Verification of Many-Qubit States

Verification is a task to check whether a given quantum state is close to an ideal state or not. In this paper, we show that a variety of many-qubit quantum states can be verified with only sequential single-qubit measurements of Pauli operators. First, we introduce a protocol for verifying ground states of Hamiltonians. We next explain how to verify quantum states generated by a certain class of quantum circuits. We finally propose an adaptive test of stabilizers that enables the verification of all polynomial-time-generated hypergraph states, which include output states of the Bremner-Montanaro-Shepherd-type instantaneous quantum polynomial time (IQP) circuits. Importantly, we do not make any assumption that the identically and independently distributed copies of the same states are given: Our protocols work even if some highly complicated entanglement is created among copies in any artificial way. As applications, we consider the verification of the quantum computational supremacy demonstration with IQP models, and verifiable blind quantum computing.

When an experimentalist generates these many-qubit resource states in his or her own laboratory [Fig.1(a)], or when a client of cloud quantum computing receives these resource states from a remote server [Fig.1(b)], it is important to check the correctness of given states [43].More precisely, let us consider the following game between two people, the verifier and the prover [44].The prover sends a certain quantum state Φ to the verifier claiming that it is the tensor product of many copies ρ ⊗k of a many-qubit state ρ.The state ρ is an important resource state for the verifier.For example, ρ is a ground state of a Hamiltonian or a resource state of MBQC.However, the prover is not necessarily trusted, and therefore, the verifier has to check the correctness of the given state.
If Φ is guaranteed to be at least the tensor product of many copies σ ⊗k of the same state σ, i.e., the states are independent and identically distributed (i.i.d.), and if the size of σ is small, the quantum tomography [46] is enough.However, useful resource states are often large-size quantum states, and therefore, the quantum tomography suffers from the exponential blowup.The exponential increase of parameters is somehow mitigated by using the compressed sensing idea, especially for low-rank quantum states [47], but the scaling is, in general, exponential.If we are interested only in the fidelity, by direct fidelity estimation [48] and by using fidelity witnesses [49], we achieve the goal without reconstructing the full state, which is more efficient than quantum tomography.
However, these protocols also assume the i.i.d.property of quantum states.In reality, such an i.i.d.property does not hold.Because of environmental noises, the generated state in a laboratory is not a tensor product of the same states.In cloud quantum computing, moreover, the situation is worse because a malicious prover might generate highly complicated entanglement among samples to fool the verifier.In other words, what the verifier actually receives is not ρ ⊗k but Eðρ ⊗k Þ with a completely positive and trace-preserving (CPTP) map E. If Eðρ ⊗k Þ is a state generated by a wellcontrolled experimental setup, E is a time evolution generated by a physically natural Hamiltonian describing the interaction between the system and the environment.If Eðρ ⊗k Þ is a state given by the server of cloud quantum computing, E can be any CPTP map [50].
In addition to the non-i.i.d.property of samples, another realistic assumption in verifications is that the verifier's ability is severely limited.(In fact, otherwise the verification task would be trivial.For example, if the verifier can generate the correct state by his or herself, the verification is straightforward by doing the SWAP test between the given state and the correct state generated by him or her [51].)If the verifier is severely restrictive, the verification is a highly nontrivial problem.For example, can the verifier verify a highly entangled many-qubit state by measuring each qubit individually?
In summary, a verification protocol should satisfy the following three conditions: (i) It runs in polynomial time.
(ii) The i.i.d.property of samples is not assumed.
(iii) No entangling operation is required for the verifier.Verification protocols that satisfy these three conditions have been proposed for some specific classes of states, such as graph states [52,53] and hypergraph states with low connectivity [54], including the Union Jack state [55].
Here, hypergraph states are generalizations of graph states by replacing the controlled-Z (CZ) gates of graph states with generalized CZ gates.A generalized CZ gate is a unitary gate that flips the phase AE1 if and only if all qubits are j1i.(See Sec.IVA for the definition of hypergraph states.)We say that a hypergraph state has a low connectivity if the connectivity is constant with respect to jVj, where ξ v is the number of generalized CZ gates acting on the vertex v, V is the set of vertices, and jVj is the size of V.These protocols, Refs.[52][53][54], satisfy all the above conditions (i)-(iii).In particular, in these protocols, the verifier only needs sequential single-qubit measurements of Pauli operators.However, these protocols leave the following two problems open: (1) Are there other more general classes of states that are verifiable with only sequential single-qubit measurements of Pauli operators?For example, can we verify ground states of Hamiltonians and states generated by general quantum circuits with sequential single-qubit measurements of Pauli operators?(2) Can we verify hypergraph states with high connectivity by using only sequential single-qubit measurements of Pauli operators?Here, high connectivity means that Eq. ( 1) is polynomial with respect to jVj.The second open problem is important for the verification of the quantum computational supremacy demonstration because output states of the Bremner-Montanaro-Shepherd-type IQP circuits [12] are hypergraph states with high connectivity.(See Sec.V for details.) In this paper, we solve the two open problems by proposing three verification protocols.We first introduce a protocol for verifying ground states of Hamiltonians (Sec.II).We next show a protocol for verifying quantum states generated by a certain class of quantum circuits (Sec.III).As a common technique used in these two verification protocols, we decompose an operator such as a Hamiltonian or a generalized stabilizer into Pauli operators and estimate overlaps between the verified state and Pauli operators.A similar technique was used in the direct fidelity estimation [48].We finally explain a verification protocol for hypergraph states with high connectivity (Sec.IV).For the construction of the third protocol, we propose a novel test, which we call the adaptive stabilizer test, by combining the stabilizer test of Ref. [52] with adaptive classical processing.This adaptivity is the key that enables the verification of hypergraph states with high connectivity.The previous protocol [54] is not enough to verify hypergraph states with high connectivity.The adaptive classical processing we introduce in Secs.IV B and IV C is the key idea to realize a verification protocol for hypergraph states with high connectivity.
The validness of our protocols is demonstrated by showing their completeness and soundness.Roughly speaking, if the verifier accepts the ideal quantum state with high probability, we say that the verification protocol has the completeness.On the other hand, if the protocol guarantees that a quantum state passing the verification protocol is close to the ideal state with high probability, we say that the protocol has the soundness.The precise statements are given later as theorems.
In Sec.V, we discuss applications of our protocols to the verification of quantum computational supremacy demonstrations with the IQP model and its variants.We also consider an application to verifiable blind quantum computing.Sections VI and VII are devoted to the discussion and the conclusion, respectively.
Note that in addition to Refs.[52][53][54] and the present paper, other papers have proposed verification protocols for quantum computational supremacy demonstrations.Hangleiter et al. have proposed a polynomial-time verification protocol for ground states of frustration-free Hamiltonians [56].A disadvantage of this protocol when it is used for the verification of quantum computing is that the Feynman-Kitaev history state [24,57] corresponding to the quantum circuit, which is more complicated than the mere output state of the circuit, has to be generated.Furthermore, their verification protocol requires multiqubit measurements.Based on the verification protocol of Ref. [56], Gao et al. [14] and Bermejo-Vega et al. [15] have proposed verification protocols for quantum computational supremacy demonstrations of their architectures.Miller et al. [16] have proposed a polynomial-time verification protocol for the output states of the Bremner-Montanaro-Shepherd-type IQP circuits [12].Their protocol is a special case of our third protocol when the target state is restricted to hypergraph states.With respect to the boson sampling model [4], a verification protocol has already been proposed [58], but this protocol requires at most exponentially many copies of a verified quantum state.As a common drawback of all these protocols [14][15][16]56,58], they assume the i.i.d.property of samples.
All verification protocols introduced above and our present protocols require the ability of the verifier to make measurements.On the other hand, there are complement protocols where a verifier is required to prepare quantum states [59,60].The protocol in Ref. [59] uses trap qubits [61,62] to perform verified quantum computational supremacy demonstrations for an Ising sampler [14] or an IQP circuit [10][11][12], and does not assume the i.i.d.property.The protocol in Ref. [60] can verify that the server has the ability to sample from an IQP circuit.For some experimental setups, measurements are easier than preparations, and vice versa for other experimental setups.Therefore, at this moment, we do not know which approach is better.

II. VERIFICATION OF GROUND STATES OF HAMILTONIANS
In this section, we explain our verification protocol for ground states of Hamiltonians.In Sec.II A, we define a test.In Sec.II B, we explain how to verify ground states by using the test.

A. Test
Let H be an N-qubit Hamiltonian.We want to verify its ground state corresponding to the ground energy E 0 .Let Δð> 0Þ be a lower bound of the energy gap, i.e., E 1 − E 0 ≥ Δ, where E 1 is the first excitation energy.From H, we define a rescaled Hamiltonian Since H 0 is Hermitian, if we decompose H 0 in the Pauli basis as σ ijj ∈ fI; X; Y; Zg, and τ 0 ≡ I ⊗N .From Eq. ( 2), the ground energy of H 0 is 0. Accordingly, Hereafter, we consider Hamiltonians that satisfy the following three conditions: (i) The probability distribution from fjc i j=Rg h i¼0 can be sampled exactly in polynomial time.Here, R≡ P h i¼0 jc i j. (ii) R ¼ O(polyðNÞ).
(iii) R is known or can be computed in polynomial time.Condition (i) is necessary to perform the test defined in the next paragraph.Condition (ii) is required to extract the information of Tr½ρH 0 from p pass in Eq. ( 5) using only the polynomial number of quantum states ρ.Condition (iii) is needed to define the accept or reject criteria in Eq. ( 6).Note that it is obvious that for the usual Hamiltonians in condensed matter physics, such as Ising models and Heisenberg models, these conditions are satisfied if the energy gap is constant or polynomially decays.On the other hand, if the energy gap exponentially decays, then condition (ii) is not satisfied.In fact, for a Hamiltonian The test on an N-qubit quantum state ρ is defined as follows: The verifier selects i with probability jc i j=R.If the verifier selects i, the verifier measures the jth qubit of ρ in the Pauli basis σ ijj .Let m j ∈ f1; −1g be the outcome of the measurement on the jth qubit.Note that if σ ijj ¼ I, the verifier sets m j ¼ 1.We say that the verifier passes the test on ρ if Here, sgnð•Þ is the sign function.
The expected probability p pass that the verifier passes the test on ρ, where the expectation is taken over the sampling of i, is where we have used Eqs.( 4) and (3) to derive the second and the last equalities, respectively.Note that in order to relate p pass to Tr½ρH 0 , i ¼ 0 is included in the test.

B. Verification
In this subsection, we propose a verification protocol for ground states based on the test explained in the previous subsection.Our protocol runs as follows: (1) The prover sends the verifier an , and each register stores N qubits.If the prover is honest, the prover sends the tensor product of the ideal state.On the other hand, if the prover is malicious, the prover sends an Nðk þ m þ 1Þ-qubit, completely arbitrary, quantum state instead of the tensor product of the ideal state.(2) The verifier chooses m registers uniform randomly and discards them to guarantee that the remaining Nðk þ 1Þ-qubit state ρ 0 B is close to an i.i.d.sample by using the quantum de Finetti theorem [63].Next, the verifier chooses one register-which we call the target register, whose state is ρ tgt -uniform randomly and uses it for the verifier's purpose.The verifier performs the test on each of the remaining k registers [see Fig. 2(b)].Let K pass be the number of times that the verifier passes the test.If we say that the verifier accepts the prover, where 0 < ϵ < 1 is specified later.Note that since the random selection is equivalent to random permutation of registers, ρ B becomes permutation invariant after the random selection in step 2. Accordingly, we can use the quantum de Finetti theorem [63].This idea comes from Ref. [54].Hereafter, we consider the case where ϵ ¼ 1=ð4N 2 Þ, m ≥ 2N 5 k 2 log 2, and k ≥ 32R 2 N 5 are satisfied.In this case, the following theorems hold.
Theorem 1 (Completeness).If the prover is honest, i.e., the state of each register is a ground state of H, the probability that the verifier accepts the prover is larger than 1 − e −N .
Proof.-When the state of each register is a ground state of H, p pass ¼ 1=2.Because of the Hoeffding inequality, If the prover is honest, the state of each register is the ideal quantum state.On the other hand, if the prover is malicious, registers may be entangled with each other.(b) A quantum state in step 2. Randomly chosen black registers are discarded, and then the remaining m blue registers and one green register become close to i.i.d.samples because of the quantum de Finetti theorem [63].Randomly chosen m blue registers are used for the test.The green register is the target state ρ tgt .
Pr½the verifier accepts the prover If the verifier accepts the prover, the state ρ tgt of the target register satisfies with a probability larger than 1 − 1=N.Here, Π is the projector onto the ground-energy eigenspace of H, and we consider the case where N ≠ 2.
Proof.-Let Π ⊥ ≡ I ⊗N − Π, and T be the positiveoperator-valued-measure (POVM) element corresponding to the event where the verifier accepts the prover.When N ≠ 2, we can show that for any N-qubit state ρ, Its proof is given later.Because of the quantum de Finetti theorem [for the fully one-way local operations and classical communication (LOCC) norm] [63] and Eq. ( 7), Here, μ is a probability measure on ρ.We have This means that if the verifier accepts the prover, with a probability larger than 1 − 1=N.
To complete the proof, we show Eq.(7).First, we consider the case where Tr½H 0 ρ ≤ 2ϵ.Let fjE 0 i i; E 0 i g i be the set of excited eigenstates of H 0 and their eigenvalues.

VERIFICATION OF QUANTUM STATES GENERATED BY A CERTAIN CLASS OF QUANTUM CIRCUITS
In this section, we explain our second verification protocol, namely, the protocol for quantum states generated by a certain class of quantum circuits.In Sec.III A, we explain a stabilizer test.In Sec.III B, we show the verification protocol based on the stabilizer test.

A. Stabilizer test
Let us assume that we want to verify the quantum state jψi ≡ Ujþi ⊗N , where jþi ≡ ðj0i þ j1iÞ= ffiffi ffi 2 p , and U is a certain N-qubit unitary operator whose properties are specified later.The ith stabilizer g i of jψi is defined by where X i is performed on the ith qubit of jψi.Note that g i is not necessarily a tensor product of Pauli operators, and therefore, it should be considered as a "generalized stabilizer."From Eq. ( 10), Since g i is Hermitian, if we decompose g i in the Pauli basis as j is a real number, where and σ jjk ∈ fI; X; Y; Zg.Hereafter, we consider the U that satisfies the following three conditions: (i) The probability distribution from fjc ðiÞ j j=R i g j can be sampled exactly in polynomial time.Here, R i ≡ P j jc ðiÞ (iii) R i is known or can be computed in polynomial time for all i.Condition (i) is necessary to perform the stabilizer test defined in the next paragraph.Condition (ii) is required to extract the information of Tr½ρg i from p pass ðiÞ in Eq. ( 11) using only the polynomial number of quantum states ρ.Condition (iii) is needed to define the accept or reject criteria in Eq. (12).
The stabilizer test for g i on ρ is defined as follows: The verifier selects j with probability jc ðiÞ j j=R i .The verifier measures the kth qubit of ρ in the Pauli basis σ jjk .Let m k ∈ f1; −1g be the outcome of the measurement on the kth qubit.Note that if σ jjk ¼ I, the verifier sets m k ¼ 1.We say that the verifier passes the stabilizer test for g i on ρ if Since quantum states satisfying the above three properties include graph states and hypergraph states with low connectivity as special cases, our stabilizer test can be considered as a generalization of previous stabilizer tests [52,54].
The expected probability p pass ðiÞ that the verifier passes the stabilizer test for g i on ρ, where the expectation is taken over the sampling of j, is

B. Verification
In this subsection, we propose a verification protocol for jψi ¼ Ujþi ⊗N .Our protocol runs as follows: (1) The prover sends the verifier an registers, and each register stores N qubits.If the prover is honest, the prover sends jψi ⊗Nkþmþ1 .On the other hand, if the prover is malicious, the prover sends an NðNk þ m þ 1Þ-qubit, completely arbitrary, quantum state instead of jψi ⊗Nkþmþ1 .(2) The verifier chooses m registers uniform randomly and discards them to guarantee that the remaining NðNk þ 1Þ-qubit state ρ 0 B is close to an i.i.d.sample by using the quantum de Finetti theorem [63].Next, the verifier chooses one register-which we call the target register, whose state is ρ tgt -uniform randomly and uses it for the verifier's purpose.The remaining Nk registers are divided into N groups such that which register is assigned to the ith group is uniformly random.The verifier performs the stabilizer test for g i on every register in the ith group.Let K i be the number of times that the verifier passes the stabilizer test for g i .If we say that the verifier passes the stabilizer test for the ith group, where 0 < ϵ < 1 is specified later.If the verifier passes the stabilizer test for all i, we say that the verifier accepts the prover.Hereafter, we consider the case where ϵ ¼ 1=ð2N 3 Þ, m ≥ 2N 7 k 2 log 2, and k ≥ 8R 2 N 7 are satisfied.In this case, the following theorems hold.
Theorem 3 (Completeness).If the prover is honest, i.e., the state of each register is jψi, the probability that the verifier accepts the prover is larger than 1 − Ne −N .
Proof.-When the state of each register is jψi, Because of the union bound and the Hoeffding inequality, Pr½the verifier accepts the prover If the verifier accepts the prover, the state ρ tgt of the target register satisfies with a probability larger than 1 − 1=N.Here, we consider the case where N ≠ 2.
Proof.-Let Π ⊥ be the N-qubit projector I ⊗N − jψihψj, and T be the POVM element corresponding to the event where the verifier accepts the prover.When N ≠ 2, we can show that for any N-qubit state ρ, Its proof is given later.Because of the quantum de Finetti theorem (for the fully one-way LOCC norm) [63] and Eq. ( 13), Here, μ is a probability measure on ρ.We have This means that if the verifier accepts the prover, with a probability larger than 1 − 1=N.
To complete the proof, we show Eq. ( 13).First, we consider the case where Tr½g i ρ ≥ 1-2ϵ is satisfied for all i.From the union bound, Next, we consider the case where Tr½g i ρ < 1-2ϵ is satisfied for at least one i.In this case, for the i 0 that satisfies Tr½g i 0 ρ < 1-2ϵ, Therefore, because of the Hoeffding inequality, From Eqs. ( 14) and ( 15), when N ≠ 2,

VERIFICATION OF HYPERGRAPH STATES
Although the verification protocol proposed in Sec.III can verify hypergraph states with low connectivity, it cannot verify hypergraph states with high connectivity.To verify hypergraph states with high connectivity, we now explain our third protocol, which uses a new adaptive stabilizer test.In Sec.IVA, we review the definition of hypergraph states.In Sec.IV B, we explain our basic idea with a simple example.In Sec.IV C, we define the adaptive stabilizer test in a general form.In Sec.IV D, we explain how to verify hypergraph states with high connectivity by using the adaptive stabilizer test.

A. Hypergraph states
In this subsection, we review the definition of hypergraph states [64] and their properties.A hypergraph G ≡ ðV; EÞ is a pair of a set V of vertices and a set E of hyperedges, where a hyperedge is a set of vertices.We define N ≡ jVj.The hypergraph state jGi corresponding to the hypergraph G is defined by where f CZ e is the generalized CZ gate acting on vertices in e; i.e., it is the gate that flips the phase AE1 if all qubits in e are j1i.Since a hypergraph has at most 2 N − 1 hyperedges, the time required to generate a hypergraph state is at most Oð2 N Þ.However, in many quantum-information processing protocols, only quantum states that can be generated in polynomial time are used.To focus on such efficiently generatable quantum states, we assume that 2 ≤ jej ≤ c for all e ∈ E, where jej is the size of e.Here, cð≥ 3Þ is a constant integer.The size jEj of E is then polynomially upper bounded: The ith stabilizer g i of jGi (i ¼ 1; 2; …; N) is defined by where X i is the Pauli-X operator acting on the ith qubit.We can show the useful relation which is derived by applying Q e∈E f CZ e from both the right and the left on both sides of the trivial equation and by using Eq. ( 16).

B. Simple example
Before introducing the general formalism of our adaptive stabilizer test, here we briefly explain our basic idea with a simple example.Let us consider the three-qubit hypergraph state, where j−i ≡ ðj0i − j1iÞ= ffiffi ffi 2 p .From the definition Eq. ( 16), its stabilizers are calculated as The adaptive stabilizer test for g 1 on a three-qubit quantum state ρ proceeds as follows: (1) The verifier measures the first qubit of ρ in the X basis.Let x 1 ∈ f1; −1g be the measurement result.(2) The verifier measures the second and third qubits in the Z bases.Let z j ∈ f1; −1g (j ¼ 2, 3) be the measurement result for the jth qubit.(3) If z 2 ¼ 1 and x 1 ¼ 1, the verifier accepts.If z 2 ¼ −1 and x 1 z 3 ¼ 1, the verifier accepts.Otherwise, the verifier rejects.It is easy to check that the acceptance probability p pass of this test is (The intuitive idea is illustrated in Fig. 3.When z 2 ¼ 1, the three-qubit hypergraph state jGi becomes jþi 1 ⊗ jþi 3 .When z 2 ¼ −1, it becomes the two-qubit graph state that is stabilized by X 1 Z 3 .)Therefore, the correct state jGi passes the test with probability 1.We will see later that the estimation of p pass (and therefore the estimation of Tr½g 1 ρ) is possible in our verification protocol.With respect to g 2 and g 3 , a similar argument holds.

C. Adaptive stabilizer test
For general polynomial-time-generated hypergraph states, we define the adaptive stabilizer test for g i using the idea explained above.Let V ¼ fv 1 ; v 2 ; …; v N g and E ¼ fe 1 ; e 2 ; …; e jEj g.The generalized CZ gate acting on vertices fv ðjÞ 1 ; v ðjÞ 2 ; …; v ðjÞ je j j g that are connected by the jth hyperedge e j can be written as ð17Þ where ða ∈ f0; 1gÞ.From Eq. ( 16), the ith stabilizer g i of jGi can be calculated as where W ði;jÞ CZ ≡ fṽ ðjÞ jðv i ; ṽðjÞ Þ ¼ e j g: Here, E 0 ð⊆ EÞ is a set of hyperedges that connect more than two vertices, and ṽðjÞ ≡ ṽðjÞ 1 ; …; ṽðjÞ je j j−1 is a shorthand notation.By substituting Eq. ( 17) into Eq.( 18), ð19Þ where WðiÞ P ≡ ∪ ṽðjÞ ∈W ðiÞ CZ fṽ ðjÞ gnfṽ ðjÞ je j j−1 g; ð20Þ Here, a ðjÞ ≡ fa ṽðjÞ values of all elements of a are given and WðiÞ P is known, the time required to calculate the rhs of Eq. ( 21) is at most OðN c−1 Þ. Accordingly, we can derive α ði;aÞ , Wði;aÞ Z , and WðiÞ P in classical polynomial time.
The adaptive stabilizer test for g i on an N-qubit quantum state ρ is defined as follows: The verifier measures the ith qubit of ρ that corresponds to the vertex v i in the X basis, and each of the other qubits of ρ in the Z basis, respectively.Let x i ∈ f1; −1g be the outcome of the X-basis measurement, and z i 0 ∈ f1; −1g be the outcome of the Z-basis measurement on the i 0 th qubit.Then, the verifier calculates WðiÞ P .From WðiÞ P and measurement outcomes, the verifier knows the values of a.We say that the verifier passes the adaptive stabilizer test for g i on ρ if Note that the adaptiveness is not needed in the special case of graph states because W ðiÞ CZ ¼ ∅.The expected probability p pass ðiÞ that the verifier passes the adaptive stabilizer test for g i on ρ, where the expectation is taken over the sampling of a, is where We have used Eq. ( 19) to derive the last equality.
Let us explain why our adaptive stabilizer test can verify hypergraph states with high connectivity, while our second protocol (Sec.III) and the previous protocol [54] cannot.For the nonadaptive stabilizer test (Sec.III), the probability p pass ðiÞ of passing the stabilizer test for g i is given in Eq. (11).If R i ¼ O( expðNÞ), exponentially many tests are required to distinguish p pass ðiÞ from 1=2, which means that no polynomial-time verification is possible.On the other hand, since R i does not appear in Eq. ( 22), such a problem does not occur for the adaptive stabilizer test.

D. Verification
In this subsection, we propose a verification protocol for hypergraph states based on the adaptive stabilizer test explained in the previous subsection.Our protocol runs as follows: (1) The prover sends the verifier an registers, and each register stores N qubits.If the prover is honest, the prover sends jGi ⊗Nkþmþ1 .On the other hand, if the prover is malicious, the prover sends an NðNk þ m þ 1Þ-qubit, completely arbitrary, quantum state instead of jGi ⊗Nkþmþ1 .(2) The verifier chooses m registers uniform randomly and discards them to guarantee that the remaining NðNk þ 1Þ-qubit state ρ 0 B is close to an i.i.d.sample by using the quantum de Finetti theorem [63].Next, the verifier chooses one register-which we call the target register, whose state is ρ tgt -uniform randomly and uses it for the verifier's purpose.The remaining Nk registers are divided into N groups such that which register is assigned to the ith group is uniformly random.The verifier performs the adaptive stabilizer test for g i on every register in the ith group.Let K i be the number of times that the verifier passes the adaptive stabilizer test for g i .If we say that the verifier passes the adaptive stabilizer test for the ith group, where 0 < ϵ < 1 is specified later.If the verifier passes the adaptive stabilizer test for all i, we say that the verifier accepts the prover.When the prover is honest, i.e., the prover sends jGi ⊗Nkþmþ1 to the verifier, the verifier accepts him with probability 1, which is obvious from Eq. ( 22).This means that our verification protocol has the completeness.Hereafter, we consider the case where ϵ ¼ 1=ð4Nk 2=7 Þ, m ≥ 2N 3 k 18=7 log 2, and k ≥ ð4NÞ 7 are satisfied.In this case, the following theorem holds.
Theorem 5 (Soundness).If the verifier accepts the prover, the state ρ tgt of the target register satisfies with a probability larger than 1 − k −1=7 .
Proof.-Let Π ⊥ be the N-qubit projector I ⊗N − jGihGj, and T be the POVM element corresponding to the event where the verifier accepts the prover.We can show that for any N-qubit state ρ, Its proof is given later.Because of the quantum de Finetti theorem (for the fully one-way LOCC norm) [63] and Eq. ( 24), Here, μ is a probability measure on ρ.We have This means that if the verifier accepts the prover, with a probability larger than 1 − k −1=7 .
To complete the proof, we show Eq. ( 24).First, we consider the case where Tr½g i ρ ≥ 1-4ϵ for all i.Because of the union bound, Next, we consider the case where Tr½g i ρ < 1-4ϵ is satisfied for at least one i.In this case, for the i 0 that satisfies Tr½g i 0 ρ < 1-4ϵ, Therefore, because of the Hoeffding inequality, From, Eqs. ( 25) and (26), In this section, we discuss applications of our protocols to the verification of quantum computational supremacy demonstrations with IQP circuits and its variants, and verifiable blind quantum computing.
First, we discuss the verification of quantum computational supremacy demonstrations with IQP circuits.An Nqubit IQP circuit is the following restricted quantum circuit: (i) The initial state is j0i ⊗N .
(ii) The N-qubit unitary H ⊗N DH ⊗N is applied, where H is the Hadamard gate, and D is a quantum circuit consisting of a polynomial number of Z-diagonal gates, such as Z, CZ, and e iθZ .(iii) Finally, each qubit is measured in the computational basis.The IQP model does not seem to be universal, but it is known that the output probability distributions of the IQP model cannot be classically efficiently sampled with a constant multiplicative error unless the polynomial-time hierarchy (PH) collapses to the third level [11] or the second level [8].Here, we say that a probability distribution fp z g z is sampled with a multiplicative error ϵ if jp z − q z j ≤ ϵp z for all z, where q z is the probability that the classical sampler outputs z.
Recently, Bremner, Montanaro, and Shepherd [12] have shown that, assuming a certain unproven conjecture, the no-go result can be generalized to the l 1 -norm error sampling, which is more realistic.Here, we say that a probability distribution fp z g z is sampled with an l 1 -norm error ϵ if X z jp z − q z j ≤ ϵ; where q z is the probability that the classical sampler outputs z.More precisely, they have shown the following theorem.
Theorem 6 (Ref.[12]).Assume the below conjecture is true.If it is possible to classically sample from the output probability distribution of any IQP circuit in polynomial time, up to an error of 1=192 in l 1 norm, then there is a BPP NP algorithm to solve any problem in P #P .Hence, the PH would collapse to its third level.
Here, complexity classes BPP, NP, P, and #P are abbreviations of bounded-error probabilistic polynomial time, nondeterministic polynomial time, polynomial time, and sharp P, respectively.
Importantly, the theorem holds for the IQP model that uses only Z, CZ, and CCZ gates, where CCZ is the controlled-controlled-Z gate defined as The theorem therefore shows the hardness for the sampling of the probability distribution of the X-basis measurement outcomes on hypergraph states.In other words, if the verifier generates a hypergraph state in his or her laboratory or receives it from a remote server, the verifier can demonstrate the quantum computational supremacy.However, one problem is that what the verifier receives deviates from the ideal hypergraph state because of the experimental imperfections or the server's dishonesty.The verifier therefore has to verify the correctness of the state, where the verification task becomes important.
In Ref. [12], all gates, Z, CZ, and CCZ, are applied uniformly random.The anticoncentration lemma, which is essential for their proof, is satisfied when Z and CZ gates are applied uniformly random, but Conjecture 1, which is often called "average case vs worst case hardness conjecture," seems to be more plausible when the application of CCZ gates is also uniformly random.In other words, the hypergraph states generated by the IQP circuits of Ref. [12] can have high connectivity.
Our third protocol can verify such hypergraph states with high connectivity.From Theorem 5, we can guarantee that which means for any POVM fM x g x .Here, k • k is the trace norm.In particular, if we take the POVM as the X-basis measurements, where p z is the probability of obtaining the outcome zð∈ f0; 1g N Þ when jGi is measured in the X bases, and p 0 z is the probability of obtaining the outcome z when ρ tgt is measured in the X bases: Assume that fp 0 z g z is classically efficiently sampled with the l 1 -norm error 1=193: ; where q z is the probability that a classical sampler outputs z.Then, which causes the collapse of the PH according to Theorem 6.
In conclusion, the probability distribution of the X-basis measurement outcomes on the verified state ρ tgt through our third protocol cannot be classically efficiently sampled with the l 1 -norm error.Similarly, our third protocol can also be used to verify variants of the IQP model such as those introduced in Refs.[13][14][15][16]23].
Recently, several other verification protocols for IQP circuits have also been proposed.For example, Hangleiter et al. have proposed a polynomial-time verification protocol [56] using the Feynman-Kitaev history state [24,57] corresponding to the quantum circuit Q L i¼1 U i with an initial state jϕ 0 i, where U 0 ¼ I.In their protocol, the prover sends the Feynman-Kitaev history state to the verifier.Since the Feynman-Kitaev history state is, in general, more complicated than the mere output state ð Q L i¼1 U i Þjϕ 0 i, their protocol is more demanding for the prover than ours.Their protocol is also more demanding for the verifier because multiqubit measurements are necessary for the verifier.Moreover, their protocol assumes the i.i.d.property of samples unlike ours.Miller et al. have proposed another polynomial-time verification protocol for IQP circuits [16].Although the prover in their protocol only has to generate hypergraph states like our protocol, their protocol also assumes the i.i.d.property of samples.Averification protocol proposed in Ref. [54] does not assume any i.i.d.property of samples, but the protocol cannot be used for hypergraph states with high connectivity because exponentially many quantum states are required to distinguish the probability of passing a test from 1=2, which means that no polynomialtime verification is possible.Accordingly, this protocol cannot be used to verify the Bremner-Montanaro-Shepherd-type IQP circuits of Ref. [12].
As another application, our verification protocol for hypergraph states can also be used to construct a verifiable blind quantum computing protocol in a similar way to Ref. [54].Since the Union Jack state [55], which is a hypergraph state, is a universal resource state for MBQC with only adaptive single-qubit measurements of Pauli operators, the client is required to perform only single-qubit Pauli measurements.

VI. DISCUSSION
We have seen that if the honest prover sends the correct state to the verifier, the verifier accepts it with high probability.However, in reality, it is not easy for the verifier to receive the perfectly ideal state: Imperfections in the prover's machine and noises in the channel from the prover to the verifier change the state even if the prover is honest.In this section, we point out that even if the state is slightly deviated from the ideal one, the verifier still accepts with high probability.In other words, our protocols are robust to some extent.We also discuss possibilities of using the quantum error correction.
To understand our argument, let us consider a simple example.Assume that the verifier receives the slightly deviated state instead of jGihGj ⊗Nkþmþ1 , where 0 < ϵ 0 < 1, jGi is the ideal hypergraph state, and η is any state.The trace distance between the deviated state and the ideal state is and therefore, if ϵ 0 ¼ Oð1=polyÞ, the deviated state is still useful for the quantum computational supremacy demonstration.This means that the deviated state should also be accepted by the verifier with high probability.In fact, our protocol accepts it with high probability.From Eq. ( 22), for each i ¼ 1; 2; …; N. Therefore, the probability that the verifier accepts the deviated state is approaches 1 asymptotically.For simplicity, in the above example, we have considered the tensor product of the same states, Eq. ( 27), but it is easy to confirm that a similar argument holds even if the tensor product state is replaced with a slightly entangled state.
In this way, we have seen that our protocols are robust to some extent.However, we have to mention that our protocols are not perfectly fault tolerant.For example, let us consider the state ðZ 1 ⊗ I ⊗N−1 ÞjGi; where only the first qubit of the ideal hypergraph state is phase flipped.Such a state should also be accepted with high probability because such a tiny error can be easily corrected with a quantum error correction; thus, the corrected state is a useful resource state for the verifier.However, it is also easy to check that our protocols cannot accept such a state with high probability because such a state is stabilized by −g 1 , where g 1 is the first stabilizer of the ideal state jGi.
A solution to the problem is to ask the prover to send the encoded version of jGi with the Calderbank-Shor-Steane (CSS) code [65,66].(This means that the prover encodes each qubit of jGi into a logical qubit with the CSS code.)A great advantage of our protocols is that only Pauli measurements are required for the verifier.Since in the CSS code logical Pauli measurements can be done with the transversal physical Pauli measurements, the verifier can do the verification and the syndrome measurements with only physical single-qubit Pauli measurements; i.e., no entangling gate is required for the verifier.
In Refs.[67,68], more elaborated methods have been proposed.Instead of physically encoding states, the prover sends special states, such as the Raussendorf-Harrington-Goyal (RHG) topological graph state [69], so that the verifier can do the topological quantum error correction with only physical single-qubit Pauli measurements.Unfortunately, such a scheme is known only for graph states, and at this moment, we do not know how to generalize it to hypergraph states.If a similar scheme is found for hypergraph states, we can apply it to our verification protocols so that the verifier can accept a broad class of deviated but topologically correctable states with high probability.
With respect to other verification protocols for ground states of Hamiltonians and output states of quantum circuits, a similar argument holds from Eqs. ( 6) and (12).

VII. CONCLUSION
In this paper, we have proposed verification protocols for ground states of Hamiltonians, quantum states generated by a certain class of quantum circuits, and all polynomialtime-generated hypergraph states.As applications of our verification protocols, we have considered the verification of IQP circuits and its variants, and verifiable blind quantum computing.
As an outlook, let us finally provide several open problems.First, our verification protocol for ground states of Hamiltonians requires knowledge of, for example, the ground energy and energy gap.It is, in general, QMA-hard to know these quantities, and therefore, it is an important open problem whether or not a protocol that does not use this knowledge exists.If it exists, it is desirable to invent such a protocol.More precisely, it is unknown whether or not the conditions (i)-(iii) for the Hamiltonian in Sec.II can be relaxed.Related to this open problem, it is interesting to consider the physical relevance of the conditions.This is also the case for our second verification protocol, namely, the verification protocol for quantum circuits.It is an important open problem to find physical meaning of conditions (i)-(iii) for the circuit and to relax these conditions.
Second, it would be useful to consider verification protocols for other quantum states such as weighted graph states, Y ði;jÞ∈E e iθ ij Z i Z j jþi ⊗N ; and higher-dimensional quantum states including the continuous-variable ones.Here, E is a set of edges, and θ ij ∈ R.
Those states are important resources in quantum information and condensed matter physics [27,70].Finally, with respect to the verification of quantum computational supremacy demonstrations, it would be interesting to explore good verification protocols for subuniversal circuits other than the IQP, such as the DQC1 model [6][7][8][9], the boson sampling model [4], the depth-four model [71], the Fourier sampling model [17], and the conjugated Clifford model [21].

FIG. 1 .
FIG. 1.The prover-verifier game considered in this paper.(a) An experimentalist (verifier) wants to verify the correctness of a state Φ from the experimental setup (prover).(b) In cloud quantum computing of the type of Ref. [45], a client (verifier) asks a remote server (prover) to generate and send a certain quantum many-qubit state Φ.The client wants to verify the correctness of the state sent from the server.

FIG. 2 .
FIG. 2. (a)The quantum state ρ B in step 1.Each rectangle represents a register that stores N qubits, and ρ B consists of k þ m þ 1 registers.If the prover is honest, the state of each register is the ideal quantum state.On the other hand, if the prover is malicious, registers may be entangled with each other.(b) A quantum state in step 2. Randomly chosen black registers are discarded, and then the remaining m blue registers and one green register become close to i.i.d.samples because of the quantum de Finetti theorem[63].Randomly chosen m blue registers are used for the test.The green register is the target state ρ tgt .
When the FIG.3.A quantum state after the Z 2 -basis measurement on jGi.