Noise-tolerant parity learning with one quantum bit
aa r X i v : . [ qu a n t - ph ] M a r Noise-tolerant parity learning with one quantum bit
Daniel K. Park, ∗ June-Koo K. Rhee, and Soonchil Lee Natural Science Research Institute, Korea Advanced Institute of Science and Technology, Daejeon 34141, Republic of Korea School of Electrical Engineering, Korea Advanced Institute of Science and Technology, Daejeon 34141, Republic of Korea Department of Physics, Korea Advanced Institute of Science and Technology, Daejeon 34141, Republic of Korea
Demonstrating quantum advantage with less powerful but more realistic devices is of great im-portance in modern quantum information science. Recently, a significant quantum speedup wasachieved in the problem of learning a hidden parity function with noise. However, if all data qubitsat the query output are completely depolarized, the algorithm fails. In this work, we present a quan-tum parity learning algorithm that exhibits quantum advantage as long as one qubit is providedwith nonzero polarization in each query. In this scenario, the quantum parity learning naturallybecomes deterministic quantum computation with one qubit. Then the hidden parity function canbe revealed by performing a set of operations that can be interpreted as measuring nonlocal observ-ables on the auxiliary result qubit having nonzero polarization and each data qubit. We also discussthe source of the quantum advantage in our algorithm from the resource-theoretic point of view.
I. INTRODUCTION
Experimental realizations of quantum information pro-cessing (QIP) have made impressive progress in the pastyears [1–4]. Nonetheless, a scalable architecture capableof universal and reliable quantum computation is stillfar from within reach. While the development of suchquantum computers is pursued, identifying well-definedcomputational tasks for which less powerful and less chal-lenging devices (for example, subuniversal, without quan-tum error correction, etc.) can still outperform classicalcounterparts is of fundamental importance.One interesting family of problems for which near-termquantum devices can exhibit considerable advantages ismachine learning. In particular, the quantum speedup isdemonstrated in the problem of learning a hidden par-ity function defined by the unknown binary string in thepresence of noise (LPN). The LPN problem is thoughtto be computationally intractable classically [5–8], andhence cryptographic applications have been suggestedbased on this problem [9, 10]. In the quantum setting,all possible input binary strings are encoded in the data qubits for parallel processing, and the outcome of thefunction is encoded in the auxiliary result qubit. Thenthe quantum learner with the ability to coherently rotateall qubits before the readout can solve the LPN problemin logarithmic time [11]. However, the number of re-quired queries diverges as the noise (depolarizing) rateincreases, and the learning becomes impossible if the fi-nal state of the data qubits is maximally mixed [11, 12].This result intuitively makes sense since measuring themaximally mixed state outputs completely random bits.Hence the parity function can only be guessed with suc-cess probability decreasing exponentially with the size ofthe problem in both classical and quantum settings.In this work, we present a protocol with which thehidden bit string of the parity function can be learned ∗ [email protected] efficiently even if all data qubits are completely depolar-ized, provided that the result qubit has nonzero polariza-tion. Under the aforementioned conditions, the learningalgorithm can naturally become deterministic quantumcomputation with one quantum bit (DQC1) [13]. Thenthe expectation value measurement on the result qubitallows for efficient evaluation of the normalized trace ofthe unitary gate that represents the hidden parity func-tion. However, this unitary operator is traceless as longas at least one element of the hidden bit string is 1, andtherefore the naive application of the DQC1 protocoldoes not help. Thus, we modify the original quantumLPN algorithm by adding a set of operations that canbe understood as performing nonlocal measurements be-tween each data qubit and the result qubit. With thischange, the normalized trace is nonzero if the hidden bitencoded in the data qubit is 0, and zero if it is 1. There-fore, the parity function can be learned using the numberof queries that grows only linearly with the length of thehidden bit string. This counterintuitive result shows thatthe robustness of the quantum parity learning against de-coherence is retained via the power of one quantum bit.The quantum advantage is achieved without any entan-glement between the data qubits and the result qubit bi-partition. This brings up an interesting question: Whatis the quantum resource that empowers the learning pro-tocol? We conjecture that the inherent ability of theDQC1 model to discriminate the coherence consumption,which results in producing nonclassical correlation, lies atthe center of our learning algorithm.The remainder of the paper is organized as follows.Section II briefly reviews the LPN problem and theDQC1 protocol, topics that have been studied exten-sively by numerous authors. In Sec. III A we describethe equivalence of the quantum parity learning circuitand the DQC1 circuit when the data output is in themaximally mixed state. The DQC1 algorithm for solv-ing the LPN problem is presented in Sec. III B, includingthe discussion on the computation efficiency. The effectof errors at various locations in the DQC1 LPN protocolis discussed in Sec. III C. Section IV discusses the originof the quantum advantage in our learning algorithm, andSec. V concludes. II. PRELIMINARIESA. LPN
Here we briefly summarize the work presented inRef. [11]. In the parity learning problem, an oracle gen-erates a uniformly random input x ∈ { , } n and com-putes a Boolean function f s defined by a hidden bit string s ∈ { , } n , f s ( x ) = n X j =1 s j x j mod 2 , (1)where s j ( x j ) is the j th bit of s ( x ). A query to the oraclereturns ( x, f s ( x )), and a learner tries to reconstruct s byrepeating the query. In the presence of noise, the learnerobtains f s ( x ) ⊕ e , where e ∈ { , } has the Bernoullidistribution with parameter p , i.e., Pr[ e = 1] = p/ ,
1l + ǫσ =1 D … H | (cid:127) | (cid:127) | (cid:127) | (cid:127) { | (cid:127) resultdata HHH HHHHH … FIG. 1. The quantum circuit for the parity learning algorithmin Ref. [11]. Hadamard operations ( H ) prepare the equal su-perposition of all possible input states. The hidden parityfunction (gray box) is realized using controlled-not gates be-tween the result (target) and data (control) qubits. The hid-den bit string s = 011 . . . LPN was realized experimentally with superconductingqubits in Ref. [12].On the other hand, in terms of the noise strength,the query complexity of the quantum algorithm is O (poly(1 / (1 − p ))) [11]. The experimental results inRef. [12] also show that the number of queries divergesas p → s . In fact, inthe learning algorithm discussed thus far, for each com-pletely depolarized data qubit, the probability of finding s exactly is reduced by 1 /
2. Repeating the query doesnot improve the success probability since the outcome isuniformly random every time. Equivalently, the fully de-polarizing noise acting on the data output can be trans-lated to the state preparation error. In this case, withoutany additional noise, the final entangled state at the endof a query is 1 √ | i r | x i d ± | i r | x ⊕ s i d ) , (3)where the relative phase factor − x or x ⊕ s . However, since x is randomly sampled ineach query, the learning is not possible. Classically, thecomplete depolarization of the data qubits at the outputcorresponds to complete ignorance of the input bit string x . Therefore, under such a noise model, classical andquantum learners can only guess s out of 2 n possibilities. B. DQC1
DQC1 is a subuniversal quantum computation modelto which one probe qubit with nonzero polarization α , n bits in a maximally mixed state, an arbitrary unitarytransformation, and the expectation measurement of thePauli operator σ i ( i ∈ { x, y, z } ) on the probe qubit areavailable [13]. Though weaker than standard universalquantum computers, it still offers efficient solutions tosome problems that are classically intractable [13–15]. Inparticular, DQC1 can be employed to efficiently estimatethe normalized trace of an n -qubit unitary operator, U n ,provided that U n can be implemented with O (poly( n ))elementary quantum gates. In the trace evaluation pro-tocol, a Hadamard gate on the probe qubit is followed bythe controlled unitary ( | ih | ⊗ n + | ih | ⊗ U n ), where1l n is the 2 n × n identity matrix. These operations trans-form the input state ρ i = (1l + ασ z ) ⊗ n / n +1 to ρ f = 12 n +1 (cid:0) n +1 + α (cid:0) | ih | ⊗ U † n + | ih | ⊗ U n (cid:1)(cid:1) . (4)The traceless part that deviates from the identity is calledthe deviation density matrix, and only this part returnsnonzero expectation values in DQC1. Measuring the ex-pectation of σ x or σ y on the probe qubit ends the proto-col, and h σ x i = α n Re (tr ( U n )) , h σ y i = α n Im (tr ( U n )) . (5)Repeating the protocol O (log (1 /δ ) / ( αǫ ) ) times allowsfor estimating the expectation values to within ǫ with theprobability of error δ [16]. III. PARITY LEARNING WITH FULLYDEPOLARIZING NOISEA. From LPN to DQC1
The LPN algorithm fails if the noise completely ran-domizes the output. However, if the result qubit is alivewith some polarization, then can anything about theoverall evolution be inferred from measuring the resultqubit alone? This situation resembles the DQC1 model inwhich the probe qubit carries the information about thetrace of the unitary operator applied to the completelymixed state. Indeed, using H | ih | H ⊗
1l + H | ih | H ⊗ σ x = 1l ⊗ H | ih | H + σ x ⊗ H | ih | H , the quantum circuitfor the parity learning (Fig. 1) with completely depolar-izing noise on the data qubits can be converted to theDQC1 circuit as depicted in Fig. 2. Without loss of gen-erality, the data qubits are supplied in the completelymixed state as input. The result qubit can be initializedwith some error, but it should possess nonzero polariza-tion. Since measuring the fully depolarized data qubitsis redundant, only the result qubit is measured. Then bymeasuring the expectations of σ x and σ y , the normalizedtrace of the unitary matrix that implements the hiddenparity function can be evaluated. The depolarizing noiseat the result qubit ouput scales the expectation values bya factor of (1 − p ): h σ x i + i h σ y i = (1 − p ) α n tr ( U s ) , (6) … H (cid:127) σ x,y D p { n n
1l + ασ z … FIG. 2. The DQC1 circuit that implements the original quan-tum parity learning algorithm with fully depolarized dataqubits. The gray box represents the hidden function definedby s = 011 . . . α . The expectation mea-surement replaces the projective measurement, and it returnsthe normalized trace of the unitary matrix that correspondsto the hidden parity function. The result qubit also experi-ences depolarizing noise ( D p ) prior to the measurement as inthe original algorithm. The trace is zero for all s except whenit is uniformly 0. where U s is the unitary implementation of the hiddenparity function acting on the data qubits. This is easy toverify using the Kraus representation of the depolarizingchannel D p = { p − p/ , p p/ σ x , p p/ σ y , p p/ σ z } and the cyclic property of the trace. Hence as long as p <
1, the normalized trace can be estimated with highaccuracy using ∼ / (1 − p ) repetitions. Equation 6shows that some information about the hidden functioncan be contained in the coherent basis of the result qubit.Yet the trace of the hidden unitary matrix does not pro-vide any useful knowledge about s since the trace is zerofor all s except when s is uniformly 0.In the following, we present a strategy for finding s using the trace estimation. B. Solving LPN using DQC1
The quantum learner with an access to the DQC1 LPNcircuit (Fig. 2) has the ability to implement additionalquantum gates after the unknown unitary operation. Ifa rotation R x ( θ ) = exp( iθσ x /
2) controlled by the resultqubit is applied equally to all data qubits after the hiddenparity function, the trace of the total unitary operatorbecomestr (cid:0) R ⊗ nx ( θ ) U s (cid:1) = 2 n ( i sin ( θ/ m (cos ( θ/ n − m , (7)where m is the number of CNOT operators implementedin the hidden parity function, i.e., the number of onesin s . Now, if the rotation on one of the data qubits isundone by another controlled-rotation R j † x ( θ ), then thenormalized trace of the total unitary operator becomestr (cid:16) R ¯ jx ( θ ) U s (cid:17) / n = ( ( i sin ( θ/ m (cos ( θ/ n − m − if s j = 0 , s j = 1 . (8)Here R ¯ jx ( θ ) represents a coherent rotation uniformly ap-plied to all n qubits except the j th qubit, i.e., R ¯ jx ( θ ) = R j † x ( θ ) R ⊗ nx ( θ )= exp (cid:16) − iθσ ( j ) x / (cid:17) n Y k =1 exp (cid:16) iθσ ( k ) x / (cid:17) , (9)and the superscript ( j ) indicates that the Pauli operatoris acting on the j th data qubit while the identity operatoracts on the rest. We use σ ( r ) i to represent the result qubitfor clarity when needed. For θ = aπ, a ∈ Z , the DQC1protocol can resolve whether the hidden bit encoded inthe j th data qubit is 0 or 1; the trace estimation returnsa nonzero value if s j = 0, and 0 if s j = 1. The quantumcircuit for finding the value of s j is shown in Fig. 3. … H (cid:127) σ x,y D p R ¯ jx ( θ ) { n n
1l + ασ z … FIG. 3. The modified DQC1 circuit for solving the LPN prob-lem. The gray box represents the hidden function defined by s = 011 . . . j th qubit ( R ¯ jx ( θ )). For some θ , the traceof the total unitary operator is 0 (nonzero) if the hidden bitencoded in the j th data qubit is 1 (0). The deviation density matrix at the end of the protocolcan be written as˜ ρ f = α n +1 (cid:0) | ih | ⊗ V † R jx ( θ ) + | ih | ⊗ R j † x ( θ ) V (cid:1) , (10)where V = R ⊗ nx ( θ ) U s . Then the expectation measure-ment on the result qubit can be expressed as h σ i i = tr (cid:18) σ ( r ) i α cos( θ/ n +1 (cid:0) | ih | ⊗ V † + | ih | ⊗ V (cid:1)(cid:19) +tr (cid:18) σ ( r ) i σ ( j ) x iα sin( θ/ n +1 (cid:0) | ih | ⊗ V † − | ih | ⊗ V (cid:1)(cid:19) . (11)Consequently, the measurement outcome can be inter-preted as the sum of two expectations determined from different deviation density matrices, and one of them(second line in Eq. (11)) corresponds to measuring thenonlocal observable on the result qubit and the j th dataqubit. This nonlocal contribution to the measurementextracts the information about the bit value hidden inthe j th qubit.To optimally distinguish the normalized traces (the dif-ference is denoted as ∆ τ j ) without knowing m , the rota-tion angle should be chosen as θ = π/ τ j = i m (1 / √ n − . Once s j isrevealed, the j th data qubit can be decoupled from theresult qubit by applying the inverse of the unitary oper-ator that encodes s j . Then in the subsequent run, thecontrolled rotation is applied only to the remaining dataqubits. This rotation can be expressed as˜ R jx ( θ ) = n Y k = j +1 exp (cid:16) iθσ ( k ) x / (cid:17) . (12)This extra procedure increases ∆ τ j by a factor of √ | ∆ τ j | = (1 / √ n − j , andcan reduce the computational overhead accordingly.With these results, the full learning algorithm can bestated as follows. • Given a DQC1 circuit with the hidden unitary op-erator controlled- U s , for j = 1 , . . . , n , do the fol-lowing.1. Apply the controlled-rotation ˜ R jx ( θ ) to dataqubits with the result qubit as the control.2. Measure h σ x i and h σ y i . Repeat until desiredaccuracy is reached.3. If h σ x i + h σ y i =0, record s j = 1. Otherwise,record s j = 0.4. If h σ x i + h σ y i =0, apply a bit-flip ( σ x ) gateto the j th data qubit controlled by the resultqubit. Otherwise, do nothing.5. Increment j and go to step 1.Until the first nonzero value is detected, both h σ x i and h σ y i must be measured because ∆ τ j can be either real orimaginary depending on m . However, once the nonzerotrace is found, only one of them needs to be measured insubsequent runs.The number of queries required for estimating s within ǫ with the probability of error δ is O (log(1 /δ ) / ( L ( αǫ (1 − p )) )), assuming an ensemble of L quantum systems (e.g.,spin-1/2 nuclei) encodes the result qubit. In order toidentify whether s j is 0 or 1 with high certainty, ǫ < | ∆ τ j | / | ∆ τ j | decreases exponentially in n − j . Thus, the learning maybe too expensive, especially when L ≪ n and for j ≪ n .However, for ensemble quantum computing models suchas those based on nuclear magnetic resonance, L ∼ .This means that for about n = log (10 ) ≈ L ≫ n and the learning algorithm is efficient. For the hiddenbit string beyond this length, the size of the ensembleshould increase exponentially to maintain the efficiencyin the number of queries. C. Error analysis
The depolarizing noise (or any Pauli errors) on the re-sult qubit anywhere during the protocol can be treatedas either the initialization error that reduces α or themeasurement error that increases p . Errors on thedata qubits before the realization of the hidden func-tion does not have any effect since all data qubitsare completely mixed, as long as the noise is unital.Also, errors on the data qubits after the controlled-˜ R jx ( θ ) are irrelevant since only the result qubit is de-tected. In contrast, for s j = 1, a phase-flip ( σ z ) er-ror that occurs on a data qubit between the CNOT andthe controlled- ˜ R jx ( θ ) can propagate to the result qubit.Then the propagated error can be treated as an errorin the state preparation or in the measurement. Be-cause of the properties 1l ⊗ σ z ( | ih | ⊗
1l + | ih | ⊗ σ x ) =( | ih | ⊗
1l + | ih | ⊗ σ x ) σ z ⊗ σ z and σ z H = Hσ x , twoquantum circuits shown in Fig. 4 are equivalent. Thisshows that a single phase-flip error ( Z in Fig. 4) thatoccurs on a data qubit results in two errors, a phase-flipand a bit-flip ( X in Fig. 4) on the input state of thedata and the result qubits, respectively. Now suppose FIG. 4. A phase-flip ( Z ) on the second qubit after a gatesequence constructed as a Hadamard followed by a CNOT isequivalent to a bit-flip ( X ) on the first qubit and a phase-flipon the second qubit before the gate sequence. that the phase-flip error corrupts two data qubits simul-taneously at this location. This sends two bit-flip errorsto the initial state of the result qubit which cancel eachother. Hence, the phase errors that occur simultaneouslyon an even number of data qubits cancel each other anddo not affect the result qubit. For an odd number ofphase errors, only one of them affects the result qubit.Therefore, the depolarizing noise occurring between thecontrolled- U s and the controlled- ˜ R jx ( θ ) independently onall data qubits with the error rate q results in a bit-fliperror with the error rate being ∼ q/ ∼ (1 − q ).Systematic errors in the controlled- ˜ R jx ( θ ) also affectthe result, but not severely. We already mentioned thatthe algorithm works for all θ = aπ, a ∈ Z , althoughideally θ should be π/ φ )ˆ x + sin( φ )ˆ x ⊥ , where ˆ x ⊥ is some axis orthogonal toˆ x . Then the normalized trace is multiplied by a factorof cos( φ ) m . In principle, the algorithm can distinguish s j as long as cos( φ ) = 0, but the optimal separation isattained when cos( φ ) = 1 as chosen in our algorithm. IV. QUANTUM DISCORD AND COHERENCECONSUMPTION
In the preceding, we showed that the learning is en-abled by the nonlocal nature of the measurement embed-ded in each query. This section further investigates thesource of the quantum advantage in our protocol fromthe resource-theoretic standpoint. According to the re-sults in Refs. [14, 17], the DQC1 circuit cannot gener-ate entanglement at the bipartition split as one resultqubit and n data qubits when α ≤ /
2. Hereinafter welimit our discussion to correlations that are generatedat this result-data bipartition. Clearly, entanglement isnot the source of the quantum supremacy in our algo-rithm. However, nonclassical correlation other than en-tanglement as measured by quantum discord can existfor α > U s = 1l for all s [21].However, discord is generated when the controlled rota-tion R ¯ jx ( θ ) is added. We calculate the amount of discordgenerated in our modified DQC1 circuit shown in Fig. 3for various hidden functions, and it is observed to be dif-ferent depending on s j . This feature coincides with thedependence of the trace of the total unitary operator on s j (see Eq. (8)), which plays the central role in our learn-ing algorithm. The discord is plotted as a function of α for some selection of the hidden bit strings in Fig. 5.As the length of s increases, the difference of the dis-cords for s j = 1 and s j = 0 becomes smaller, similarto the behavior of ∆ τ j . Moreover, the difference of thediscords decreases with α , consistent with the scaling ofthe number of queries required in terms of α for a fixedaccuracy. The inset shows the difference of the discordsfor s j = 1 and s j = 0 as a function of the controlled-rotation angle θ when s = 10 and α = 1 /
4. The discordcontrast with respect to θ resembles ∆ τ j in that it is thelargest when θ is an odd-integer multiple of π/ π as the discord is zeroregardless of s j at these points. Above studies suggestthat the presence of nonzero discord and the discord con-trast in different DQC1 circuits are crucial for our learn-ing algorithm. Nonetheless, claiming quantum discord asthe necessary resource for the DQC1-based binary clas- D i sc o r d s j =1s=101, s j =0s=0110, s j =0s=01001, s j =0 D i sc o r d s=10, =1/4 FIG. 5. Quantum discord at the end of the DQC1 circuitshown in Fig. 3 as a function of α for various s . In this regime,there is no entanglement in the result-data bipartition. Theamount of discord depends on the hidden bit value encodedin the j th data qubit, which is excluded from the uniformrotation prior to the measurement (see Eq. (9)). For all s ,the discord is the same when s j = 1 (solid line). The insetshows the difference of the discord for s j = 1 and s j = 0 as afunction of the controlled-rotation angle θ when s = 10 and α = 1 / sification in general is problematic since one can comeup with two unitary matrices with different normalizedtraces that do not produce discord when implemented inthe DQC1 circuit.Alternatively, quantum coherence can be regarded asa resource, and it has been rigorously studied within theframework of quantum resource theory recently [22–24].Evidently, the probe qubit must contain some amountof coherence as the minimal requirement for the DQC1protocol [25]. The connection between coherence and dis-cord in DQC1 is established in Ref. [26]: the discord pro-duced is upper-bounded by the coherence consumed bythe probe qubit. Using the relative entropy of coherenceas the quantifier [22], the coherence consumption ∆ C ineach execution of our DQC1 protocol can be expressedas ∆ C = H (cid:18) − α | τ j | (cid:19) − H (cid:18) − α (cid:19) , (13)where H ( · ) is the binary Shannon entropy and τ j is thenormalized trace of the total unitary operator acting onthe data qubits controlled by the result qubit. This ismonotonically decreasing with respect to | τ j | for a fixednonzero α . Thus it appears that the DQC1 protocol isinherently capable of quantifying the consumption of thecoherent resource supplied by one quantum bit. Further-more, the magnitude of the partial derivative of ∆ C withrespect to | τ j | ( α ) monotonically increases with the in-dependent variable, meaning that ∆ C is more sensitiveto the changes in | τ j | ( α ) when the independent vari-able is large. This feature is consistent with the com- putational complexity of our algorithm. By all means,the notion of the coherence consumption is purely quan-tum mechanical. Our algorithm is set up in a way thatthe coherent resource used up in each query varies withthe answer s j being probed. An interesting open ques-tion is whether manipulating the coherence consumptionprovides a quantum advantage in solving problems otherthan those based on the trace estimation. V. CONCLUSION
By measuring only one quantum bit with nonzero po-larization in each query, an n -bit hidden parity functioncan be identified. This situation arises when data qubitsundergo the completely depolarizing channel in the orig-inal quantum LPN algorithm in Ref. [11]. The protocolintroduced here can solve the problem efficiently when n ∼ log ( L ). Classically, the corresponding task canonly be accomplished via brute-force enumeration in anexponentially large search space, provided that an effi-cient means to verify the answer exists. The one-qubitLPN algorithm is inspired by the DQC1 model. How-ever, the naive translation of the original LPN algorithmto a DQC1 circuit does not solve the problem since thetrace of the unitary matrix that encodes the hidden par-ity function is zero in 2 n − coherence consumption contrast is es-sential for the quantum advantage in our algorithm.While efforts towards building standard quantum com-puters that fulfill what the theory of QIP promises con-tinue, exploring weaker but more realistic quantum de-vices to solve interesting but classically hard problemsis imperative. The LPN problem is one such problemin which the noisy quantum machine can shine. Forthe LPN problem, the ability to manipulate and mea-sure the coherence consumed by one quantum bit sufficesto demonstrate the quantum supremacy. This also mo-tivates future studies on whether similar strategies canbe utilized in the near-term quantum devices to performother well-defined computational tasks beyond classicalcapabilities and how much, if any, improvement can beachieved by utilizing coherence from more than one qubit. ACKNOWLEDGMENTS
We thank Sumin Lim for helpful discussions. This re-search was supported by the National Research Founda-tion of Korea (Grants No. 2015R1A2A2A01006251 andNo. 2016R1A5A1008184). [1] D. Nigg, M. M¨uller, E. A. Martinez, P. Schindler,M. Hennrich, T. Monz, M. A. Martin-Delgado, andR. Blatt, Science , 302 (2014).[2] T. H. Taminiau, J. Cramer, T. van der Sar, V. V.Dobrovitski, and R. Hanson, Nat. Nanotechnol. , 171(2014).[3] J. Kelly, R. Barends, A. G. Fowler, A. Megrant, E. Jef-frey, T. C. White, D. Sank, J. Y. Mutus, B. Campbell,Y. Chen, Z. Chen, B. Chiaro, A. Dunsworth, I. C. Hoi,C. Neill, P. J. J. O’Malley, C. Quintana, P. Roushan,A. Vainsencher, J. Wenner, A. N. Cleland, and J. M.Martinis, Nature (London) , 66 (2015).[4] D. Lu, K. Li, J. Li, H. Katiyar, A. J. Park, G. Feng,T. Xin, H. Li, G. Long, A. Brodutch, J. Baugh, B. Zeng,and R. Laflamme, npj Quantum Info. , 45 (2017).[5] D. Angluin and P. Laird, Mach. Learn. , 343 (1988).[6] A. Blum, A. Kalai, and H. Wasserman, J. Assoc. Com-put. Mach. , 506 (2003).[7] V. Lyubashevsky, “The Parity Problem in the Presenceof Noise, Decoding Random Linear Codes, and the Sub-set Sum Problem,” in Approximation, Randomizationand Combinatorial Optimization: Algorithms and Tech-niques , Lecture Notes in Computer Science, Vol. 3624(Springer, Berlin, 2005), pp. 378–389.[8] ´E. Levieil and P.-A. Fouque, “An Improved LPN Al-gorithm”, in
Security and Cryptography for Networks:SCN 2006 , Lecture Notes in Computer Science, Vol. 4116(Springer, Berlin, 2006), pp. 348–359.[9] O. Regev, in
Proceedings of the Thirty-Seventh AnnualACM Symposium on Theory of Computing, STOC’05 (ACM, New York, 2005), pp. 84–93.[10] K. Pietrzak, “Cryptography from Learning Parity withNoise,” in
Theory and Practice of Computer Science,SOFSEM 2012 , Vol. 7147 (Springer, Berlin, 2012), pp. 99–114.[11] A. W. Cross, G. Smith, and J. A. Smolin, Phys. Rev. A , 012327 (2015).[12] D. Rist`e, M. P. da Silva, C. A. Ryan, A. W. Cross, A. D.C´orcoles, J. A. Smolin, J. M. Gambetta, J. M. Chow,and B. R. Johnson, npj Quantum Info. , 16 (2017).[13] E. Knill and R. Laflamme, Phys. Rev. Lett. , 5672(1998).[14] A. Datta, S. T. Flammia, and C. M. Caves, Phys. Rev.A , 042316 (2005).[15] P. W. Shor and S. P. Jordan, Quantum Info. Comput. ,681 (2008).[16] P. J. Huber, Robust Statistics (Wiley, New York, 1981).[17] M. Boyer, A. Brodutch, and T. Mor, Phys. Rev. A ,022330 (2017).[18] A. Datta, A. Shaji, and C. M. Caves, Phys. Rev. Lett. , 050502 (2008).[19] L. Henderson and V. Vedral, J. Phys. A: Math. Gen. ,6899 (2001).[20] H. Ollivier and W. H. Zurek, Phys. Rev. Lett. , 017901(2001).[21] B. Daki´c, V. Vedral, and ˇC. Brukner, Phys. Rev. Lett. , 190502 (2010).[22] T. Baumgratz, M. Cramer, and M. B. Plenio, Phys. Rev.Lett. , 140401 (2014).[23] A. Winter and D. Yang, Phys. Rev. Lett. , 120404(2016).[24] A. Streltsov, G. Adesso, and M. B. Plenio, Rev. Mod.Phys. , 041003 (2017).[25] J. M. Matera, D. Egloff, N. Killoran, and M. B. Plenio,Quantum Science and Technology , 01LT01 (2016).[26] J. Ma, B. Yadin, D. Girolami, V. Vedral, and M. Gu,Phys. Rev. Lett.116