arxiv: v1 [quant-ph] 18 Nov 2014

Transcription

1 Overcoming efficiency constraints on bind quantum computation Caros A Pérez-Degado 1 and oseph F Fitzsimons1, 2, 1 Singapore University of Technoogy and Design, 20 Dover Drive, Singapore Centre for Quantum Technoogies, Nationa University of Singapore, 3 Science Drive 2, Singapore ing of gates independenty chosen from a set of cardinaity G requires an exchange of at east ogg ogbd qudits Whie for any fixed choice of d and B this approach yieds a bound simiar to the no-programming theorem, it is more widey appicabe As such, it is tempting to conjecture that the no-programming bound of Ω og 2 G) on the number of bits/qubits exchanged appies to any approach to bind quantum computation In this paper, however, we show that such an efficiency constraint can be overcome if the cient is aowed to prepare arbitrary singe or muti-qubit states The protocos we construct are not ony more efficient than previous bind computation protocos, but require ess communication than is required to cassicay describe the deegated computation Before presenting the main protoco, we first present a precursor protoco which forms the main buiding boc of our fina protoco Our approach is based on gate teeportation [14], but differs from standard usages in that instead of directy correcting errors induced by teeportation byproducts, we mae use of additiona gate teeportation steps to correct the state of the system This avoids the need to provide a cassica description of the correction operator, eading to a saving in the tota communication cost of the protoco, in turn aowing our protoco to avoid the ower bound on communication of og 2 G which resuts from a naive appication of the noprogramming theorem Consider the set D m, of a diagona operators acting on m qubits of the form expi j {0,1} m θ j Z j 1 Z j 2 Z j m ), with θ j { rπ r {0,1,2,3,,2 1}} Our approach a- 2 arxiv: v1 [quant-ph] 18 Nov 2014 Bind quantum computation aows a user to deegate a computation to an untrusted server whie eeping the computation hidden A number of recent wors have sought to estabish bounds on the communication requirements necessary to impement bind computation, and a bound based on the no-programming theorem of Niesen and Chuang has emerged as a natura imiting factor Here we show that this constraints ony hod in imited scenarios and show how to overcome it using a method based on iterated gate-teeportations We present our resuts as a famiy of protocos, with varying degrees of computationa-abiity requirements on the cient Certain protocos in this famiy exponentiay outperform previousy nown schemes in terms of tota communication The approach presented here can be adapted to other distributed computing protocos to reduce communication requirements Bind quantum computation is a cryptographic tas whereby a cient sees to hide a deegated computation from the server impementing the computation A number of protocos for bind computation have been discovered exhibiting either information theoretic security [1 10], for which it can be proven that a cheating server cannot earn anything about the computation being performed based on purey information theoretic grounds, or cheat-sensitivity [11], whereby a cheating server can be detected even though the computation cannot be ept hidden from it A range of capabiities for the cient have aso been considered, from the abiity to prepare or measure individua singe qubit states [1, 5, 6], to the abiity to perform universa computation on fixed size systems [2] Recenty wor has sought to unify this disparate famiy of protocos in terms of security definitions [12] and in terms of resource accounting [9, 11] Recenty, Giovannetti, Maccone, Morimae and Rudoph proposed a nove cheat-sensitive protoco for bind quantum computation, for which the tota communication required scaes optimay for their specific setting [11] However, their optimaity argument appies ony to the case where the cient is restricted to preparing and performing projective measurements on singe qubits in two bases In this case, they argued based on the no-programming theorem of Niesen and Chuang [13] that Ω og 2 G) qubits must be exchanged between cient and server, where is the tota number of gates performed, and G is the cardinaity of the gate set A sighty weaer bound than that provided by the no-programming theorem can be shown for any protoco where the cient is restricted to preparing or measuring qudits of dimension D in one of B bases, by counting the number of possibe branches of the protoco: the cient s actions amount to a series of s preparations and measurements, since any cassica communication can aso be viewed in this way As the cient has no memory, preparations correspond to the transmission of a qudit to the server, and measurements correspond to the transmission of a qudit from the server As such, s qudits in tota are exchanged In order for the cient s actions to determine which of N C possibe computations is performed, it is necessary to have s ogn C ogbd by the pigeon-hoe principe Hence, in this setting, bind computation of a circuit of depth consist- FIG 1: Gate teeportation procedure The top set of wires corresponds to register R, whie the bottom set correspond to R

2 2 Protoco 1 Iterated Teeportation Aice s input: Gate D D m, to be teeported Bob s input: Initia state ψ, in register R Output: The state XD ψ in Bob s register R, where X is a tensor product of the Paui-X operator and the identity, nown both to Bob and Aice Steps: 1 Set D 1 = D 2 For 1 a) Aice prepares the state D + m, and sends it to Bob, who stores it in register R b) Bob appies the teeportation procedure depicted in Fig 1 obtaining measurement resuts s ) 1,,s) m He sends the measurement resuts to Aice c) Bob swaps the contents of register R and R d) Set D +1 = X D X D, where X = m i X s) i 3 Set X = X ) Bob now has the desired state XD ψ in register R ows Aice to successfuy teeport any given operator D D m, to Bob in at most steps, each invoving the transmission of m qubits This gives a tota cost of Om) Compare this to any setting where the no-programming theorem appies, which sets a minimum of Ω2 m ) qubits to be transmitted We wi assume that Bob s system contains two registers R and R The muti-qubit gate teeportation circuit we use is depicted in Fig 1 This procedure is formaised in Prot 1 Note that at the end of Prot 1, Bob is in possession of the desired output state, up to a series of Paui-X corrections, which he can perform himsef in this non-bind version Before discussing a bind version of Prot 1 we show that this protoco, if foowed by both Aice and Bob, does indeed yied the correct output [16] We wi begin by examining the effect of an iteration of the main oop Steps 2a through 2d) on an arbitrary input state ψ in register R Each iteration serves to impement a gate teeportation so that an input state ψ is transformed to ψ +1 = D X ψ Thus, ψ = D X ) ψ, 1) where the product operator is used to denote that the eft to right ordering is from highest to owest vaue of Note that if an operator D D m,t then n =1 X a )D n =1 X a )D D m,t 1 for any choice of variabes a {0,1} Thus, for any, we have D D m, +1 Since D m,1 corresponds to the set of tensor products of Z and the identity, D X = ±X D Thus, up to a goba phase, we have 1 ψ = X D D X ) ψ j, 2) Protoco 2 Bind Iterated Teeportation Aice s input: Gate D D m, to be teeported Bob s input: Initia state ψ, in register R Output: The state ZXD ψ in Bob s register R, where Z X) is a tensor product of the Paui-Z Paui-X) operator and the identity, and Z is Aice s encryption ey, nown ony to her Steps: 1 Set D 1 = D 2 For 1 a) Aice prepares the state Z Z 1 D + m, where Z = m=1 Z r), where r ), 1 x are uniformy random bits, and Z 0 = I She transmits it to Bob, who stores it in register R b) Bob appies the teeportation procedure depicted in Fig 1 obtaining measurement resuts s ) 1,,s) m He sends the measurement resuts to Aice c) Bob swaps the contents of register R and R d) Set D +1 = X D X D, where X = m i X s) i 3 Set X = X ), and Z = Z Bob now has the desired state ZXD ψ in register R which coapses teescopicay, substituting in the definition of D, to yied ψ = X )D 1 ψ j 3) Setting X = X ) competes the proof Note that, at this stage, Bob can correct his state by appying Paui-X to his qubits as appropriate, without nowing the teeported gate, and without any further assistance or communication from Aice Next we present a bind version of Prot 1 This procedure aows for the same functionaity as the previous protoco, enabing Aice and Bob to perform gate teeportation of a gate encoded by Aice, whie additionay ensuring that the gate remains unnown to Bob The procedure for accompishing this is presented in Prot 2 The proof of correctness of Prot 2 is simiar to that of Prot 1 The ony difference is that now each iteration adds a series of random Paui-Z operators With each iteration an input state ψ is transformed to ψ +1 = Z Z 1 D X ψ Thus, ψ = Z Z 1 D X ) ψ, 4) where, again, the product operator is used to denote that the eft to right ordering is from highest to owest vaue of As before, we use the property of D m,1, and the definition of D to teescopicay coapse the ast equation to ψ = Z X )D 1 ψ j 5)

3 3 0i H H H H 0i H H H H 0i H D 1 H D 2 H D 1 H D 0i H H H H y o i FIG 2: Bind Quantum Computation with Teeportation Protoco The dotted-ine square shows the repeating pattern of operations Now we turn to the bindness of the protoco The ony information transmitted from Aice to Bob are the set of quantum states φ = Z Z 1 D 0 m Note that ony φ is a function of r ) for 1 m, and that as these vaues are unnown to Bob, this state is necessariy the maximay mixed state of m qubits, and hence independent of the vaues of a other r ) when Hence φ 1 is the ony quantum state dependent on r 1) for 1 m, and must simiary be in a maximay mixed state We can appy this argument recursivey, impying that every state sent from Aice to Bob is in the maximay mixed state due to the unnown vaues of {r 1 m,1 }, which serve as Aice s ey As the joint state of a these messages are fixed to the maximay mixed state and hence independent of the computation, the ony parameters eaed to Bob are and m We are now in a position to present a compete protoco for universa bind quantum computation Rather than present a singe protoco, we introduce a famiy of protocos which are parameterised by an integer m, corresponding to the size of the cient s system During intermediate steps Aice wi instruct Bob to perform m-qubit gates via gate-teeportation, using Prot 2 The purpose of studying protocos with varying parameter m is the foowing When m = 1, we obtain a protoco with the most modest computationa requirements 1 on Aice she need ony be abe to prepare and send singe qubits in a finite set of states whie sti outperforming previous protocos On the other hand, when m is proportiona to the number of qubits used in the computation, n, the protoco achieves an exponentia in n) separation in tota communication from the naive imit impied by the no-programming theorem The protoco proceeds in phases During the jth teeportation phase, Aice wi use gate teeportation to send the desired gates to Bob Without oss of generaity we assume that m divides n [17], such that n = Pm, for some integer P Then for each contiguous set of m qubits Aice wi teeport an operator D j,p, to Bob, for 1 p P, who wi then appy it to the qubits abeed p 1)m + 1 through pm of his current state in memory Thus, if at the beginning of the jth phase Bob s register is in the state ψ j, by the end of the phase it wi be in state D j ψ j, where D j = P p=1 D j,p As the set of gates which may be impemented by gate teeportation do not form a universa gate set, the scheme we present here everages fixed gates impemented by Bob to bring about universaity in a competey bind manner, as foows Interspersed with the operations that Aice teeports, Bob wi aso appy the operation CZ = n 1 i=1 CZi,i + 1), where CZi, i+1) is the controed-z operator acting on qubits i and i + 1; as we as the operator H = H n, where H is the usua Hadamard operator The order of phases of the protoco is as foows The first step consists of controed-z operators, foowed by a Hadamard step, then a teeportation phase, then another Hadamard phase, foowed by a second teeportation phase Then, the pattern repeats itsef unti teeportation phases have been achieved To simpify the anaysis, and without oss of generaity, we assume is even This set of operations forms a universa set of gates for quantum computation for any m, and any x 2 see for exampe [15]) See Fig 2 for a schematic diagram and Prot 3 for forma presentation of the protoco The correct operation of the protoco depends on the proper definition of the function f j used in Step 3c This function is meant to correct and remove the X errors and the Z obfuscation operators introduced in previous steps Before giving a genera definition of f j, ets first consider a simpified version of the protoco where m = n and the phases of controed-z operators have been subsumed into the diagona operator teeportation phases Hence, the protoco simpifies into a series teeported gate phases foowed by a ayer of Hadamard gates The output of the protoco is then given by ψ o = Z j X j f j D j )H ) 0 n, 7) where the product operator is used to denote that the eft to right ordering is from highest to owest vaue of j Because there is a ayer of Hadamard gates in between every teeportation stage, the Z operator byproducts are turned into X operators, and vice versa, before the the next teeportation Since Aice can ony impement diagona gates using Prot 2, she can ony correct the X byproducts of the previous stage She can, however, conjugate her current gate with the previous Z operators, so as to commute that operator forward, so that it can be corrected in the foowing teeportation stage In this case, f j is given by: f j D) = HZ j 1 HDZ j 2 HX j 1 Z j 1 H, 8) where Z j = X j = I for a j < 1 It is straightforward to verify from the definition above that f j maps D m, onto itsef Now, substituting into Eq 7 we get ψ o = Z X D j H ) 0 n 9) From this state, Aice can get the correct output for computation by having Bob measure in the X basis, and sending her the output After this, she uses her decryption ey

4 4 Protoco 3 Genera Iterated Teeportation Bind Quantum Computation 1 Aice chooses a depth and a set of diagona operations D j = P p=1 D j,p, D j,p D m,x, where P = and n is the number of qubits used in the computation, such that her target computation is given by the measurement of HD HD 1 HCZCZD 2 HD 1 + n in the computationa basis 2 Aice produces the state Z 1 D 1 + n, where Z 1 = m =1 Z r1), where each r 1) is chosen uniformy at random from the set {0,1}, and transmits and this state to Bob, who stores the quantum state in register R 3 For 2 j a) If j 1 mod 2, then Bob appies CZ to register R b) Bob appies H to register R c) For 1 p P i Aice cacuates the operator f j,p D j,p ), where the function f j,p is defined in the main text in Eq 11 ii Aice and Bob engage in Prot 2 using f j,p D j,p ) as Aice s target gate, and Bob s qubits p 1)m through pm as the target register iii Aice eeps a record of the operator X j,p, the teeportation byproduct resuting from Prot 2, and Z j,p her encryption ey d) Aice cacuates the operators X j = X j,p, Z j = Z j,p, 6) p p and eeps a record of them 4 Finay, Bob measures his resuting state in the X basis, and sends the measurement outcomes m 1 m n to Aice Aice computes each output bit for the computation as o = m r, where Z = Z r The anaysis of the fu protoco is sighty more invoved due to the re-)introduction of the CZ gates, since these affect the propagation of X byproducts Fortunatey, errors propagate ony once, to the nearest neighbours before they can be corrected To see this, note that in between every two CZ gate stages, there are two sequences of Hadamard operators foowed by gate teeportations Hence, any error that cannot be fixed in the gate-teeportation phase immediatey preceding the CZ stage, can be corrected in the subsequent phase In order to define the genera correction function f j,p, et x j, and y j, be such that X j = n X x j,, and Z j = =1 n Z z j, 10) =1 For even j we tae χ j, = z j 1, and ζ j, = z j 2, +x j 1, + t { 1,1} z j 3,+t + x j 2,+t ), and for odd j we tae χ j, = z j 1, + t { 1,1} z j 2,+t + x j 1,+t ) and ζ j, = z j 2, + x j 1, Then, finay, for a j and p we define ) ) f j,p D) = X χ j, D Z ζ j, X χ j,, 11) where the tensor products are taen over vaues of ranging from p 1)m + 1 to pm The correctness of the genera protoco foows from a simiar argument to that of the specia case previousy considered The output of the genera protoco is given by ψ o = Z j X j f j,p D j,p ) HCZ j 0 n, 12) p=1 where the product operator is used to denote that the eft to right ordering is from highest to owest vaue of j Substituting Eq 11 into Eq 12, with some eementary agebra, gives ψ o = Z X D j HCZ j) 0 n, 13) as required The proof of bindness of the main protoco foows directy from the proof of bindness of Prot 2 Setting the parameter m equa to n, the above protoco requires that Aice transmit exacty x different n qubit states to Bob, and hence requires ony a tota of nx qubits to be sent from Aice to Bob, and nx cassica bits to be sent from Bob to Aice However, this protoco impements unnown operations, each of which can be drawn arbitrariy from the set D which has cardinaity 2 ) 2n 1) Any scheme to which the no-programming theorem appies, such as that in [11], woud require that at east 2 n 1) qubits or bits be communicated, and hence the protoco presented here is exponentiay more efficient than than previous schemes Setting m equa to n requires Aice to prepare arge entanged states, which may be undesirabe in reaistic settings Setting m to a sma constant, gives a protoco that is at east as easiy impementabe as previous ones in terms of resources needed on Aice s side, whie sti being universa for quantum computation, and offering a communication advantage The approach of iterated teeportation introduced in this comment can be appied to other measurement-based bind computation protocos such as [1], [5] and [9]) to achieve smaer advantages over the no-programming theorem bound It can be used outside of the bind computation setting, to reduce communication requirements in other deegated computation scenarios via Prot 1The notion of bindness used here is compatibe with requirements for composabe security in the abstract cryptography framewor [12], meaning that there is no compromise in security This materia is based on research funded by the Singapore Nationa Research Foundation under NRF Award NRF- NRFF We than Lorenzo Maccone, Tomoyui Morimae and Terry Rudoph for hepfu comments on the manuscript

5 5 Eectronic address: joseph [1] A Broadbent, Fitzsimons, and E Kashefi, Proceedings of the 50th Annua IEEE Symposium on Foundations of Computer Science FOCS 2009) pp ) [2] D Aharonov, M Ben-Or, and E Eban, in Proceedings of Innovations in Computer Science ), p 453 [3] S Barz, E Kashefi, A Broadbent, F Fitzsimons, A Zeiinger, and P Wather, Science 335, ) [4] T Morimae and K Fujii, Nature Communications 3, ) [5] F Fitzsimons and E Kashefi, arxiv preprint arxiv: ) [6] T Morimae, Phys Rev Lett ) [7] T Morimae and K Fujii, Physica Review A 87, ) [8] S Barz, F Fitzsimons, E Kashefi, and P Wather, Nature Physics 2013) [9] A Mantri, C A Pérez-Degado, and F Fitzsimons, Phys Rev Lett 111, ) [10] T Suei, T Koshiba, and T Morimae, Physica Review A ) [11] V Giovannetti, L Maccone, T Morimae, and T G Rudoph, Phys Rev Lett 111, ) [12] V Dunjo, F Fitzsimons, C Portmann, and R Renner, arxiv preprint arxiv: ) [13] M A Niesen and I L Chuang, Phys Rev Lett 79, ) [14] D Gottesman and I L Chuang, Nature 402, ) [15] Fitzsimons, L Xiao, S C Benjamin, and A ones, Phys Rev Lett 99, ) [16] A minor modification of Prot 1 invoves Aice and Bob hating the protoco as soon as Bob measures a zeroes In this case, no further corrections are necessary, and the protoco can concude with the correct output state In the case where 2 m < this eads to an average-case communication cost which is independent of [17] This may aways be done, since Aice can pad her input with unused ancia qubits