I Introduction
It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is “Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier?” defBQP . Answering this question is important not only for practical applications of cloud quantum computing but also for foundations of computer science and quantum physics AharonovVazirani .
Partial solutions to the open problem have been obtained. For example, several verification protocols MNS ; posthoc and verifiable blind quantum computing protocols FK ; Aharonov ; HM ; Broadbent ; Andru_review
demonstrate that if the verifier has a weak quantum ability, such as preparations or measurements of single-qubit quantum states, any BQP problem can be verified with a BQP prover. Furthermore, it is known that if more than two entangling BQP provers who are not communicating with each other are allowed, any BQP problem is verified with a BPP verifier
MattMBQC ; RUV ; Ji . Since BQP is contained in IP, a natural approach to the open problem is to restrict the prover of IP to BQP when the problem is in BQP defIP . In fact, recently, a significant step in this line has been obtained in Ref. AharonovGreen . The authors of Ref. AharonovGreen have constructed a new smart interactive proof system that verifies the value of the trace of operators with a postBQP prover and a BPP verifier.Actually, the answer to the open problem is yes if we consider specific BQP problems. For example, it is known that the recursive Fourier sampling BV has an interactive proof system with a BQP prover and a BPP verifier MattFourier . Its proof is elegant, but so far we do not know how to generalize it to other BQP problems. Furthermore, it was suggested in Ref. Tommaso that a problem of deciding whether there exist some results that occur with high probability or not for circuits in the second level of the Fourier hierarchy (FH) FH ; expFH is verified by a Merlin-Arthur (MA) protocol with Merlin who is BQP in the honest case MA .
The first main result of the present paper is to introduce another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. We consider the following promise problem, which we call Probability Distribution Distinguishability with Maximum Norm (PDD-Max):
Problem (PDD-Max): Given a classical description of two quantum circuits and acting on qubits that consist of number of elementary gates, and parameters and such that and , decide
-
YES: there exists such that .
-
NO: for any , .
Here, and .
We first show that PDD-Max is BQP-complete (Sec. II). We next show that if and are some types of circuits in FH (such as IQP circuits, and circuits in Fig. 1(a) and (c)), PDD-Max is in MA with Merlin who is enough to be BQP for yes instances (Sec. III). This result demonstrates that PDD-Max with the restriction in FH is another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. This result also suggests that PDD-Max with the FH restriction is not BQP-hard, since BQP is not believed to be in MA.
FH contains many important quantum circuits. For example, Simon’s algorithm Simon and Shor’s factoring algorithm Shor use such circuits. Furthermore, the IQP model BJS ; BMS is also in FH. The IQP model is a well-known example of sub-universal quantum computing models whose output probability distributions cannot be classically efficiently sampled unless the polynomial-time hierarchy collapses. Other sub-universal models that exhibit similar quantum supremacy are also known, such as the depth four model TD , the Boson sampling model AA , the DQC1 model KL ; MFF ; M ; Kobayashi ; KobayashiICALP , the Fourier sampling model BU , and the conjugated Clifford model AFK .
The second main result of the present paper is to add another simple model in FH to the above list of sub-universal models. Let us consider the following model, which we call the Hadamard-classical circuit with one-qubit (HC1Q) model (see Fig. 1(a)):
-
The initial state is .
-
is applied, where is the Hadamard gate.
-
A polynomial-time uniformly-generated classical reversible circuit
is applied “coherently”.
-
is applied.
-
All qubits are measured in the computational basis.

We show that the HC1Q model is universal with a postselection. More precisely, we show the following statement: Let be a polynomial-time uniformly-generated quantum circuit acting on qubits that consists of number of Hadamard gates and classical reversible gates, such as , CNOT, and Toffoli. The HC1Q model of Fig. 1(a) for equipped with a postselection can generate the state .
Its proof is given in Sec. IV. The proof is based on a new idea that is different from those used in the previous results TD ; BJS ; AA ; MFF . Proofs for the depth-four model TD , the Boson sampling model AA , and the IQP model BJS use gadgets that can insert some gates in a post hoc way by using a postselection. The proof for the DQC1 model MFF uses a postselection to initialize the maximally-mixed state to the pure state . As we will see later, our proof is different from those: we first construct a polynomial-time non-deterministic algorithm that simulates the action of on . We then show that the polynomial-time non-deterministic algorithm is simulated by the HC1Q model with a postselection. This new idea itself seems to be useful for other applications.
An immediate corollary of the result is quantum supremacy of the HC1Q model: Output probability distributions of the HC1Q model of Fig. 1(a) cannot be classically efficiently sampled with a multiplicative error unless the polynomial-time hierarchy collapses to the third level. Here, we say that a probability distribution is classically efficiently sampled with a multiplicative error if there exists a classical polynomial-time sampler such that
for all , where is the probability that the classical sampler outputs
. This result demonstrates an interesting “phase transition” between classical and quantum. To see it, let us consider the circuit of Fig.
1(b), which is obtained by removing the last qubit of Fig. 1(a). Here,is a polynomial-time uniformly-generated classical reversible circuit. The circuit of Fig. 1(b) is trivially classically simulatable, since is a permutation on and therefore
where . Our result therefore suggests that the addition of a single qubit to the trivial circuit of Fig. 1(b) changes its complexity dramatically.
The third level collapse of the polynomial-time hierarchy for the depth-four model, the Boson sampling model, the IQP model, and the DQC1 model can be improved to the second level collapse Kobayashi ; KobayashiICALP . In Sec. IV, we show that the same improvement is possible for the HC1Q model of Fig. 1(a).
It is known that for the -qubit IQP model probability distributions of measurement results on number of qubits can be classically exactly sampled in polynomial time BJS . In Sec. V we show analogous results for our models of Fig. 1(a) and (c): probability distributions of measurement results on number of qubits in these models can be classically sampled in polynomial time with a L1-norm error.
Ii BQP completeness
In this section, we show that PDD-Max is BQP-complete. We first show that PDD-Max is BQP-hard. Let be a promise problem in BQP. Let be the polynomial-time quantum circuit, which acts on qubits, corresponding to the instance . If we write as
with certain qubit states and , we have when , and when , where is any polynomial. We consider the circuit of Fig. 2 as in PDD-Max. The state immediately before the measurement is
When , the probability of obtaining the measurement result is
When , the probability of obtaining the measurement result , where , is
and the probability of obtaining the measurement result , where , is
Therefore, when ,
and when ,
for any . Hence if we take such that is the uniformly random distribution, is BQP-hard.

We next show that PDD-Max is in BQP. To show it, we use the following well known result.
We show that the following BQP protocol solves PDD-Max with a completeness-soundness gap (i.e., the gap of acceptance probabilities between the yes-instances and the no-instances is lowerbounded by ):
-
Flip a fair coin . Generate , and measure each qubit in the computational basis. Let be the measurement result.
-
Calculate . If , accept. Otherwise, reject.

First, let us consider the case when the answer to PDD-Max is YES. If obtained in step 1 satisfies , and if and satisfy and , we definitely accept. The probability of occurring such an event is lowerbounded as
where we have taken and is any polynomial of . Therefore, the acceptance probability of our protocol is lowerbounded as
Next, let us consider the case when the answer to PDD-Max is NO. If and , which occurs with probability , we definitely reject. The rejection probability is therefore lowerbounded as
Therefore, the acceptance probability is upperbounded as
The completeness-soundness gap is therefore
for sufficiently large , which shows that PDD-Max is in BQP.
Iii Restriction to FH circuits
In this section, we show that if and are restricted to some circuits in FH, PDD-Max is in MA with honest BQP Merlin. We mean that a promise problem is in MA with honest BQP Merlin, if is in MA, and the prover (honest Merlin) that makes the verifier (Arthur) accept with high probability for the yes-instances is a BQP prover.
To understand our idea, we first restrict and to be circuits in the form of Fig. 1(a). Similar results are obtained for other circuits in FH, such as IQP circuits and the Simon type ones. These generalizations are discussed at the end of this section.
Our MA protocol with honest BQP Merlin runs as follows.
-
If Merlin is honest, he flips a fair coin . He next generates , and measures each qubit in the computational basis to obtain the result . He sends to Arthur. If Merlin is malicious, his computational ability is unbounded, and what he sends to Arthur can be any bit string.
-
Let be a polynomial of specified later. Arthur generates and , where each of and is a uniformly and independently chosen random bit string.
-
Arthur calculates
where
Here,
is the classical circuit in ,
is the th bit of , and is the th bit of . We call the estimator of . Note that can be calculated in classical time.
-
In a similar way, Arthur calculates the estimator of . If
Arthur accepts. Otherwise, he rejects.
Note that is given as
Therefore, from the Chernoff-Hoeffding bound, the estimator satisfies with probability . For , a similar result holds. It is easy to check that the honest prover is a BQP prover in the above protocol.
Now we show that the above protocol can verify PDD-Max. The proof is similar to that for the BQP case given in Sec. II.
First, let us consider the case when the answer to PDD-Max is yes. If the that Merlin sends to Arthur satisfies , and the and that Arthur calculates satisfy and , Arthur definitely accepts. Taking the honest prover in step 1, the probability of occurring such an event is lowerbounded as
where we have taken and is any polynomial of . Therefore, the probability that Arthur accepts in our protocol is lowerbounded as
Next, let us consider the case when the answer to PDD-Max is no. If and , which occurs with probability , Arthur definitely rejects. Therefore, the probability that Arthur accepts in our protocol is upperbounded as
The completeness-soundness gap is therefore
for sufficiently large , which shows that PDD-Max is in MA with honest BQP Merlin.
From the proof, it is clear that similar results hold for other circuits in FH whose is bounded by at most and calculatable in classical polynomial time (in , , and ). For example, let us consider the IQP model. For the IQP model, is a complex-valued function, but we can use the Chernoff-Hoeffding bound for complex random variables introduced in Ref. NestSchwarz .
The other example is Fig. 1(c). The model of Fig. 1(a) uses only one single ancilla qubit that is not rotated by . The model of Fig. 1(c) is a generalization of Fig. 1(a) so that ancilla qubits initialized in are available. Such a circuit is used, for example, in the Simon’s algorithm Simon . We can show a similar result for such a circuit. In fact, the probability of obtaining the result is
and therefore the Chernoff-Hoeffding bound argument can be used. Here, is the first bits of , and is the last bits of .
Iv Quantum supremacy of our model
In this section, we provide the results on quantum supremacy of the HC1Q model in Fig. 1 (a). First we show that the model is universal with a postselection. We are given a unitary operator
acting on qubits, where is or a classical gate for all . From , we define
where is acting on th qubit (). Let us consider the following polynomial-time non-deterministic algorithm, which “simulates” the action of on . We represent the state of the register of the polynomial-time non-deterministic computing by , where and . (Note that using the ket notation to represent the state of the register of the polynomial-time non-deterministic computing is just for convenience. The polynomial-time non-deterministic computing is, of course, not quantum computing.)
-
The initial state of the register is .
-
Repeat the following for .
-
If is a classical gate
we update the state of the register as
-
If is acting on th qubit, we update the state of the register in the following non-deterministic way:
-
Let us define by
i.e., is the number of appearing in . The above polynomial-time non-deterministic algorithm does the non-deterministic transition times, and therefore the algorithm has computational paths. We label each path by an -bit string . We write the final state of the register for the path by , where and . For each , we can calculate and in classical polynomial-time. Let be a classical circuit that calculates and on input . It is obvious that
Now we show that the state can be generated by the HC1Q model with a postselection. Let us consider the quantum circuit of Fig. 4. It is easy to show that the state immediately before the postselection is
(1) |
where is a certain -qubit state whose detail is irrelevant keep . After the postselection, the state becomes
In this way, we have shown that the HC1Q model is universal with a postselection.

By combining the above result with the well-known technique BJS ; AA ; MFF , we can show that the output probability distribution of the HC1Q model cannot be classically efficiently sampled with a multiplicative error unless the polynomial-time hierarchy collapses to the third level.
It was shown in Refs. Kobayashi ; KobayashiICALP that the third level collapse of the polynomial-time hierarchy for most of the sub-universal models (including the depth-four model TD , the Boson sampling model AA , the IQP model BJS , and the DQC1 model MFF ) is improved to the second level collapse. The idea is to use the class NQP NQP in stead of postBQP. NQP is a quantum version of NP, and defined as follows.
Definition: A promise problem is in NQP if and only if there exists a polynomial-time uniformly-generated family of quantum circuits such that if then , and if then . Here is the acceptance probability of .
By using a similar argument of Refs. Kobayashi ; KobayashiICALP , we now show that the collapse of the polynomial-time hierarchy to the third level for the HC1Q model can be improved to that to the second level. In stead of doing the postselection, let us do the projective measurement on the state of Eq. (1). If is obtained, we accept. Here,
The acceptance probability is
Let us assume that a promise problem is in NQP. Then there exists a polynomial-time uniformly-generated family of quantum circuits that satisfies the above definition of NQP. For an instance , let us take as . Assume that is classically efficiently sampled with a multiplicative error . It means that there exists a classical polynomial-time computer such that
where is the probability that the classical computer accepts. If then
If then
is therefore in NP. Hence , which leads to the collapse of the polynomial-time hierarchy to the second level Kobayashi :
V Classical simulatability
In this section, we show that probability distributions of measurement results on qubits of Fig. 1(a) and (c) can be classically sampled in polynomial time with a L1-norm error.
For simplicity, a proof is given for the model of Fig. 1(a). The same proof works for the model of Fig. 1(c). Furthermore, for simplicity, we assume that the first qubits are measured. Generalizations to other qubits are easy. Let be the measurement result. By a straightforward calculation, the probability of obtaining is
where
and is defined by
The subset can be obtained in polynomial time in the following way:
-
Set .
-
Repeat the following for all .
-
Calculate .
-
If for certain , add to .
-
-
End.
From the construction, . Therefore, the value of is exactly computable in polynomial time for each . Furthermore, because
By using the Chernoff-Hoeffding bound, we can calculate the estimator of that satisfies
in time .
For any polynomial , let us take . Given , define the probability distribution by
Note that it is well defined, because
which is shown as follows:
Furthermore, is obtained in polynomial time. The distance between and is
It is shown as follows. First,
Second,
We finally show that can be sampled in classical polynomial time. For simplicity, let us assume that each is represented in the -bit binary:
where for . (Otherwise, by polynomially increasing the size of , we obtain exponentially good approximations.) The following algorithm samples the probability distribution .
-
Randomly generate an -bit string .
-
Output such that
where and mean the standard dictionary order. (For example, for three bits, .)
Acknowledgements.
We thank Keisuke Fujii, Seiichiro Tani, and Francois Le Gall for discussion. TM is supported by JST ACT-I No.JPMJPR16UP, JST PRESTO, and the Grant-in-Aid for Young Scientists (B) No.JP17K12637 of JSPS. YT is supported by the Program for Leading Graduate Schools: Interactive Materials Science Cadet Program and JSPS Grant-in-Aid for JSPS Research Fellow No.JP17J03503. HN is supported by the Grant-in-Aid for Scientific Research (A) Nos.26247016, 16H01705 and (C) No.16K00015 of JSPS.References
- (1) BQP is the class of promise problems that can be solved in quantum polynomial time. Here, a promise problem is a problem that can be answered by YES or NO under some promised conditions. A BQP prover is a prover whose computational ability is quantum polynomial-time. BPP is the class of promise problems that can be solved in classical probabilistic time. A BPP verifier is a verifier whose computational ability is classical probabilistic polynomial-time.
- (2) D. Aharonov and U. Vazirani, Is quantum mechanics falsifiable? A computational perspective on the foundations of quantum mechanics. arXiv:1206.3686
- (3) T. Morimae, D. Nagaj, and N. Schuch, Quantum proofs can be verified using only single-qubit measurements. Phys. Rev. A 93, 022326 (2016).
- (4) T. Morimae and J. F. Fitzsimons, Post hoc verification with a single prover. arXiv:1603.06046
- (5) J. F. Fitzsimons and E. Kashefi, Unconditionally verifiable blind computation. Phys. Rev. A 96, 012303 (2017).
- (6) D. Aharonov, M. Ben-Or, E. Eban, and U. Mahadev, Interactive proofs for quantum computations. arXiv:1704.04487
- (7) M. Hayashi and T. Morimae, Verifiable measurement-only blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, 220502 (2015).
- (8) A. Broadbent, How to verify quantum computation. arXiv:1509.09180
- (9) A. Gheorghiu, T. Kapourniotis, and E. Kashefi, Verification of quantum computation: an overview of existing approaches. arXiv:1709.06984
-
(10)
M. McKague, Interactive proofs for BQP via self-tested graph states. Theory of Computing
12, 1 (2016). - (11) Z. Ji, Classical verification of quantum proofs. Proceedings of the 48th annual ACM symposium on Theory of Computing (STOC 2016) p.885 (2016).
- (12) B. W. Reichardt, F. Unger, and U. Vazirani, Classical command of quantum systems. Nature 496, 456 (2013).
- (13) IP is the class of promise problems verified by an interactive proof system with a BPP verifier and a prover with unlimited computational ability.
- (14) D. Aharonov and A. Green, A quantum inspired proof of . arXiv:1710.09078
- (15) E. Bernstein and U. Vazirani, Quantum complexity theory. SIAM Journal on Computing 26, 1411 (1997).
- (16) M. McKague, Interactive proofs with efficient quantum prover for recursive Fourier sampling. Chicago Journal of Theoretical Computer Science 6, 1 (2012).
- (17) T. F. Demarie, Y. Ouyang, and J. F. Fitzsimons, Classical verification of quantum circuits containing few basis changes. arXiv:1612.04914
- (18) Y. Shi, Quantum and classical tradeoffs. Theoretical Computer Science 344, 335 (2005).
- (19) FH, the th level of the Fourier hierarchy, is the class of quantum circuits with levels of Hadamard gates and all other gates preserving the computational basis.
- (20) Merlin-Arthur (MA) is the class of promise problems that can be verified by a BPP verifier and a prover whose computational ability is unlimited. In MA, the prover first sends a bit string to the verifier, and the verifier then does the computing for the verification.
- (21) M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011).
- (22) M. J. Bremner, A. Montanaro, and D. J. Shepherd, Average-case complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, 080501 (2016).
- (23) D. R. Simon, On the power of quantum computation. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.116 (1994).
- (24) P. Shor, Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.124 (1994).
- (25) B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and Arthur-Merlin games. Quant. Inf. Comput. 4, 134 (2004).
- (26) S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of Computing 9, 143 (2013).
- (27) E. Knill, and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998).
- (28) T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of classically simulating the one clean qubit model. Phys. Rev. Lett. 112, 130502 (2014).
- (29) T. Morimae, Hardness of classically sampling one clean qubit model with constant total variation distance error. Phys. Rev. A 96, 040302(R) (2017).
- (30) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Impossibility of classically simulating one-clean-qubit computation. arXiv:1409.6777
- (31) K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Power of quantum computation with few clean qubits. Proceedings of 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016), p.13:1.
- (32) B. Fefferman and C. Umans, The power of quantum Fourier sampling. arXiv:1507.05592
- (33) A. Bouland, J. F. Fitzsimons, and D. E. Koh, Quantum advantage from conjugated Clifford circuits. arXiv:1709.01805
- (34) M. Schwarz and M. Van den Nest, Simulating quantum circuits with sparse output distributions. arXiv:1310.6749
- (35) Note that the -qubit Toffoli gate in Fig. 4 can be implemented with a polynomially many Toffoli gates by using ancilla qubits Barenco . It is known that ancilla qubits do not need to be initialized Barenco . Therefore, we can use states as ancilla qubits, which keeps the circuit of Fig. 4 in the form of Fig. 1(a).
- (36) A. Barenco, C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. A. Smolin, H. Weinfurter, Elementary gates for quantum computation. Phys. Rev. A 52 3457 (1995).
- (37) L. M. Adleman, J. DeMarrais, and M. A. Huang, Quantum Computability. SIAM J. Comput. 26 1524 (1997).
Comments
There are no comments yet.