...
11/28/2017

### Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

It is a long-standing open problem whether quantum computing can be veri...
10/15/2017

### Game-Theoretic Pricing and Selection with Fading Channels

We consider pricing and selection with fading channels in a Stackelberg ...
12/09/2020

### Constant-round Blind Classical Verification of Quantum Sampling

In a recent breakthrough, Mahadev constructed a classical verification o...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## I Introduction

Blind quantum computing BFK ; Barz ; BarzNP ; Chiara ; Vedrancomposability ; FK ; Vedran ; MABQC ; HayashiMorimae ; AKLTblind ; topoblind ; CVblind ; Lorenzo ; Atul ; Sueki ; Takeuchi ; distillation enables a client (Alice), who can access to only a limited quantum technology, to delegate her quantum computing to a remote quantum server (Bob) in such a way that Alice’s input, output, and program are hidden from Bob. The first blind quantum computing protocol proposed by Broadbent, Fitzsimons, and Kashefi BFK requires Alice to do only preparations of randomly-rotated single-qubit states. It is open whether the requirement is removed: it is open whether a completely classical Alice can blindly delegate quantum computing to Bob. Several other blind quantum computing protocols have been proposed to ease Alice’s burden. For example, generating weak coherent pulses was shown to be enough instead of the single-qubit state generation Vedran . Furthermore, it was shown that blind quantum computing is possible for Alice who can do only single-qubit measurements MABQC . Measuring quantum states is sometimes easier than generating quantum states. However, all previous results require some minimum quantum technologies for Alice, and the possibility of blind quantum computing for completely classical Alice remains open. (Note that we are interested in the information-theoretic security. If we consider the computational one, a recent breakthrough showed that secure delegated quantum computing for completely classical Alice is possible Mahadev .)

Morimae and Koshiba showed that if one-round perfectly-secure delegated universal quantum computing is possible for a completely classical client, then  MorimaeKoshiba . Since BQP is not believed to be in NP, the result suggests the impossibility of such a delegation. In their protocol, only a single round of message exchange is done between Alice and Bob, and what is sent from Bob to Alice is only a single bit. Aaronson, Cojocaru, Gheorghiu, and Kashefi considered a more general setup where poly-length messages are exchanged in poly-rounds between Alice and Bob ACGK ; error .

In this paper, we consider a classical blind delegation of sampling of subuniversal models. We show that the delegation is impossible unless the polynomial-time hierarchy collapses to the third level. The result holds for any subuniversal model that does not change the complexity class NQP (or that is universal under postselections, see Sec. V). Examples are the DQC1 model KL , the IQP model BJS , the depth-four model TD , the Boson Sampling model AA , the random circuit model random , and the HC1Q model HC1Q , etc. In our protocol, only a single-round of message exchange is done and what Bob sends to Alice is only a single bit. It is an open problem whether our no-go result is generalized to more general setups (for discussion on this point, see Sec. VI). One might think that in the case when Bob sends only a single bit to Alice, a no-go result could be shown unconditionally. However, some computational assumptions seem to be necessary. In fact, the blind delegation of BPP sampling can be done unconditionally: Alice has only to do it by herself.

This paper is organized as follows. In the next section, Sec. II, we give some preliminaries. In Sec. III, we explain the delegation protocol we consider. In Sec. IV, we show the no-go result for the DQC1 model. In Sec. V, we generalize the result to other subuniversal models. Finally, in Sec. VI, we give some discussions.

## Ii Preliminaries

In this section, we provide some preliminaries necessary to understand the main result.

### ii.1 Dqc1

Let us first explain the DQC1 model. The DQC1 model is a restricted model of quantum computing where all but a single input qubit are maximally mixed. It was introduced by Knill and Laflamme originally to model NMR quantum computing KL . It is known that the DQC1 model can efficiently solve several problems whose classical efficient solutions are not known, such as the calculation of Jones polynomials ShorJordan

. Furthermore, it was shown that output probability distributions of the DQC1 model cannot be classically efficiently sampled unless the polynomial-time hierarchy collapses

DQC1additive ; DQC1nonclean ; DQC1_1 ; DQC1_1ICALP ; DQC1_3 .

Let be a quantum circuit on qubits. We define the probability distribution by

 pDQC1V(0) = pDQC1V(1) =

where is the two-dimensional identity operator. In this paper we consider the classical delegation of sampling of . It is known that if is sampled in classical polynomial time with a multiplicative error , then the polynomial-time hierarchy collapses to the second level DQC1_1 ; DQC1_1ICALP . Here, we say that a probability distribution is sampled in classical polynomial time with a multiplicative error if there exists a classical probabilistic polynomial-time algorithm that outputs with probability such that

 |pz−qz|≤ϵpz

for all .

### ii.2 Iqp

We next explain the IQP model BJS ; BMS . An -qubit IQP circuit is a quantum circuit in the form of , where is an Hadamard gate and is a quantum circuit that consists of only -diagonal gates, such as , , , and . Here

 Z ≡ |0⟩⟨0|−|1⟩⟨1|, CZ ≡ I⊗2−2|11⟩⟨11|, CCZ ≡ I⊗3−2|111⟩⟨111|.

Let be an -qubit IQP circuit. For an , we define the probability distribution by

 pIQP,mV(1) = ∥∥(|1m⟩⟨1m|⊗I⊗n−m)V|0n⟩∥∥2, pIQP,mV(0) = 1−pIQP,mV(1).

In this paper we consider the classical delegation of sampling of with . It is known that if is sampled for certain in classical polynomial time with a multiplicative error , then the polynomial-time hierarchy collapses to the second level DQC1_1 ; DQC1_1ICALP . (It is also known that is exactly sampled in classical polynomial time if  BJS .)

### ii.3 Nqp

The complexity class NQP is a quantum version of NP and defined as follows ADH97 :

###### Definition 1

A problem is in NQP if and only if there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Here, , and .

It is important to point out that quantum computing in the above definition of NQP can be restricted to some subuniversal models, such as the DQC1 model or the IQP model DQC1_1 ; DQC1_1ICALP . Let us define the following classes.

###### Definition 2

A problem is in if and only if there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Here,

 pDQC1Vx(1)≡Tr[(|1⟩⟨1|⊗I⊗n−1)Vx(|0⟩⟨0|⊗I⊗n−12n−1)V†x],

and .

###### Definition 3

A problem is in if and only if there exists a polynomial-time uniformly generated family of IQP circuits such that

• If then .

• If then .

Here , , and .

Then we can show the following equivalences.

###### Theorem 4

DQC1_1 ; DQC1_1ICALP .

###### Theorem 5

DQC1_1 ; DQC1_1ICALP .

For the convenience of readers, their proofs are given in Appendix A and Appendix B, respectively.

### ii.4 ˆBP operator

Let K be a complexity class. The class is defined as follows TO92 .

###### Definition 6

A problem is in if and only if for any polynomially bounded function , there exist a problem in and a polynomially bounded function such that for every , it holds that

• If then

 |{z∈{0,1}r(|x|) | ⟨x,z⟩∈Byes}|≥(1−2−q(|x|))2r(|x|).
• If then

 |{z∈{0,1}r(|x|) | ⟨x,z⟩∈Bno}|≥(1−2−q(|x|))2r(|x|).

### ii.5 Advice classes

We also use advice classes KarpLipton . Let K be any complexity class.

###### Definition 7

A problem is in if and only if there exist a problem in K, an advice function , and a polynomial such that for all , and

• If then .

• If then .

We also use a complexity class with probabilistic advice.

###### Definition 8

A problem is in if and only if there exist a classical probabilistic polynomial-time algorithm and a family of probability distributions such that

• If then .

• If then .

Here, takes as the input, where is sampled from the probability distribution .

## Iii Delegation protocol

In this section we explain the delegation protocol we consider. Let be a quantum circuit on qubits with a parameter . Alice wants to sample the probability distribution , where

 pDQC1Vx(z)≡Tr[(|z⟩⟨z|⊗I⊗n−1)Vx(|0⟩⟨0|⊗I⊗n−12n−1)V†x].

However, she is completely classical (i.e., her computational ability is classical probabilistic polynomial-time), so she delegates the sampling to Bob. Bob’s computational ability is unbounded. She wants to hide the parameter from Bob up to its size .

Our delegation protocol consists of the following elements:

• A classical probabilistic polynomial-time key generation algorithm . On input , the algorithm outputs with certain probability, where is a key.

• A classical deterministic polynomial-time encryption algorithm . On input , it outputs , where .

• A classical deterministic polynomial-time decryption algorithm . On input , it outputs , where .

Our delegation protocol runs as follows:

• On input , Alice runs the key generation algorithm to get a key .

• Alice computes , and sends to Bob.

• Bob sends Alice with probability .

• Alice computes .

We require that this delegation protocol satisfies both the correctness and blindness simultaneously. Here, the correctness and blindness are defined as follows.

###### Definition 9

We say that the above protocol is -correct if for any circuit , any parameter , and any key for , i.e., ,

 ∣∣Pr(τ=0)−pDQC1Vx(0)∣∣ ≤ ϵpDQC1Vx(0), ∣∣Pr(τ=1)−pDQC1Vx(1)∣∣ ≤ ϵpDQC1Vx(1).

Here,

 Pr(τ=z)≡∑b∈{0,1}qE(x,k)(b)δz,D(x,k,b)

for .

It means that Alice can sample with a multiplicative error .

###### Definition 10

We say that the above protocol is blind if the following is satisfied: Let be any parameter, and be any key for , i.e., . For any parameter such that , the probability that outputs such that is non-zero.

In other words, let be the probability that outputs such that . Then, the blindness means that supports of and are the same for any and . The intuition behind Definition 10 is that if such is never generated then Bob can learn that Alice’s parameter is not when he receives from Alice.

To conclude this section, we provide several remarks. First, our delegation protocol is similar to the generalized encryption scheme (GES) of Refs. AFK ; ACGK . However, the GES is a protocol that enables a client to delegate the calculation of for a function and input with success probability larger than . The computation of the value of could be delegated by using the GES, but it is stronger than what Alice wants to do, i.e., the sampling of . Second, what Bob does in our protocol is only sending a single bit to Alice, while the GES considers a more general setup: Bob sends Alice poly-length bit strings, and multiple rounds of message exchanges are done between Alice and Bob. It is an open problem whether we can generalize our no-go result for more general setups (see Sec. VI). Third, our definition of the blindness given above is a minimum one, and in fact it is a necessary condition for the more general definition of the blindness in Refs. AFK ; ACGK . Our no-go result can be shown with any reasonable definition of the blindness as long as it includes the above definition of the blindness as a necessary condition. Finally, in our protocol, we have assumed that a valid key is always obtained. We can generalize it to the following: on input , the key generation algorithm outputs . If , is a valid key. If , is an invalid key. The probability that the key generation algorithm outputs is at least . In this case, Alice has only to run until she gets .

## Iv Result

The main result of the present paper is the following.

###### Theorem 11

If the above delegation protocol satisfies both the -correctness and blindness simultaneously with , then .

Proof. Let be a problem in NQP. Then, from Theorem 4, is in . Therefore, there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Let be a natural number. Let be any key for , i.e., . Let . Bob sends Alice with probability when he receives from Alice. Let us consider the following probabilistic algorithm with advice.

• On input with , receive as advice. Note that it is advice, because both and depend only on . (Note that we consider only quantum circuits whose acceptance probabilities can be represented exactly in poly-length bit strings, such as circuits consisting of and Toffoli.)

• Run the key generation algorithm on input . Let be the obtained key, i.e., . Run the encryption algorithm on input . If , reject. If , then generate with probability , and run the decryption algorithm on input . Let , where . If , accept. If , reject.

Because of the correctness,

 ∣∣Pr(ξ=1)−pDQC1Vx(1)∣∣ ≤ ϵpDQC1Vx(1)

for a certain . The acceptance probability of the above probabilistic algorithm with advice is

 pacc=η×Pr(ξ=1),

where is the probability that the key generation algorithm on input outputs a key such that . Because of the blindness, . Hence, if then

 pacc≥η(1−ϵ)pDQC1Vx(1)>0.

If then

 pacc≤η(1+ϵ)pDQC1Vx(1)=0.

Therefore, is in , and we have shown .

The consequence, , leads to the collapse of the polynomial-time hierarchy to the third level due to the following lemma. Because the polynomial-time hierarchy is not believed to collapse, Theorem 11 suggests the impossibility of the classical blind DQC1 sampling.

###### Lemma 12

If , then the polynomial-time hierarchy collapses to the third level.

Proof. Note that

 coNP⊆PH⊆ˆBP⋅coC=P=ˆBP⋅NQP⊆ˆBP⋅NP/poly⊆NP/poly.

Here, the second inclusion is from Corollary 2.5 of Ref. TO92 . The third equality is from of Ref. FGHP99 . The proof of the last containment, , is similar to that of (see Appendix C). Finally, leads to the collapse of the polynomial-time hierarchy to the third level Yap . (Actually, leads to the stronger result  Cai , where .)

## V Generalizations

In this paper, we have shown that if a classical client can blindly delegate the DQC1 sampling then the polynomial-time hierarchy collapses to the third level. It is clear that the same result holds for another subuniversal model if is satisfied, where is the NQP whose quantum circuits are restricted to the model . For example, we can show the following:

###### Theorem 13

If the sampling of can be classically delegated satisfying both the -correctness and blindness simultaneously with , then .

Furthermore, it is clear that the same result holds for other subuniversal models , such as the Boson Sampling model AA , the depth-4 model TD , and the random circuit model random , because for these models. (It is known that these models are universal under a postselection. If we accept when the postselection is successful and the original circuit accepts, then the acceptance probability is proportional to the acceptance probability of a universal circuit. See Appendix B.)

## Vi Discussion

In this paper, we have considered the delegation protocol where Bob sends only a single bit to Alice. It is an open problem whether we can generalize our no-go result for more general delegation protocols. For example, what happens if Bob sends a poly-length bit string to Alice? (It is easy to see that Theorem 11 can be generalized to the delegation protocol where Bob sends Alice a log-length bit string.) Furthermore, what happens if multiple rounds of message exchanges are done between Alice and Bob?

The argument used in the proof of Theorem 11 does not seem to be directly applied to these generalized cases. For example, let us modify our delegation protocol in such a way that, instead of the single bit, Bob sends Alice a poly-length bit string with probability when he receives from Alice. Then we can show the following.

###### Theorem 14

If such a modified delegation protocol satisfies both the -correctness and blindness simultaneously with , then .

Proof. Let be a problem in NQP. Then, from Theorem 4, is in . Therefore, there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Let be a natural number. Let be any key for , i.e., . Let . Bob sends Alice with probability when he receives from Alice. Let us consider the following probabilistic algorithm with probabilistic advice.

• On input with , receive and the probability distribution as advice. Note that they are advices, because both and depend only on .

• Run the key generation algorithm on input . Let be the obtained key, i.e., . Run the encryption algorithm on input . If , reject. If , then sample from , and run the decryption algorithm on input . Let , where . If , accept. If , reject.

Because of the correctness,

 ∣∣Pr(ξ=1)−pDQC1Vx(1)∣∣ ≤ ϵpDQC1Vx(1)

for a certain . The acceptance probability of the above algorithm is

 pacc=η×Pr(ξ=1),

where is the probability that the key generation algorithm on input outputs a key such that . Because of the blindness, . Hence, if then

 pacc≥η(1−ϵ)pDQC1Vx(1)>0.

If then

 pacc≤η(1+ϵ)pDQC1Vx(1)=0.

Therefore, is in , and we have shown .

However, it can be shown that (for a proof, see Appendix DAndrucomment . Therefore we cannot conclude any unlikely consequence, such as the collapse of the polynomial-time hierarchy.

###### Acknowledgements.
TM thanks A. Gheorghiu for sending his Ph.D. thesis and answering to some questions. TM is supported by JST PRESTO No.JPMJPR176A and JSPS Grant-in-Aid for Young Scientists (B) No.JP17K12637. HM is supported by JSPS KAKENHI grants No. 26247016, No. 16H01705 and No. 16K00015.

## Appendix A Proof of Theorem 4

The inclusion is trivial. Let us show the other inclusion . Let be a problem in NQP. Then, there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Here, . Let us define the -qubit circuit as is shown in Fig. 1. Then,

• If then .

• If then .

Here, . From , we construct the DQC1 model of Fig. 2. By the straightforward calculation, it is clear that the probability of obtaining 1 when the first qubit of the DQC1 model of Fig. 2 is measured in the computational basis is

 ~p=4pWx(1)(1−pWx(1))2n+2.

Therefore, if then , and if then , which means that is in . Hence we have shown .

## Appendix B Proof of Theorem 5

Since is trivial, let us show . Let be a problem in NQP. Then there exists a polynomial-time uniformly generated family of quantum circuits such that

• If then .

• If then .

Here, . Since the IQP model is universal under a postselection, for any there exist an IQP circuit and such that

 (|1s⟩⟨1s|⊗I⊗n)Wx|0n+s⟩√2−s=|1s⟩⊗(Vx|0n⟩).

Therefore

 pIQP,s+1Wx(1)=∥∥(|1s+1⟩⟨1s+1|⊗I⊗n−1)Wx|0n+s⟩∥∥2=pVx(1)2s.

Therefore if then , and if then . Hence is in , and we have shown .

## Appendix C Proof of ˆBP⋅NP/poly⊆NP/poly

One way of showing it is to combine Lemma 2.12 of Ref. TO92 , , with .

Here, for the convenience of readers, we provide a direct proof. Let be a problem in . Then, for any polynomially bounded function , there exist a problem in and a polynomially bounded function such that for every it holds that

• If , then

 ∣∣{z∈{0,1}r(|x|) | ⟨x,z⟩∈Byes}∣∣≥2r(|x|)(1−2−q(|x|)).
• If , then

 ∣∣{z∈{0,1}r(|x|) | ⟨x,z⟩∈Bno}∣∣≥2r(|x|)(1−2−q(|x|)).

Let us take . For each , the number of such that is at most . For each , the number of such that is at most . Therefore, there exists at least one such that for all

• If then .

• If then .

Let be such . Then, there exists an advice such that for all

• If then .

• If then .

Since is in , there exists a problem in NP and advice such that

• If then .

• If then .

Therefore,

• If then .

• If then .

Hence we have shown is in .

## Appendix D Proof of NP/rpoly=ALL

Here we show . The proof is essentially the same as that of  Aar05 .

Let be any problem. Let be a function such that if and only if , and if and only if . Let be the probability distribution such that

 qs(x,y)={12sy=f(x)0y≠f(x)

for all . Let us consider the following probabilistic algorithm with probabilistic advice:

• On input with , receive the probability distribution as advice.

• Sample from . If , reject. If , see . If , accept. If , reject.

If , the acceptance probability is

 pacc=12s×1>0.

If , the acceptance probability is

 pacc=12s×0=0.

Therefore, is in .

## References

• (1) A. Broadbent, J. F. Fitzsimons, and E. Kashefi, Universal blind quantum computation. Proc. of the 50th Annual IEEE Sympo. on Found. of Comput. Sci. pp.517-526 (2009).
• (2) S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, Demonstration of blind quantum computing. Science 335, 303 (2012).
• (3) S. Barz, J. F. Fitzsimons, E. Kashefi, and P. Walther, Experimental verification of quantum computation. Nature Phys. 9, 727 (2013).
• (4) C. Greganti, M. Roehsner, S. Barz, T. Morimae, and P. Walther, Demonstration of measurement-only blind quantum computing. New J. Phys. 18, 013020 (2016).
• (5) V. Dunjko, J. F. Fitzsimons, C. Portmann, and R. Renner, Composable security of delegated quantum computation. ASIACRYPT 2014, LNCS Volume 8874, pp.406-425 (2014).
• (6) J. F. Fitzsimons and E. Kashefi, Unconditionally verifiable blind computation. Phys. Rev. A 96, 012303 (2017).
• (7) V. Dunjko, E. Kashefi, and A. Leverrier, Blind quantum computing with weak coherent pulses. Phys. Rev. Lett. 108, 200502 (2012).
• (8) T. Morimae and K. Fujii, Blind quantum computation for Alice who does only measurements. Phys. Rev. A 87, 050301(R) (2013).
• (9) M. Hayashi and T. Morimae, Verifiable measurement-only blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
• (10) T. Morimae, V. Dunjko, and E. Kashefi, Ground state blind quantum computation on AKLT state. Quant. Inf. Comput. 15, 0200-0234 (2015).
• (11) T. Morimae and K. Fujii, Blind topological measurement-based quantum computation. Nature Communications 3, 1036 (2012).
• (12) T. Morimae, Continuous-variable blind quantum computation. Phys. Rev. Lett. 109, 230502 (2012).
• (13) V. Giovannetti, L. Maccone, T. Morimae, and T. G. Rudolph, Efficient universal blind computation. Phys. Rev. Lett. 111, 230501 (2013).
• (14) A. Mantri, C. Pérez-Delgado, and J. F. Fitzsimons, Optimal blind quantum computation. Phys. Rev. Lett. 111, 230502 (2013).
• (15) T. Sueki, T. Koshiba, and T. Morimae, Ancilla-driven universal blind quantum computation. Phys. Rev. A 87, 060301(R) (2013).
• (16) Y. Takeuchi, K. Fujii, T. Morimae, and N. Imoto, Fault-tolerant verifiable blind quantum computing with logical state remote preparation. arXiv:1607.01568
• (17) T. Morimae and K. Fujii, Secure entanglement distillation for double-server blind quantum computation. Phys. Rev. Lett. 111, 020502 (2013).
• (18) U. Mahadev, Classical homomorphic encryption for quantum circuits. arXiv:1708.02130
• (19) T. Morimae and T. Koshiba, Impossibility of perfectly-secure delegated quantum computing for classical client. arXiv:1407.1636
• (20) S. Aaronson, A. Cojocaru, A. Gheorghiu, and E. Kashefi, On the implausiblity of classical client blind quantum computing. arXiv:1704.08482
• (21) Theorem 3 of Ref. ACGK , which roughly says that “if a classical blind delegation of Boson Sampling is possible, then the polynomial-time hierarchy collapses to the fourth level”, contains an error private . On the other hand, another result, which roughly says that “if a classical blind delegation of Boson Sampling is possible, then the permanent can be computed with a small size circuit” is shown in Ref. AndruPhD .
• (22) A. Gheorghiu, private communications.
• (23) A. Gheorghiu, Ph.D. thesis, University of Edinburgh (2018).
• (24) E. Knill and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998).
• (25) M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011).
• (26) B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and Arthur-Merlin games. Quant. Inf. Comput. 4, 134-145 (2004).
• (27)

S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of Computing

9, 143-252 (2013).
• (28) A. Bouland, B. Fefferman, C. Nirkhe, and U. Vazirani, On the complexity and verification of quantum random circuit sampling. Nat. Phys. 2018
• (29) T. Morimae, Y. Takeuchi, and H. Nishimura, Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy. Quantum 2, 106 (2018).
• (30)

P. W. Shor and S. P. Jordan, Estimating Jones polynomials is a complete problem for one clean qubit. Quant. Inf. Comput.

8, 681-714 (2008).
• (31) T. Morimae, Hardness of classically sampling one clean qubit model with constant total variation distance error. Phys. Rev. A 96, 040302(R) (2017).
• (32) T. Morimae, K. Fujii, and H. Nishimura, Power of one non-clean qubit. Phys. Rev. A 95, 042336 (2017).
• (33) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Impossibility of classically simulating one-clean-qubit model with multiplicative error. Phys. Rev. Lett. 120, 200502 (2018).
• (34) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Power of quantum computation with few clean qubits. Proceedings of 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016), pp.13:1-13:14 (2016).
• (35) T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of classically simulating one clean qubit model. Phys. Rev. Lett. 112, 130502 (2014).
• (36) M. J. Bremner, A. Montanaro, and D. J. Shepherd, Average-case complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, 080501 (2016).
• (37) L. Adleman, J. DeMarrais, and M. Huang, Quantum computability. SIAM J. Comput. 26, 1524-1540 (1997).
• (38) S. Toda and M. Ogiwara, Counting classes are at least as hard as the polynomial-time hierarchy. SIAM Journal on Computing 21, 316-328 (1992).
• (39) R. M. Karp and R. J. Lipton, Some connections between nonuniform and uniform complexity classes. Proceedings of the twelfth annual ACM symposium on theory of computing (STOC ’80), pp.302-309 (1980).
• (40) M. Abadi, J. Feigenbaum, and J. Kilian, On hiding information from an oracle. Journal of Computer and System Sciences 39, 21-50 (1989).
• (41) S. Fenner, F. Green, S. Homer, and R. Pruim, Determining acceptance probability for a quantum computation is hard for the polynomial hierarchy. Proceedings of the Royal Society A 455, 3953-3966 (1999).
• (42) C. K. Yap. Some consequences of non-uniform conditions on uniform classes. Theoretical Computer Science 26, 287-300 (1983).
• (43) J. Y. Cai, V. T. Chakaravarthy, L. A. Hemaspaandra, and M. Ogihara, Competing provers yield improved Karp-Lipton collapse results. Information and Computation 198, 1-23 (2005).
• (44) S. Aaronson, Limitations of quantum advice and one-way communication. Theory of Computing 1, pp.1-28 (2005).
• (45) One might think that this seems strange as  Aar06

while NP is in MA. However, adding randomized (or quantum) advice may change the inclusion order of the original complexity classes. In our case, the definition of NP based on a probabilistic Turing machine (the unbounded-error acceptance criterion) is crucial to make

.
• (46) S. Aaronson, is contained in : De-Merlinizing quantum protocols. In Proceedings of IEEE Complexity 2006, pp.261-273 (2006).