Kitaev s quantum strong coin-flipping bound

Transcription

1 Kitaev s quantum strong coin-flipping bound In this lecture we will use the semidefinite programming characterization of multiple turn interactions from the previous lecture to prove Kitaev s bound on quantum strong coin-flipping. 8.1 Quantum strong coin-flipping Our first order of business is to clarify what is meant by a quantum strong coinflipping protocol. We imagine an interaction between two individuals, Alice and Bob, along similar lines to the sorts of interactions we discussed in the previous lecture. This time, however, Bob will also produce a measurement outcome, as is suggested by Figure 8.1. More specifically, the set of measurement outcomes for both Alice and Bob is { 0, 1, abort }. (8.1 We will consider what happens when optimizations over the actions of Alice and Bob are performed (individually, but for the moment it is to be assumed that honest actions for both Alice and Bob have been provided by a hypothetical protocol designer. It will sometimes be convenient to refer to these individuals as honest Alice and honest Bob to distinguish them from potentially adversarial individuals. The hypothetical protocol designer s goal is to allow honest Alice and Bob to flip a fair coin, protecting each of them against the possibility that the other player is being dishonest. Similar to what we did in the previous lecture, we will make the assumption that Alice and Bob s actions are specified by isometries: A 1,..., A n for Alice and B 1,..., B n for Bob. Recall that this means, more precisely, that A k U(Z k 1 X k, Z k Y k and B k U(Y k 1 W k 1, X k W k (8.2 1

2 CS 867/QIC 890 Semidefinite Programming in Quantum Information Alice Z 1 Z 2 A 1 A 2 A 3 Z 3 X 1 Y 1 X 2 Y 2 X 3 B 1 B 2 B 3 W 1 W 2 W 3 Bob Figure 8.1: An interaction between Alice and Bob in which both individuals produce a measurement outcome. for each k {1,..., n}, where X 1,..., X n, Y 0,..., Y n, Z 0,..., Z n, and W 0,..., W n are complex Euclidean spaces (and where we assume W 0 = C, Z 0 = C, Y 0 = C, and Y n = C. We will also let Alice s and Bob s measurements be described by the operators { P0, P 1 } Pos(Zn and { Q 0, Q 1 } Pos(Wn, (8.3 where we assume P 0 + P 1 1 and Q 0 + Q 1 1 and implicitly take P abort = 1 (P 0 + P 1 and Q abort = 1 (Q 0 + Q 1. (8.4 Now, we say that such a specification of Alice and Bob constitutes a quantum strong coin-flipping protocol with bias at most ε if the following properties hold: 1. The interaction between honest Alice and honest Bob produces measurement outcomes a and b, respectively, that are distributed so that Pr ( (a, b = (0, 0 = Pr ( (a, b = (1, 1 = 1 2. (8.5 Note that this implies that neither individual outputs abort, and that Alice s output and Bob s output always agree. 2. For every choice of a {0, 1} and every choice of a (possibly dishonest Bob B = (B 1,..., B n, the interaction between honest Alice and B causes Alice to output a with probability at most 1/2 + ε. 3. For every choice of b {0, 1} and every choice of a (possibly dishonest Alice A = (A 1,..., A n, the interaction between A and honest Bob causes Bob to output b with probability at most 1/2 + ε. 2

3 The reason that a coin-flipping protocol meeting these requirements is referred to as strong is that neither outcome can be forced by either individual with probability greater than 1/2 + ε. A weak quantum coin-flipping protocol, on the other hand, implicitly assumes that each player has a preferred outcome (0 for Alice, 1 for Bob, let us say, and only demands that dishonest participants cannot force their preferred outcome with probability greater than 1/2 + ε. 8.2 Kitaev s quantum strong coin-flipping bound The remainder of the lecture will be devoted to a statement and proof of Kitaev s strong quantum coin-flipping bound, which states that it is not possible to devise a strong quantum coin-flipping protocol with bias smaller than 1/ 2 1/2. Theorem 8.1. Suppose that A = (A 1,..., A n, {P 0, P 1 } and B = (B 1,..., B n, {Q 0, Q 1 } (8.6 describe a quantum strong coin-flipping protocol with bias at most ε. It holds that ε (8.7 Proof. Fix any choice of a {0, 1}, and consider the maximum probability with which a dishonest Bob B = (B 1,..., B n can cause honest Alice to output a. As discussed in the previous lecture, this maximum probability can be expressed as a semidefinite program whose dual form is as follows: minimize: Dual problem (for Alice outputting a λ subject to: λ1 X1 A 1 (Z 1 1 Y1 A 1, Z 1 1 X2 A 2(Z 2 1 Y2 A 2,. Z n 2 1 Xn 1 A n 1 (Z n 1 1 Yn 1 A n 1 Z n 1 1 Xn A np a A n, λ R, Z 1 Herm(Z 1,..., Z n 1 Herm(Z n 1. If we were to go through a similar analysis for the maximum probability with which a dishonest Alice A = (A 1,..., A n can cause honest Bob to produce a particular measurement outcome b {0, 1}, we would find that this value is also represented by a semidefinite program. Its dual form is as follows: 3

4 CS 867/QIC 890 Semidefinite Programming in Quantum Information Dual problem (for Bob outputting b minimize: TrX1 (B 1 B1, W 1 subject to: 1 Y1 W 1 B 2(1 X2 W 2 B 2,. 1 Yn 2 W n 2 B n 1 (1 X n 1 W n 1 B n 1 1 Yn 1 W n 1 B n(1 Xn Q b B n, W 1 Herm(W 1,..., W n 1 Herm(W n 1. Note that both problems are strictly feasible, and as the primal forms are feasible, one has strong duality for both semidefinite programs by Slater s theorem. Consider the pure states of the system as A and B (honest Alice and Bob interact: let u k = ( A k 1 Wk 1Zk 1 B k ( A1 1 W1 B1 (8.8 for k = 1,..., n. (Observe that because B 1 is an isometry from Y 0 W 0 = C to X 1 W 1, we may regard it as a unit vector in X 1 W 1. The vector u n Z n W n represents the pure state of the registers (Z n, W n immediately before honest Alice and Bob perform their measurements, while u k represents the state of (Z k, Y k, W k after honest Alice and Bob have each applied k operations, for k = 1,..., n 1. Note that the first requirement of a strong coin-flipping protocol may be expressed as u n(p 0 Q 0 u n = 1 2 = u n(p 1 Q 1 u n. (8.9 Now suppose that (λ, Z 1,..., Z n 1 and (W 1,..., W n 1 are feasible solutions to the two dual problems above, for measurement outcomes a and b satisfying a = b. (Either of the two possibilities a = b = 0 and a = b = 1 yield the same result. Observe that all of the operators Z 1,..., Z n 1 and W 1,..., W n 1 must be positive semidefinite, by virtue of the fact that P a and Q b are positive semidefinite. For every choice of k {1,..., n 2} it therefore holds that and and therefore Z k 1 Yk W k Z k Bk+1( 1Xk+1 W k+1 Bk+1 = ( 1 Zk Bk+1 (8.10 Zk 1 Xk+1 W k+1 1Zk B k+1 Z k 1 Xk+1 W k+1 A k+1( Zk+1 1 Yk+1 Ak+1 W k+1 = ( A k+1 1 W k+1 Zk+1 1 Yk+1 W k+1 Ak+1 1 Wk+1, (8.11 u k( Zk 1 Yk W k u k u k+1( Zk+1 1 Yk+1 W k+1 uk+1. (8.12 4

5 Along similar lines, and which together imply Z n 1 1 Yn 1 W n 1 Z n 1 Bn( 1Xn Q b Bn = ( 1 Zn 1 Bn (8.13 Zn 1 1 Xn Q b 1Zn 1 B n Z n 1 1 Xn Q b A np a A n Q b = ( A n 1 Wn Pa Q b An 1 Wn, (8.14 u ( n 1 Zn 1 1 Yn 1 W n 1 un 1 u n(p a Q b u n = 1 2 (8.15 (by the assumption a = b. One therefore concludes that u 1 (Z 1 1 Y1 W 1 u (8.16 Finally, we have that the product of the two objective values satisfies λ Tr X1 (B 1 B1, W ( ( 1 = Tr B 1 λ1x1 W 1 B1 Tr ( B1 ( ( A 1 Z1 1 Y1 A1 W 1 B1 = u 1 (Z 1 1 Y1 W 1 u (8.17 One of the two objective values must therefore be at least 1/ 2. By strong duality of the semidefinite programs, we conclude (for both of the outcomes c {0, 1} that either Alice can force Bob to output c with probability at least 1/ 2 or Bob can force Alice to output c with probability at least 1/ 2. The bias of the protocol is therefore at least 1/ 2 1/2, as required. 5