arxiv: v2 [quant-ph] 10 Jan 2018

Transcription

1 Merlin-Arthur with efficient quantum Merlin and quantum supremacy for the second level of the Fourier hierarchy Tomoyuki Morimae, 1,2,3, Yuki Takeuchi, 4, and Harumichi Nishimura 5, 1 Department of Computer Science, Gunma University, arxiv: v2 [quant-ph] 10 Jan Tenjincho, Kiryu, Gunma, , Japan 2 JST, PRESTO, Honcho, Kawaguchi, Saitama, , Japan 3 Yukawa Institute for Theoretical Physics (YITP), Kyoto University, Kitashirakawa Oiwakecho, Sakyo-ku, Kyoto , Japan 4 Graduate School of Engineering Science, Osaka University, Toyonaka, Osaka , Japan 5 Graduate School of Informatics, Nagoya University, Furocho, Chikusaku, Nagoya, Aichi, , Japan (Dated: January 11, 2018) 1

2 Abstract It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier?. Several partial solutions to the open problem have been obtained. For example, verifiable blind quantum computing protocols demonstrate that if the verifier is slightly quantum, the problem is solved. Furthermore, the answer to the open problem is yes for specific BQP problems, such as the recursive Fourier sampling. In this paper, we consider a problem of distinguishing output probability distributions of two quantum circuits. We show that the problem is BQP-complete, but if the two circuits are restricted to some circuits in the second level of the Fourier hierarchy, such as IQP circuits, the problem has a Merlin-Arthur proof system where the prover (Merlin) has the power of BQP for yes instances. Our result is therefore another example of specific BQP problems that have an interactive proof system with a BQP prover and a BPP verifier. As an additional result, we also consider a simple model in the second level of the Fourier hierarchy, and show that a multiplicative-error classical efficient sampling of the output probability distribution of the model causes the collapse of the polynomialtime hierarchy to the third or the second level. The model consists of a classical reversible circuit sandwiched by two layers of Hadamard gates. The proof technique for its quantum supremacy is different from those for previous sub-universal models, such as IQP, Boson Sampling, and DQC1, and therefore the technique itself might be useful for other applications. Electronic address: tomoyuki.morimae@yukawa.kyoto-u.ac.jp Electronic address: takeuchi@qi.mp.es.osaka-u.ac.jp Electronic address: hnishimura@is.nagoya-u.ac.jp 2

3 I. INTRODUCTION It is a long-standing open problem whether quantum computing can be verified by a classical verifier. In the computational complexity term, it is Does any BQP problem have an interactive proof system with a BQP prover and a BPP verifier? [1]. Answering this question is important not only for practical applications of cloud quantum computing but also for foundations of computer science and quantum physics [2]. Partial solutions to the open problem have been obtained. For example, several verification protocols [3, 4] and verifiable blind quantum computing protocols [5 9] demonstrate that if the verifier has a weak quantum ability, such as preparations or measurements of single-qubit quantum states, any BQP problem can be verified with a BQP prover. Furthermore, it is known that if more than two entangling BQP provers who are not communicating with each other are allowed, any BQP problem is verified with a BPP verifier [10 12]. Since BQP is contained in IP, a natural approach to the open problem is to restrict the prover of IP to BQP when the problem is in BQP [13]. In fact, recently, a significant step in this line has been obtained in Ref. [14]. The authors of Ref. [14] have constructed a new smart interactive proof system that verifies the value of the trace of operators with a postbqp prover and a BPP verifier. Actually, the answer to the open problem is yes if we consider specific BQP problems. For example, it is known that the recursive Fourier sampling [15] has an interactive proof system with a BQP prover and a BPP verifier [16]. Its proof is elegant, but so far we do not know how to generalize it to other BQP problems. Furthermore, it was suggested in Ref. [17] that a problem of deciding whether there exist some results that occur with high probability or not for circuits in the second level of the Fourier hierarchy (FH 2 ) [18, 19] is verified by a Merlin-Arthur (MA) protocol with Merlin who is BQP in the honest case [20]. The first main result of the present paper is to introduce another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. We consider the following promise problem, which we call Probability Distribution Distinguishability with Maximum Norm (PDD-Max): Problem (PDD-Max): Given a classical description of two quantum circuits U 1 and U 2 acting on N qubits that consist of poly(n) number of elementary gates, and parameters a and b such that 0 b < a 1 and a b 1/poly(N), decide 3

4 YES: there exists z {0,1} N such that p z q z a. NO: for any z {0,1} N, p z q z b. Here, p z z U 1 0 N 2 and q z z U 2 0 N 2. We first show that PDD-Max is BQP-complete (Sec. II). We next show that if U 1 and U 2 are some types of circuits in FH 2 (such as IQP circuits, and circuits in Fig. 1(a) and (c)), PDD-Max is in MA with Merlin who is enough to be BQP for yes instances (Sec. III). This result demonstrates that PDD-Max with the restriction in FH 2 is another example of problems that have an interactive proof system with a BQP prover and a BPP verifier. This result also suggests that PDD-Max with the FH 2 restriction is not BQP-hard, since BQP is not believed to be in MA. FH 2 contains many important quantum circuits. For example, Simon s algorithm [23] and Shor s factoring algorithm [24] use such circuits. Furthermore, the IQP model [21, 22] is also in FH 2. The IQP model is a well-known example of sub-universal quantum computing models whose output probability distributions cannot be classically efficiently sampled unless the polynomial-time hierarchy collapses. Other sub-universal models that exhibit similar quantum supremacy are also known, such as the depth four model [25], the Boson sampling model [26], the DQC1 model [27 31], the Fourier sampling model [32], and the conjugated Clifford model [33]. The second main result of the present paper is to add another simple model in FH 2 to the above list of sub-universal models. Let us consider the following model, which we call the Hadamard-classical circuit with one-qubit (HC1Q) model (see Fig. 1(a)): 1. The initial state is 0 N. 2. H (N 1) I is applied, where H is the Hadamard gate. 3. A polynomial-time uniformly-generated classical reversible circuit C : {0,1} N w C(w) {0,1} N is applied coherently. 4. H (N 1) I is applied. 5. All qubits are measured in the computational basis. 4

5 0 0 N-1 H (a) C H M M (b) N-1 0 H C' H M 0 0 N-m m H (c) C H M M FIG. 1: (a) The HC1Q model. M is the computational-basis measurement. A single line with the slash represents a set of N 1 qubits. The Hadamard gate H is applied on each qubit. The measurement M is done on each qubit. (b) The circuit similar to HC1Q model, but the last 0 qubit is removed. (c) A generalization of (a). We show that the HC1Q model is universal with a postselection. More precisely, we show the following statement: Let U be a polynomial-time uniformly-generated quantum circuit acting on n qubits that consists of poly(n) number of Hadamard gates and classical reversible gates, such as X, CNOT, and Toffoli. The HC1Q model of Fig. 1(a) for N = poly(n) equipped with a postselection can generate the state U 0 n. Its proof is given in Sec. IV. The proof is based on a new idea that is different from those used in the previous results [21, 25, 26, 28]. Proofs for the depth-four model [25], the Boson sampling model [26], andthe IQPmodel [21] use gadgetsthat can insert some gatesinapost hoc way by using a postselection. The proof for the DQC1 model [28] uses a postselection to initialize the maximally-mixed state I n /2 n to the pure state 0 n. As we will see later, our proof is different from those: we first construct a polynomial-time non-deterministic algorithm that simulates the action of U on 0 n. We then show that the polynomial-time non-deterministic algorithm is simulated by the HC1Q model with a postselection. This new idea itself seems to be useful for other applications. An immediate corollary of the result is quantum supremacy of the HC1Q model: Output probability distributions of the HC1Q model of Fig. 1(a) cannot be classically efficiently sampled with a multiplicative error ǫ < 1 unless the polynomial-time hierarchy collapses to 5

6 the third level. Here, we say that a probability distribution {p z } z is classically efficiently sampled with a multiplicative error ǫ if there exists a classical polynomial-time sampler such that p z q z ǫp z for all z, where q z is the probability that the classical sampler outputs z. This result demonstrates an interesting phase transition between classical and quantum. To see it, let us consider the circuit of Fig. 1(b), which is obtained by removing the last 0 qubit of Fig. 1(a). Here, C : {0,1} N 1 w C (w) {0,1} N 1 is a polynomial-time uniformly-generated classical reversible circuit. The circuit of Fig. 1(b) is trivially classically simulatable, since C is a permutation on {0,1} N 1 and therefore C + (N 1) = 1 2 N 1 x {0,1} N 1 C (x) = + (N 1), where + ( )/ 2. Our result therefore suggests that the addition of a single 0 qubit to the trivial circuit of Fig. 1(b) changes its complexity dramatically. The third level collapse of the polynomial-time hierarchy for the depth-four model, the Boson sampling model, the IQP model, and the DQC1 model can be improved to the second level collapse [30, 31]. In Sec. IV, we show that the same improvement is possible for the HC1Q model of Fig. 1(a). It is known that for the N-qubit IQP model probability distributions of measurement results on O(log(N)) number of qubits can be classically exactly sampled in polynomial time[21]. InSec.VweshowanalogousresultsforourmodelsofFig.1(a)and(c): probability distributions of measurement results on O(log(N)) number of qubits in these models can be classically sampled in polynomial time with a 1/poly(N) L1-norm error. II. BQP COMPLETENESS In this section, we show that PDD-Max is BQP-complete. We first show that PDD-Max is BQP-hard. Let A = (A yes,a no ) be a promise problem in BQP. Let V x be the polynomialtime quantum circuit, which acts on n qubits, corresponding to the instance x. If we write 6

7 V x 0 n as V x 0 n = α 0 φ α 1 φ 1 with certain n 1 qubit states φ 0 and φ 1, we have α 1 2 r when x A yes, and α 2 r when x A no, where r is any polynomial. We consider the circuit of Fig. 2 as U 1 in PDD-Max. The state immediately before the measurement is α 0 0 m V x ( 0 φ 0 )+ 1 α 1 + m V x ( 1 φ 1 ). When x A yes, the probability of obtaining the measurement result 0 n+m+1 is p 0 n+m+1 = α 0 n V x( 0 φ 0 ) 2 = α 2 (1 2 r ) 2. When x A no, the probability of obtaining themeasurement result 0z, where z {0,1} n+m, is [ p 0z = α z 0 m V x 0 )] ( 0 φ 2 α 2 r, and the probability of obtaining the measurement result 1z, where z {0,1} n+m, is p 1z = 2 m (1 α) z m+1,...,z n+m V x( 1 φ 1 ) 2 2 m. Therefore, when x A yes, 1 p 0 n+m+1 (1 2 r ) 2 2 (n+m+1), 2 n+m+1 and when x A no, p z 1 2 n+m+1 pz n+m+1 max(2 m,2 r )+2 (n+m+1) for any z {0,1} n+m+1. Hence if we take U 2 such that {q z } z is the uniformly random distribution, A is BQP-hard. We next show that PDD-Max is in BQP. To show it, we use the following well known result. Chernoff-Hoeffding bound: Let X 1,...,X T be i.i.d. real random variables with X i 1 for every i = 1,...,T. Then [ 1 Pr T T ] X i E(X i ) ǫ 1 2e Tǫ2 i=1 7 2.

8 0 M m 0 H M 0 V x V M 0 n-1 M x FIG. 2: A circuit to show the BQP hardness. We show that the following BQP protocol solves PDD-Max with a 1/poly(N) completeness-soundness gap (i.e., the gap of acceptance probabilities between the yesinstances and the no-instances is lowerbounded by 1/poly(N)): 1. Flip a fair coin s {0,1}. Generate U s+1 0 N, and measure each qubit in the computational basis. Let z {0,1} N be the measurement result. 2. Run the SWAP test (Fig. 3) between U 1 0 N and z for T times, where T is a polynomial of N specified later. Let m j {0,1} be the measurement result of the jth run, where j = 1,2,...,T. Calculate p z 1 T T ( 1) m j. j=1 From the Chernoff-Hoeffding bound, p z p z ǫ with probability larger than 1 2e Tǫ2 2, where p z z U 1 0 N 2. In a similar way, calculate the estimator q z of q z z U 2 0 N Calculate p z q z. If p z q z a a b, accept. Otherwise, reject. 4 First, let us consider the case when the answer to PDD-Max is YES. If z obtained in step 1 satisfies p z q z a, and if p z and q z satisfy p z p z a b 8 and q z q z a b 8, we definitely accept. The probability η of occurring such an event is lowerbounded as η a 2 ( p z +q ) z 2 z: p z q z a ) 2 (1 2e T(a b)2 128 a 2 (1 2e k ) 2, [ Pr p z p z a b 8 ] [ Pr q z q z a b ] 8 8

9 0 H H M ψ φ SWAP FIG. 3: The SWAP test between ψ and φ. SWAP in the circuit means the SWAP gate that exchanges two quantum states as ψ φ φ ψ. The expectation value of ( 1) m for the measurement result m is ψ φ 2. where we have taken T 128k (a b) 2 and k is any polynomial of N. Therefore, the acceptance probability p acc of our protocol is lowerbounded as p acc η a 2 (1 2e k ) 2. Next, let us consider the case when the answer to PDD-Max is NO. If p z p z a b 8 and q z q z a b 8, which occurs with probability (1 2e k ) 2, we definitely reject. The rejection probability p rej is therefore lowerbounded as p rej (1 2e k ) 2. Therefore, the acceptance probability p acc is upperbounded as p acc = 1 p rej 1 (1 2e k ) 2 = 4e k 4e 2k. The completeness-soundness gap is therefore a 2 (1 2e k ) 2 (4e k 4e 2k ) 1 poly(n) for sufficiently large k, which shows that PDD-Max is in BQP. III. RESTRICTION TO FH 2 CIRCUITS In this section, we show that if U 1 and U 2 are restricted to some circuits in FH 2, PDD- Max is in MA with honest BQP Merlin. We mean that a promise problem A is in MA with honest BQP Merlin, if A is in MA, and the prover (honest Merlin) that makes the verifier (Arthur) accept with high probability for the yes-instances is a BQP prover. 9

10 To understand our idea, we first restrict U 1 and U 2 to be circuits in the form of Fig. 1(a). Similar results are obtained for other circuits in FH 2, such as IQP circuits and the Simon type ones. These generalizations are discussed at the end of this section. Our MA protocol with honest BQP Merlin runs as follows. 1. If Merlin is honest, he flips a fair coin s {0,1}. He next generates U s+1 0 N, and measures each qubit in the computational basis to obtain the result z {0,1} N. He sends z to Arthur. If Merlin is malicious, his computational ability is unbounded, and what he sends to Arthur can be any N bit string. 2. Let T be a polynomial of N specified later. Arthur generates {x i } T i=1 and {y i } T i=1, where each of x i {0,1} N 1 and y i {0,1} N 1 is a uniformly and independently chosen random N 1 bit string. 3. Arthur calculates p z 1 T T f(x i,y i ), i=1 where f(x,y) ( 1) N 1 j=1 [C j(x0) z j +C j (y0) z j ] δ CN (x0),z N δ CN (y0),z N. Here, C : {0,1} N w C(w) {0,1} N is the classical circuit in U 1, x0 (x 1,...,x N 1,0), C j (x0) is the jth bit of C(x0) {0,1} N, and z j is the jth bit of z {0,1} N. We call p z the estimator of p z. Note that p z can be calculated in classical poly(n) time. 4. In a similar way, Arthur calculates the estimator q z of q z. If Arthur accepts. Otherwise, he rejects. p z q z a a b 4, 10

11 Note that p z is given as p z = 1 2 2(N 1) x,y {0,1} N 1 f(x,y). Therefore, from the Chernoff-Hoeffding bound, the estimator p z satisfies p z p z ǫ with probability 1 2e Tǫ2 2. For q z, a similar result holds. It is easy to check that the honest prover is a BQP prover in the above protocol. Now we show that the above protocol can verify PDD-Max. The proof is similar to that for the BQP case given in Sec. II. First, let us consider the case when the answer to PDD-Max is yes. If the z that Merlin sends to Arthur satisfies p z q z a, and the p z and q z that Arthur calculates satisfy p z p z a b and q 8 z q z a b, Arthur definitely accepts. Taking the honest prover in 8 step 1, the probability η of occurring such an event is lowerbounded as η a 2 ( p z +q ) z 2 z: p z q z a (1 2e T(a b)2 128 [ Pr p z p z a b 8 ) 2 a 2 (1 2e k ) 2, ] [ Pr q z q z a b ] 8 where we have taken T 128k (a b) 2 and k is any polynomial of N. Therefore, the probability p acc that Arthur accepts in our protocol is lowerbounded as p acc a 2 (1 2e k ) 2. Next, let us consider the case when the answer to PDD-Max is no. If p z p z a b 8 and q z q z a b 8, which occurs with probability (1 2e k ) 2, Arthur definitely rejects. Therefore, the probability p acc that Arthur accepts in our protocol is upperbounded as p acc 1 (1 2e k ) 2 = 4e k 4e 2k. The completeness-soundness gap is therefore a 2 (1 2e k ) 2 (4e k 4e 2k ) 1 poly(n) for sufficiently large k, which shows that PDD-Max is in MA with honest BQP Merlin. From the proof, it is clear that similar results hold for other circuits in FH 2 whose f(x,y) is bounded by at most poly(n) and calculatable in classical polynomial time (in x, y, and z ). For example, let us consider the IQP model. For the IQP model, f(x,y) is a 11

12 complex-valued function, but we can use the Chernoff-Hoeffding bound for complex random variables introduced in Ref. [34]. The other example is Fig. 1(c). The model of Fig. 1(a) uses only one single ancilla qubit that is not rotated by H. The model of Fig. 1(c) is a generalization of Fig. 1(a) so that m = poly(n) ancilla qubits initialized in 0 are available. Such a circuit is used, for example, in the Simon s algorithm [23]. We can show a similar result for such a circuit. In fact, the probability p s,t of obtaining the result (s,t) {0,1} N m {0,1} m is p s,t = 1 2 2(N m) x,y {0,1} N m ( 1) C1,...,N m(x0m) s+c1,...,n m(y0m) s δ t,cn m+1,...,n (x0 m )δ t,cn m+1,...,n (y0 m ), and therefore the Chernoff-Hoeffding bound argument can be used. Here, C 1,...,N m (x0 m ) is the first N m bits of C(x0 m ), and C N m+1,...,n (y0 m ) is the last m bits of C(x0 m ). IV. QUANTUM SUPREMACY OF OUR MODEL In this section, we provide the results on quantum supremacy of the HC1Q model in Fig. 1 (a). First we show that the model is universal with a postselection. We are given a unitary operator U = u t...u 2 u 1 acting on n qubits, where u i is H or a classical gate for all i = 1,2,...,t. From U, we define U u t+n...u t+1 U, where u t+i ish acting onith qubit (i = 1,2,...,n). Let us consider the following polynomialtime non-deterministic algorithm, which simulates the action of U on 0 n. We represent the state of the register of the polynomial-time non-deterministic computing by s z, where s {0,1} and z {0,1} n. (Note that using the ket notation to represent the state of the register of the polynomial-time non-deterministic computing is just for convenience. The polynomial-time non-deterministic computing is, of course, not quantum computing.) 1. The initial state of the register is s = 0 z = 0 n. 2. Repeat the following for i = 1,...,t+n. 12

13 2-a. If u i is a classical gate we update the state of the register as g : {0,1} n z g(z) {0,1} n, s z s g(z). 2-b. If u i is H acting on jth qubit, we update the state of the register in the following Let us define h by non-deterministic way: s z 1,...,z j 1,0,z j+1,...,z n s z s z j z 1,...,z j 1,1,z j+1,...,z n. h {i {1,2,...,t+n} ui = H}, i.e., h is the number of H appearing in U. The above polynomial-time non-deterministic algorithm does the non-deterministic transition h times, and therefore the algorithm has 2 h computational paths. We label each path by an h-bit string y {0,1} h. We write the final state of the register for the path y {0,1} h by s(y) z(y), where s(y) {0,1} and z(y) {0,1} n. For each y, we can calculate s(y) and z(y) in classical polynomial-time. Let W be a classical circuit that calculates s(y) and z(y) on input y. It is obvious that U 0 n = 1 2 h y {0,1} h ( 1) s(y) z(y). Now we show that the state H n U 0 n = U 0 n can be generated by the HC1Q model with a postselection. Let us consider the quantum circuit of Fig. 4. It is easy to show that the state immediately before the postselection is 1 2 n+h+1 y {0,1} h (H h y ) (H s(y) ) (H n z(y) ) 1 + ψ 0, (1) where ψ is a certain (h + n + 1)-qubit state whose detail is irrelevant [35]. After the postselection, the state becomes 1 2 h y {0,1} h ( 1) s(y) H n z(y) = H n U 0 n = U 0 n. 13

14 0 H 0 H W 0 0 h n H H H H 0 FIG. 4: The quantum circuit with a postselection. The first h qubits, the (h+1)th qubit, and the last qubit are postselected to 0 h, 1, and 1, respectively. In this way, we have shown that the HC1Q model is universal with a postselection. By combining the above result with the well-known technique [21, 26, 28], we can show that the output probability distribution of the HC1Q model cannot be classically efficiently sampled with a multiplicative error ǫ < 1 unless the polynomial-time hierarchy collapses to the third level. It was shown in Refs. [30, 31] that the third level collapse of the polynomial-time hierarchy for most of the sub-universal models (including the depth-four model [25], the Boson sampling model [26], the IQP model [21], and the DQC1 model [28]) is improved to the second level collapse. The idea is to use the class NQP [37] in stead of postbqp. NQP is a quantum version of NP, and defined as follows. Definition: A promise problem A = (A yes,a no ) is in NQP if and only if there exists a polynomial-time uniformly-generated family {V x } x of quantum circuits such that if x A yes then p acc > 0, and if x A no then p acc = 0. Here p acc is the acceptance probability of V x. By using a similar argument of Refs. [30, 31], we now show that the collapse of the polynomial-time hierarchy to the third level for the HC1Q model can be improved to that to the second level. In stead of doing the postselection, let us do the projective measurement {Λ,I h+n+2 Λ} on the state of Eq. (1). If Λ is obtained, we accept. Here, The acceptance probability p acc is Λ 0 0 h I n p acc = 0n U ( 0 0 I n 1 )U 0 n 2 h+n+2. Let us assume that a promise problem A = (A yes,a no ) is in NQP. Then there exists a polynomial-time uniformly-generated family {V x } x of quantum circuits that satisfies the 14

15 above definition of NQP. For an instance x, let us take U as V x. Assume that p acc is classically efficiently sampled with a multiplicative error ǫ < 1. It means that there exists a classical polynomial-time computer such that p acc q acc ǫp acc, where q acc is the probability that the classical computer accepts. If x A yes then q acc (1 ǫ)p acc > 0. If x A no then q acc (1+ǫ)p acc = 0. A is therefore in NP. Hence NQP NP, which leads to the collapse of the polynomial-time hierarchy to the second level [30]: PH BP coc = P = BP NQP = BP NP = AM. V. CLASSICAL SIMULATABILITY In this section, we show that probability distributions of measurement results on k = O(log(N)) qubits of Fig. 1(a) and (c) can be classically sampled in polynomial time with a 1/poly(N) L1-norm error. For simplicity, a proof is given for the model of Fig. 1(a). The same proof works for the model of Fig. 1(c). Furthermore, for simplicity, we assume that the first k qubits are measured. Generalizations to other k qubits are easy. Let z {0,1} k be the measurement result. By a straightforward calculation, the probability of obtaining z is p z = 1 2 N 1 x {0,1} N 1 f(x), where f(x) 1 ( 1) z C1,...,k(x0)+z C1,...,k(y0) δ 2 k Ck+1,...,N (x0),c k+1,...,n (y0) y {0,1} N 1 = 1 ( 1) z C 1,...,k(x0)+z C 1,...,k (y0), 2 k y S 15

16 and S {0,1} N 1 is defined by S {y {0,1} N 1 C k+1,...,n (x0) = C k+1,...,n (y0)}. The subset S can be obtained in polynomial time in the following way: 1. Set S = {}. 2. Repeat the following for all α {0,1} k Calculate C 1 (αc k+1,...,n (x0)) If C 1 (αc k+1,...,n (x0)) = y0 for certain y {0,1} N 1, add y to S. 3. End. From the construction, S 2 k = poly(n). Therefore, the value of f(x) is exactly computable in polynomial time for each x. Furthermore, f(x) 1 because f(x) 1 ( 1) z C 1,...,k(x0)+z C 1,...,k (y0) 1. 2 k y S By using the Chernoff-Hoeffding bound, we can calculate the estimator p z of p z that satisfies in time poly(t). [ ] Pr p z p z ǫ 1 2e Tǫ2 2 For any polynomial r, let us take ǫ = k r. Given { p z} z, define the probability distribution {q z } z by q z p z z {0,1} k p z. Note that it is well defined, because z {0,1} k p z > 0, which is shown as follows: z {0,1} k p z z {0,1} k p z z {0,1} k (p z ǫ) = 1 2 k ǫ = k r > 0. 16

17 Furthermore, {q z } z is obtained in polynomial time. The distance between {p z } z and {q z } z is It is shown as follows. First, z {0,1} k p z q z 5 2 2k ǫ = 1 r. p z q z = z {0,1} p k z p z +ǫ 1 2 k ǫ = (p z +ǫ)(1+2 k ǫ+o(2 k ǫ)) = p z +p z 2 k ǫ+p z o(2 k ǫ)+ǫ+2 k ǫ 2 +ǫo(2 k ǫ) p z +5 2 k ǫ. Second, p z q z = z {0,1} p k z p z ǫ 1+2 k ǫ = (p z ǫ)(1 2 k ǫ+o(2 k ǫ)) = p z p z 2 k ǫ+p z o(2 k ǫ) ǫ+2 k ǫ 2 ǫo(2 k ǫ) p z 5 2 k ǫ. We finally show that {q z } z can be sampled in classical polynomial time. For simplicity, let us assume that each q z is represented in the m-bit binary: m q z = 2 j a z,j, j=1 where a z,j {0,1} for j = 1,2,...,m. (Otherwise, by polynomially increasing the size of m, we obtain exponentially good approximations.) The following algorithm samples the probability distribution {q z } z. 1. Randomly generate an m-bit string (w 1,...,w m ) {0,1} m. 2. Output z {0,1} k such that q y y<z j=1 m 2 j w j < q y, y z where y < z and y z mean the standard dictionary order. (For example, for three bits, 000 < 001 < 010 < 011 < 100 < 101 < 110 < 111.) 17

18 Acknowledgments We thank Keisuke Fujii, Seiichiro Tani, and Francois Le Gall for discussion. TM is supported by JST ACT-I No.JPMJPR16UP, JST PRESTO, and the Grant-in-Aid for Young Scientists (B) No.JP17K12637 of JSPS. YT is supported by the Program for Leading Graduate Schools: Interactive Materials Science Cadet Program and JSPS Grant-in-Aid for JSPS Research Fellow No.JP17J HN is supported by the Grant-in-Aid for Scientific Research (A) Nos , 16H01705 and (C) No.16K00015 of JSPS. [1] BQP is the class of promise problems that can be solved in quantum polynomial time. Here, a promise problem is a problem that can be answered by YES or NO under some promised conditions. A BQP prover is a prover whose computational ability is quantum polynomialtime. BPP is the class of promise problems that can be solved in classical probabilistic time. A BPP verifier is a verifier whose computational ability is classical probabilistic polynomial-time. [2] D. Aharonov and U. Vazirani, Is quantum mechanics falsifiable? A computational perspective on the foundations of quantum mechanics. arxiv: [3] T. Morimae, D. Nagaj, and N. Schuch, Quantum proofs can be verified using only single-qubit measurements. Phys. Rev. A 93, (2016). [4] T. Morimae and J. F. Fitzsimons, Post hoc verification with a single prover. arxiv: [5] J. F. Fitzsimons and E. Kashefi, Unconditionally verifiable blind computation. Phys. Rev. A 96, (2017). [6] D. Aharonov, M. Ben-Or, E. Eban, and U. Mahadev, Interactive proofs for quantum computations. arxiv: [7] M. Hayashi and T. Morimae, Verifiable measurement-only blind quantum computing with stabilizer testing. Phys. Rev. Lett. 115, (2015). [8] A. Broadbent, How to verify quantum computation. arxiv: [9] A. Gheorghiu, T. Kapourniotis, and E. Kashefi, Verification of quantum computation: an overview of existing approaches. arxiv: [10] M. McKague, Interactive proofs for BQP via self-tested graph states. Theory of Computing 12, 1 (2016). 18

19 [11] Z. Ji, Classical verification of quantum proofs. Proceedings of the 48th annual ACM symposium on Theory of Computing (STOC 2016) p.885 (2016). [12] B. W. Reichardt, F. Unger, and U. Vazirani, Classical command of quantum systems. Nature 496, 456 (2013). [13] IP is the class of promise problems verified by an interactive proof system with a BPP verifier and a prover with unlimited computational ability. [14] D. Aharonov and A. Green, A quantum inspired proof of P #P IP. arxiv: [15] E. Bernstein and U. Vazirani, Quantum complexity theory. SIAM Journal on Computing 26, 1411 (1997). [16] M. McKague, Interactive proofs with efficient quantum prover for recursive Fourier sampling. Chicago Journal of Theoretical Computer Science 6, 1 (2012). [17] T. F. Demarie, Y. Ouyang, and J. F. Fitzsimons, Classical verification of quantum circuits containing few basis changes. arxiv: [18] Y. Shi, Quantum and classical tradeoffs. Theoretical Computer Science 344, 335 (2005). [19] FH k, the kth level of the Fourier hierarchy, is the class of quantum circuits with k levels of Hadamard gates and all other gates preserving the computational basis. [20] Merlin-Arthur (MA) is the class of promise problems that can be verified by a BPP verifier and a prover whose computational ability is unlimited. In MA, the prover first sends a bit string to the verifier, and the verifier then does the computing for the verification. [21] M. J. Bremner, R. Jozsa, and D. J. Shepherd, Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proc. R. Soc. A 467, 459 (2011). [22] M. J. Bremner, A. Montanaro, and D. J. Shepherd, Average-case complexity versus approximate simulation of commuting quantum computations. Phys. Rev. Lett. 117, (2016). [23] D. R. Simon, On the power of quantum computation. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.116 (1994). [24] P. Shor, Algorithms for quantum computation: discrete logarithms and factoring. Proceedings of the 35th Annual Symposium on Foundations of Computer Science (FOCS 1994), p.124 (1994). [25] B. M. Terhal and D. P. DiVincenzo, Adaptive quantum computation, constant depth quantum circuits and Arthur-Merlin games. Quant. Inf. Comput. 4, 134 (2004). [26] S. Aaronson and A. Arkhipov, The computational complexity of linear optics. Theory of 19

20 Computing 9, 143 (2013). [27] E. Knill, and R. Laflamme, Power of one bit of quantum information. Phys. Rev. Lett. 81, 5672 (1998). [28] T. Morimae, K. Fujii, and J. F. Fitzsimons, Hardness of classically simulating the one clean qubit model. Phys. Rev. Lett. 112, (2014). [29] T. Morimae, Hardness of classically sampling one clean qubit model with constant total variation distance error. Phys. Rev. A 96, (R) (2017). [30] K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Impossibility of classically simulating one-clean-qubit computation. arxiv: [31] K. Fujii, H. Kobayashi, T. Morimae, H. Nishimura, S. Tamate, and S. Tani, Power of quantum computation with few clean qubits. Proceedings of 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016), p.13:1. [32] B. Fefferman and C. Umans, The power of quantum Fourier sampling. arxiv: [33] A. Bouland, J. F. Fitzsimons, and D. E. Koh, Quantum advantage from conjugated Clifford circuits. arxiv: [34] M. Schwarz and M. Van den Nest, Simulating quantum circuits with sparse output distributions. arxiv: [35] Note that the (n + 1)-qubit Toffoli gate in Fig. 4 can be implemented with a polynomially many Toffoli gates by using ancilla qubits [36]. It is known that ancilla qubits do not need to be initialized [36]. Therefore, we can use + states as ancilla qubits, which keeps the circuit of Fig. 4 in the form of Fig. 1(a). [36] A. Barenco, C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T. Sleator, J. A. Smolin, H. Weinfurter, Elementary gates for quantum computation. Phys. Rev. A (1995). [37] L. M. Adleman, J. DeMarrais, and M. A. Huang, Quantum Computability. SIAM J. Comput (1997). 20