In a recent breakthrough, Mahadev constructed a classical verification of quantum computation (CVQC) protocol for a classical client to delegate decision problems in BQP to an untrusted quantum prover under computational assumptions. In this work, we explore further the feasibility of CVQC with the more general sampling problems in BQP and with the desirable blindness property. We contribute affirmative solutions to both as follows.
(1) Motivated by the sampling nature of many quantum applications (e.g., quantum algorithms for machine learning and quantum supremacy tasks), we initiate the study of CVQC for quantum sampling problems (denoted by SampBQP). More precisely, in a CVQC protocol for a SampBQP problem, the prover and the verifier are given an input $x\in \{0,1\}^n$ and a quantum circuit $C$, and the goal of the classical client is to learn a sample from the output $z \leftarrow C(x)$ up to a small error, from its interaction with an untrusted prover. We demonstrate its feasibility by constructing a four-message CVQC protocol for SampBQP based on the quantum Learning With Error assumption.
(2) The blindness of CVQC protocols refers to a property of the protocol where the prover learns nothing, and hence is blind, about the client's input. It is a highly desirable property that has been intensively studied for the delegation of quantum computation. We provide a simple yet powerful generic compiler that transforms any CVQC protocol to a blind one while preserving its completeness and soundness errors as well as the number of rounds.
Applying our compiler to (a parallel repetition of) Mahadev's CVQC protocol for BQP and our CVQC protocol for SampBQP yields the first constant-round blind CVQC protocol for BQP and SampBQP respectively, with negligible and inverse polynomial soundness errors respectively, and negligible completeness errors.
Blind quantum computing is a new secure quantum computing protocol where a client who does not have any sophisticated quantum technlogy can delegate her quantum computing to a server without leaking any privacy. It is known that a client who has only a measurement device can perform blind quantum computing [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)]. It has been an open problem whether the protocol can enjoy the verification, i.e., the ability of client to check the correctness of the computing. In this paper, we propose a protocol of verification for the measurement-only…
We consider an information reconciliation protocol for quantum key distribution (QKD). In order to correct down the error rate, we suggest a method, which is based on symmetric blind information reconciliation for the low-density parity-check (LDPC) codes. We develop a subsequent verification protocol with the use of $ε$-universal hash functions, which allows verifying the identity between the keys with a certain probability.
Verifiable blind quantum computing is a secure delegated quantum computing where a client with a limited quantum technology delegates her quantum computing to a server who has a universal quantum computer. The client's privacy is protected (blindness) and the correctness of the computation is verifiable by the client in spite of her limited quantum technology (verifiability). There are mainly two types of protocols for verifiable blind quantum computing: the protocol where the client has only to generate single-qubit states, and the protocol where the client needs only the ability of single-qu…
Optimizing Resource Costs: A Practical Guide to Achieving Target Security in Verifiable Blind Quantum Computing
QuTech, Delft University of Technology（代尔夫特理工大学 QuTech）；Kavli Institute of Nanoscience, Delft University of Technology（代尔夫特理工大学 卡弗里纳米科学研究所）；Quantum Computer Science, EEMCS, Delft University of Technology（代尔夫特理工大学 EEMCS 量子计算机科学）
Randomized encoding is a powerful cryptographic primitive with various applications such as secure multiparty computation, verifiable computation, parallel cryptography, and complexity lower-bounds. Intuitively, randomized encoding $\hat{f}$ of a function $f$ is another function such that $f(x)$ can be recovered from $\hat{f}(x)$, and nothing except for $f(x)$ is leaked from $\hat{f}(x)$. Its quantum version, quantum randomized encoding, has been introduced recently [Brakerski and Yuen, arXiv:2006.01085]. Intuitively, quantum randomized encoding $\hat{F}$ of a quantum operation $F$ is another …
In this paper, we extend the protocol of classical verification of quantum computations (CVQC) recently proposed by Mahadev to make the verification efficient. Our result is obtained in the following three steps: $\bullet$ We show that parallel repetition of Mahadev's protocol has negligible soundness error. This gives the first constant round CVQC protocol with negligible soundness error. In this part, we only assume the quantum hardness of the learning with error (LWE) problem similar to the Mahadev's work. $\bullet$ We construct a two-round CVQC protocol in the quantum random oracle model (…
Blind quantum computing protocols enable a client, who can generate or measure single-qubit states, to delegate quantum computing to a remote quantum server protecting the client's privacy (i.e., input, output, and program). With current technologies, generations or measurements of single-qubit states are not too much burden for the client. In other words, secure delegated quantum computing is possible for "almost classical" clients. However, is it possible for a "completely classical" client? Here we consider a one-round perfectly-secure delegated quantum computing, and show that the protocol…
Recent advances in theoretical and experimental quantum computing bring us closer to scalable quantum computing devices. This makes the need for protocols that verify the correct functionality of quantum operations timely and has led to the field of quantum verification. In this paper we address key challenges to make quantum verification protocols applicable to experimental implementations. We prove the robustness of the single server verifiable universal blind quantum computing protocol of Fitzsimons and Kashefi (2012) in the most general scenario. This includes the case where the purificati…
Blind quantum computing allows for secure cloud networks of quasi-classical clients and a fully fledged quantum server. Recently, a new protocol has been proposed, which requires a client to perform only measurements. We demonstrate a proof-of-principle implementation of this measurement-only blind quantum computing, exploiting a photonic setup to generate four-qubit cluster states for computation and verification. Feasible technological requirements for the client and the device-independent blindness make this scheme very applicable for future secure quantum networks.
We study the role of quantum communication in attacks on quantum position verification. In this work, we construct the first known example of a QPV protocol that is provably secure against unentangled attackers restricted to classical communication, but can be perfectly attacked by local operations and a single round of simultaneous quantum communication indicating that allowing for quantum communication may break security. We also show that any protocol secure against classical communication can be transformed into a protocol secure against quantum communication. We further show, using argume…
Blindness is a desirable feature in delegated computation. In the classical setting, blind computations protect the data or even the program run by a server. In the quantum regime, blind computing may also enable testing computational or other quantum properties of the server system. Here we propose a scheme for universal blind quantum computation using a quantum simulator capable of emulating Heisenberg-like Hamiltonians. Our scheme is inspired by the central spin Hamiltonian in which a single spin controls dynamics of a number of bath spins. We show how, by manipulating this spin, a client t…
Experimental verifiable multi-client blind quantum computing on a Qline architecture
Dipartimento di Fisica - Sapienza Università di Roma（罗马大学物理系）；School of Informatics, University of Edinburgh（爱丁堡大学信息学院）；VeriQloud；Laboratoire d’Informatique de Paris 6, CNRS, Sorbonne Université（巴黎第六大学计算机实验室，法国国家科学研究中心，索邦大学）
To date, blind quantum computing demonstrations require clients to have weak quantum devices. Here we implement a proof-of-principle experiment for completely classical clients. Via classically interacting with two quantum servers that share entanglement, the client accomplishes the task of having the number 15 factorized by servers who are denied information about the computation itself. This concealment is accompanied by a verification protocol that tests servers' honesty and correctness. Our demonstration shows the feasibility of completely classical clients and thus is a key milestone towa…
Many-body quantum states, as a matter of fact, are extremely essential to solve certain mathematical problems or simulate quantum systems in measurement-based quantum computation. However, how to verify large scale quantum states, such as hypergraph states, is an exceedingly hard task for multi-body quantum systems. Here, we propose a novel fault-tolerant solution for verification of colorable hypergraph states by using stabilizer test. Compared with the adaptive stabilizer test, our protocol is dramatically facilitating by making only Pauli-X and Pauli-Z measurement. As to appliance, it will …
Solitude verification is arguably one of the simplest fundamental problems in distributed computing, where the goal is to verify that there is a unique contender in a network. This paper devises a quantum algorithm that exactly solves the problem on an anonymous network, which is known as a network model with minimal assumptions [Angluin, STOC'80]. The algorithm runs in $O(N)$ rounds if every party initially has the common knowledge of an upper bound $N$ on the number of parties. This implies that all solvable problems can be solved in $O(N)$ rounds on average without error (i.e., with zero-si…
We present a scheme for teleporting an unknown, two-particle entangled state with a message from a sender (Alice) to a receiver (Bob) via a six-particle entangled channel. We also present another scheme for teleporting an unknown one-particle entangled state with a message transmitted in a two-way form between the same sender and receiver via a five-qubit cluster state. One-way hash functions, Bell-state measurements, and unitary operations are adopted in these two schemes. Our schemes use the physical characteristics of quantum mechanics to implement delegation, signature, and verification pr…
Loss of inputs can be detrimental to the security of quantum position verification (QPV) protocols, as it may allow attackers to not answer on all played rounds, but only on those they perform well on. In this work, we study \textit{loss-tolerant} QPV protocols. We propose a new fully loss-tolerant protocol QPV$_{\textsf{SWAP}}$, based on the SWAP test, with several desirable properties. The task of the protocol, which could be implemented using only a single beam splitter and two detectors, is to estimate the overlap between two input states. By formulating possible attacks as a semi-definite…
We propose a simple protocol for the verification of quantum computation after the computation has been performed. Our construction can be seen as an improvement on previous results in that it requires only a single prover, who is restricted to measuring qubits in the $X$ or $Z$ basis, while requiring only one way communication, from the prover to the verifier. We also show similar constant round protocols with purely classical verifiers are not possible, unless BQP is contained in the third level of the polynomial hierarchy.
In the universal blind quantum computation problem, a client wants to make use of a single quantum server to evaluate $C|0\rangle$ where $C$ is an arbitrary quantum circuit while keeping $C$ secret. The client's goal is to use as few resources as possible. This problem, with a representative protocol by Broadbent, Fitzsimons and Kashefi [FOCS09, arXiv:0807.4154], has become fundamental to the study of quantum cryptography, not only because of its own importance, but also because it provides a testbed for new techniques that can be later applied to related problems (for example, quantum computa…
Quantum private information retrieval (QPIR) for quantum messages is the protocol in which a user retrieves one of the multiple quantum states from one or multiple servers without revealing which state is retrieved. We consider QPIR in two different settings: the blind setting, in which the servers contain one copy of the message states, and the visible setting, in which the servers contain the description of the message states. One trivial solution in both settings is downloading all states from the servers and the main goal of this paper is to find more efficient QPIR protocols. First, we pr…
The classical channel remote state preparation (ccRSP) is an important two-party primitive in quantum cryptography. Alice (classical polynomial-time) and Bob (quantum polynomial-time) exchange polynomial rounds of classical messages, and Bob finally gets random single-qubit states while Alice finally gets classical descriptions of the states. In [T. Morimae, arXiv:2003.10712], an information-theoretically-sound non-interactive protocol for the verification of quantum computing was proposed. The verifier of the protocol is classical, but the trusted center is assumed that sends random single-qu…
We present a verifiable and blind protocol for assisted universal quantum computing on continuous-variable (CV) platforms. This protocol is highly experimentally-friendly to the client, as it only requires Gaussian-operation capabilities from the latter. Moreover, the server is not required universal quantum-computational power either, its only function being to supply the client with copies of a single-mode non-Gaussian state. Universality is attained based on state-injection of the server's non-Gaussian supplies. The protocol is automatically blind because the non-Gaussian resource requested…
We present a classical interactive protocol that verifies the validity of a quantum witness state for the local Hamiltonian problem. It follows from this protocol that approximating the non-local value of a multi-player one-round game to inverse polynomial precision is QMA-hard. Our work makes an interesting connection between the theory of QMA-completeness and Hamiltonian complexity on one hand and the study of non-local games and Bell inequalities on the other.
A quantum money scheme enables a trusted bank to provide untrusted users with verifiable quantum banknotes that cannot be forged. In this work, we report an experimental demonstration of the preparation and verification of unforgeable quantum banknotes. We employ a security analysis that takes experimental imperfections fully into account. We measure a total of $3.6\times 10^6$ states in one verification round, limiting the forging probability to $10^{-7}$ based on the security analysis. Our results demonstrate the feasibility of preparing and verifying quantum banknotes using currently availa…
Verification is a task to check whether a given quantum state is close to an ideal state or not. In this paper, we show that a variety of many-qubit quantum states can be verified with only sequential single-qubit measurements of Pauli operators. First, we introduce a protocol for verifying ground states of Hamiltonians. We next explain how to verify quantum states generated by a certain class of quantum circuits. We finally propose an adaptive test of stabilizers that enables the verification of all polynomial-time-generated hypergraph states, which include output states of the Bremner-Montan…
Quantum computers are expected to offer substantial speedups over their classical counterparts and to solve problems that are intractable for classical computers. Beyond such practical significance, the concept of quantum computation opens up new fundamental questions, among them the issue whether or not quantum computations can be certified by entities that are inherently unable to compute the results themselves. Here we present the first experimental verification of quantum computations. We show, in theory and in experiment, how a verifier with minimal quantum resources can test a significan…
Efficient verification of pure quantum states in the adversarial scenario is crucial to many applications in quantum information processing, such as blind measurement-based quantum computation and quantum networks. However, little is known about this topic so far. Here we establish a general framework for verifying pure quantum states in the adversarial scenario and clarify the resource cost. Moreover, we propose a simple and general recipe to constructing efficient verification protocols for the adversarial scenario from protocols for the nonadversarial scenario. With this recipe, arbitrary p…
While building a universal quantum computer remains challenging, devices of restricted power such as the so-called one pure qubit model have attracted considerable attention. An important step in the construction of these limited quantum computational devices is the understanding of whether the verification of the computation within these models could be also performed in the restricted scheme. Encoding via blindness (a cryptographic protocol for delegated computing) has proven successful for the verification of universal quantum computation with a restricted verifier. In this paper, we presen…
We propose here a two-round relativistic bit commitment scheme where committer commits in the first round and then confirms his/her commitment in the second round. The scheme offers indefinite commitment time where both committer and receiver extract non-locally correlated measurement outcomes during the scheme that can be stored and revealed after arbitrarily long time. We show that the proposed scheme turns out to be a multiparty bit commitment scheme where both parties commit and reveal simultaneously. The multiparty generalization would have applications in business and secure multiparty c…
Graph states and hypergraph states are of wide interest in quantum information processing and foundational studies. Efficient verification of these states is a key to various applications. Here we propose a simple method for verifying hypergraph states which requires only two distinct Pauli measurements for each party, yet its efficiency is comparable to the best strategy based on entangling measurements. For a given state, the overhead is bounded by the chromatic number and degree of the underlying hypergraph. Our protocol is dramatically more efficient than all previous protocols based on lo…
The problem of reliably certifying the outcome of a computation performed by a quantum device is rapidly gaining relevance. We present two protocols for a classical verifier to verifiably delegate a quantum computation to two non-communicating but entangled quantum provers. Our protocols have near-optimal complexity in terms of the total resources employed by the verifier and the honest provers, with the total number of operations of each party, including the number of entangled pairs of qubits required of the honest provers, scaling as $O(g\log g)$ for delegating a circuit of size $g$. This i…
Blind Quantum Computing (BQC) allows a client to have a server carry out a quantum computation for them such that the client's input, output and computation remain private. A desirable property for any BQC protocol is verification, whereby the client can verify with high probability whether the server has followed the instructions of the protocol, or if there has been some deviation resulting in a corrupted output state. A verifiable BQC protocol can be viewed as an interactive proof system leading to consequences for complexity theory. The authors, together with Broadbent, previously proposed…
Quantum systems, in general, output data that cannot be simulated efficiently by a classical computer, and hence is useful for solving certain mathematical problems and simulating quantum many-body systems. This also implies, unfortunately, that verification of the output of the quantum systems is not so trivial, since predicting the output is exponentially hard. As another problem, quantum system is very delicate for noise and thus needs error correction. Here we propose a framework for verification of the output of fault-tolerant quantum computation in the measurement-based model. Contrast t…
We introduce a private quantum money scheme with the note verification procedure based on Sampling Matching, a problem in the one-way communication complexity model introduced by Kumar et al.[Nature Communications 10, Article number: 4152]. Our scheme involves a Bank that produces and distributes quantum notes, noteholders who are untrusted and trusted local verifiers of the Bank to whom the holders send their notes in order to carry out transactions. The key aspects of our money scheme include: note verification procedure requiring a single round classical interaction between the local verifi…
Blind delegation protocols allow a client to delegate a computation to a server so that the server learns nothing about the input to the computation apart from its size. For the specific case of quantum computation we know that blind delegation protocols can achieve information-theoretic security. In this paper we prove, provided certain complexity-theoretic conjectures are true, that the power of information-theoretically secure blind delegation protocols for quantum computation (ITS-BQC protocols) is in a number of ways constrained. In the first part of our paper we provide some indication t…
Recent developments make the possibility of achieving scalable quantum networks and quantum devices closer. From the computational point of view these emerging technologies become relevant when they are no longer classically simulatable. Hence a pressing challenge is the construction of practical methods to verify the correctness of the outcome produced by universal or non-universal quantum devices. A promising approach that has been extensively explored is the scheme of verification via encryption through blind quantum computing initiated by Fitzsimons and Kashefi. We present here a new const…
