Fault-tolerant Preparation of Stabilizer States for Quantum CSS Codes by Classical Error-Correcting Codes
FFault-tolerant Preparation of Stabilizer States for Quantum CSS Codes by ClassicalError-Correcting Codes
Ching-Yi Lai, ∗ Yi-Cong Zheng,
2, 3 and Todd A. Brun Institute of Information Science, Academia Sinica, Taipei, Taiwan 11529 Centre for Quantum Technology, National University of Singapore, Singapore 117543 Yale-NUS College, Singapore 138614 Electrical Engineering Department, University of Southern California, Los Angeles, California, USA 90089. (Dated: March 10, 2017)Stabilizer states are extensively studied in quantum information theory for their structures basedon the Pauli group. Calderbank-Shor-Steane (CSS) stabilizer states are of particular importance intheir application to fault-tolerant quantum computation (FTQC). However, how to fault-tolerantlyprepare arbitrary CSS stabilizer states for general CSS stabilizer codes is still unknown, and theirpreparation can be highly costly in computational resources. In this paper, we show how to preparea large class of CSS stabilizer states useful for FTQC. We propose distillation protocols usingsyndrome encoding by classical codes or quantum CSS codes. Along the same lines, we show thatclassical coding techniques can reduce the ancilla consumption in Steane syndrome extraction byusing additional transversal controlled-NOT gates and classical computing power. In the scenarioof a fixed ancilla consumption rate, we can increase the frequency of quantum error correction andeffectively lower the error rate.
I. INTRODUCTION
Quantum states are inherently susceptible to noise,and physical devices that process quantum informationare themselves generally faulty. Reliable quantum com-putation is still possible, however, with the help of quan-tum error-correcting codes. Quantum stabilizer codesare an especially important class of quantum codes thatare similar to classical linear block codes [1], in whichquantum information is encoded in the eigenstates—codewords—of a set of commuting Pauli operators calledstabilizer generators.Fault-tolerant quantum computation (FTQC) is thetask of accomplishing quantum computation with arbi-trary accuracy using imperfect quantum circuits. Pro-tected by one or more stabilizer codes, a code-basedFTQC scheme computes in the codespace of a stabi-lizer code, interspersed with repeated error corrections.A fault-tolerant procedure has the property that if onlyone component (or more generally, a small number ofcomponents) of the procedure fails, the errors producedby this failure are correctable, and are not transformedby the procedure into an uncorrectable error of the un-derlying error-correcting code. Threshold theorems haveshown that it is possible to realize quantum compu-tations of arbitrary size with arbitrary accuracy, pro-vided that the errors are sufficiently local and their ratesfall below a threshold [2–5]. Currently, most FTQCschemes use Calderbank-Shor-Steane (CSS) type stabi-lizer codes [6, 7], where every stabilizer generator can bechosen to be the tensor products of identity and either X or Z Pauli operators, and so can the logical opera-tors. Most such FTQC schemes require the preparation ∗ [email protected] of CSS stabilizer states—codewords of the CSS code thatare eigenstates of some set of logical operators—for thepurpose of error correction or computation.CSS stabilizer states can be prepared by using Cliffordencoding circuits (with faulty gates) [8]. However, thisis not fault-tolerant, so the generated states need to beverified. Basic CSS stabilizer states, such as the logicalstates | (cid:105) L or | + (cid:105) L , are usually fault-tolerantly generatedby specific quantum circuits in FTQC schemes [9–18].For general CSS codes, it is not known how to producearbitrary stabilizer states that are “clean” enough forquantum computation, especially when the code lengthis large.In other contexts (e.g., entanglement purification [19,20] or magic state distillation [21]), this problem is tack-led by distillation: making a bunch of imperfect states,and then carrying out a protocol to produce a smallernumber of better states. In this paper we show how clas-sical error-correcting codes , together with the Steane syn-drome extraction, can be applied to distill a large class ofuseful CSS stabilizer states (Distillation Protocol I), byactively correcting errors on a fraction of the imperfectstabilizer states that are produced by non-fault-tolerant(or fault-tolerant) methods.If we have clean ancillas, we can use the Steane syn-drome extraction to learn information about the errors—the error syndrome [22]. A transversal circuit is appliedbetween the codeword and two clean ancillas, and bit-wise qubit measurements are applied to the ancillas andthe error syndrome is obtained by computing the paritiesof the corresponding measurement outcomes. However,this would obviously consume more clean ancillas thanit produces. Since in our scenario only noisy stabilizerstates are available, we combine Steane extraction withclassical coding. After performing a transversal circuiton a set of noisy CSS stabilizer states, a subset of thestates are measured bitwise and a set of parities is cal- a r X i v : . [ qu a n t - ph ] M a r culated, and classical decoding is then applied to this setof parities to learn the error syndromes of the remain-ing stabilizer states. Quantum error correction can beapplied accordingly to obtain clean ancillas. Along theway, we also develop a distillation protocol using quan-tum CSS codes rather than classical codes (DistillationProtocol II).The only operations needed in the two protocolsare transversal controlled-NOT (CNOT) gates, bitwisesingle-qubit measurements, classical decoding, and cor-rection by applying Pauli gates (see Sec. III). These fea-tures for fault-tolerance are similar to the constraint oflocal operations and classical communication (LOCC) insome multipartite protocols, where each qubit is consid-ered as a single party. Therefore our distillation protocolsnaturally apply to the task of multipartite entanglementpurification for CSS stabilizer states by LOCC [23–28].For simplicity, we only consider CSS codes that encodeone logical qubit in this paper. Our results, however, canbe generalized easily to multi-qubit codes.The methods used for distilling ancillas—combiningSteane syndrome extraction with classical errorcorrection—can also solve a different (but related)problem. Steane syndrome extraction is used for quan-tum CSS codes with high-weight stabilizer generators.However, each error-correction step requires two cleanancillas per (quantum) codeword, which are of the samesize as the underlying CSS codes and are expensive,especially when the code length is large. We thereforewould like to use as few ancillas as possible duringsyndrome measurement without seriously degrading theperformance of error correction. To achieve this, wepropose an ancilla saving protocol using classical codes.Rather than using two ancillas for each code block, asmaller number of ancillas is shared among multiple codeblocks, and classical decoding is used to separate out theerror syndromes of the different blocks. Assuming thatthe error rate is low enough, this can reduce the rate ofancilla consumption for a given rate of error correctionwithout seriously reducing its accuracy.The paper is organized as follows. We provide prelimi-nary material in the Sec. II, including the basics of stabi-lizer codes, CSS codes, and Steane syndrome extraction.The distillation protocols by classical codes and quantumCSS codes are given in Subsec. III A and Subsec. III B,respectively. Following that, we describe the ancilla sav-ing protocol in Sec. IV. We conclude in Sec. V. II. PRELIMINARIES
We begin with a brief review of classical codes, quan-tum stabilizer codes, CSS codes, and Steane syndromeextraction.
A. Classical Codes, Stabilizer Codes, and CSSCodes
Error-correcting codes protect digital information fromnoise by adding redundancy. The encoded informa-tion has to satisfy some mathematical relations— paritychecks —so that errors can be detected if any of the paritychecks are violated. Let H be an ( m − k ) × m binary ma-trix with full rank. Then an [ m, k, d ] linear binary code C associated with parity-check matrix H is a k − dimensionalsubspace of all binary ordered m − tuples (row vectors) in Z m such that v H T = 0 , for all v ∈ C , where H T is the transpose of H and theaddition is modulo 2. Such row vectors v are called code-words of C . If H ˜ v T (cid:54) = 0 for some ˜ v ∈ Z m , we know thatsome error occurred. Hence, the rows of H are calledparity-checks and H ˜ v T is called the error syndrome of˜ v . The parameter d is called the minimum distance of C so that any two codewords of C differ in at least d bits.This code can correct arbitrary (cid:98) d − (cid:99) -bit errors. Sincethe code is linear, C can also be defined as the row spaceof an k × m generator matrix G , which satisfies GH T = 0 . That is, G and H are orthogonal. The dual code C ⊥ of C is the row space of H . For more properties of classicalcodes, please refer to [29].Now we consider the quantum case. We focus on thetwo-level quantum system—the qubit . A pure qubit stateis a unit vector in the two-dimensional complex vectorspace C with the usual inner product and an (ordered)orthonormal basis {| (cid:105) , | (cid:105)} . The n -qubit state space is C n . Let G n = G ⊗ n denote the n -fold Pauli group, where G = {± I, ± iI, ± X, ± iX, ± Y, ± iY, ± Z, ± iZ } , (1)and I = (cid:20) (cid:21) , X = (cid:20) (cid:21) ,Z = (cid:20) − (cid:21) , Y = iXZ. We use the notation X j to denote I ⊗ j − ⊗ X ⊗ I ⊗ n − j where the underlying length n is clear from the context,and similarly for Y j and Z j . We also use the notation X e for e = e · · · e n ∈ Z n (row vector) to denote ⊗ ni =1 X e i ,and similarly for Z e . In general, an n -fold Pauli operatorcan be expressed as i c (cid:48) ⊗ ni =1 X e i Z f i = i c X e Z f (2)for c, c (cid:48) ∈ { , , , } and e, f ∈ Z n . Thus ( e, f ) is calledthe binary representation of the Pauli operator i c X e Z f .For example, I ⊗ X ⊗ I ⊗ I ⊗ Z = X Z = X Z .The identity I ⊗ n will be denoted by id . Let C i ( X j )denote the CNOT gate with control qubit i and targetqubit j . For example, C ( X ) = | (cid:105)(cid:104) | ⊗ I ⊗ n − + | (cid:105)(cid:104) | ⊗ X ⊗ I ⊗ n − . The quantum circuits in this paper consistonly of CNOT gates, together with single-qubit measure-ments in the X or Z basis.Suppose S is an Abelian subgroup of G n with a setof l independent generators { g , . . . , g l } , and S does notinclude − I . Every element in G n has eigenvalues ± n, n − l ]] quantum stabilizer code C ( S ) is defined asthe 2 n − l -dimensional subspace of the n -qubit state space( C n ) fixed by S , which is the joint-(+1) eigenspace of g , . . . , g l . Then for a codeword | ψ (cid:105) ∈ C ( S ), g | ψ (cid:105) = | ψ (cid:105) for all g ∈ S . When l = n , C ( S ) has only one eigenstate(up to a phase) and this state is called a stabilizer state .The error operators in this paper are assumed to be Pauli errors (i.e., operators in G n ). This is not actuallyas restrictive as it sounds: since the Pauli operators forma basis, the ability to correct a set of Pauli errors impliesthe ability to correct a large class of general errors. If aPauli error occurs on | ψ (cid:105) , some eigenvalues of g , . . . , g l may be flipped. Therefore, we gain information about theerror by measuring the stabilizer generators g , . . . , g l ,and the measurement outcomes (in bits) of g , . . . , g l arecalled error syndrome . (If the eigenvalue of a stabilizeris +1 or −
1, its corresponding syndrome bit is 0 or 1,respectively.) Then a quantum decoder has to choosea good recovery operation based on the measured errorsyndromes.CSS codes are a class of stabilizer codes whose stabi-lizer generators consist of the tensor products of identityand either X or Z operators [6, 7]. Let [ M ] i,j denotethe ( i, j ) entry of a matrix M . (We may also use [ v ] i to denote the i th entry of a vector v .) A CSS code canbe defined by two matrices that are orthogonal to eachother. Suppose H Z and H X are r Z × n and r X × n matri-ces ( r Z + r X ≤ n ) with full rank r Z and r X , respectively,such that H X H TZ = 0 . (3)Then we can define an [[ n, n − r Z − r X ]] CSS code with Z stabilizer generators g i = n (cid:79) j =1 Z [ H Z ] i,j , i = 1 , . . . , r Z , (4)and X stabilizer generators g r Z + i = n (cid:79) j =1 X [ H X ] i,j , i = 1 , . . . , r X . (5)The condition in Eq. (3) implies that the X and Z sta- bilizer generators all commute.The check matrix of an [[ n, n − l ]] stabilizer code isan l × n binary matrix whose rows are the binary repre-sentations (Eq. (2)) of the stabilizer generators g , . . . , g l .For the CSS code defined by H Z and H X , its check matrixis (cid:20) H Z H X (cid:21) . (6)The error syndrome of a Pauli error is the string ofbinary outcomes of measuring the stabilizers g , . . . , g l .Since a Pauli error can be expressed as a product of X and Z operators, error correction can be done by treat-ing Pauli X and Z errors separately. For CSS codes,the eigenvalues of g , . . . , g r Z (respectively, g r Z +1 , . . . , g l )correspond to the error syndrome of X (resp. Z ) errors.Suppose a Pauli error X e Z f occurs on a codeword, where e, f ∈ Z n . Then its (binary) X error syndrome s X ∈ Z r Z ,which corresponds to the eigenvalues of g , . . . , g r Z , isgiven by s X = e H TZ , (7)and the Z error syndrome is defined similarly: s Z = e H TZ . (8)In addition to the stabilizer elements, there will in gen-eral also be Pauli operators that commute with all thestabilizer generators without being in the stabilizer them-selves. We call these logical operators . For a CSS code,it is always possible to find a subset of logical opera-tors involving only the identity and either X or Z op-erators, which generate all other logical operators up tomultiplication by a stabilizer element. Moreover, theselogical generators can be chosen in anticommuting pairs,usually denoted ¯ X j , ¯ Z j , where each pair corresponds tological qubit j in the code. For simplicity, in the restof this paper we consider the preparation of stabilizerstates of CSS codes Q that encode one logical qubit (or r Z + r X = n − n, n − r Z − r X ]] multiple-qubit CSS codes( n − r Z − r X > X and ¯ Z denote the logical X and Z operators of Q . A quantum state with L in thesubscript refers to an encoded state. For example, theencoded | (cid:105) , | + (cid:105) = √ ( | (cid:105) + | (cid:105) ) are denoted by | (cid:105) L and | + (cid:105) L , respectively. B. CSS Stabilizer States and Steane SyndromeExtraction
Steane suggested a method to extract error syndromesfor CSS codes [22], as shown in Fig. 1. Two clean ancil-las | + (cid:105) L and | (cid:105) L in the logical states of the underlyingCSS code Q are used to measure the X and Z errorsyndromes, respectively. Each CNOT gate in Fig. 1 rep-resents transversal CNOT gates, and the measurements FIG. 1. Quantum circuit for Steane syndrome extraction. in the Z or X basis are bitwise. In the circuit, X and Z errors on the data qubit will propagate, respectively, tothe ancillas | + (cid:105) L and | (cid:105) L through the CNOTs, so thatwe learn error information by measuring the two ancillas.Suppose the measurement outcomes of | + (cid:105) L and | (cid:105) L are m X and m Z (in bits), respectively. Then the (ob-served) X and Z syndromes are computed by m X H TZ , and m Z H TX , respectively. We can perform error correc-tion according to these syndromes or just keep track ofthem.The two ancillas | + (cid:105) L and | (cid:105) L are actually stabi-lizer states of Q by including logical operator ¯ X or ¯ Z in with the stabilizer generators. That is, | + (cid:105) L is sta-bilized by (cid:104) g , . . . , g n − , ¯ X (cid:105) , and | (cid:105) L is stabilized by (cid:104) g , . . . , g n − , ¯ Z (cid:105) . These two stabilizer states can be pro-duced by Clifford encoding circuits with CNOT gatesonly, together with the ability to prepare physical qubitsin | (cid:105) and | + (cid:105) [30]. If imperfect quantum gates are usedin the encoding circuit, the states must be verified.We can use Steane syndrome extraction to correct er-rors on a noisy ancilla, but it requires us already to havetwo clean ancillas, which is clearly impractical. In thefollowing section, we will introduce a protocol for distill-ing a number of CSS stabilizer states from a larger set ofimperfect ones by using classical error-correcting codesand quantum CSS codes, and demonstrate how to distillthe states | (cid:105) L or | + (cid:105) L .A simple example of a CSS stabilizer state is theEinstein-Podolsky-Rosen (EPR) pair: | (cid:105) + | (cid:105)√ , which is stabilized by X ⊗ X and Z ⊗ Z . C´orcoles et al. recently experimentally demonstrated error correction onan EPR pair [31]. EPR pairs were the first states forwhich a distillation protocol was proposed [19, 20]. III. ANCILLA DISTILLATION
Suppose we are using an [[ n, Q defined bymatrices H Z , H X with r Z + r X = n − X e | (cid:105) L , wecan perform quantum error correction and restore thestate up to some logical operator if we know the actualerror syndrome. Now, measuring the logical operator ¯ Z will tell us whether there is a logical error or not, andadditional logical correction can be applied if necessary. Thus we can, ideally, have a perfect stabilizer state | (cid:105) L .In reality we are in a situation where the ancillas forsyndrome measurements are also imperfect, and we willaddress this issue in this section.Suppose we are given a bunch of imperfect ancillas insome CSS stabilizer state, e.g., | (cid:105) L or | + (cid:105) L , and we wishto purify them. Our approach is to determine the correcterror syndromes of a subset of the ancillas by measuringthe rest. More precisely, we will use a transversal quan-tum circuit to couple m noisy ancillas according to aclassical error-correcting code, measure m − k of them,and then extract the error syndromes of the remaining k ancillas. This procedure is called ancilla distillation byclassical codes and will be detailed in the first subsec-tion. In the second subsection, we generalize the idea todistill the noisy ancillas by using an arbitrary quantumCSS code.For now, we neglect any errors in the CNOTs or mea-surements used in the quantum circuit for distillation.We discuss the issue of noisy distillation circuits in Sec-tion V. A. Distillation by Classical Codes
The key observation is that classical binary linear codescan be encoded or decoded by circuits using only CNOTs.Suppose C D is an [ m, k, d ] binary linear block code thatcan correct t = (cid:98) d − (cid:99) errors. Such a code has r = m − k parity checks. Let H D = [ A T I r ] be the parity-checkmatrix of C D in systematic form, where I k is the k × k identity matrix and A is k × r . We define a quantumdistillation circuit U D by U D = k (cid:89) i =1 r (cid:89) j =1 C i ( X k + j ) [ A ] i,j . (9)That is, C i ( X k + j ) is applied if [ A ] i,j = 1, and id is ap-plied, otherwise. Consider X e | m (cid:105) = | e (cid:105) , where e = e · · · e m ∈ Z m and 0 m = 0 · · · (cid:124) (cid:123)(cid:122) (cid:125) m . Then U D | e (cid:105) = | e · · · e k (cid:105) ⊗ | s e (cid:105) , where s Te = H D e T is the classical error syndrome of e with respect to C D . Then we can use a decoder of C D to find the most probable error vector ˜ e ∈ Z m and thencorrect the bit-flip errors in | e · · · e k (cid:105) . This decodingprocedure is the main conceptual tool of our distillationprotocol.Distillation of CSS stabilizer states by classical codesinvolves two rounds of error correction: one for X errorsand one for Z errors. Distillation Protocol I:
1) Using an encoding circuit, we prepare many noisycopies of an n -qubit CSS stabilizer state. Divide thenoisy ancillas up into groups of m .2) (Round 1: X errors) In each group of m ancillas,choose the last r of the ancillas to hold the paritychecks, and apply U D transversally : that is, apply U D to the first qubits of all m ancillas in the group, to thesecond qubits, and so forth. This unitary U D appliestransversal CNOTs according to the pattern of 1s inthe binary matrix A .3) Measure every qubit in the r parity-check ancillas (thelast r ancillas in each group of m ) in the Z basis.Let the binary row vectors ν (1) , . . . , ν ( r ) ∈ Z n be theoutcomes of these measurements.4) Calculate σ ( i ) (cid:44) ν ( i ) H TZ for i = 1 , . . . , r . For j =1 , . . . , r Z , use [ σ (1) ] j · · · [ σ ( r ) ] j as a classical error syn-drome of C D and use a decoder of C D to find the mostprobable error vector ˜ s (1) j · · · ˜ s ( m ) j with this error syn-drome. Then ˜ s ( i )1 · · · ˜ s ( i ) r Z is the estimated X error syn-drome of the i th target ancilla. Correct the X errors,if any (or just keep track of them).5) If the distillation target is | (cid:105) L or | (cid:105) L , calculate theparity of ¯ Z from ν ( i ) and estimate the syndrome bitsfor the logical operators as in the previous step. Cor-rect the logical errors ¯ X , if any (or just keep track).6) Of our original large number of ancillas, a fraction k/m are left. Again, divide them up into groups of m .It is very important that ancillas that were groupedtogether in the first round are not grouped together inthe second round, because their errors are correlated.7) (Round 2: Z errors) Similarly to step 2 above, do atransversal U HD , where U HD = k (cid:89) i =1 r (cid:89) j =1 C k + j ( X i ) [ A ] i,j . (10)(The control and target qubits of U D are switched toobtain U HD .)8) Measure the r parity-check ancillas in the X basis.Then repeat steps 3–5, but with X and Z switchedeverywhere, and with | (cid:105) , | (cid:105) replaced by | + (cid:105) , |−(cid:105) , re-spectively. (cid:50) This procedure is somewhat technical, so we willdemonstrate the distillation protocol with a detailed ex-ample.
Example 1.
Fig. 2 illustrates the quantum circuit fordistillation by the [3 , ,
3] repetition code with a parity-check matrix H D = (cid:20) (cid:21) , (11) FIG. 2. The circuit for distilling | (cid:105) L by the classical [3 , , (cid:102) | (cid:105) L are imperfect logical states. Thelast two (cid:102) | (cid:105) L serve as parity-check ancillas. for the ancilla state | (cid:105) L of an n -qubit quantum CSS code.We now demonstrate the above protocol by distilling theancillas of the [[7 , , g = Z Z Z Z ,g = Z Z Z Z ,g = Z Z Z Z ,g = X X X X ,g = X X X X ,g = X X X X , and logical operators ¯ X = X X X , ¯ Z = Z Z Z .Suppose the [3 , ,
3] repetition code is used for distill-ing several noisy codewords of the Steane code. First, thenoisy codewords are divided in to groups of m = 3. Con-sider one group with the three noisy Steane codewords E | (cid:105) L , E | (cid:105) L , and E | (cid:105) L prepared independently witherrors E , , , where E = X X X = ¯ X , E = X , and E = X X . Note that E and E are uncorrectableerrors for the Steane code. The X error syndromes are E : 000 1 E : 001 0 E : 110 0with respect to g , g , g , and ¯ Z , respectively. Afterthe (perfect) distillation circuit U D by the [3 , ,
3] code(Fig. 2), the errors become E (cid:48) = E , E (cid:48) = E E = X X X X , and E (cid:48) = E E = X X X X X . Thenmeasuring bitwise the second and the third codewords,and calculating the parities of g , g , g and ¯ Z , we havetheir syndrome bits σ (1) : 001 1 ,σ (2) : 110 1 . Now we can use the parity check matrix of the [3 , , s (1) : 000 1 . Since the fourth bit is 1, we apply logical operator ¯ X to the first codeword to correct the logical error and thefinal state is | (cid:105) L . Thus we have fault-tolerantly preparedan ancilla | (cid:105) L . (cid:50) Now we carry out protocol I for general CSS codes asfollows. Suppose the X errors on the m ancillas are X e (1) , . . . , X e ( m ) , where e ( j ) = e ( j )1 · · · e ( j ) n ∈ Z n . Let s (1) = e (1) H TZ , . . . , s ( m ) = e ( m ) H TZ . The decoding operator U D will transform X e (1) j ⊗ X e (2) j ⊗ · · · ⊗ X e ( m ) j to X e (1) j ⊗ · · · ⊗ X e ( k ) j ⊗ X s jX for j = 1 , . . . , n , where s jX ∈ Z r is the error syndromeof e (1) j · · · e ( m ) j ∈ Z m with respect to H D . If we couldmeasure s jX , we could decode e ij directly and then obtain k clean ancillas.However, the measurement outcomes ν (1) , . . . , ν ( r ) ofstep 3 are actually a disturbed version of s jX : (cid:16) ν (1) T · · · ν ( r ) T (cid:17) = s X ... s nX + (cid:0) c T · · · c Tr (cid:1) , = (cid:16) e (1) T · · · e ( m ) T (cid:17) H TD + (cid:0) c T · · · c Tr (cid:1) , (12)where the row vectors { c j } are unknown codewords ofthe classical code with parity check matrix H Z . Since wedo not know the codewords, we cannot learn s jX .On the other hand, we still can learn the quantumerror syndrome s (1) = e (1) H TZ , . . . , s ( m ) = e ( m ) H TZ from ν (1) , . . . , ν ( r ) . Multiplying (12) from the right by H TZ , we have H D s (1) ... s ( m ) = ν (1) H TZ ... ν ( r ) H TZ (cid:44) σ (1) ... σ ( r ) . (13)Then we can choose any decoder of C D to recover the k error syndromes ˜ s ( i ) of the target ancillas as in step 4.That is, we are retrieving a particular syndrome bit j of every ancilla ˜ s (1) j , . . . , ˜ s ( m ) j in one classical decodingprocedure. From that, we can correct all the X errors inthe target k ancillas (and also any logical X errors if weare distilling | (cid:105) L ). Remark 1.
As long as fewer than (cid:98) d − (cid:99) of the m syn-drome bits s (1) j , . . . , s ( m ) j are 1s, they can be recovered bythe classical decoding, assuming that the quantum gatesin the distillation circuit are perfect. Remark 2.
The distillation protocol depends only onthe error-correcting power of the classical code C D , andnot on the error-correcting ability of the stabilizer statesbeing distilled. If n = 1, this procedure reduces to thestandard classical decoding of C D . After round 1, the remaining k ancillas from the groupwill have lower rates of X errors than they started with.However, Z errors on the parity-check ancillas can propa-gate via the CNOTs back onto these k ancillas, increasingthe rate of Z errors (and also correlating the errors acrossthe ancillas). How do these changes compare? Assumethat the original rates of Z and X errors are both p .The rate of Z errors on the remaining k ancillas will in-crease to ∼ ( β + 1) p , where β ≤ r is the number of paritychecks that each qubit is included in (or the number of1s in each row of A ). The rate of X errors goes from p to cp t +1 , where c is a constant that depends on the detailsof the codes. If p is not too big, the rate of Z errors hasgrown roughly by a constant factor, while the rate of X errors has been substantially reduced.After round 2, we are left with a fraction ( km ) of ouroriginal ancillas. The rate of Z errors will go from ( β +1) p to c (( β + 1) p ) t +1 = c (cid:48) p t +1 , and the rate of X errors willgo from cp t +1 to ( β + 1) cp t +1 = c (cid:48)(cid:48) p t +1 . (So the rateof an arbitrary Pauli error is roughly ˜ cp t +1 for some ˜ c .)These constants will not generally be equal to each other(and indeed, the starting rates for X and Z might nothave been equal ); one might use two different classicalerror-correcting codes in the two rounds so that the finalrates both end up below some desired fraction. To reach adesired target error rate, this procedure could be iterated;or one could just vary the distances of the classical codesused depending on the original error rates and the desiredfinal error rates. Example 2.
In addition to the [3 , ,
3] repetition codeabove, we simulated distillation by the [5 , ,
5] repetitioncode and the [7 , ,
3] Hamming code [29]. The results areshown in Fig. 3. The simulations begin with preparationof noisy ancillas by the CSS encoding circuit. We as-sume that during the ancilla preparation each individualqubit suffers independent depolarizing errors with rate p . Noisy CNOTs in the encoding circuit are modeled asa perfect CNOT, followed by no error (with probability1 − p ) or one of the nonidentity two-fold Paul operators(e.g., X ⊗ Y , I ⊗ Z , X ⊗ I , . . . ) with equal probabilities p/
15. For our initial analysis, we assume that the dis-tillation circuit does not itself contain errors; the issueof imperfect distillation circuits will be addressed in thediscussion section.We define the final error rate to be the probabilityof any Pauli error left in the target ancillas after tworounds of distillation. This estimate is pessimistic , sinceit ignores the likelihood that the residual errors are cor-rectable in the next error correction cycle.After the noisy encoding circuit, the error rate on eachqubit will increase to ∼ ( α + 1) p , where α is the num-ber of stabilizer generators each qubit is involved. If p issmall enough, the distillation protocol will work. As canbe seen in the logarithmic plot in Fig. 3, each curve ap-pears linear with slope t + 1 and the “threshold” for eachcode is specified by log p th = − t log ˜ c . (By “threshold,”we mean the crossing point of a curve with the dashedline. That is, the point where the distillation error rateand the physical rate p are equal.) Thus, we say that astabilizer state can be fault-tolerantly prepared if the er-ror rate is below the threshold for the classical code usedin distillation. (cid:50) For these simple examples, we can see that the [5,1,5]code with higher distance has asymptotically better be-havior in the low physical error rate regime but the yieldrate is low. On the other hand, the [7,4,3] code has alarger yield rate but worse performance. Since there aremany efficient classical codes with high rate and gooderror-correcting ability, we can certainly find better can-didates for the protocol with extra cost. (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230)(cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224)(cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:180) (cid:45) (cid:180) (cid:45) (cid:180) (cid:45) (cid:180) (cid:45) (cid:180) (cid:45) (cid:45) (cid:45) (cid:45) (cid:45) p E rr o rr a t e FIG. 3. (Color online.) Ancilla distillation by 1) the [7 , , , ,
3] repetitioncode (red dots); 3) the [5 , ,
5] repetition code (blue squares).The dashed line is the rate without distillation. Up to 7 × iterations are used for each point. Finally we briefly discuss candidates for large quan-tum codes whose raw ancilla state preparation by noisyClifford circuits will have sufficiently low error rates. Itis known that quantum CSS codes built from classicaldoubly-even codes allow transversal Clifford gates [33,34]: such codes as the Steane code, the [[23 , , B. Distillation by Quantum CSS Codes
Instead of using classical codes in two steps to correctboth X and Z errors, we can similarly use an [[ m, k ]]quantum CSS code Q D to distill the desired ancillas ofan [[ n, Q D is defined by H (cid:48) Z and H (cid:48) X of dimension r (cid:48) Z × m and r (cid:48) X × m matrices( k = m − ( r (cid:48) Z + r (cid:48) X ) >
0) with full rank r (cid:48) Z and r (cid:48) X and H (cid:48) X H (cid:48) TZ = 0 . Q D has r (cid:48) Z Z generators, and r (cid:48) X X generators. The check matrix of an [[ m, k ]] CSS code canbe written in the following form [8]: (cid:18) H (cid:48) Z H (cid:48) X (cid:19) = (cid:18) I r (cid:48) Z A B
D I r (cid:48) X F (cid:19) , where A , B , D , and F are binary matrices of appropri-ate dimensions. We use a particular encoding circuit asfollows: to the k information qubit state | φ (cid:105) , append r (cid:48) Z ancilla qubits in the state | (cid:105) and r (cid:48) X ancilla qubits in thestate | + (cid:105) , which will correspond to the r (cid:48) Z Z generatorsand r (cid:48) X X generators, respectively, after encoding. Thatis, we apply an encoding circuit to the initial state | (cid:105) ⊗ r (cid:48) Z ⊗ | + (cid:105) ⊗ r (cid:48) X ⊗ | φ (cid:105) , which corresponds to a check matrix (cid:18) I r (cid:48) Z I r (cid:48) X (cid:19) . The encoding circuit U (cid:48) D , which is a unitary operator, willthen consist only of CNOT gates [30]. It can be verifiedthat this works for any CSS codes. and we postpone thisjustification to Appendix A.Suppose an error operator E ∈ G m occurs on a code-word of Q D . We decode by running the above encodingcircuit backwards, so that the error syndrome informa-tion will be contained in the ancilla qubits. After thedecoding circuit U (cid:48) D † , we have the following transformederror operating on the initial state | (cid:105) ⊗ r (cid:48) Z ⊗ | + (cid:105) ⊗ r (cid:48) X ⊗ | φ (cid:105) : U (cid:48) D † EU (cid:48) D (cid:44) X s X ⊗ Z s Z ⊗ L E , where s X ∈ Z r (cid:48) Z , s Z ∈ Z r (cid:48) X are the syndrome vectors(hence X s X ∈ G r (cid:48) Z , Z s Z ∈ G r (cid:48) X ) and L E ∈ G k is an logicalerror operator.We then measure the first r (cid:48) Z ancillas in the Z basis,which gives the X error syndrome s X , and the other r (cid:48) X ancillas in the X basis, which gives the Z error syndrome s Z . From that, we can figure out what corrections, if any,need to be applied to the k information qubits. This leadsto the following distillation scheme: Distillation Protocol II:
Suppose we want to distill a CSS stabilizer state of the[[ n, Q defined at the beginning of this section.1) Start with m imperfect copies of a stabilizer state of Q . Do a transversal U (cid:48) D † on the m copies of the n -qubit system.2) For the r (cid:48) Z (respectively r (cid:48) X ) systems in the positionscorresponding to the Z (resp. X ) ancillas, we mea-sure all the qubits in the Z (resp. X ) basis and let ν (1) , . . . , ν ( r (cid:48) Z ) ∈ Z m (resp. ν (1) , . . . , ν ( r (cid:48) X ) ∈ Z m ) bethe outcomes.3) Calculate σ ( i ) X (cid:44) ν ( i ) Z H TZ for i = 1 , . . . , r (cid:48) Z . For j = 1 , . . . , r Z , use [ σ (1) X ] j · · · [ σ ( r (cid:48) Z ) X ] j as a classical er-ror syndrome with respect to the parity-check matrix H (cid:48) Z and use a corresponding decoder to find the mostprobable error vector ˜ s (1) j · · · ˜ s ( m ) j with this error syn-drome. Then ˜ s ( i )1 · · · ˜ s ( i ) r Z is the estimated X error syn-drome of the i th target ancilla. We can correct the X errors, if any, (or just keep track of them).4) Repeat 3) but with X and Z switched everywhere.5) If the distillation target is | (cid:105) L or | (cid:105) L (resp. | + (cid:105) L or |−(cid:105) L ), then calculate the parity of ¯ Z (resp. ¯ X ) from ν ( i ) Z (resp. ν ( i ) X ) and estimate the syndrome bits forthe logical operators as in the previous step. Correctthe logical error ¯ X (resp. ¯ Z ), if any, (or just keeptrack of them). (cid:3) This protocol is very similar to Distillation Protocol I.Thus we omit the explanation of how it works. We end upwith k much cleaner copies of the n -qubit CSS stabilizerstates of Q . Again, this procedure could be iterated,or we can use a good enough [[ m, k ]] code. This is likea concatenation of the n -qubit code Q with the [[ m, k ]]code Q D , but only the decoding on the second level, Q D ,is applied.Protocol I by classical codes is more flexible than Pro-tocol II, since any classical codes can be used in Protocol Iand the codes can be different in two rounds of distilla-tion; whereas only dual-containing codes can be appliedin Protocol II. On the other hand, dual-containing codesused in Protocol II can also be applied in Protocol I,and the number of CNOTs for correcting both X and Z errors are roughly the same in the two protocols. Basi-cally, the performance of these two protocols are stronglyrelated to the performance of the classical codes, so weomit simulations of Protocol II here. IV. ANCILLA SAVING
Clean ancillas | (cid:105) L and | + (cid:105) L in Steane syndrome ex-traction are expensive resources. We would like to use asfew of them as possible during syndrome measurement,as long as errors do not accumulate seriously. In the FIG. 4. The circuit for syndrome measurement of three datablocks with two ancilla blocks by the [3 , ,
3] repetition code. following, we show that classical coding can also reduceancilla consumption in Steane syndrome extraction; itturns out that this problem is equivalent to the distilla-tion problem in Sec. III A. We assume that the quantumcircuits for error correction are perfect, and the ancillasare assumed to be clean in the following discussion.Suppose we have m codewords | ψ (cid:105) , . . . , | ψ m (cid:105) of the[[ n, Q defined by H Z and H X . Let X e ( j ) Z f ( j ) be the error corrupting | ψ j (cid:105) for j = 1 , . . . , m . If Steanesyndrome extraction is used, m (perfect) ancillas | + (cid:105) L are required to measure the X error syndromes e ( j ) H TZ .Our goal here is to estimate the X error syndromes byusing only r ( < m ) clean ancillas | + (cid:105) L . The treatmentfor Z error is similar.Let C D be an [ m, k = m − r, d ] classical code withparity-check matrix H D = [ A T I r ]. Assume we have r clean ancillas | + (cid:105) L and r clean ancillas | (cid:105) L . Ancilla Saving Protocol:
1) Apply transversal CNOTs from | ψ j (cid:105) to the j -th | + (cid:105) L for j = k + 1 , . . . , m .2) Apply a transversal CNOT from | ψ i (cid:105) to the j -th | + (cid:105) L if [ A ] i,j = 1.3) Do steps 3 and 4 of Distillation Protocol I.4) Apply transversal CNOTs from the j -th | (cid:105) L to | ψ j (cid:105) for j = k + 1 , . . . , m .5) Apply a transversal CNOT from the j -th | (cid:105) L to | ψ i (cid:105) to if [ A ] i,j = 1.6) Do steps 3 and 4 of Distillation Protocol I, but with X and Z switched everywhere. (cid:3) Fig. 4 demonstrates the circuit for the X syndromeextraction of three data blocks with two ancilla blocksby the [3 , ,
3] repetition code. Observe that this circuitis essentially equivalent to the circuit in Fig. 2. We cancombine the X errors from the second and third encodedstates with the two clean ancillas | + (cid:105) L , respectively, andthen remove those two encoded states. As a consequence,our ancilla saving protocol is equivalent to the distillationprotocol by classical codes.We may compare the error correction performance ofthis ancilla saving protocol by C D on codewords of Q , say Q + C D , with the original Steane extraction scheme. Agood figure of merit for comparison is the channel fidelityof a quantum code over a noise channel [36, 37]. Forsimplicity, here we assume the independent single-qubitnoise channel is E ( ρ ) = (1 − p ) ρ + pXρX, for any single-qubit state ρ . Unquestionably the channelfidelity is expected to drop with fewer ancillas in the sav-ing protocol, and both the encoding and decoding com-plexities will increase. Thus, we have a tradeoff betweenchannel fidelity, gate complexity, and ancilla consump-tion. Example 3.
Consider the [[7 , , F C ( E ) i be the channel fidelity of sending | ψ i (cid:105) through E ⊗ n for i = 1 , . . . , m . Then the average channelfidelity is F C ( E ) = 1 m (cid:88) i F C ( E ) i . Since | ψ i (cid:105) are correlated in the saving protocol, the pre-vious result of F C ( E ) cannot be applied here. Thus weapply Monte Carlo methods to approximate F C ( E ):1) Fix p . Set i := 1.2) Apply Pauli X errors X ie (1) , . . . , X ie ( m ) to perfect infor-mation states | ψ (cid:105) , . . . , | ψ m (cid:105) , where X ie ( j ) ∈ P n is an n -fold Pauli X error, randomly generated accordingto the probability distribution of E .3) Use the ancilla-saving code C to recover the error syn-dromes s , . . . , s m for X ie (1) , . . . , X ie ( m ) , respectively. Ifthere is no logical error on | ψ j (cid:105) after decoding, X ie ( j ) is correctable. Set i := i + 1.4) Repeat steps 2 and 3 N times.5) Count the number of correctable errors in { X ie ( j ) } , say M . Then F C ( E ) is approximated by MmN .Fig. 5 illustrates plots on F C ( E ) for various ancilla sav-ing protocols: the [7 , ,
3] Hamming code, and the [3 , , , ,
5] repetition codes, together with F C ( E ) with-out ancilla-saving. As shown in Fig. 5, at p = 0 .
01, thechannel fidelity for [[7 , , , ,
3] drops from 0.998to 0.988. Since only two ancilla states are used, we re-duce the ancilla consumption by 33 .
3% by using one ad-ditional transversal CNOT and increased classical com-puting complexity. (Note that the circuit for preparing a | + (cid:105) L has nine CNOTs.) For the [7 , ,
3] code, the fidelity (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230)(cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224)(cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236)(cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) p F c (cid:72) (cid:69) (cid:76) (cid:242) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:236) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:224) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:230) (cid:64)(cid:64) (cid:68)(cid:68) FIG. 5. (Color online.) The average channel fidelity of theSteane code without or with ancilla saving by the [3 , , , , , ,
5] code. The number of iterations for eachpoint is up to 7 × . drops significantly to save = 57 .
1% ancillas. For the[5 , ,
5] code, the fidelity drop at p = 0 .
01 is less than0 . = 20% of the ancillas are saved. (cid:50) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230) (cid:230)(cid:230)(cid:230)(cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224) (cid:224)(cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236) (cid:236)(cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) (cid:242) p F c (cid:72) (cid:69) (cid:76) (cid:242) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:236) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:224) (cid:64)(cid:64) (cid:68)(cid:68) (cid:43) (cid:64) (cid:68) (cid:230) (cid:64)(cid:64) (cid:68)(cid:68) FIG. 6. (Color online.) The average channel fidelity of Steanecode with ancilla saving by the [3 , , , , , ,
5] codeat physical error rate p . The number of iterations for eachpoint is up to 7 × . When the ancilla consumption rate is fixed, we can in-crease the frequency of quantum error correction with theancilla saving protocol, which is equivalent to loweringthe error rate on the data qubits. Let us define the effec-tive error rate as the (accumulated) physical error ratebetween two error correction steps. Here the effective er-ror rate of an [[ n, physical error rate . If the physical error rate is p , then the effective error rate of an [[ n, m, m − r ] an-cilla saving protocol is rp/m , assuming that quantum er-ror correction is sufficiently fast. Let F p o and F p comb be thechannel fidelities of the original and the [[ n, m, m − r ]protocols at effective error rate p , respectively. Appar-ently we have F = F = 1 and F p o > F p comb for p >
0. Thus by the continuity of fidelity, there exists p ∗ F p ∗ o = F rp ∗ /m comb . Here we define the effectivechannel fidelity of an [[ n, m, m − r ] protocol as theaverage channel fidelity of the protocol at effective errorrate rp/m . Hence for physical error rate p < p ∗ the effec-tive channel fidelity of the [[ n, m, m − r ] protocol ishigher. Let us consider the above example again. Fig. 6plots these channel fidelities. As can be seen, applyingthe ancilla saving protocol with the [5 , ,
5] code is betterthan the original scheme for p < . V. DISCUSSION
A straightforward approach to achieving FTQC is toimplement logical gates transversally, but no quantumstabilizer code can have a universal gate set of quan-tum computation that can be transversally implemented[39, 40]. As a consequence, universality is usually accom-plished by the assistance of certain ancillas, prepared bymagic state distillation [21]. A large literature is devotedto reducing the overhead of magic state distillation [41–46], since it may dominate the overall resources neededfor FTQC [47].The current work is motivated by a different approachto fault-tolerance: the use of a set of CSS codes to storeand process quantum information. By teleporting logicalqubits between code blocks that admit different sets oftransversal gates, it is possible to perform a universal setof logical gates [48]. We have illustrated distillation withthe simple example of the Steane [[7 , , X operators or only Z operators.This limitation means that it is not possible to distillcompletely general stabilizer states (or even general CSSstabilizer states) by the methods presented here, thoughgeneralizations of this scheme may make that possible.However, the protocols presented in this paper can distillall the logical ancillas needed for the teleportation-basedFTQC scheme of [48].Given the ability to prepare a set of suitable CSS sta-bilizer states, only transversal circuits and single-qubitPauli measurements are needed for FTQC. In particular,magic states are not needed. (Other schemes withoutmagic state distillation have also been proposed, such as[46, 49–52].) The results of this paper show that in prin-ciple this approach to FTQC is possible. However, theoverhead for distillation dominates in this scheme, andwe need to further analyze and quantify both the cost ofdistilling ancillas for various codes, and the performanceof distillation in the presence of errors in the distillationcircuit. Our distillation protocol is a combination of the Steanesyndrome extraction method and classical coding so thatstabilizer states can be fault-tolerantly prepared. How-ever, more work is needed to show that the overall schemeis both fault-tolerant and efficient enough to be useful atrealistic error rates. In particular, noise in the distillationcircuit will have two important effects. First, residual er-rors will be left in the ancilla by the noisy distillationcircuit. Second, errors may degrade the performance sothat ancilla errors from the encoding circuit may not befully corrected. This first source of error will increase theeffective error rate in the computation; but because thedistillation circuit is transversal, these errors should beindependent across the qubits of a single ancilla. How-ever, the second type of error would be more serious: cor-related errors across an ancilla can dramatically shortenthe lifetime of the quantum codes used in the computa-tion. Thus, careful modeling and numerical simulationsare needed to assess and optimize the performance of dis-tillation in the presence of noise.Some methods may be used to greatly mitigate thesepotential pitfalls. In the distillation protocol by clas-sical coding, error syndromes of the target ancillas areencoded by the coupling CNOTs and then recovered. Ifthe transversal circuits for distillation are imperfect, themeasured parity-check syndromes ν H TZ are not reliable,which compromises the efficiency of distillation. How-ever, this can be handled by learning more parities ofthe stabilizer generators as suggested by the method in[53–55]. In particular, we can choose another classicalcode C to encode the parity checks of H Z by appendingmore redundant rows to the parity-check matrix. By cal-culating these additional parity checks, we can use anydecoder of C to purify the decoding outputs of C D andobtain more reliable error syndromes about the targetancillas. To further improve the reliability of distillation,we can also use a final postselection. By filtering outthose noisy blocks with distinct syndromes, residual er-rors of higher weight can be further reduced at only asmall cost in yield for the protocol.We have begun to study these methods, and havefound some preliminary results. A simulation of noisydistillation of the [[23 , , , ,
3] repetition code, followed by the [23 , ,
7] Go-lay code with postselection, suggests an overall yield of10% by our protocol at a physical error rate of about10 − ∼ − . Technical details and performance analy-ses for some candidate classical codes and quantum codeswill be addressed in a forthcoming paper [56].In [12], an ancilla verification method is proposed forthe quantum Golay code. This method can be regardedas a special case of our protocol, but our distillation pro-tocol is potentially more efficient. In the verificationscheme, pairs of blocks are compared to check errors.If any errors are detected in either block, everything isdiscarded and the process starts over again. By contrast,the results of each verification (parity checks) are kepttrack of in our protocol, and we can take advantage of1their correlations by classical decoding. Since good clas-sical codes with high rate and efficient decoders exist, weexpect our distillation protocol to have higher through-put.In the simulations in this paper, we used a minimumdistance decoder of the classical code for distillation.However, the error rate of each syndrome bit of an an-cilla may depend on the Clifford circuit that generatesthese faulty ancillas. We may be able to analyze thisdependence and employ other techniques to improve thedecoding performance. This is another future researchdirection.Our distillation protocols are similar to magic statedistillation, but there is an important distinction: be-cause these ancillas are stabilizer states, they can bemade using only Clifford gates, and (in principle) canbe fault-tolerantly verified. This would suggest betterperformance here than in magic state distillation, whereone cannot improve the quality of the encoded state bymeasuring it directly. At the very least, we should beable to do better in this respect: with magic state distil-lation, there is a probability of failure at each iterationstep, where you have to discard everything; here, if wedetect an error in the logical operators, we can correctthem. Also, only certain codes with special propertiescan be used for magic state distillation; while a broadrange of classical error-correcting codes can be appliedin our scheme.In this paper, we also have shown how to recover ac-curate error syndromes in Steane syndrome extractionusing fewer ancillas, at the cost of higher classical decod-ing complexity and some additional CNOTs, while sacri-ficing a little channel fidelity. Since classical computingpower is much cheaper, in general, than expensive quan-tum resources, it makes sense to exploit classical comput-ing to save quantum resources. The layout of additionaltransversal CNOTs depends on the chosen classical codeand their cost may or may not be comparable to the com-plexity saved by preparing fewer ancillas. However, theoverall error-correcting power can be increased when theancilla consumption rate is fixed. This protocol sharesthe same structure as ancilla distillation, and should givea net benefit at least in the regime of low error rates.To do quantum error correction, we can also usethe Shor syndrome extraction [3, 34]. (Knill syndromeextraction [58] is essentially equivalent to the Steanemethod up to qubit relocations.) For codes with low-weight stabilizer generators, Shor syndrome extractionmay be preferred since it needs only low-weight ancillas—the cat states ( | (cid:105) ⊗ w + | (cid:105) ⊗ w ) / √ , , H D = (cid:0) (cid:1) , where an ancilla is discarded if the measurement out-comes are nonzero. However, we can use a general clas-sical error-correcting code to do error recovery in thedistillation process, and hence the efficiency can be bet-ter. Distillation protocol I could be adapted to a hash-ing protocol for multipartite entanglement purificationas in [24–26]; however, we omit further discussion forthe present, since the main topic of this paper is aboutfault-tolerant quantum computation. Also, the protocolin [28] is very similar to our distillation protocol II. Sincethey did not consider the problem in the fault-tolerantscenario, the eigenvalues of the stabilizers are measureddirectly in their protocol. By contrast, we use a transver-sal decoding circuit and bitwise qubit measurements torecover the eigenvalues of the stabilizers in our protocol. ACKNOWLEDGMENTS
We thank Ben Reichardt for useful discussions. Wealso thank Scott Glancy for helpful comments. Thiswork was supported in part by the IARPA QCS program;by HRL subcontract No. 1144-400707-DS; and by NSFGrant No. CCF-1421078. This work was also partiallyfunded by the Singapore Ministry of Education (Tier-1funding), through Yale-NUS Internal Grant IG14-LR001.T.A.B. also acknowledges funding as an IBM EinsteinFellow at the Institute for Advanced Study.
Appendix A: Justification of the Encoding for CSSCodes
The encoding procedure mentioned in Subsec. III Bcan be justified as follows. The unitary encoding operatorcan be implemented by applying a certain quantum cir-cuit, consisting of CNOTs, Hadmard gates, phase gatesand SWAP gates. (For example, Wilde gave an encodingalgorithm [57] to find such a circuit.)The check matrix of an [[ m, m − r − s ]] CSS code canbe written in the following form (see, e.g., [8]): H = [ H X | H Z ] = (cid:18) I r A B
D I s F (cid:19) , where I r and I s are the r × r and s × s identity matrices,respectively, and A , B , D , and F are r × s , r × ( m − r − s ), s × r , and s × ( m − r − s ) binary matrices, respectively.2( r = s in our case.) Our goal is to apply a sequence ofCNOT gates that transform H into (cid:18) I r I s (cid:19) . Then the reverse of this sequence of CNOTs is our en-coding circuit.This process is like applying Gaussian elimination on H . We first apply a series of CNOTs from the matrices I r to clear the matrices A and B . These CNOTs havecontrol qubits on qubit number 1 to r and target qubitson qubit number r + 1 to m , respectively. Thus, only the matrix D of H Z is altered by these CNOTs. We have H (cid:48) = (cid:18) I r D (cid:48) I s F (cid:19) . Since H (cid:48) has to satisfy the commutation relations, D (cid:48) must be 0. Thus we have H (cid:48) = (cid:18) I r I s F (cid:19) . Then we apply CNOTs to clear F . These CNOTs havecontrol qubits on qubits number ( r + s +1) to m and targetqubits on qubits number ( r + 1) to ( r + s ), respectively. H X is not affected by these CNOTs and we have H (cid:48)(cid:48) = (cid:18) I r I s (cid:19) as required. [1] D. Gottesman, Phys. Rev. A , 127 (1998).[2] D. Aharonov and M. Ben-Or, in Proceedings of thetwenty-ninth annual ACM symposium on Theory of com-puting , STOC ’97 (ACM, New York, NY, USA, 1997) pp.176–188.[3] D. P. DiVincenzo and P. W. Shor, Phys. Rev. Lett. ,3260 (1996).[4] F. Gaitan, Quantum error correction and fault tolerantquantum computing (CRC Press, Boca Raton, FL, 2008).[5] D. A. Lidar and T. A. Brun, eds.,
Quantum Error Cor-rection (Cambridge University Press, 2013).[6] A. R. Calderbank and P. W. Shor, Phys. Rev. A , 1098(1996).[7] A. M. Steane, Phys. Rev. Lett. , 793 (1996).[8] M. A. Nielsen and I. L. Chuang, Quantum Computationand Quantum Information (Cambridge University Press,Cambridge, UK, 2000).[9] P. Aliferis, D. Gottesman, and J. Preskill, Quant. Inf.Comp. , 97 (2006).[10] E. Knill, Nature , 39 (2005).[11] P. Aliferis and A. W. Cross, Phys. Rev. Lett. , 220502(2007).[12] A. Paetznick and B. W. Reichardt, Quant. Inf. Comp. , 1034 (2012).[13] K. M. Svore, D. P. Divincenzo, and B. M. Terhal, Quant.Inf. Comp. , 297 (2007).[14] F. M. Spedalieri and V. P. Roychowdhury, Quant. Inf.Comp. , 666 (2009).[15] C.-Y. Lai, G. Paz, M. Suchara, and T. Brun, Quant. Inf.Comp. , 807 (2014).[16] A. G. Fowler, A. M. Stephens, and P. Groszkowski, Phys.Rev. A , 052312 (2009).[17] A. M. Steane, (2002) arXiv:quant-ph/0202036.[18] H. Goto, Scientific Reports , 19578 (2016).[19] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, andW. K. Wootters, Phys. Rev. A , 3824 (1996).[20] C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher,J. A. Smolin, and W. K. Wootters, Phys. Rev. Lett. , 722 (1996).[21] S. Bravyi and A. Kitaev, Phys. Rev. A , 022316 (2005).[22] A. M. Steane, Phys. Rev. Lett. , 2252 (1997).[23] W. D¨ur, H. Aschauer, and H.-J. Briegel, Phys. Rev. Lett. , 107903 (2003).[24] H. Aschauer, W. D¨ur, and H.-J. Briegel, Phys. Rev. A , 012319 (2005).[25] K. Chen and H.-K. Lo, Quant. Inf. Comp. , 689 (2007).[26] E. Hostens, J. Dehaene, and B. De Moor, Phys. Rev. A , 042316 (2006).[27] C. Kruszynska, A. Miyake, H. J. Briegel, and W. D¨ur,Phys. Rev. A , 052316 (2006).[28] S. Glancy, E. Knill, and H. M. Vasconcelos, Phys. Rev.A , 032319 (2006).[29] F. J. MacWilliams and N. J. A. Sloane, The Theoryof Error-Correcting Codes (North-Holland, Amsterdam,The Netherlands, 1977).[30] M. Grassl, “Mathematics of quantum computation,”(Chapman and Hall/CRC, 2002) Chap. Algorithmic as-pects of quantum error-correcting codes.[31] A. C´orcoles, E. Magesan, S. J. Srinivasan, A. W. Cross,M. Steffen, J. M. Gambetta, and J. M. Chow, Naturecommunications (2015).[32] A. M. Steane, Proc. R. Soc. London A , 2551 (1996).[33] A. M. Steane, Nature , 124 (1999).[34] P. W. Shor, in Proceedings of the 37th Annual Symposiumon the Theory of Computer Science (IEEE Press, LosAlamitos, 1996) pp. 56–65.[35] C.-Y. Lai and C.-C. Lu, IEEE Trans. Inf. Theory ,7163 (2011).[36] B. Schumacher, Phys. Rev. A , 2614 (1996).[37] M. Reimpell and R. F. Werner, Phys. Rev. Lett. ,080501 (2005).[38] C.-Y. Lai and T. A. Brun, Phys. Rev. A , 032319(2012).[39] B. Eastin and E. Knill, Phys. Rev. Lett. , 110502(2009). [40] B. Zeng, A. Cross, and I. Chuang, IEEE Trans. Inf.Theory , 6272 (2011).[41] S. Bravyi and J. Haah, Phys. Rev. A , 052329 (2012).[42] B. Eastin, Phys. Rev. A , 032321 (2013).[43] C. Jones, Phys. Rev. A , 022328 (2013).[44] C. Jones, Phys. Rev. A , 042305 (2013).[45] C. Jones, Phys. Rev. A , 052334 (2013).[46] A. Paetznick and B. W. Reichardt, Phys. Rev. Lett. ,090505 (2013).[47] A. G. Fowler, M. Mariantoni, J. M. Martinis, and A. N.Cleland, Phys. Rev. A , 032324 (2012).[48] T. A. Brun, Y.-C. Zheng, K.-C. Hsu, J. Job, and C.-Y.Lai, (2015)arXiv:1504.03913.[49] T. Jochym-O’Connor and R. Laflamme, Phys. Rev. Lett. , 010505 (2014).[50] J. T. Anderson, G. Duclos-Cianci, and D. Poulin, Phys. Rev. Lett. , 080501 (2014).[51] S. Bravyi, and A. Cross, (2015) arXiv:1509.03239.[52] T. Jochym-O’Connor and S. D. Bartlett, Phys. Rev. A , 022323 (2016).[53] A. Ashikhmin, C.-Y. Lai, and T. A. Brun, in Proc. IEEEInt. Symp. Inf. Theory (2014) pp. 546–550.[54] A. Ashikhmin, C.-Y. Lai, and T. A. Brun, in