Verification of quantum computation

Transcription

1 Verification of quantum computation THOMAS VIDICK, CALIFORNIA INSTITUTE OF TECHNOLOGY Presentation based on the paper: Classical verification of quantum computation by U. Mahadev (IEEE symp. on Foundations of Comp. Science, 2018)

2 Part I: Statement of result

3 Turing machines Computation model: the Turing Machine (TM) Input tape, work tape, output tape Input x 0,1 is on input tape Executes elementary steps using work tape as memory Eventually writes halting symbol on output tape The output of the TM is the contents of the output tape A TM is polynomial-time if there is a polynomial P Z[X] such that for any input x, M halts in at most P(bit length(x)) steps A randomized TM has access to a randomness tape initialized with random bits An interactive TM has access to communication tapes

4 Languages A (promise) language is L = (L yes, L no ) 0,1 PRIMES: L yes = { binary representation of prime integers } L no = { binary representation of non-prime integers } 3COL: L yes = { binary representation of 3-colorable graph G} L no = { binary representation of not 3 colorable graph G } QCIRCUIT: L yes = { C: quantum circuit, returns 1 w.p. 2/3} L no = { C: quantum circuit, returns 1 w.p. 1/3} ZEROSUM: L yes = { (P, q) s.t. P multilinear polynomial, σ x P x = 0 mod q } L no = { (P, q) s.t. P multilinear polynomial, σ x P x 0 mod q }

5 Verification Given L = (L yes, L no ) and x L y L n, decide which? P: languages that can be decided by a poly-time TM PRIMES is in P. 3COL? NP: languages with efficiently verifiable proofs: L NP if there is a poly-time TM V such that for any x: If x L yes, there is a proof π s.t. V accepts π w.h.p. prover proof If x L no, for any π, V rejects π w.h.p. 3COL: proof is valid coloring ZEROSUM? verifier

6 Verification Given L = (L yes, L no ) and x L y L n, decide which? P: languages that can be decided by a poly-time TM PRIMES is in P NP: languages with efficiently verifiable proofs 3COL is in NP IP: languages with efficiently verifiable interactive proofs: L IP if there is a poly-time randomized interactive TM V and a (unbounded) TM P such that for any x prover proof If x L yes, V accepts P w.h.p. If x L no, for any P, V rejects P w.h.p. ZEROSUM is in IP verifier

7 QCIRCUIT L yes = { C: quantum circuit, returns 1 w.p. 2/3} L no = { C: quantum circuit, returns 1 w.p. 1/3} 0 b 0 0 (C 2 ) n has basis {e b = e b1 e bn, b 0,1 n } C = U T U 1 U (C 2 ) n Pr(C returns 1 ) = Π 1 C(e 0 e 0 ) 2 QCIRCUIT is strongly believed not to lie in P or in NP QCIRCUIT is in IP by reduction to ZEROSUM (Feynman path integral) Prover has to compute unphysical exponential sums Can quantum mechanics prove itself?

8

9

10

11

12 Testing quantum mechanics in the high-complexity regime Google Intel IONQ Tangle Bristlecone IBM 160 IBM Lake qubits Q5(49Q) Q16 (72Q) Exponential state space + uncertainty principle prevent direct simulation or even benchmarking Quantum mechanics untested at large scales What if there is a limit to the exponential scaling of quantum devices?

13 Main Result [Mahadev 18] Theorem (Mahadev 2018) There is a classical randomized polynomial-time verifier V and a quantum polynomial-time prover P such that, given as input a quantum circuit C, If Pr C returns "1" 2/3, then Pr V accepts P 1 If Pr C returns "1" 1/3, then for any P, Pr V accepts P 0 *** Under the LWE assumption ***

14 The LWE assumption [Regev 05] Learning with Errors (LWE) : noisy linear equations are hard! Let n and q n 2 be integer, and s 0,1 n. Given polynomially many samples a i, a i s + e i mod q such that a i U Z q n, e i U { q,, 0,, q } it is hard to recover s LWE is leading candidate for post-quantum cryptography standard (NIST) Believed hard even for quantum computers A quantum device that defeats Mahadev s protocol can be used to break LWE

15 Part II Proof ideas

16 Main Result [Mahadev 18] Theorem (Mahadev 2018) There is a classical randomized polynomial-time verifier V and a quantum polynomial-time prover P such that, given as input a quantum circuit C, If Pr C returns "1" 2/3, then Pr V accepts P 1 If Pr C returns "1" 1/3, then for any P, Pr V accepts P 0 *** Under the LWE assumption ***

17 Verifying classical circuits x 0,1 x 0,2 x 0,3 x 0,4 x 1,1 x 1,2 x 1,3 x 1,4 x 2,1 x 2,2 x 2,3 x 2,4 x 3,1 x 3,2 x 3,3 x 3,4 x 4,1 x 4,2 x 4,3 x 4,4 b = 1? x 0,1 = x 0,2 = x 0,3 = x 0,4 = 0 x 1,1 = 1 x 0,1, x 1,2 = x 0,2, x 2,3 = x 1,3 x 1,4, x 4,1 = 1 Verifying computation of C reduces to verifying existence of solution to system of local equations

18 Qubits e 1 ψ = α 0 e 0 + α 1 e 1 C 2 In general, the state of n qubits is represented by a unit vector ψ = α b e b1 e bn C 2 C 2 = C 2n b 0,1 n Dimension of state space grows exponentially with number of qubits Quantum circuit is unitary C = U T U 2 U 1 on C 2n Each U i acts as identity on all but constant number of qubits Pr C returns 1 = Π 1 C(e 0 e 0 ) 2, where Π 1 : projection on {αe 1 v} e 0

19 Hamiltonians A n-qubit Hamiltonian is a Hermitian H of norm H 1 acting on C 2 C 2 Z = and X = are 1-qubit Hamiltonians The energy of ψ with respect to H is ψ Hψ Toy example: H = 1 2 (X + Z) = λ min H = 2 2 ψ = α 0 e 0 + α 1 e 1 To evaluate the energy of ψ with respect to H: 1) Select W {X, Z} at random 2) Measure ψ in eigenbasis of W to obtain w 1,1 s.t. E w = ψ Wψ Repeat multiple times to get x 1, x k, z 1,, z k. Return 1 2 (1 σx k k + 1 σz k k)

20 Circuit-to-Hamiltonian [Kitaev 99] 0 b 0 0 H = σ i h i acting on C 2n Theorem (Kitaev): There is a δ > 1/ C 3 and an efficient mapping circuit C Hamiltonian H such that Pr(C returns "1") 2/3 λ min H 0 Pr(C returns "1") 1/3 λ min H δ Verifying computation of C reduces to verifying existence of small eigenvalues of H

21 A prototype 0 b 0 0 Select W {X, Z} w Measure W w 2 Measure W Repeat multiple times to get w n x 1, Measure x k, z 1, W, z k. H = 1 (X + Z) 2 qubit 1 qubit 2 qubit n Prepare ψ s.t. ψ Hψ = λ min (H) Send qubits of ψ one at a time Accept if 1 2 (1 k σx k + 1 k σz k) is δ 2

22 A prototype 0 b 0 0 H = 1 (X + Z) 2 Select W {X, Z} Repeat multiple times to get x 1, x k, z 1,, z k. W? w Prepare ψ s.t. ψ Hψ = λ min (H) Measure ψ in eigenbasis of W to obtain w { 1,1} Accept if 1 2 (1 k σx k + 1 k σz k) is δ 2 Prover can pretend λ min H = 1, violating uncertainty principle!

23 Claw-free functions f 0, f 1 : 0,1 n 0,1 n a claw-free pair of functions: r 0 f 1 Both f 0 and f 1 are bijections f 0 c For every c in the range, there is a unique claw: a pair (r 0,r 1 ) such that f 0 r 0 = f 1 r 1 = c r 1 Claws are hard to find: no efficient procedure returns (r 0, r 1, c) LWE assumption: Let n and q n 2 be integer, and s 0,1 n. Given samples a i, a i s + e i mod q such that a i U Z n q, e i U { q,, 0,, q } it is hard to recover s Public information: LWE samples a i, y i = a i s + e i Function evaluation: f b x i = a i x + e i + b y i mod q

24 Committing to a bit (f 0, f 1 ): 0,1 n 0,1 n a claw-free pair c = f b (r) (b, r) b {0,1} r R 0,1 n Check: f b r = c Hiding: c reveals no information about b (every c has exactly two preimages) Binding: Given c, computationally bounded device can reveal at most one b b = 0 b = 1 is easy, but given any fixed c, 0, r 0 (1, r 1 ) is hard

25 Committing to a qubit c = com(ψ) Compute w 1,1 s.t. E w = ψ Wψ Commit by encoding information in unknown two-dimensional space e 0 e r0, e 1 e r1 Classical outcome c commits quantum device to operate in that space W? d W = Meas W (ψ) e 1 ψ = α 0 e 0 + α 1 e 1 ψ c = α 0 e 0 e r0 + α 1 e 1 e r1 Measure all qubits in W eigenbasis ψ e 0 Can obtain measurement outcomes distributed as measurements in X or Z eigenbasis directly on ψ c Binding condition: must exist a single quantum state underlying both W

26 Commit & Reveal protocol [Mahadev 18] 0 0 b H = 1 (X + Z) 2 Prepare ψ = Σ α b e b s.t. 0 ψ Hψ = λ min (H) c = com(ψ) e 1 ψ Select W {X, Z} W? e 0 Compute outcome w from d w Repeat multiple times to get x 1, x k, z 1,, z k. d W = Meas W (ψ) Measure all qubits of ψ c in W eigenbasis Accept if 1 2 (1 k σx k + 1 k σz k) is δ 2

27 Commit & Reveal protocol [Mahadev 18] Theorem (Mahadev 2018) There is a classical randomized polynomial-time verifier V and a quantum polynomial-time prover P such that, given as input a quantum circuit C, If Pr C returns "1" 2/3, then Pr V accepts P 1 If Pr C returns "1" 1/3, then for any P, Pr V accepts P 0 Protocol can be implemented using small quantum computer Overhead due to crypto ~200 qubits For any behavior of the device, either the verifier rejects, or the device breaks the LWE assumption, or there exists a state ψ that underlies the verifier s energy estimation procedure, for all choices of measurement

28 Open: information-theoretic security IBM quantum experience (17 qubit) Can we remove the post-quantum crypto assumption? IP protocol requires device to perform unphysical computations Can a quantum computer prove the validity of its computation to a classical verifier?

29 Thank you Presentation based on the paper: Classical verification of quantum computation by U. Mahadev (IEEE conf. on Foundations of Comp. Science, 2018)

30 Interactive proofs for quantum computations Feynman path integral: Pr(C returns "1") = σ x:x1 =1 e x Ce 0 2 is (square of) summation of amplitude over exponentially many paths S = Σ P(x 1,, x T ) z T p 0 = P( z 1,, z T ) Any language that can be decided on a quantum computer can be classically verified. by querying an exponentially powerful prover!

31 Hamiltonians A n-qubit Hamiltonian is a Hermitian H of norm H 1 acting on C 2 C 2 Z = and X = are 1-qubit Hamiltonians The energy of ψ with respect to H is ψ Hψ ψ = α 0 e 0 + α 1 e 1 ψ Zψ = α 0 2 α 1 2 ψ Xψ = α 0 2 α 1 2 Estimate energy wrt Z: measure Estimate energy wrt X: Hadamard + measure X More generally, i : I 2 X I 2 I 2 H = σ ij α ij 2 (X ix j + Z i Z j ) is an n qubit Hamiltonian (provided Σ ij α ij 1)

32 Measurements e 1 e 0 Measurement rule: for b {0,1}, Pr b ψ = e b ψ 2 = α b 2 e 1 ψ = α 0 e 0 + α 1 e 1 C 2 Fourier transform: e 0 H: e 0 e 0, e 1 e 1 Generally: ψ = Measure i-th qubit: α x (e x1 e xn ) x 0,1 n H n α t = 2 n/2 α t (e t1 e tn ) t 0,1 n x 1 x t α x Pr b ψ, i = α x 2 Pr b ψ, i = α t 2 x:x i =b t:t i =b

33 Interactive proof for ZEROSUM Input is multilinear polynomial P F q [X 1,, X T ]. Goal: Σ x Fq T P x = 0? S = Σ P(x 1,, x T ) Σ z p T z = S? z T R F q Σ z p T 1 z = p T (z T )? z T 1 R F q p T (z) = Σ P(x 1,, x T 1, z) z T p T 1 (z) = Σ P(x 1,, z, z T ) z T 1 p 0 = P z 1,, z T? p 0 = P( z 1,, z T ) This protocol shows ZEROSUM IP

34 An example 0 H Z H b = 1 description of circuit C I got b = 1 Oh? Is this right?