Restricted quantum computation

The first BQC protocol is widely attributed to Childs,27 who introduced an interactive protocol which allowed a user with restricted quantum capabilities to perform universal quantum computation with the aid of a second party possessing a universal quantum computer (Fig. 3a), while keeping the specifics of the computation hidden. In the scenario originally considered, the client had a large quantum memory with the ability to rearrange qubits and to perform Pauli operations, but lacked the ability to perform non-Pauli gates and to perform measurements. The ability to perform Pauli gates allowed the client to encrypt qubits using a quantum one-time pad (i.e. applying a random Pauli to each qubit) before sending them to the server. The client selects a qubit or qubits to perform an operation on, applies a random quantum one-time pad, and transmits them to the server. The server then applies the desired operation before returning the qubits to the client. When encoded in this way, measurements made by the server revealed no information about the state of the encoded qubit, but can be decoded by the client using the one-time pad key. Furthermore, Clifford group gates can be applied by the server directly onto the encrypted state provided that the client update their encryption key. This is due to the fact that given a Clifford group operator C, a multi-qubit Pauli operator σ and and quantum state |ψ〉, \(C\sigma \left| \psi \right\rangle = \sigma 'C\left| \psi \right\rangle \) where \(\sigma ' = C\sigma {C^\dag }\). The procedure for implementing non-Clifford group gates is a little more involved. Consider the result of the server applying the gate \(T = \left| 0 \right\rangle \left\langle 0 \right| + {e^{i\frac{\pi }{4}}}\left| 1 \right\rangle \left\langle 1 \right|\) to a state encrypted with a quantum one-time pad given by the Pauli operator σ. If σ commutes with T, then trivially Tσ|ψ〉 = σT|ψ〉 and the gate has been successfully applied on the encrypted state. If however σ does not commute with T, then it is because σ contains either an X or Y term corresponding to the qubit on which T is being applied. In this case Tσ|ψ〉 = σT †|ψ〉. While this is not the desired result, it is possible to make a correction by applying the gate S = T 2, which is in the Clifford group and hence can be applied deterministically by the server using the previous procedure. One caveat is that if the server is only requested to apply an S gate following a T gate if σ does not commute with T on the chosen qubit, then information about the encoded state is revealed. In order to avoid this scenario, following each T gate the server must always be requested to perform an S gate. In the case where S is unnecessary, the client simply chooses an ancillary qubit for it to be performed on. Since the qubit is returned to the client between each step, and the one-time pad renewed, there is no mechanism for the server to distinguish between the two cases. As these operations together are sufficient for approximately-universal quantum computation, the client can thus make use of the server to implement an arbitrary quantum computation without revealing their state. This can be extended to hide the full computation by requiring that the server always implement a fixed order of gates (say Hadamard, CNOT, T, S) where the client simply choses to have unwanted gates applied to an ancillary pair of qubits.

A notable feature of this protocol is that the quantum resources required of the client depends on the computation being performed. Furthermore, while Childs discussed the issue of verification, noting that the computation could be verified by a classical client if it resulted in a witness for an instance of a problem in NP and speculating on the use of tomography on a subset of gates as a mechanism for keeping a memoryless server honest, the protocol did not provide a general mechanism for verifying the correctness of general computation. Subsequent work has sought to both reduce the requirements on the client and to ensure verifiability of the computation. Specifically, an alternate approach taken by Aharanov, Ben-Or and Eban in the context of developing interactive proofs for BQP, which shifts the memory requirement to the server.12 In the ABE protocol, the client is used to prepare the initial state for the computation, encoded using a polynomial code introduced in ref. 28, which amounts to a quantum authentication scheme.29 This can be done logical qubit by logical qubit, and so the size of the client’s device need not scale as a function of the number of qubits in their chosen computation, but can be as low as 3 qubits (Fig. 3b). The algebraic structure of the encoding allows for the server to implement Clifford gates transversally, provided that the client update their encryption key, and so by making use of gate teleportation using magic states prepared by the client it is possible to implement an approximately universal gate set. Just as in the case of Childs’ protocol, the encoding hides the client’s input state only. However, by making use of a fixed programmable unitary, similar to that used in the composable security definitions discussed earlier, this can be leveraged into a BQC protocol, hiding not only the input but also the intended computation. Furthermore, the use of an authentication code ensures that the computation can be verified with constant probability of error.

Fig. 3 a An illustration of the BQC setting considered by Childs.27 In this scenario, the client has a large quantum memory together with the ability to perform Pauli operations on qubits and to transmit them to the server. However they lack the ability to perform other gates, such as Toffoli or Hadamard gates. b An illustration of the setting considered by Aharonov, Ben-Or and Eban,12 in which the client has access to a quantum computer capable of performing arbitrary operations on a constant number of qubits Full size image

State preparation

While the approaches described in the previous section do allow a client with limited quantum capabilities to harness the power of a larger quantum computer, they require reasonably sophisticated apparatus on the client’s side. As we shall see, it is possible to further reduce the complexity of the client’s device. The universal blind quantum computing protocol (UBQC) introduced in ref. 10 manages to hide arbitrary quantum circuits with a client only capable of preparing certain single qubit quantum states. Rather than directly implementing a computation as a series of gates applied to a fixed register of qubits, the UBQC protocol implements the desired circuit as a measurement-based computation.

In order to understand how the UBQC protocol works, it is first necessary to understand how a computation can be expressed in the measurement-based model. In measurement-based quantum computation (MBQC), a quantum computation is expressed as a sequence of single-qubit measurements to be performed on a fixed resource state.32 These resource states are known as graph states, due to their correspondence to simple graphs. The resource state corresponding to a particular graph G can be determined as the output of a circuit specified as follows. For each vertex in G, prepare a qubit in the state \(\left| + \right\rangle = \frac{1}{{\sqrt 2 }}\left( {\left| 0 \right\rangle + \left| 1 \right\rangle } \right)\). Then, for each edge e in G, apply a controlled-phase gate between the qubits corresponding to the vertices joined by e. Since the controlled-phase gates necessarily commute, the state produced by the circuit is independent of the order of these operations. While the original resource states studied in the context of MBQC were cluster states,33, 34 the graph for which corresponds to a regular square lattice, the UBQC protocol made use of a different resource state known as a brickwork state, illustrated in Fig. 4. The reason for this was that the initial insight underlying the UBQC protocol allowed the hiding of only measurements which projected onto states in the XY-plane of the Bloch sphere. Until very recently cluster states were not known to be universal without the addition of Z-basis measurements, and so a resource state was constructed which required only XY-plane measurements. Recent results proving the universality of cluster states with only XY-plane measurements imply that the UBQC protocol could be trivially modified to use such states.35 For simplicity, in discussing how MBQC implements a computation, we will consider only the case of the brickwork state. Readers interested in a more thorough introduction to this model of computation are referred to ref. 36.

Fig. 4 The structure of measurement-based computation using the brickwork state as the resource. a The brickwork state underlying the UBQC protocol.10 The same resource state has previously been considered in ref. 30. Logical qubits propagate along horizontal chains of vertices from right to left. These can be thought of as corresponding to wires in a quantum circuit diagram, with each vertex corresponding to the application of a single qubit gate, and vertical edges corresponding to controlled-phase gates between neighbouring qubits. The graph of the resource state is constructed from a regular tiled unit cell. b Possible choices for measurements within the unit cell giving rise to arbitrary single qubit rotations on each logical qubit or to a CNOT gate. c A two qubit teleportation circuit which can be used to understand the propagation of logical qubits along the horizontal chains indicated in A when qubits are measured in the X basis. d A modified version of the two qubit teleportation protocol which can be used to understand the effect of measurements in arbitrary bases in the XY-plane when propagating logical qubits through the graph, as discussed in ref. 31 Full size image

In a measurement-based computation performed on a brickwork state, the planar nature of the underlying graph has a natural interpretation in terms of the circuit model. Each row of vertices, together with the edges connecting them, corresponds to a single logical qubit which is propagated from left to right by a sequence of measurements, as shown in Fig. 4a. The initial state of each such logical qubit is |+〉 and initially the state can be thought of as residing at the leftmost vertex in the chain. Each measurement in a basis B θ = cos(2θ)X + sin(2θ)Y has the effect of propagating the logical qubit on vertex to the right and applying the operator X m HR Z (θ), where R Z (θ) = cosθI + sinθZ and m∈{0, 1} is the outcome of the measurement. This is a consequence of a rotated version of the two-qubit teleportation protocol illustrated in Fig. 4c, d.30, 31 The presence of the teleportation byproduct X m means that subsequent measurement angles need to be adapted to negate this byproduct in order to achieve deterministic computation. Thus the measurement bases will in general depend on the outcomes of previous measurements as well as the intended logic gate they correspond to, a dependency formalised for general graphs by the notion of flow.37 The only remaining element unaccounted for, then, are vertical edges in the graph. These can be seen as controlled-phase gates between logical qubits which occur when both logical qubits have been propagated onto the vertices linked by a vertical edge. Measurement of the rightmost qubit in each row corresponds to a measurement of the final state of the computation. Taken together, these two elements can be combined to perform more common universal gate sets such as arbitrary local unitary operations and CNOTs as shown in Fig. 4b.

UBQC was the first protocol to take advantage of measurement-based computation in the context of blind computation. It achieves blindness by effectively hiding the measurement bases for a measurement-based computation on a fixed resource state. The UBQC protocol, depicted in Fig. 5, proceeds as follows. The client first encodes their computation as a sequence of measurements at angles ϕ i , chosen from the set \(A = \left\{ {0,\frac{\pi }{4},\frac{{2\pi }}{4}, \ldots ,\frac{{7\pi }}{4}} \right\}\), in the XY-plane on a brickwork state of dimensions N × M, proportional to the dimensions of the quantum circuit corresponding to the desired computation. The client then prepares and sends NM single qubit states \(\left| {{\psi _i}} \right\rangle = \frac{1}{{\sqrt 2 }}\left( {\left| 0 \right\rangle + {{( - 1)}^{{r_i}}}{e^{i\theta_i }}\left| 1 \right\rangle } \right)\), where r i and θ i are chosen uniformly at random from the sets {0, 1} and A, respectively and transmits them to the server. The server arranges these in a two dimensional grid of N × M qubits and entangled them with controlled-phase gates according to the brickwork graph. The computation then proceeds in rounds in which the qubits are measured sequentially, in a fixed order (going from top to bottom, left to right). In the ith round, the client sends a measurement angle \({\delta _i} = {\phi '_i} - {\theta _i}\) to the server, who measures qubit i in this basis and returns the resulting outcome b i to the client. Here \({\phi '_i}\) denotes updated measurement angle for qubit i adapted from ϕ to account for previous teleportation byproducts. The client then decodes this outcome to obtain a new bit m i = b i ⊕r i , which they take to be the true outcome of the measurement. This entire procedure can be seen to be equivalent to the original measurement-based computation chosen by the client since rotations about the Z axis commute with the entangling operations and hence the θ i terms included in the state preparation and measurement angle cancel. Furthermore, the effect of r i is equivalent to applying a Z operation to the initial state, which commutes with the entangling operations but anti-commutes with the measurement operator, and hence results in a bit flip on the outcome of the measurement result b i , which is undone in the computation of m i . It is easy to see that the UBQC protocol satisfies the conditions of the first blindness definition introduced in Section II by noting that only |ψ i 〉 depends on r i , and as these values are random, and a priori unknown to the server, the density matrix for the state received by the server is always maximally mixed, and so fixed and independent of θ i . Thus only δ i is dependent on θ i , which is chosen uniformly at random from the same set as ϕ i and is a priori unknown to the server, and hence it too is uniformly random and independent of ϕ i or \({\phi '_i}\). As such, the distribution of messages sent to the server, when averaged over choices of the random variables {r 1 ,…,r NM } and {θ 1 ,…,θ NM } is fixed as the maximally mixed distribution. Blindness under this first definition was proved in ref. 10 while security under the stronger composable definition proved in ref. 19. It is worth noting that while the resource state requires NM qubits, due to the commutation of operations involving non-neighbouring qubits, not every qubit needs to be present in the initial state. Indeed, by postponing each controlled-phase operation as long as possible, it is possible to implement this protocol using only N + 1 qubits.

Fig. 5 A depiction of the Universal Blind Quantum Computation (UBQC) protocol introduced in ref. 10. The client prepares random single qubit states which are then sent to the server to be entangled. For each qubit in turn, the client computes a measurement angle which is sent to the server, which returns the result to the client for inclusion in the calculation of subsequent measurement angles Full size image

While the original paper introduced a mechanism for verifying the delegated computation based on the use of ancillary ‘trap’ qubits randomly interspersed with the target computation (see Fig. 2a), the analysis of verification given in ref. 10 was incomplete. Subsequently a modified verification technique was proposed based on using physical qubits rather than logical qubits as traps (see Fig. 2b) and proven to suppress arbitrary deviations from the protocol by the server.21 The modified BQC protocol also introduced new functionality, making it possible to incorporate hidden Z-basis measurements within a measurement pattern, and allowing for the entanglement graph to be hidden. This modified protocol also satisfies the composable security definitions for perfect blindness (i.e. 0-blindness) and ϵ-blind-verifiability discussed in Section II for exponentially small ϵ.17 The UBQC protocol can also be used as a method to remotely prepare the states used in the ABE protocol, resulting in a hybrid protocol which requires only single qubit state preparations.38

Measurement

An alternate take on the use of MBQC for blind computation was proposed by Morimae and Fujii,11 which changed the role of the client from state preparation to measurement. They noted that if the client were capable of making the adaptive single-qubit measurements necessary to drive a measurement-based computation on a fixed graph state, then a BQC protocol could be achieved by having the server feed the resource state to the client, one qubit at a time, as depicted in Fig. 6. Such a scheme is trivially blind, since the direction of communication is always from server to client, and has been shown to satisfy composable security definitions.17, 39 This approach to blind computation can be thought of as dual to the UBQC approach, due to the fact that in quantum mechanics there is a symmetry under post-selection between preparation and measurement. As a result, fault-tolerance constructions are interchangeable between the two settings, and trap-based verification techniques have been successfully adapted to this setting.22 Furthermore, the fact that the server is required only to prepare a fixed state has lead to new approaches to verification based on directly testing that this state has been prepared using stabiliser measurements.40, 41

Fig. 6 A depiction of the BQC approach considered by Morimae and Fujii,11 in which the client performs adaptive measurements on a sequence of qubits sent to them by the server. By having the server send the client a universal resource state one qubit at a time, the client can implement an arbitrary computation without ever sending information to the server beyond the initial graph description (Fig. 6) Full size image