# Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy

It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is "Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier?". Several partial solutions to the open problem have been obtained. For example, verifiable blind quantum computing protocols demonstrate that if the verifier is slightly quantum, the problem is solved. Furthermore, the answer to the open problem is yes for specific BQP problems, such as the recursive Fourier sampling. In this paper, we consider a problem of distinguishing output probability distributions of two quantum circuits. We show that the problem is BQP-complete, but if the two circuits are restricted to some circuits in the second level of the Fourier hierarchy, such as IQP circuits, the problem has a Merlin-Arthur proof system where the prover (Merlin) has the power of BQP for yes instances. Our result is therefore another example of specific BQP problems that have an interactive proof system with a BQP prover and a BPP verifier. As an additional result, we also consider a simple model in the second level of the Fourier hierarchy, and show that a multiplicative-error classical efficient sampling of the output probability distribution of the model causes the collapse of the polynomial-time hierarchy to the third or the second level. The model consists of a classical reversible circuit sandwiched by two layers of Hadamard gates. The proof technique for its quantum supremacy is different from those for previous sub-universal models, such as IQP, Boson Sampling, and DQC1, and therefore the technique itself might be useful for other applications.

## Authors

• 14 publications
• 6 publications
• 8 publications
01/07/2019

### Fine-grained quantum computational supremacy

It is known that several sub-universal quantum computing models cannot b...
12/10/2018

### Impossibility of blind quantum sampling for classical client

Blind quantum computing enables a client, who can only generate or measu...
06/22/2020

### Efficiently generating ground states is hard for postselected quantum computation

Although quantum computing is expected to outperform universal classical...
11/11/2020

### StoqMA meets distribution testing

𝖲𝗍𝗈𝗊𝖬𝖠 captures the computational hardness of approximating the ground e...
01/07/2019

### Fine-grained quantum supremacy of the one-clean-qubit model

The one-clean-qubit model (or the DQC1 model) is a restricted model of q...
09/06/2017

### Quantum Advantage from Conjugated Clifford Circuits

A well-known result of Gottesman and Knill states that Clifford circuits...
10/29/2018

### The Expressive Power of Parameterized Quantum Circuits

Parameterized quantum circuits (PQCs) have been broadly used as a hybrid...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## I Introduction

It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is “Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier?” defBQP . Answering this question is important not only for practical applications of cloud quantum computing but also for foundations of computer science and quantum physics AharonovVazirani .

Partial solutions to the open problem have been obtained. For example, several verification protocols MNS ; posthoc and verifiable blind quantum computing protocols FK ; Aharonov ; HM ; Broadbent ; Andru_review

demonstrate that if the verifier has a weak quantum ability, such as preparations or measurements of single-qubit quantum states, any BQP problem can be verified with a BQP prover. Furthermore, it is known that if more than two entangling BQP provers who are not communicating with each other are allowed, any BQP problem is verified with a BPP verifier

MattMBQC ; RUV ; Ji . Since BQP is contained in IP, a natural approach to the open problem is to restrict the prover of IP to BQP when the problem is in BQP defIP . In fact, recently, a significant step in this line has been obtained in Ref. AharonovGreen . The authors of Ref. AharonovGreen have constructed a new smart interactive proof system that verifies the value of the trace of operators with a postBQP prover and a BPP verifier.

Actually, the answer to the open problem is yes if we consider specific BQP problems. For example, it is known that the recursive Fourier sampling BV has an interactive proof system with a BQP prover and a BPP verifier MattFourier . Its proof is elegant, but so far we do not know how to generalize it to other BQP problems. Furthermore, it was suggested in Ref. Tommaso that a problem of deciding whether there exist some results that occur with high probability or not for circuits in the second level of the Fourier hierarchy (FHFH ; expFH is verified by a Merlin-Arthur (MA) protocol with Merlin who is BQP in the honest case MA .

The first main result of the present paper is to introduce another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. We consider the following promise problem, which we call Probability Distribution Distinguishability with Maximum Norm (PDD-Max):

Problem (PDD-Max): Given a classical description of two quantum circuits and acting on qubits that consist of number of elementary gates, and parameters and such that and , decide

• YES: there exists such that .

• NO: for any , .

Here, and .

We first show that PDD-Max is BQP-complete (Sec. II). We next show that if and are some types of circuits in FH (such as IQP circuits, and circuits in Fig. 1(a) and (c)), PDD-Max is in MA with Merlin who is enough to be BQP for yes instances (Sec. III). This result demonstrates that PDD-Max with the restriction in FH is another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. This result also suggests that PDD-Max with the FH restriction is not BQP-hard, since BQP is not believed to be in MA.

FH contains many important quantum circuits. For example, Simon’s algorithm Simon and Shor’s factoring algorithm Shor use such circuits. Furthermore, the IQP model BJS ; BMS is also in FH. The IQP model is a well-known example of sub-universal quantum computing models whose output probability distributions cannot be classically efficiently sampled unless the polynomial-time hierarchy collapses. Other sub-universal models that exhibit similar quantum supremacy are also known, such as the depth four model TD , the Boson sampling model AA , the DQC1 model KL ; MFF ; M ; Kobayashi ; KobayashiICALP , the Fourier sampling model BU , and the conjugated Clifford model AFK .

The second main result of the present paper is to add another simple model in FH to the above list of sub-universal models. Let us consider the following model, which we call the Hadamard-classical circuit with one-qubit (HC1Q) model (see Fig. 1(a)):

• The initial state is .

• is applied, where is the Hadamard gate.

• A polynomial-time uniformly-generated classical reversible circuit

 C:{0,1}N∋w↦C(w)∈{0,1}N

is applied “coherently”.

• is applied.

• All qubits are measured in the computational basis.

We show that the HC1Q model is universal with a postselection. More precisely, we show the following statement: Let be a polynomial-time uniformly-generated quantum circuit acting on qubits that consists of number of Hadamard gates and classical reversible gates, such as , CNOT, and Toffoli. The HC1Q model of Fig. 1(a) for equipped with a postselection can generate the state .

Its proof is given in Sec. IV. The proof is based on a new idea that is different from those used in the previous results TD ; BJS ; AA ; MFF . Proofs for the depth-four model TD , the Boson sampling model AA , and the IQP model BJS use gadgets that can insert some gates in a post hoc way by using a postselection. The proof for the DQC1 model MFF uses a postselection to initialize the maximally-mixed state to the pure state . As we will see later, our proof is different from those: we first construct a polynomial-time non-deterministic algorithm that simulates the action of on . We then show that the polynomial-time non-deterministic algorithm is simulated by the HC1Q model with a postselection. This new idea itself seems to be useful for other applications.

An immediate corollary of the result is quantum supremacy of the HC1Q model: Output probability distributions of the HC1Q model of Fig. 1(a) cannot be classically efficiently sampled with a multiplicative error unless the polynomial-time hierarchy collapses to the third level. Here, we say that a probability distribution is classically efficiently sampled with a multiplicative error if there exists a classical polynomial-time sampler such that

 |pz−qz|≤ϵpz

for all , where is the probability that the classical sampler outputs

. This result demonstrates an interesting “phase transition” between classical and quantum. To see it, let us consider the circuit of Fig.

1(b), which is obtained by removing the last qubit of Fig. 1(a). Here,

 C′:{0,1}N−1∋w↦C′(w)∈{0,1}N−1

is a polynomial-time uniformly-generated classical reversible circuit. The circuit of Fig. 1(b) is trivially classically simulatable, since is a permutation on and therefore

 C′|+⟩⊗(N−1)=1√2N−1∑x∈{0,1}N−1|C′(x)⟩=|+⟩⊗(N−1),

where . Our result therefore suggests that the addition of a single qubit to the trivial circuit of Fig. 1(b) changes its complexity dramatically.

The third level collapse of the polynomial-time hierarchy for the depth-four model, the Boson sampling model, the IQP model, and the DQC1 model can be improved to the second level collapse Kobayashi ; KobayashiICALP . In Sec. IV, we show that the same improvement is possible for the HC1Q model of Fig. 1(a).

It is known that for the -qubit IQP model probability distributions of measurement results on number of qubits can be classically exactly sampled in polynomial time BJS . In Sec. V we show analogous results for our models of Fig. 1(a) and (c): probability distributions of measurement results on number of qubits in these models can be classically sampled in polynomial time with a L1-norm error.

## Ii BQP completeness

In this section, we show that PDD-Max is BQP-complete. We first show that PDD-Max is BQP-hard. Let be a promise problem in BQP. Let be the polynomial-time quantum circuit, which acts on qubits, corresponding to the instance . If we write as

 Vx|0n⟩=√α|0⟩⊗|ϕ0⟩+√1−α|1⟩⊗|ϕ1⟩

with certain qubit states and , we have when , and when , where is any polynomial. We consider the circuit of Fig. 2 as in PDD-Max. The state immediately before the measurement is

 √α|0⟩⊗|0m⟩⊗V†x(|0⟩⊗|ϕ0⟩)+√1−α|1⟩⊗|+⟩⊗m⊗V†x(|1⟩⊗|ϕ1⟩).

When , the probability of obtaining the measurement result is

 p0n+m+1=α|⟨0n|V†x(|0⟩⊗|ϕ0⟩)|2=α2≥(1−2−r)2.

When , the probability of obtaining the measurement result , where , is

 p0z=α∣∣⟨z|[|0m⟩⊗V†x(|0⟩⊗|ϕ0⟩)]∣∣2≤α≤2−r,

and the probability of obtaining the measurement result , where , is

 p1z=2−m(1−α)|⟨zm+1,...,zn+m|V†x(|1⟩⊗|ϕ1⟩)|2≤2−m.

Therefore, when ,

 ∣∣p0n+m+1−12n+m+1∣∣≥(1−2−r)2−2−(n+m+1),

and when ,

 ∣∣pz−12n+m+1∣∣ ≤ pz+12n+m+1 ≤ max(2−m,2−r)+2−(n+m+1)

for any . Hence if we take such that is the uniformly random distribution, is BQP-hard.

We next show that PDD-Max is in BQP. To show it, we use the following well known result.

Chernoff-Hoeffding bound: Let

be i.i.d. real random variables with

for every . Then

We show that the following BQP protocol solves PDD-Max with a completeness-soundness gap (i.e., the gap of acceptance probabilities between the yes-instances and the no-instances is lowerbounded by ):

• Flip a fair coin . Generate , and measure each qubit in the computational basis. Let be the measurement result.

• Run the SWAP test (Fig. 3) between and for times, where is a polynomial of specified later. Let be the measurement result of the th run, where . Calculate

 ~pz≡1TT∑j=1(−1)mj.

From the Chernoff-Hoeffding bound, with probability larger than , where

. In a similar way, calculate the estimator

of .

• Calculate . If , accept. Otherwise, reject.

First, let us consider the case when the answer to PDD-Max is YES. If obtained in step 1 satisfies , and if and satisfy and , we definitely accept. The probability of occurring such an event is lowerbounded as

 η ≡ (∑z:|pz−qz|≥apz+qz2)×Pr[|~pz−pz|≤a−b8]×Pr[|~qz−qz|≤a−b8] ≥ a2(1−2e−T(a−b)2128)2 ≥ a2(1−2e−k)2,

where we have taken and is any polynomial of . Therefore, the acceptance probability of our protocol is lowerbounded as

 pacc≥η≥a2(1−2e−k)2.

Next, let us consider the case when the answer to PDD-Max is NO. If and , which occurs with probability , we definitely reject. The rejection probability is therefore lowerbounded as

 prej≥(1−2e−k)2.

Therefore, the acceptance probability is upperbounded as

 pacc=1−prej≤1−(1−2e−k)2=4e−k−4e−2k.

The completeness-soundness gap is therefore

 a2(1−2e−k)2−(4e−k−4e−2k)≥1poly(N)

for sufficiently large , which shows that PDD-Max is in BQP.

## Iii Restriction to FH2 circuits

In this section, we show that if and are restricted to some circuits in FH, PDD-Max is in MA with honest BQP Merlin. We mean that a promise problem is in MA with honest BQP Merlin, if is in MA, and the prover (honest Merlin) that makes the verifier (Arthur) accept with high probability for the yes-instances is a BQP prover.

To understand our idea, we first restrict and to be circuits in the form of Fig. 1(a). Similar results are obtained for other circuits in FH, such as IQP circuits and the Simon type ones. These generalizations are discussed at the end of this section.

Our MA protocol with honest BQP Merlin runs as follows.

• If Merlin is honest, he flips a fair coin . He next generates , and measures each qubit in the computational basis to obtain the result . He sends to Arthur. If Merlin is malicious, his computational ability is unbounded, and what he sends to Arthur can be any bit string.

• Let be a polynomial of specified later. Arthur generates and , where each of and is a uniformly and independently chosen random bit string.

• Arthur calculates

 ~pz≡1TT∑i=1f(xi,yi),

where

 f(x,y)≡(−1)∑N−1j=1[Cj(x0)⋅zj+Cj(y0)⋅zj]δCN(x0),zNδCN(y0),zN.

Here,

 C:{0,1}N∋w↦C(w)∈{0,1}N

is the classical circuit in ,

 x0≡(x1,...,xN−1,0),

is the th bit of , and is the th bit of . We call the estimator of . Note that can be calculated in classical time.

• In a similar way, Arthur calculates the estimator of . If

 |~pz−~qz|≥a−a−b4,

Arthur accepts. Otherwise, he rejects.

Note that is given as

 pz = 122(N−1)∑x,y∈{0,1}N−1f(x,y).

Therefore, from the Chernoff-Hoeffding bound, the estimator satisfies with probability . For , a similar result holds. It is easy to check that the honest prover is a BQP prover in the above protocol.

Now we show that the above protocol can verify PDD-Max. The proof is similar to that for the BQP case given in Sec. II.

First, let us consider the case when the answer to PDD-Max is yes. If the that Merlin sends to Arthur satisfies , and the and that Arthur calculates satisfy and , Arthur definitely accepts. Taking the honest prover in step 1, the probability of occurring such an event is lowerbounded as

 η ≡ (∑z:|pz−qz|≥apz+qz2)×Pr[|~pz−pz|≤a−b8]×Pr[|~qz−qz|≤a−b8] ≥ a2(1−2e−T(a−b)2128)2≥a2(1−2e−k)2,

where we have taken and is any polynomial of . Therefore, the probability that Arthur accepts in our protocol is lowerbounded as

 pacc≥a2(1−2e−k)2.

Next, let us consider the case when the answer to PDD-Max is no. If and , which occurs with probability , Arthur definitely rejects. Therefore, the probability that Arthur accepts in our protocol is upperbounded as

 pacc≤1−(1−2e−k)2=4e−k−4e−2k.

The completeness-soundness gap is therefore

 a2(1−2e−k)2−(4e−k−4e−2k)≥1poly(N)

for sufficiently large , which shows that PDD-Max is in MA with honest BQP Merlin.

From the proof, it is clear that similar results hold for other circuits in FH whose is bounded by at most and calculatable in classical polynomial time (in , , and ). For example, let us consider the IQP model. For the IQP model, is a complex-valued function, but we can use the Chernoff-Hoeffding bound for complex random variables introduced in Ref. NestSchwarz .

The other example is Fig. 1(c). The model of Fig. 1(a) uses only one single ancilla qubit that is not rotated by . The model of Fig. 1(c) is a generalization of Fig. 1(a) so that ancilla qubits initialized in are available. Such a circuit is used, for example, in the Simon’s algorithm Simon . We can show a similar result for such a circuit. In fact, the probability of obtaining the result is

 ps,t=122(N−m)∑x,y∈{0,1}N−m(−1)C1,...,N−m(x0m)⋅s+C1,...,N−m(y0m)⋅sδt,CN−m+1,...,N(x0m)δt,CN−m+1,...,N(y0m),

and therefore the Chernoff-Hoeffding bound argument can be used. Here, is the first bits of , and is the last bits of .

## Iv Quantum supremacy of our model

In this section, we provide the results on quantum supremacy of the HC1Q model in Fig. 1 (a). First we show that the model is universal with a postselection. We are given a unitary operator

 U=ut...u2u1

acting on qubits, where is or a classical gate for all . From , we define

 U′≡ut+n...ut+1U,

where is acting on th qubit (). Let us consider the following polynomial-time non-deterministic algorithm, which “simulates” the action of on . We represent the state of the register of the polynomial-time non-deterministic computing by , where and . (Note that using the ket notation to represent the state of the register of the polynomial-time non-deterministic computing is just for convenience. The polynomial-time non-deterministic computing is, of course, not quantum computing.)

• The initial state of the register is .

• Repeat the following for .

• If is a classical gate

 g:{0,1}n∋z↦g(z)∈{0,1}n,

we update the state of the register as

 |s⟩⊗|z⟩→|s⟩⊗|g(z)⟩.
• If is acting on th qubit, we update the state of the register in the following non-deterministic way:

Let us define by

 h≡∣∣{i∈{1,2,...,t+n} | ui=H}∣∣,

i.e., is the number of appearing in . The above polynomial-time non-deterministic algorithm does the non-deterministic transition times, and therefore the algorithm has computational paths. We label each path by an -bit string . We write the final state of the register for the path by , where and . For each , we can calculate and in classical polynomial-time. Let be a classical circuit that calculates and on input . It is obvious that

 U′|0n⟩=1√2h∑y∈{0,1}h(−1)s(y)|z(y)⟩.

Now we show that the state can be generated by the HC1Q model with a postselection. Let us consider the quantum circuit of Fig. 4. It is easy to show that the state immediately before the postselection is

 1√2n+h+1∑y∈{0,1}h(H⊗h|y⟩)⊗(H|s(y)⟩)⊗(H⊗n|z(y)⟩)⊗|1⟩+|ψ⟩⊗|0⟩, (1)

where is a certain -qubit state whose detail is irrelevant keep . After the postselection, the state becomes

 1√2h∑y∈{0,1}h(−1)s(y)H⊗n|z(y)⟩=H⊗nU′|0n⟩=U|0n⟩.

In this way, we have shown that the HC1Q model is universal with a postselection.

By combining the above result with the well-known technique BJS ; AA ; MFF , we can show that the output probability distribution of the HC1Q model cannot be classically efficiently sampled with a multiplicative error unless the polynomial-time hierarchy collapses to the third level.

It was shown in Refs. Kobayashi ; KobayashiICALP that the third level collapse of the polynomial-time hierarchy for most of the sub-universal models (including the depth-four model TD , the Boson sampling model AA , the IQP model BJS , and the DQC1 model MFF ) is improved to the second level collapse. The idea is to use the class NQP NQP in stead of postBQP. NQP is a quantum version of NP, and defined as follows.

Definition: A promise problem is in NQP if and only if there exists a polynomial-time uniformly-generated family of quantum circuits such that if then , and if then . Here is the acceptance probability of .

By using a similar argument of Refs. Kobayashi ; KobayashiICALP , we now show that the collapse of the polynomial-time hierarchy to the third level for the HC1Q model can be improved to that to the second level. In stead of doing the postselection, let us do the projective measurement on the state of Eq. (1). If is obtained, we accept. Here,

 Λ≡|0⟩⟨0|⊗h⊗|1⟩⟨1|⊗|0⟩⟨0|⊗I⊗n−1⊗|1⟩⟨1|.

The acceptance probability is

 pacc=⟨0n|U†(|0⟩⟨0|⊗I⊗n−1)U|0n⟩2h+n+2.

Let us assume that a promise problem is in NQP. Then there exists a polynomial-time uniformly-generated family of quantum circuits that satisfies the above definition of NQP. For an instance , let us take as . Assume that is classically efficiently sampled with a multiplicative error . It means that there exists a classical polynomial-time computer such that

 |pacc−qacc|≤ϵpacc,

where is the probability that the classical computer accepts. If then

 qacc≥(1−ϵ)pacc>0.

If then

 qacc≤(1+ϵ)pacc=0.

is therefore in NP. Hence , which leads to the collapse of the polynomial-time hierarchy to the second level Kobayashi :

 PH⊆BP⋅coC=P=BP⋅NQP=BP⋅NP=AM.

## V Classical simulatability

In this section, we show that probability distributions of measurement results on qubits of Fig. 1(a) and (c) can be classically sampled in polynomial time with a L1-norm error.

For simplicity, a proof is given for the model of Fig. 1(a). The same proof works for the model of Fig. 1(c). Furthermore, for simplicity, we assume that the first qubits are measured. Generalizations to other qubits are easy. Let be the measurement result. By a straightforward calculation, the probability of obtaining is

 pz=12N−1∑x∈{0,1}N−1f(x),

where

 f(x) ≡ 12k∑y∈{0,1}N−1(−1)z⋅C1,...,k(x0)+z⋅C1,...,k(y0)δCk+1,...,N(x0),Ck+1,...,N(y0) = 12k∑y∈S(−1)z⋅C1,...,k(x0)+z⋅C1,...,k(y0),

and is defined by

 S ≡ {y∈{0,1}N−1 | Ck+1,...,N(x0)=Ck+1,...,N(y0)}.

The subset can be obtained in polynomial time in the following way:

• Set .

• Repeat the following for all .

• Calculate .

• If for certain , add to .

• End.

From the construction, . Therefore, the value of is exactly computable in polynomial time for each . Furthermore, because

 |f(x)|≤12k∑y∈S|(−1)z⋅C1,...,k(x0)+z⋅C1,...,k(y0)|≤1.

By using the Chernoff-Hoeffding bound, we can calculate the estimator of that satisfies

 Pr[|~pz−pz|≤ϵ]≥1−2e−Tϵ22

in time .

For any polynomial , let us take . Given , define the probability distribution by

 qz≡|~pz|∑z∈{0,1}k|~pz|.

Note that it is well defined, because

 ∑z∈{0,1}k|~pz|>0,

which is shown as follows:

 ∑z∈{0,1}k|~pz|≥∑z∈{0,1}k~pz≥∑z∈{0,1}k(pz−ϵ)=1−2kϵ=1−15×2kr>0.

Furthermore, is obtained in polynomial time. The distance between and is

 ∑z∈{0,1}k|pz−qz|≤5×22kϵ=1r.

It is shown as follows. First,

 qz = |~pz|∑z∈{0,1}k|~pz| ≤ pz+ϵ1−2kϵ = (pz+ϵ)(1+2kϵ+o(2kϵ)) = pz+pz2kϵ+pzo(2kϵ)+ϵ+2kϵ2+ϵo(2kϵ) ≤ pz+5×2kϵ.

Second,

 qz = |~pz|∑z∈{0,1}k|~pz| ≥ pz−ϵ1+2kϵ = (pz−ϵ)(1−2kϵ+o(2kϵ)) = pz−pz2kϵ+pzo(2kϵ)−ϵ+2kϵ2−ϵo(2kϵ) ≥ pz−5×2kϵ.

We finally show that can be sampled in classical polynomial time. For simplicity, let us assume that each is represented in the -bit binary:

 qz=m∑j=12−jaz,j,

where for . (Otherwise, by polynomially increasing the size of , we obtain exponentially good approximations.) The following algorithm samples the probability distribution .

• Randomly generate an -bit string .

• Output such that

 ∑y

where and mean the standard dictionary order. (For example, for three bits, .)

###### Acknowledgements.
We thank Keisuke Fujii, Seiichiro Tani, and Francois Le Gall for discussion. TM is supported by JST ACT-I No.JPMJPR16UP, JST PRESTO, and the Grant-in-Aid for Young Scientists (B) No.JP17K12637 of JSPS. YT is supported by the Program for Leading Graduate Schools: Interactive Materials Science Cadet Program and JSPS Grant-in-Aid for JSPS Research Fellow No.JP17J03503. HN is supported by the Grant-in-Aid for Scientific Research (A) Nos.26247016, 16H01705 and (C) No.16K00015 of JSPS.