Nonadaptive fault-tolerant verification of quantum supremacy with noise
NNonadaptive fault-tolerant verification of quantum supremacy with noise
Theodoros Kapourniotis ∗ and Animesh Datta † Department of Physics, University of Warwick, Coventry CV4 7AL, United Kingdom (Dated: February 28, 2019)Quantum samplers are believed capable of sampling efficiently from distributions that are clas-sically hard to sample from. We consider a sampler inspired by the classical Ising model. It isnonadaptive and therefore experimentally amenable. Under a plausible conjecture, classical sam-pling upto additive errors from this model is known to be hard. We present a trap-based verificationscheme for quantum supremacy that only requires the verifier to prepare single-qubit states. Theverification is done on the same model as the original sampler, a square lattice, with only a constantoverhead. We next revamp our verification scheme in two distinct ways using fault tolerance thatpreserves the nonadaptivity. The first has a lower overhead based on error correction with the samethreshold as universal quantum computation. The second has a higher overhead but an improvedthreshold (1.97%) based on error detection. We show that classically sampling upto additive errorsis likely hard in both these schemes. Our results are applicable to other sampling problems suchas the Instantaneous Quantum Polynomial-time (IQP) computation model. They should also assistnear-term attempts at experimentally demonstrating quantum supremacy and guide long-term ones.
I. INTRODUCTION
Considerable experimental efforts are being directed to-wards the realisation of quantum information processingtechnologies, with the eventual aim of constructing uni-versal quantum computers and simulators [1–4]. One ofthe motivations for this exercise is their expected abil-ity to simulate physical systems that are believed to beintractable classically [5, 6]. An example of such a sys-tem is a lattice of interacting spins in the presence of amagnetic field, represented by the classical Ising model[7]. The Ising model is a workhorse in condensed mat-ter physics, employed to study magnetic properties ofspin glasses [8] and spin liquids [9] as well as phase tran-sitions in many-body systems such as lattice gases [10],and numerous other problems. The partition function is aquantity central to most of these studies.
Computing thepartition function (and ground state) of the Ising modelin an external magnetic field is, however, NP-hard evenin two dimensions [11], and approximating it up to mul-tiplicative errors is sampling up to multi-plicative [14–17] and additive [18–23] errors from certaindistributions hold the possibility of demonstrating ‘quan-tum supremacy’ [24] in devices that do not require thefull complement of DiVincenzo’s criteria [25] for their im-plementation. Their scalable implementation is thus an-ticipated to be more achievable than a universal quantumcomputer’s, providing tangible demonstrations of quan-tum supremacy sooner [17, 26–29]. This expectation ispurchased at the price of sacrificing the full power of uni-versal quantum computers, promising only to efficientlysample from certain distributions instead. Among them ∗ [email protected] † [email protected] is a non-universal quantum simulator based on a non-adaptive translationally-invariant Ising model that allowssampling from the distribution of classical Ising modelpartition functions [20]. It shows, in line with other mod-els [13, 15–17, 19], that under a plausible conjecture, ahighly unexpected collapse of the polynomial hierarchyto the third level occurs if a classical sampler can sam-ple the partition function distribution upto additive er-rors. Unlike these models, however, the hardness resultsof the Ising sampler [20] hold for a single fixed instanceof the problem, relieving the burden of creating randominstances.We tackle two crucial challenges facing any experimentaldemonstration of quantum supremacy for the Ising sam-pler. The first is verifying that the output distribution isindeed from the correct quantum sampler, as opposed toa classical sampler emulating a similar distribution [30].The second is ensuring that the sampling task remainsclassically hard to simulate even in the presence of exper-imental noise and decoherence [30]. A deeper question iswhether it is possible to demonstrate and verify quan-tum supremacy fault-tolerantly in a manner that is lessdemanding than universal quantum computation.In this paper, we answer the above question in the af-firmative by amalgamating trap-based quantum verifica-tion techniques [31] with recent results on demonstrat-ing quantum supremacy by emulating fault tolerance viapost-selection [29]. To answer the first challenge above,we present a nonadaptive verification scheme with expo-nentially low probability of failure and only linear com-plexity for the Ising sampler (prover). Our scheme ap-plies to any untrusted prover with entangling and mea-suring capabilities, limited only by the laws of quantummechanics, and requires the verifier to prepare random,single-qubit states with bounded local noise. We firstpresent a verification scheme that should aid demonstrat-ing quantum supremacy with few qubits (Theorem 1).We then prove fault-tolerant versions (Theorem 2), oneof which uses the idea of emulated fault tolerance by post- a r X i v : . [ qu a n t - ph ] F e b selection [29]. This ‘free’ post-selection enables us to pro-vide a fault-tolerant verification scheme with improvedthresholds over universal quantum computing thresholds.An important property of our verification is that it itselfis within the instantaneous model of quatum computingand therefore can be implemented in the same device asthe Ising sampler with small modifications.We go beyond Ref. [31] in three ways, namely (i) pro-viding a new definition of verifiability over many i.i.d.repetitions of the protocol, based on the total variationdistance between the output distribution and the correctone; (ii) using the Raussendorf-Harrington-Goyal (RHG)strategy for fault tolerance instead of using it for prob-ability amplification; and (iii) developing a simpler con-struction for verification and computation on separateplanar graphs.To answer the second challenge above, we show quantumsupremacy in the presence of noise with emulated fault-tolerance. We go beyond Ref. [29] by (i) solving one ofits open problems – proving quantum supremacy of im-proved threshold fault-tolerant model up to additive er-rors (Theorem 3) and (ii) verifying quantum supremacywhile maintaining its improved thresholds.Our verification schemes apply to any nonadaptive sam-pler based on cluster states, however we will use the Isingsampler [20] as a particular example, thus keeping thebenefit of the single instance property and experimen-tal feasibility of this model. Our work is a significantimprovement over the verification method of Ref. [20] ontwo counts. Firstly, our schemes require a linear overheadin the number of qubits as opposed to a quadratic one inRef [20]. Secondly, our schemes (fault-tolerant ones) scalein the face of constant local noise while that of Ref [20]requires local noise polynomially small in the total num-ber of qubits.Our work is structured as follows. Section II defines veri-fiability based on the total variation distance of the out-put distribution. Section III provides an overview of theIsing sampler placed in an a cryptographic setting of aprover and a verifier. Section IV contains the first of ourmain results on the verification of the Ising sampler’s out-put. We present a non-fault-tolerant verification scheme(Theorem 1). Since it requires decreasing noise in prepa-ration, entanglement and measurement with increasingsystem size, this is only viable in small-sized experimen-tal demonstrations of quantum supremacy. In Section Vwe present two fault-tolerant versions of the verificationscheme (Theorem 2) which are scalable when noise isbelow certain thresholds. Section VI provides a result(Theorem 3) on the quantum supremacy of the outputdistribution of the noisy Ising sampler conditioned onsyndrome measurements accepting, which is a generali-sation of Ref. [29] for additive errors. II. VERIFIABILITY
We begin with our definition of a verification proto-col.
Definition 1 (Verification protocol) . A verification pro-tocol involves two parties - a trusted verifier and an un-trusted prover who share a quantum and classical chan-nel. The protocol takes as input a description of a compu-tation and outputs a string and a bit. The bit determinesif the string is accepted or rejected.
Establishing verifiability of a protocol consists of provingcompleteness and soundness. A protocol is complete if,for an honest prover, the verifier outputs the correct re-sult and accepts. A protocol is sound if, for any deviationof the prover, the probability that the verifier outputs anincorrect result and accepts is low. This deviation cap-tures both a malevolent prover who tries to cheat anduncontrollable errors in the prover’s device.Note that the above notion of verifiability relies on anoutput string being correct while sampling relies on dis-tributions being close. We are therefore interested in thetotal variation distance between the experimental outputdistribution and the exact one [31]. We are furthermoreinterested in arguing for quantum supremacy based onthe total variation distance between distributions. Thisrequires us to go from a joint distribution of a string and abit to a probability distribution over strings conditionedon a bit. To meet these demands we introduce the idea ofa verification scheme, that uses a protocol as a black boxand can call it repeatedly. We also assume that the rep-etitions of the protocols are independent and identicallydistributed (i.i.d.). However, there is no assumption onthe behaviour of the system within the protocol, whichmeans that an adversarial prover can cheat by correlatingsystems within the protocol.
Definition 2 (Verification scheme) . A verificationscheme takes as input a verification protocol, M ∈ N , l ∈ [0 , and outputs a string and a bit. The bit determinesif the string is accepted or rejected.A verification scheme works as follows. After running M i.i.d repetitions of a verification protocol it outputs oneof the M output strings at random and accepts if at leasta fraction l of the protocols accept and rejects otherwise. Let q nsy ( x ) be the experimental and q exc ( x ) be the ex-act distribution of the output x of a sampler. We areinterested in the quantityvar ≡ (cid:88) x | q exc ( x ) − q nsy ( x ) | , (1)where the sum is over all binary strings x of size N .The following definition captures the notions of complete-ness and soundness at the level of a scheme for samplingproblems. Definition 3 (Verifiability of a scheme) . A scheme isverifiable if its output is • ( δ (cid:48) , δ ) − complete: For an honest prover having onlybounded noise, the scheme accepts at least withprobability δ (cid:48) , and var ≤ − δ (2) for the output string. • ( ε (cid:48) , ε ) − sound: For any, including adversarial,prover if the scheme accepts then var ≤ ε (3) with confidence ε (cid:48) . We then consider the verifiability of a scheme for asampler which has a designated output register wecall the post-selection register. We consider probabilities q nsy ( x | y = 0), where y is the value of the post-selectionregister, for the experimental and q exc ( x | y = 0) for theexact distribution of a sampler, conditioned on y beingzero. We are interested in the quantityvar Post ≡ (cid:88) x | q exc ( x | y = 0) − q nsy ( x | y = 0) | . (4)Again, the sums are over all binary strings x of size N .We adapt our definition to conditional probabilities asfollows. Definition 4 (Verifiability of a scheme for post-selecteddistribution) . A scheme is verifiable conditioned on thepost-selection register being zero, if its output is • ( δ (cid:48) , δ ) − complete: For an honest prover having onlybounded noise, the scheme accepts at least withprobability δ (cid:48) , and var Post ≤ − δ (5) for the the output string. • ( ε (cid:48) , ε ) − sound: For any, including adversarial,prover if the scheme accepts, then var Post ≤ ε (6) with confidence ε (cid:48) . III. QUANTUM SAMPLING IN THEVERIFIER-PROVER SETTING
In the verifier-prover setting, the verifier can preparebounded-error, single-qubit states and the prover imple-ments the rest of the computation including the mea-surements, and returns the output samples to the veri-fier. The role of the verifier is to ascertain if the prover isacting honestly and executing the correct operation. Theprover is, in general, malicious, trying to pass any testsdesigned by the verifier while deviating from the correctimplementation at the same time. This malice may be in-tentional if the prover is trying to convince the verifier ofits quantum power when it has none, or incidental if theprover possesses an imperfect quantum device prone to noise and errors. We assume that the prover’s deviationsare governed by quantum mechanics.We begin by adapting the Ising spin model to ablind verifier-prover cryptographic setting [32]. Blind-ness, which ensures that the prover remains ignorantof the actual computation, is a necessary ingredient inour verification scheme. Our Ising spin model consistsof qubits in state | + (cid:105) subject to nearest neighbour con-trolled π -phase rotations, denoted by cZ . All the qubitsare measured simultaneously in a basis in the xy -planeof the Bloch sphere. The measurement outcome of classi-cal bits is the output sample. This model corresponds tothe well-studied measurement-based quantum comput-ing (MBQC) model [33] without the adaptive measure-ments. This last restriction, which relaxes DiVincenzo’scriteria of long decoherence times, makes this model non-universal for quantum computing.In the particular Ising sampler presented in [20] the struc-ture of the graph state is fixed (Fig. (1)), but its sizescales with the width m and depth n. The measure-ment angles are also fixed to specific values from the set {− π/ , − π/ , , π/ , π/ } . This choice of graph, whichwe call the ‘extended’ brickwork state, and a fixed anglefor each physical qubit has the following benefit: Eachpossible combination of measurement outcomes ‘chooses’a different angle for each qubit of the original brickworkstate from the set { kπ/ } , k = { , . . . , } . This effectivelymakes a single instance of the model a random quantumcircuit generator, a property exploited to prove its hard-ness.The correspondence to an Ising model comes from the lo-cality of spin interactions and decomposing each MBQCmeasurement into a unitary rotation around the z -axiscorresponding to an external magnetic field, followed bya Pauli X measurement. The quantum state just beforethe Pauli X measurement is given by the unitary evolu-tion due to the Hamiltonian H = − (cid:88) (cid:104) i,j (cid:105) JZ i Z j + (cid:88) i B i Z i (7)where J is the interaction term, B i the local field strengthand Z i the Pauli Z operator on qubit i .The probability q exc ( x ) of measuring a bit string x cor-responds to the partition function Z x of the Ising modelwith Hamiltonian H (cid:48) ≡ H + π (cid:80) i x i Z i and is givenby q exc ( x ) = | Tr( e − i ( H + π (cid:80) i x i Z i ) ) | N ≡ |Z x | N , (8)where N = mn . The second term in H (cid:48) comes from themeasurement outcomes of the Pauli X measurements,and the partition function is evaluated at an imaginarytemperature β = 1 /k B T = i . Although the partitionfunction at imaginary temperatures may appear unphys-ical, it has deep connections to quantum complexity the-ory [12] as well as quantum statistical and condensedmatter physics via analytic continuations.Testing the honesty of the prover, in our case the Isingsampler, requires the ‘blind’ injection of certain ‘trap’qubits. To keep the identity of these trap qubits from theprover, the verifier applies some encoding on the orig-inal translationally-invariant Ising spin model, makingthe model translationally variant. Now both the partici-pating qubits and the measurement angles on the graphstate have a randomly chosen extra rotation according tothe scheme described next.Specifically, each qubit i is individually prepared by theverifier in the state | + θ i (cid:105) , where θ i is chosen uniformlyat random from the set A = { , π , π , . . . , π } . Insteadof the prover measuring in fixed predetermined angles,as in the original Ising sampler, the verifier sends en-crypted angles to the prover: δ i = θ i + ( − r (cid:48) i φ i + r i π for r i , r (cid:48) i ∈ R { , } , where ∈ R stands for a uniform randomselection. Rotations by θ i on the qubit and on the anglesmutually cancel and the classical information that theprover receives (containing the actual measurement an-gles φ i ) is classically one time padded by θ i . The bits r i , r (cid:48) i provide some extra randomness to restrict the informa-tion the prover gets from the quantum state and can becorrected by classical post-processing of the sample. Ourdifference from Ref. [32] lies in the number of angles usedin the set A , and comes from the fact that we use a dif-ferent decomposition of the computation. We conjecturethat this can be improved upon (See Sec. VII). IV. NON-FAULT-TOLERANT VERIFICATIONOF ISING SAMPLER
The output of a quantum sampler must be classical for itto be comparable to that of a classical sampler, a prereq-uisite for demonstrating quantum supremacy. This allowsus to simplify trap-based verification strategies for uni-versal quantum computation [31, 34, 35] to having dis-jointed computational resource and trap states - an ideaalso used in Ref. [35] and in circuit-based verification [36].This permits an exponentially small error in our estima-tion of the fidelity of the output using a square lattice.Finally, a trap-based technique instead of fidelity-witnessbased certification ones [20, 37], similar also to [38, 39],enables us to reduce the resource complexity of the veri-fication protocol from quadratic to linear.Our verification protocol relies on judiciously selectingthe measurement angles and placing dummy qubits pre-pared in the state | (cid:105) , which, together with xy -plane mea-surements, allows us to carve different types of graphsfrom a square lattice graph, as shown in Fig. (3). Plac-ing one dummy qubit between any two other qubits pre-vents the prover’s entangling operators to have any en-tangling effect between the participating qubits, so theprover can apply exactly the same operations that pro-duce the square lattice but create a different graph state.The graphs carved out are the ‘extended’ brickwork state(Fig. 1) and two other graphs containing special ‘trap’qubits in the state | + (cid:105) . The extended brickwork state ( i ) == π/ − π/ π/ − π/ ( ii ) FIG. 1: The original brickwork state ( i ) is a universalresource for MBQC under xy -plane measurements,where white vertices represent qubits and the edgesrepresent cZ operations. The ‘extended’ brickwork state( ii ) is used in the original Ising sampler [20], where eachwhite vertex is replaced by 7 physical qubits (blackvertices). The measurement angle for each qubit is fixedto the value written above each vertex. There is noadaptation of the angles based on previousmeasurement outcomes as in universal MBQC.is used to run the Ising sampler. The traps in the trapgraphs are measured in the same basis as prepared, yield-ing a deterministic check on the prover. Two differenttypes of the trap graphs are needed to enable placing atrap at any position in the graph with equal probabil-ity. The order of the graphs is chosen at random andthe whole protocol implemented blindly to thwart theprover from distinguishing trap and target computationqubits.A sketch of our Protocol 1 appears in Fig. (2), andthe details in Sec. IV A. The protocol has constant timecomplexity of the quantum operations and needs O ( N )qubits, where N is the number of the qubits of the Isingsampler.Noise considered in all our protocols for an honest proveris local, unital and bounded. It applies after every el-ementary operation (preparation, entangling and mea-surement) j and is expressed as a CPTP superopera-tor: N j = (1 − (cid:15) ) I + E j (9)where ||E j || (cid:5) = (cid:15) V for the noise of the verifier (prepara-tion noise) and ||E j || (cid:5) = (cid:15) P for the noise of the honestprover (entangling and measurement noise). Theorem 1 (Non-fault tolerance verification scheme) . There exists a verification scheme with Protocol 1, M =log(1 /β ) / (2 κ N ( (cid:15) V + (cid:15) P ) ) , l = (1 − κN (2 (cid:15) V + 4 (cid:15) P )) that according to Def. (3) is (cid:16) − β, − (cid:112) N ( (cid:15) V + 3 (cid:15) P ) (cid:17) − complete
1. Verifier selects a random ordering of2 κ + 1 graphs, one for target computa-tion and κ from each type of trap graphs.2. Verifier prepares, one by one, the qubits neededfor the blind implementation of the 2 κ + 1cluster states and sends them to the prover.3. Verifier sends the encrypted mea-surement angles to the prover.4. Prover entangles all receivedqubits in the 2 κ + 1 cluster states.5. Prover measures all qubits simultaneously inthe instructed angles and returns the results.6. Verifier decrypts the outputs and accepts ifall trap results are correct, otherwise rejects. FIG. 2: Nonadaptive verification protocol and (cid:16) − β, (cid:112) κN (3 (cid:15) V + 5 (cid:15) P ) + ∆ κ (cid:17) − sound, where ∆ κ = κ !( κ + 1)! / (2 κ + 1)! . In the above, (cid:15) V and (cid:15) P are fixed by the experimentalcapability, while completeness and soundness parametersare set by the conjectures invoked to argue for quantumsupremacy, as obtained in Eqn. (16).A proof sketch appears in Section IV C and a full proofin Appendix B.Using our verifiable quantum sampler to demonstratequantum supremacy is underwritten by results whichshow that approximating the Ising sampler upto constanttotal variation distance is hard classically, subject to anaverage case hardness and an anti-concentration conjec-ture, presented in Section VI, similarly to the originalmodel [20]. N (cid:15) V and N (cid:15) P must be constant for the to-tal variation distances to be constant in Theorem 1, re-quiring the local errors (cid:15) V and (cid:15) P decrease linearly withthe number of qubits. This is only realistic in quantumsupremacy experiments involving a few qubits.To overcome this restriction, we consider fault-tolerantversions of our verification protocol in Section V. A. Protocol
The following is a full description of the non-fault tolerantverification protocol:
Protocol 1:
1. Verifier selects a random ordering of 2 κ + 1 graphs,one for computation and 2 κ for testing, as in Fig. (3).This fixes the position of computational basis qubitscalled the dummy qubits (see Appendix A) and the ( i )( ii )( iii ) FIG. 3: Verifier chooses a random ordering of 2 κ + 1graph states - the computational graph on the right offigure ( i ); κ identical trap graphs on the right of figure( ii ) which have traps (starred nodes) on the even paritypositions of the sub-graph that corresponds to thecomputational graph; and κ identical graphs on theright of figure ( iii ) which have traps on the odd paritypositions of the sub-graph that corresponds to thecomputational graph. All of these graphs can begenerated from a square lattice (on the left) byreplacing | + (cid:105) qubits with | (cid:105) at the positions (isolateddot nodes) we do not want entangled with theirneighbours when cZ is applied. Further detail on thecarving procedure, which can be made blind (SectionIII), is provided in Appendix A.measurement angles { φ i } Ni =1 , where N = m × n is thetotal number of qubits, so that(a) in the target computation graph we carve fromthe square lattice a universal resource state, the ‘ex-tended’ brickwork state of Figure (1) and fix the rest ofthe measurement angles according to the Ising samplermodel;(b) in the trap computation graphs the dummy qubitsare used to isolate the traps, which are placed at fixedpositions. For half of the graphs in positions with oddparity that correspond to non-dummy qubits in thecomputational graph and in the other half in positionswith even parity that correspond to non-dummies inthe computational graph. The traps are measured withangles φ = 0 so that the measurement is deterministic.Crucially, the trap graphs do not contain any ‘bridge’operations so there is no need for adaptive corrections.2. Verifier prepares the qubits that compose the clusterstate one by one and sends them to the prover.(a) The dummy qubits are prepared in {| d i (cid:105) : d i ∈ R { , }} . (b) The rest of the qubits are prepared in Z d k ∼ j | + θ j (cid:105) = √ ( | (cid:105) + e i ( θ j + d k ∼ j π ) | (cid:105) ), where θ j is chosen uniformly at random from the set A = { , π , π , . . . , π }} and d k ∼ j is the parity of the d ’s ofall neighbours of j . Notice that the set A is differentfrom the original trap-based protocol of Ref. [31].3. Verifier sends the encrypted computational measure-ment angles to the prover: δ i = θ i + ( − r (cid:48) i φ i + r i π for r i , r (cid:48) i ∈ R { , } . Parameters r i , r (cid:48) i create a classicalone-time pad on measurement outputs.4. Prover entangles all received qubits according to the2 κ + 1 cluster states, each of dimension n × m , byapplying cZ gates for every edge of each cluster.5. Prover measures all qubits simultaneously in angles δ i and returns the measurement results to the verifier.6. Verifier applies a bit flip to the output bit i when r i = 1and to its (non-dummy) neighbours when r (cid:48) i = 1 toundo the classical one time pad. The output stringof the measurements of the target computation is theoutput of the protocol. The verifier sets an extra bit toaccept if all the traps give the correct result (decodedmeasurement result 0).A variation of the protocol can have the prover to en-tangle all the graphs directly in the ‘extended brickworkstate’ instead of the square lattice state. This leaks noextra more information to the prover from what is pub-licly known. However, we seek a more generic prover andkeep the protocol as presented.The resource count of the protocol is as follows. The num-ber of qubits prepared by the verifier and sent to theprover one at a time is (2 κ + 1) N where N is the orig-inal size of the computation. The classical informationexchanged is linear in N and can be sent in one round.Similarly the classical outcomes of the measurements canbe sent in one go. The prover is required to entangle allneighbouring qubits in a square lattice and apply singlequbit measurements in the xy -plane. B. Proof of Completeness
To prove completeness we assume that the prover hon-estly follows the prescribed steps (up to bounded noise).Before considering the noisy case, we show that for thenoiseless prover, the fidelity of the target computationand the trap computation to the correct ones are bothunity.We begin with a circuit diagram of the operations onthe prover’s side in Fig. (4). Any measurement by angle { δ i } for the prover is mathematically decomposed into a z -rotation ( R z ) controlled by δ i and a Pauli X measure-ment. Without loss of generality, since everything beforethe measurements is unitary we can assume that even adishonest prover will apply the correct unitary operatorsand then chose his deviation U B on all systems, including U B | + θ (cid:105)| d i − (cid:105) Z d i +1 Z d i − | + θ i (cid:105)| d i +1 (cid:105)| + θ (2 κ +1) N (cid:105)| δ (cid:105)| δ (2 κ +1) N (cid:105)| (cid:105) ⊗| B | /// R z R z R z R z R z XXXXX
FIG. 4: The inputs, other than prover’s private system | (cid:105) ⊗| B | , are the qubits prepared by the verifier in steps1-3 of Protocol 1, for both target and trap rounds. Werepresent the prover’s operation (steps 4-6 in Protocol1) upon their receipt. Qubit at position i is a trap qubitsurrounded by dummy qubits at positions i − i + 1. U B is an arbitrary unitary deviation on theprover’s system. When prover is honest U B = I .his private qubits | (cid:105) ⊗| B | . Since we are proving complete-ness in this section, we assume U B = I . The measurementangles δ i received by the prover are represented as com-putational basis multi-qubit states | δ i (cid:105) .The circuit in Fig. (4) can be simplified in a number ofways, resulting in the circuit of Fig. (5). The cZ gatesbetween the dummy qubits and their neighbours cancelthe Pauli Z pre-rotation on the neighbours. Also, we canwrite explicitly the rotation angles on each of the con-trolled R z gates and remove the control lines.Further simplification follows when the z -rotations by θ i which are part of the R z gates and the z -rotationsby θ i applied by the verifier to the qubits before send-ing them to the prover mutually cancel after commutingwith the cZ gates. Notice that the dummy qubits arean exception since θ i rotations remain but have no ef-fect other than a global phase. Moreover, we can extractthe Pauli operators from the R z by applying identities: R z ( − χ ) = XR z ( χ ) X and R z ( χ + π ) = ZR z ( χ ). ThePauli X operators from the left hand side of R z can berewritten as Z rotations on their entangled neighbours. U B | + θ (cid:105)| d i − (cid:105)| + θ i (cid:105)| d i +1 (cid:105)| + θ N (cid:48) (cid:105)| δ (cid:105)| δ N (cid:48) (cid:105)| (cid:105) ⊗| B | /// R z ( θ + ( − r (cid:48) φ + r π ) R z ( θ i − + r i − π ) R z ( θ i + r i π ) R z ( θ i +1 + r i +1 π ) R z ( θ N (cid:48) + ( − r (cid:48) N (cid:48) φ N (cid:48) + r N (cid:48) π ) XXXXX FIG. 5: When applying the corresponding entanglingoperations in Fig. 4, dummy qubits at positions i − i + 1 have the effect of isolating their neighboursand cancelling the neighbours’ pre-rotations thatdepend on parameters d i − , d i +1 (here the onlyneighbour depicted is the trap qubit at position i ).Also, unitary rotations of Fig. 4 are written explicitly.Remember that for dummy and trap qubits angles φ take value 0. For clarity of the figure we have used N (cid:48) ≡ (2 κ + 1) N .This results in the circuit diagram depicted in Fig. (6).Notice that the remaining Pauli X operators do not haveany effect on the Pauli X measurements (we recall thatin this proof U B = I ) and the Pauli Z operators flip themeasurement results.Let us denote all the measurement outcomes of the pro-tocol except the dummy qubit measurements by the bi-nary vector x and p ( x ) the probability of obtaining it.Let q exc ( x ) denote the exact probability of obtaining x inan non-encrypted MBQC implementation using the samemeasurement pattern { φ } Ni as input. The only differencebetween the actual and the non-encrypted case are thePauli Z operators before the measurements, which flipthe outcomes. Therefore, by relabelling the probabilities p ( x ) to p ( x (cid:48) ), where x (cid:48) i = x i ⊕ r i ⊕ (cid:80) j r (cid:48) j ∼ i , we get q exc ( x ) = p ( x (cid:48) ). In other words, in the noiseless case,we can sample from the exact distribution by simply cor-recting the bit flips caused by the random Pauli Z , whichare known to the verifier. U B | + (cid:105)| (cid:105)| + (cid:105)| (cid:105)| + (cid:105)| δ (cid:105)| δ N (cid:48) (cid:105)| (cid:105) ⊗| B | /// R z ( φ ) X d i − X d i +1 R z ( φ N (cid:48) ) X r (cid:48) R z ( θ i − ) X r (cid:48) i R z ( θ i +1 ) X r (cid:48) N (cid:48) Z r + (cid:80) j ∼ r (cid:48) j Z r i − Z r i Z r i +1 Z r N (cid:48) + (cid:80) j ∼ N (cid:48) r (cid:48) j XXXXX
FIG. 6: Each z -rotation by θ in Fig. 5 undoes thecorresponding pre-rotations of the qubits (except for thedummies that have no pre-rotation by θ ). For any qubit k , operations in the form R z (( − r (cid:48) k φ k ) in Fig. 5 can bewritten as X r (cid:48) k R z ( φ k ) X r (cid:48) k and the X r (cid:48) k before (intemporal order) when commuting with theentanglement operators can be written as Z r (cid:48) k on theneighbours (this has an effect on qubits 1 and N (cid:48) in thisfigure). All Pauli operators here are written separatelyfrom z − rotations. Notice that we can write an extra X r (cid:48) i , with r (cid:48) i ∈ R { , } , applying on the trap qubit i since X | + (cid:105) = | + (cid:105) .In MBQC, we can also write the distribution in termsof unitaries, labelled by the measurement outcomes (theso-called branches of the MBQC computation) of all thelayers except the last. For dimension m × n, we have (upto global phases) q exc ( x ) = | (cid:104) x ( n − m +1 , . . . , x nm | U x ,...,x ( n − m | + , . . . , + m (cid:105) | ( n − m (10)since all the computational branches ( x , . . . , x ( n − m )are equiprobable and they define a unitary operation onthe input [40]. For the trap qubits this distribution is de-terministic since each qubit is prepared in the | + (cid:105) state,remains isolated throughout the computation and is mea-sured in the |±(cid:105) basis.Now, consider local bounded noise of the form of Eqn. (9)after every elementary operation j , including prepara-tion, entangling and measurement. The operations thatcan introduce noise in a single round of the protocol in-clude N preparations at the verifier’s end and at most2 N entanglements and N measurements at the prover’send. This is an upper bound of 4 N operations. The fi-delity F c of the noisy output of the target computationto the noiseless one (which is the correct one as we provedabove) cannot be smaller than 1 − ( N (cid:15) V + 3 N (cid:15) P ). Sincefor any two states ρ, σ , D ( ρ, σ ) ≤ (cid:112) − F ( ρ, σ ), this isan upper bound in total variation distance for the targetcomputation 1 − δ = (cid:112) N ( (cid:15) V + 3 (cid:15) P ).Completeness means that our scheme should accept withhigh probability in the case of bounded noise. The ac-ceptance of the scheme, according to Def. (2), dependson our estimate (cid:98) F t of the acceptance probability of theprotocol F t . Given the above bounded noise, F t cannotbe smaller than 1 − κN ( (cid:15) V + 3 (cid:15) P ).Our estimate for F t comes from M i.i.d. repetitions ofthe protocol. By Hoeffding’s inequality, repeating M =log(1 /β ) / (2 κ N ( (cid:15) V + (cid:15) P ) ) times gets us κN ( (cid:15) V + (cid:15) P )-close in our estimation with confidence 1 − β . In orderto have high probability of acceptance we need to set thelimit for accepting the estimate to (1 − κ (2 N (cid:15) V +4 N (cid:15) P )).Then our probability of accepting is as high as our con-fidence. Setting this limit is necessary to get high com-pleteness but will have an effect in the soundness. C. Proof of Soundness
The proof of soundness of Theorem 1 is based on the factthat the fraction of accepting protocols, (cid:98) F t , is a goodestimator of a lower bound in the fidelity F c of the tar-get computation. Thus, looking at (cid:98) F t gives us with highconfidence a lower bound on the fidelity, or similarly anupper bound on total variation distance var, as definedin Eq. (1).We outline the main arguments employed to prove thistheorem in stages here, and provide the explicit algebraicderivations in Appendix (B).Firstly, a unitary deviation U B applied before the mea-surements, depicted in Fig. (6), captures in all generalitythe prover’s dishonesty. To see this, consider the casewhen the prover performs measurements different fromthe honest ones. This corresponds to applying a unitarybasis rotation followed by Pauli X measurements. Then, U B applies also on the prover’s private subsystem so hecan use this power to replace the qubits he receives withany other qubits he chooses to prepare privately. In anycase, he has to report some classical measurement resultsso we always keep the final Pauli X measurements in thepicture. Our proof should therefore apply to any choiceof U B .Secondly, we bound the total variation distance of the output distribution via the trace distance D ( ρ c , ρ (cid:48) c ),where ρ c represents the state of the computational sys-tem just after the Pauli X measurements if the prover ishonest and ρ (cid:48) c the same state if the prover is dishonest.Thus, var ≤ D ( ρ c , ρ (cid:48) c ) ≤ (cid:112) − F ( ρ c , ρ (cid:48) c )= (cid:113) − Tr ( (cid:112) ρ c ρ (cid:48) c ) (11)The main idea leading to the statement of the theorem isthat the acceptance probability F t minus a lower boundon the fidelity of the computational system F ( ρ c , ρ (cid:48) c )is small, when averaged over the random parameters.Therefore, by estimating F t (by counting the fractionof acceptances over many repetitions of the protocol), weget a good estimate of a lower bound on the fidelity ofthe computational system and therefore an upper boundon var. We begin our analysis for the case of perfectpreparations and subsequently incorporate the effect ofnoise.Averaged over the random parameters, the probability ofgetting all trap outcomes 1, summing over the randomvariables r i , r (cid:48) i , d i and θ i , is calculated in Appendix Bas F t = (cid:88) t p ( t ) (cid:88) k | α k | (cid:89) i ∈ t | (cid:104) + | i P k | i | + (cid:105) i | , (12)where t is the vector of the indices of the positions of thetraps in all 2 κ trap systems and (cid:80) t takes all possiblevalues allowed by the construction with equal probability p ( t ). The summation over the random parameters resultsin the attack on the trap system to be transformed intoa convex combination of Pauli operators P k , each withprobability | α k | . By P k | i we represent the Pauli operatorthat applies on qubit i .The average fidelity F c of the computational systemis F c ≡ (cid:88) r , θ , t p ( r , θ , t ) F ( ρ c , ρ (cid:48) c ) = (cid:88) r , θ , t p ( r , θ , t )Tr( (cid:112) ρ c ρ (cid:48) c ) , where ρ c and ρ (cid:48) c represent the honest and dishonest stateof the target computation just after the Pauli X measure-ments. Calculation, presented in detail in Appendix B,leads to F c ≥ (cid:88) t p ( t ) (cid:88) k | α k | (cid:89) i ∈ c ( t ) | (cid:104) + | i P k | i | + (cid:105) i | (13)where c ( t ) denotes the positions of the qubits that par-ticipate in the computation and depends on the randomordering of the 2 κ + 1 rounds and therefore is a functionof the position of the traps.In general we prove that F t − F c ≤ κ !( κ + 1)!(2 κ + 1)! ≡ ∆ κ . (14)The verification scheme output bit is set to accept orreject by averaging over M repetitions of the protocoland comparing our estimate of F t with (1 − κN (2 (cid:15) V +4 (cid:15) P )) (set by completeness). By Hoeffiding’s inequalityrepeating M = log(1 /β ) / (2 κ N ( (cid:15) V + (cid:15) P ) ) times getsus κN ( (cid:15) V + (cid:15) P )-close in our estimation with confidence1 − β . Therefore, F t − F c ≤ κN (3 (cid:15) V + 5 (cid:15) P ) + ∆ κ . Thismeans that for the total variation distance we have anupper bound, which gives the soundness parameter ε ofDef. (3) var ≤ ε = (cid:112) κN (3 (cid:15) V + 5 (cid:15) P ) + ∆ κ . V. FAULT-TOLERANT VERIFICATION OFISING SAMPLER
Ensuring
N (cid:15) V and N (cid:15) P in Theorem 1 to be constant willget harder experimentally for increasing N . Therefore, wepresent two new fault-tolerant verification schemes wherethe total noise scales linearly with the size, and prove thatit provides a distribution that is hard to sample fromclassically upto constant additive error. We then provethat noise scaling with system size does not prevent usfrom verifying the provers distribution with completenessand soundness parameters independent of the problemsize.Quantum fault tolerance strategies such as due toRHG [41] can overcome the challenge of noise scalingwith system size. This involves gate distillation requir-ing adaptive operations which are beyond the Ising sam-pler. On the target computation, our fault tolerant ver-ification schemes overcome this adaptivity by using ar-guments for free postselection due to Fujii [29] as ap-plied to the verification of quantum supremacy. On thetrap computation, we do not require any adaptivity sincewe chose it to be Clifford. This keeps our fault toler-ant verification schemes within the Ising sampler, al-lowing verification of quantum supremacy in the pres-ence of total noise scaling linearly with the size. Notethat a non-Clifford trap computation would suffer dueto nonadaptivity. Time complexity of the quantum op-erations in the protocol is constant and the number ofqubits needed is O ( N PolyLog( N )) [41], the polylogarith-mic overhead coming from the properties of the topolog-ical code and the use of concatenation in the distillationprocedure.The next issue of fault-tolerant thresholds leads to twofault-tolerant versions of the protocol in Fig. (2) anddescribed in detail in Sections V A and V B. The firstis called Protocol 2a. It employs the full RHG encod-ing in the traps leading to the threshold of (cid:15) thres =0 .
75% [41], the same threshold as for universal quan-tum computation. This is worse than the suggested im-provements in the noise thresholds for unverified quan-tum supremacy [29]. However, our next protocol, Pro-tocol 2b, provides (cid:15) thres = 1 .
97% for verified quantumsupremacy, which is an underestimate since we ignorecorrelated errors. To achieve this threshold, Protocol 2b, replaces error cor-rection with error detection when performing the RHGencoding on the trap qubits. This is possible because thetrap qubits are isolated and can be retransmitted individ-ually without affecting the rest of the trap computation.The numerical value is obtained by performing a thresh-old calculation of applying the RHG encoding in MBQC(Appendix C). A similar procedure was performed in thecircuit model by Fujii [29]. The cost of maintaining thesame completeness and soundness as in Protocols 1 and2a is to replace κ in Fig. (2) by M κ, where M is an ex-tra overhead in the number of qubits depending on thecode minimal distance d between and around the defectsand the noise parameter (cid:15). For example, with d = 2 and (cid:15) as the following fractions of the noise threshold, wehave (cid:15) (cid:15) thres / (cid:15) thres / (cid:15) thres / M × M may also be possible with judiciousbraiding or using an alternative topological code.An additional intricacy needs resolving for both fault-tolerant protocols. Since blindness is an ingredient in ourverification scheme, its straightforward application (onthe logical level) risks leaking the logical measurementangles in the distillation procedure, where many copiesof the same magic state need to be sent. Also, for thedistillation procedure to be effective, we need to revealinformation about the state distilled. Our stratagem forcircumventing this is to apply blindness on the lowestlevel of MBQC, on which the fault-tolerant constructionis based. The traps are applied at the logical MBQC level,since those are the qubits needing protection from noise,as outlined in Fig. (7). Ising Sampler and Trap Computations MBQC(Logical layer)Protected topology using defectsBlind 3D cluster-state MBQC(Physical layer)
FIG. 7: Layered structure of verifiable FT computation.Our proof of the classical hardness of Ising sampling inthis case (Theorem 3) relies on proving the complete-ness and soundness of verifying conditional probabilities(Theorem 2). They are proved in Section V A.Noise is again of the form of Eqn. (9). Suppose the ver-ifier’s noise in each qubit preparation is local, boundedby (cid:15) V < (cid:15) thres , the threshold and does not depend on thesecret parameters. Assume the honest prover’s noise ineach elementary operation is bounded by (cid:15) P < (cid:15) thres . Inorder to prove Theorem 2 we make the extra assumption0that verifier’s noise is independent of the secret parame-ters.In the following theorem, (cid:15) (cid:48)(cid:48) is the error rate of the codeand scales down exponentially with distance parameter d .Let q nsy ( x | y = 0) be the experimental and q exc ( x | y = 0)the exact distribution of the Ising sampler, when theyare conditioned on the syndrome measurement outcome y giving the null result. The theorem holds for both Pro-tocol 2a and 2b. Theorem 2 (Fault-tolerant verification scheme) . Thereexists a verification scheme with Protocol 2a/2b, M =log(1 /β ) / (2 (cid:15) (cid:48)(cid:48) ) and l = (1 − (cid:15) (cid:48)(cid:48) ) , that according toDef. (4) is (1 − β, − √ (cid:15) (cid:48)(cid:48) ) − completeand (1 − β, (cid:112) (cid:15) (cid:48)(cid:48) + ∆ κ ) − soundwhere ∆ κ = κ !( κ + 1)! / (2 κ + 1)! . A. Protocol 2a
The fault-tolerant computation scheme used is theone proposed by RHG [41]. Single qubit prepara-tion/distillation, entangling gates ( cX ) and Pauli X mea-surements are topologically protected using the three di-mensional lattice shown in Fig. (8) and measurement-based implementation of the topological operations(more details on the MBQC implementation of the RHGcode see [42], [44]). Universality comes from topologicallyprotected concatenated distillation (Fig. (9)) of magicstates: | Y (cid:105) = 1 √ | (cid:105) + i | (cid:105) ) , | A (cid:105) = 1 √ | (cid:105) + e i π | (cid:105) )FIG. 8: 3D cluster state used in the RHG code usingMBQC. Blue dots are the qubits that represent theprimal cubic lattice edges (or equivalently the dualcubic lattice faces) and red dots are the qubits thatrepresent the primal cubic lattice faces (or equivalentlythe dual cubic lattice edges). Entangling operations( cZ ) are represented by blue lines. On the right handside you can see the primal and dual cubes, as areadapted from Refs. [41, 42]. | + (cid:105) • T X | + (cid:105) • T X | (cid:105) T X | + (cid:105) • T X | (cid:105) T X | (cid:105) T X | (cid:105) T X | + (cid:105) • T X | (cid:105) T X | (cid:105) T X | (cid:105) T X | (cid:105) T X | (cid:105) T X | (cid:105) T X | + (cid:105) • • T X | (cid:105) FIG. 9: Distillation step [43]. A logical | + (cid:105) is producedusing the (15 , ,
3) quantum Reed-Muller code. Then atransversal T gate applied using the technique of Figure(10), stabilizer measurements and teleportation to anauxiliary qubit gives a ‘cleaner’ magic state (up to Pauli Z correction on the teleported qubit) when the errorsyndromes are correct. Everything is topologicallyprotected. Picture adapted from Ref. [13].which are generated by single physical qubit measure-ments. Using the logical distilled magic states and thegate teleportation model one can implement a universalset of gates (Fig. 10). One can simulate an MBQC com-putation by using these gates and Pauli measurementsand consequently add a forth dimension to the system,which comes from the flow of the logical MBQC oper-ations (notice that this layer is distinct from the physi-cal MBQC layer on which the topological code is imple-mented). The exact usage of RHG encoding in our FTverification scheme depends on whether we use error cor-rection or error detection in our trap computation, givingtwo separate protocols.Our first fault-tolerant protocol follows the protocol forthe non-fault-tolerant verification of quantum supremacy,introduced in Sec. IV but using fault tolerance. Protocol 2a: Trapification:
Verifier selects a random ordering of2 κ + 1 sufficiently large 3D graphs of Fig. (8), one for1the target computation and 2 κ for the trap compu-tations. In the target computation round the logicalcomputation is the same as the one in the non-fault-tolerant protocol (see Fig. 1). In the trap computationrounds, the logical graph contains isolated traps in thesame configuration as in the non-fault-tolerant version(see Fig. 3). We call this the logical layer of our pro-tocol.2. Generation of the ‘topological code-compatible’circuit:
The above MBQC patterns contain |± φ (cid:105) mea-surements that are not compatible with the topo-logical code. We directly translate the MBQC pat-terns into a circuit with the same operations, withthe difference that the measurements are replacedby teleportation of distilled | + φ (cid:105) states followed byPauli X measurements. Since our rotations are mul-tiples of π/ | A (cid:105) magic states need be replaced by √ ( | (cid:105) + e i π | (cid:105) ) states, gate teleportation is as de-scribed before (Fig. 10) with a T gate instead of a S gate correction and distillation based on (31 , ,
3) in-stead of (15 , ,
3) quantum Reed-Muller code. Adap-tive T gates are not applied since we want to keep themodel instantaneous - this will be accounted for in oursupremacy proof. To avoid adaptivity in distillation wefix which magic states we keep for the next level of dis-tillation independently of the syndrome measurementsoutcomes - this is not a problem because we have ‘free’postselection on the syndrome measurements of thecomputation run.Even the |±(cid:105) measurements of the traps use inputsthat go through the distillation and teleportation pro-cedure (Fig. 10 (iii)). This is in order for the physicalattacks to have the same effect on the target and trapcomputation at the logical level (see proof of verifia-bility for more).3. Topological translation:
The topological transla-tion from the circuit to the topology is straightfor-ward [42].4.
Blind implementation of topology:
The topologi-cal code is implemented at the physical level by MBQCusing the 3D-graphs, so that we can implement themblindly using the following encryption.(a) Verifier prepares, one by one, the pre-rotatedphysical qubits | + θ (cid:105) , θ ∈ R { , π , π , . . . , π } ,needed for the blind implementation of the topo-logical protected computation on the three di-mensional cluster states and sends them to theprover. Blindness, induced by the random rota-tions, hides from the prover the physical opera-tions applied and therefore the logical structureof the computation in the topologically protected(vacuum) and isolated qubit region. In particu-lar, the prover is not able to distinguish betweenimplementing distillation and teleportation of amagic state or a | + (cid:105) state used for computationand testing respectively.(b) Verifier sends all the encrypted measurement an-gles δ i = θ i + ( − r (cid:48) i φ i + r i π for r i , r (cid:48) i ∈ R { , } . | ψ (cid:105) Z | Y (cid:105) • X Z S | ψ (cid:105) ( i ) | ψ (cid:105) Z | A (cid:105) • X S T | ψ (cid:105) ( ii ) | ψ (cid:105) Z | + (cid:105) • X I | ψ (cid:105) ( iii ) FIG. 10: ( i ) , ( ii ) Gate teleportation (up to global phase)using magic states | Y (cid:105) , | A (cid:105) , ( iii ) State teleportationusing auxiliary state | + (cid:105) that mimics gate teleportation(via blindess). These operations are applied in atopologically protected way, both during statedistillation using ‘impure’ states and to implement thecorresponding logical operations during computationusing distilled states.Parameters r i , r (cid:48) i are classical one-time pads forthe measurement outputs.(c) Prover runs the computation, by entangling, mea-suring all at once and returning the results.(d) Verifier classically corrects the returned outcomesusing the correction procedure of the quantumerror correcting code used in distillation and thetopological code and undoes the r, r (cid:48) pad.(e) Verifier accepts if all the results of the logical trapcomputations are correct, otherwise rejects.Completeness of the protocol follows the same analysisas in the non-fault-tolerant case. We can eliminate thepre-rotations by the θ ’s of the computation in the lowerlevel MBQC due to θ being in δ and, then, the com-putation is correct up to Pauli Z corrections before themeasurements. Local noise is taken care of by the errorcorrection if it is lower than the threshold of the RHGcode. This avoids scaling issues that we had in the nonfault-tolerant protocol. In particular because of fault tol-erance we get var ≤ √ (cid:15) (cid:48)(cid:48) . Completeness means that ourscheme should also accept with high probability and thisis achieved by setting the limit to accept the fidelity es-timate to (1 − (cid:15) (cid:48)(cid:48) ). By repeating N = log(1 /β ) / (2 (cid:15) (cid:48)(cid:48) )times gets us √ (cid:15) (cid:48)(cid:48) -close in our estimation with confidence1 − β . Thus, this is a lower bound on the probability ourscheme accepts in the case of completeness.The proof of soundness is similar to the non fault-tolerantcase since the noise can be considered part of the prover’s2 | + (cid:105) • X | + (cid:105) • • • X | + (cid:105) • X | + (cid:105) • X | + (cid:105) • • • X | + (cid:105) • X (a) | + (cid:105) • X | (cid:105) Z | + (cid:105) • X | (cid:105) Z | + (cid:105) • • • X | (cid:105) Z (b)(c)(d) FIG. 11: (a) ‘H’-shaped building component ofbrickwork state. (b) Same with cNOT gates where thecontrol is always | + (cid:105) and the target always | (cid:105) . (c)Translation into prime (blue)/dual (red) topologicallyprotected qubits. (d) Prime/dual colouring of thetopologically protected brickwork state.attack that has the same effect on the target computa-tion and the trap at a logical level. We show this in Ap-pendix D.The threshold of this protocol is the same as the thresholdof the RHG code since error correction is used in the traprounds. B. Protocol 2b
We now adapt Protocol 2a to work with error detectionand attain a better threshold. The main idea is that be-cause the traps are isolated qubits one can look at thesyndrome measurements of all trap computations andpick from each computation only the logical trap qubitmeasurements that are correct individually.The traps in this case test topologically protected qubitsof the graph state that implements the target compu-tation together with the distillation . This is because wewant to have smaller traps, in terms of number of phys-ical qubits, compared to Protocol 2a where a trap canbe as large as a magic state distillation circuit. This is crucial because by employing error detection and retrans-mission, one needs to resend one logical trap every timeat least one syndrome measurement in the topologicallyprotected region around the trap fails (we limit this over-head to M times).To avoid the trap computation being distinguishablefrom the target, we implement the traps as if all qubitshave an injected singular qubit, but the injected singularqubit is prepared in the | + (cid:105) state and therefore the logi-cal input remains the logical | + (cid:105) . The underlying MBQCblindness hides the qubit that is injected. Each trap com-putation is now performed M times. Protocol 2b: Generation of the ‘topological code-compatible’MBQC pattern:
Verifier selects a random orderingof 2 κM + 1 sufficiently large 3D graphs of Fig. (8),one for the target computation and 2 κM for the trapcomputations. For the target computation round: TheIsing sampler MBQC pattern of Fig. (1) is translatedinto a ‘topological code-compatible’ one, i.e. an MBQCpattern where qubits are prepared as | + kπ/ (cid:105) statesand always measured in the {|±(cid:105)} basis. This transla-tion is possible using again circuits similar to Fig. (10).Notice that this introduces some adaptive T gates thatwe cannot perform if we want to keep the model instan-taneous - this will be accounted for in our supremacyproof. Moreover, topological protection requires thedistillation of the magic states and this can also betranslated into an MBQC pattern. To avoid adaptiv-ity we fix which magic states we keep for the next levelof distillation independently of the syndrome measure-ments outcomes - this is not a problem because wehave ‘free’ postselection on the computation run. Thefinal MBQC pattern can be also standardised to theform of a brickwork state so that it can be trapifiedshown as in Fig. (3).2. Trapification:
The target computation is the MBQCpattern generated in the previous step. For the trapround, as shown in Fig. (3), we have two types oftrap computations by isolating qubits of the brick-work state. This is also ‘topological code-compatible’.Qubits are prepared in the | + (cid:105) or | (cid:105) state and aremeasured in the {|±(cid:105)} basis. Notice that in the traprounds there is no adaptivity. We call this the logicallayer of our protocol.3. Topological translation:
As shown in Fig. (11) onecan translate the ‘topological code-compatible’ MBQCpattern into a topology that conforms with the topo-logical code. To avoid leaking any information con-cerning when magic states or dummy qubits are in-jected, we inject a physical qubit at every logical qubit.Thus, we use the same topology to inject | + (cid:105) (whichis equivalent to not injecting anything in the topologyof Fig. (11)) or | (cid:105) or a magic state when needed.4. Blind implementation of topology:
In order to im-plement the above topology blindly, so that the proverdoes not know which physical states we inject, we3chose to implement it on MBQC and use the followingencryption.(a) Verifier prepares, one by one, the pre-rotatedphysical qubits | + θ (cid:105) , θ ∈ R { , π , π , . . . , π } (b) Verifier sends all the encrypted measurement an-gles δ i = θ i + ( − r (cid:48) i φ i + r i π for r i , r (cid:48) i ∈ R { , } .Parameters r i , r (cid:48) i are classical one-time pads forthe measurement outputs.(c) Prover runs the computation, by entangling, mea-suring all at once and returning the results. Allother topological corrections are implemented bythe verifier keeping track of the Pauli corrections.(d) Verifier classically detects the errors in the re-turned syndrome measurements after undoingthe r, r (cid:48) pad of the trap computations. From theset of the κM logical trap qubits corresponding toeach position in the trap graph it selects κ correctones. This is possible, on average, if M is largeenough as described at the end of Appendix C.This results in the quantity ∆ κ in Theorem 2 be-ing averaged over the noise distribution.(e) Verifier accepts the outcome of the target com-putation if all the results of the logical trap com-putations are correct, otherwise rejects.The proof of correctness and soundness are identical toProtocol 2a. VI. NOISY COMPUTATIONAL SUPREMACY
Assuming the following conjectures, the quantum com-putational supremacy theorem (Theorem 3) for the noisycase holds.
Conjecture 1 (Average-case hardness) . For ≤ α , β ≤ , approximating the probability distribution ofthe Ising sampler by p apx ( x | y = 0) up to multiplicativeerror | p apx ( x | y = 0) − q exc ( x | y = 0) | ≤ α q exc ( x | y = 0) in time poly ( | x | , /α , /β ) is P -hard for at least afraction β of x instances. Conjecture 2 (Anti-concentration) . There exist some ≤ α , β ≤ , /α ∈ poly(1 /β ) such that for all x prob (cid:16) q exc ( x | y = 0) ≥ α N (cid:17) ≥ β (15)The above encapsulate two properties for the Ising sam-pler: the worst to average case hardness equivalence formultiplicative approximations and the probability anti-concentration conjecture. Theorem 3 (Fault-tolerant hardness) . Assume thatConjectures 1 and 2 hold. Then sampling from the outputdistribution of the experimental Ising sampler q nsy ( x , y ) with a classical machine, assuming a ( ε (cid:48) , ε ) -sound verifi-cation scheme (Def. 3/Def. 4) accepts with ε ≤ ( β + β − − − N ) α α , (16) implies, with confidence ε (cid:48) , a collapse in the polynomialhierarchy to the third level. In order to have a scheme with positive soundness param-eter ε , we need our conjectures to satisfy β + β − − N ≥ A. Proof
Compared the the FT hardness proof of [29], our proof isfor the more general case of additive as opposed to multi-plicative approximation, thus answering an open questionof that paper.We follow a similar line of reasoning as the original trans-lationally invariant Ising sampler [20] - proof by contra-diction. The main difference is that we use probabilitiesconditioned on null syndromes. Other differences includeadding explanation of intermediate steps, a discussionabout obfuscation and breaking the original single Con-jecture into two separate ones: one for anti-concentrationand one for average case hardness.We also follow a line similar to an earlier result [18]. Com-pared to that result our proof does not assign specificnumbers to the parameters of the conjectures, but statesthem in a parametrised fashion.The following proof holds for a verification scheme ac-cording to Def. 4. In the case of a verification scheme ofDef. 3 the same proof holds, replacing var
Post with varand setting q nsy ( y = 0) = 1. Proof of Theorem 3.
If we can classically sample from q nsy ( x , y ) (which means that our quantum computercould be a classical impostor), then estimating the prob-abilities of the distribution with exponential accuracyis in P : We can construct a polynomial time non-deterministic Turing machine that uses the sampler asan oracle that accepts when a specific string is sampled,so that the probability of that event could be estimated,if we could count the accepting branches. We could alsoestimate the marginal probabilities q nsy ( y ) in such a man-ner. Notice that we could not apply the same argumentfor the quantum sampler since we cannot extract its ran-domness as input to build the oracle. From Stockmeyer’stheorem [45], there exists an F BP P NP machine that cancompute explicitly the values p apx ( x , y ), such that for ev-ery x , y | p apx ( x , y ) − q nsy ( x , y ) | ≤ q nsy ( x , y )poly( N ) . (17)The same can be applied in calculating the marginals.Thus a F BP P NP machine can calculate q nsy ( y = 0),4the probability of accepting the syndrome measurements,with accuracy of the same scaling as the joint probability.Using the fact that q nsy ( y = 0) is non-zero (it is lowerbounded by (1 − (cid:15) ) N , so one can get a non-zero estimatein P and approximate it using Stockmeyer) it is easyto prove that for conditional probabilities, | p apx ( x | y = 0) − q nsy ( x | y = 0) | ≤ q nsy ( x | y = 0)poly( N ) . (18)Applying the triangle inequality, for every x the distancebetween the values p apx ( x | y = 0) and the exact condi-tional probability q exc ( x | y = 0) of the Ising sampler is | p apx ( x | y = 0) − q exc ( x | y = 0) |≤ | p apx ( x | y = 0) − q nsy ( x | y = 0) | + | q nsy ( x | y = 0) − q exc ( x | y = 0) |≤ q nsy ( x | y = 0)poly( N ) + | q nsy ( x | y = 0) − q exc ( x | y = 0) | . (19)Assuming an ( ε (cid:48) , ε )-sound verification scheme has ac-cepted, it follows that | q nsy ( x | y = 0) − q exc ( x | y = 0) | ≤ ε , with confidence ε (cid:48) .Obfuscation of the probability estimated in this modelcomes by construction. We can pick a computationalbranch ( x , . . . , x m ( n − ) and final layer output string( x n , . . . , x mn ) to estimate at random, without revealingany information to the sampler. This is possible becausethe uniform distribution over branches (see Section IV B)is created within a fixed instance of the Ising sampler,with no extra input provided to the sampler. This is incontrast to other models (e.g. [28]) where extra encryp-tion is needed to hide from the sampler which probabilitywe are interested in. The expectation of var Post over theuniform distribution on x is ≤ ε mn , where m, n are thedimensions of the logical ‘extended’ brickwork state and N = mn .Markov inequality relates the probability of a randomvariable exceeding a certain value with its expectation.For a random variable X and γ > , prob( X ≥ γ ) ≤ E ( X ) γ . (20)Applying the Markov inequality to the second term inEqn. (19)prob( | q nsy ( x | y = 0) − q exc ( x | y = 0) | ≥ γ ) ≤ ε N γ . (21)By changing variablesprob (cid:18) | q nsy ( x | y = 0) − q exc ( x | y = 0) | ≥ ε N γ (cid:19) ≤ γ orprob (cid:18) | q nsy ( x | y = 0) − q exc ( x | y = 0) | ≤ ε N γ (cid:19) ≥ − γ. (22) Condensing this with Eqn. (19),prob (cid:32) | p apx ( x | y = 0) − q exc ( x | y = 0) | ≤ q exc ( x | y = 0)poly( N ) + 2 ε (1 + o (1))2 N γ (cid:19) ≥ − γ, (23)Thus, for more than 1 − γ fraction of instances of x | p apx ( x | y = 0) − q exc ( x | y = 0) | ≤ q exc ( x | y = 0)poly( N )+ 2 ε (1 + o (1))2 mn γ , (24)which means that strongly simulating, i.e. calculatingthe probabilities, of the Ising distribution with the abovemixture of additive and multiplicative accuracy for morethan 1 − γ fraction of instances of x is in the third levelof the polynomial hierarchy.We use the two conjectures to continue our proof. FromEqn. (24) and Conjecture 2, setting ε ∈ ε (1+ o (1)) γα , theremust be at least β − γ fraction of instances of x (weassume γ < β ) such that | p apx ( x | y = 0) − q exc ( x | y = 0) | ≤ q exc ( x | y = 0)poly( N ) + ε q exc ( x | y = 0) , (25)or | p apx ( x | y = 0) − q exc ( x | y = 0) | ≤ ( o (1) + ε ) q exc ( x | y = 0) . Let Conjecture 1 hold with β ≥ − ( β − γ ) + 2 − N and α ∈ o (1) + ε . These imply for the soundness parameter ε ≤ ( β + β − − − N ) α α , (26)which is positive for β + β − − N ≥ F BP P NP Stockmeyermachine have calculated is P -hard.Then, P H ⊆ P P ⊆ P F BP P NP ⊆ Σ P , where the firstinclusion is given by Toda’s theorem, and the polynomialhierarchy collapses to the third level, an event expectedto be highly unlikely.Our average case conjecture is implicitly contained in amore general conjecture that includes anti-concetrationin [20]. Notice that our average case conjecture, however,applies to a slightly different distribution. The differenceis that, in our case, we can have extra rotations on someof the measurement angles, as a consequence of not ap-plying the correction gates conditioned on the measure-ment outcome of the teleportation step of the FT gates(Fig. 10 ( ii )). This issue will affect the implementation of5the measurements with non-zero angles in the extendedbrickwork state (Figure 1 ( ii )). Assuming magic | + π/ (cid:105) states are used for the implementation of the π/ √ T gates), the byproduct is a k π/ i )), for some k which depends on the measurementoutcomes of the magic state teleportation steps. The orig-inal argument made in [20] to support their average caseconjecture is that for random measurement outcomes ofthe vertices of the extended brickwork state, a uniformrotation over the 8 different { kπ/ } angles is producedon the brickwork state. In our case it is the same, becausethe extra rotations cannot change the uniformity of theseangles. Thus, the computation applied is based on a ran-dom brickwork MBQC pattern and connections to therandom circuit model, such as in [17], can be made. Inthe latter paper, the average hardness of sampling froma random circuit is supported by drawing connections toquantum chaos and some numerical evidence. VII. DISCUSSIONS
Quantum computational supremacy demonstration is be-lieved to be easier than universal quantum computingsince it may not have to fulfil atleast one of DiVin-cenzo’s criteria. Our work shows that fault-tolerant ver-ifiable quantum supremacy is quantitatively easier thanfault-tolerant universal quantum computation in terms ofthresholds. This relies on combining the notion of post-selected thresholds with trap-based verification whichallows error-detection-based fault tolerance to combatnoise. Such a combination is not known to exist for otherquantum verification methods. In the trap-based verifica-tion schemes we use, it is the isolatable nature of the trapsthat enables error-detection-based fault tolerance.The techniques developed here have a wide range of ap-plicability. We apply it to the Ising sampler as a spe-cific example of a model for quantum supremacy. Forexample, they could be applied in implementations ofthe Boson Sampling model [19] in a fault-tolerant quan-tum computer based on qubits [46]. Our methods shouldalso apply to the random circuit IQP model [47] which,in the ‘graph program’ implementation [48] requires asmaller than the Ising sampler, but non-planar, resourcestate. Finally, it can be applied to recently studied quan-tum supremacy architectures on low-periodicity planarlattices [23]. The only requirement for our isolated trapcomputation technique is that the underlying graph stateis bipartite. Thus, it can even be used to simplify theoriginal verification protocol [31] for a universal quantumcomputer, in the case it runs a classical output problem,and use our technique to implement it in a fault-tolerant way.Trap-based techniques require blindness, which is notbelieved possible with a classical verifier [49, 50]. Evenverification protocols that do not require blindness, suchas [51], still need some level of quantum encryption. Thisis true for any protocol based on quantum authenticationschemes [52], made possible by a quantum verifier. Verifi-cation protocols with classical verifiers exist [48, 53, 54],but require extra assumptions such as additional com-putational hardness conjectures or non-communicatingprovers respectively. For general reviews of blind and ver-ifiable protocols see Refs. [55, 56].Our work is one of the first on fault-tolerant verification,which was known to be a challenging open question. An-other recent progress [57] presents a fault-tolerant veri-fication technique for universal MBQC that requires theverifier to perform measurements, as opposed to prepa-rations as in our scheme. Our scheme is complementaryto contemperaneous work on composable verification ofIQP, which is a classical hypothesis test with the verifierpreparing perfect stabilizer states and the prover usinga non-planar graph [58]. A formal proof of composabil-ity of our protocol is a desirable next step and may bedeveloped using the methods given in [59].A direction for future investigation should be the po-tential of other known fault-tolerant quantum codes inproviding improved post-selected thresholds, as well asthe search for quantum codes for non-universal models.Another direction should be the study of known quan-tum supremacy models whose verification lies with themodel [60], as well as the development of such new non-universal models. More technically, an open problem forour verification scheme is to find a graph state with localrotations being only multiples of π/ xy -planemeasurements can also be considered [61, 62]. ACKNOWLEDGEMENTS
We thank Zhang Jiang, Ashely Montanaro, MichaelBremner for early discussions and Elham Kashefi, Pet-ros Wallden and Andru Gheorghiu for discussions onthe trap-based verification technique. We thank theanonymous referees for valuable feedback that helpedimprove the manuscript. We thank Dominic Branfordand Samuele Ferracin for discussions and the first foralso helping with the figures. This work was supported,in part, by the UK EPSRC (EP/K04057X/2), andthe UK National Quantum Technologies Programme(EP/M013243/1). [1] I. M. Georgescu, S. Ashhab, and F. Nori, Rev. Mod.Phys. , 153 (2014). [2] T. Fukuhara, A. Kantian, M. Endres, M. Cheneau,P. Schausz, S. Hild, D. Bellem, U. Schollwock, T. Gia- marchi, C. Gross, I. Bloch, and S. Kuhr, Nat Phys ,235 (2013).[3] T. Lanting, A. J. Przybysz, A. Y. Smirnov, F. M.Spedalieri, M. H. Amin, A. J. Berkley, R. Harris, F. Al-tomare, S. Boixo, P. Bunyk, N. Dickson, C. Enderud,J. P. Hilton, E. Hoskinson, M. W. Johnson, et al. , Phys.Rev. X , 021041 (2014).[4] J. Kelly, R. Barends, A. G. Fowler, A. Megrant, E. Jef-frey, T. C. White, D. Sank, J. Y. Mutus, B. Campbell,Y. Chen, Z. Chen, B. Chiaro, A. Dunsworth, I.-C. Hoi,C. Neill, et al. , Nature , 66 (2015).[5] R. P. Feynman, International Journal of TheoreticalPhysics , 467 (1982).[6] I. Buluta and F. Nori, Science , 108 (2009).[7] E. Ising, Zeitschrift f¨ur Physik A Hadrons and Nuclei ,253 (1925).[8] K. Binder and A. P. Young, Rev. Mod. Phys. , 801(1986).[9] L. Savary and L. Balents, Reports on Progress in Physics , 016502 (2017).[10] T. D. Lee and C. N. Yang, Phys. Rev. , 410 (1952).[11] F. Barahona, Journal of Physics A: Mathematical andGeneral , 3241 (1982).[12] L. A. Goldberg and H. Guo, Computational Complexity , 765 (2017).[13] K. Fujii and T. Morimae, New Journal of Physics ,033003 (2017).[14] B. Terhal and D. DiVincenzo, Quantum Information andComputation , 134 (2004).[15] M. J. Bremner, R. Jozsa, and D. J. Shepherd, Proceed-ings of the Royal Society A: Mathematical, Physical andEngineering Sciences , 459 (2011).[16] E. Farhi and A. W. Harrow, (2016), arXiv:1602.07674.[17] S. Boixo, S. V. Isakov, V. N. Smelyanskiy, R. Babbush,N. Ding, Z. Jiang, J. M. Martinis, and H. Neven, (2016),arXiv:1608.00263.[18] M. Bremner, A. Montanaro, and D. Shepherd,Physical Review Letters (2016), 10.1103/Phys-RevLett.117.080501.[19] S. Aaronson and A. Arkhipov, Theory of Computing ,143 (2013).[20] X. Gao, S.-T. Wang, and L.-M. Duan, Physical ReviewLetters , 040502 (2017).[21] J. Miller, S. Sanders, and A. Miyake, Physical ReviewA , 062320 (2017).[22] T. Morimae, Physical Review A , 040302 (2017).[23] J. Bermejo-Vega, D. Hangleiter, M. Schwarz,R. Raussendorf, and J. Eisert, Phys. Rev. X ,021010 (2018).[24] J. Preskill, (2012), arXiv:1203.5813.[25] D. P. DiVincenzo, Fortschritte der Physik , 771 (2000).[26] J. B. Spring, B. J. Metcalf, P. C. Humphreys,W. S. Kolthammer, X.-M. Jin, M. Barbieri, A. Datta,N. Thomas-Peter, N. K. Langford, D. Kundys, J. C.Gates, B. J. Smith, P. G. R. Smith, and I. A. Walm-sley, Science (New York, N.Y.) , 798 (2013).[27] L. Latmiral, N. Spagnolo, and F. Sciarrino, New Journalof Physics , 113008 (2016).[28] M. J. Bremner, A. Montanaro, and D. J. Shepherd,Quantum , 8 (2017).[29] K. Fujii, (2016), arXiv:1610.03632.[30] S. Aaronson and L. Chen, in LIPIcs-Leibniz InternationalProceedings in Informatics , Vol. 79 (Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2017). [31] J. F. Fitzsimons and E. Kashefi, Physical Review A ,012303 (2017).[32] A. Broadbent, J. Fitzsimons, and E. Kashefi, in Founda-tions of Computer Science, 2009. FOCS’09. 50th AnnualIEEE Symposium on (IEEE, 2009) pp. 517–526.[33] R. Raussendorf and H. J. Briegel, Phys. Rev. Lett. ,5188 (2001).[34] T. Kapourniotis, V. Dunjko, and E. Kashefi, in Pro-ceedings of the 15th Asian Quantum Information ScienceConference (AQISC 2015), Seoul, Korea (2015) pp. 25–28.[35] E. Kashefi and P. Wallden, Journal of Physics A: Math-ematical and Theoretical , 145306 (2017).[36] A. Broadbent, Theory of Computing , 1 (2018).[37] D. Hangleiter, M. Kliesch, M. Schwarz, and J. Eisert,Quantum Science and Technology , 015004 (2017).[38] L. Aolita, C. Gogolin, M. Kliesch, and J. Eisert, Naturecommunications (2015).[39] M. Cramer, M. B. Plenio, S. T. Flammia, R. Somma,D. Gross, S. D. Bartlett, O. Landon-Cardinal, D. Poulin,and Y.-K. Liu, Nature communications , 149 (2010).[40] A. M. Childs, D. W. Leung, and M. A. Nielsen, PhysicalReview A , 032318 (2005).[41] R. Raussendorf, J. Harrington, and K. Goyal, New Jour-nal of Physics , 199 (2007).[42] A. G. Fowler and K. Goyal, Quantum Information andComputation , 0721 (2009).[43] S. Bravyi and A. Kitaev, Phys. Rev. A , 022316 (2005).[44] K. Fujii, Quantum Computation with Topological Codes:from qubit to topological fault-tolerance , Vol. 8 (Springer,2015).[45] L. Stockmeyer, SIAM Journal on Computing , 849(1985).[46] B. Peropadre, A. Aspuru-Guzik, and J. J. Garcia-Ripoll,(2015), arXiv:1509.02703.[47] M. J. Bremner, A. Montanaro, and D. J. Shepherd, Phys.Rev. Lett. , 080501 (2016).[48] D. Shepherd and M. J. Bremner, Proceedings of theRoyal Society of London A: Mathematical, Physical andEngineering Sciences , 1413 (2009).[49] T. Morimae and T. Koshiba, arXiv preprintarXiv:1407.1636 (2014).[50] S. Aaronson, A. Cojocaru, A. Gheorghiu, and E. Kashefi,arXiv preprint arXiv:1704.08482 (2017).[51] D. Aharonov, M. Ben-Or, and E. Eban, in Proceedings ofInnovations in Computer Science 2010 , ICS2010 (2010)pp. 453–.[52] H. Barnum, C. Crepeau, D. Gottesman, A. Smith, andA. Tapp, in
Foundations of Computer Science, 2002. Pro-ceedings. The 43rd Annual IEEE Symposium on (IEEE,2002) pp. 449–458.[53] B. W. Reichardt, F. Unger, and U. Vazirani, Nature ,456 (2013).[54] U. Mahadev, in (2018) pp.259–267.[55] J. F. Fitzsimons, npj Quantum Information , 23 (2017).[56] A. Gheorghiu, T. Kapourniotis, and E. Kashefi, Theoryof computing systems , 1 (2018).[57] K. Fujii and M. Hayashi, Phys. Rev. A , 030301 (2017).[58] D. Mills, A. Pappa, T. Kapourniotis, and E. Kashefi,arXiv preprint arXiv:1704.01998 (2017).[59] V. Dunjko, J. F. Fitzsimons, C. Portmann, andR. Renner, in Advances in Cryptology–ASIACRYPT (Springer, 2014) pp. 406–425.[60] T. Kapourniotis, E. Kashefi, and A. Datta, in LIPIcs-Leibniz International Proceedings in Informatics ,Vol. 27 (Schloss Dagstuhl-Leibniz-Zentrum fuer Infor-matik, 2014).[61] A. Mantri, T. F. Demarie, and J. F. Fitzsimons, Scien-tific reports , 42861 (2017). [62] R. Mezher, J. Ghalbouni, J. Dgheim, and D. Markham,Phys. Rev. A , 022333 (2018).[63] M. Hein, J. Eisert, and H. J. Briegel, Phys. Rev. A ,062311 (2004).[64] C. Dankert, R. Cleve, J. Emerson, and E. Livine, Phys.Rev. A , 012304 (2009).[65] E. Dennis, A. Kitaev, A. Landahl, and J. Preskill, Jour-nal of Mathematical Physics , 4452 (2002). Appendix A: Bridge and break operators and the Ising Sampler
To understand the procedure of carving a specific graph out of a square lattice state by using only xy -plane measure-ments, we explain two types of operations originally introduced in [31, 63].The first is break operators. Let i be a vertex we want to remove from the original graph, together with the connectionto its neighbours. One can achieve this by performing a Pauli Z measurement on the qubit that corresponds to i anddiscard the outcome. However, we do not have the power to perform measurements out of the xy -plane in our protocol,otherwise we risk revealing the position of the traps by asking the prover to change the basis. Pauli Z -measurementscan be simulated by preparing dummy qubits in the | (cid:105) state. Then,the cZ gate applied by the prover has no effectin entangling it with its neighbours. The measurement can have any arbitrary rotation since the qubit is isolated anddoes not participate in the computation. In order to keep the whole procedure blind we instead prepare the qubit instate | d i (cid:105) for d i chosen independently and uniformly at random from { , } . This ensures that the state is identicalto the maximally mixed state, as is the case for the other qubits in a blind protocol. Also, we apply on each of itsneighbours Pauli operation Z d i , before sending them to the prover, so that we cancel the effect that the prover’sentangling will have on that neighbour.The second is called bridge operators. Let i be a vertex of degree 2 that we want to remove in the original graphand join its neighbours by an new edge. To achieve this we apply a Pauli Y measurement (measurement angle π/ i and add π/ Z correction on the neighbours.Since our Ising sampler model is nonadaptive and all our measurements are in the xy plane we can achieve this byflipping the measurement outcomes of the corresponding qubits. Notice that this is not an issue in the trap roundsthat we explain in Section IV A since there are no bridge operations in this case. Appendix B: Proof of soundness in Theorem 1
Proof.
Let U P ( r , d ) denote the correct unitary operation of the protocol. It includes everything preceding U B inFigure (6), and we have only included in the arguments the random parameters that will be averaged over later.The vector r contains as elements bits r i , r (cid:48) i , where i ranges from 1 to (2 κ + 1) N (2 κ +1) N possible values) andthe vector d contains as elements bits d i , where i ranges again from 1 to (2 κ + 1) N (for the non-dummy qubits weassume fixed d i = 0, thus 2 κN possible values). The rest of the random parameters are the vector θ which containselements θ i ∈ { , π , π , . . . , π } for 1 ≤ i ≤ (2 κ + 1) N (16 (2 κ +1) N possible values) and the vector t which containsthe indices of the positions of the traps in all 2 κ trap systems and takes all (cid:0) κ +1 κ (cid:1) ( κ + 1) possible values allowed bythe construction. The distributions over all the possible values of the above random parameters are uniform.In the honest case, after U P ( r , d ) is applied, the state of the trap system becomes ρ t = (cid:78) i ∈ t Z r i | + (cid:105) i (cid:104) + | i Z r i , wherethe index i takes values from the elements of t that represent the positions of the traps. In the dishonest case (againbased on Figure 6), tracing out the prover’s private system, the deviation U B becomes an arbitrary CPTP mapdenoted by E . The probability of getting all zeros of the trap system ρ (cid:48) t , right after the measurements, can be writtenas8 F t ≡ (cid:88) r , θ , t , d p ( r , θ , t , d )Tr (cid:32)(cid:79) i ∈ t Z r i | + (cid:105) i (cid:104) + | i Z r i ρ (cid:48) t (cid:33) (B1)= (cid:88) r , θ , t , d , b p Tr (cid:79) i ∈ t Z r i | + (cid:105) i (cid:104) + | i Z r i Tr { i : i/ ∈ t } (cid:79) i Z b i | + (cid:105) i (cid:104) + | i Z b i E U P ( r , d ) (cid:79) i/ ∈ m ( t ) | + (cid:105) i (cid:104) + | i (cid:79) i ∈ m ( t ) | (cid:105) i (cid:104) | i U P ( r , d ) † (cid:79) i | δ i ( θ i , r i ) (cid:105) (cid:104) δ i ( θ i , r i ) | (cid:33) (cid:79) i Z b i | + (cid:105) i (cid:104) + | i Z b i (cid:33)(cid:33) (B2)where the inner trace in the formula is taken over all the systems except the trap system. The vector b has beenintroduced, where elements b i are bits which correspond to the results of measurements of bits i for 1 ≤ i ≤ (2 κ + 1) N .The probability p comes from the uniform distribution over all possible values of the random parameters and istherefore 1 / (2 κ +1) N κN (2 κ +1) N (cid:0) κ +1 κ (cid:1) ( κ + 1)). Also, m ( t ) are the positions of the dummy qubits for a choice oftrap positions t .Summing over θ ’s creates the maximally mixed state for the δ ’s and summing over the r ’s and d ’s of the computationalsystem and the dummy system creates the maximally mixed state for those systems. This is because just before theapplication of deviation operator these systems are not entangled with the trap system and at the same time aquantum one-time-pad is applied on them. We can therefore trace them out and update the CPTP map E to a newCPTP map E (cid:48) that applies on the remaining system (of dimension 2 N (cid:48) ) and does not depend on the secret parameters.The CPTP map E (cid:48) can be written as a Kraus decomposition, where the Kraus operators { E u } obey (cid:80) u E u E † u = I N (cid:48) ,where I N (cid:48) is the identity on a 2 N (cid:48) dimension system. Each Kraus operator can be further decomposed into the Paulibasis as E u = (cid:80) k a u,k P k , where { P k } are all generalized elements of the Pauli basis applying on a 2 N (cid:48) dimensionsystem and { a u,k } are complex coefficients. Also, we remind the reader that the φ parameters of the trap qubits areall zero and therefore the remaining honest operation consists only of the rotations by the r parameters. F t = (cid:88) r t , t , b t p ( r t , t )Tr (cid:18) (cid:88) u N (cid:48) (cid:88) k =1 4 N (cid:48) (cid:88) l =1 a u,k a ∗ u,l (cid:79) i ∈ t Z r i | + (cid:105) i (cid:104) + | i Z r i (cid:79) i ∈ t Z b i | + (cid:105) (cid:104) + | Z b i P k | i Z r i | + (cid:105) i (cid:104) + | i Z r i P l | i Z b i | + (cid:105) (cid:104) + | Z b i (cid:19) , (B3)where P k | i denotes the Pauli operator that applies on qubit with index i from the generalized Pauli basis operator P k . Because of the state of the system, in particular the fact that X | + (cid:105) = | + (cid:105) , we can add ‘free’ Pauli X operatorsrandomized by new parameters r (cid:48) taken uniform at random. F t = (cid:88) r t , r (cid:48) t , t , b t p ( r t , r (cid:48) t , t )Tr (cid:18) (cid:88) u,k,l a u,k a ∗ u,l (cid:79) i ∈ t Z r i | + (cid:105) i (cid:104) + | i Z r i (cid:79) i ∈ t Z b i | + (cid:105) (cid:104) + | X r (cid:48) i Z b i P k | i Z r i X r (cid:48) i | + (cid:105) i (cid:104) + | i X r (cid:48) i Z r i P l | i Z b i X r (cid:48) i | + (cid:105) (cid:104) + | Z b i (cid:19) (B4)By changing variables b (cid:48) i = b i + r i and applying the cyclic property of the trace to move Z r i X r (cid:48) i around F t = (cid:88) r t , r (cid:48) t , t , b (cid:48) t p ( r t , r (cid:48) t , t )Tr (cid:18) (cid:88) u,k,l a u,k a ∗ u,l (cid:79) i ∈ t | + (cid:105) i (cid:104) + | i (cid:79) i ∈ t Z b (cid:48) i | + (cid:105) (cid:104) + | X r (cid:48) i Z b (cid:48) i + r i P k | i Z r i X r (cid:48) i | + (cid:105) i (cid:104) + | i X r (cid:48) i Z r i P l | i Z b (cid:48) i + r i X r (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i (cid:19) (B5)Applying the Pauli twirl lemma [64], proven in Appendix (E), by averaging over r t , r (cid:48) t , we get F t = (cid:88) t , b (cid:48) t p ( t ) (cid:88) u,k | a u,k | (cid:89) i ∈ t | (cid:104) + | i Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i P k | i | + (cid:105) i | = (cid:88) t p ( t ) (cid:88) k | α k | (cid:89) i ∈ t | (cid:104) + | i P k | i | + (cid:105) i | , (B6)9where | α k | = (cid:80) u | a u,k | and (cid:80) k | α k | = 1 from the unital property of the attack.A similar analysis is applied to calculate the average fidelity F c = F ( ρ c , ρ (cid:48) c ) of the computational state after themeasurements. In the honest case the computational state ρ c just before the measurement will be disentangled fromthe rest of the system: (cid:78) i ∈ c Z r i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:78) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j Z r j , where c ( t ) are the positions of thecomputational qubits for a choice of trap positions t and | G (cid:105) (cid:104) G | is the computational graph state. The latter can beexpressed as E G (cid:78) i ∈ c | + (cid:105) i (cid:104) + | i E † G , where E G denotes all entangling operators cZ that apply on a graph G . In thedishonest case, for an attack E the fidelity ¯ F c is F c ≡ (cid:88) r , r (cid:48) , θ , t , d p ( r , r (cid:48) , θ , t , d ) F ( ρ c , ρ (cid:48) c )= (cid:88) r , r (cid:48) , θ , t , d p ( r , r (cid:48) , θ , t , d )Tr (cid:16) ( ρ c ρ (cid:48) c ) / (cid:17) ≥ Tr (cid:88) r , r (cid:48) , θ , t , d p ( r , r (cid:48) , θ , t , d ) ρ c ρ (cid:48) c / = Tr (cid:88) r , r (cid:48) , θ , t , d , b p (cid:79) i ∈ c Z r i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j Z r j Tr { i : i/ ∈ c } (cid:32)(cid:79) i Z b i | + (cid:105) i (cid:104) + | i Z b i E ( U P ( r , r (cid:48) , d ) (cid:79) i/ ∈ m ( t ) | + (cid:105) i (cid:104) + | i (cid:79) i ∈ m ( t ) | (cid:105) i (cid:104) | i U P ( r , r (cid:48) , d ) † (cid:79) i | δ i ( θ i , r i , r (cid:48) i ) (cid:105) (cid:104) δ i ( θ i , r i , r (cid:48) i ) | ) (cid:79) i Z b i | + (cid:105) i (cid:104) + | i Z b i / . (B7)Summing over the θ ’s of the δ ’s and the r ’s and the d ’s of the trap and the dummy system creates the maximally mixedsystem for these systems which can be traced over. Expressing the attack on the remaining system (of dimension 2 N (cid:48) )using the Kraus decomposition with each Kraus element decomposed in the Pauli basis we get as before F c ≥ Tr (cid:18)(cid:18) (cid:88) t , r c ( t ) , r (cid:48) c ( t ) , b c ( t ) p (cid:88) u N (cid:48) (cid:88) k =1 4 N (cid:48) (cid:88) l =1 a u,k a ∗ u,l (cid:79) i ∈ c Z r i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j Z r j (cid:79) i ∈ c Z b i | + (cid:105) (cid:104) + | Z b i P k | i Z r i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j Z r j P l | j Z b i | + (cid:105) (cid:104) + | Z b i (cid:19) / (cid:19) . (B8)By changing variables b (cid:48) = b + r and applying the cyclic property of the trace F c ≥ Tr (cid:18)(cid:18) (cid:88) t , r c ( t ) , r (cid:48) c ( t ) , b (cid:48) c ( t ) p (cid:88) u N (cid:48) (cid:88) k =1 4 N (cid:48) (cid:88) l =1 a u,k a ∗ u,l (cid:79) i ∈ c X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j (cid:79) i ∈ c Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i + r i P k | i Z r i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j Z r j P l | j Z b (cid:48) i + r i | + (cid:105) (cid:104) + | Z b (cid:48) i (cid:19) / (cid:19) . (B9)Using Corollary 1 in Appendix (E) and the cyclic property of the trace and sum over r c ( t ) , we can eliminate allPauli X operators of the attack that differ in the two sides (we denote this by replacing the summation over l witha summation over l x where the element P l agrees with P k on all the Pauli X components). We also use the cyclicproperty of the trace to get F c ≥ Tr (cid:18)(cid:18) (cid:88) t , r c ( t ) , r (cid:48) c ( t ) , b (cid:48) c ( t ) p (cid:88) u (cid:88) k (cid:88) l x a u,k a ∗ u,l (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j (cid:79) i ∈ c Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i P k | i X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:104) G | (cid:79) j ∈ c X r (cid:48) j R z ( − φ j ) X r (cid:48) j P l | j Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i (cid:79) i ∈ c X r (cid:48) i R z ( φ i ) X r (cid:48) i | G (cid:105) (cid:19) / (cid:19) . (B10)Then, the X r (cid:48) i ( X r (cid:48) j ) operators that are next to | G (cid:105) ( (cid:104) G | ) can be rewritten as Pauli Z operators on their neighbours,which then commute with z rotations and the attack (since the Pauli X operators of the attack are the same from0both sides) and with the projectors Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i , by changing variable b (cid:48)(cid:48) i = b (cid:48) i + r (cid:48) i , and cancel each other. The X r (cid:48) i operators that are next to projectors Z b (cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48) i commute with them trivially F c ≥ Tr (cid:18)(cid:18) (cid:88) t , r (cid:48) c ( t ) , b (cid:48)(cid:48) c ( t ) p (cid:88) u (cid:88) k (cid:88) l x a u,k a ∗ u,l (cid:104) G | (cid:79) j ∈ c R z ( − φ j ) (cid:79) i ∈ c Z b (cid:48)(cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48)(cid:48) i X r (cid:48) j P k | i X r (cid:48) i R z ( φ i ) | G (cid:105) (cid:104) G | (cid:79) j ∈ c R z ( − φ j ) X r (cid:48) j P l | j X r (cid:48) i Z b (cid:48)(cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48)(cid:48) i (cid:79) i ∈ c R z ( φ i ) | G (cid:105) (cid:19) / (cid:19) . (B11)Then we can use again Corollary 1, but with Q , Q (cid:48) being Pauli Z +identity operators and { P i } all tensor productsof Pauli X +identity operators, and sum over r (cid:48) c ( t ) to eliminate the Pauli Z components of the attack the differ inthe two sides. Thus, given that (cid:80) u,k | a u,k | = 1 from the unital property of the attack, the attack becomes a convexcombination of Pauli operators: F c ≥ (cid:18) (cid:88) t , b (cid:48)(cid:48) c ( t ) p ( t ) (cid:88) u,k | a u,k | | (cid:79) i ∈ c ( t ) (cid:104) + | i E † G (cid:79) i ∈ c ( t ) R z ( − φ i ) Z b (cid:48)(cid:48) i | + (cid:105) (cid:104) + | Z b (cid:48)(cid:48) i P k | i R z ( φ i ) E G (cid:79) i ∈ c ( t ) | + (cid:105) i | (cid:19) / (B12)The Pauli X component of P k | i can be replaced by I since the only effect is, depending on b (cid:48)(cid:48) i , to change the signof the quantity inside the absolute and the sign is eliminated. Then, we can sum over the b ’s to get identity andsince E † G R z ( − φ i ) now commutes with the attack Pauli operators, it cancels with R z ( φ i ) E G . Also, as before, we set | α k | = (cid:80) u | a u,k | F c ≥ (cid:88) t p ( t ) (cid:88) k | α k | (cid:89) i ∈ c ( t ) | (cid:104) + | i P k | i | + (cid:105) i | . (B13)It is easy to see by the symmetry of the trap construction that, for attacks that are exactly the same on any of the2 κ + 1 graphs of the different the rounds of the protocol e.g. stochastic noise, Equation B6 and Equation B13 givethe same result when averaged over t . However, one needs to deal with more clever attacks which attack a differentqubit at every round trying to coincide with dummies instead of traps with non-zero probability, i.e. for some of thepossible permutations of the 2 κ + 1 graphs.We now show that for κ ≥ F t − F c for all possible deviation strategies is∆ κ ≡ κ !( κ + 1)!(2 κ + 1)!The attack is a convex combination of Pauli operators, thus it suffices to find the Pauli operator that maximizes F t − F c . The maximum comes from the attack that touches all 2 κ + 1 rounds. In this case, F c is lower bounded by0 and F t comes from the probability the attack does not coincide with any trap in the 2 κ trap computation rounds.There are 2 κ + 1 ways of picking the target computation round, which fixes the positions of the 2 κ trap computationrounds. The choice of the even/odd parity positions for the traps is fixed not to coincide with the attacks. Furthersimplification can be done by observing that only the attacks on κ + 1 of the same kind (even or odd) and κ of theother, are successful. By attacking κ + 2 or more of the same kind they are guaranteed to hit a trap of the same kind,independently of the position of the target. This reduces the possible ways of picking the target to κ + 1, which givesa bound of κ +1 ( κ +1 κ ) ( κ +1) , equal to the value of ∆ κ above.To conclude the proof we show that for all other attacks F t − F c is non-positive and thus estimating F c through F t is a conservative estimation. We begin by arguing that there is no benefit for the attacker to touch more thanone qubit of each round, since the lower bound of the fidelity F c contains products of terms that can be 0 or 1 andthus it suffices to make one term 0 to make the product 0. By symmetry of the construction it does not matter whichparticular qubit the attacker touches but only whether it is an odd or even position qubit at each round. Let λ be thenumber of rounds that are attacked.Assume, without loss of generality, the first ξ rounds are attacked on an even qubit, where ξ ≤ κ otherwise it willcertainly hit a trap, and λ − ξ ≤ κ for the same reason. Also, assume ξ ≥ ( λ − ξ ) without loss of generality.For index k to correspond to an attack on λ rounds F c,k ≥ − λ κ + 1 = 2 κ + 1 − λ κ + 1 (B14)1There are (cid:0) κ +1 κ (cid:1) ( κ + 1) possibilities for the selection of traps. In order to count the combinations of attacks notaffecting the traps, we identify two cases, (i) the target is in the attacked rounds ( λ possible positions) and there are (cid:0) κ +1 − λκ − ξ (cid:1) possible placings of the remaining traps in the non-attacked positions, (ii) the target is not in the attackedrounds (2 κ +1 − λ possible positions) and there are (cid:0) κ − λκ − ξ (cid:1) possible placings of the remaining traps in the non-attackedpositions: F t,k = λ (cid:0) κ +1 − λκ − ξ (cid:1) + (2 κ + 1 − λ ) (cid:0) κ − λκ − ξ (cid:1)(cid:0) κ +1 κ (cid:1) ( κ + 1) (B15)We show that for λ ≤ κ we have F t,k − F c,k ≤ λ (cid:0) κ +1 − λκ − ξ (cid:1) + (2 κ + 1 − λ ) (cid:0) κ − λκ − ξ (cid:1)(cid:0) κ +1 κ (cid:1) ( κ + 1) − κ + 1 − λ κ + 1 ≤ ⇔ (2 κ − λ + 1)( κ + ξ + 1) (cid:0) κ − λκ − ξ (cid:1) ( κ − ( λ − ξ ) + 1) (cid:0) κ +1 κ (cid:1) ( κ + 1) − κ + 1 − λ κ + 1 ≤ ⇔ (2 κ − λ + 1)( κ + ξ + 1)(2 κ − λ )!( κ !) ( κ − ( λ − ξ ) + 1)(2 κ + 1)!( κ − ( λ − ξ ))!( κ − ξ )! ≤ κ + 1 − λ κ + 1 ⇔ ( κ + ξ + 1)(2 κ − λ )!( κ !) ( κ − ( λ − ξ ) + 1)(2 κ )!( κ − ( λ − ξ ))!( κ − ξ )! ≤ κ = { , } it is easy to verify the expression directly. For the general case we rewrite the above as:( κ + ξ + 1)[( κ − ξ + 1) · . . . · κ ][( κ − ( λ − ξ ) + 1) · . . . · κ ]( κ − ( λ − ξ ) + 1)(2 κ − λ + 1) · . . . · κ ≤ ξ + ( λ − ξ ) = 1 + λ terms on the numerator and 1 + λ terms in the denominator.For the LHS of the above equation we have ≤ ( κ + ξ + 1)( κ − ( λ − ξ ) + 1)2 ξ ≤ ( κ + ξ + 1)( κ − ξ + 1)2 ξ (B18)It suffices to show that the above is ≤ κ and ξ . We can rewrite it as:( κ + ξ + 1)( κ − ξ + 1) ≤ ξ ⇔ (B19)1ln(2) ln( κ + 1 + ξκ + 1 − ξ ) ≤ ξ ⇔ (B20)2ln(2) artanh (cid:18) ξκ + 1 (cid:19) ≤ ξ (B21)which is true for κ ≥ , ξ ≤ κ . This concludes our calculation of the bound ∆ κ .The rest of the proof is given in the main text.2 Appendix C: Calculation of FT Threshold for Protocol 2b
Since the logical graph is the brickwork state, its topological implementation will look like Fig. (8).Noise considered is local, unital and bounded. It applies after every elementary operation (preparation, entanglingand measurement) j and is expressed as a CPTP superoperator: N j = (1 − (cid:15) ) I + E j (C1)where ||E j || (cid:5) = (cid:15) , where we set (cid:15) = (cid:15) V = (cid:15) P to calculate a common threshold for the verifier and the prover.For the fault tolerant noisy, but honest, probability distribution post-selected for null syndrome measurement q nsy ( x | y = 0), and the exact one q exc ( x ) we reproduce the derivation of Ref. [29]. (cid:88) x | q nsy ( x | y = 0) − p exc ( x ) | = (cid:88) x (cid:12)(cid:12)(cid:12)(cid:12) Tr( P x Q y ( ρ sparse + ρ faulty ))Tr( Q y ( ρ sparse + ρ faulty )) − p exc ( x ) (cid:12)(cid:12)(cid:12)(cid:12) = (cid:88) x (cid:12)(cid:12)(cid:12)(cid:12) Tr( P x Q y ρ faulty )Tr( Q y ( ρ sparse + ρ faulty )) − (1 − b ) p exc ( x ) (cid:12)(cid:12)(cid:12)(cid:12) (C2)Here, P x is the projector to result x for the output register and Q y is the projector to null syndrome for the post-selection register. ρ faulty is the un-normalised state of the noisy sampler with the noise operators that produce an errorin the output distribution and operator ρ sparse is is the un-normalised state with the noise operators do not producean error in the output distribution when the syndromes give a null result (for more detail see [29]). b is defined b = Tr( P x Q y ρ sparse )Tr( Q y ρ sparse + ρ faulty ) q exc ( x ) . (C3)By applying triangle inequality and by observing that the trace terms are positive (cid:88) x | q nsy ( x | y = 0) − p exc ( x ) | ≤ Tr( Q y ρ faulty )Tr( Q y ( ρ sparse + ρ faulty )) + (1 − b )Since (cid:80) x Tr( P x Q y ( ρ sparse + ρ faulty ))Tr( Q y ( ρ sparse + ρ faulty )) = 1, we have 1 − b = Tr( Q y ρ faulty )Tr( Q y ( ρ sparse + ρ faulty )) .Also we have Tr( Q y ( ρ sparse + ρ faulty )) > (1 − (cid:15) ) N . Thus (cid:88) x | q nsy ( x | y = 0) − p exc ( x ) | ≤ ρ faulty ) / (1 − (cid:15) ) N (C4)In the case of the topological code the errors are created by error chains L of length greater than L d , which is theminimum of the distance between two defects and the size of defects. SoTr( ρ faulty ) ≤ N (cid:88) L = L d (cid:88) L : |L| = L Tr( ρ L faulty ) ≤ N (cid:88) L = L d (cid:88) L : |L| = L (1 − (cid:15) ) N L (cid:89) j =1 ||E j || (cid:5) − (cid:15) ≤ N (cid:88) L = L d (cid:88) L : |L| = L (1 − (cid:15) ) N (cid:18) (cid:15) − (cid:15) (cid:19) |L| (C5)The number of error chains of length |L| in the 3D lattice of size n is poly( n )(6 / |L| , which is the number of selfavoiding walks [65]. Thus the gap (cid:80) x | q nsy ( x | y = 0) − p exc ( x ) | is bounded by ≤ N (cid:88) L = d poly( N )(6 / L (cid:18) (cid:15) − (cid:15) (cid:19) L (C6)which converges to zero if (cid:15)/ (1 − (cid:15) ) < /
5. The threshold comes from the self-avoiding walks that affect the singularqubits and surpass the distillation threshold, where a more careful counting needs to be done [29] to get (cid:15)/ (1 − (cid:15) ) < . (cid:15) < . (cid:15) thres = 0 . ≤ d ). This is the area of dimension d around thedefect qubits and their ‘past’ in terms of MBQC flow (physical layer) which we choose in the smallest of the threedimensions of the topological code. We take the biggest (in terms of physical qubits) trap of Fig. (8). The number ofsyndrome measurements (cubes) will depend on the distance parameter d . Since the counting of syndromes is involvedwe give an example for fixed values, d = 2 and physical noise (cid:15) = (1 / (cid:15) thres . In this case the number of syndromesis a most 564 and the number of repetitions is M = 1 / (1 − p c ) , where p c is the probability of a cube syndromefailing. Probability p c is given by (1 − (1 − (cid:15) )) ) /
2. This gives M ≈ × . Overheads for other fractions of thethreshold for noise appear in the main text. Appendix D: Proof of Theorem 2 soundness
Proof.
To establish soundness we need to show that a lower bound in the fidelity on the target computation roundand the acceptance probability of the trap computation rounds are the same averaged over the random parameters.The total variation distance between the experimental (noisy and potentially dishonest) distribution of the Isingsampler q nsy ( x | y = 0), where y = 0 implies conditioning on the null syndrome, and the exact one q exc ( x | y = 0) = q exc ( x ) after the measurements isvar Post = 12 (cid:88) x | q exc ( x | y = 0) − q nsy ( x | y = 0) | = 12 (cid:88) x (cid:12)(cid:12)(cid:12)(cid:12) q exc ( x ) − q nsy ( x , y = 0) q nsy ( y = 0) (cid:12)(cid:12)(cid:12)(cid:12) = D (cid:32) ρ c , ρ (cid:48) post c q nsy ( y = 0) (cid:33) ≤ (cid:118)(cid:117)(cid:117)(cid:116) − F (cid:32) ρ c , ρ (cid:48) post c q nsy ( y = 0) (cid:33) = (cid:118)(cid:117)(cid:117)(cid:117)(cid:116) − Tr (cid:115) ρ c ρ (cid:48) post c q nsy ( y = 0) , (D1)where ρ c is the correct state and ρ (cid:48) post c the experimental state, post-selected on the null syndrome measurements,after all measurements. For the rest of this section we denote q nsy ( y = 0) as q (cid:48) for simplicity.For the target round, the average fidelity F c is calculated in the physical level of the computation as in the non-fault-tolerant case. The qubits are pre-rotated by θ i , or flipped by d i in the case of dummies.Noise can enter either during the state preparation from the verifier, or during the single round elementary MBQCoperations (entangling and measurement) of the prover. We assume a noise model which is local, unital and bounded,so that standard fault tolerance techniques are applicable. Noise can always moved after every elementary operationon qubit j and expressed as a CPTP superoperator applies only on the state of qubit j : N j = (1 − (cid:15) ) I + E j (D2)where ||E j || (cid:5) ≤ (cid:15) thres .Crucially, we assume that the noise during the preparation does not have any dependence on the secret parameter θ i .Moving all the noise operators just before the measurement, results to a different set of local, unital and boundedoperators N (cid:48) j , collectively represented as N (cid:48) .4We apply the same twirling steps as in the proof of Theorem 1 to twirl the CPTP map that is the composition of theattack and the noise. Notice that the twirl on the post-selected qubits is trivial since there is no sum over b (cid:48) i . Thus, F c (cid:32) ρ post c , ρ (cid:48) post c q (cid:48) (cid:33) ≥ (D3)1 q (cid:48) (cid:88) t , b (cid:48) c ( t ) p ( t ) (cid:88) u,k | a u,k | (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) (cid:79) i ∈ c ( t ) (cid:104) | i (cid:79) i ∈ c ( t ) (cid:104) + | i E † G (cid:79) i ∈ c ( t ) R z ( − φ i ) Z b (cid:48) i | + (cid:105) i (cid:104) + | i Z b (cid:48) i P k | i R z ( φ i ) E G (cid:79) i ∈ c ( t ) | + (cid:105) i (cid:79) i ∈ c ( t ) | (cid:105) i (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) , where b (cid:48) i ’s take fixed values in the sum for the syndrome measurements such that the syndrome indicates null errors.The only (noise and attack) Pauli operators that have an effect on the above quantity are tensor products of identityand Pauli Z . These operators flip the measurement outcome of the particular qubit. Detectable attacks disappearbecause of the projector to null syndromes. The undetected attacks that come from operators P k | i can be writtenas logical bit flips on the subsequent measurements - since it will affect the classical post-processing. Also, thenormalization factor vanishes when we trace over the syndrome systems.Therefore, at the logical level F c ≥ (D4) (cid:88) t , b (cid:48)(cid:48) c ( t ) p ( t ) (cid:88) u,k | a u,k | (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) (cid:79) i ∈ c ( t ) (cid:104) | Li (cid:79) i ∈ c ( t ) (cid:104) + | Li E † LG (cid:79) i ∈ c ( t ) R z ( − φ Li ) Z b (cid:48)(cid:48) i L | + (cid:105) L (cid:104) + | L Z b (cid:48)(cid:48) i L P Lk | i R z ( φ Li ) E LG (cid:79) i ∈ c ( t ) | + (cid:105) Li (cid:79) i ∈ c ( t ) | (cid:105) Li (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) , We can now sum over the index b (cid:48)(cid:48) c ( t ) to simplify the expression, by cancelling also the rotation and entanglingoperators. On the logical dummy system the logical Pauli Z attacks have no effect, therefore it has trace 1 and canbe simplified to F c ≥ (cid:88) t p ( t ) (cid:88) u,k | a u,k | (cid:89) i ∈ c ( t ) | (cid:104) + | Li P Lk | i | + (cid:105) Li | . (D5)The same technique can be employed for the trap rounds, with the difference that instead of post-selection there iserror correction for Protocol 2a and error detection for Protocol 2b that results in the same logical state for the same(noise and attack) Pauli operators.From completeness we have set the limit of acceptance of the fidelity estimate to (1 − (cid:15) (cid:48)(cid:48) ). By repeating N =log(1 /β ) / (2 (cid:15) (cid:48)(cid:48) ) times gets us √ (cid:15) (cid:48)(cid:48) -close in our estimation with confidence 1 − β . Thus, with this confidence we getbound var Post ≤ √ (cid:15) (cid:48)(cid:48) + ∆ κ . Appendix E: Channel Twirl Lemma
The following lemma is used in the verifiability proofs.
Lemma 1. n (cid:88) i =1 P i QP i ρP i Q (cid:48) P i = 0 , if Q (cid:54) = Q (cid:48) (E1) where ρ is a matrix of dimension n × n , Q , Q (cid:48) are two arbitrary n -fold tensor products of Pauli+identity operators { I, X, Y, Z } , and { P i } is the set of all n -fold tensor products of Pauli operators and the identity { I, X, Y, Z } . A proof of this lemma is also provided in Ref. [64].
Proof.
We can write Q as Z a X a (cid:48) = Z a ⊗ . . . ⊗ Z a n X a (cid:48) ⊗ . . . ⊗ X a (cid:48) n , for arbitrary binary vectors a = ( a , . . . , a n ), a (cid:48) = ( a (cid:48) , . . . , a (cid:48) n ), and similarly Q (cid:48) = Z b X b (cid:48) . Assuming Q (cid:54) = Q (cid:48) , either a (cid:54) = b or a (cid:48) (cid:54) = b (cid:48) . Summing over all P k , k (cid:48) ’swhich are the n -fold tensor products of the form Z k X k (cid:48) = Z k (cid:48) ⊗ . . . ⊗ Z k (cid:48) n X k ⊗ . . . ⊗ X k n for binary vectors k = ( k , . . . , k n ) , k (cid:48) = ( k (cid:48) , . . . , k (cid:48) n ) , we get5 (cid:88) k , k (cid:48) P k , k (cid:48) QP k , k (cid:48) ρP k , k (cid:48) Q (cid:48) P k , k (cid:48) = (cid:88) k , k (cid:48) Z k X k (cid:48) Z a X a (cid:48) Z k X k (cid:48) ρZ k X k (cid:48) Z b X b (cid:48) Z k X k (cid:48) = (cid:88) k , k (cid:48) Z k ( X k (cid:48) Z a X k (cid:48) ) X a (cid:48) Z k ρZ k ( X k (cid:48) Z b X k (cid:48) ) X b (cid:48) Z k = (cid:88) k , k (cid:48) Z k (( − k (cid:48) · a Z a ) X a (cid:48) Z k ρZ k (( − k (cid:48) · b Z b ) X b (cid:48) Z k = (cid:88) k , k (cid:48) ( − k (cid:48) · ( a ⊕ b ) Z a ( Z k X a (cid:48) Z k ) ρZ b ( Z k X b (cid:48) Z k )= (cid:88) k (cid:48) ( − k (cid:48) · ( a ⊕ b ) (cid:88) k ( − k · ( a (cid:48) ⊕ b (cid:48) ) Z a X a (cid:48) ρZ b X b (cid:48) If either a (cid:54) = b or a (cid:48) (cid:54) = b (cid:48) the summation (cid:80) k (cid:48) (( − k (cid:48) · ( a ⊕ b ) ) or (cid:80) k (( − k · ( a (cid:48) ⊕ b (cid:48) ) ) is equal to zero respectively,because (in either case) exactly half of the elements of the summation will be − a (cid:54) = b or a (cid:48) (cid:54) = b (cid:48) or both, the whole expression equals zero. Corollary 1. n (cid:88) i =1 P i QP i ρP i Q (cid:48) P i = 0 , if Q (cid:54) = Q (cid:48) (E2) where ρ is a matrix of dimension n × n , Q , Q (cid:48) are two arbitrary n -fold tensor products of Pauli X and identityoperators { I, X } , and { P i } is the set of all n -fold tensor products of Pauli Z and identity operators { I, Z } . Proof.
Since Q (cid:54) = Q (cid:48) , Lemma 1 gives n (cid:88) i =1 P i QP i ρP i Q (cid:48) P i = 0 (E3)where { P i } is the set of all n -fold tensor products of the Pauli operators and the identity { I, X, Y, Z } . But since Q and Q (cid:48) have only identity and Pauli X tensor elements the Pauli X operators of { P i } commute with Q and Q (cid:48)(cid:48)