The Complexity of Entangled Games. Thomas Vidick

Transcription

1 The Complexity of Entngled Gmes by Thoms Vidick A disserttion submitted in prtil stisfction of the requirements for the degree of Doctor of Philosophy in Computer Science in the Grdute Division of the University of Cliforni, Berkeley Committee in chrge: Professor Umesh V. Vzirni, Chir Professor Stish Ro Associte Professor Ashvin Vishwnth Fll 2011

2 The Complexity of Entngled Gmes Copyright 2011 by Thoms Vidick

3 1 Abstrct The Complexity of Entngled Gmes by Thoms Vidick Doctor of Philosophy in Computer Science University of Cliforni, Berkeley Professor Umesh V. Vzirni, Chir Entnglement is t the hert of quntum mechnics. The nonlocl correltions tht cn be obtined from spce-time seprted mesurements on n entngled stte re centrl feture which provbly distinguish it from locl theories. This disserttion studies entnglement through computtionl viewpoint. We develop new insights into the complex nture of entnglement by studying its role in multiplyer gmes, in which cooperting, but noncommunicting, plyers interct with referee in n ttempt to win pre-specified gme. On the one hnd, the nonlocl correltions tht entnglement llows my enble plyers using it to develop new colluding strtegies, defeting previously secure protocols. On the other, the richness of this new resource my lso be exploited in order to design new protocols, providing solutions to problems previously deemed impossible. We explore both spects of this dul nture of entnglement, putting limits on its strength while t the sme time showing how it cn be put to profit to solve new computtionl problems. A mjor unresolved question on the computtionl complexity of multiplyer entngled gmes is the power of MIP, the clss of lnguges hving entngled multi-prover interctive proofs: how does it relte to its purely clssicl nlogue MIP, which ws completely chrcterized through the fundmentl eqution MIP = NEXP? Since the plyers my use entnglement to increse their odds t colluding ginst the verifier, MIP could potentilly be much weker clss thn MIP. Indeed, for long time it hs been n open question whether two entngled provers re more useful thn single prover. In this thesis we resolve this question by showing tht the clss of lnguges hving multiprover interctive proofs with entngled provers is t lest s lrge s its clssicl counterprt: NEXP MIP. At the hert of this result is n nlysis of the multilinerity test of Bbi, Fortnow, nd Lund in the presence of entnglement. The fct tht this test remins sound gives systemtic wy for verifier to impose strong limits on the bility of entngled provers to collude ginst the verifier. Gp mplifiction is fundmentl primitive in the study of clssicl multiplyer gmes. While sequentil repetition of gme lwys decreses the prover s mximum success prob-

4 2 bility t n exponentil rte, the fct tht prllel repetition lso chieves gp mplifiction is highly non-trivil fct. We show tht gp mplifiction cn be performed in prllel even in the presence of entnglement between the provers. We dpt technique which ws originlly introduced by Feige nd Kilin nd results in polynomil rte of mplifiction. The phenomenon of monogmy of entnglement sttes, in first pproximtion, tht if two prties re mximlly entngled then they cnnot simultneously be entngled with third prty. We use this phenomenon in two distinct results. In the first, we show tht the bits generted in our rndomness-expnsion protocol re certifibly rndom even from the point of view of quntum dversry who my shre prior entnglement with the provers. In ddition, we prove the security ginst quntum dversries of rndomness-efficient extrctor construction originlly due to Trevisn. This lets us trnsform the high-entropy bits tht re generted in our protocol into ones tht re lmost indistinguishble from uniform by ny dversry. More generlly, we show how the monogmy of entnglement cn be exploited to design multi-prover interctive proof systems tht re prtilly entnglement-resistnt. Quntittive bounds on the monogmy of entnglement hve generlly been elusive, nd the nlysis of our protocol demonstrtes such bound in new context. The nonlocl correltions tht cn be creted by entngled plyers provide sttisticl mens of differentiting them from clssicl, unentngled plyers. This is the min ide behind Bell inequlities, the violtion of which demonstrtes the nonloclity of quntum mechnics. Weshowhowthisphenomenonmybeexploitedtodesignprotocolinwhichthe bits produced by successful plyers necessrily contin lrge quntity of fresh rndomness. The presence of rndomness is gurnteed irrespective of the provers ctul strtegy, s long s the sole constrint of no signling is respected. Hence sttisticl certifiction for the presence of rndomness, fet esily seen to be impossible to chieve clssiclly. In order to mnipulte the rndom bits produced in our protocol, nd mke them useful in cryptogrphy, we give the first proof of security of poly-logrithmic seed extrctor secure ginst quntum dversries. To chieve this we dpt the reconstruction prdigm originlly introduced by Trevisn to the quntum setting. We study other wys in which entnglement my be used in interctive proof systems by lso llowing quntum interction between the referee nd the plyers. We show tht, using entnglement, the clss of QMIP proof systems cn be prllelized to only three rounds of interction, nd mde public-coin, property tht does not hold in the bsence of entnglement between the plyers.

5 i À m grnd-mère, Qui urit été si fière.

6 ii Contents 1 Introduction Entnglement s nonlocl resource The computtionl complexity of entngled gmes Contributions on the complexity of entngled gmes Proof strtegy Using entnglement in multiplyer gmes Generting certified rndomness Interctive proofs with quntum messges Bibliogrphicl remrks Working with entngled provers: the exmple of linerity testing The linerity test Entngled strtegies Linerity testing of entngled provers Mesuring the distnce between provers The quntum nlysis Omitted proofs Preliminries Nottion Quntum computing Quntum informtion theory Gmes nd complexity clsses Gmes Interctive proofs with multiple provers Techniques Distnce mesures Prelude: the cse of the mximlly entngled stte The ρ-norms Reltionships between norms

7 iii 4.2 Consistency Applictions The orthogonliztion lemm The lmost-commuting vs. nerly-commuting conjecture Hrdness of entngled gmes Overview Preliminries NEXP-complete problems Summtion test Protocol Completeness Soundness Anlysis of the multilinerity gme Preliminry nlysis Proof of Theorem Proof of Theorem The self-improvement lemm A convex optimiztion problem Constructing POVM independent of x k The psting lemm Consistency of V nd A V is not too incomplete Immunizing gmes ginst entnglement Proof overview Hrdness of three-prover clssicl entngled gmes Prllel repetition of entngled gmes Proof overview Results Proof overview Proof of the min theorem Nottion A quntum dichotomy theorem Seril strtegies Bounding the success of plyers in repeted gme Discussion nd open questions

8 iv 8 Trevisn s extrctor in the presence of quntum side informtion Introduction Relted results Contributions Proof technique Extrctors Extrctors, side informtion, nd privcy mplifiction Extrcting more rndomness Constructing m-bit extrctors from one-bit extrctors nd wek designs Description of Trevisn s construction Anlysis Concrete constructions Ner optiml entropy loss Seed of logrithmic size Loclly computble extrctor Wek rndom seed Other vritions of Trevisn s scheme Certifible Quntum Dice Introduction The guessing gme Proof of the min result Producing rndom bits secure in the presence of quntum dversry Proof overview Proof of Theorem Multiprover interctive proofs with quntum messges Proof overview Achieving Perfect Completeness Prllelizing to Three Turns Public-Coin Systems Converting to Public-Coin Systems Prllelizing to Two Turns Directly Modifying Three-Turn Systems to Two-Turn Systems Conclusion A Auxiliry results 191 A.1 Mtrix inequlities A.2 Omitted proofs from Chpter A.2.1 Proof of Corollry A.3 The orthogonliztion lemm

9 A.4 Omitted proofs from Chpter A.5 More on extrctors A.5.1 Wek rndom seed A.5.2 Composing extrctors A.5.3 Technicl lemms A.5.4 Known extrctors nd designs A.5.5 List-decodble codes re one-bit extrctors A.5.6 List-decodble codes re strong extrctors A.6 Omitted proofs from Chpter A.6.1 Identifying good blocks in Protocols A nd B A.6.2 Proof of Lemm A.6.3 Recovering ll t-xors v

10 vi Acknowledgments First nd foremost I would like to thnk my dvisor Umesh Vzirni for his support, encourgements, nd endless bility to ensure tht I lwys left his office infused with level of motivtion nd enthusism incomprble to wht they were before entering it. I m most grteful for the incredible environment of cretivity nd intellectul curiosity tht Umesh inspires to those round him. The lst few months I spent t Berkeley were especilly formtive nd I m indebted to Umesh for his guidnce nd support during tht period. Juli Kempe first introduced me to quntum computing, nd is the one to blme for strting ll this. She hs provided me with infillible support nd dvice ll long, nd I m deeply indebted to her generosity, wrmth, nd scientific tlent. Iwould like toextend my wrmest thnks toll my co-uthors, mny ofwhich lso served s hosts over extended periods of time throughout these pst four yers. Mrtin Roetteler led me through highly enjoyble internship t NEC lbs in Princeton during my first summer of grd school. Juli Kempe nd Oded Regev hosted me both t Tel-Aviv University in the summer of 2009, nd t LRI, then LIAFA, in Pris. Hrry Buhrmn nd Ronld de Wolf welcomed me t CWI in Amsterdm, lso in the summer of 2009, nd Stephnie Wehner hosted me for wonderful month of July 2010 t CQT in Singpore. I thnk them, s well s my other co-uthors, for their ptience nd generosity in guiding my first steps in reserch res rnging from communiction complexity to quntum cryptogrphy nd orcle clsses. I m lso grteful to my more junior collbortors, mong which Jop Briet, Anindy De, Joshu Brody nd Tsuyoshi Ito, for shring their ides nd their ptience in listening to mine. Sod Hll hs proved gret plce to not work, nd for this I thnk my office-mtes, Greg, Jmes nd Yron, s well s the regulr Sod Hll occupnts without whom these four yers wouldn t hve been the sme: Grnt, Mdhur, Lorenzo, Anindy, Flk, Yi-Ki, Anupm, Urmil, Siu Mn, Siu On, nd ll the others. Whtever the time of dy or night they lwys mde Sod Hll the most welcoming plce in Berkeley. I would like to extend specilly wrm thnk you to Zeph Lndu, who served s n lwys welcoming nd stbilizing presence in the quntum computing group. Though I did my best to hide this from him, Zeph tught me mny things, not lest of which the un-mtched deliciousness of the vocdo nd tomto bguette sndwich. My sty in the By Are ws gretly enlightened by the friends I mde here. Most of ll I thnk Joseph nd Pui-W for their continul presence, nd Joseph for (trying) to tech me to be free. I would not hve reched this point without the constnt support of my fmily. I especilly thnk my prents for their unwvering belief in my ptitude to crry this through. I

11 owe them more thn they know. If nyone reds this thesis it will be my dd, nd I hope tht it finlly helps him remember its title. I m lso grteful to my brother nd sister for helping me keep my feet on the ground by turning blind eye the minute I would strt tlking bout my reserch. vii

12 1 Chpter 1 Introduction Entnglement is rgubly the most counterintuitive spect of quntum mechnics it plys crucil role in the exponentil speed-ups of quntum computers. Einstein, whose skepticism bout quntum mechnics rested in prt on thought experiments involving entnglement, derided it s spukhfte Fernwirkung, or spooky ction t distnce. In his lndmrk 1965 pper [15], Bell proved tht entnglement hd testble consequence: simultneous mesurements on pir of spce-like seprted entngled prticles could led to outcomes correlted in wy tht no clssicl locl hidden vrible theory could explin. However, these correltions re still limited by the no-signling principle, which sttes tht no informtion cn be communicted from one prticle to the other. Enormous efforts hve since been devoted to systemtic investigtion of the sttisticl spects of nonlocl correltions. Understnding nd quntifying the precise nture of these correltions is one of the bsic gols of quntum informtion theory, nd hs led to full chrcteriztion of the nonlocl polytope in two dimensions, the cse of three dimensions still being open (see e.g. [47] for survey). This disserttion tkes different, more computtionl pproch towrds understnding the nture of entnglement. The strength of this pproch is in tking entnglement out of the sttic context commonly used in physics, nd putting it into dynmic setting. The result is new understnding of the limits (beyond no-signling) of the power of entnglement, s well s the discovery of new tsks tht re mde possible using it, but re impossible in clssicl world. Moreover, the benefit is reciprocl: the introduction of powerful new element, entnglement, in the theory of computtion promises to bring bout new understnding of some of the bsic techniques of complexity theory, such s prllel repetition or multilinerity testing. The first theme of this disserttion, introduced in Section 1.2, consists in using computtionl complexity to study entnglement: wht re the computtionl consequences of the nonlocl correltions tht it genertes? A second theme, introduced in Section 1.3, explores the following question: wht re computtionl tsks tht re mde possible by the presence of entnglement? Before describing these themes, in the next section we introduce the min

13 CHAPTER 1. INTRODUCTION 2 computtionl model tht our work is bsed on, multiplyer gmes. 1.1 Entnglement s nonlocl resource The following experiment, originlly introduced by Cluser, Horne, Shimony nd Holt [25], gives the simplest demonstrtion of the strength of entnglement s nonlocl resource. Consider two distnt prties, ech holding one hlf of n entngled pir of prticles. Ech of the prties receives single bit x, y {0, 1}, chosen uniformly t rndom, s input. They re llowed to perform rbitrry mesurements on their prticle, but re not llowed to communicte. 1 Their gol is to produce outputs,b tht stisfy the CHSH condition b = x y. = 1 = 1 π/4 = 0 = 0 = 0 = 1 = 1 π/4 = 0 π/8 Figure 1.1: The bses used in the CHSH gme. Plin lines correspond to the bsis used on input x = 0 (left) nd y = 0 (right). Dotted lines correspond to the bsis used on input x = 1 (left) nd y = 1 (right). Pirs of vectors corresponding to vlid outputs lwys mke n ngle of π/8. It is not hrd to see tht, if the prticles re only clssiclly correlted (i.e. they ply the role of shred rndomness) then the best strtegy will led to success probbility of 3/4 in fct, systemticlly outputting 0 is the best one cn do. However, there re quntum mesurements on 2-qubit entngled stte tht llow one to obtin strictly higher success probbility of cos 2 π/ The entngled stte is Bell pir Ψ = 1 2 ( ). This nottion describes the joint stte of pir of two-dimensionl systems tht re in n equl superposition of two identicl sttes: the 0 0 stte nd the 1 1 stte. Ech prty will mesure its own hlf of Ψ using one of two possible choices of bsis, depending on the input bit. These bses re such tht, out of the 4 pirs of bses, those corresponding to input pirs (x,y) such tht x y = 0 mke n ngle π/8 with ech other, while the pir corresponding to the inputs(1, 1) mke n ngle π/2 π/8(see Figure 1.1 for n illustrtion). 1 In the originl version of the experiment the no-communiction ssumption ws enforced through spcetime seprtion of the two prties.

14 CHAPTER 1. INTRODUCTION 3 The resulting mesurements hve the property tht, for every possible pir of inputs, the pir of outputs obtined by mking the corresponding mesurements on both hlves of Ψ will be correct with probbility cos 2 π/8. While using these mesurements the mrginl distribution of outcomes obtined by either prty will be uniform, their joint distribution depends on the locl choice of bsis. The possibility to obtin such correltions is the source of the strength of entnglement. Multiplyer gmes. Multiplyer gmes generlize the setting of the CHSH experiment by frming it s n interctive gme between referee, who runs the gme, nd two or more plyers. In such gme the plyers co-operte in n ttempt to win the gme rbitrted by the referee. While they hve unlimited computtionl power, they re crucilly not llowed to communicte with ech other once their interction with the referee hs strted. This no-communiction, or no-signling, ssumption is t the hert of the richness of multiplyer gmes. Given gme, the key quntity ssocited to it is its vlue: the mximum winning probbility tht ny plyers cn obtin in the gme. 2 This quntity lets us frme gmes s model of computtion: the input is description of the gme itself, nd the output is its vlue. One my think of the plyers s computing this output for the referee: if it is close to 1 then the plyers hve high chnce of winning the gme, nd if it close to 0 it is unlikely tht they will succeed. The introduction of entnglement in multiplyer gmes is ll but nturl in quntum mechnicl universe, the shring of entnglement between resource-unbounded plyers cnnot be physiclly voided. We will cll such gmes entngled gmes, nd their vlue the entngled vlue, thereby referring to the dditionl resource tht the plyers my shre. The lnguge of gmes lets us study entnglement in new context, going well beyond the simple non-interctive setting of the EPR prdox nd Bell inequlities. For instnce we my sk, does entnglement strengthen or weken the types of computtions tht cn be performed using multiplyer gmes? We hve seen tht entnglement my increse the vlue of gme: wht re the computtionl consequences of this fct? If the increse in vlue ws systemticlly bounded, these consequences would be miniml. The following exmple shows tht this is not the cse. The Mgic Squre gme. As further exmple demonstrting the strength of the nonlocl correltions of entnglement, consider the Mermin-Peres Mgic Squre gme [83, 91]. In this gme there re two plyers, the row plyer nd the column plyer. The row plyer is trying to convince the referee tht the cells of n imginry 3 3 squre cn be lbeled with bits in {0,1} so tht the bits in ech row hve even prity, while the column plyer is trying to convince him tht the squre cn be lbeled in such wy tht the bits in ech column hve odd prity. In order to ctch them, the referee sks the row plyer (resp. the 2 This probbility is tken over ll rndom choices mde in the gme: the referee s nd the plyers.

15 CHAPTER 1. INTRODUCTION ? Rows hve even prity Columns hve odd prity Figure 1.2: The Mgic Squre gme. Cells in ny given row should hve even prity, while in ny given column their prity should be odd. Any lbeling of the remining cell will violte either row or column constrint. columnplyer)forthevluesththewouldssigntothethreecellsofrndomlychosenrow (resp. rndomly chosen column). He then verifies tht the prity of ech plyer s nswers is correct, nd tht the two plyers re consistent in the vlue tht they ssign to the unique cell in which the chosen row nd column intersect. A moment s thought will convince the reder tht the plyers cnnot win this gme with certinty indeed, the squre s overll prity must be either odd or even, so tht one of the plyers hs to be wrong (cf. Figure 1.2 for n illustrtion). In strk contrst, Arvind [8] demonstrted the existence of simple entngled strtegy succeeding with certinty, dshing ll hopes of entnglement providing only bounded dvntge over clssicl plyers in generl. This striking exmple cn be pushed even further. As we will see in the next section, the fct tht entngled plyers cn collude perfectly in the Mgic Squre gme hs drmtic consequences on the computtionl complexity of multiplyer gmes. Indeed, it demonstrtes tht the soundness property of certin proof systems (e.g. some proof systems used in connection with the PCP theorem to show hrdness of pproximtion of constrint stisfction problems) cn completely fil in the presence of entnglement. 1.2 The computtionl complexity of entngled gmes The introduction of multiplyer gmes s model of computtion in the lte 80s hd profound impct on clssicl complexity theory. It ws the nturl result of revolutionry line of work expnding on the definition of the clss NP by dding lyer of rndomiztion nd interction. In tht context multiplyer gmes re often referred to s interctive proof systems: polynomil-time referee (or verifier) intercts with the plyers (or provers) in order to verify the vlidity of certin sttement. One my think of the provers s holding detiled proof of the sttement. Tht proof my be very long nd complex, nd the verifier cn only sk specific questions bout it. The provers re computtionlly unbounded, but not llowed to communicte. They will lwys ttempt to convince the verifier to ccept, irrespective of the truth of the sttement he is ttempting to verify. It is therefore crucil tht such proof systems hve good soundness property: if the sttement is flse, then

16 CHAPTER 1. INTRODUCTION 5 the interction should be such tht no nswers from the provers could convince the verifier otherwise (except with smll probbility). The corresponding clss MIP of lnguges hving multiprover interctive proofs [17] ws fully chrcterized in the celebrted result MIP = NEXP [12], where NEXP stnds for non-deterministic exponentil time. This chrcteriztion demonstrtes the impressive computtionl power of multiple provers. It should be contrsted with the power of single prover, s expressed in the result tht IP = PSPACE [80, 106], the set of lnguges recognizble in polynomil spce. At the sme time, the discovery tht MIP = NEXP strted long, extremely fruitful line of work exploring the properties of multiplyer gmes, eventully leding to proof of the PCP theorem [9, 10] nd to the subsequent explortion of its deep connections with hrdness of pproximtion [45]. The introduction of entnglement leds to the nturl extension of multiprover entngled interctive proofs, in which the provers my shre n rbitrry entngled stte. In spite of the no-signling principle, which shows tht the plyers cnnot use entnglement to exchnge informtion, its introduction cn hve profound effect on the properties of certin proof systems. As n exmple, consider the following simple protocol used to verify tht given 3XOR formul hs lrge frction of its cluses stisfible. A 3XOR formul is given by list of cluses x i y i z i = i, where x i,y i,z i re vribles nd i {0,1}. The verifier picks two cluses (i,j) t rndom, under the constrint tht they shre t lest one vrible, sy x i = x j. He sends the three vribles in the first cluse to first prover, nd the vribles from the second cluse to second prover. Ech prover should nswer him with n ssignment to the three vribles it ws sent. The verifier checks tht the ssignments he receives stisfy the cluses, nd re consistent: both provers should ssign the sme vlue to the shred vrible x i. It is possible to relte the vlue of this proof system to the mximum number of cluses tht cn be simultneously stisfied in the formul: if there is n ssignment stisfying lrge frction of cluses then the provers hve successful strtegy, nd conversely ny successful strtegy implies the existence of good ssignment. The key point is tht the consistency check mde by the verifier prevents the provers from using cheting strtegy tht would ssign different vlues to the sme vrible, depending on the cluse they re being sked: such strtegy will fil becuse the provers do not know which vrible they shre in common. The Mgic Squre gme shows tht such reltionship no longer holds in the presence of entnglement between the provers: there re exmples of 3XOR formuls tht re fr from stisfible, but such tht entngled plyers hve perfect winning strtegy. This exmple shows tht the soundness property of certin interctive proof systems my be broken by the introduction of entnglement. It rises fundmentl question: Wht is the computtionl complexity of entngled gmes? This question cn be stted more precisely by introducing the entngled nlogue of the complexity clss MIP, MIP [26]. The question then becomes: wht is the reltionship

17 CHAPTER 1. INTRODUCTION 6 between MIP nd MIP? To show the inclusion MIP MIP, one hs to show tht the soundness property of n interctive proof system is preserved: if there is no clssicl strtegy chieving high success probbility, then there is no entngled strtegy chieving much higher success probbility. But the exmple discussed bove shows tht such reltionship does not hold! Hence the impossibility of direct reduction between the two clsses. Cleve, Høyer, Toner nd Wtrous [26] pushed this observtion further by showing tht entnglement could indeed led to the collpse of whole complexity clss. More specificlly, they study clss, MIP, of lnguges hving certin restricted type of two-prover interctive proofs. While it follows from work of Håstd [52] tht this clss equls NEXP (nd is thus s powerful s the whole of MIP), Cleve & l. show tht the corresponding clss with entnglement, MIP, collpses to EXP. This result shows tht, in the setting of MIP proof systems, whtever the verifier s ttempts to prevent entngled provers from colluding, they will hve strtegy tht fools him. In spite of this negtive result, the question of the complexity of generl entngled interctive proofs remined open. Indeed, it could be tht by llowing the verifier to interct with the provers in less constrined wy, one my devise more complex proof systems tht re immune to the kind of behvior tht cused the collpse of MIP. Despite intense efforts on this question, for long time little ws known. The best lower bound on MIP consisted in the trivil observtion tht multiple entngled provers re t lest s powerful s single prover, hence PSPACE MIP Contributions on the complexity of entngled gmes We prove three results putting strong limits on the bility of entngled plyers to use their entnglement in order to collude ginst the referee in multiplyer gme. NEXP MIP. We prove the inclusion NEXP = MIP MIP, nswering longstnding open question [72] nd estblishing the fct tht multi-prover interctive proof systems with entnglement re t lest s expressive s their clssicl counterprts. We prove our result by dpting Bbi, Fortnow nd Lund s [12] originl proof tht NEXP MIP to the entngled setting. A key component in this proof is multilinerity test, by which one ensures tht the provers re nswering the verifier s questions ccording to n rbitrry multiliner function f : F n F, where F is finite field. The test is very simple: the verifier picks triple of xis-ligned points x,y,z F n, nd he checks tht the provers provide him with nswers, b, c F tht re correspondingly ligned. Bbi, Fortnow nd Lund showed tht if three deterministic provers hd high probbility of success in this test, then it must be the cse tht ech prover computes his nswer using function = f(x) tht is liner in ech of its n coordintes. The min difficulty in extending this test to the quntum setting is tht there is no underlying function: the strength of n entngled-prover strtegy is in the correltions tht re genertes by the provers respective mesurements on their shred entngled stte, nd

18 CHAPTER 1. INTRODUCTION 7 there is no mening to either provers strtegy when tken in isoltion. As such, the sitution is similr to, but more complex thn, scenrio in which the provers would be using shred rndomness but one would not llow for the usul convexity rgument stting tht this rndomness could be fixed. We explin this difficulty, nd the wy in which we overcome it, in more detil in Section below. We lso give more detiled introduction to the problem of linerity testing with entngled provers in Chpter 2. Our min result is tht the multilinerity test is sound even in the presence of entngled plyers. This demonstrtes tht even entngled plyers cnnot escpe the strong liner structure imposed in this test, mking it impossible for them to gin more thn negligible dvntge from their shred entnglement. This result is presented in Chpter 5. Our result leves open the intriguing possibility tht entnglement my led to lrger, more expressive clss of proof systems: is MIP MIP? Since the presence of entnglement seemingly only increses the power of the provers, wekening the soundness gurntees of existing protocols, it my seem like this inclusion should de fcto hold. But there is n intriguing possibility: the presence of entnglement between the provers my lso increse the power of the verifier by llowing him to devise new protocols, enbling the verifiction of more complex clsses of lnguges. This could result in MIP being lrger clss thn MIP. In the second prt of this thesis (cf. Section 1.3.2) we will show tht entnglement cn indeed be used to perform certin tsks tht re impossible in its bsence. The monogmy of entnglement. Monogmy is genuinely quntum phenomenon. At n intuitive level, monogmy dicttes tht the correltions obtined from entnglement cn only be shred successfully between two prties, not more. Indeed, if two plyers re mximlly entngled, then neither of them cn be simultneously entngled with third plyer. Unfortuntely this ppeling property is very difficult to quntify precisely, nd it cn be expressed in mny distinct wys through the use of different entnglement mesures [118, 71]. Multiplyer gmes provide concrete wy to understnd the monogmy of entnglement: in three-plyer gme, constrining two of the plyers to be strongly correlted should limit their bility to collude with the third. We show how this ide cn be put to profit by trnsforming ny gme in wy tht, even if in the originl gme entngled plyers were ble to use their entnglement to collude perfectly, in the modified gme this is no longer possible. Our trnsformtion consists in introducing third plyer, sending him the sme question s to one of the originl plyers, nd checking tht he provides the sme nswer. Using this trnsformtion, we re ble to give the first hrdness of pproximtion result for three-plyer one-round entngled gmes: it is NP-hrd to pproximte the vlue of such gme to within fctor tht is inverse polynomil in the size of the gme, s mesured by the number of possible questions. This result is incomprble to the previous one: while the hrdness fctor is weker (inverse polynomil compred to constnt), it pplies to more restricted clss of gmes, in which there re only three provers nd single round of

19 CHAPTER 1. INTRODUCTION 8 interction. Moreover, the trnsformtion tht we introduce here is generic, nd cn be used to enhnce the entnglement-resistnce cpbilities of ny two-plyer gme. Prllel repetition of entngled gmes. Gp mplifiction is fundmentl primitive in complexity theory. In the context of interctive proofs, one often rrives t sitution where one hs designed specific gme such tht one cn show tht either there exists strtegy for the plyers with success probbility 1, or no plyers cn succeed with probbility lrger thn, sy, 0.99 without knowing which is the cse. It is then required to mplify this distinction in order to mke it more robust, while ltering the properties of the gme the lest possible. In the setting of two-plyer clssicl gmes, n importnt result of Rz [96] shows tht gp mplifiction cn be performed in prllel, without incresing the number of rounds of interction: the referee simultneously sends independent pirs of questions to the plyers, receives ll their nswers together, nd checks tht ll pirs of nswers re vlid for the corresponding questions. This result shows limittion of clssicl non-communicting provers: they cnnot tke dvntge of the fct tht, in prllel repeted gme, they re llowed to see ll their questions before sending bck their nswers. In Chpter 7 we show tht gp mplifiction cn lso be performed with entngled plyers, lbeit only t polynomil rte, by dpting the miss/mtch technique introduced by Feige nd Kilin [42]. While the polynomil rte we obtin is sub-optiml, this technique hs the benefit of proving more thn mplifiction. Indeed, one cn show tht ny plyers with resonble(t lest inverse polynomil) success probbility in the repeted gme must be using strtegy tking very specific sequentil form, which my be useful to nlyze repeted gmes in more detil Proof strtegy The three results discussed bove ll rely on the nlysis of certin multiplyer gmes, or multi-prover interctive protocols, designed to chieve specific gol. The min hurdle in the nlysis of such gme is to prove its soundness: given gme, show tht no plyers cn hve significntly higher success probbility thn could honest plyers, plying ccording to n idel, well-behved strtegy. In the clssicl setting, strtegy for the plyers is specified by function f from the question set to the nswer set. One usully resons by contrpositive, showing tht high success in the gme imposes strict constrints on f, up to the point where one mnges to show tht f must be close to the idel strtegy. In order to mke this nlysis possible one hs t one s disposl ll the modern tools of computer science, including error-correcting codes, Fourier nlysis, nd mny others. The nlysis of entngled strtegies, however, poses n immedite chllenge: there is no underlying function. This difficulty lredy rises in the presence of shred rndomness, used by the plyers to coordinte in selecting one of mny possible functions before producing their nswer. The solution, in tht cse, is well-known: there is lwys n optiml shred

20 CHAPTER 1. INTRODUCTION 9 rndom string which cn be fixed, reducing the nlysis to the deterministic cse. Entnglement, however, cnnot be fixed. This is consequence of the non-commuting nture of the plyers mesurements, mking it impossible in generl to extrct even joint globl distribution describing the plyers choice of nswers for every possible pir of questions. 3 One is therefore constrined to work directly with the plyers strtegies, s represented by their mesurements nd potentilly very high-dimensionl entngled stte. In the setting of clssicl plyers using shred rndomness, this would correspond to crrying out the whole nlysis in superposition, without fixing the rndomness chllenging tsk by itself. As in the clssicl cse, our gol is, strting from the ssumption tht the provers hve high success probbility in the gme, to deduce constrints on the structure of the strtegy they could be using, relting it to honest, idel strtegy whose success we cn esily bound for instnce becuse it cn be modeled using shred rndomness, thus reducing the nlysis to the clssicl cse. In order to crry out this pproch we develop techniques gered t nlyzing nd constrining entngled-plyer strtegies. One such technique is quntum counterprt to the celebrted linerity test of Blum, Luby, nd Rubinfeld [23], nd we present it in n ccessible wy in Chpter 2. An extension of this test to multilinerity testing is t the hert of our proof tht NEXP MIP, described in Chpter 5. Another technique exploits the monogmy of entnglement to obtin lmost-commuting conditions on the plyers mesurements. This condition lets us pply wek rounding procedure from entngled strtegies to clssicl strtegies. We relte the success of this rounding technique to conjecture bout lmost-commuting versus nerly-commuting mesurements, which is discussed in Chpter 4. Our lst technique, used in the proof of our result on prllel repetition, consists in exploiting consistency constrints on the plyers nswers to deduce tht their mesurements must obey certin orthogonlity conditions. These conditions re used to derive direct product test for entngled strtegies. 1.3 Using entnglement in multiplyer gmes The second theme of this thesis explores the new possibilities tht re fforded by entnglement in multiplyer gmes in order to present tsks tht cn only be ccomplished in the presence of entnglement. These complement the results in the first prt of the thesis, in which entnglement ws seen s negtive resource used by the plyers to collude ginst the referee. We give two min pplictions: the first to cryptogrphy nd the second to interctive proof systems with quntum messges. 3 This very fct is wht mkes the existence of gmes such s the Mgic Squre possible: in this gme entngled plyers hve perfect winning strtegy even though there is no deterministic ssignment of nswers to ll questions tht stisfies the constrints imposed by the referee.

21 CHAPTER 1. INTRODUCTION Generting certified rndomness A source of independent rndom bits is bsic resource in mny computtionl tsks, such s cryptogrphy, gme theoretic protocols, lgorithms nd physicl simultions. However, constructing physicl source of rndomness is n unexpectedly tricky tsk. Wht mkes this tsk prticulrly chllenging is the following: how cn one even test whether one hs succeeded? In other words, suppose we re given box tht clims to output perfectly rndom bits; is there test to verify tht clim? On the fce of it, this tsk is impossible: perfect rndom number genertor must output every n-bit sequence with equl probbility 1/2 n, nd there seems to be no bsis on which to reject ny prticulr output in fvor of ny other. Entnglement provides surprising wy out of this conundrum. Recll the CHSH gme outlined erlier. This gme hs the property tht clssicl plyers cn chieve success probbility t most p CHSH 3 4, while for ny number 3 4 < p CHSH cos 2 π/ there is quntum strtegy chieving exctly tht success probbility. Hence we my define the quntum regime for the CHSH gme s this rnge of probbilities: for ny vlue in tht rnge there is simple quntum-mechnicl strtegy, obeying the no-signling condition, which chieves tht success probbility. These well-known fcts hve striking consequence, first mde explicit in Colbeck s Ph.D. thesis [28] (see lso [29] for n expnded version): ny plyers producing correltions tht fll in the quntum regime must be rndomized! Indeed, deterministic plyers re inherently clssicl, so tht their success probbility must fll in the clssicl regime p CHSH 3/4. By checking tht the plyers produce nswers tht re more strongly correlted thn could ny deterministiclly chosen nswers, the referee is in effect implementing sttisticl test for rndomness. This ide ws quntittively nlyzed in work by Pironio & l. [92]. They showed, using protocol bsed on the CHSH gme, tht one could chieve qudrtic expnsion of rndomness: while the protocol requires the referee to use n uniformly distributed bits in order to select his questions, n bits of rndomness re generted. The work in [92] left open two importnt questions. First, wht is the best expnsion fctor chievble? Is qudrtic optiml? Among the mny pplictions for rndom bits, some of the most prominent pertin to the re of cryptogrphy. For instnce, the most widely-studied key distribution protocol, BB84 [18], requires lrge number of uniformly distributed bits in order to mke n initil choice of bsis. Hence second question: Are the rndom bits produced secure for cryptogrphic uses? Tht is, could ny informtion bout them potentilly be leked to n dversry, who my shre prior entnglement with the plyers? Our contribution. We give n nswer to both these questions. In Chpter 9 we introduce protocol tht only requires the referee to use O(logn) rndom bits, nd still results in the genertion of n bits of certified rndomness: n exponentil expnsion. In our protocol, n

22 CHAPTER 1. INTRODUCTION 11 experimenter (the referee) hs sequentil interction with pir of unknown devices (the plyers). The experimenter repetedly selects inputs to the devices, nd collects outputs. He then verifies tht the chosen inputs, together with the outputs obtined, verify certin constrint (in this cse, the CHSH condition). If so, he ccepts the outputs, nd if not he rejects them. This protocol is such tht, if the devices shre entnglement, there is simple strtegy tht will led them to produce outputs tht re ccepted by the referee with ner-certinty (nd re highly rndom). Moreover, ny pir of devices stisfying the no-signling condition whether or not their inner workings cn be described by quntum mechnics will either be rejected by the experimenter with high probbility, or produce bits tht contin lrge mounts of entropy. Hence the certified presence of rndomness does not depend on ny ssumption on the physicl nture of the devices it is gurnteed by simple sttisticl test, together with the no-signling condition. We lso show tht the bits produced in our protocol pper rndom even to the point of view of quntum dversry, who my herself be entngled with the two plyers used in the protocol. This condition is crucil for the use of the rndom bits in cryptogrphy, s well s for composbility of the protocol. Our proof of this dditionl security gurntee exploits some key fetures of specific construction of quntum-proof extrctor. Specificlly, suppose tht the conditionl min-entropy of the devices outputs B, conditioned on the dversry s system E, is much smller thn the number of rndom bits we clim the devices produce: H (B E) n. The key observtion is then tht, if we were to pply n extrctor to B in n ttempt to extrct more bits thn its conditionl min-entropy, then certinly the extrctor s output would not be secure: Eve would be ble to distinguish it from uniformly rndom string. By exploiting key fetures of the security proof of specific extrctor, bsed on construction prdigm due to Trevisn [119], we re ble to use this rgument to derive strong conditions on the dversry, eventully leding to contrdiction with the no-signling condition. We explin our results one extrctors next. Quntum-proof extrctors. Extrctors re pseudorndom constructions tht trnsform high-entropy string of bits (the source) into one tht is close to uniform (but shorter). In order to chieve this, they typiclly require n dditionl input, the seed, tht is uniformly distributed. An dversry to the extrctor is given ccess to the seed, nd to the output of the extrctor. The gol of the dversry is to distinguish this output from uniformly distributed bit string. If the dversry succeeds then the extrctor is not ccomplishing its tsk. Quntum dversries my be further (wekly) correlted with the source of the extrctor, nd use this quntum side informtion in order to help them distinguish the output of the extrctor from uniform. Showing tht n extrctor is secure ginst quntum dversries is chllenging tsk, nd the first such proof of security is due to Renner [100]. Other constructions were proven secure on cse-by-cse bsis [117, 74, 76], but for long time no extrctor construction with poly-logrithmic seed ws shown secure ginst quntum dversries. The first such

23 CHAPTER 1. INTRODUCTION 12 result cme in work by T-Shm [112], who provided n nlysis of vrint of Trevisn s extrctor [119] in the quntum bounded-storge model. Tht vrint hd poly-logrithmic seed, but n output length with poor dependence on the dversry s memory size. In Chpter 8 we show tht Trevisn s extrctor is secure in the presence of quntum dversry, in the most generl model of security. Moreover, we show tht the prmeters of the extrctor re essentilly the sme s in the clssicl setting. Our proof technique dpts the so-clled reconstruction prdigm to the quntum setting. Adpting this technique poses the unique chllenge of overcoming fundmentl property of quntum mesurements, which is tht they perturb the stte on which they re performed. The resulting quntum reconstruction prdigm, which derives its key ingredient from work of Koenig nd Terhl [76], plys n importnt role in the proof of security of our rndomness-expnsion protocol Interctive proofs with quntum messges. Entnglement plys dul role in multilyer gmes. As we hve seen, it cn be used by the plyers in order to collude ginst the referee. But it my lso potentilly be useful to the referee: by exploiting the presence of entnglement between the plyers the referee my require them to perform more complex tsks, tht even honest but un-entngled plyers would not be ble to chieve. This intriguing possibility, together with the bsence of quntittive bound on the mount of entnglement tht my be required of the plyers to ply even ner-optimlly in given gme, helps explin why there is currently no upper bound known on the clss MIP. (See [38] for n upper bound on the relted clss of lnguges hving quntum commuting-prover interctive proofs.) In order to explore this question we study multiplyer gmes in which the referee is llowed to exchnge quntum messges with the plyers. This nturl modifiction my open the wy to stronger forms of interction: for instnce, the referee my himself send entngled questions to the plyers, potentilly mking it hrder for them to collude or t lest mking it necessry for them to shre entnglement in order to succeed in the gme. The corresponding complexity clss, QMIP, ws introduced by Kobyshi nd Mtsumoto [72]. Kobyshi nd Mtsumoto show tht, in the bsence of entnglement between the plyers, QMIP = NEXP, while if polynomil number of qubits of entnglement re llowed then the inclusion QMIP NEXP still holds. Their first result demonstrtes tht quntum messges re no more useful thn clssicl messges in the context of multiprover interctive proofs without entnglement. 4 Our contribution. We show tht the presence of entnglement in multiprover interctive proofs with quntum messges cn be used beneficilly by the verifier. Indeed, we show 4 An nlogous result ws very recently shown for the clss of lnguges hving single-prover quntum interctive proofs: QIP = IP = PSPACE [64]. While the inclusion IP QIP is not hrd to see, it is the proof of the reverse continment QIP PSPACE = IP tht required mjor work nd the development of rdiclly new techniques [63, 62].

24 CHAPTER 1. INTRODUCTION 13 tht using entnglement QMIP systems cn be prllelized to three rounds of interction, nd mde public-coin: the verifier s sole messge to the provers is the brodcst of single rndom bit. This second property does not hold in the bsence of entnglement: in the clssicl cse, public-coin multi-prover interctive proofs re only s powerful s single-prover interctive proofs since every prover receives the sme question from the verifier, every prover knows how other provers will behve nd the joint strtegy of the provers cn therefore simulte ny strtegy of single prover. Hence, these systems cnnot be s powerful s generl clssicl multi-prover interctive proofs unless NEXP = PSPACE. In contrst, our result shows tht in the quntum cse, public-coin QMIP systems re s powerful s generl QMIP systems. The non-trivility of public-coin QMIP systems my be explined s follows: even if every quntum prover knows how other quntum provers will behve, still ech quntum prover cn only pply locl trnsformtions over prt of some stte tht my be entngled mong the provers, which is not enough to simulte every possible strtegy single quntum prover could follow. 1.4 Bibliogrphicl remrks This thesis is bsed on seven different ppers. The result NEXP MIP is joint work with T. Ito [60]. The prllel repetition of entngled gmes ws studied in joint work with J. Kempe [67]. The results exploiting the monogmy of entnglement in three-plyer gmes pper in joint work with J. Kempe, H. Kobyshi, K. Mtsumoto nd B. Toner [68]. The rndomness-expnsion protocol is joint work with U. V. Vzirni [121], while the security of Trevisn s extrctor ginst quntum dversries ws first shown in the bounded storge model in joint work with A. De [33], nd extended to the most generl setting in work with A. De, C. Portmnn nd R. Renner [34]. The results on the structure of QMIP re tken from joint work with J. Kempe, H. Kobyshi nd K. Mtsumoto [69].