Recent advances in theoretical and experimental quantum computing bring us closer to scalable quantum computing devices. This makes the need for protocols that verify the correct functionality of quantum operations timely and has led to the field of quantum verification. In this paper we address key challenges to make quantum verification protocols applicable to experimental implementations. We prove the robustness of the single server verifiable universal blind quantum computing protocol of Kashefi (2012 arXiv:1203.5217) in the most general scenario. This includes the case where the purification of the deviated input state is in the hands of an adversarial server. The proved robustness property allows the composition of this protocol with a device-independent state tomography protocol that we give, which is based on the rigidity of CHSH games as proposed by Reichardt et al (2013 Nature 496 456-60). The resulting composite protocol has lower round complexity for the verification of entangled quantum servers with a classical verifier and, as we show, can be made fault tolerant.The approaches that have been so far successful are those based on interactive proof systems [6,7], where a trusted, computationally limited verifier (also known as client, in a cryptographic setting) exchanges messages with an untrusted, powerful quantum prover, or multiple provers (also known as servers). The verifier attempts to certify that, with high probability, the provers are performing the correct quantum operations. Because we are dealing with a new form of computation, the verification protocols, while based on established techniques are fundamentally different from their classical counterparts. A number of quantum verification protocols have been developed, for different functionalities of devices and using a variety of different strategies to achieve verification [1,2,[8][9][10][11][12][13][14][15][16][17]. The assumptions made depend on the specific target and desired properties of the protocol. For example, if the emphasis is on creating an immediate practical implementation, then this should be reflected in the technological requirements leading to a testable application with current technology [17]. Alternatively, if the motivation is to prove a theoretical result, we may relax some requirements such as efficient scaling [2]. An important open problem in the field of quantum verification, is whether a scheme with a fully classical verifier is possible [18,19]. We know, however, that verification is possible in the following two scenarios.(1)A verifier with minimal quantum capacity (ability to prepare random single qubits) and a single quantum prover [1]. This is the Fitzsimons and Kashefi (FK) protocol.(2)A fully classical verifier and two non-communicating quantum provers that share entanglement [20]. This is the Reichardt, Unger and Vazirani (RUV) protocol.One of our objectives is to obtain a device-independent (allowing untrusted quantum devices) version of the FK protocol, by composing it with the RUV protocol.Here we ...

Quantum computers promise to efficiently solve not only problems believed to be intractable for classical computers, but also problems for which verifying the solution is also considered intractable. This raises the question of how one can check whether quantum computers are indeed producing correct results. This task, known as quantum verification, has been highlighted as a significant challenge on the road to scalable quantum computing technology. We review the most significant approaches to quantum verification and compare them in terms of structure, complexity and required resources. We also comment on the use of cryptographic techniques which, for many of the presented protocols, has proven extremely useful in performing verification. Finally, we discuss issues related to fault tolerance, experimental implementations and the outlook for future protocols. arXiv:1709.06984v2 [quant-ph] 9 Jul 2018Problem 1 (Verifiability of BQP computations). Does every problem in BQP admit an interactive-proof system in which the prover is restricted to BQP computations?As mentioned, this complexity theoretic formulation of the problem was considered by Gottesman, Aaronson and Vazirani [10,11] and, in fact, Aaronson has offered a 25$ prize for its resolution [10]. While, as of yet, the question remains open, one does arrive at a positive answer through slight alterations of the 4 BPP and MA are simply the probabilistic versions of the more familiar classes P and NP. Under plausible derandomization assumptions, BPP = P and MA = NP [13]. 5 Even if this were the case, i.e. BQP ⊆ MA, for this to be useful in practice one would require that computing the witness can also be done in BQP. In fact, there are candidate problems known to be in both BQP and MA, for which computing the witness is believed to not be in BQP (a conjectured example is [17]). 6 MA can be viewed as an interactive-proof system where only one message is sent from the prover (Merlin) to the verifier (Arthur).consideration for any realistic implementation of a verification protocol. Finally, in Subsection 5.3 we outline some of the existing experimental implementations of these protocols. Throughout the review, we are assuming familiarity with the basics of quantum information theory and some elements of complexity theory. However, we provide a brief overview of these topics as well as other notions that are used in this review (such as measurement-based quantum computing) in the appendix, Section 7. Note also, that we will be referencing complexity classes such as BQP, QMA, QPIP and MIP * . Definitions for all of these are provided in Subsection 7.3 of the appendix. We begin with a short overview of blind quantum computing. Blind quantum computingThe concept of blind computing is highly relevant to quantum verification. Here, we simply give a succinct outline of the subject. For more details, see this review of blind quantum computing protocols by Fitzsimons [34] as well as [35][36][37][38][39]. Note that, while the review of Fitzsimons covers all of the material ...

The relationship between correlations and entanglement has played a major role in understanding quantum theory since the work of Einstein et al (1935 Phys. Rev. 47 777-80). Tsirelson proved that Bell states, shared among two parties, when measured suitably, achieve the maximum non-local correlations allowed by quantum mechanics (Cirel'son 1980 Lett. Math. Phys. 4 93-100). Conversely, Reichardt et al showed that observing the maximal correlation value over a sequence of repeated measurements, implies that the underlying quantum state is close to a tensor product of maximally entangled states and, moreover, that it is measured according to an ideal strategy (Reichardt et al 2013 Nature 496 456-60). However, this strong rigidity result comes at a high price, requiring a large number of entangled pairs to be tested. In this paper, we present a significant improvement in terms of the overhead by instead considering quantum steering where the device of the one side is trusted. We first demonstrate a robust one-sided device-independent version of self-testing, which characterises the shared state and measurement operators of two parties up to a certain bound. We show that this bound is optimal up to constant factors and we generalise the results for the most general attacks. This leads us to a rigidity theorem for maximal steering correlations. As a key application we give a onesided device-independent protocol for verifiable delegated quantum computation, and compare it to other existing protocols, to highlight the cost of trust assumptions. Finally, we show that under reasonable assumptions, the states shared in order to run a certain type of verification protocol must be unitarily equivalent to perfect Bell states.

We introduce a protocol between a classical polynomial-time verifier and a quantum polynomialtime prover that allows the verifier to securely delegate to the prover the preparation of certain singlequbit quantum states. The protocol realizes the following functionality, with computational security: the verifier chooses one of the observables Z, X, Y, (X + Y)/ √ 2, (X − Y)/ √ 2; the prover receives a uniformly random eigenstate of the observable chosen by the verifier; the verifier receives a classical description of that state. The prover is unaware of which state he received and moreover, the verifier can check with high confidence whether the preparation was successful.The delegated preparation of single-qubit states is an elementary building block in many quantum cryptographic protocols. We expect our implementation of "random remote state preparation with verification" (RSP V ), a functionality first defined in (Dunjko and Kashefi 2014), to be useful for removing the need for quantum communication in such protocols while keeping functionality.The main application that we detail is to a protocol for blind and verifiable delegated quantum computation (DQC) that builds on the work of (Fitzsimons and Kashefi 2018), who provided such a protocol with quantum communication. Recently, both blind an verifiable DQC were shown to be possible, under computational assumptions, with a classical polynomial-time client (Mahadev 2017. Compared to the work of Mahadev, our protocol is more modular, applies to the measurement-based model of computation (instead of the Hamiltonian model) and is composable. Our proof of security builds on ideas introduced in (Brakerski et al. 2018). *

No abstract