The Quantum Supremacy Tsirelson Inequality
aa r X i v : . [ c s . CC ] A ug The Quantum Supremacy Tsirelson Inequality
William Kretschmer ∗ Abstract
A leading proposal for verifying near-term quantum supremacy experiments on noisy randomquantum circuits is linear cross-entropy benchmarking. For a quantum circuit C on n qubitsand a sample z ∈ { , } n , the benchmark involves computing |h z | C | n i| , i.e. the probabilityof measuring z from the output distribution of C on the all zeros input. Under a strongconjecture about the classical hardness of estimating output probabilities of quantum circuits,no polynomial-time classical algorithm given C can output a string z such that |h z | C | n i| issubstantially larger than n (Aaronson and Gunn, 2019). On the other hand, for a randomquantum circuit C , sampling z from the output distribution of C achieves |h z | C | n i| ≈ n onaverage (Arute et al., 2019).In analogy with the Tsirelson inequality from quantum nonlocal correlations, we ask: can apolynomial-time quantum algorithm do substantially better than n ? We study this question inthe query (or black box) model, where the quantum algorithm is given oracle access to C . Weshow that, for any ε ≥ n ) , outputting a sample z such that |h z | C | n i| ≥ ε n on averagerequires at least Ω (cid:16) n/ poly( n ) (cid:17) queries to C , but not more than O (cid:0) n/ (cid:1) queries to C , if C is eithera Haar-random n -qubit unitary, or a canonical state preparation oracle for a Haar-random n -qubit state. We also show that when C samples from the Fourier distribution of a randomBoolean function, the naive algorithm that samples from C is the optimal 1-query algorithm formaximizing |h z | C | n i| on average. A team based at Google has claimed the first experimental demonstration of quantum computa-tional supremacy on a programmable device [AAB + random circuitsampling , where the task is to sample (with nontrivial fidelity) from the output distribution of aquantum circuit containing random 1- and 2-qubit gates. To verify their experiemnt, they used theso-called Linear Cross-Entropy Benchmark , or Linear XEB. Specifically, for an n -qubit quantumcircuit C and samples z , . . . , z k ∈ { , } n , the benchmark is given by: b = 2 n k · k X i =1 |h z i | C | n i| . The goal is for b to be large with high probability over the choice of the random circuit and therandomness of the sampler, as this demonstrates that the observations tend to concentrate on theoutputs that are more likely to be measured under the ideal distribution for C . We formalize thistask as the b -XHOG task: ∗ University of Texas at Austin. Email: [email protected] . roblem 1 ( b -XHOG, or Linear Cross-Entropy Heavy Output Generation) . Given a quantumcircuit C on n qubits, output a sample z ∈ { , } n such that E (cid:2) |h z | C | n i| (cid:3) ≥ b n , where theexpectation is over an implicit distribution over circuits C and over the randomness of the algorithmthat outputs z . Here, b “large” means b bounded away from 1, as outputting z uniformly at random achieves b = 1 on average for any C . On the other hand, if z is drawn from the ideal distribution for C , and ifthe random circuits C empirically exhibit the Porter-Thomas distribution on output probabilities,then sampling from C achieves b ≈ +
19, AG19].Under a strong complexity-theoretic conjecture about the classical hardness of nontrivially es-timating output probabilities of quantum circuits, Aaronson and Gunn showed that no classicalpolynomial-time algorithm can solve b -XHOG for any b ≥ n ) on random quantum circuits ofpolynomial size [AG19]. Thus, a physical quantum computer that solves b -XHOG for b ≥ b -XHOG do substantially betterthan b = 2? That is, what is the largest b for which a polynomial-time quantum algorithm can solve b -XHOG on random circuits? Note that the largest b we could hope for is achieved by the optimalsampler that always outputs the string z maximizing |h z | C | n i| . If the random circuits induce aPorter-Thomas distribution on output probabilities, then this solves b -XHOG for b = Θ( n ), becausethe probabilities of a Porter-Thomas distribution approach i.i.d. exponential random variables(see Fact 10 below). However, finding the largest output probability might be computationallydifficult even on a quantum computer, which is why we restrict our attention to efficient quantumalgorithms.We refer to our problem as the “quantum supremacy Tsirelson inequality” in reference to theBell [Bel64] and Tsirelson [CT80] inequalities for quantum nonlocal correlations (for a modernoverview, see [CHTW04]). Under this analogy, the quantity b in XHOG plays a similar role as theprobability p of winning some nonlocal game. For example, the Bell inequality for the CHSH game[CHSH69] states that no classical strategy can win the game with probability p > ; we view this asanalogous to the conjectured inability of efficient classical algorithms to solve b -XHOG for any b > p = cos (cid:0) π (cid:1) ≈ . > . An experiment that wins the CHSH game withprobability p > , a violation of the Bell inequality, is analogous to an experimental demonstrationof b -XHOG for b > p ≤ cos (cid:0) π (cid:1) . Hence, an upper bound on b for efficient quantum algorithms is the quantum supremacy counterpart to the Tsirelson inequality.We emphasize that our choice to refer to this as a “Tsirelson inequality” is purely by analogy; wedo not claim that the question involving quantum supremacy or the techniques one might use toanswer it are otherwise related to quantum nonlocal correlations. We study the quantum supremacy Tsirelson inequality in the quantum query (or black box) model.That is, we consider distributions over quantum circuits that make queries to a randomized quantumor classical oracle, and ask how many queries to the oracle are needed to solve b -XHOG, in terms of b . Our motivation for studying this problem in the query model is twofold. First, quantum query2esults often give useful intuition for what to expect in the real world, and can provide insightinto why naive algorithmic approaches fail. Second, we view this as an interesting quantum querycomplexity problem in its own right. Whereas most other quantum query lower bounds involvedecision problems [Amb18] or relation problems [Bel15], XHOG is more like a weighted, average-case relation problem, because we only require that |h z | C | n i| be large on average . Constrast thiswith the relation problem considered in [AC17], where the task is to output a z such that |h z | C | n i| is greater than some threshold.Note that there are known quantum query complexity lower bounds for relation problems[AAB + + The XHOG task is well-defined for any distribution of random quantum circuits, so this givesus a choice in selecting the distribution. We focus on three classes of oracle circuits that eitherresemble random circuits used in practical experiments, or that were previously studied in thecontext of quantum supremacy.
Canonical State Preparation Oracles
Because the linear cross-entropy benchmark for a cir-cuit C depends only on the state | ψ i := C | n i produced by the circuit on the all zeros input,it is natural to consider an oracle O ψ that prepares a random state | ψ i without leaking addi-tional information about | ψ i . Formally, we choose a Haar-random n -qubit state | ψ i , and fix acanonical state |⊥i orthogonal to all n -qubit states. Then, we take the oracle O ψ that acts as O ψ |⊥i = | ψ i , O ψ | ψ i = |⊥i , and O ψ | ϕ i = | ϕ i for any state | ϕ i that is orthogonal to both |⊥i and | ψ i . Equivalently, O ψ is a reflection about the state | ψ i−|⊥i . Finally, we let C be the compositionof O ψ with any unitary that sends | n i to |⊥i , so that C | n i = | ψ i . This model is often chosenwhen proving lower bounds for quantum algorithms that query state preparation oracles (see e.g.[ARU14, AKKT20, BR20]), in part because the ability to simulate O ψ follows in a completely blackbox manner from the ability to prepare | ψ i unitarily without garbage (see Lemma 7 below). Hence,the oracle O ψ is “canonical” in the sense that it is uniquely determined by | ψ i and is not any morepowerful than any other oracle that prepares | ψ i without garbage. Haar-Random Unitaries
A random polynomial-size quantum circuit C does not behave like acanonical state preparation oracle: C | x i looks like a random quantum state for any computationalbasis state | x i , not just x = 0 n . Indeed, random quantum circuits are known to information-theoretically approximate the Haar measure in certain regimes [BHH16, HM18], and it seemsplausible that they are also computationally difficult to distinguish from the Haar measure. Thus,one could alternatively model random quantum circuits by Haar-random n -qubit unitaries. As we will see later, however, the polynomial method [BBC +
01] plays an important role in one of our results. We can always assume that a convenient |⊥i exists by extending the Hilbert space, if needed. For example, if | ψ i is an n -qubit state, a natural choice is to encode | ψ i by | ψ i| i and to choose |⊥i = | n i| i . ourier Sampling Circuits Finally, we consider quantum circuits that query a random classical oracle. For this, we use
Fourier Sampling circuits, which Aaronson and Chen [AC17] previouslystudied in the context of proving oracular quantum supremacy for a problem related to XHOG.
Fourier Sampling circuits are defined as H ⊗ n U f H ⊗ n , where U f is a phase oracle for a uniformlyrandom Boolean function f : { , } n → {− , } . On the all-zeros input, Fourier Sampling cir-cuits output a string z ∈ { , } n with probability proportional to the squared Fourier coefficientˆ f ( z ) . This model has the advantage that we can prove the corresponding quantum supremacy Bellinequality for classical algorithms given query access to f , and that in some cases we can replace f by a pseudorandom function to base quantum supremacy on cryptographic assumptions [AC17].Our first result is an exponential lower bound on the number of quantum queries needed tosolve (2 + ε )-XHOG given either of the two types of quantum oracles that we consider: Theorem 2 (Informal version of Theorem 14 and Theorem 17) . For any ε ≥ n ) , any quantumquery algorithm for (2 + ε ) -XHOG with query access to either:(1) a canonical state preparation oracle O ψ for a Haar-random n -qubit state | ψ i , or(2) a Haar-random n -qubit unitary,requires at least Ω (cid:16) n/ poly( n ) (cid:17) queries. We do not know if Theorem 2 is optimal, but we show in Theorem 15 that a simple algorithmbased on the quantum collision finding algorithm [BHT97] solves (2 + Ω(1))-XHOG using O (cid:0) n/ (cid:1) queries to either oracle.Finally, we show that for Fourier Sampling circuits, the naive algorithm of simply runningthe circuit is optimal among all 1-query algorithms:
Theorem 3 (Informal version of Theorem 19) . Any -query quantum algorithm for b -XHOG with Fourier Sampling circuits achieves b ≤ . The starting point for our proof of the Tsirelson inequality with a canonical state preparationoracle O ψ is a result of Ambainis, Rosmanis, and Unruh [ARU14], which shows that any algorithmthat queries O ψ can be approximately simulated by a different algorithm that makes no queries,but starts with copies of a resource state that depends on | ψ i . This resource state consists ofpolynomially many (in the number of queries to O ψ ) states of the form α | ψ i + β |⊥i , i.e. copies of | ψ i in superposition with |⊥i . Our strategy is to show that if any algorithm solves b -XHOG giventhis resource state, then a similar algorithm solves b -XHOG given copies of | ψ i alone. Then, weprove a lower bound on the number of copies of | ψ i needed to solve b -XHOG. To do so, we argue thatif | ψ i is Haar-random, then the best algorithm for b -XHOG given copies of | ψ i is a simple collision-finding algorithm: measure all copies of | ψ i in the computational basis, and output whichever string Note that the value of b achieved by the naive quantum algorithm for XHOG depends on the class of circuits used.In contrast to Haar-random circuits that achieve b ≈ Fourier Sampling circuits achieve b ≈ complex normal random variables, whereas the amplitudes of a state produced by a random Fourier Sampling circuit are approximately distributed as real normal random variables. ∈ { , } n appears most frequently in the measurement results. For a Haar-random n -qubit state,the chance of seeing any collisions is exponentially unlikely (unless the number of copies of | ψ i isexponentially large in n ), and so this does not do much better than measuring a single copy of | ψ i and outputting the result.To prove the analogous lower bound for b -XHOG with a Haar-random unitary oracle, we showmore generally that the canonical state preparation oracles and Haar-random unitary oracles areessentially equivalent as resources, which may be of independent interest. More specifically, weshow that for an n -qubit state | ψ i , given query access to O ψ , one can approximately simulate (toexponential precision) a random oracle that prepares | ψ i . By “random oracle that prepares | ψ i ,” wemean an n -qubit unitary U ψ that acts as U ψ | n i = | ψ i but Haar-random everywhere else. We canconstruct such a U ψ by taking an arbitrary n -qubit unitary that maps | n i to | ψ i , then composingit with a Haar-random unitary on the (2 n − | n i .Our lower bound for Fourier Sampling circuits uses an entirely different technique. We usethe polynomial method of Beals et al. [BBC + T queries to a classical oracle, the output probabilities of the algorithm can be expressedas degree-2 T polynomials in the variables of the classical oracle. Our key observation is that theaverage linear XEB score achieved by such a quantum query algorithm can also be expressed asa polynomial in the variables of the classical oracle. We further observe that this polynomial isconstrained by the requirement that the polynomials representing the output probabilities must benonnegative and sum to 1. This allows us to upper bound the largest linear XEB score achievableby the maximum value of a certain linear program, whose variables are the coefficients of thepolynomials that represent the output probabilities of the algorithm. To upper bound this quantity,we exhibit a solution to the dual linear program. We use [ N ] to denote the set { , , . . . , N } . We use to denote the identity matrix (of implicit size).We let TD( ρ, σ ) denote the trace distance between density matrices ρ and σ , and let || A || ⋄ denotethe diamond norm of a superoperator A acting on density matrices (see [AKN98] for definitions).For a unitary matrix U , we use U · U † to denote the superoperator that maps ρ to U ρU † . In aslight abuse of notation, if A denotes a quantum algorithm (which may consist of unitary gates,measurements, oracle queries, and initialization of ancilla qubits), then we also use A to denote thesuperoperator corresponding to the action of A on input density matrices. We frequently consider quantum algorithms that query quantum oracles. In this model, a query toa unitary matrix U consists of a single application of either U , U † , or controlled versions of U or U † . We also consider quantum algorithms that make queries to random oracles. In analogue withthe classical random oracle model, such calls are not randomized at each query. Rather, a unitary U is chosen randomly (from some distribution) at the start of the execution of the algorithm, andthereafter all queries for the duration of the algorithm are made to U .We now define several types of unitary oracles that we will use. These definitions (and associatedlemmas giving constructions of them) have appeared implicitly or explicitly in prior work, e.g.5ARU14, AKKT20, BR20, ABC + Definition 4.
For an n -qubit quantum state | ψ i , the reflection about | ψ i , denoted R ψ , is the n -qubit unitary R ψ := − | ψ ih ψ | . In other words, | ψ i is a − R ψ , and all states orthogonal to | ψ i are +1 eigenstates.The following lemma shows that R ψ can be simulated given any unitary that prepares | ψ i fromthe all-zeros state, possibly with unentangled garbage. Lemma 5.
Let U be a unitary that acts as U | n i| m i = | ψ i| ϕ i , where | ψ i and | ϕ i are n - and m -qubit states, respectively. Then one can simulate T queries to the reflection R ψ using T + 1 queries to U .Proof. Consider the unitary U ( − | m + n ih m + n | ) U † . For any n -qubit state | x i , the action of thisunitary on | x i| ϕ i is equivalent to the action of R ψ on | x i| ϕ i . So, we can simulate R ψ as follows:first use one query to U to prepare a copy of | ϕ i . Then, simulate each query to R ψ using a queryto U and U † to perform U ( − | m + n ih m + n | ) U † . (cid:4) Definition 6.
For a quantum state | ψ i , the canonical state preparation oracle for | ψ i , denoted O ψ ,is the reflection about the state | ψ i−|⊥i , where |⊥i is some canonical state orthogonal to | ψ i . Unless otherwise specified, we generally assume that if | ψ i is an n -qubit state, then |⊥i isorthogonal to the space of n -qubit states under a suitable encoding (see Footnote 2).The next lemma shows that O ψ can be simulated from any oracle that prepares | ψ i withoutgarbage: Lemma 7.
Let U be an n -qubit unitary that satisfies U | n i = | ψ i . Then one can simulate T queries to O ψ using T + 2 queries to U .Proof. |⊥i is known, so we may assume that a known unitary V acts as V | n i = |⊥i . Because O ψ is defined as a reflection about | ψ i−|⊥i , by Lemma 5, it suffices to construct a unitary thatprepares any state of the form | ψ i−|⊥i | ϕ i from | n i| m i using 2 queries to U . The following circuitaccomplishes this, with | ϕ i = | i : | n i V U † X ⊗ n • X ⊗ n U | i X H • • X (cid:4) We introduce the notion of a random state preparation oracle, which, to our knowledge, is new.
Definition 8.
For an n -qubit state | ψ i we define a random state preparation oracle for | ψ i , denoted U ψ , as follows. We fix an arbitrary n -qubit unitary V that satisfies V | n i = | ψ i , then choose aHaar-random unitary W that acts on the (2 n − -dimensional subspace orthogonal to | n i in thespace of n -qubit states. Finally, we set U ψ = V W . The invariance of the Haar measure guarantees that this distribution over U ψ is independentof the choice of V , and hence this is well-defined. Note that while we often refer to U ψ as a singleunitary matrix, U ψ really refers to a distribution over unitary matrices. Notice also that if | ψ i is distributed as a Haar-random n -qubit state, then U ψ is distributed as a Haar-random n -qubitunitary. 6 .3 Other Useful Facts We use the following formula for the distance between unitary superoperators in the diamond norm.
Fact 9 ([AKN98]) . Let V and W be unitary matrices, and suppose d is the distance between andthe polygon in the complex plane whose vertices are the eigenvalues of V W † . Then (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) V · V † − W · W (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ = 2 p − d . Finally, we observe that for a Haar-random n -qubit quantum state, the information-theoreticallylargest linear XEB achievable is O ( n ). Fact 10.
Let | ψ i be a Haar-random n -qubit quantum state. Then: E | ψ i h max z |h z | ψ i| i ≤ O ( n )2 n . Proof sketch.
For a Haar-random | ψ i , the probabilities |h z | ψ i| follow a Porter-Thomas distribu-tion [AAB + n in the limit. By a well-known result of R´enyi [R´en53], the maximum of N i.i.d. exponentialrandom variables with mean µ is distributed as P Ni =1 E i i , where E , . . . , E N are i.i.d. exponen-tially distributed with mean µ . In particular, the expected value of the maximum of N i.i.d.exponential random variables with mean µ is H N µ , where H N is the N th harmonic number. So, E (cid:2) max z |h z | ψ i| (cid:3) should approach O ( n )2 n .In reality, the probabilities |h z | ψ i| are distributed according to a Dirichlet distribution (infact, uniform on the 2 n -dimensional probability simplex), which can be sampled from as follows:sample E , E , . . . , E n to be i.i.d. exponential random variables, and set |h z | ψ i| = E z P ni =1 E i . Thesame proof idea still works, essentially because the denominator P n i =1 E i concentrates sufficientlywell. (cid:4) In this section, we prove the quantum supremacy Tsirelson inequality for XHOG with a canonicalstate preparation oracle for a Haar-random state. We first sketch the important ideas in the proof.At the heart of our proof is the following lemma, due to Ambainis, Rosmanis, and Unruh [ARU14].It shows that any quantum algorithm that makes queries to a canonical state preparation oracle O ψ can be approximately simulated by a quantum algorithm that makes no queries to O ψ , and insteadreceives various copies of | ψ i and superpositions of | ψ i with some canonical orthogonal state. Lemma 11 ([ARU14]) . Let A be a quantum query algorithm that makes T queries to O ψ . Thenfor any k , there is a quantum algorithm B that makes no queries to O ψ , and a quantum state | R i of the form: | R i := k O j =1 α j | ψ i + β j |⊥i such that for any state | ϕ i : TD( A ( | ϕ ih ϕ | ) , B ( | R ih R | , | ϕ ih ϕ | )) ≤ O (cid:18) T √ k (cid:19) .
7o long as k ≫ T , the output of B will be arbitrarily close to the output of A in trace distance.We will use this and Fact 10 to show that if A solves b -XHOG for some b >
2, then so does B . Then,to prove a lower bound on the number of queries T to O ψ needed to solve b -XHOG, it sufficies toinstead lower bound k , the number of states of the form α j | ψ i + β j |⊥i needed to solve b -XHOG.When | ψ i is a Haar-random state, notice that the linear XEB depends only on the magnitude of the amplitudes in | ψ i ; the phases are irrelevant. So, when considering algorithms that attemptto solve b -XHOG given only a state | R i of the form used in Lemma 11, we might as well assumethat the algorithm randomly reassigns the phases on | ψ i . More formally, define the mixed state σ R as σ R := E diagonal U h U ⊗ k | R ih R | U †⊗ k i , (1)where the expectation is over the diagonal unitaries U such that the entries h i | U | i i are i.i.d. uni-formly random complex phases (and by convention, h⊥| U |⊥i = 1). Then, the algorithm’s averagelinear XEB score on σ R is identical to its average linear XEB score on | R i , because of the invarianceof the Haar measure with respect to phases.Next, we observe that one can prepare σ R by measuring k copies of | ψ i in the computationalbasis. We prove this in Lemma 12. So, when considering algorithms for XHOG that start with | R i ,it suffices to instead consider algorithms that simply measure k copies of | ψ i in the computationalbasis. Such algorithms are much easier to analyze, because once we have measured the k copies of | ψ i , we can assume (by convexity) that any optimal such algorithm for XHOG outputs a string z deterministically given the k measurement results. And in that case, clearly the optimal strategyis to output whichever z maximizes the posterior expectation of |h z | ψ i| given the measurementresults. We analyze this strategy in Lemma 13, and show that roughly 2 n/ copies of | ψ i are neededto do solve b -XHOG for b bounded away from 2. The intuition is that the posterior expectationof |h z | ψ i| increases only when we see z at least twice in the measurement results. However, theprobability that any two measurement results are the same is tiny—on the order of 2 − n —and sowe need to measure at least 2 n/ copies of | ψ i to see any collisions with decent probability.We now proceed to proving the necessary lemmas. Lemma 12.
Let | ψ i = P Ni =1 ψ i | i i be an unknown quantum state, and consider a state | R i of theform: | R i := k O j =1 α j | ψ i + β j |⊥i , where α j , β j are known for j ∈ [ k ] , and the vectors {| i , | i , . . . , | N i , |⊥i} form an orthonormalbasis. Define the mixed state σ R as above. Then there exists a protocol to prepare σ R by measuring k copies of | ψ i in the computational basis. To give some intuition, we note that it is simpler to prove Lemma 12 in the case where α j = 1for all j . In that case, σ R can be viewed as an N k × N k density matrix where both the rows andcolumns are indexed by strings in [ N ] k . Then, the averaging over diagonal unitaries implies that σ R is obtained from ( | R ih R | ) ⊗ k by zeroing out all entries where the index corresponding to therow is not a reordering of the index corresponding to the column. In fact, one can show that σ R is expressible as a mixture of pure states, where each pure state is a uniform superposition overbasis states that are reorderings of each other. Moreover, the probability associated with each purestate in this mixture is precisely the probability that one of the reorderings is observed when we8easure k copies of | ψ i in the computational basis. So, to prepare σ R , it sufficies to measure | ψ i ⊗ k and then output the uniform superposition over reorderings of the measurement result.The proof of Lemma 12 is similar, but we instead have to randomly set some of the measurementresults to ⊥ with probability | β j | . Proof of Lemma 12.
We first describe the protocol. Define [ N ⊥ ] := [ N ] ∪ {⊥} . Begin by taking themeasurement results to obtain a string x ∈ [ N ] k . Then, sample a string x ∈ [ N ⊥ ] k by setting x j = ( x j with probability | α j | ⊥ with probability | β j | independently for each j ∈ [ k ]. Let Z := { z ∈ [ N ⊥ ] k : z is a reordering of x } . For each z ∈ Z and j ∈ [ k ], define γ zj := ( α j z j = ⊥ β j z j = ⊥ . Finally, prepare and output the state | ζ Z i := P z ∈ Z (cid:16)Q kj =1 γ zj (cid:17) | z i qP z ∈ Z Q kj =1 γ zj γ ∗ zj . (2)This allows us to express the density matrix ρ R output by this protocol as follows: ρ R := X Z ⊂ [ N ⊥ ] k Pr[ Z = Z ] · | ζ Z ih ζ Z | . (3)To complete the proof, we want to show that ρ R = σ R . To see that this holds, first consider anentry h x | σ R | y i of σ R , where x, y ∈ [ N ⊥ ] k . It is equal to h x | σ R | y i = E diagonal U k Y j =1 γ xj γ ∗ yj · Y j : x j = ⊥ U x j x j ψ x j · Y j : y j = ⊥ U ∗ y j y j ψ ∗ y j (4)= h x | R ih R | y i · E diagonal U Y j : x j = ⊥ U x j x j · Y j : y j = ⊥ U ∗ y j y j (5)= ( h x | R ih R | y i x is a reording of y | R i and σ R . In (6),we use the fact that the entries U ii are independent, uniformly random complex units, and so E [ U aii U ∗ bii ] = E [ U a − bii ] is 1 if a = b and 0 otherwise, for positive integers a, b . Also, if i = j , then E [ U aii U ∗ bjj ] = 0 unless a = b = 0.Evidently, h x | ρ R | y i = h x | σ R | y i = 0 whenever x is not a reordering of y , because ρ R is a mixtureof pure states, each of which is a superposition of basis states that are reorderings of one another.So, it remains to show that h x | ρ R | y i = h x | σ R | y i = h x | R ih R | y i whenever x is a reordering of y . Let Z := { z ∈ [ N ⊥ ] k : z is a reordering of x } . Then: h x | ρ R | y i = Pr[ Z = Z ] · h x | ζ Z ih ζ Z | y i (7)9 X z ∈ Z Pr[ x = z ] ! · h x | ζ Z ih ζ Z | y i (8)= X z ∈ Z m Y j =1 γ zj γ ∗ zj Y j : z j = ⊥ ψ z j ψ ∗ z j · Q mj =1 γ xj γ ∗ yj P z ∈ Z Q mj =1 γ zj γ ∗ zj (9)= m Y j =1 γ xj γ ∗ yj · Y j : x j = ⊥ ψ x j ψ ∗ x j (10)= h x | R ih R | y i (11)= h x | σ R | y i . (12)Here, (7) holds because | ζ Z i and | ζ Z ′ i have disjoint support when Z ∩ Z ′ = ∅ ; (8) holds by definitionof Z ; (9) holds by definitions of x and | ζ Z i ; (10) is a simplification; (11) holds by definition of | R i ,and (12) follows from (6), because x was assumed to be a reordering of y . (cid:4) Combining Lemma 11 and Lemma 12, we have reduced the problem of lower bounding thenumber of O ψ queries needed to solve b -XHOG, to lower bounding the number of copies of | ψ i needed to solve b -XHOG. The next lemma lower bounds this latter quantity. Lemma 13.
Let | ψ i be a Haar-random n -qubit quantum state. Consider a quantum algorithm thatreceives as input | ψ i ⊗ k and outputs a string z ∈ { , } n . Then: E | ψ i ,z (cid:2) |h z | ψ i| (cid:3) ≤ n + O ( k )4 n . Proof.
Let | R i = | ψ i ⊗ k . As we have argued above, the algorithm achieves the same linear XEB scoreon average if it instead begins with the mixed state σ R defined in (1), because of the invarianceof the Haar measure with respect to phases. By Lemma 12, the algorithm can prepare σ R bymeasuring | R i in the computational basis. By a convexity argument, we can assume that thealgorithm outputs z deterministically given the measurement results.Suppose the measurement results are z , z , . . . , z k . Clearly, the choice of z that maximizes E (cid:2) |h z | ψ i| (cid:3) is whichever z appears most frequently in z , z , . . . , z k (with ties broken arbitrarily):the probabilities |h i | ψ i| are distributed according to a Dir(1 , , . . . ,
1) distribution, so we can easilycompute the posterior expectations E (cid:2) |h i | ψ i| | z , z , . . . , z k (cid:3) . So, it suffices to bound E (cid:2) |h z | ψ i| (cid:3) for the algorithm that chooses z to be the most frequent measurement result.Let m be a random variable that denotes the frequency of the chosen z . Then E (cid:2) |h z | ψ i| (cid:3) = E (cid:2) E (cid:2) |h z | ψ i| | m (cid:3)(cid:3) (13)= E (cid:20) m n + k (cid:21) (14) ≤ n + E h m n i (15) ≤ n + E (cid:20) P i = j [ z i = z j ]2 n (cid:21) (16)= 22 n + X i = j Pr[ z i = z j ]2 n (17)10 22 n + (cid:18) k (cid:19) n (2 n + 1) (18) ≤ n + O ( k )4 n . (19)Here, (13) is valid by the law of total expectation. (14) substitutes the formula for the posteriorexpectation of a Dirichlet distribution. (15) is valid by linearity of expectation. In (16), we use thecrude upper bound that m is at most one more than the number of pairwise collisions in z , . . . , z k (which is tight when the number of collisions is 0 or 1). (17) is valid by linearity of expectation. (18)expands the sum, and computes the collision probabilities in terms of moments of the underlyingDir(1 , , . . . ,
1) prior distribution. (cid:4)
We note that one should not expect Lemma 13 to be tight for large k (say, k = Ω (cid:0) n/ (cid:1) ). Forexample, to achieve b = 4, we need at least enough samples to see m ≥ m ≥
3] is negligible unless k = Ω (cid:0) n/ (cid:1) . More generally, a tight bound on the numberof copies of | ψ i needed to achieve a particular value of b seems closely related to the number ofmeasurements of | ψ i needed to see m ≥ b −
1. This is like a sort of “balls into bins” problem[JK77, RS98] with k balls and 2 n bins, but where the probabilities associated to each bin follow aDirichlet prior rather than being uniform.We finally have the tools to prove the main result of this section. Theorem 14.
Any quantum query algorithm for (2 + ε ) -XHOG with query access to O ψ for aHaar-random n -qubit state | ψ i requires Ω (cid:16) n/ ε / n (cid:17) queries.Proof. Consider a quantum algorithm A that makes T queries to O ψ and solves (2 + ε )-XHOG.Choose k = c T n ε in Lemma 11 for a constant c to be chosen later. By Lemma 11, there is aquantum algorithm B that makes no queries to O ψ and instead starts with a state | R i (dependingon | ψ i ) such that the trace distance between the output of A and B is at most O (cid:0) εcn (cid:1) for every | ψ i .In particular, if we view | ψ i as fixed, then the total variation distance between the outputs z A and z B of A and B , respectively, (as probability distributions over { , } n ) is at most O (cid:0) εcn (cid:1) . Hence,for every | ψ i , we may write: E z A (cid:2) |h z A | ψ i| (cid:3) − E z B (cid:2) |h z B | ψ i| (cid:3) = n X z =1 |h z | ψ i| · (Pr[ z A = z ] − Pr[ z B = z ]) ≤ n X z =1 |h z | ψ i| · | Pr[ z A = z ] − Pr[ z B = z ] |≤ max z |h z | ψ i| · n X z =1 | Pr[ z A = z ] − Pr[ z B = z ] |≤ max z |h z | ψ i| · O (cid:16) εcn (cid:17) , because the sum in the penultimate inequality is twice the total variation distance between z A and z B . Fact 10 states that for a Haar-random | ψ i , E | ψ i (cid:2) max z |h z | ψ i| (cid:3) ≤ O ( n )2 n . So, for a Haar-random | ψ i , we have E | ψ i ,z A (cid:2) |h z A | ψ i| (cid:3) − E | ψ i ,z B (cid:2) |h z B | ψ i| (cid:3) ≤ O (cid:16) εc n (cid:17) .
11n particular, if we choose c sufficiently large, then B solves (cid:0) ε (cid:1) -XHOG.Because of the invariance of the Haar measure with respect to phases, B still solves (cid:0) ε (cid:1) -XHOG if the pure state | R i is replaced with the mixed state σ R defined in (1). By Lemma 12,this implies the existence of an algorithm that solves (cid:0) ε (cid:1) -XHOG given k copies of | ψ i . ByLemma 13, such an algorithm must satisfy: ε ≤ O ( k )2 n . Plugging in k gives the desired lower bound on T : ε ≤ O (cid:18) T n n ε (cid:19) T ≥ Ω n/ ε / n ! . (cid:4) Lastly, we give an upper bound on the number of queries needed to nontrivially beat the naivealgorithm for XHOG with O ψ . In fact, the following algorithm works with any oracle that preparesa Haar-random state (including a Haar-random unitary), because the algorithm only needs copiesof | ψ i and the ability to perform the reflection R ψ . We thank Scott Aaronson for suggesting thisapproach based on quantum collision-finding. Theorem 15.
There is a quantum algorithm for (2 + Ω(1)) -XHOG that makes O (cid:0) n/ (cid:1) queries toa state preparation oracle for a Haar-random n -qubit state | ψ i .Proof. The quantum algorithm is essentially equivalent to the collision-finding algorithm of Bras-sard, Høyer, and Tapp [BHT97]. We proceed by measuring k = 2 n/ copies of | ψ i in the compu-tational basis, with results z , z , . . . , z k ∈ { , } n . If any string appears twice in z , z , . . . , z k , weoutput the first such collision. Otherwise, we perform quantum amplitude amplification [BHMT02]on another copy of | ψ i , where the “good” subspace is spanned by z , z , . . . , z k . This uses the re-flection R ψ , which can be simulated using a constant number of queries to any oracle that prepares | ψ i (see Lemma 5). Finally, we measure and output the result of the amplitude amplification; callthis result z k +1 . For the purpose of analyzing this algorithm, we say that the algorithm “succeeds”if it either finds a collision in z , z , . . . , z k , or if z k +1 is contained in the good subspace.We first argue that for any | ψ i , O (cid:0) n/ (cid:1) queries to R ψ (for amplitude amplification) are sufficientfor the algorithm to succeed with high probability. For this part of the analysis, we view | ψ i as fixed, and consider only the randomness of the algorithm. Notice that for each 1 ≤ i ≤ k ,Pr (cid:2) |h z i | ψ i| ≥ n +1 (cid:3) ≥ , because at most half of the probability mass of the output distributionof | ψ i can be placed on inputs for which the output probability is less than n +1 , because there areonly 2 n possible outputs. Thus, by a Chernoff bound, we have that:Pr " k X i =1 |h z i | ψ i| ≥ k n +2 ≥ − exp( O ( k )) . In particular, with probability 1 − exp( O ( k )), either the algorithm finds a collision in z , z , . . . , z k ,or else O (cid:16)q n k (cid:17) = O (cid:0) n/ (cid:1) applications of R ψ within the amplitude amplification subroutine12re sufficient to measure a good string with arbitrarily high constant probability. So overall, thealgorithm can be assumed to succeed with arbitrarily high constant probability.Next, we argue that the algorithm outputs a string z such that E (cid:2) |h z | ψ i| (cid:3) ≥ n . Supposethat instead of performing amplitude amplification at the end, we just measured one additionalcopy of | ψ i (still calling the result z k +1 ) and output z k +1 if there were no collisions in z , z , . . . , z k .Then notice that, conditional on this modified algorithm’s success, the expected XEB score is atleast − o (1)2 n . In symbols, we claim that: E (cid:2) |h z | ψ i| | success (cid:3) ≥ n + k + 1for this modified algorithm, because conditional on success, z was observed at least twice in z , z , . . . , z k +1 , so n + k +1 is a lower bound on the posterior expectation of the underlying Dirichletprior distribution on the output probabilities of | ψ i . But now, we claim that E (cid:2) |h z | ψ i| | success (cid:3) isthe same for both the modified algorithm and the original algorithm that uses amplitude amplifica-tion. The reason is that amplitude amplification preserves conditional probabilities: the conditionalprobability distribution of z k +1 is exactly the same in both algorithms, when conditioned on mea-suring in the good subspace. So overall, we have that: E (cid:2) |h z | ψ i| (cid:3) = E (cid:2) |h z | ψ i| | success (cid:3) · Pr[success] + E (cid:2) |h z | ψ i| | failure (cid:3) · Pr[failure] ≥ E (cid:2) |h z | ψ i| | success (cid:3) · Pr[success]= 3 − o (1)2 n · (1 − p ) ≥ n , where p is the arbitrarily small constant failure probability of amplitude amplification. (cid:4) In this section, we show that a canonical state preparation oracle and a random state preparationoracle are essentially equivalent, and use it to prove the quantum supremacy Tsirelson inequalityfor XHOG with a Haar-random oracle.By Lemma 7, for a state | ψ i , query access to a random state preparation oracle U ψ impliesquery access to the canonical state preparation oracle O ψ with constant overhead. The reversedirection is less obvious. We know from the definition of U ψ (Definition 8) that one can simulate U ψ given any n -qubit unitary V that prepares | ψ i from | n i . So, it is tempting to let V = O ψ with |⊥i = | n i to argue that O ψ allows simulating U ψ . However, this is only possible if | n i isorthogonal to | ψ i . And while we previously argued that we can always find a canonical state |⊥i that is orthogonal to | ψ i (Footnote 2), this requires extending the Hilbert space, so that O ψ nolonger acts on n qubits!On the other hand, a random n -qubit state | ϕ i will be nearly orthogonal to | ψ i with over-whelming probability. The next theorem shows that we can use this observation to approximatelysimulate U ψ given O ψ . 13 heorem 16. Let | ψ i be an n -qubit state. Consider a quantum query algorithm A that makes T queries to U ψ . Then there is a quantum query algorithm B that makes T queries to O ψ such that: (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) E U ψ [ A ] − B (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ ≤ T + 42 n/ . Proof.
Without loss of generality, assume |⊥i is orthogonal to all n -qubit states. Let | ϕ i be aHaar-random n -qubit state, and let V be an arbitrary n -qubit unitary that satisfies V | n i = | ϕ i .Write | ϕ i = α | ψ ⊥ i + β | ψ i , where | ψ ⊥ i is some n -qubit state orthogonal to | ψ i , with the phasechosen so that α is real and nonnegative. Note that β = h ψ | ϕ i .Suppose we had an oracle V ′ acting on n qubits such that V ′ | n i = | ψ ⊥ i . Then we couldappeal to Lemma 7 to simulate an oracle O ψ ⊥ that reflects about the state | ψ ⊥ i−|⊥i√ using queriesto V ′ . Then the composition O ψ O ψ ⊥ O ψ would be a reflection about the state | ψ i−| ψ ⊥ i√ , whichin particular means it would act only on the space of n -qubit states. Furthermore, we’d havethat O ψ O ψ ⊥ O ψ V ′ | n i = | ψ i , so we could simulate U ψ perfectly by choosing a random (2 n − W and replacing calls to U ψ with O ψ O ψ ⊥ O ψ V ′ W .Unfortunately, we do not have such an oracle V ′ ; we only have V . However, we can show thatthere exists an oracle V ′ that is close to V , so if we replace all occurrences of V ′ with V , theresulting unitary we get is close to a random state preparation oracle for | ψ i . Specifically, we take R to be a rotation in the 2-dimensional space spanned by | ψ i and | ψ ⊥ i that satisfies R | ϕ i = | ψ ⊥ i .Then, we let V ′ = RV . R is a rotation by angle θ = arccos( α ) in this 2-dimensional subspace, and acts as the identityelsewhere. So, R has eigenvalues e iθ , e − iθ , and 1. The assumption that α ≥ θ ≤ π , so byFact 9, (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) V · V † − V ′ · V ′† (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ = 2 p − cos ( θ ) = 2 sin θ = 2 |h ψ | ϕ i| . (20)Lemma 7 shows that V ′ (or more precisely, controlled- V ′ or its inverse) is used 4 T + 2 times inimplementing T queries to O ψ ⊥ , which means we need 5 T + 2 applications of V ′ to implement T queries to O ψ O ψ ⊥ O ψ V ′ .Let B ψ ⊥ denote the quantum algorithm that simulates A using O ψ O ψ ⊥ O ψ V ′ W (for a randomchoice of W ) in place of U ψ , and let B ϕ denote the quantum algorithm that simulates B ψ ⊥ using V in place of V ′ . Then (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) E U ψ [ A ] − B ϕ (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ = (cid:12)(cid:12)(cid:12)(cid:12) B ψ ⊥ − B ϕ (cid:12)(cid:12)(cid:12)(cid:12) ⋄ (21) ≤ (5 T + 2) (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) V · V † − V ′ · V ′† (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ (22)= (10 T + 4) |h ψ | ϕ i| , (23)where (21) holds because E U ψ [ A ] and B ψ ⊥ are equivalent as superoperators; (22) holds by thesubadditivity of the diamond norm under composition, because B ψ ⊥ queries V ′ a total of 5 T + 2times; and (23) substitutes (20).Finally, let B = E | ϕ i [ B ϕ ] (i.e. run B ϕ for a Haar-random choice of | ϕ i ). Then (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) E U ψ [ A ] − B (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ = (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) E U ψ [ A ] − E | ϕ i [ B ϕ ] (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ (24)14 E | ϕ i "(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) E U ψ [ A ] − B ϕ (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ⋄ (25) ≤ E | ϕ i [(10 T + 4) |h ψ | ϕ i| ] (26)= (10 T + 4) E | ϕ i " P n i =1 |h ψ | i i| n (27) ≤ T + 42 n/ , (28)where (24) holds by the definition of B ; (25) holds by the triangle inequality; (26) substitutes (23);(27) holds by symmetry (the choice of basis is arbitrary); and (28) holds because the 1-norm of an n -qubit quantum state is at most 2 n/ (maximized by a uniform superposition). (cid:4) The above theorem implies that the oracle O ψ in Theorem 14 can be replaced by a Haar-random n -qubit unitary. Theorem 17.
Any quantum query algorithm for (2 + ε ) -XHOG with query access to U ψ for aHaar-random n -qubit state | ψ i (i.e. a Haar-random n -qubit unitary) requires Ω (cid:16) n/ ε / n (cid:17) queries.Proof. Consider a quantum algorithm A that makes T queries to U ψ and solves (2 + ε )-XHOG.Let c be a constant to be chosen later. If T > c n/ εn , then we are done, because we can alwaysassume that ε ≤ O ( n ) (Fact 10), so n/ εn ≥ n/ ε / n for sufficiently large n . In the complementarycase, suppose that T ≤ c n/ εn . By Theorem 16 and the definition of the diamond norm, there is aquantum query algorithm B that makes 2 T queries to O ψ such that the trace distance between theoutput of A (averaged over the choice of U ψ ) and B is at most T +42 n/ ≤ T n/ ≤ cεn for every | ψ i .By an argument involving Fact 10 similar to the one used in the proof of Theorem 14, we concludethat if c is a sufficiently small constant, then B solves (cid:0) ε (cid:1) -XHOG. By Theorem 14, this implies T = Ω (cid:16) n/ ε / n (cid:17) . (cid:4) In this section, we prove the quantum supremacy Tsirelson inequality for single-query algorithmsover
Fourier Sampling circuits.Throughout this section, we let N = 2 n , and let F n := { f : { , } n → {− , }} denote the setof all n -bit Boolean functions. Given a function f ∈ F n , we define the Fourier coefficientˆ f ( z ) := 12 n X x ∈{ , } n f ( x )( − x · z for each z ∈ { , } n . We also define the characters χ z : { , } n → {− , } for each z ∈ { , } n : χ z ( x ) := ( − x · z . Given oracle access to a function f ∈ F n , the Fourier Sampling quantum circuit for f consistsof a layer of Hadamard gates, then a single query to f , then another layer of Hadamard gates, so15hat the resulting circuit samples a string z ∈ { , } n with probability ˆ f ( z ) . In the context ofXHOG, we consider the distribution of Fourier Sampling circuits where the oracle f is chosenuniformly at random from F n . Proposition 18.
Fourier Sampling circuits over n qubits solve (3 − n ) -XHOG.Proof. Because the circuit samples z with probability ˆ f ( z ) , the expected linear XEB score is: E f ∈F n X z ∈{ , } n ˆ f ( z ) = E f ∈F n X z ∈{ , } n \ f · χ z (0 n ) (29)= 2 n E f ∈F n h ˆ f (0 n ) i (30)= 2 n (cid:18) n (cid:19) E h ( B (2 n , / − E [ B (2 n , / i (31)= 3 − n n , (32)where (29) applies the substitution ˆ f ( z ) = \ f · χ z (0 n ); (30) is valid because if f is uniform over F n then so is f · χ z ; (31) uses the fact that n ( ˆ f (0 n ) + 1) is binomially distributed with 2 n trials andsuccess probability ; and (32) uses the formula N p (1 − p )(1 + (3 N − p (1 − p )) for the 4th centralmoment of a binomial distribution with N trials and success probability p . (cid:4) The remainder of this section constitutes the proof of the following theorem, which shows theoptimality of the 1-query algoritm for XHOG with
Fourier Sampling circuits:
Theorem 19.
Any -query algorithm for b -XHOG over n -qubit Fourier Sampling circuits sat-isfies b ≤ − n . To prove Theorem 19, we use the polynomial method of Beals et al. [BBC + T queries to f ∈ F n and outputs a string z ∈ { , } n . Thepolynomial method implies that for each z ∈ { , } n , the probability that the algorithm outputs z can be expressed as a real multilinear polynomial of degree 2 T in the bits of f . We write such apolynomial as: p z ( f ) = X S ⊂{ , } n , | S |≤ T c z,S · Y x ∈ S f ( x ) . Then, the expected XEB score of this quantum query algorithm is given by:12 N X f ∈F n X z ∈{ , } n p z ( f ) · ˆ f ( z ) . (33)Our key observation is that the quantity (33) is linear in the coefficients c z,S . This allows us toexpress the largest XEB score achievable by polynomials of degree 2 T as a linear program, withthe constraints that the polynomials { p z ( f ) : z ∈ { , } n } must represent a probability distribution.Then, the objective value of the linear program can be upper bounded by giving a solution to the16ual linear program. We can write the linear program as follows:max 12 N X f ∈F n X z ∈{ , } n p z ( f ) · ˆ f ( z ) subject to p z ( f ) ≥ f ∈ F n ; z ∈ { , } n X z ∈{ , } n p z ( f ) = 1 for each f ∈ F n c z,S ∈ R for each z ∈ { , } n ; 0 ≤ | S | ≤ T (34)Before giving a solution to (or even writing down) the dual linear program, we will first show thatthe primal linear program can be simplified considerably.We first argue that one can apply a sort of symmetrization to reduce the number of variables.Consider a solution to the linear program (34) in terms of polynomials p z , and define: p ′ z ( f ) = 1 N X y ∈{ , } n p y ⊕ z ( f · χ y ) . Then we claim that the polynomials p ′ z are also a solution to the linear program with the sameobjective value. The intuition is that ˆ f ( z ) = \ f · χ y ( y ⊕ z ), so we might as well assume that theprobability of outputting z on f is the same as the probability of outputting y ⊕ z on f · χ y , byaveraging over the possible choices of y . We verify that the objective value is:1 N N X f ∈F n X z ∈{ , } n p ′ z ( f ) · ˆ f ( z ) = 1 N N X f ∈F n X z ∈{ , } n X y ∈{ , } n p y ⊕ z ( f · χ y ) · ˆ f ( z ) = 1 N N X f ∈F n X z ∈{ , } n X y ∈{ , } n p y ⊕ z ( f · χ y ) · \ f · χ y ( y ⊕ z ) = 1 N N X y ∈{ , } n X f ∈F n X z ∈{ , } n p y ⊕ z ( f · χ y ) · \ f · χ y ( y ⊕ z ) = 12 N X f ∈F n X z ∈{ , } n p z ( f ) · ˆ f ( z ) . The nonnegativity constraint on each p ′ z ( f ) is satisfied by convexity, and the polynomials sum to 1for each f because X z ∈{ , } n p ′ z ( f ) = 1 N X z ∈{ , } n X y ∈{ , } n p y ⊕ z ( f · χ y )= 1 N X y ∈{ , } n X z ∈{ , } n p y ⊕ z ( f · χ y )= 1 N X y ∈{ , } n X z ∈{ , } n p z ( f · χ y )= 1 N X y ∈{ , } n
117 1 . Notice that the p ′ z s satisfy p ′ z ( f ) = p ′ n ( f · χ z ). So, we can rewrite the linear program in terms of p ′ n ( f ) alone. Define p ( f ) = p ′ n ( f ) and define the coefficients of p ( f ) by: p ( f ) = X S ⊂{ , } n , | S |≤ T c S · Y x ∈ S f ( x ) . Now, we can rewrite the linear program (34) in terms of p ( f ) as:max 12 N X f ∈F n X z ∈{ , } n p ( f · χ z ) · ˆ f ( z ) subject to p ( f ) ≥ f ∈ F n X z ∈{ , } n p ( f · χ z ) = 1 for each f ∈ F n c S ∈ R for each 0 ≤ | S | ≤ T (35)We can simplify the objective function of the linear program (35) even further:12 N X f ∈F n X z ∈{ , } n p ( f · χ z ) · ˆ f ( z ) = 12 N X f ∈F n X z ∈{ , } n p ( f · χ z ) · \ f · χ z (0 n ) = 12 N X z ∈{ , } n X f ∈F n p ( f · χ z ) · \ f · χ z (0 n ) = 12 N X z ∈{ , } n X f ∈F n p ( f ) · b f (0 n ) = N N X f ∈F n p ( f ) · ˆ f (0 n ) . Notice that we can also assume p ( f ) = p ( − f ) without loss of generality, because the squared Fouriercoefficient of f is the same as the squared Fourier coefficient of its negation, and because replacing p ( f ) by p ( f )+ p ( − f )2 still satisfies all of the constraints. In particular,we can assume c S = 0 if | S | isodd.Next, we turn to simplifying the equality constraint. Define q ( f ) by: q ( f ) := X z ∈{ , } n p ( f · χ z )= X z ∈{ , } n X | S |≤ T c S · Y x ∈ S f ( x ) · ( − x · y , which is also a multilinear polynomial in f of degree 2 T . Then the equality constraint reads as q ( f ) = 1 for every f ∈ F n . Because q is multilinear, this implies q ( f ) = 1 in fact holds identicallyover all f : { , } n → R , and not just Boolean-valued f . So, the coefficient on the monomial of theset S in q must be 1 if S = ∅ and 0 otherwise. For S empty, we have: X z ∈{ , } n c ∅ = 1 , c ∅ = N . Otherwise, for nonempty S we have: X z ∈{ , } n c S Y x ∈ S ( − x · y = 0 . We can rewrite the equation above as: X z ∈{ , } n c S ( − P x ∈ S x ) · y = 0 . Now, there are two cases: • If L x ∈ S x = 0 n , then the equation holds if and only if c S = 0. • If L x ∈ S x = 0 n , then the terms in the sum are c S half of the time and − c S the other half ofthe time, so the sum always holds.Putting this altogether, we can conclude: • c ∅ = N . • c S = 0 if L x ∈ S x = 0 n . • c S = 0 if | S | is odd. • c S is otherwise unconstrained by q ( f ) = 1.After all of this, our linear program now has the much simpler form:max N N X f ∈F n p ( f ) · ˆ f (0 n ) subject to p ( f ) ≥ f ∈ F n c ∅ = 1 Nc S ∈ R for each 2 ≤ | S | ≤ T with | S | even, ⊕ S = 0 n (36)Alternatively, we can express the linear program (36) purely in terms of the variables c S , ratherthan leaving them implicit in p ( f ). In the objective function, the coefficient on c S is given by: k S := N N X f ∈F n ˆ f (0 n ) · Y x ∈ S f ( x ) . We compute k S depending on the size of S : • If S = ∅ , then k S = N · E h ˆ f (0 n ) i = N · E (cid:20) ˆ f (0 n ) − E h ˆ f (0 n ) i (cid:21) = N · Var h ˆ f (0 n ) i = 1,because for a random f , ˆ f (0 n ) is a sum of 2 n independent ± n variables.19 If S = ∅ , then: k S = N N X f ∈F n n X x ∈{ , } n X x ∈{ , } n f ( x ) f ( x ) Y x ∈ S f ( x )= N N n X x ∈{ , } n X x ∈{ , } n X f ∈F n f ( x ) f ( x ) Y x ∈ S f ( x )= ( N | S | = 20 | S | > , because in the second line, the innermost sum is 0 unless { x , x } = S .So, the final primal linear program takes the form:max c ∅ + 2 N X | S | =2 c S subject to X S c S · Y x ∈ S f ( x ) ≥ f ∈ F n c ∅ = 1 Nc S ∈ R for each 2 ≤ | S | ≤ T with | S | even, ⊕ S = 0 n (37)Standard manipulations reveal the dual linear program of (37):min bN subject to b − X f ∈F n ψ f = 1 − X f ∈F n ψ f Y x ∈ S f ( x ) = 2 N for each | S | = 2 − X f ∈F n ψ f Y x ∈ S f ( x ) = 0 for each 4 ≤ | S | ≤ T with | S | even, ⊕ S = 0 n ψ f ≥ f ∈ F n b ∈ R (38)We now construct a solution to the dual linear program (38) for T = 1 query. Our dual solutionis motivated by complementary slackness, which guarantees that a variable in (38) of the optimaldual solution is nonzero if and only if the corresponding constraint in (37) is tight in the optimalprimal solution. The naive XHOG algorithm solves the primal linear program with p ( f ) = ˆ f (0 n ) ,so p ( f ) = 0 if and only if ˆ f (0 n ) = 0. Thus, if we think that the naive algorithm is optimal, thenwe should look for a dual solution where ψ f is nonzero if and only if ˆ f (0 n ) = 0.For some κ to be chosen later, we choose ψ f = κ if ˆ f (0 n ) = 0 and ψ f = 0 otherwise. In otherwords, we let ψ f = κ · Half N ( f ), where Half N : {− , } N → { , } is the 0-1 indicator of the set offunctions in F n (viewed as N -bit strings) with exaclty N coordinates equal to − ψ f = ψ ( f ) as a function ψ : {− , } N → R , it will be convenient to rewrite theconstraints of the dual linear program in terms of the Fourier coefficients of ψ . We use the innerproduct formula below for Fourier coefficients, with the understanding that we identify a set S ⊆ [ N ]with its characteristic string in { , } N :ˆ ψ ( S ) = 12 N X f ∈{− , } N ψ f Y x ∈ S f ( x ) . Now, the dual linear program reads as:min bN subject to b − N ˆ ψ ( ∅ ) = 12 N ˆ ψ ( S ) = − N for each | S | = 2ˆ ψ ( S ) = 0 for each 4 ≤ | S | ≤ T with | S | even, ⊕ S = 0 n ψ f ≥ f ∈ F n b ∈ R (39)The Fourier coefficients of Half N are well known [O’D14, Theorem 5.19], though they are alsoeasy to compute by hand for sets of small size. For | S | = 2 j , they are given by: \ Half N ( S ) = ( − j (cid:0) N/ j (cid:1)(cid:0) N j (cid:1) · (cid:0) NN/ (cid:1) N . The | S | = 2 equality constraint of the dual linear program (39) implies2 N · κ · \ Half N ( S ) = − Nκ = 12 N · N · (cid:0) N (cid:1)(cid:0) N/ (cid:1) · N (cid:0) NN/ (cid:1) = 4 (cid:0) N (cid:1) N (cid:0) NN/ (cid:1) = 2( N − N (cid:0) NN/ (cid:1) . Plugging this value of κ into the constraint on ˆ ψ ( ∅ ) gives: b − N · κ · \ Half N ( ∅ ) = 1 b = 1 + 2 N · κ · (cid:0) N/ (cid:1)(cid:0) N (cid:1) · (cid:0) NN/ (cid:1) N = 1 + 2 N − N = 3 − N .
This completes the proof, as we have shown a solution to the dual linear program with objectivevalue − N N . We do not know if our lower bounds for b -XHOG with O ψ or U ψ are tight, and it seems probablethat they could be improved. Our lower bounds show that for constant ε , (2 + ε )-XHOG requires21 (cid:16) n/ poly( n ) (cid:17) queries to either oracle, while the best upper bound we know of solves (2 + ε )-XHOGin O (cid:0) n/ (cid:1) queries. One possible approach towards improving the lower bound for b -XHOG with O ψ (and by extension, U ψ ) is to use the polynomial method, as we did for the Fourier Sampling lower bound. Indeed, the output probabilities of an algorithm that makes T queries to O ψ can beexpressed as degree-2 T polynomials in the entries of O ψ . If we write | ψ i = P Ni =1 α i | i i , then theseare polynomials in the amplitudes α , . . . , α N and the conjugates of the amplitudes α ∗ , . . . , α ∗ N .Because of the invariance of the Haar measure with respect to phases, and because the linear XEBscore depends only on the magnitudes of the amplitudes, we can further assume without loss ofgenerality that the output probabilities are polynomials in the variables | α | , . . . , | α N | , whichare equivalently the measurement probabilities of | ψ i in the computational basis. We can alsoassume that these polynomials are homogeneous, because the input variables satisfy P Ni =1 | α i | =1. Like in our Fourier Sampling lower bound, the polynomials are constrained to represent aprobability distribution for all valid inputs. However, unlike the
Fourier Sampling lower bound,this introduces uncountably many constraints in the primal linear program. It may still be possibleto exhibit a solution to the dual linear program if only finitely many of the constraints are relevant(such an approach was used in [BT15], for example).
Acknowledgements
Thanks to Scott Aaronson, Sabee Grewal, Sam Gunn, Robin Kothari, Daniel Liang, Patrick Rall,Andrea Rocchetto, and Justin Thaler for helpful discussions and illuminating insights. This workwas supported by a Vannevar Bush Fellowship from the US Department of Defense.
References [AAB +
19] Frank Arute, Kunal Arya, Ryan Babbush, et al. Quantum supremacyusing a programmable superconducting processor.
Nature , 574(7779):505–510, 2019. URL: https://doi.org/10.1038/s41586-019-1666-5 , doi:10.1038/s41586-019-1666-5 . [pp. 1, 2, 3, 7][ABC +
20] Srinivasan Arunachalam, Aleksandrs Belovs, Andrew M. Childs, RobinKothari, Ansis Rosmanis, and Ronald de Wolf. Quantum Coupon Collec-tor. In Steven T. Flammia, editor, , volume158 of
Leibniz International Proceedings in Informatics (LIPIcs) , pages 10:1–10:17, Dagstuhl, Germany, 2020. Schloss Dagstuhl–Leibniz-Zentrum f¨ur In-formatik. URL: https://drops.dagstuhl.de/opus/volltexte/2020/12069 , doi:10.4230/LIPIcs.TQC.2020.10 . [p. 6][AC17] Scott Aaronson and Lijie Chen. Complexity-theoretic foundations of quantumsupremacy experiments. In Proceedings of the 32nd Computational Complexity Con-ference , CCC 17, Dagstuhl, DEU, 2017. Schloss Dagstuhl–Leibniz-Zentrum fuer Infor-matik. [pp. 3, 4][AG19] Scott Aaronson and Sam Gunn. On the classical hardness of spoofing linear cross-entropy benchmarking, 2019. arXiv:1910.12085 . [p. 2]22AKKT20] Scott Aaronson, Robin Kothari, William Kretschmer, and Justin Thaler. Quan-tum Lower Bounds for Approximate Counting via Laurent Polynomials. InShubhangi Saraf, editor, , volume 169 of
Leibniz International Proceedings in Informatics (LIPIcs) ,pages 7:1–7:47, Dagstuhl, Germany, 2020. Schloss Dagstuhl–Leibniz-Zentrumf¨ur Informatik. URL: https://drops.dagstuhl.de/opus/volltexte/2020/12559 , doi:10.4230/LIPIcs.CCC.2020.7 . [pp. 3, 6][AKN98] Dorit Aharonov, Alexei Kitaev, and Noam Nisan. Quantum circuits with mixed states.In Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing ,STOC 98, page 2030, New York, NY, USA, 1998. Association for Computing Machin-ery. URL: https://doi.org/10.1145/276698.276708 , doi:10.1145/276698.276708 .[pp. 5, 7][Amb18] Andris Ambainis. Understanding quantum algorithms via query complexity. In Proceed-ings of the 2018 International Congress of Mathematicians , volume 3, pages 3249–3270,2018. [p. 3][AMRR11] Andris Ambainis, Lo¨ıck Magnin, Martin Roetteler, and J´er´emie Roland. Symmetry-assisted adversaries for quantum state generation. In , pages 167–177, 2011. [p. 3][ARU14] Andris Ambainis, Ansis Rosmanis, and Dominique Unruh. Quantum attackson classical proof systems: The hardness of quantum rewinding. In
Proceed-ings of the 2014 IEEE 55th Annual Symposium on Foundations of ComputerScience , FOCS 14, page 474483, USA, 2014. IEEE Computer Society. URL: https://doi.org/10.1109/FOCS.2014.57 , doi:10.1109/FOCS.2014.57 . [pp. 3, 4,6, 7][BBC +
01] Robert Beals, Harry Buhrman, Richard Cleve, Michele Mosca, and Ronald de Wolf.Quantum lower bounds by polynomials.
J. ACM , 48(4):778797, July 2001. URL: https://doi.org/10.1145/502090.502097 , doi:10.1145/502090.502097 . [pp. 3, 5,16][Bel64] John Bell. On the einstein-podolsky-rosen paradox. Physics , 1:195–200, Nov1964. URL: https://link.aps.org/doi/10.1103/PhysicsPhysiqueFizika.1.195 , doi:10.1103/PhysicsPhysiqueFizika.1.195 . [p. 2][Bel15] Aleksandrs Belovs. Variations on quantum adversary, 2015. arXiv:1504.06943 . [p. 3][BHH16] Fernando G. S. L. Brand˜ao, Aram W. Harrow, and Micha lHorodecki. Local random quantum circuits are approximate polynomial-designs. Communications in Mathematical Physics , 346(2):397–434, 2016. URL: https://doi.org/10.1007/s00220-016-2706-8 , doi:10.1007/s00220-016-2706-8 . [p. 3][BHMT02] Gilles Brassard, Peter Høyer, Michele Mosca, and Alain Tapp. Quantum amplitudeamplification and estimation. In Quantum Computation and Quantum Information ,23olume 305 of
Contemporary Mathematics , pages 53–74. American Mathematical Soci-ety, 2002. [p. 12][BHT97] Gilles Brassard, Peter Høyer, and Alain Tapp. Quantum cryptanalysis ofhash and claw-free functions.
SIGACT News , 28(2):1419, June 1997. URL: https://doi.org/10.1145/261342.261346 , doi:10.1145/261342.261346 . [pp. 4,12][BR20] Aleksandrs Belovs and Ansis Rosmanis. Approximate unitary t-designs byshort random quantum circuits using nearest-neighbor and long-range gates, 2020. arXiv:2002.06879 . [pp. 3, 6][BT15] Mark Bun and Justin Thaler. Dual lower bounds for approximate degree andmarkov-bernstein inequalities. Inf. Comput. , 243(C):225, August 2015. URL: https://doi.org/10.1016/j.ic.2014.12.003 , doi:10.1016/j.ic.2014.12.003 .[p. 22][CHSH69] John F. Clauser, Michael A. Horne, Abner Shimony, and Richard A. Holt. Pro-posed experiment to test local hidden-variable theories. Phys. Rev. Lett. , 23:880–884, Oct 1969. URL: https://link.aps.org/doi/10.1103/PhysRevLett.23.880 , doi:10.1103/PhysRevLett.23.880 . [p. 2][CHTW04] Richard Cleve, Peter Høyer, Benjamin Toner, and John Watrous. Consequences andlimits of nonlocal strategies. In Proceedings of the 19th IEEE Annual Conference onComputational Complexity , CCC 04, page 236249, USA, 2004. IEEE Computer Society.[p. 2][CT80] Boris Cirel’son (Tsirelson). Quantum generalizations of Bell’s in-equality.
Letters in Mathematical Physics , 4(2):93–100, 1980. URL: https://doi.org/10.1007/BF00417500 , doi:10.1007/BF00417500 . [p. 2][HM18] Aram Harrow and Saeed Mehraban. Approximate unitary t-designs by shortrandom quantum circuits using nearest-neighbor and long-range gates, 2018. arXiv:1809.06957 . [p. 3][JK77] Norman L. Johnson and Samuel Kotz. Urn models and their application: an approachto modern discrete probability theory . Wiley, 1977. [p. 11][LMR +
11] Troy Lee, Rajat Mittal, Ben W. Reichardt, Robert ˇSpalek, and Mario Szegedy. Quan-tum query complexity of state conversion. In
Proceedings of the 2011 IEEE 52ndAnnual Symposium on Foundations of Computer Science , FOCS 11, page 344353,USA, 2011. IEEE Computer Society. URL: https://doi.org/10.1109/FOCS.2011.75 , doi:10.1109/FOCS.2011.75 . [p. 3][LR20] Nathan Lindzey and Ansis Rosmanis. A Tight Lower Bound For Non-Coherent Index Erasure. In Thomas Vidick, editor, , volume 151 of Leib-niz International Proceedings in Informatics (LIPIcs) , pages 59:1–59:37,24agstuhl, Germany, 2020. Schloss Dagstuhl–Leibniz-Zentrum fuer Infor-matik. URL: https://drops.dagstuhl.de/opus/volltexte/2020/11744 , doi:10.4230/LIPIcs.ITCS.2020.59 . [p. 3][O’D14] Ryan O’Donnell. Analysis of Boolean Functions . Cambridge University Press, USA,2014. [p. 21][R´en53] Alfr´ed R´enyi. On the theory of order statistics.