I Introduction
Blind quantum computing BFK ; Barz ; BarzNP ; Chiara ; Vedrancomposability ; FK ; Vedran ; MABQC ; HayashiMorimae ; AKLTblind ; topoblind ; CVblind ; Lorenzo ; Atul ; Sueki ; Takeuchi ; distillation enables a client (Alice), who can access to only a limited quantum technology, to delegate her quantum computing to a remote quantum server (Bob) in such a way that Alice’s input, output, and program are hidden from Bob. The first blind quantum computing protocol proposed by Broadbent, Fitzsimons, and Kashefi BFK requires Alice to do only preparations of randomlyrotated singlequbit states. It is open whether the requirement is removed: it is open whether a completely classical Alice can blindly delegate quantum computing to Bob. Several other blind quantum computing protocols have been proposed to ease Alice’s burden. For example, generating weak coherent pulses was shown to be enough instead of the singlequbit state generation Vedran . Furthermore, it was shown that blind quantum computing is possible for Alice who can do only singlequbit measurements MABQC . Measuring quantum states is sometimes easier than generating quantum states. However, all previous results require some minimum quantum technologies for Alice, and the possibility of blind quantum computing for completely classical Alice remains open. (Note that we are interested in the informationtheoretic security. If we consider the computational one, a recent breakthrough showed that secure delegated quantum computing for completely classical Alice is possible Mahadev .)
Morimae and Koshiba showed that if oneround perfectlysecure delegated universal quantum computing is possible for a completely classical client, then MorimaeKoshiba . Since BQP is not believed to be in NP, the result suggests the impossibility of such a delegation. In their protocol, only a single round of message exchange is done between Alice and Bob, and what is sent from Bob to Alice is only a single bit. Aaronson, Cojocaru, Gheorghiu, and Kashefi considered a more general setup where polylength messages are exchanged in polyrounds between Alice and Bob ACGK ; error .
In this paper, we consider a classical blind delegation of sampling of subuniversal models. We show that the delegation is impossible unless the polynomialtime hierarchy collapses to the third level. The result holds for any subuniversal model that does not change the complexity class NQP (or that is universal under postselections, see Sec. V). Examples are the DQC1 model KL , the IQP model BJS , the depthfour model TD , the Boson Sampling model AA , the random circuit model random , and the HC1Q model HC1Q , etc. In our protocol, only a singleround of message exchange is done and what Bob sends to Alice is only a single bit. It is an open problem whether our nogo result is generalized to more general setups (for discussion on this point, see Sec. VI). One might think that in the case when Bob sends only a single bit to Alice, a nogo result could be shown unconditionally. However, some computational assumptions seem to be necessary. In fact, the blind delegation of BPP sampling can be done unconditionally: Alice has only to do it by herself.
This paper is organized as follows. In the next section, Sec. II, we give some preliminaries. In Sec. III, we explain the delegation protocol we consider. In Sec. IV, we show the nogo result for the DQC1 model. In Sec. V, we generalize the result to other subuniversal models. Finally, in Sec. VI, we give some discussions.
Ii Preliminaries
In this section, we provide some preliminaries necessary to understand the main result.
ii.1 Dqc1
Let us first explain the DQC1 model. The DQC1 model is a restricted model of quantum computing where all but a single input qubit are maximally mixed. It was introduced by Knill and Laflamme originally to model NMR quantum computing KL . It is known that the DQC1 model can efficiently solve several problems whose classical efficient solutions are not known, such as the calculation of Jones polynomials ShorJordan
. Furthermore, it was shown that output probability distributions of the DQC1 model cannot be classically efficiently sampled unless the polynomialtime hierarchy collapses
DQC1additive ; DQC1nonclean ; DQC1_1 ; DQC1_1ICALP ; DQC1_3 .Let be a quantum circuit on qubits. We define the probability distribution by
where is the twodimensional identity operator. In this paper we consider the classical delegation of sampling of . It is known that if is sampled in classical polynomial time with a multiplicative error , then the polynomialtime hierarchy collapses to the second level DQC1_1 ; DQC1_1ICALP . Here, we say that a probability distribution is sampled in classical polynomial time with a multiplicative error if there exists a classical probabilistic polynomialtime algorithm that outputs with probability such that
for all .
ii.2 Iqp
We next explain the IQP model BJS ; BMS . An qubit IQP circuit is a quantum circuit in the form of , where is an Hadamard gate and is a quantum circuit that consists of only diagonal gates, such as , , , and . Here
Let be an qubit IQP circuit. For an , we define the probability distribution by
In this paper we consider the classical delegation of sampling of with . It is known that if is sampled for certain in classical polynomial time with a multiplicative error , then the polynomialtime hierarchy collapses to the second level DQC1_1 ; DQC1_1ICALP . (It is also known that is exactly sampled in classical polynomial time if BJS .)
ii.3 Nqp
The complexity class NQP is a quantum version of NP and defined as follows ADH97 :
Definition 1
A problem is in NQP if and only if there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Here, , and .
It is important to point out that quantum computing in the above definition of NQP can be restricted to some subuniversal models, such as the DQC1 model or the IQP model DQC1_1 ; DQC1_1ICALP . Let us define the following classes.
Definition 2
A problem is in if and only if there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Here,
and .
Definition 3
A problem is in if and only if there exists a polynomialtime uniformly generated family of IQP circuits such that

If then .

If then .
Here , , and .
Then we can show the following equivalences.
Theorem 4
DQC1_1 ; DQC1_1ICALP .
Theorem 5
DQC1_1 ; DQC1_1ICALP .
ii.4 operator
Let K be a complexity class. The class is defined as follows TO92 .
Definition 6
A problem is in if and only if for any polynomially bounded function , there exist a problem in and a polynomially bounded function such that for every , it holds that

If then

If then
ii.5 Advice classes
We also use advice classes KarpLipton . Let K be any complexity class.
Definition 7
A problem is in if and only if there exist a problem in K, an advice function , and a polynomial such that for all , and

If then .

If then .
We also use a complexity class with probabilistic advice.
Definition 8
A problem is in if and only if there exist a classical probabilistic polynomialtime algorithm and a family of probability distributions such that

If then .

If then .
Here, takes as the input, where is sampled from the probability distribution .
Iii Delegation protocol
In this section we explain the delegation protocol we consider. Let be a quantum circuit on qubits with a parameter . Alice wants to sample the probability distribution , where
However, she is completely classical (i.e., her computational ability is classical probabilistic polynomialtime), so she delegates the sampling to Bob. Bob’s computational ability is unbounded. She wants to hide the parameter from Bob up to its size .
Our delegation protocol consists of the following elements:

A classical probabilistic polynomialtime key generation algorithm . On input , the algorithm outputs with certain probability, where is a key.

A classical deterministic polynomialtime encryption algorithm . On input , it outputs , where .

A classical deterministic polynomialtime decryption algorithm . On input , it outputs , where .
Our delegation protocol runs as follows:

On input , Alice runs the key generation algorithm to get a key .

Alice computes , and sends to Bob.

Bob sends Alice with probability .

Alice computes .
We require that this delegation protocol satisfies both the correctness and blindness simultaneously. Here, the correctness and blindness are defined as follows.
Definition 9
We say that the above protocol is correct if for any circuit , any parameter , and any key for , i.e., ,
Here,
for .
It means that Alice can sample with a multiplicative error .
Definition 10
We say that the above protocol is blind if the following is satisfied: Let be any parameter, and be any key for , i.e., . For any parameter such that , the probability that outputs such that is nonzero.
In other words, let be the probability that outputs such that . Then, the blindness means that supports of and are the same for any and . The intuition behind Definition 10 is that if such is never generated then Bob can learn that Alice’s parameter is not when he receives from Alice.
To conclude this section, we provide several remarks. First, our delegation protocol is similar to the generalized encryption scheme (GES) of Refs. AFK ; ACGK . However, the GES is a protocol that enables a client to delegate the calculation of for a function and input with success probability larger than . The computation of the value of could be delegated by using the GES, but it is stronger than what Alice wants to do, i.e., the sampling of . Second, what Bob does in our protocol is only sending a single bit to Alice, while the GES considers a more general setup: Bob sends Alice polylength bit strings, and multiple rounds of message exchanges are done between Alice and Bob. It is an open problem whether we can generalize our nogo result for more general setups (see Sec. VI). Third, our definition of the blindness given above is a minimum one, and in fact it is a necessary condition for the more general definition of the blindness in Refs. AFK ; ACGK . Our nogo result can be shown with any reasonable definition of the blindness as long as it includes the above definition of the blindness as a necessary condition. Finally, in our protocol, we have assumed that a valid key is always obtained. We can generalize it to the following: on input , the key generation algorithm outputs . If , is a valid key. If , is an invalid key. The probability that the key generation algorithm outputs is at least . In this case, Alice has only to run until she gets .
Iv Result
The main result of the present paper is the following.
Theorem 11
If the above delegation protocol satisfies both the correctness and blindness simultaneously with , then .
Proof. Let be a problem in NQP. Then, from Theorem 4, is in . Therefore, there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Let be a natural number. Let be any key for , i.e., . Let . Bob sends Alice with probability when he receives from Alice. Let us consider the following probabilistic algorithm with advice.

On input with , receive as advice. Note that it is advice, because both and depend only on . (Note that we consider only quantum circuits whose acceptance probabilities can be represented exactly in polylength bit strings, such as circuits consisting of and Toffoli.)

Run the key generation algorithm on input . Let be the obtained key, i.e., . Run the encryption algorithm on input . If , reject. If , then generate with probability , and run the decryption algorithm on input . Let , where . If , accept. If , reject.
Because of the correctness,
for a certain . The acceptance probability of the above probabilistic algorithm with advice is
where is the probability that the key generation algorithm on input outputs a key such that . Because of the blindness, . Hence, if then
If then
Therefore, is in , and we have shown .
The consequence, , leads to the collapse of the polynomialtime hierarchy to the third level due to the following lemma. Because the polynomialtime hierarchy is not believed to collapse, Theorem 11 suggests the impossibility of the classical blind DQC1 sampling.
Lemma 12
If , then the polynomialtime hierarchy collapses to the third level.
Proof. Note that
Here, the second inclusion is from Corollary 2.5 of Ref. TO92 . The third equality is from of Ref. FGHP99 . The proof of the last containment, , is similar to that of (see Appendix C). Finally, leads to the collapse of the polynomialtime hierarchy to the third level Yap . (Actually, leads to the stronger result Cai , where .)
V Generalizations
In this paper, we have shown that if a classical client can blindly delegate the DQC1 sampling then the polynomialtime hierarchy collapses to the third level. It is clear that the same result holds for another subuniversal model if is satisfied, where is the NQP whose quantum circuits are restricted to the model . For example, we can show the following:
Theorem 13
If the sampling of can be classically delegated satisfying both the correctness and blindness simultaneously with , then .
Furthermore, it is clear that the same result holds for other subuniversal models , such as the Boson Sampling model AA , the depth4 model TD , and the random circuit model random , because for these models. (It is known that these models are universal under a postselection. If we accept when the postselection is successful and the original circuit accepts, then the acceptance probability is proportional to the acceptance probability of a universal circuit. See Appendix B.)
Vi Discussion
In this paper, we have considered the delegation protocol where Bob sends only a single bit to Alice. It is an open problem whether we can generalize our nogo result for more general delegation protocols. For example, what happens if Bob sends a polylength bit string to Alice? (It is easy to see that Theorem 11 can be generalized to the delegation protocol where Bob sends Alice a loglength bit string.) Furthermore, what happens if multiple rounds of message exchanges are done between Alice and Bob?
The argument used in the proof of Theorem 11 does not seem to be directly applied to these generalized cases. For example, let us modify our delegation protocol in such a way that, instead of the single bit, Bob sends Alice a polylength bit string with probability when he receives from Alice. Then we can show the following.
Theorem 14
If such a modified delegation protocol satisfies both the correctness and blindness simultaneously with , then .
Proof. Let be a problem in NQP. Then, from Theorem 4, is in . Therefore, there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Let be a natural number. Let be any key for , i.e., . Let . Bob sends Alice with probability when he receives from Alice. Let us consider the following probabilistic algorithm with probabilistic advice.

On input with , receive and the probability distribution as advice. Note that they are advices, because both and depend only on .

Run the key generation algorithm on input . Let be the obtained key, i.e., . Run the encryption algorithm on input . If , reject. If , then sample from , and run the decryption algorithm on input . Let , where . If , accept. If , reject.
Because of the correctness,
for a certain . The acceptance probability of the above algorithm is
where is the probability that the key generation algorithm on input outputs a key such that . Because of the blindness, . Hence, if then
If then
Therefore, is in , and we have shown .
However, it can be shown that (for a proof, see Appendix D) Andrucomment . Therefore we cannot conclude any unlikely consequence, such as the collapse of the polynomialtime hierarchy.
Acknowledgements.
TM thanks A. Gheorghiu for sending his Ph.D. thesis and answering to some questions. TM is supported by JST PRESTO No.JPMJPR176A and JSPS GrantinAid for Young Scientists (B) No.JP17K12637. HM is supported by JSPS KAKENHI grants No. 26247016, No. 16H01705 and No. 16K00015.Appendix A Proof of Theorem 4
The inclusion is trivial. Let us show the other inclusion . Let be a problem in NQP. Then, there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Here, . Let us define the qubit circuit as is shown in Fig. 1. Then,

If then .

If then .
Here, . From , we construct the DQC1 model of Fig. 2. By the straightforward calculation, it is clear that the probability of obtaining 1 when the first qubit of the DQC1 model of Fig. 2 is measured in the computational basis is
Therefore, if then , and if then , which means that is in . Hence we have shown .
Appendix B Proof of Theorem 5
Since is trivial, let us show . Let be a problem in NQP. Then there exists a polynomialtime uniformly generated family of quantum circuits such that

If then .

If then .
Here, . Since the IQP model is universal under a postselection, for any there exist an IQP circuit and such that
Therefore
Therefore if then , and if then . Hence is in , and we have shown .
Appendix C Proof of
One way of showing it is to combine Lemma 2.12 of Ref. TO92 , , with .
Here, for the convenience of readers, we provide a direct proof. Let be a problem in . Then, for any polynomially bounded function , there exist a problem in and a polynomially bounded function such that for every it holds that

If , then

If , then
Let us take . For each , the number of such that is at most . For each , the number of such that is at most . Therefore, there exists at least one such that for all

If then .

If then .
Let be such . Then, there exists an advice such that for all

If then .

If then .
Since is in , there exists a problem in NP and advice such that

If then .

If then .
Therefore,

If then .

If then .
Hence we have shown is in .
Appendix D Proof of
Here we show . The proof is essentially the same as that of Aar05 .
Let be any problem. Let be a function such that if and only if , and if and only if . Let be the probability distribution such that
for all . Let us consider the following probabilistic algorithm with probabilistic advice:

On input with , receive the probability distribution as advice.

Sample from . If , reject. If , see . If , accept. If , reject.
If , the acceptance probability is
If , the acceptance probability is
Therefore, is in .
References
 (1) A. Broadbent, J. F. Fitzsimons, and E. Kashefi, Universal blind quantum computation. Proc. of the 50th Annual IEEE Sympo. on Found. of Comput. Sci. pp.517526 (2009).
 (2) S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, Demonstration of blind quantum computing. Science 335, 303 (2012).
 (3) S. Barz, J. F. Fitzsimons, E. Kashefi, and P. Walther, Experimental verification of quantum computation. Nature Phys. 9, 727 (2013).
 (4) C. Greganti, M. Roehsner, S. Barz, T. Morimae, and P. Walther, Demonstration of measurementonly blind quantum computing. New J. Phys. 18, 013020 (2016).
 (5) V. Dunjko, J. F. Fitzsimons, C. Portmann, and R. Renner, Composable security of delegated quantum computation. ASIACRYPT 2014, LNCS Volume 8874, pp.406425 (2014).
 (6) J. F. Fitzsimons and E. Kashefi, Unconditionally verifiable blind computation. Phys. Rev. A 96, 012303 (2017).
 (7) V. Dunjko, E. Kashefi, and A. Leverrier, Blind quantum computing with weak coherent pulses. Phys. Rev. Lett. 108, 200502 (2012).
 (8) T. Morimae and K. Fujii, Blind quantum computation for Alice who does only measurements. Phys. Rev. A 87, 050301(R) (2013).
 (9) M. Hayashi and T. Morimae, Verifiable measurementonly blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
 (10) T. Morimae, V. Dunjko, and E. Kashefi, Ground state blind quantum computation on AKLT state. Quant. Inf. Comput. 15, 02000234 (2015).
 (11) T. Morimae and K. Fujii, Blind topological measurementbased quantum computation. Nature Communications 3, 1036 (2012).
 (12) T. Morimae, Continuousvariable blind quantum computation. Phys. Rev. Lett. 109, 230502 (2012).
 (13) V. Giovannetti, L. Maccone, T. Morimae, and T. G. Rudolph, Efficient universal blind computation. Phys. Rev. Lett. 111, 230501 (2013).
 (14) A. Mantri, C. PérezDelgado, and J. F. Fitzsimons, Optimal blind quantum computation. Phys. Rev. Lett. 111, 230502 (2013).
 (15) T. Sueki, T. Koshiba, and T. Morimae, Ancilladriven universal blind quantum computation. Phys. Rev. A 87, 060301(R) (2013).
 (16) Y. Takeuchi, K. Fujii, T. Morimae, and N. Imoto, Faulttolerant verifiable blind quantum computing with logical state remote preparation. arXiv:1607.01568
 (17) T. Morimae and K. Fujii, Secure entanglement distillation for doubleserver blind quantum computation. Phys. Rev. Lett. 111, 020502 (2013).
 (18) U. Mahadev, Classical homomorphic encryption for quantum circuits. arXiv:1708.02130
 (19) T. Morimae and T. Koshiba, Impossibility of perfectlysecure delegated quantum computing for classical client. arXiv:1407.1636
 (20) S. Aaronson, A. Cojocaru, A. Gheorghiu, and E. Kashefi, On the implausiblity of classical client blind quantum computing. arXiv:1704.08482
 (21) Theorem 3 of Ref. ACGK , which roughly says that “if a classical blind delegation of Boson Sampling is possible, then the polynomialtime hierarchy collapses to the fourth level”, contains an error private . On the other hand, another result, which roughly says that “if a classical blind delegation of Boson Sampling is possible, then the permanent can be computed with a small size circuit” is shown in Ref. AndruPhD .
 (22) A. Gheorghiu, private communications.
 (23) A. Gheorghiu, Ph.D. thesis, University of Edinburgh (2018).
 (24) E. Knill and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998).
 (25) M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011).
 (26) B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and ArthurMerlin games. Quant. Inf. Comput. 4, 134145 (2004).

(27)
S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of Computing
9, 143252 (2013).  (28) A. Bouland, B. Fefferman, C. Nirkhe, and U. Vazirani, On the complexity and verification of quantum random circuit sampling. Nat. Phys. 2018
 (29) T. Morimae, Y. Takeuchi, and H. Nishimura, MerlinArthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy. Quantum 2, 106 (2018).

(30)
P. W. Shor and S. P. Jordan, Estimating Jones polynomials is a complete problem for one clean qubit. Quant. Inf. Comput.
8, 681714 (2008).  (31) T. Morimae, Hardness of classically sampling one clean qubit model with constant total variation distance error. Phys. Rev. A 96, 040302(R) (2017).
 (32) T. Morimae, K. Fujii, and H. Nishimura, Power of one nonclean qubit. Phys. Rev. A 95, 042336 (2017).
 (33) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Impossibility of classically simulating onecleanqubit model with multiplicative error. Phys. Rev. Lett. 120, 200502 (2018).
 (34) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Power of quantum computation with few clean qubits. Proceedings of 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016), pp.13:113:14 (2016).
 (35) T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of classically simulating one clean qubit model. Phys. Rev. Lett. 112, 130502 (2014).
 (36) M. J. Bremner, A. Montanaro, and D. J. Shepherd, Averagecase complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, 080501 (2016).
 (37) L. Adleman, J. DeMarrais, and M. Huang, Quantum computability. SIAM J. Comput. 26, 15241540 (1997).
 (38) S. Toda and M. Ogiwara, Counting classes are at least as hard as the polynomialtime hierarchy. SIAM Journal on Computing 21, 316328 (1992).
 (39) R. M. Karp and R. J. Lipton, Some connections between nonuniform and uniform complexity classes. Proceedings of the twelfth annual ACM symposium on theory of computing (STOC ’80), pp.302309 (1980).
 (40) M. Abadi, J. Feigenbaum, and J. Kilian, On hiding information from an oracle. Journal of Computer and System Sciences 39, 2150 (1989).
 (41) S. Fenner, F. Green, S. Homer, and R. Pruim, Determining acceptance probability for a quantum computation is hard for the polynomial hierarchy. Proceedings of the Royal Society A 455, 39533966 (1999).
 (42) C. K. Yap. Some consequences of nonuniform conditions on uniform classes. Theoretical Computer Science 26, 287300 (1983).
 (43) J. Y. Cai, V. T. Chakaravarthy, L. A. Hemaspaandra, and M. Ogihara, Competing provers yield improved KarpLipton collapse results. Information and Computation 198, 123 (2005).
 (44) S. Aaronson, Limitations of quantum advice and oneway communication. Theory of Computing 1, pp.128 (2005).

(45)
One might think that this seems strange as
Aar06
while NP is in MA. However, adding randomized (or quantum) advice may change the inclusion order of the original complexity classes. In our case, the definition of NP based on a probabilistic Turing machine (the unboundederror acceptance criterion) is crucial to make
.  (46) S. Aaronson, is contained in : DeMerlinizing quantum protocols. In Proceedings of IEEE Complexity 2006, pp.261273 (2006).
Comments
There are no comments yet.