Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

I Introduction

It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is “Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier?” defBQP . Answering this question is important not only for practical applications of cloud quantum computing but also for foundations of computer science and quantum physics AharonovVazirani .

Partial solutions to the open problem have been obtained. For example, several verification protocols MNS ; posthoc and verifiable blind quantum computing protocols FK ; Aharonov ; HM ; Broadbent ; Andru_review

demonstrate that if the verifier has a weak quantum ability, such as preparations or measurements of single-qubit quantum states, any BQP problem can be verified with a BQP prover. Furthermore, it is known that if more than two entangling BQP provers who are not communicating with each other are allowed, any BQP problem is verified with a BPP verifier

MattMBQC ; RUV ; Ji . Since BQP is contained in IP, a natural approach to the open problem is to restrict the prover of IP to BQP when the problem is in BQP defIP . In fact, recently, a significant step in this line has been obtained in Ref. AharonovGreen . The authors of Ref. AharonovGreen have constructed a new smart interactive proof system that verifies the value of the trace of operators with a postBQP prover and a BPP verifier.

Actually, the answer to the open problem is yes if we consider specific BQP problems. For example, it is known that the recursive Fourier sampling BV has an interactive proof system with a BQP prover and a BPP verifier MattFourier . Its proof is elegant, but so far we do not know how to generalize it to other BQP problems. Furthermore, it was suggested in Ref. Tommaso that a problem of deciding whether there exist some results that occur with high probability or not for circuits in the second level of the Fourier hierarchy (FH $_{2}$ ) FH ; expFH is verified by a Merlin-Arthur (MA) protocol with Merlin who is BQP in the honest case MA .

The first main result of the present paper is to introduce another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. We consider the following promise problem, which we call Probability Distribution Distinguishability with Maximum Norm (PDD-Max):

Problem (PDD-Max): Given a classical description of two quantum circuits $U_{1}$ and $U_{2}$ acting on $N$ qubits that consist of $p o l y (N)$ number of elementary gates, and parameters $a$ and $b$ such that $0 \leq b < a \leq 1$ and $a - b \geq 1 / p o l y (N)$ , decide

YES: there exists $z \in {0, 1}^{N}$ such that $| p_{z} - q_{z} | \geq a$ .
NO: for any $z \in {0, 1}^{N}$ , $| p_{z} - q_{z} | \leq b$ .

Here, $p_{z} \equiv | ⟨ z | U_{1} | 0^{N} ⟩ |^{2}$ and $q_{z} \equiv | ⟨ z | U_{2} | 0^{N} ⟩ |^{2}$ .

We first show that PDD-Max is BQP-complete (Sec. II). We next show that if $U_{1}$ and $U_{2}$ are some types of circuits in FH $_{2}$ (such as IQP circuits, and circuits in Fig. 1(a) and (c)), PDD-Max is in MA with Merlin who is enough to be BQP for yes instances (Sec. III). This result demonstrates that PDD-Max with the restriction in FH $_{2}$ is another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. This result also suggests that PDD-Max with the FH $_{2}$ restriction is not BQP-hard, since BQP is not believed to be in MA.

FH $_{2}$ contains many important quantum circuits. For example, Simon’s algorithm Simon and Shor’s factoring algorithm Shor use such circuits. Furthermore, the IQP model BJS ; BMS is also in FH $_{2}$ . The IQP model is a well-known example of sub-universal quantum computing models whose output probability distributions cannot be classically efficiently sampled unless the polynomial-time hierarchy collapses. Other sub-universal models that exhibit similar quantum supremacy are also known, such as the depth four model TD , the Boson sampling model AA , the DQC1 model KL ; MFF ; M ; Kobayashi ; KobayashiICALP , the Fourier sampling model BU , and the conjugated Clifford model AFK .

The second main result of the present paper is to add another simple model in FH $_{2}$ to the above list of sub-universal models. Let us consider the following model, which we call the Hadamard-classical circuit with one-qubit (HC1Q) model (see Fig. 1(a)):

The initial state is $| 0^{N} ⟩$ .
$H^{\otimes (N - 1)} \otimes I$ is applied, where $H$ is the Hadamard gate.
A polynomial-time uniformly-generated classical reversible circuit

$C : {0, 1}^{N} ∋ w \mapsto C (w) \in {0, 1}^{N}$

is applied “coherently”.
$H^{\otimes (N - 1)} \otimes I$ is applied.
All qubits are measured in the computational basis.

Figure 1: (a) The HC1Q model. $M$ is the computational-basis measurement. A single line with the slash represents a set of $N - 1$ qubits. The Hadamard gate $H$ is applied on each qubit. The measurement $M$ is done on each qubit. (b) The circuit similar to HC1Q model, but the last $| 0 ⟩$ qubit is removed. (c) A generalization of (a).

We show that the HC1Q model is universal with a postselection. More precisely, we show the following statement: Let $U$ be a polynomial-time uniformly-generated quantum circuit acting on $n$ qubits that consists of $p o l y (n)$ number of Hadamard gates and classical reversible gates, such as $X$ , CNOT, and Toffoli. The HC1Q model of Fig. 1(a) for $N = p o l y (n)$ equipped with a postselection can generate the state $U | 0^{n} ⟩$ .

Its proof is given in Sec. IV. The proof is based on a new idea that is different from those used in the previous results TD ; BJS ; AA ; MFF . Proofs for the depth-four model TD , the Boson sampling model AA , and the IQP model BJS use gadgets that can insert some gates in a post hoc way by using a postselection. The proof for the DQC1 model MFF uses a postselection to initialize the maximally-mixed state $I^{\otimes n} / 2^{n}$ to the pure state $| 0^{n} ⟩$ . As we will see later, our proof is different from those: we first construct a polynomial-time non-deterministic algorithm that simulates the action of $U$ on $| 0^{n} ⟩$ . We then show that the polynomial-time non-deterministic algorithm is simulated by the HC1Q model with a postselection. This new idea itself seems to be useful for other applications.

An immediate corollary of the result is quantum supremacy of the HC1Q model: Output probability distributions of the HC1Q model of Fig. 1(a) cannot be classically efficiently sampled with a multiplicative error $ϵ < 1$ unless the polynomial-time hierarchy collapses to the third level. Here, we say that a probability distribution ${p_{z}}_{z}$ is classically efficiently sampled with a multiplicative error $ϵ$ if there exists a classical polynomial-time sampler such that

| p_{z} - q_{z} | \leq ϵ p_{z}

for all $z$ , where $q_{z}$ is the probability that the classical sampler outputs $z$

. This result demonstrates an interesting “phase transition” between classical and quantum. To see it, let us consider the circuit of Fig.

1(b), which is obtained by removing the last

| 0 ⟩

qubit of Fig. 1(a). Here,

C^{'} : {0, 1}^{N - 1} ∋ w \mapsto C^{'} (w) \in {0, 1}^{N - 1}

is a polynomial-time uniformly-generated classical reversible circuit. The circuit of Fig. 1(b) is trivially classically simulatable, since $C^{'}$ is a permutation on ${0, 1}^{N - 1}$ and therefore

C^{'} | + ⟩^{\otimes (N - 1)} = \frac{1}{\sqrt{2^{N - 1}}} \sum x \in {0, 1}^{N - 1} | C^{'} (x) ⟩ = | + ⟩^{\otimes (N - 1)},

where $| + ⟩ \equiv (| 0 ⟩ + | 1 ⟩) / \sqrt{2}$ . Our result therefore suggests that the addition of a single $| 0 ⟩$ qubit to the trivial circuit of Fig. 1(b) changes its complexity dramatically.

The third level collapse of the polynomial-time hierarchy for the depth-four model, the Boson sampling model, the IQP model, and the DQC1 model can be improved to the second level collapse Kobayashi ; KobayashiICALP . In Sec. IV, we show that the same improvement is possible for the HC1Q model of Fig. 1(a).

It is known that for the $N$ -qubit IQP model probability distributions of measurement results on $O (log (N))$ number of qubits can be classically exactly sampled in polynomial time BJS . In Sec. V we show analogous results for our models of Fig. 1(a) and (c): probability distributions of measurement results on $O (log (N))$ number of qubits in these models can be classically sampled in polynomial time with a $1 / p o l y (N)$ L1-norm error.

Ii BQP completeness

In this section, we show that PDD-Max is BQP-complete. We first show that PDD-Max is BQP-hard. Let $A = (A_{y e s}, A_{n o})$ be a promise problem in BQP. Let $V_{x}$ be the polynomial-time quantum circuit, which acts on $n$ qubits, corresponding to the instance $x$ . If we write $V_{x} | 0^{n} ⟩$ as

V_{x} | 0^{n} ⟩ = \sqrt{α} | 0 ⟩ \otimes | ϕ_{0} ⟩ + \sqrt{1 - α} | 1 ⟩ \otimes | ϕ_{1} ⟩

with certain $n - 1$ qubit states $| ϕ_{0} ⟩$ and $| ϕ_{1} ⟩$ , we have $α \geq 1 - 2^{- r}$ when $x \in A_{y e s}$ , and $α \leq 2^{- r}$ when $x \in A_{n o}$ , where $r$ is any polynomial. We consider the circuit of Fig. 2 as $U_{1}$ in PDD-Max. The state immediately before the measurement is

\sqrt{α} | 0 ⟩ \otimes | 0^{m} ⟩ \otimes V_{x}^{†} (| 0 ⟩ \otimes | ϕ_{0} ⟩) + \sqrt{1 - α} | 1 ⟩ \otimes | + ⟩^{\otimes m} \otimes V_{x}^{†} (| 1 ⟩ \otimes | ϕ_{1} ⟩) .

When $x \in A_{y e s}$ , the probability of obtaining the measurement result $0^{n + m + 1}$ is

p_{0^{n + m + 1}} = α | ⟨ 0^{n} | V_{x}^{†} (| 0 ⟩ \otimes | ϕ_{0} ⟩) |^{2} = α^{2} \geq (1 - 2^{- r})^{2} .

When $x \in A_{n o}$ , the probability of obtaining the measurement result $0 z$ , where $z \in {0, 1}^{n + m}$ , is

p_{0 z} = α ∣ ∣ ⟨ z | [| 0^{m} ⟩ \otimes V_{x}^{†} (| 0 ⟩ \otimes | ϕ_{0} ⟩)] {∣ ∣}^{2} \leq α \leq 2^{- r},

and the probability of obtaining the measurement result $1 z$ , where $z \in {0, 1}^{n + m}$ , is

p_{1 z} = 2^{- m} (1 - α) | ⟨ z_{m + 1}, . . ., z_{n + m} | V_{x}^{†} (| 1 ⟩ \otimes | ϕ_{1} ⟩) |^{2} \leq 2^{- m} .

Therefore, when $x \in A_{y e s}$ ,

∣ ∣ p_{0^{n + m + 1}} - \frac{1}{2^{n + m + 1}} ∣ ∣ \geq (1 - 2^{- r})^{2} - 2^{- (n + m + 1)},

and when $x \in A_{n o}$ ,

	$∣ ∣ p_{z} - \frac{1}{2^{n + m + 1}} ∣ ∣$	$\leq$	$p_{z} + \frac{1}{2^{n + m + 1}}$
		$\leq$	$max (2^{- m}, 2^{- r}) + 2^{- (n + m + 1)}$

for any $z \in {0, 1}^{n + m + 1}$ . Hence if we take $U_{2}$ such that ${q_{z}}_{z}$ is the uniformly random distribution, $A$ is BQP-hard.

Figure 2: A circuit to show the BQP hardness.

We next show that PDD-Max is in BQP. To show it, we use the following well known result.

Chernoff-Hoeffding bound: Let $X_{1}, . . ., X_{T}$

be i.i.d. real random variables with

| X_{i} | \leq 1

for every

i = 1, . . ., T

. Then

We show that the following BQP protocol solves PDD-Max with a $1 / p o l y (N)$ completeness-soundness gap (i.e., the gap of acceptance probabilities between the yes-instances and the no-instances is lowerbounded by $1 / p o l y (N)$ ):

Flip a fair coin $s \in {0, 1}$ . Generate $U_{s + 1} | 0^{N} ⟩$ , and measure each qubit in the computational basis. Let $z \in {0, 1}^{N}$ be the measurement result.
Run the SWAP test (Fig. 3) between $U_{1} | 0^{N} ⟩$ and $| z ⟩$ for $T$ times, where $T$ is a polynomial of $N$ specified later. Let $m_{j} \in {0, 1}$ be the measurement result of the $j$ th run, where $j = 1, 2, . . ., T$ . Calculate

${~ p}_{z} \equiv \frac{1}{T} T \sum j = 1 (- 1)^{m_{j}} .$

From the Chernoff-Hoeffding bound, $| {~ p}_{z} - p_{z} | \leq ϵ$ with probability larger than $1 - 2 e^{- \frac{T ϵ^{2}}{2}}$ , where $p_{z} \equiv | ⟨ z | U_{1} | 0^{N} ⟩ |^{2}$
. In a similar way, calculate the estimator
${~ q}_{z}$ of $q_{z} \equiv | ⟨ z | U_{2} | 0^{N} ⟩ |^{2}$ .
Calculate $| {~ p}_{z} - {~ q}_{z} |$ . If $| {~ p}_{z} - {~ q}_{z} | \geq a - \frac{a - b}{4}$ , accept. Otherwise, reject.

Figure 3: The SWAP test between $| ψ ⟩$ and $| ϕ ⟩$ . “SWAP” in the circuit means the SWAP gate that exchanges two quantum states as $| ψ ⟩ \otimes | ϕ ⟩ \to | ϕ ⟩ \otimes | ψ ⟩$ . The expectation value of $(- 1)^{m}$ for the measurement result $m$ is $| ⟨ ψ | ϕ ⟩ |^{2}$ .

First, let us consider the case when the answer to PDD-Max is YES. If $z$ obtained in step 1 satisfies $| p_{z} - q_{z} | \geq a$ , and if ${~ p}_{z}$ and ${~ q}_{z}$ satisfy $| {~ p}_{z} - p_{z} | \leq \frac{a - b}{8}$ and $| {~ q}_{z} - q_{z} | \leq \frac{a - b}{8}$ , we definitely accept. The probability $η$ of occurring such an event is lowerbounded as

$η$	$\equiv$	$(\sum z : \| p_{z} - q_{z} \| \geq a \frac{p_{z} + q_{z}}{2}) \times P r [\| {~ p}_{z} - p_{z} \| \leq \frac{a - b}{8}] \times P r [\| {~ q}_{z} - q_{z} \| \leq \frac{a - b}{8}]$
	$\geq$	$\frac{a}{2} (1 - 2 e^{- \frac{T (a - b)^{2}}{128}})^{2}$
	$\geq$	$\frac{a}{2} (1 - 2 e^{- k})^{2},$

where we have taken $T \geq \frac{128 k}{(a - b)^{2}}$ and $k$ is any polynomial of $N$ . Therefore, the acceptance probability $p_{a c c}$ of our protocol is lowerbounded as

p_{a c c} \geq η \geq \frac{a}{2} (1 - 2 e^{- k})^{2} .

Next, let us consider the case when the answer to PDD-Max is NO. If $| {~ p}_{z} - p_{z} | \leq \frac{a - b}{8}$ and $| {~ q}_{z} - q_{z} | \leq \frac{a - b}{8}$ , which occurs with probability $\geq (1 - 2 e^{- k})^{2}$ , we definitely reject. The rejection probability $p_{r e j}$ is therefore lowerbounded as

p_{r e j} \geq (1 - 2 e^{- k})^{2} .

Therefore, the acceptance probability $p_{a c c}$ is upperbounded as

p_{a c c} = 1 - p_{r e j} \leq 1 - (1 - 2 e^{- k})^{2} = 4 e^{- k} - 4 e^{- 2 k} .

The completeness-soundness gap is therefore

\frac{a}{2} (1 - 2 e^{- k})^{2} - (4 e^{- k} - 4 e^{- 2 k}) \geq \frac{1}{p o l y (N)}

for sufficiently large $k$ , which shows that PDD-Max is in BQP.

Iii Restriction to FH $_{2}$ circuits

In this section, we show that if $U_{1}$ and $U_{2}$ are restricted to some circuits in FH $_{2}$ , PDD-Max is in MA with honest BQP Merlin. We mean that a promise problem $A$ is in MA with honest BQP Merlin, if $A$ is in MA, and the prover (honest Merlin) that makes the verifier (Arthur) accept with high probability for the yes-instances is a BQP prover.

To understand our idea, we first restrict $U_{1}$ and $U_{2}$ to be circuits in the form of Fig. 1(a). Similar results are obtained for other circuits in FH $_{2}$ , such as IQP circuits and the Simon type ones. These generalizations are discussed at the end of this section.

Our MA protocol with honest BQP Merlin runs as follows.

If Merlin is honest, he flips a fair coin $s \in {0, 1}$ . He next generates $U_{s + 1} | 0^{N} ⟩$ , and measures each qubit in the computational basis to obtain the result $z \in {0, 1}^{N}$ . He sends $z$ to Arthur. If Merlin is malicious, his computational ability is unbounded, and what he sends to Arthur can be any $N$ bit string.
Let $T$ be a polynomial of $N$ specified later. Arthur generates ${x^{i}}_{i = 1}^{T}$ and ${y^{i}}_{i = 1}^{T}$ , where each of $x^{i} \in {0, 1}^{N - 1}$ and $y^{i} \in {0, 1}^{N - 1}$ is a uniformly and independently chosen random $N - 1$ bit string.
Arthur calculates

${~ p}_{z} \equiv \frac{1}{T} T \sum i = 1 f (x^{i}, y^{i}),$

where

$f (x, y) \equiv (- 1)^{\sum_{j = 1}^{N - 1} [C_{j} (x 0) \cdot z_{j} + C_{j} (y 0) \cdot z_{j}]} δ_{C_{N} (x 0), z_{N}} δ_{C_{N} (y 0), z_{N}} .$

Here,

$C : {0, 1}^{N} ∋ w \mapsto C (w) \in {0, 1}^{N}$

is the classical circuit in $U_{1}$ ,

$x 0 \equiv (x_{1}, . . ., x_{N - 1}, 0),$

$C_{j} (x 0)$ is the $j$ th bit of $C (x 0) \in {0, 1}^{N}$ , and $z_{j}$ is the $j$ th bit of $z \in {0, 1}^{N}$ . We call ${~ p}_{z}$ the estimator of $p_{z}$ . Note that ${~ p}_{z}$ can be calculated in classical $p o l y (N)$ time.
In a similar way, Arthur calculates the estimator ${~ q}_{z}$ of $q_{z}$ . If

$| {~ p}_{z} - {~ q}_{z} | \geq a - \frac{a - b}{4},$

Arthur accepts. Otherwise, he rejects.

Note that $p_{z}$ is given as

p_{z}

=

\frac{1}{2^{2 (N - 1)}} \sum x, y \in {0, 1}^{N - 1} f (x, y) .

Therefore, from the Chernoff-Hoeffding bound, the estimator ${~ p}_{z}$ satisfies $| {~ p}_{z} - p_{z} | \leq ϵ$ with probability $\geq 1 - 2 e^{- \frac{T ϵ^{2}}{2}}$ . For ${~ q}_{z}$ , a similar result holds. It is easy to check that the honest prover is a BQP prover in the above protocol.

Now we show that the above protocol can verify PDD-Max. The proof is similar to that for the BQP case given in Sec. II.

First, let us consider the case when the answer to PDD-Max is yes. If the $z$ that Merlin sends to Arthur satisfies $| p_{z} - q_{z} | \geq a$ , and the ${~ p}_{z}$ and ${~ q}_{z}$ that Arthur calculates satisfy $| {~ p}_{z} - p_{z} | \leq \frac{a - b}{8}$ and $| {~ q}_{z} - q_{z} | \leq \frac{a - b}{8}$ , Arthur definitely accepts. Taking the honest prover in step 1, the probability $η$ of occurring such an event is lowerbounded as

	$η$	$\equiv$	$(\sum z : \| p_{z} - q_{z} \| \geq a \frac{p_{z} + q_{z}}{2}) \times P r [\| {~ p}_{z} - p_{z} \| \leq \frac{a - b}{8}] \times P r [\| {~ q}_{z} - q_{z} \| \leq \frac{a - b}{8}]$
		$\geq$	$\frac{a}{2} (1 - 2 e^{- \frac{T (a - b)^{2}}{128}})^{2} \geq \frac{a}{2} (1 - 2 e^{- k})^{2},$

where we have taken $T \geq \frac{128 k}{(a - b)^{2}}$ and $k$ is any polynomial of $N$ . Therefore, the probability $p_{a c c}$ that Arthur accepts in our protocol is lowerbounded as

p_{a c c} \geq \frac{a}{2} (1 - 2 e^{- k})^{2} .

Next, let us consider the case when the answer to PDD-Max is no. If $| {~ p}_{z} - p_{z} | \leq \frac{a - b}{8}$ and $| {~ q}_{z} - q_{z} | \leq \frac{a - b}{8}$ , which occurs with probability $\geq (1 - 2 e^{- k})^{2}$ , Arthur definitely rejects. Therefore, the probability $p_{a c c}$ that Arthur accepts in our protocol is upperbounded as

p_{a c c} \leq 1 - (1 - 2 e^{- k})^{2} = 4 e^{- k} - 4 e^{- 2 k} .

The completeness-soundness gap is therefore

\frac{a}{2} (1 - 2 e^{- k})^{2} - (4 e^{- k} - 4 e^{- 2 k}) \geq \frac{1}{p o l y (N)}

for sufficiently large $k$ , which shows that PDD-Max is in MA with honest BQP Merlin.

From the proof, it is clear that similar results hold for other circuits in FH $_{2}$ whose $f (x, y)$ is bounded by at most $p o l y (N)$ and calculatable in classical polynomial time (in $| x |$ , $| y |$ , and $| z |$ ). For example, let us consider the IQP model. For the IQP model, $f (x, y)$ is a complex-valued function, but we can use the Chernoff-Hoeffding bound for complex random variables introduced in Ref. NestSchwarz .

The other example is Fig. 1(c). The model of Fig. 1(a) uses only one single ancilla qubit that is not rotated by $H$ . The model of Fig. 1(c) is a generalization of Fig. 1(a) so that $m = p o l y (N)$ ancilla qubits initialized in $| 0 ⟩$ are available. Such a circuit is used, for example, in the Simon’s algorithm Simon . We can show a similar result for such a circuit. In fact, the probability $p_{s, t}$ of obtaining the result $(s, t) \in {0, 1}^{N - m} \times {0, 1}^{m}$ is

p_{s, t} = \frac{1}{2^{2 (N - m)}} \sum x, y \in {0, 1}^{N - m} (- 1)^{C_{1, . . ., N - m} (x 0^{m}) \cdot s + C_{1, . . ., N - m} (y 0^{m}) \cdot s} δ_{t, C_{N - m + 1, . . ., N} (x 0^{m})} δ_{t, C_{N - m + 1, . . ., N} (y 0^{m})},

and therefore the Chernoff-Hoeffding bound argument can be used. Here, $C_{1, . . ., N - m} (x 0^{m})$ is the first $N - m$ bits of $C (x 0^{m})$ , and $C_{N - m + 1, . . ., N} (y 0^{m})$ is the last $m$ bits of $C (x 0^{m})$ .

Iv Quantum supremacy of our model

In this section, we provide the results on quantum supremacy of the HC1Q model in Fig. 1 (a). First we show that the model is universal with a postselection. We are given a unitary operator

U = u_{t} . . . u_{2} u_{1}

acting on $n$ qubits, where $u_{i}$ is $H$ or a classical gate for all $i = 1, 2, . . ., t$ . From $U$ , we define

U^{'} \equiv u_{t + n} . . . u_{t + 1} U,

where $u_{t + i}$ is $H$ acting on $i$ th qubit ( $i = 1, 2, . . ., n$ ). Let us consider the following polynomial-time non-deterministic algorithm, which “simulates” the action of $U^{'}$ on $| 0^{n} ⟩$ . We represent the state of the register of the polynomial-time non-deterministic computing by $| s ⟩ \otimes | z ⟩$ , where $s \in {0, 1}$ and $z \in {0, 1}^{n}$ . (Note that using the ket notation to represent the state of the register of the polynomial-time non-deterministic computing is just for convenience. The polynomial-time non-deterministic computing is, of course, not quantum computing.)

The initial state of the register is $| s = 0 ⟩ \otimes | z = 0^{n} ⟩$ .
Repeat the following for $i = 1, . . ., t + n$ .
- If $u_{i}$ is a classical gate
  
  $g : {0, 1}^{n} ∋ z \mapsto g (z) \in {0, 1}^{n},$
  
  we update the state of the register as
  
  $| s ⟩ \otimes | z ⟩ \to | s ⟩ \otimes | g (z) ⟩ .$
- If $u_{i}$ is $H$ acting on $j$ th qubit, we update the state of the register in the following non-deterministic way:

Let us define $h$ by

h \equiv ∣ ∣ {i \in {1, 2, . . ., t + n} | u_{i} = H} ∣ ∣,

i.e., $h$ is the number of $H$ appearing in $U^{'}$ . The above polynomial-time non-deterministic algorithm does the non-deterministic transition $h$ times, and therefore the algorithm has $2^{h}$ computational paths. We label each path by an $h$ -bit string $y \in {0, 1}^{h}$ . We write the final state of the register for the path $y \in {0, 1}^{h}$ by $| s (y) ⟩ \otimes | z (y) ⟩$ , where $s (y) \in {0, 1}$ and $z (y) \in {0, 1}^{n}$ . For each $y$ , we can calculate $s (y)$ and $z (y)$ in classical polynomial-time. Let $W$ be a classical circuit that calculates $s (y)$ and $z (y)$ on input $y$ . It is obvious that

U^{'} | 0^{n} ⟩ = \frac{1}{\sqrt{2^{h}}} \sum y \in {0, 1}^{h} (- 1)^{s (y)} | z (y) ⟩ .

Now we show that the state $H^{\otimes n} U^{'} | 0^{n} ⟩ = U | 0^{n} ⟩$ can be generated by the HC1Q model with a postselection. Let us consider the quantum circuit of Fig. 4. It is easy to show that the state immediately before the postselection is

\frac{1}{\sqrt{2^{n + h + 1}}} \sum y \in {0, 1}^{h} (H^{\otimes h} | y ⟩) \otimes (H | s (y) ⟩) \otimes (H^{\otimes n} | z (y) ⟩) \otimes | 1 ⟩ + | ψ ⟩ \otimes | 0 ⟩,

(1)

where $| ψ ⟩$ is a certain $(h + n + 1)$ -qubit state whose detail is irrelevant keep . After the postselection, the state becomes

\frac{1}{\sqrt{2^{h}}} \sum y \in {0, 1}^{h} (- 1)^{s (y)} H^{\otimes n} | z (y) ⟩ = H^{\otimes n} U^{'} | 0^{n} ⟩ = U | 0^{n} ⟩ .

In this way, we have shown that the HC1Q model is universal with a postselection.

Figure 4: The quantum circuit with a postselection. The first $h$ qubits, the $(h + 1)$ th qubit, and the last qubit are postselected to $| 0^{h} ⟩$ , $| 1 ⟩$ , and $| 1 ⟩$ , respectively.

By combining the above result with the well-known technique BJS ; AA ; MFF , we can show that the output probability distribution of the HC1Q model cannot be classically efficiently sampled with a multiplicative error $ϵ < 1$ unless the polynomial-time hierarchy collapses to the third level.

It was shown in Refs. Kobayashi ; KobayashiICALP that the third level collapse of the polynomial-time hierarchy for most of the sub-universal models (including the depth-four model TD , the Boson sampling model AA , the IQP model BJS , and the DQC1 model MFF ) is improved to the second level collapse. The idea is to use the class NQP NQP in stead of postBQP. NQP is a quantum version of NP, and defined as follows.

Definition: A promise problem $A = (A_{y e s}, A_{n o})$ is in NQP if and only if there exists a polynomial-time uniformly-generated family ${V_{x}}_{x}$ of quantum circuits such that if $x \in A_{y e s}$ then $p_{a c c} > 0$ , and if $x \in A_{n o}$ then $p_{a c c} = 0$ . Here $p_{a c c}$ is the acceptance probability of $V_{x}$ .

By using a similar argument of Refs. Kobayashi ; KobayashiICALP , we now show that the collapse of the polynomial-time hierarchy to the third level for the HC1Q model can be improved to that to the second level. In stead of doing the postselection, let us do the projective measurement ${Λ, I^{\otimes h + n + 2} - Λ}$ on the state of Eq. (1). If $Λ$ is obtained, we accept. Here,

Λ \equiv | 0 ⟩ ⟨ 0 |^{\otimes h} \otimes | 1 ⟩ ⟨ 1 | \otimes | 0 ⟩ ⟨ 0 | \otimes I^{\otimes n - 1} \otimes | 1 ⟩ ⟨ 1 | .

The acceptance probability $p_{a c c}$ is

p_{a c c} = \frac{⟨ 0^{n} | U^{†} (| 0 ⟩ ⟨ 0 | \otimes I^{\otimes n - 1}) U | 0^{n} ⟩}{2^{h + n + 2}} .

Let us assume that a promise problem $A = (A_{y e s}, A_{n o})$ is in NQP. Then there exists a polynomial-time uniformly-generated family ${V_{x}}_{x}$ of quantum circuits that satisfies the above definition of NQP. For an instance $x$ , let us take $U$ as $V_{x}$ . Assume that $p_{a c c}$ is classically efficiently sampled with a multiplicative error $ϵ < 1$ . It means that there exists a classical polynomial-time computer such that

| p_{a c c} - q_{a c c} | \leq ϵ p_{a c c},

where $q_{a c c}$ is the probability that the classical computer accepts. If $x \in A_{y e s}$ then

q_{a c c} \geq (1 - ϵ) p_{a c c} > 0.

If $x \in A_{n o}$ then

q_{a c c} \leq (1 + ϵ) p_{a c c} = 0.

$A$ is therefore in NP. Hence $N Q P \subseteq N P$ , which leads to the collapse of the polynomial-time hierarchy to the second level Kobayashi :

P H \subseteq B P \cdot {c o C}_{=} P = B P \cdot N Q P = B P \cdot N P = A M .

V Classical simulatability

In this section, we show that probability distributions of measurement results on $k = O (log (N))$ qubits of Fig. 1(a) and (c) can be classically sampled in polynomial time with a $1 / p o l y (N)$ L1-norm error.

For simplicity, a proof is given for the model of Fig. 1(a). The same proof works for the model of Fig. 1(c). Furthermore, for simplicity, we assume that the first $k$ qubits are measured. Generalizations to other $k$ qubits are easy. Let $z \in {0, 1}^{k}$ be the measurement result. By a straightforward calculation, the probability of obtaining $z$ is

p_{z} = \frac{1}{2^{N - 1}} \sum x \in {0, 1}^{N - 1} f (x),

where

	$f (x)$	$\equiv$	$\frac{1}{2^{k}} \sum y \in {0, 1}^{N - 1} (- 1)^{z \cdot C_{1, . . ., k} (x 0) + z \cdot C_{1, . . ., k} (y 0)} δ_{C_{k + 1, . . ., N} (x 0), C_{k + 1, . . ., N} (y 0)}$
		$=$	$\frac{1}{2^{k}} \sum y \in S (- 1)^{z \cdot C_{1, . . ., k} (x 0) + z \cdot C_{1, . . ., k} (y 0)},$

and $S \subseteq {0, 1}^{N - 1}$ is defined by

S

\equiv

{y \in {0, 1}^{N - 1} | C_{k + 1, . . ., N} (x 0) = C_{k + 1, . . ., N} (y 0)} .

The subset $S$ can be obtained in polynomial time in the following way:

Set $S = {}$ .
Repeat the following for all $α \in {0, 1}^{k}$ .
- Calculate $C^{- 1} (α C_{k + 1, . . ., N} (x 0))$ .
- If $C^{- 1} (α C_{k + 1, . . ., N} (x 0)) = y 0$ for certain $y \in {0, 1}^{N - 1}$ , add $y$ to $S$ .
End.

From the construction, $| S | \leq 2^{k} = p o l y (N)$ . Therefore, the value of $f (x)$ is exactly computable in polynomial time for each $x$ . Furthermore, $| f (x) | \leq 1$ because

| f (x) | \leq \frac{1}{2^{k}} \sum y \in S | (- 1)^{z \cdot C_{1, . . ., k} (x 0) + z \cdot C_{1, . . ., k} (y 0)} | \leq 1.

By using the Chernoff-Hoeffding bound, we can calculate the estimator ${~ p}_{z}$ of $p_{z}$ that satisfies

P r [| {~ p}_{z} - p_{z} | \leq ϵ] \geq 1 - 2 e^{- \frac{T ϵ^{2}}{2}}

in time $p o l y (T)$ .

For any polynomial $r$ , let us take $ϵ = \frac{1}{5 \times 2^{2 k} r}$ . Given ${{~ p}_{z}}_{z}$ , define the probability distribution ${q_{z}}_{z}$ by

q_{z} \equiv \frac{| {~ p}_{z} |}{\sum_{z \in {0, 1}^{k}} | {~ p}_{z} |} .

Note that it is well defined, because

\sum z \in {0, 1}^{k} | {~ p}_{z} | > 0,

which is shown as follows:

\sum z \in {0, 1}^{k} | {~ p}_{z} | \geq \sum z \in {0, 1}^{k} {~ p}_{z} \geq \sum z \in {0, 1}^{k} (p_{z} - ϵ) = 1 - 2^{k} ϵ = 1 - \frac{1}{5 \times 2^{k} r} > 0.

Furthermore, ${q_{z}}_{z}$ is obtained in polynomial time. The distance between ${p_{z}}_{z}$ and ${q_{z}}_{z}$ is

\sum z \in {0, 1}^{k} | p_{z} - q_{z} | \leq 5 \times 2^{2 k} ϵ = \frac{1}{r} .

It is shown as follows. First,

$q_{z}$	$=$	$\frac{\| {~ p}_{z} \|}{\sum_{z \in {0, 1}^{k}} \| {~ p}_{z} \|}$
	$\leq$	$\frac{p_{z} + ϵ}{1 - 2^{k} ϵ}$
	$=$	$(p_{z} + ϵ) (1 + 2^{k} ϵ + o (2^{k} ϵ))$
	$=$	$p_{z} + p_{z} 2^{k} ϵ + p_{z} o (2^{k} ϵ) + ϵ + 2^{k} ϵ^{2} + ϵ o (2^{k} ϵ)$
	$\leq$	$p_{z} + 5 \times 2^{k} ϵ .$

Second,

$q_{z}$	$=$	$\frac{\| {~ p}_{z} \|}{\sum_{z \in {0, 1}^{k}} \| {~ p}_{z} \|}$
	$\geq$	$\frac{p_{z} - ϵ}{1 + 2^{k} ϵ}$
	$=$	$(p_{z} - ϵ) (1 - 2^{k} ϵ + o (2^{k} ϵ))$
	$=$	$p_{z} - p_{z} 2^{k} ϵ + p_{z} o (2^{k} ϵ) - ϵ + 2^{k} ϵ^{2} - ϵ o (2^{k} ϵ)$
	$\geq$	$p_{z} - 5 \times 2^{k} ϵ .$

We finally show that ${q_{z}}_{z}$ can be sampled in classical polynomial time. For simplicity, let us assume that each $q_{z}$ is represented in the $m$ -bit binary:

q_{z} = m \sum j = 1 2^{- j} a_{z, j},

where $a_{z, j} \in {0, 1}$ for $j = 1, 2, . . ., m$ . (Otherwise, by polynomially increasing the size of $m$ , we obtain exponentially good approximations.) The following algorithm samples the probability distribution ${q_{z}}_{z}$ .

Randomly generate an $m$ -bit string $(w_{1}, . . ., w_{m}) \in {0, 1}^{m}$ .
Output $z \in {0, 1}^{k}$ such that

$\sum y < z q_{y} \leq m \sum j = 1 2^{- j} w_{j} < \sum y \leq z q_{y},$

where $y < z$ and $y \leq z$ mean the standard dictionary order. (For example, for three bits, $000 < 001 < 010 < 011 < 100 < 101 < 110 < 111$ .)

Acknowledgements.

We thank Keisuke Fujii, Seiichiro Tani, and Francois Le Gall for discussion. TM is supported by JST ACT-I No.JPMJPR16UP, JST PRESTO, and the Grant-in-Aid for Young Scientists (B) No.JP17K12637 of JSPS. YT is supported by the Program for Leading Graduate Schools: Interactive Materials Science Cadet Program and JSPS Grant-in-Aid for JSPS Research Fellow No.JP17J03503. HN is supported by the Grant-in-Aid for Scientific Research (A) Nos.26247016, 16H01705 and (C) No.16K00015 of JSPS.

References

(1) BQP is the class of promise problems that can be solved in quantum polynomial time. Here, a promise problem is a problem that can be answered by YES or NO under some promised conditions. A BQP prover is a prover whose computational ability is quantum polynomial-time. BPP is the class of promise problems that can be solved in classical probabilistic time. A BPP verifier is a verifier whose computational ability is classical probabilistic polynomial-time.
(2) D. Aharonov and U. Vazirani, Is quantum mechanics falsifiable? A computational perspective on the foundations of quantum mechanics. arXiv:1206.3686
(3) T. Morimae, D. Nagaj, and N. Schuch, Quantum proofs can be verified using only single-qubit measurements. Phys. Rev. A 93, 022326 (2016).
(4) T. Morimae and J. F. Fitzsimons, Post hoc verification with a single prover. arXiv:1603.06046
(5) J. F. Fitzsimons and E. Kashefi, Unconditionally verifiable blind computation. Phys. Rev. A 96, 012303 (2017).
(6) D. Aharonov, M. Ben-Or, E. Eban, and U. Mahadev, Interactive proofs for quantum computations. arXiv:1704.04487
(7) M. Hayashi and T. Morimae, Verifiable measurement-only blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
(8) A. Broadbent, How to verify quantum computation. arXiv:1509.09180
(9) A. Gheorghiu, T. Kapourniotis, and E. Kashefi, Verification of quantum computation: an overview of existing approaches. arXiv:1709.06984
(10)
M. McKague, Interactive proofs for BQP via self-tested graph states. Theory of Computing
12, 1 (2016).
(11) Z. Ji, Classical verification of quantum proofs. Proceedings of the 48th annual ACM symposium on Theory of Computing (STOC 2016) p.885 (2016).
(12) B. W. Reichardt, F. Unger, and U. Vazirani, Classical command of quantum systems. Nature 496, 456 (2013).
(13) IP is the class of promise problems verified by an interactive proof system with a BPP verifier and a prover with unlimited computational ability.
(14) D. Aharonov and A. Green, A quantum inspired proof of $P^{# P} \subseteq I P$ . arXiv:1710.09078
(15) E. Bernstein and U. Vazirani, Quantum complexity theory. SIAM Journal on Computing 26, 1411 (1997).
(16) M. McKague, Interactive proofs with efficient quantum prover for recursive Fourier sampling. Chicago Journal of Theoretical Computer Science 6, 1 (2012).
(17) T. F. Demarie, Y. Ouyang, and J. F. Fitzsimons, Classical verification of quantum circuits containing few basis changes. arXiv:1612.04914
(18) Y. Shi, Quantum and classical tradeoffs. Theoretical Computer Science 344, 335 (2005).
(19) FH $_{k}$ , the $k$ th level of the Fourier hierarchy, is the class of quantum circuits with $k$ levels of Hadamard gates and all other gates preserving the computational basis.
(20) Merlin-Arthur (MA) is the class of promise problems that can be verified by a BPP verifier and a prover whose computational ability is unlimited. In MA, the prover first sends a bit string to the verifier, and the verifier then does the computing for the verification.
(21) M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011).
(22) M. J. Bremner, A. Montanaro, and D. J. Shepherd, Average-case complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, 080501 (2016).
(23) D. R. Simon, On the power of quantum computation. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.116 (1994).
(24) P. Shor, Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.124 (1994).
(25) B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and Arthur-Merlin games. Quant. Inf. Comput. 4, 134 (2004).
(26) S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of Computing 9, 143 (2013).
(27) E. Knill, and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998).
(28) T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of classically simulating the one clean qubit model. Phys. Rev. Lett. 112, 130502 (2014).
(29) T. Morimae, Hardness of classically sampling one clean qubit model with constant total variation distance error. Phys. Rev. A 96, 040302(R) (2017).
(30) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Impossibility of classically simulating one-clean-qubit computation. arXiv:1409.6777
(31) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Power of quantum computation with few clean qubits. Proceedings of 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016), p.13:1.
(32) B. Fefferman and C. Umans, The power of quantum Fourier sampling. arXiv:1507.05592
(33) A. Bouland, J. F. Fitzsimons, and D. E. Koh, Quantum advantage from conjugated Clifford circuits. arXiv:1709.01805
(34) M. Schwarz and M. Van den Nest, Simulating quantum circuits with sparse output distributions. arXiv:1310.6749
(35) Note that the $(n + 1)$ -qubit Toffoli gate in Fig. 4 can be implemented with a polynomially many Toffoli gates by using ancilla qubits Barenco . It is known that ancilla qubits do not need to be initialized Barenco . Therefore, we can use $| + ⟩$ states as ancilla qubits, which keeps the circuit of Fig. 4 in the form of Fig. 1(a).
(36) A. Barenco, C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. A. Smolin, H. Weinfurter, Elementary gates for quantum computation. Phys. Rev. A 52 3457 (1995).
(37) L. M. Adleman, J. DeMarrais, and M. A. Huang, Quantum Computability. SIAM J. Comput. 26 1524 (1997).

Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

Authors

Fine-grained quantum computational supremacy

Impossibility of blind quantum sampling for classical client

Efficiently generating ground states is hard for postselected quantum computation

StoqMA meets distribution testing

Fine-grained quantum supremacy of the one-clean-qubit model

Quantum Advantage from Conjugated Clifford Circuits

The Expressive Power of Parameterized Quantum Circuits

I Introduction

Ii BQP completeness

Iii Restriction to FH $_{2}$ circuits

Iv Quantum supremacy of our model

V Classical simulatability

Acknowledgements.

References

Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

Authors

Related Research

Fine-grained quantum computational supremacy

Impossibility of blind quantum sampling for classical client

Efficiently generating ground states is hard for postselected quantum computation

StoqMA meets distribution testing

Fine-grained quantum supremacy of the one-clean-qubit model

Quantum Advantage from Conjugated Clifford Circuits

The Expressive Power of Parameterized Quantum Circuits

This week in AI

I Introduction

Ii BQP completeness

Iii Restriction to FH2 circuits

Iv Quantum supremacy of our model

V Classical simulatability

Acknowledgements.

References

Iii Restriction to FH $_{2}$ circuits