Authors Andrea Coladangelo, Alex B. Grilo, Stacey Jeffery, Thomas Vidick,
License CC-BY-3.0
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87
www.theoryofcomputing.org
Verifier-on-a-Leash: New Schemes for
Verifiable Delegated Quantum
Computation, with Quasilinear Resources
Andrea Coladangelo∗ Alex B. Grilo† Stacey Jeffery‡
Thomas Vidick§
Received June 4, 2019; Revised February 15, 2022; Published September 3, 2024
Abstract. The problem of reliably certifying the outcome of a computation
performed by a quantum device is rapidly gaining relevance. We present two
protocols for a classical verifier to verifiably delegate a quantum computation to two
non-communicating but entangled quantum provers, with statistical soundness. Our
protocols have near-optimal complexity in terms of the total resources employed by
the verifier and the honest provers, with the total number of operations of each party,
including the number of entangled pairs of qubits required of the honest provers,
scaling as 𝑂(𝑔 log 𝑔) for delegating a circuit of size 𝑔. This is in contrast to previous
protocols, whose overhead in terms of resources employed, while polynomial, is far
A conference version of this paper appeared in the Proceedings of the 48th Ann. Internat. Conf. on Theory and
Appl. of Cryptographic Techniques (EUROCRYPT 2019).
∗ Supported by AFOSR YIP award number FA9550-16-1-0495 and by the Simons Institute for the Theory of
Computing under a Quantum Postdoctoral Fellowship.
† Part of this work was performed when AG was affiliated to IRIF, CNRS/University of Paris, where he was
supported by ERC QCC and part of this work was performed when AG was affiliated to CWI and QuSoft, where we
has partially supported by ERC Consolidator Grant 615307-QPROGRESS.
‡ Supported by an NWO Veni Innovational Research Grant under project number 639.021.752; an NWO WISE
Grant; an NWO Klein Grant under project number OCENW.KLEIN.061; and the CIFAR Quantum Information
Science Program.
§ Supported by NSF CAREER Grant CCF-1553477, MURI Grant FA9550-18-1-0161, AFOSR YIP award number
FA9550-16-1-0495, and the IQIM, an NSF Physics Frontiers Center (NSF Grant PHY-1125565) with support of the
Gordon and Betty Moore Foundation (GBMF-12500028).
© 2024 Andrea Coladangelo, Alex B. Grilo, Stacey Jeffery and Thomas Vidick
c b Licensed under a Creative Commons Attribution License (CC-BY) DOI: 10.4086/toc.2024.v020a003
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
beyond what is feasible in practice. Our first protocol requires a number of rounds
that is linear in the depth of the circuit being delegated, and is blind, meaning
neither prover can learn the circuit or its input. The second protocol is not blind, but
requires only a constant number of rounds of interaction.
Our main technical innovation is an efficient rigidity theorem that allows a verifier
to test that two entangled provers perform measurements specified by an arbitrary
𝑚-qubit tensor product of single-qubit Clifford observables on their respective
halves of 𝑚 shared EPR pairs, with a robustness that is independent of 𝑚. Our two-
prover classical-verifier delegation protocols are obtained by combining this rigidity
theorem with a single-prover quantum-verifier protocol for the verifiable delegation
of a quantum computation, introduced by Broadbent (Theory of Computing, 2018).
ACM Classification: F.1.3, G.3
AMS Classification: 68Q15, 81P68
Key words and phrases: quantum computing, quantum interactive proofs, delegated computa-
tion, nonlocal games
1 Introduction
Quantum computers hold the potential to speed up a wide range of computational tasks (see,
for example, [31]). Recent progress towards implementing limited quantum devices has added
urgency to the already important question of how a classical verifier can test a quantum device.
This verifier could be an experimentalist running a new experimental setup; a consumer who
has purchased a purported quantum device; or a client who wishes to delegate some task
to a quantum server. In all cases, the user would like to exert some form of control over the
quantum device. For example, the experimentalist may think that she is testing that a particular
experiment prepares a certain quantum state by performing a series of measurements, i. e., by
state tomography, but this assumes some level of trust in the measurement apparatus being
used. For a classical party to truly test a quantum system, that system should be modeled in
a device-independent way, having classical inputs (e. g., measurement settings) and classical
outputs (e. g., measurement results).
Tests of quantum mechanical properties of a system first appeared in the form of Bell tests
[4, 10]. In a Bell test, a verifier asks classical questions to a quantum-device and receives
classical answers. These tests make one crucial assumption on the system to be tested: that it
consists of two spatially isolated components that are unable to communicate throughout the
experiment. One can then upper bound the value of some statistical quantity of interest subject
to the constraint that the two devices do not share any entanglement. Such a bound is referred
to as a Bell inequality. While the violation of a Bell inequality can be seen as a certificate of
entanglement, the area of self-testing, first introduced in [27], allows for the certification of much
stronger statements, including which measurements are being performed, and on which state.
Informally, a robust rigidity theorem is a statement about which kind of apparatus, quantum state
and measurements, must be used by a pair of isolated devices in order to succeed in a given
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 2
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
statistical test. Following a well-established tradition, we will refer to such tests as games, call
the devices players (or provers), and the quantum state and measurements that they implement
the strategy of the players. A rigidity theorem is a statement about the necessary structure of
near-optimal strategies for a game.
In 2012, Reichardt, Unger and Vazirani proved a robust rigidity theorem for playing a
sequence of 𝑛 CHSH games [37]. Aside from its intrinsic interest, this rigidity theorem had
two important consequences. One was the first device-independent protocol for quantum
key distribution. The second was a protocol whereby a completely classical verifier can test
a universal quantum computer consisting of two non-communicating devices. The resulting
protocol for delegating quantum computations has received a lot of attention as the first classical-
verifier delegation protocol. The task is well-motivated: for the foreseeable future, making use
of a quantum computer will likely require delegating the computation to a potentially untrusted
cloud service, such as that provided by IBM [8].
Unfortunately, the complexity overhead of the delegation protocol from [37], in terms of both
the number of EPR pairs needed for the provers and the overall time complexity of the provers
as well as the (classical) verifier, while polynomial, is prohibitively large. Although the authors
of [37] do not provide an explicit value for the exponent, in [20] it is estimated that their protocol
requires resources that scale like Ω(𝑔 8192 ), where 𝑔 is the number of gates in the delegated circuit
(notwithstanding the implicit constant, this already makes the approach thoroughly impractical
for even a 2-gate circuit!). The large overhead is in part due to a very small (although still inverse
polynomial) gap between the completeness and soundness parameters of the rigidity theorem;
this requires the verifier to perform many more Bell tests than the actual number of EPR pairs
needed to implement the computation, which would scale linearly with the circuit size.
Subsequent work has presented significantly more efficient protocols for achieving the same,
or similar, functionality [28, 17, 20]. We refer to Table 1 for a summary of estimated lower
bounds on the complexity of each of these results (these estimates were computed in [20]). Prior
to our work, the best two-prover delegation protocol required resources scaling like 𝑔 2048 for
delegating a 𝑔-gate circuit. Things improve significantly if we allow for more than two provers,
however, the most efficient multi-prover delegation protocols still required resources that scale
as at least Ω(𝑔 4 log 𝑔) for delegating a 𝑔-gate circuit on 𝑛 qubits. Since we expect that in the
foreseeable future most quantum computations will be delegated to a third-party server, even
such small polynomial overhead is unacceptable, as it already negates the quantum advantage
for a number of problems, such as quantum search.
The most efficient classical-verifier delegation protocols known [13, 14, 35], with poly(𝑛)
and 7 provers, respectively, require resources that scale as 𝑂(𝑔 3 ), but this efficiency comes at
the cost of a technique of “post-hoc” verification. In this technique, the provers must learn
the verifier’s input even before they are separated, so that they can prepare the history state
for the computation.1 As a result, these protocols are not blind2. Other articles such as [21],
1Using results of Ji [24], this allows the protocol to be single-round. Alternatively, the state can be created by a
single prover and teleported to the others with the help of the verifier, resulting in a two-round protocol.
2Blindness is a property of delegation protocols, which informally states that the prover learns nothing about the
verifier’s private circuit.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 3
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Provers Rounds Total Resources Blind
RUV 2012 [37] 2 poly(𝑛) ≥ 𝑔 8192 yes
McKague 2013 [28] poly(𝑛) poly(𝑛) ≥ 2153 𝑔 22 yes
GKW 2015 [17] 2 poly(𝑛) ≥ 𝑔 2048 yes
HPDF 2015 [20] poly(𝑛) poly(𝑛) Θ(𝑔 4 log 𝑔) yes
Verifier-on-a-Leash Protocol (Section 4) 2 𝑂(depth) Θ(𝑔 log 𝑔) yes
Dog-Walker Protocol (Section 5) 2 𝑂(1) Θ(𝑔 log 𝑔) no
Table 1: Resource requirements of various delegation protocols in the multi-prover model. We
use 𝑛 to denote the number of qubits and 𝑔 the number of gates in the delegated circuit. “depth”
refers to the depth of the delegated circuit. “Total Resources” refers to the gate complexity
of the provers, the number of EPR pairs of entanglement needed, and the number of bits of
communication in the protocol. To ensure fair comparison, each protocol is required to produce
the correct answer with probability 99%. For all protocols except our two new protocols, this
requires a polynomial number of sequential repetitions, which is taken into account when
computing the total resources.
achieve two-prover verifiable delegation with complexity that scales like 𝑂(𝑔 4 log 𝑔), but in
much weaker models; for example, in [21] the provers’ private system is assumed a priori to be
in tensor product form, with well-defined registers. General techniques are available to remove
the strong assumption, but they would lead to similar large overhead as previous results.
In contrast, in the setting where the verifier is allowed to have some limited quantum power,
such as the ability to generate single-qubit states and measure them with observables from a small
finite set, efficient schemes for blind verifiable delegation do exist [2, 15, 32, 7, 22, 33, 14, 16, 34]
(see also [12] for a recent survey). In this case, only a single prover is needed, and the most
efficient single-prover quantum-verifier protocols can evaluate a quantum circuit with 𝑔 gates with
resources scaling as 𝑂(𝑔) (e. g., [7]). The main reason these protocols are much more efficient
than the classical-verifier multi-prover protocols is that they avoid the need for directly testing
any of the qubits used by the prover, instead requiring the trusted verifier to directly either
prepare or measure the qubits used for the computation.
Recently, another model has been considered where the classical verifier delegates her
quantum computation to a single quantum prover [25, 18]. The protocols proposed in this
setting are computationally secure, i. e., the security of the protocol rests on the assumption that
the prover cannot solve an (expected to be) hard problem for quantum computers (specifically,
the Learning with Errors problem).
New delegation protocols. In this article, we propose verifiable two-prover delegation protocols
that overcome the prohibitively large resource requirements of all previous multi-prover
protocols. We describe two new two-prover classical-verifier protocols in which the complexity
(in terms of number or EPR pairs used and time) of verifiably delegating a 𝑔-gate quantum
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 4
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
circuit solving a BQP problem scales as 𝑂(𝑔 log 𝑔).3
We achieve our protocols by adapting the efficient single-prover quantum-verifier delegation
protocol introduced by Broadbent [7] (we refer to this as the “EPR protocol”), which has the
advantage of offering a direct implementation of the delegated circuit, in the circuit model
of computation and with very little modification needed to ensure verifiability, as well as an
elegantly simple and intuitive analysis.
Our first protocol is blind, and requires a number of rounds of interaction that scales linearly
with the depth of the circuit being delegated. The second protocol is not blind, but only requires
a constant number of rounds of interaction with the provers. Our result is the first multi-prover
delegation protocol to require only a quasilinear amount of resources, in terms of number of
EPR pairs and time. However, notwithstanding our improvements, a physical implementation
of verifiable delegation protocols remains a challenging task for the available technology.
The idea at the heart of our protocols is that they provide methods to delegate the quantum
computation performed by the quantum verifier in Broadbent’s EPR protocol [7] to one of the
two provers (call him PV for Prover 𝑉). This is achieved via new robust rigidity tests which are
used to certify that the two provers share many EPR pairs, and indeed PV performs the same
actions as the honest verifier on her half EPR pairs. These actions are sequences of single-qubit
measurements of Clifford observables from the set Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺} (where 𝐹 and 𝐺 are
defined in (2.2)). The other prover (which we call PP for Prover 𝑃) is then asked to play the role
of Broadbent’s prover. Soundness of our two-prover protocols is then the result of soundness of
Broadbent’s EPR protocol, together with our rigidity results. 4
New rigidity results. We overcome existing efficiency limitations by introducing a new robust
rigidity theorem. Our theorem allows a classical verifier to certify that two non-communicating
provers apply a measurement associated with an arbitrary 𝑚-qubit tensor product of single-qubit
Clifford observables on their respective halves of 𝑚 shared EPR pairs. This is the first result to
achieve self-testing for such a large class of measurements. The majority of previous articles
in self-testing have been primarily concerned with certifying the state and were limited to
simple single-qubit measurements in the 𝑋-𝑍 plane. Prior self-testing results for multi-qubit
measurements only allow one to test for tensor products of 𝜎𝑋 and 𝜎𝑍 observables. While this is
sufficient for verification in the post-hoc model of [13, 14], testing for 𝜎𝑋 and 𝜎𝑍 observables does
not directly allow for the verification of a general computation (unless one relies on techniques
such as process tomography [37], which introduce substantial additional overhead).
Our first contribution is to extend the “Pauli braiding test” of [35] (which allows one to test
tensor products of 𝜎𝑋 and 𝜎𝑍 observables with constant robustness) to allow for 𝜎𝑌 observables
as well. This is somewhat subtle due to an ambiguity in the complex phase that cannot be
3The log 𝑔 overhead is due to the complexity of sampling from the right distribution in rigidity tests, which are
discussed next. We leave the possibility of removing this by derandomization for future work. Another source of
overhead is in achieving blindness: in order to hide the circuit, we encode it as part of the input to a universal circuit,
introducing a factor of 𝑂(log 𝑔) overhead.
4This idea can be understood more directly as employing rigidity tests to delegate to PV the preparation of the
random eigenstates required in Broadbent’s basic prepare-and-measure protocol in [7], thus enabling the classical
part of that protocol to be executed between PP and the classical verifier.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 5
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
detected by any classical two-player test; we formalize the ambiguity and show how it can
be effectively accounted for. Our second contribution is to substantially increase the set of
elementary gates that can be tested, to include arbitrary 𝑚-qubit tensor products of single-qubit
Clifford observables. This is achieved by introducing a new “conjugation test”, which tests how
an observable applied by the provers acts on the Pauli group. The test is inspired by general
results of Slofstra [39] which provide an approach to test that a set of observables satisfy some
algebraic relations (when acting on EPR pairs), but is substantially more direct.
A key feature of our rigidity results is that their robustness scales independently of the
number of EPR pairs tested, as in [35]. This is crucial for the efficiency of our delegation
protocols. The robustness for previous results in parallel self-testing, other than [35], had a
polynomial dependence on the number of EPR pairs tested. We give an informal statement of
our robust rigidity theorem.
Theorem 1.1 (Informal). Let 𝑚 ∈ ℤ>0 . Let 𝒢 be a fixed, finite set of single-qubit Clifford observables.
Then there exists an efficient two-prover test rigid(𝒢, 𝑚) with 𝑂(𝑚)-bit questions (a constant fraction of
which are of the form 𝑊 ∈ 𝒢 𝑚 ) and answers such that the following properties hold:
• (Completeness) There is a strategy for the provers that uses 𝑚 + 1 EPR pairs and succeeds with
probability at least 1 − e−Ω(𝑚) in the test.
• (Soundness) For any 𝜀 > 0, any strategy for the provers that succeeds with probability 1 − 𝜀 in the
test must be poly(𝜀)-close, up to local isometries, to a strategy in which the provers begin with
(𝑚 + 1) EPR pairs and is such that upon receipt of a question of the form 𝑊 ∈ 𝒢 𝑚 the prover
measures the “correct” observable 𝑊.
Although we do not strive to obtain√the best dependence on 𝜀, we believe it should be
possible to obtain a scaling of the form 𝐶 𝜀 for a reasonable constant 𝐶. We discuss the test in
Section 3. Next, we describe the two delegation protocols in a little more detail.
Verifier-on-a-Leash protocol. The first protocol, which we call Verifier-on-a-Leash Protocol, or
“Leash Protocol” for short, is divided into two subgames; which game is played is chosen by the
verifier by flipping a biased coin with appropriately chosen probabilities.
• The first game is a sequential version of the rigidity game rigid(Σ, 𝑚), from Theorem 1.1
(this is described in detail in Figure 11). This aims to enforce that PV performs precisely
the right measurements;
• The second game is the delegation game (this is described in detail in Figures 12, 13, and 14,
and its structure is summarized in Figure 9). Here the verifier guides PP through the
computation in a similar way as in Broadbent’s EPR Protocol [7].
In the delegation game, the questions to PV are of all of the form 𝑊 ∈ Σ𝑚 , where Σ =
{𝑋 , 𝑌, 𝑍, 𝐹, 𝐺}. The latter is the set of measurements performed by the verifier in Broadbent’s
EPR protocol. On the other hand, PP is asked to perform the same measurements as a prover in
Broadbent’s EPR protocol.
In the rigidity game, instead, the questions for PV come from a slightly larger set (which also
includes Bell basis measurements). However, crucially, a subset of these questions are of the form
𝑊 ∈ Σ𝑚 , with the same distribution as in the delegation game. This ensures that, upon receiving
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 6
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
a question of the form 𝑊 ∈ Σ𝑚 , PV is not able to tell which of the two games is being played.
Hence, we can apply the rigidity result of Theorem 1.1 to guarantee the honest behavior of PV
in the delegation game. With the latter guarantee in hand, we can deduce that in the delegation
game, PP is constrained to behaving like an honest prover in Broadbent’s EPR protocol.
Overall, PV (who plays the role of the verifier in Broadbent’s EPR protocol) only needs to
perform products of single-qubit Clifford observables and Bell-basis measurements (universal
quantum computational power is not needed for this prover), while PP needs to behave like the
honest prover in Broadbent’s EPR protocol (this requires universal quantum computation).
The protocol requires 2𝑑 + 1 rounds of interaction, where 𝑑 is the T-depth of the circuit being
delegated (this is the number of layers of T gates in the circuit - see Section 4.1 for a precise
definition). The protocol requires 𝑂(𝑛 + 𝑔) EPR pairs to delegate a 𝑔-gate circuit on 𝑛 qubits,
and the overall time complexity of the protocol is 𝑂(𝑔 log 𝑔). The input to the circuit is hidden
from the provers, meaning that the protocol can be made blind by encoding the circuit in the
input, and delegating a universal circuit. However, blindness holds only as long as PV and PP
stay separated after the execution of the protocol. We note that using universal circuits incurs a
log 𝑛 factor increase in the depth of the circuit [5].
The completeness of the protocol follows directly from the completeness of Broadbent’s EPR
protocol and of the rigidity game rigid(Σ, 𝑚). Once we ensure the correct behavior of PV using
our rigidity test, soundness follows from soundness of Broadbent’s protocol as well, since the
combined behavior of our verifier and an honest PV in the delegation game is nearly identical to
that of the verifier in Broadbent’s protocol.
Dog-Walker protocol. The second protocol, which we refer to as the Dog-Walker Protocol, also
starts from Broadbent’s protocol but modifies it in a different way to achieve a protocol that
only requires a constant number of rounds of interaction. The latter property is achieved by
leveraging the fact that, when the prover in Broadbent’s EPR protocol is honest, his actions
can be performed before the actions of the verifier. Thus the main difference between the Leash
Protocol and the Dog-Walker Protocol is that, in the latter, the classical verifier first obtains all of
PP’s measurement outcomes via one round of interaction. Then these outcomes are sent by the
verifier to PV, together with the input 𝑥 of the computation (which is now communicated in the
clear). With these, PV is able to perform the required adaptive measurements without the need
to interact with the verifier any further. An additional rigidity test, which we refer to as the
Tomography test is necessary to enforce that PV performs the adaptive measurements honestly.
We skip for now the details on this new test, and we defer its presentation to the beginning of
Section 3 and its precise description to Section 3.6.
The proof of security is slightly more involved, but the key ideas are the same: we use a
combination of our new rigidity results and the techniques of Broadbent’s protocol to control
the two provers, one of which plays the role of Broadbent’s verifier, and the other the role
of the prover. Because of the more complicated “leash” structure in this protocol we call it
the Dog-Walker Protocol. Like the Leash Protocol, the Dog-Walker Protocol has overall time
complexity 𝑂(𝑔 log 𝑔). Unlike the leash protocol, the Dog-Walker protocol is not blind, since PV
simply receives the input in the clear.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 7
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Based on the Dog-Walker Protocol, it is possible to design a classical-verifier two-prover
protocol for all languages in QMA. This is achieved along the same lines as the proof that QMIP
= MIP∗ from [37]. PV, given the input, creates the QMA witness and teleports it to PP with
the help of the verifier. The verifier then delegates the QMA verification circuit to the second
prover, as in the Dog-Walker Protocol. PV can then be re-used to verify the operations of PP.
The Dog-Walker Protocol enables this extension in a straightforward manner, since it can be
adapted to have PV decide the input to the computation. We notice that such a transformation
is not possible with the Leash protocol given that PP must know the input 𝑥 in order to be able
to create the corresponding QMA witness.
We remark that the soundness of both the Leash Protocol and the Dog-Walker Protocol can
be amplified by sequential repetition. In particular, an arbitrarily low, but constant, soundness
error can be achieved in the Dog-Walker Protocol by repeating the protocol a constant number
of times, thus maintaining constant round-complexity (we refer to Section 6 for the details).
Subsequent work. Bowles et al. [6] have independently derived a variant of our rigidity test for
multi-qubit 𝜎𝑋 , 𝜎𝑌 and 𝜎𝑍 observables in the context of entanglement certification protocols in
quantum networks. Their self-test result has a slightly smaller set of questions but significantly
weaker robustness bounds.
Grilo [19] presented a protocol for verifiable two-prover delegation of quantum computation
by a classical client with a single round of communication. Because of this single-round structure,
space-like separation can replace the non-communication assumption. The latter protocol is not
blind, and requires resources scaling as Ω(𝑛𝑔 2 ) to delegate a circuit of 𝑔 gates on 𝑛 qubits.
Open questions and directions for future work. We have introduced a new rigidity theorem
and shown how it can be used to transform a specific quantum-verifier delegation protocol, due
to Broadbent, into a classical-verifier protocol with an additional prover, while suffering very little
overhead in terms of the efficiency of the protocol. We believe that a similar transformation could
be performed starting from delegation protocols based on other models of computation, such as
the protocol in the measurement-based model of [15] or the protocol based on computation by
teleportation considered in [37], and would lead to similar efficiency improvements.
Recently, [23] provided an experimental demonstration of a two-prover delegation protocol
based on [37] for a 3-qubit quantum circuit based on Shor’s algorithm to factor the number 15;
in order to obtain an actual implementation, necessitating “only” on the order of 6000 CHSH
tests, the authors had to make the strong assumption that the devices behave in an independent
and identically distributed (i. i. d.) manner at each use, and therefore the authors could not use
the most general testing results from [37]. We believe that our improved rigidity theorem could
lead to an implementation that does not require any additional assumptions. We also leave as
an open problem investigating whether (a variant of) our protocol can be made fault-tolerant,
making it more suitable for future implementation.
We note that our protocols require the verifier to communicate with one prover after at least
one round of communication with the other has been completed. Therefore, the requirement that
the provers do not communicate throughout the protocol cannot be enforced through space-like
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 8
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
separation, and must be taken as an a priori assumption. The single-round protocol of [19], for
which non-communication can be enforced through space-like separation, is not blind. Hence,
it is an open question whether there exists a two-prover delegation protocol that consists of a
single round of simultaneous communication with each prover, and is both blind and verifiable.
We also wonder if the fact that blindness is compromised after the provers collude is unavoidable
in this model. A different avenue to achieve this is to rely on computational assumptions on
the power of the provers to achieve protocols with more properties (non-interactive, blind,
verifiable) [11, 3, 26, 25]. Unfortunately at the moment all such protocols suffer from a significant
overhead due to the use of the computational assumption; namely, a number of qubits that
scales at least as min(𝑛, 𝑔) times a polynomial in the security parameter.
Regarding blindness of the Leash protocol, our current proof does not say anything about
the possibility of the provers being able to increase their knowledge on the input given prior
side-information. This would be particularly important if the Leash protocol is composed with
other protocols. We leave as an open question if the blindness of the Leash protocol could be
proven using simulation-based security definitions, which would imply its composability.
Finally, due to its efficiency and robustness, our ridigity theorem is a potentially useful tool
in many other cryptographic protocols. For instance, an interesting direction to explore is the
possibility of exploiting our theorem to achieve more efficient protocols for device-independent
quantum key distribution, entanglement certification or other cryptographic protocols involving
more complex untrusted computation of the users.
Organization. In Section 2, we give the necessary preliminaries, including outlining Broad-
bent’s EPR Protocol (Section 2.4). In Section 3, we introduce our new rigidity theorems. In
Section 4, we present our first protocol, the leash protocol, and in Section 5, we discuss our
second protocol, the Dog-Walker Protocol (including the extension to a two-prover protocol for
QMA). In Section 6, we discuss the sequential repetition of our protocols.
Acknowledgments. We thank Anne Broadbent for useful discussions in the early stages of
this work. All authors acknowledge the IQIM, an NSF Physics Frontiers Center at the California
Institute of Technology, where this research was initiated. We also thank the anonymous
reviewers that helped us to improve the presentation of this manuscript.
2 Preliminaries
2.1 Notation
We often write 𝑥® = (𝑥 1 , . . . , 𝑥 𝑛 ) ∈ {0, 1} 𝑛 for a string of bits, and 𝑊 = 𝑊1 · · · 𝑊𝑚 ∈ Σ𝑚 for a
string, where Σ is a finite alphabet. If 𝑆 ⊆ {1, . . . , 𝑚} we write 𝑊𝑆 for the substring of 𝑊 indexed
by 𝑆. For an event 𝐸, we use 1𝐸 to denote the indicator variable for that event, so 1𝐸 = 1 if 𝐸 is
true, and otherwise 1𝐸 = 0. We write poly(𝜀) for 𝑂(𝜀 𝑐 ), where 𝑐 is a universal constant that may
change each time the notation is used.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 9
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
ℋ is a finite-dimensional Hilbert space. We denote by U(ℋ ) the set of unitary operators,
Obs(ℋ ) the set of binary observables (we omit the term “binary” from here on; in this paper all
observables are binary) and Proj(ℋ ) the set of projective measurements on ℋ . We let |EPRi
denote an EPR pair:
1
|EPRi = √ (|00i + |11i) .
2
Observables. We use capital letters 𝑋 , 𝑍, 𝑊 , . . . to denote observables. We use greek letters 𝜎,
𝜏 with a subscript 𝜎𝑊 , 𝜏𝑊 , to emphasize that the observable 𝑊 specified as subscript acts in a
particular basis. For example, 𝑋 is an arbitrary observable but 𝜎𝑋 is specifically the Pauli 𝑋
matrix defined in (2.1).
For 𝑎 ∈ {0, 1} 𝑛 and commuting observables 𝜎𝑊1 , . . . , 𝜎𝑊𝑛 , we write 𝜎𝑊 (𝑎) = 𝑛𝑖=1 (𝜎𝑊𝑖 )𝑎 𝑖 .
Î
𝑢
The associated projective measurements are {𝜎𝑊 0
𝑖
, 𝜎𝑊
1
𝑖
} where 𝜎𝑊𝑖 = 𝜎𝑊
0
𝑖
− 𝜎𝑊
1
𝑖
and {𝜎𝑊 } 𝑢∈{0,1}𝑛
𝑢 𝑢·𝑎
where 𝜎𝑊 = E𝑎 (−1) 𝜎𝑊 (𝑎). Often the 𝜎𝑊𝑖 will be single-qubit observables acting on distinct
qubits, in which case each is implicitly tensored with the identity outside of the qubit on which
it acts.
We recall the commutator notation [𝐴, 𝐵] for 𝐴𝐵 + 𝐵𝐴 and anti-commutator notation {𝐴, 𝐵}
for 𝐴𝐵 + 𝐵𝐴, where 𝐴, 𝐵 are linear operators on the same Hilbert space.
Pauli and Clifford groups. Let
1 0 0 1 0 −𝑖 1 0
𝜎𝐼 = , 𝜎𝑋 = , 𝜎𝑌 = and 𝜎𝑍 = (2.1)
0 1 1 0 𝑖 0 0 −1
denote the standard Pauli matrices acting on a qubit. The single-qubit Weyl-Heisenberg group
n o
(1) 𝑐
ℋ = 𝐻(ℤ2 ) = (−1) 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) : 𝑎, 𝑏, 𝑐 ∈ {0, 1}
is the matrix group generated by the Pauli 𝜎𝑋 and 𝜎𝑍 . We let ℋ (𝑛) = 𝐻(ℤ2𝑛 ) be the direct product
of 𝑛 copies of ℋ (1) . The 𝑛-qubit Clifford group is the normalizer of ℋ (𝑛) in the unitary group,
up to phase:
(𝑛)
𝐺 𝒞 = 𝐺 ∈ U((ℂ2 )⊗𝑛 ) : 𝐺𝜎𝐺 † ∈ ℋ (𝑛) ∀𝜎 ∈ ℋ (𝑛) .
Some Clifford observables we will use include
𝜎𝑋 + 𝜎𝑍 𝜎𝑋 − 𝜎𝑍 −𝜎𝑋 + 𝜎𝑌 𝜎𝑋 + 𝜎𝑌
𝜎𝐻 = √ , 𝜎𝐻 0 = √ , 𝜎𝐹 = √ , 𝜎𝐺 = √ . (2.2)
2 2 2 2
Note that 𝜎𝐻 and 𝜎𝐻 0 satisgy 𝜎𝑋 𝜎𝐻 𝜎𝑋 = 𝜎𝐻 0 and 𝜎𝑍 𝜎𝐻 𝜎𝑍 = −𝜎𝐻 0 . Similarly, 𝜎𝐹 and 𝜎𝐺 satisfy
𝜎𝑋 𝜎𝐹 𝜎𝑋 = −𝜎𝐺 and 𝜎𝑌 𝜎𝐹 𝜎𝑌 = 𝜎𝐺 .
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 10
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
2.2 Concentration inequality
A supermartingale is a sequence of random variables {𝑋 𝑘 } 𝑘≥0 such that for all 𝑘 ≥ 0, 𝑋 𝑘 ≥
𝔼[𝑋 𝑘+1 |𝑋1 , . . . , 𝑋 𝑘 ]. We make use of the following formulation of the Azuma–Hoeffding
inequality. See, for example, [9, Section 6] and [30, Theorem 12.4]. The latter gives a proof for
martingales that also applies to supermartingales.
Theorem 2.1. Let {𝑋 𝑘 } 𝑘≥0 be a real-valued supermartingale such that for every 𝑘 ∈ ℕ , the condition
|𝑋 𝑘 − 𝑋 𝑘−1 | ≤ 𝑑 𝑘 holds almost surely, for some 𝑑 𝑘 ≥ 0. Then for any 𝑛 ≥ 1 and 𝜆 ≥ 0,
𝜆2
Pr(𝑋𝑛 ≥ 𝑋0 + 𝜆) ≤ exp − Í𝑛 .
2 𝑘=1 𝑑 2𝑘
2.3 Quantum circuits
We use capital letters in sans-serif font to denote gates. We work with the universal quantum
gate set {CNOT , H, T }, where the controlled-not gate is the two-qubit gate with the unitary action
CNOT |𝑏 1 , 𝑏 2 i = |𝑏 1 , 𝑏 1 ⊕ 𝑏 2 i,
and the Hadamard and T gates are single-qubit gates with actions
1
H |𝑏i = √ |0i + (−1)𝑏 |1i and T |𝑏i = e𝑖𝑏𝜋/4 |𝑏i,
2
respectively. We will also use the following gates:
X |𝑏i = |𝑏 ⊕ 1i, Z |𝑏i = (−1)𝑏 |𝑏i, and P |𝑏i = 𝑖 𝑏 |𝑏i.
Measurements in the 𝑍 basis (or computational basis) will be denoted by the standard measure-
ment symbol:
To measure another observable, 𝑊, we can perform a unitary change of basis U𝑊 before the
measurement in the computational basis.
We assume that every circuit has a specified output wire, which is measured at the end
of the computation to obtain the output bit. Without loss of generality, we can assume this is
always the first wire. For an 𝑛-qubit system, we let Π𝑏 , for 𝑏 ∈ {0, 1}, denote the orthogonal
projector onto states with |𝑏i in the output wire: |𝑏ih𝑏| ⊗ Id. For example, the probability that a
circuit 𝑄 outputs 0 on input | 𝑥®i is Π0 𝑄| 𝑥®i .
2
We can always decompose a quantum circuit into layers such that each layer contains at
most one T gate applied to each wire. The minimum number of layers for which this is possible
is called the T depth of the circuit. We note that throughout this paper we will assume circuits
are compiled in a specific form that introduces extra T gates (see the paragraph on the H gadget
in Section 2.4). The T depth of the resulting circuit is proportional to the depth of the original
circuit.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 11
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
2.4 Broadbent’s EPR protocol
In this section we summarize the main features of a delegation protocol introduced in [7],
highlighting the aspects that will be relevant to understanding our subsequent adaptation into
two-prover protocols. The “EPR Protocol” from [7] involves the interaction between a verifier
𝑉𝐸𝑃𝑅 and a prover 𝑃𝐸𝑃𝑅 ∗
. We write 𝑃𝐸𝑃𝑅 for the “honest” behavior of the prover. The verifier
𝑉𝐸𝑃𝑅 has limited quantum powers. Her goal is to delegate a BQP computation to the prover
𝑃𝐸𝑃𝑅
∗
in a verifiable way. Specifically, the verifier has as input a quantum circuit 𝑄 on 𝑛 qubits
and an input string 𝑥® ∈ {0, 1} 𝑛 , and the prover gets as input 𝑄. The verifier and prover interact.
At the end of the protocol, the verifier outputs either accept or reject. The protocol is such that
there exist values 𝑝 sound and 𝑝 compl with 𝑝 sound < 𝑝compl such that 𝑝 compl − 𝑝 sound , called the
soundness-completeness gap, is a constant independent of input size, and moreover:
Completeness: If the prover is honest and Π0 𝑄| 𝑥®i
2
≥ 2/3, then the verifier outputs accept
with probability at least 𝑝compl ;
Soundness: If Π0 𝑄| 𝑥®i
2
≤ 1/3, then the probability the verifier outputs accept is at most
𝑝 sound .
In the EPR protocol, 𝑉𝐸𝑃𝑅 and 𝑃𝐸𝑃𝑅 are assumed to share (𝑛 + 𝑡) EPR pairs at the start of
the protocol, where 𝑡 is the number of T gates in 𝑄 and 𝑛 the number of input bits. The first
𝑛 EPR pairs correspond to the input to the computation; they are indexed by 𝑁 = {1, . . . , 𝑛}.
The remaining pairs are indexed by 𝑇 = {𝑛 + 1, . . . , 𝑛 + 𝑡}; they will be used as ancilla qubits to
implement each of the T gates in the delegated circuit. In [7] the EPR protocol is only considered
in the analysis, and it is assumed that the EPR pairs are prepared by the verifier.
The behavior of 𝑉𝐸𝑃𝑅 depends on a run type randomly chosen by 𝑉𝐸𝑃𝑅 after her interaction
with 𝑃𝐸𝑃𝑅 . There are three possible run types:
• Computation run (𝑟 = 0): the verifier delegates the computation to 𝑃𝐸𝑃𝑅 , and at the end of
the run can recover its output if 𝑃𝐸𝑃𝑅 behaves honestly;
• 𝑋-test run (𝑟 = 1) and 𝑍-test run (𝑟 = 2): the verifier tests that 𝑃𝐸𝑃𝑅 behaves honestly, and
rejects if malicious behavior is detected.
For some constant 𝑝, V chooses 𝑟 = 0 with probability 𝑝, and otherwise chooses 𝑟 ∈ {1, 2} with
equal probability. Since the choice of run type is made after the interaction with 𝑃𝐸𝑃𝑅 , 𝑃𝐸𝑃𝑅 ’s
behavior cannot depend on the run type. In particular, any deviating behavior in a computation
run is reproduced in both types of test runs. The analysis amounts to showing that any deviating
behavior that affects the outcome of the computation will be detected in at least one of the test
runs.
In slightly more detail, the high-level structure of the protocol is the following. 𝑉𝐸𝑃𝑅
measures her halves of the 𝑛 qubits in 𝑁 in order to prepare the input state on 𝑃𝐸𝑃𝑅 ’s system. As
a result the input is quantum one-time padded with keys that depend on 𝑉𝐸𝑃𝑅 ’s measurement
results. For example, in a computation run, 𝑉𝐸𝑃𝑅 measures each input qubit in the 𝑍 basis, and
®
gets some result 𝑑® ∈ {0, 1} 𝑛 , meaning the input on 𝑃𝐸𝑃𝑅 ’s side has been prepared as X 𝑑 |0i ⊗𝑛 . In
[7], the input is always considered to be 0,® but we can also prepare an arbitrary classical input
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 12
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
𝑥® ∈ {0, 1} 𝑛 by reinterpreting the one-time pad key as 𝑎® = 𝑑® ⊕ 𝑥® so that the input state on 𝑃𝐸𝑃𝑅 ’s
side is X 𝑎® | 𝑥®i. In a test run, on the other hand, the input is prepared as the one-time pad of either
|0i ⊗𝑛 or |+i ⊗𝑛 . Note that as indicated in Figure 2 this choice of measurements will be made
after the interaction with 𝑃𝐸𝑃𝑅 has taken place.
The honest prover 𝑃𝐸𝑃𝑅 applies the circuit 𝑄, which we assume is compiled in the universal
gate set {H, T , CNOT }, to his one-time padded input. We will shortly describe gadgets that 𝑃𝐸𝑃𝑅
can apply in order to implement each of the three gate types. The gadgets are designed in a way
that in a test run each gadget amounts to an application of an identity gate; this is what enables
𝑉𝐸𝑃𝑅 to perform certain tests in those runs that are meant to identify deviating behavior of a
dishonest prover. After each gadget, the one-time padded keys can be updated by 𝑉𝐸𝑃𝑅 , who is
able to keep track of the keys at any point in the circuit using the update rules in Table 2.
Key Update Rule
CNOT (𝑎 𝑗 , 𝑏 𝑗 , 𝑎 𝑗0 , 𝑏 𝑗0 ) ← (𝑎 𝑗 , 𝑏 𝑗 + 𝑏 𝑗0 , 𝑎 𝑗 + 𝑎 𝑗0 , 𝑏 𝑗0 )
H (𝑎 𝑗 , 𝑏 𝑗 ) ← (𝑏 𝑗 , 𝑎 𝑗 )
Computation Run (𝑎 𝑗 , 𝑏 𝑗 ) ← (𝑎 𝑗 + 𝑐 𝑖 , 𝑏 𝑗 + 𝑒 𝑖 + 𝑎 𝑗 + 𝑐 𝑖 + (𝑎 𝑗 + 𝑐 𝑖 )𝑧 𝑖 )
T 𝑋-test, even parity; or 𝑍-test, odd parity (𝑎 𝑗 , 𝑏 𝑗 ) ← (𝑒 𝑖 , 0)
𝑍-test, even parity; or 𝑋-test, odd parity (𝑎 𝑗 , 𝑏 𝑗 ) ← (0, 𝑏 𝑗 + 𝑒 𝑖 + 𝑧 𝑖 )
Table 2: Rules for updating the one-time-pad keys after applying each type of gate in the EPR
Protocol, in particular: after applying a CNOT gate controlled on the 𝑗-th wire and targeting the
𝑗 0-th wire; applying an H gate to the 𝑗-th wire; or applying the 𝑖-th T gate to the 𝑗-th wire.
We now describe the three gadgets, before giving a complete description of the protocol.
CNOT Gadget To implement a CNOT gate on wires 𝑗 and 𝑗 0, 𝑃𝐸𝑃𝑅 simply performs the CNOT
gate on those wires of his input qubits. The one-time pad keys are changed by the update
rule in Table 2, because CNOT · X 𝑎 𝑗 Z𝑏 𝑗 ⊗ X 𝑎 𝑗0 Z𝑏 𝑗0 = X 𝑎 𝑗 Z𝑏 𝑗 +𝑏 𝑗0 ⊗ X 𝑎 𝑗 +𝑎 𝑗0 Z𝑏 𝑗0 · CNOT. Note that
CNOT |0i|0i = |0i|0i and CNOT |+i|+i = |+i|+i, so in the test runs, 𝑃𝐸𝑃𝑅 is applying the identity.
H Gadget To implement an H gate on wire 𝑗, 𝑃𝐸𝑃𝑅 simply performs the H on wire 𝑗, and the
one-time-pad keys are changed as in Table 2. Unlike CNOT, H does not act as the identity on
|0i and |+i, so it is not the identity in a test run. To remedy this, assume that 𝑄 is compiled
so that every H gate appears in a pattern H(TTH) 𝑘 , where 𝑘 is odd. This can be accomplished
by replacing each H by HTTHTTHTTH, which implements the same unitary. In test runs, the T
gadget, described shortly, implements the identity, and since H(Id H) 𝑘 for odd 𝑘 implements the
identity, H(TTH) 𝑘 will also have no effect in test runs.
Parity of a T Gate Within a pattern H(TTH) 𝑘 , the H has the effect of switching between an
𝑋-test run scenario (the state |0i) and a 𝑍-test run scenario (the state |+i). In order to consistently
talk about the type of a run while evaluating the circuit, we can associate a parity with each
T gate in the circuit. The parity of the T gates that are not part of the pattern H(TTH) 𝑘 will be
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 13
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
defined to be even. An H will always flip the parity, so that within such a pattern, the first two T
gates will be odd, the next two will be even, etc., until the last two T gates will be odd again.
T Gadget The gadget for implementing the 𝑖-th T gate on the 𝑗-th wire is performed on 𝑃𝐸𝑃𝑅 ’s
𝑗-th input qubit, and his 𝑖-th auxiliary qubit (indexed by 𝑛 + 𝑖), which we can think of as being
prepared in a particular auxiliary state by 𝑉𝐸𝑃𝑅 measuring her half of the corresponding EPR
pair, as shown in Figure 1. The gadget depends on a uniformly random bit 𝑧 𝑖 that is chosen by
𝑉𝐸𝑃𝑅 and sent to the prover.
𝑗
Prover (𝑃𝐸𝑃𝑅 )
{ 𝑛+𝑖
P𝑧 𝑖
Verifier (𝑉𝐸𝑃𝑅 )
{ 𝑐𝑖
U𝑊𝑖 𝑒𝑖
Figure 1: The gadget for implementing the 𝑖-th T gate on the 𝑗-th wire. The gate U𝑊𝑖 implementing
𝑟
the change of basis associated with observable 𝑊𝑖 is applied as part of the procedure 𝑉𝐸𝑃𝑅 (see
Figure 3b) and is determined by the run type 𝑟, the parity of the 𝑖-th T gate, 𝑧 𝑖 , 𝑐 𝑖 , and 𝑎 0𝑖 (the
X-key going into the 𝑖-th T gate), as in Table 3.
The EPR protocol. We show how the gadgets just described are used in the complete protocol.
We first describe the protocol for 𝑉𝐸𝑃𝑅 below. For later convenience we have divided the action
𝑟
of 𝑉𝐸𝑃𝑅 into classical actions and a single quantum subroutine 𝑉𝐸𝑃𝑅 depending on the run
type 𝑟.
𝑟
The procedure 𝑉𝐸𝑃𝑅 measures each of the 𝑛 + 𝑡 EPR halves according to some observable
that depends on 𝑟, 𝑐®, and 𝑧®. In the case of a computation run, 𝑉𝐸𝑃𝑅
0
measures the qubits in 𝑇
𝑟
adaptively. We describe the steps of 𝑉𝐸𝑃𝑅 , 𝑉𝐸𝑃𝑅 and the honest behavior of 𝑃𝐸𝑃𝑅 in Fig. 3.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 14
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Figure 2: This figure describes how different
pieces of the protocol fit together. 𝑉𝐸𝑃𝑅 and
𝑧® ∈ {0, 1} 𝑡 𝑃𝐸𝑃𝑅 share 𝑛 + 𝑡 EPR pairs. The honest prover
𝑃𝐸𝑃𝑅 can be seen as a procedure that acts on 𝑛 +𝑡
𝑐® ∈ {0, 1} 𝑡 𝑃𝐸𝑃𝑅 qubits — the EPR pair halves — depending on
𝑐 𝑓 ∈ {0, 1} a 𝑡-bit string 𝑧®. We have separated the quantum
𝑥®, 𝑐®, 𝑧® 𝑟
part of 𝑉𝐸𝑃𝑅 into its own procedure, called 𝑉𝐸𝑃𝑅 ,
where 𝑟 ∈ {0, 1, 2} indicates the run type, which
𝑟
𝑉𝐸𝑃𝑅
𝑉𝐸𝑃𝑅 runs on her 𝑛 + 𝑡 EPR halves, and the 2𝑡
𝑟
bits 𝑐® and 𝑧®. Aside from running 𝑉𝐸𝑃𝑅 , 𝑉𝐸𝑃𝑅 is
classical.
® 𝑒®
𝑎® , 𝑏,
𝑉𝐸𝑃𝑅
U𝑊𝑖 (observable 𝑊𝑖 )
𝑎 0𝑖 ⊕ 𝑐 𝑖 ⊕ 𝑧 𝑖 = 0 HT (observable 𝐺)
Computation Run
𝑎 0𝑖 ⊕ 𝑐 𝑖 ⊕ 𝑧 𝑖 = 1 HPT (observable 𝐹)
even T gate Id (observable 𝑍)
𝑋-test Run 𝑧𝑖 = 0 H (observable 𝑋)
odd T gate
𝑧𝑖 = 1 HP (observable 𝑌)
odd T gate Id (observable 𝑍)
𝑍-test Run 𝑧𝑖 = 0 H (observable 𝑋)
even T gate
𝑧𝑖 = 1 HP (observable 𝑌)
Table 3: The choice of U𝑊𝑖 in the T gadget. We also indicate the observable 𝑊𝑖 associated with
the final measurement 𝑊𝑖 = U𝑊 †
𝑖
𝑍 U𝑊𝑖 .
Completeness and soundness. We summarize the relevant part of the analysis of the EPR
protocol from [7]. First suppose 𝑃𝐸𝑃𝑅 behaves honestly. If Π0 𝑄 | 𝑥®i = 𝑝, then in a computation
2
run, 𝑉𝐸𝑃𝑅 outputs accept with probability 𝑝, whereas in a test run, 𝑉𝐸𝑃𝑅 outputs accept with
probability 1. This establishes completeness of the protocol:
Theorem 2.2 (Completeness). Suppose the verifier executes the EPR Protocol, choosing 𝑟 = 0 with
probability 𝑝, on an input (𝑄, | 𝑥®i) such that Π0 𝑄 | 𝑥®i ≥ 1 − 𝛿. Then the probability that 𝑉𝐸𝑃𝑅 accepts
2
when interacting with the honest prover 𝑃𝐸𝑃𝑅 is at least (1 − 𝑝) + 𝑝(1 − 𝛿).
The following theorem is implicit in [7, Section 7.6], but we include a brief proof sketch:
Theorem 2.3 (Soundness). Suppose the verifier executes the EPR Protocol, choosing 𝑟 = 0 with
probability 𝑝, on an input (𝑄, | 𝑥®i) such that Π0 𝑄| 𝑥®i ≤ 𝛿. Let 𝑃𝐸𝑃𝑅
2 ∗
be an arbitrary prover such that
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 15
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
𝑃𝐸𝑃𝑅
∗
is accepted by 𝑉𝐸𝑃𝑅 with probability 𝑞 𝑡 conditioned on 𝑟 ≠ 0, and 𝑞 𝑐 conditioned on 𝑟 = 0. Then
the prover’s overall acceptance probability is 𝑝𝑞 𝑐 + (1 − 𝑝)𝑞 𝑡 , and
𝑞 𝑐 ≤ 2 (𝑞 𝑡 𝛿 + (1 − 𝑞 𝑡 )) − 𝛿.
Proof sketch. Using the notation of [7], let 𝐸(𝜌) = 𝑘 𝐾 𝑘 𝜌𝐾 †𝑘 be the Kraus decomposition of an
Í
arbitrary attack performed by a malicious prover on the 𝑚-qubit state resulting from an honest
run of the protocol.5 We write the 𝑘-th Kraus operator of 𝐸 as a sum of Paulis 𝐾 𝑘 = 𝑄∈𝒫 (𝑚) 𝛼 𝑘,𝑄 𝑄.
Í
Finally, we define the set of benign attacks 𝐵𝑡,𝑚 ⊆ 𝒫 (𝑚) as the subset of Paulis containing 𝐼 or 𝑍
in the positions that are measured (in the computational basis) during the protocol.
Notice that the benign attacks do not affect the the acceptance of the protocol, and therefore
the value 𝐴 = 𝑘 𝑄∉𝐵𝑡,𝑚 |𝛼 𝑘,𝑄 | 2 can be interpreted then as the total weight on attacks that could
Í Í
change the outcome of the computation. By [7], the probability of rejecting in a computation
run is 1 − 𝑞 𝑐 ≥ (1 − 𝛿)(1 − 𝐴), whereas the probability of rejecting in a test run is 1 − 𝑞 𝑡 ≥ 21 𝐴.
Combining these gives 𝑞 𝑐 ≤ 2(𝑞 𝑡 𝛿 + (1 − 𝑞 𝑡 )) − 𝛿.
3 Rigidity
In this section we describe the main rigidity tests used in our delegation protocols. To present
the tests we adopt the terminology of “players” instead of “provers” and “referee” instead of
“verifier”, as this terminology is the standard one in the area of self-testing from which the
section borrows. Each of the tests consists of a two-message interaction between the referee and
the two players: first, a pair of questions is selected by the referee and each player is sent one
element of the pair. Second, each player responds to its question with an answer. Finally, the
referee decides to accept or reject the player’s answers in the test.
Our main test is called rigid(Σ, 𝑚) and it is described in Section 3.5. Here Σ denotes
the five-element set Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺}. Each element of Σ is a label for the corresponding
single-qubit observable introduced in Section 2.1. The test is parametrized by an integer 𝑚
which denotes the number 𝑚 of EPR pairs used by the players in the honest strategy. In the test,
with some constant probability either player is sent as question a string 𝑊 chosen uniformly at
random from Σ𝑚 . In these cases the honest player is expected to measure each qubit in the basis
indicated by 𝑊 and return the 𝑚-bit string of outcomes obtained. In other cases, the player may
be asked to perform measurements in other bases, such as a measurement of pairs of qubits in
the Bell basis. These measurements are required to test that the player indeed performs the right
measurement when sent a basis from Σ𝑚 (up to an isometry, as explained in Section 3.1 below).
In general a strategy for the players in any of the tests presented in this section consists of an
arbitrary entangled state |𝜓i ∈ ℋA ⊗ ℋB (which we take to be pure), and measurements (which
5Note that we can assume such behavior by the malicious prover without loss of generality since all measurements
can be performed coherently, with the first step of the attack undoing all honest operations.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 16
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
1. 𝑉𝐸𝑃𝑅 sends 𝑧® ∈𝑅 {0, 1} 𝑡 to 𝑃𝐸𝑃𝑅 , and receives back 𝑐® ∈ {0, 1} 𝑡 and 𝑐 𝑓 ∈ {0, 1}.
𝑟
2. 𝑉𝐸𝑃𝑅 chooses a random run type 𝑟 ∈ {0, 1, 2} and runs 𝑉𝐸𝑃𝑅 (see Figure 3b) on 𝑥®, 𝑐®, 𝑧® and
on her EPR halves, to obtain bits 𝑎® , 𝑏 ∈ {0, 1} and 𝑒® ∈ {0, 1} 𝑡 .
® 𝑛
3. 𝑉𝐸𝑃𝑅 applies the update rules from Table 2 on the initial keys (®𝑎 , 𝑏), ® gate-by-gate, to obtain,
for every 𝑖 ∈ [𝑡], the X-key before the 𝑖-th T gate is applied, 𝑎 𝑖 , and the final X key for the
0
output wire, 𝑎 0𝑓 . If 𝑟 = 1 (𝑋-test run) and there exists an 𝑖 such that the 𝑖-th T gate is even
and 𝑐 𝑖 ≠ 𝑎 0𝑖 ⊕ 𝑒 𝑖 , output reject. If 𝑟 = 2 (𝑍-test run) and there exists an 𝑖 such that the 𝑖-th T
gate is odd and 𝑐 𝑖 ≠ 𝑎 0𝑖 ⊕ 𝑒 𝑖 , output reject. If 𝑟 ∈ {0, 1} (computation or 𝑋-test run) and
𝑐 𝑓 ⊕ 𝑎 0𝑓 ≠ 0, output reject. Otherwise, output accept.
(a) 𝑉𝐸𝑃𝑅 ’s point of view.
Input: A circuit 𝑄 with 𝑡 T gates, 𝑥® ∈ {0, 1} 𝑛 , 𝑐®, 𝑧® ∈ {0, 1} 𝑡 , an 𝑛-qubit system indexed by 𝑁,
and a 𝑡-qubit system indexed by 𝑇.
1. If 𝑟 ∈ {0, 1}, measure each qubit in 𝑁 in the 𝑍 basis, and otherwise measure in the 𝑋
basis, to get results 𝑑® ∈ {0, 1} 𝑛 . If 𝑟 = 0, set (®𝑎 , 𝑏)
® = ( 𝑑® ⊕ 𝑥®, 0𝑛 ); if 𝑟 = 1, set (®𝑎 , 𝑏) ® 0𝑛 );
® = (𝑑,
® = (0𝑛 , 𝑑).
and if 𝑟 = 2 set (®𝑎 , 𝑏) ®
2. Going through 𝑄 gate-by-gate, use the update rules in Table 2 to update the one-time-pad
keys. For every 𝑖 ∈ [𝑡], when the 𝑖-th T gate is reached, let 𝑎 0𝑖 be the X key before the 𝑖-th T
gate is applied. Choose an observable 𝑊𝑖 according to Table 3 in which to measure the
𝑖-th qubit in 𝑇, corresponding to the 𝑖-th T gate, obtaining result 𝑒 𝑖 .
𝑟
(b) The procedure 𝑉𝐸𝑃𝑅 , employed by 𝑉𝐸𝑃𝑅 .
1. Receive 𝑧® ∈ {0, 1} 𝑡 from 𝑉𝐸𝑃𝑅 .
2. Evaluate 𝑄 gate-by-gate using the appropriate gadget for each gate. In particular, use 𝑧 𝑖
to implement the 𝑖-th T gadget, and obtain measurement result 𝑐 𝑖 .
3. Measure the output qubit to obtain 𝑐 𝑓 , and return 𝑐® and 𝑐 𝑓 to 𝑉𝐸𝑃𝑅 .
(c) Honest prover strategy 𝑃𝐸𝑃𝑅
Figure 3: The EPR Protocol.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 17
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
we take to be projective) for each possible question.6 This includes an 𝑚-bit outcome projective
measurement {𝑊 𝑢 } 𝑢∈{0,1}𝑚 for each of the queries 𝑊 ∈ Σ𝑚 , which we take to be identical for
both players (in Section 3.2 we justify why this is without loss of generality). Our rigidity result
states that for any strategy that succeeds with probability 1 − 𝜀 in the test, the measurements
associated with questions in Σ𝑚 are within poly(𝜀) of the honest strategy, up to local isometries
and in the appropriate norm, which depends on the state shared by the players (see Theorem 3.1
for a precise statement).
√ This is almost true, but for an irreconcilable ambiguity in the definition
of the complex phase −1. The fact that complex conjugation of observables leaves correlations
invariant implies that no classical test can distinguish between the two nontrivial inequivalent
irreducible representations of the Pauli group, which are given by the Pauli matrices 𝜎𝑋 , 𝜎𝑌 , 𝜎𝑍
and their complex conjugates 𝜎𝑋 = 𝜎𝑋 , 𝜎𝑍 = 𝜎𝑍 , 𝜎𝑌 = −𝜎𝑌 , respectively. In particular, the
players may use a strategy that uses a combination of both representations; as long as they
do so consistently, no test will be able to detect this behavior.7 The formulation of our result
accommodates this irreducible degree of freedom by forcing the players to use a single qubit,
the (𝑚 + 1)-st, to make their choice of representation (so honest players require the use of (𝑚 + 1)
EPR pairs to test the operation of 𝑚-fold tensor products of observables from Σs).
Theorem 3.1 below summarizes the guarantees of our main test, rigid(Σ, 𝑚). Informally,
Theorem 3.1 establishes that a strategy that succeeds in rigid(Σ, 𝑚) with probability at least
1 − 𝜖 must be such that (up to local isometries):
• The players’ joint state is close to a tensor product of 𝑚 EPR pairs, together with an
arbitrary ancilla register;
• The projective measurements performed by either player upon receipt of a query of the
form 𝑊 ∈ Σ𝑚 are, on average over the uniformly random choice of 𝑊 ∈ Σ𝑚 , close to
a measurement that consists of first, measuring an ancilla register  or B̂ to extract a
single bit that specifies whether to perform the ideal measurements or their conjugated
counterparts, respectively, and second, measuring the player’s 𝑚 half-EPR pairs in either
the bases indicated by 𝑊, or their complex conjugates, depending on the bit obtained
from the ancilla register.
For an observable 𝑊 ∈ Σ, let 𝜎𝑊 = 𝜎𝑊 +1
− 𝜎𝑊
−1
be its eigendecomposition, where 𝜎𝑊 are the
𝑢 𝑢
“honest” Pauli matrices defined in (2.1) and (2.2). For 𝑢 ∈ {±1} let 𝜎𝑊 ,+
= 𝜎𝑊 for 𝑊 ∈ Σ, and
𝑢 𝑢 𝑢
𝜎𝑋 ,− = 𝜎𝑋 , 𝜎𝑍,− = 𝜎𝑍𝑢 , 𝑢
𝜎𝑌,− = 𝜎𝑌−𝑢 , 𝑢
𝜎𝐹,− −𝑢
= 𝜎𝐺 , 𝑢
𝜎𝐺,− = 𝜎𝐹−𝑢 .
𝑢 𝑢
(In words, 𝜎𝑊 ,−
is just the complex conjugate of 𝜎𝑊 .) We note that for the purpose of our
delegation protocols, we made a particular choice of the set Σ. The result generalizes to any
constant-sized set of single-qubit Clifford observables, yielding a test for 𝑚-fold tensor products
of single-qubit Clifford observables from Σ.
6We make the assumption that the players employ a pure-state strategy for convenience, but it is easy to check
that all proofs extend to the case of a mixed strategy. Moreover, it is always possible to consider (as we do) projective
strategies only by applying Naimark’s dilation theorem, and adding an auxiliary local system to each player as
necessary, since no bound is assumed on the dimension of their systems.
7See [38, Appendix A] for an extended discussion of this issue, with a similar resolution to ours.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 18
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Theorem 3.1. Let 𝜀 > 0 and 𝑚 an integer. Suppose that a strategy for the players succeeds with
probability 1 − 𝜀 in the test rigid(Σ, 𝑚). For 𝑊 ∈ Σ𝑚 and 𝐷 ∈ {𝐴, 𝐵} let {𝑊D𝑢 } 𝑢 be the measurement
performed by player 𝐷 on question 𝑊. Let also |𝜓i be the state shared by the players. Then for 𝐷 ∈ {𝐴, 𝐵}
there exists an isometry
𝑉𝐷 : ℋD → (ℂ2 )D⊗𝑚 0 ⊗ ℋb D
and a state |auxibAbB ∈ ℋbA ⊗ ℋbB such that
√
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRi ⊗𝑚 ⊗ |auxibAbB = 𝑂( 𝜀) ,
2
(3.1)
and positive semidefinite matrices 𝜏𝜆 on b
A with orthogonal support, for 𝜆 ∈ {+, −}, such that Tr(𝜏+ ) +
Tr(𝜏− ) = 1 and
Õ
𝑉𝐴 TrB (Id𝐴 ⊗𝑊B𝑢 )|𝜓ih𝜓| AB (Id𝐴 ⊗𝑊B𝑢 )† 𝑉𝐴†
E𝑚
𝑊 ∈Σ
𝑢∈{0,1} 𝑚
𝑚 𝜎 𝑢𝑖
𝑊 ,𝜆
Õ Ì
𝑖
− ⊗ 𝜏𝜆
2 1
𝜆∈{±} 𝑖=1
= 𝑂(poly(𝜀)). (3.2)
A symmetric relation holds with the roles of 𝐴 and 𝐵 exchanged. Moreover, players employing the honest
strategy succeed with probability 1 − e−Ω(𝑚) in rigid(Σ, 𝑚).
We give some intuition for (3.2). In the honest strategy for rigid(Σ, 𝑚), for any 𝑊 ∈ Σ𝑚
the {𝑊B𝑢 } 𝑢∈{0,1}𝑚 form a projective measurement on 𝑚 qubits that consists in measuring the
𝑖-th qubit in the eigenbasis of the observable 𝜎𝑊 , for 𝑖 ∈ {1, . . . , 𝑚}. Moreover, in the honest
strategy the state |𝜓iAB consists of 𝑚 EPR pairs shared between the players. Therefore, the
post-measurement state on ℋA associated with the outcome 𝑢 when {𝑊B𝑢 } 𝑢∈{0,1}𝑚 is performed
𝑢𝑖
on ℋB is (without renormalization) ⊗𝑖 ( 12 𝜎𝑊 𝑖
). In case the system  is trivial (1-dimensional)
and 𝜏+ = 1, 𝜏− = 0, (3.2) states that the post-measurement state for any successful strategy is
close to the “ideal” post-measurement state. Informally the density matrices 𝜏𝜆 , which live
on ℋÂ , represent a “phase ambiguity” already discussed prior to the theorem statement: the
malicious player 𝐵 is allowed to use a strategy that is a mixture of two strategies, resulting in the
post-measurement state being a mixture of two post-measurement states, the “ideal” one (𝜆 = 1)
and the “phase-flipped” one (𝜆 = −1). Here it is important that 𝜏+ and 𝜏− have orthogonal, so
that there is no overlap between the two components. This ambiguity is unavoidable since no
test of the form considered here (that takes the form of a two-player one-round interaction) can
distinguish between 𝑌 and 𝑌 𝑇 , whose eigenvectors are swapped.
The statement of the theorem differs from more standard rigidity statements in providing
guarantees on the initial shared state as well as certain post-measurement states that can be
created by the players, as opposed to guarantees on the player’s observables. The motivation for
this is to write the theorem in a way that is easily usable in the other sections and in particular
the analysis of the leash protocol from Section 4.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 19
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Before proceeding with the details we give an outline for the proof of Theorem 3.1. As
already mentioned the test to which Theorem 3.1 applies is denoted rigid(Σ, 𝑚). The goal of
this test is to rigidly enforce that each players measures 𝑚 qubits in a basis indicated by a string
𝑊 ∈ Σ𝑚 when asked to do so, and reports the 𝑚-bit outcome.
The first ingredient to design the test rigid(Σ, 𝑚) is an extension of the “Pauli braiding
test” from [35] to handle tensor products of not only 𝜎𝑋 and 𝜎𝑍 , but also 𝜎𝑌 Pauli observables.
This test is denoted pbt(𝑋 , 𝑌, 𝑍) and described in Appendix A.4.3. The test would allow us to
conclude if we had Σ = {𝑋 , 𝑌, 𝑍}. It remains to develop the ability to test for the single-qubit
Clifford observables 𝐹 and 𝐺 as well as tensor products of them and 𝑋 , 𝑌, 𝑍. Our strategy to do
this is the following.
• First we introduce a test for a player making use of a unitary 𝑅 that conjugates Paulis
to Paulis in a prescribed way; for example we may test that 𝑅𝑋𝑅 = −𝑌. Here we wrote
“makes use of” because the test does not directly access the unitary 𝑅, which need not be
a measurement observable (such as a binary observable). Instead the player is asked to
0 𝑅 †
measure according to the observable 𝑋𝑅 = . As a consequence the honest strategy
𝑅 0
for this test makes use of one more qubit than the number of qubits required to implement
𝑅. Our test for conjugation is called conj-cliff(𝑅) and described in Section 3.3. This test is
based on a more general conjugation test introduced in Section 3.2, which is not restricted
to Cliffords. Note that the test conj-cliff(𝑅) directly tests for 𝑚-qubit Clifford observables
through their action on the 𝑚-qubit Clifford group, which can be tested using pbt(𝑋 , 𝑌, 𝑍).
• The test conj-cliff(𝑅) allows us to test that a unitary respects the requisite conjugation
relations. However, this is not sufficient in general, as for example 𝐹 and (−𝐹) both have
the same action on the Pauli group. When testing for observables that are associated
with strings 𝑊 ∈ Σ𝑚 we need to make sure that every time the symbol 𝐹 appears it
is the “same” observable that is used, and not sometimes its opposite (which would
correspond to exchanging eigenvectors).8 In Section 3.4 we introduce a test cliff(Σ, 𝑚)
which removes such inconsistencies by implementing a swap test between the (supposedly)
same observable acting on different qubits. The swap test is realized by asking one player
to measure in the Bell basis and the other, for instance, to measure 𝐹𝐹, and the results are
checked for consistency.
• Finally in Section 3.5 the test rigid(Σ, 𝑚) is introduced. The only missing ingredient is to
test that all the 𝐹 observables are indeed 𝐹 as intended, and not all −𝐹. For this we perform
tomography against the 𝑋 and 𝑍 observables, which allows us to distinguish between the
two eigenstates of 𝐹, thereby lifting the remaining ambiguity (and similarly for 𝐺).
We start by introducing the language required to formulate our testing results.
8Here “same” is in quotes because the observables act on different qubits”
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 20
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
3.1 Testing
In this section we recall the standard formalisms from self-testing, including state-dependent
distance measure, local isometries, etc. We also introduce a framework of “tests for relations”
that will be convenient to formulate our results.
3.1.1 Distance measures
Ultimately our goal is to test that a player implements a certain tensor product of single-qubit or
two-qubit measurements defined by observables such as 𝜎𝑋 , 𝜎𝑌 , or 𝜎𝐺 . Since it is impossible to
detect whether a player applies a certain operation 𝑋 on state |𝜓i, or 𝑉 𝑋𝑉 † on state 𝑉 |𝜓i, for
any isometry 𝑉 : L(ℋ ) → L(ℋ 0) such that 𝑉 †𝑉 = Id, we will (as is standard in testing) focus on
testing identity up to local isometries. Towards this, we introduce the following important piece
of notation:
Definition 3.2. For finite-dimensional Hilbert spaces ℋA and ℋA0 , 𝛿 > 0, and operators 𝑅 ∈ L(ℋA )
and 𝑆 ∈ L(ℋA0 ) we say that 𝑅 and 𝑆 are 𝛿-isometric with respect to |𝜓i ∈ ℋA ⊗ ℋB , and write
𝑅 '𝛿 𝑆, if there exists an isometry 𝑉 : ℋA → ℋA0 such that
(𝑅 − 𝑉 † 𝑆𝑉) ⊗ IdB |𝜓i = 𝑂(𝛿).
2
When 𝑅 = {𝑅 𝑎 } and 𝑆 = {𝑆 𝑎 } are POVM with the same set of outcomes we write 𝑅 𝑎 '𝛿 𝑆 𝑎 to
mean Õ
(𝑅 𝑎 − 𝑉 † 𝑆 𝑎 𝑉) ⊗ IdB |𝜓i = 𝑂(𝛿).
2
𝑎
If 𝑉 is the identity, then we further say that 𝑅 and 𝑆 are 𝛿-equivalent, and write 𝑅 ≈𝛿 𝑆 for
k(𝑅 − 𝑆) ⊗ IdB |𝜓ik 2 = 𝑂(𝛿).
The notation 𝑅 '𝛿 𝑆 carries some ambiguity, as it does not specify the state |𝜓i. The latter
should always be clear from context: we will often simply write that 𝑅 and 𝑆 are 𝛿-isometric,
without explicitly specifying |𝜓i or the isometry. The relation is transitive, but not reflexive: the
operator on the right will always act on a space of dimension at least as large as that on which
the operator on the left acts. The notion of 𝛿-equivalence is both transitive (its square root obeys
the triangle inequality) and reflexive, and we will use it as our main notion of distance.
3.1.2 Strategies
Given a two-player game, or test, a strategy for the players consists of a bipartite entangled state
|𝜓i ∈ ℋA ⊗ ℋB together with families of projective measurements {𝑊A𝑎 } for Alice and {𝑊B𝑎 } for
Bob, one for each question 𝑊 that can be sent to either player in the test. (We often use the
same symbol, a capital letter 𝑋 , 𝑍, 𝑊 , . . . , to denote a question in the game and the associated
projective measurement {𝑊 𝑎 } applied by the player upon reception of that question.) Recall
that to a projective measurement with outcomes in {0, 1} 𝑛 we associate a family of observables
𝑊(𝑢) parametrized by 𝑛-bit strings 𝑢 ∈ {0, 1} 𝑛 , defined by 𝑊(𝑢) = 𝑎 (−1)𝑢·𝑎 𝑊 𝑎 . If 𝑛 = 1 we
Í
simply write 𝑊 = 𝑊(1) = 𝑊 0 − 𝑊 1 ; note that 𝑊(0) = Id.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 21
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
As already mentioned, for convenience we restrict our attention to pure-state strategies
employing projective measurements. We will loosely refer to a strategy for the players as
(𝑊 , |𝜓i), with the symbol 𝑊 referring to the complete set of projective measurements used by
the players in the game.
3.1.3 Consistency tests
We formulate our tests as two-player games in which both players are treated symmetrically.
Specifically, when in a test we write “send one player the question 𝑋 and the other the question
𝑌” we implicitly mean that the role of “first player” and “second player” have been assigned
at random, and moreover a player only gets told its question, not its “role” as assigned by the
referee. Taking advantage of this symmetry we often omit the subscript A or B, as all statements
involving observables for one player hold verbatim with the other player’s observables as well.
With the exception of the Tomography Test tom presented in Section 3.6, all the games we
consider implicitly include a “consistency test” which is meant to enforce that whenever both
players are sent identical questions, they produce matching answers.9 More precisely, let 𝑇
be any of the two-player tests described in the paper. Let Pr𝑇 (𝑊 , 𝑊 0) be the distribution on
questions (𝑊 , 𝑊 0) to the players that is specified by 𝑇. Since the players are always treated
symmetrically, Pr𝑇 (·, ·) is permutation-invariant. Let Pr𝑇 (·) denote the marginal on either player.
Then, instead of executing the test 𝑇 as described, the verifier performs the following:
(i) With probability 1/2, execute 𝑇.
(ii) With probability 1/2, select a random question 𝑊 according to Pr𝑇 (𝑊). Send 𝑊 to both
players. Accept if and only if the players’ answers are equal.
Then, success with probability at least 1 − 𝜀 in the modified test implies success with probability
at least 1 − 2𝜀 in the original test, as well as in the consistency test. If {𝑊A𝑎 } and {𝑊B𝑏 } are
the players’ corresponding projective measurements and |𝜓iAB their shared state, the latter
condition implies
Õ Õ
k(𝑊A𝑎 ⊗ Id − Id ⊗𝑊B𝑎 )|𝜓iAB k 2 = 2 − 2 h𝜓| AB𝑊A𝑎 ⊗ 𝑊B𝑎 |𝜓iAB
𝑎 𝑎
≤ 4𝜀, (3.3)
so that 𝑊A𝑎 ⊗ Id ≈𝜀 Id ⊗𝑊B𝑎 (where the condition should be interpreted on average over the
choice of a question 𝑊 distributed as in the test). Similarly, if 𝑊A , 𝑊B are observables for the
players that succeed in the consistency test with probability 1 − 2𝜀 we obtain 𝑊A ⊗ Id ≈𝜀 Id ⊗𝑊B .
We will often use both relations to “switch” operators from one player’s space to the other’s; as
a result we will also often omit an explicit specification of which player’s space an observable is
applied to.
9Here by a “test” we mean a named test, such as conj(𝐴, 𝐵, 𝑅) or ac(𝑋 , 𝑍). Since conj(𝐴, 𝐵, 𝑅) uses ac(𝑋 , 𝑍) as
a subroutine, both the named subtest ac(𝑋 , 𝑍) and the named test conj(𝐴, 𝐵, 𝑅) are endowed with an additional
consistency test.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 22
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
3.1.4 Relations
We use ℛ to denote a set of relations over matrix variables 𝑋 , 𝑍, 𝑊 , . . . , such as
ℛ = 𝑋𝑍𝑋𝑍 = − Id, 𝐻𝑋 = 𝑍𝐻, {𝑋 , 𝑍, 𝐻} ∈ Obs .
Here the notation {𝑋 , 𝑍, 𝐻} ∈ Obs means that each of the symbols in {𝑋 , 𝑍, 𝐻} satisfies the
pair of relations, {𝑋 = 𝑋 † , 𝑋 2 = Id} (since we consider only binary observables) and similarly
for 𝑍, 𝐻. Each relation implicitly imposes that the variables that appear in it have compatible
dimension, e. g., 𝑋𝑍𝑋𝑍 = − Id imposes that 𝑋 , 𝑍 have the same dimension. We only consider
relations that can be expressed in the form of one of the following equations:
• (−1)𝑎 𝑊1 · · · 𝑊𝑘 = Id, where the 𝑊𝑖 are (not necessarily distinct) unitary variables and
𝑎 ∈ ℤ2 , or
• 𝑊1 · ( 𝑎 𝜔 𝑎 𝑊2𝑎 ) = Id, where 𝑊1 is a unitary variable, {𝑊2𝑎 } a projective measurement with
Í
𝑠 possible outcomes, and 𝜔 𝑎 are (arbitrary) 𝑠-th roots of unity.
Here what we mean by “unitary variable” and “projective measurement” is that when saying
that a collection of matrices satisfies the relation, we always require that the matrices be unitary
and a projective measurement), resp.; if they are not then by definition they do not satisfy the
relation.
Definition 3.3 (Rigid self-test). We say that a set ℛ of relations is (𝑐, 𝛿(𝜀))-testable, on average
under the distribution 𝒟 : ℛ → [0, 1], if there exists a game (or test) 𝐺 with question set 𝒬 such
that the following holds. The set 𝒬 includes (at least) a symbol for each variable in ℛ that is
either an observable or a POVM. Moreover,
• (Completeness) There exists a set of operators which exactly satisfy all relations in ℛ and a
strategy for the players which uses these operators for the questions in 𝒬 that correspond
to symbols appearing in the relations in ℛ (together possibly with others for the additional
questions) that has success probability at least 𝑐;
• (Soundness) For any 𝜀 > 0 and any strategy (𝑊 , |𝜓i𝐴𝐵 ) that succeeds in the game with
probability at least 𝑐 − 𝜀, the associated measurement operators satisfy the relations in
ℛ up to 𝛿(𝜀). More precisely, on average over the choice of a relation 𝑓 (𝑊) = Id from ℛ
chosen according to 𝒟, it holds that k( 𝑓 (𝑊) − Id) ⊗ Id |𝜓iAB k 2 ≤ 𝛿(𝜀).
If both conditions hold, we also say that the game 𝐺 is a robust (𝑐, 𝛿(𝜀)) self-test for the set ℛ of
relations.
Most of the games we consider have perfect completeness, 𝑐 = 1, in which case we omit
explicitly mentioning the parameter. The distribution 𝒟 will often be implicit from context, and
we do not always specify it explicitly (e. g., in case we only measure 𝛿(𝜀) up to multiplicative
factors of order |ℛ| the exact distribution 𝒟 does not matter as long as it has complete support).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 23
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Definition 3.4 (Stable relations). We say that a set of relations ℛ is 𝛿(𝜀)-stable, on average
under the distribution 𝒟 : ℛ → [0, 1], if for any state |𝜓i ∈ ℋA ⊗ ℋB and families of operators
𝑊𝐴 ∈ L(ℋA ) and 𝑊𝐵 ∈ L(ℋB ) that are consistent on average, i. e.,
(Id ⊗𝑊𝐵 − 𝑊𝐴 ⊗ Id)|𝜓i ≤ 𝜀,
2
E E
𝑓 ∼𝒟 𝑊 ∈𝑈 𝑓
where 𝑊 ∈𝑈 𝑓 is shorthand for 𝑊 being a uniformly random operator among those appearing
in the relation specified by 𝑓 , and satisfy the relations on average, i. e.,
( 𝑓 (𝑊𝐴 ) − Id) ⊗ Id |𝜓i ≤ 𝜀,
2
E
𝑓 ∼𝒟:
𝑓 (𝑊)=Id∈ℛ
ˆ which satisfy the same relations exactly and are 𝛿(𝜀)-isometric to the
there exists operators 𝑊
𝑊 with respect to |𝜓i, on average over the choice of a random relation in ℛ and a uniformly
random 𝑊 appearing in the relation, i. e., there exists an isometry 𝑉𝐴 such that
E E ˆ 𝐴 − 𝑉𝐴 𝑊𝐴 ) ⊗ Id |𝜓i
(𝑊
2
= 𝑂(𝛿(𝜀)).
𝑓 ∼𝒟 𝑊 ∈𝑈 𝑓
3.2 The conjugation test
We give a test which certifies that a unitary (not necessarily an observable) conjugates one
observable to another. More precisely, let 𝐴, 𝐵 be observables and 𝑅 a unitary acting on the
same space ℋ . The test conj(𝐴, 𝐵, 𝑅) certifies that the players implement observables of the
form
0 𝑅† 𝐴 0
𝑋𝑅 = and 𝐶 = 𝐶 𝐴,𝐵 = , (3.4)
𝑅 0 0 𝐵
such that moreover 𝑋𝑅 and 𝐶 commute. The fact that 𝑋𝑅 is an observable implies that 𝑅 is
unitary,10 while the commutation condition is equivalent to the relation 𝑅𝐴𝑅† = 𝐵. The test
thus tests for the relations
𝒞{𝑅, 𝐶} = {𝑋𝑅 , 𝐶, 𝑋 , 𝑍} ∈ Obs ∪ 𝑋𝑍 = −𝑍𝑋 ∪ 𝑋𝑅 𝐶 = 𝐶𝑋𝑅 , 𝑋𝑅 𝑍 = −𝑍𝑋𝑅 , 𝐶𝑍 = 𝑍𝐶 .
Here the anti-commuting observables 𝑋 and 𝑍 are used to specify a basis in which 𝑋𝑅 and 𝐶
can be block-diagonalized. The anti-commutation and commutation relations with 𝑍 enforce
that 𝑋𝑅 and 𝐶 have the form described in (3.4). These relations are enforced using commutation
and anti-commutation tests that are standard in the literature on self-testing. For convenience,
we state those tests, com and ac, in Appendix A. The conjugation test, which uses them as
subtests, is given in Figure 4. Here, “Inputs” refers to a subset of designated questions in the
test; “Relation” indicates a relation that the test aims to certify; “Test” describes the certification
protocol. (Recall that all our protocols implicitly include a “consistency test”, not specified on
10Note that 𝑅 will not be directly accessed in the test, since by itself it does not necessarily correspond to a
measurement.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 24
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
the figure, in which a question is chosen uniformly at random from the marginal distribution
and sent to both players, whose answers are accepted if and only if they are equal. We use this
consistency test implicitly by analyzing only strategies that are symmetric, i. e., both provers’
Hilbert spaces and measurement operators are identical.)
Test conj(A,B,R)
• Inputs: 𝐴, 𝐵, 𝑋, 𝑍, 𝑋𝑅 and 𝐶 observables.
• Relations: 𝒞{𝑅, 𝐶}, with 𝑅 defined from 𝑋𝑅 , and 𝐶 related to 𝐴 and 𝐵, as in (3.4).
• Test: execute each of the following with equal probability
(a) With probability 1/8 each, execute tests ac(𝑋 , 𝑍), com(𝐶, 𝑍), com(𝑋𝑅 , 𝐶), ac(𝑋𝑅 , 𝑍)
and com(𝐴, 𝑋), com(𝐵, 𝑋), com(𝐴, 𝑍), com(𝐵, 𝑍).
(b) Ask one player to measure 𝐴, 𝐵, 𝐶 or 𝑍 (with probability 1/4 each), and the other to
jointly measure 𝐴 or 𝐵 (with probability 1/2 each) and 𝑍. The first player returns one
bit, and the second two bits. Make an acceptance decision as follows:
– If the first player was asked 𝐶 and the second player was asked (𝐴, 𝑍) then accept
unless the second player’s second answer bit is 0 and his first answer bit does not
match the first player’s;
– If the first player was asked 𝐶 and the second player was asked (𝐵, 𝑍) then accept
unless the second player’s second answer bit is 1 and his first answer bit does not
match the first player’s;
– If the first player was asked 𝐴, 𝐵, or 𝑍 then accept if and only if his answer bit
matches the corresponding answer from the second player.
In all other cases, accept.
Figure 4: The conjugation test, conj(𝐴, 𝐵, 𝑅).
Lemma√ 3.5. The test conj(𝐴, 𝐵, 𝑅) is a (1, 𝛿) self-test for the set of relations 𝒞{𝑅, 𝐶}, for some
𝛿 = 𝑂( 𝜀). Moreover, for any strategy that succeeds with probability at least 1 − 𝜀 in the test it holds
that 𝐶 ≈𝛿 𝐴(Id +𝑍)/2 + 𝐵(Id −𝑍)/2, where 𝐴, 𝐵, 𝐶 and 𝑍 are the observables applied by the player on
receipt of a question with the same label.
Proof. Completeness is clear, as players making measurements on a maximally entangled state
on ℋA ⊗ ℋB , tensored with an EPR pair on ℂ2A0 ⊗ ℂ2B0 for the 𝑋 and 𝑍 observables, and using
𝑋𝑅 and 𝐶 defined in (3.4) (with the blocks specified by the space associated with each player’s
half-EPR pair) succeed in each test with probability 1.
We now consider soundness. Success in ac(𝑋 , 𝑍) in part (a) of the test implies the existence of
local isometries 𝑉𝐴 , 𝑉𝐵 such that 𝑉𝐴 : ℋA → ℋ ⊗ ℂ2A0 , with 𝑋 '√𝜀 Id ⊗𝜎𝑋 and 𝑍 '√𝜀 Id ⊗𝜎𝑍 .
By Lemma A.3, approximate commutation with both 𝑋 and 𝑍 enforced by the tests com(𝐴, 𝑋),
com(𝐴, 𝑍), com(𝐵, 𝑋) and com(𝐵, 𝑍) implies that under the same isometry,
𝐴 '√𝜀 𝐴𝐼 ⊗ Id and 𝐵 '√𝜀 𝐵𝐼 ⊗ Id , (3.5)
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 25
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
for observables 𝐴𝐼 , 𝐵𝐼 on ℋÂ . Similarly, the parts of the test involving 𝐶 and 𝑋𝑅 imply that they
each have the block decomposition specified in (3.4). In particular, using the second part of
Lemma A.6 (with 𝑛 = 1 and 𝑐 = 1, exchanging the roles of 𝑍 and 𝑋) anti-commutation of 𝑋𝑅
with 𝑍 certifies that 𝑋𝑅 has a decomposition of the form
𝑋𝑅 '√𝜀 𝑅 𝑋 ⊗ 𝜎𝑋 + 𝑅𝑌 ⊗ 𝜎𝑌 . (3.6)
Let 𝑅 = (𝑅 𝑋 + 𝑖𝑅𝑌 )|𝑅 𝑋 + 𝑖𝑅𝑌 | −1 , so that 𝑅 is unitary. Note that since 𝑋𝑅 is an observable,
𝑋𝑅2 = Id.
and so it follows from (3.6) that (𝑅 𝑋 + 𝑖𝑅𝑌 )(𝑅 𝑋 + 𝑖𝑅𝑌 )† ⊗ Id '√𝜀 Id. Thus 𝑅 '√𝜀 𝑅 𝑋 + 𝑖𝑅𝑌 .
Similarly, using the first part of Lemma A.6 commutation of 𝐶 with 𝑍 implies that
𝐶 '√𝜀 𝐶 𝐼 ⊗ 𝜎𝐼 + 𝐶 𝑍 ⊗ 𝜎𝑍 , (3.7)
for Hermitian 𝐶 𝐼 , 𝐶 𝑍 such that 𝐶 𝐼 ± 𝐶 𝑍 are observables because 𝐶 is an observable.
𝑎,𝑧
Next we analyze part (b) of the test. Let {𝑊𝐴𝑍 } be the projective measurement applied by
the second player upon query (𝐴, 𝑍). Success with probability 1 − 𝑂(𝜀) conditioned on the
questions being 𝐶 and (𝐴, 𝑍) item ensures that
h𝜓|𝐶 0 ⊗ (𝑊𝐴𝑍
00
+ 𝑊𝐴𝑍
01
+ 𝑊𝐴𝑍
11
) + 𝐶 1 ⊗ (𝑊𝐴𝑍
10
+ 𝑊𝐴𝑍
01
+ 𝑊𝐴𝑍
11
)|𝜓i ≥ 1 − 𝑂(𝜀), (3.8)
and a similar condition holds for the case 𝐶 and (𝐵, 𝑍), with 𝑊𝐵𝑍 instead of 𝑊𝐴𝑍 .
Success with probability 1 − 𝑂(𝜀) in the case of questions 𝐴, 𝐵 or 𝑍 and (𝐴, 𝑍) or (𝐵, 𝑍)
𝑎,𝑧 𝑏,𝑧
ensures consistency of {𝑊𝐴𝑍 } and {𝑊𝐵𝑍 }, resp., with the observable 𝐴 and 𝐵, resp., when
marginalizing over the second outcome, and 𝑍 when marginalizing over the first outcome.
Since 𝐴 and 𝐵 approximately commute with 𝑍, using the decompositions for 𝐴 and 𝐵 derived
in (3.5) it follows that 𝑊𝐴𝑍 '√𝜀 𝐴𝐼 ⊗ 𝜎𝑍 and 𝑊𝐵𝑍 '√𝜀 𝐵𝐼 ⊗ 𝜎𝑍 .
Similarly regarding the observable 𝐶, using that we already showed in (3.7) that 𝐶 is block-
diagonal in the basis specified by 𝑋 and 𝑍, (3.8) and 𝑊𝐴𝑍 '√𝜀 𝐴𝐼 ⊗ 𝜎𝑍 gives (𝐶 𝐼0 + 𝐶 𝑍0 ) '√𝜀 𝐴0𝐼
and (𝐶 𝐼1 + 𝐶 𝑍1 ) '√𝜀 𝐴1𝐼 . Using the analogous relations for 𝑊𝐵𝑍 we get (𝐶 𝐼 − 𝐶 𝑍 ) '√𝜀 𝐵𝐼 . Thus
𝐶 𝐼 '√𝜀 (𝐴 + 𝐵)/2 and 𝐶 𝑍 '√𝜀 (𝐴 − 𝐵)/2. This shows the “Moreover” part of the lemma.
Finally, success in test com(𝑋𝑅 , 𝐶) certifies the approximate commutation relation [𝑋𝑅 , 𝐶] '√𝜀
0, which, given the decomposition of 𝑋𝑅 and 𝐶 obtained so far, implies 𝑅𝐴 '√𝜀 𝐵𝑅, as
desired.
3.3 Testing Clifford unitaries
Let 𝑚 ≥ 1 be an integer, and 𝑅 an 𝑚-qubit Clifford unitary. 𝑅 is characterized, up to phase, by its
action by conjugation on the 𝑚-qubit Weyl-Heisenberg group. This action is described by linear
functions ℎ 𝑆 : {0, 1} 𝑚 × {0, 1} 𝑚 → {0, 1} and ℎ 𝑋 , ℎ 𝑍 : {0, 1} 𝑚 × {0, 1} 𝑚 → {0, 1} 𝑚 such that
𝑅𝜎𝑋 (𝑎)𝜎𝑍 (𝑏)𝑅 † = (−1) ℎ𝑆 (𝑎,𝑏) 𝜎𝑋 (ℎ 𝑋 (𝑎, 𝑏))𝜎𝑍 (ℎ 𝑍 (𝑎, 𝑏)), ∀𝑎, 𝑏 ∈ {0, 1} 𝑚 . (3.9)
Using that (𝜎𝑋 (𝑎)𝜎𝑍 (𝑏))† = (−1)𝑎·𝑏 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏), the same condition must hold of the right-
hand side of (3.9), thus ℎ 𝑋 (𝑎, 𝑏) · ℎ 𝑍 (𝑎, 𝑏) = 𝑎 · 𝑏 mod 2. To any family of observables
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 26
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
{𝑋(𝑎), 𝑍(𝑏), 𝑎, 𝑏 ∈ {0, 1} 𝑚 } satisfying the Pauli anti-commutation relations we associate, for
𝑎, 𝑏 ∈ {0, 1} 𝑚 ,
𝐴(𝑎, 𝑏) = 𝑖 𝑎·𝑏 𝑋(𝑎)𝑍(𝑏), 𝐵(𝑎, 𝑏) = 𝑖 𝑎·𝑏 𝑋(ℎ 𝑋 (𝑎, 𝑏))𝑍(ℎ 𝑍 (𝑎, 𝑏)), (3.10)
where the phase 𝑖 𝑎·𝑏 is introduced to ensure that 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏) are observables. Define 𝑋𝑅
in terms of 𝑅, and 𝐶(𝑎, 𝑏) in terms of 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏), as in (3.4). The Clifford conjugation
test aims to test for the conjugation relation 𝑋𝑅 𝐴(𝑎, 𝑏)𝑋𝑅† = 𝐵(𝑎, 𝑏), for all (in fact, on average
over a randomly chosen) (𝑎, 𝑏). For this, we first need a test that ensures 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏)
themselves have the correct form, in terms of a tensor product of Pauli observables. Such a
test was introduced in [35], where it is called “Pauli braiding test”. The test certifies the Pauli
relations
n o
𝒫 (𝑚){𝑋 , 𝑌, 𝑍} = 𝑊(𝑎) ∈ Obs : 𝑊 ∈ {𝑋 , 𝑌, 𝑍} 𝑚 , 𝑎 ∈ {0, 1} 𝑚
n o
∪ 𝑊(𝑎)𝑊 0(𝑎 0) = (−1)|{𝑖: 𝑊𝑖 ≠𝑊𝑖 ∧𝑎 𝑖 𝑎 𝑖 =1}| 𝑊 0(𝑎 0)𝑊(𝑎) : 𝑊 , 𝑊 0 ∈ {𝑋 , 𝑌, 𝑍} 𝑛 , 𝑎, 𝑎 0 ∈ {0, 1} 𝑚
0 0
n o
∪ 𝑊(𝑎)𝑊(𝑎 0) = 𝑊(𝑎 + 𝑎 0) : 𝑊 ∈ {𝑋 , 𝑌, 𝑍} 𝑛 , 𝑎, 𝑎 0 ∈ {0, 1} 𝑚 .
The Pauli braiding test, which is due to [35], allows to test for tensor products of 𝜎𝑋 and 𝜎𝑍
Pauli observables. We recall the test in Appendix A.4.1. In Appendix A.4.3 we extend the test to
include Pauli 𝜎𝑌 . We refer to the extended test as pbt(𝑋 , 𝑌, 𝑍). For the extended test we can
show the following; see Appendix A.4.3 for the proof.
Lemma 3.6. Suppose |𝜓i ∈ ℋA ⊗ ℋB and 𝑊(𝑎) ∈ Obs(ℋA ), for 𝑊 ∈ {𝑋 , 𝑌, 𝑍} 𝑚 and 𝑎 ∈ {0, 1} 𝑚 ,
specify a strategy for the players that has success probability at least 1 − 𝜀 in the extended Pauli
braiding test pbt(𝑋 , 𝑌, 𝑍) described in Figure 32. Then there exist a state |auxiÂB̂ and isometries
𝑉𝐷 : ℋD → ((ℂ2 )⊗𝑚 )D0 ⊗ ℋ̂D̂ , for 𝐷 ∈ {𝐴, 𝐵}, such that
√
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRiA⊗𝑚 = 𝑂( 𝜀),
2
0 0 |auxiÂB̂
B
and on expectation over 𝑊 ∈ {𝑋 , 𝑌, 𝑍} 𝑚 ,
√
𝑊(𝑎) − 𝑉𝐴† (𝜎𝑊 (𝑎) ⊗ Δ𝑊 (𝑎))𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀),
2
E (3.11)
𝑎∈{0,1} 𝑚
Î 𝑎𝑖
where Δ𝑊 (𝑎) = 𝑖 Δ𝑊𝑖 ∈ Obs(ℋÂ ) are observables with Δ𝑋 = Δ𝑍 = Id and Δ𝑌 an arbitrary observable
on ℋ̂𝐴ˆ . Moreover, similar conditions hold on the B systems and
√
= 𝑂( 𝜀) ,
2
Δ𝑌 ⊗ Δ𝑌 |auxi − |auxi
where as usual we use the same label for an observable acting on registers A or B.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 27
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Building on the Pauli braiding test and the conjugation test from the previous section, the
Clifford conjugation test conj-cliff(𝑅) described in Figure 5 provides a test for the set of relations
𝒥ℎ𝑆 ,ℎ 𝑋 ,ℎ 𝑍 {𝑅} = 𝒫 (𝑚){𝑋 , 𝑌, 𝑍} ∪ {𝑅 ∈ U} ∪ {Δ𝑌 ∈ Obs}
ℎ (𝑎,𝑏)
∪ 𝑅𝑋(𝑎)𝑍(𝑏)𝑅 † = Δ𝑌𝑆 𝑋(ℎ 𝑋 (𝑎, 𝑏))𝑍(ℎ 𝑍 (𝑎, 𝑏)) : 𝑎, 𝑏 ∈ {0, 1} 𝑚
∪ Δ𝑌 𝑋(𝑎) = 𝑋(𝑎)Δ𝑌 , Δ𝑌 𝑍(𝑏) = 𝑍(𝑏)Δ𝑌 : 𝑎, 𝑏 ∈ {0, 1} 𝑚 .
(3.12)
Note the presence of the observable Δ𝑌 , which arises from the conjugation ambiguity in the
definition of 𝑌 (see Lemma 3.6).
Test conj-cliff(R):
• Input: 𝑅 an 𝑚-qubit Clifford unitary. Let ℎ 𝑆 , ℎ 𝑋 , ℎ 𝑍 be such that (3.9) holds, and
𝐴(𝑎, 𝑏), 𝐵(𝑎, 𝑏) the observables defined in (3.10).
• Relations: 𝒥ℎ𝑆 ,ℎ 𝑋 ,ℎ 𝑍 {𝑅} defined in (3.12).
• Test: execute each of the following with equal probability
(a) Execute test pbt(𝑋 , 𝑌, 𝑍) on (𝑚 + 1) qubits, where the last qubit is called the “control”
qubit;
(b) Select 𝑎, 𝑏 ∈ {0, 1} 𝑚 uniformly at random. Let 𝐶(𝑎, 𝑏) be the observable defined from
𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏) in (3.4), with the block structure specified by the control qubit.
Execute test conj{𝐴(𝑎, 𝑏), 𝐵(𝑎, 𝑏), 𝑅}. In the test, to specify query 𝐴(𝑎, 𝑏) or 𝐵(𝑎, 𝑏),
represent each as a string in {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 (omitting the additional phase 𝑖, which is
applied by the prover but not specified explicitly on the query label) and use the
same label as for the same query when it is used in part (a).
Figure 5: The Clifford conjugation test, conj-cliff(𝑅).
Lemma 3.7. Let 𝑅 be an 𝑚-qubit Clifford unitary and ℎ 𝑆 , ℎ 𝑋 , ℎ 𝑍 such that (3.9) holds. Suppose a
strategy for the players succeeds with probability at least 1 − 𝜀 in test conj-cliff(𝑅). Let 𝑉𝐴 : ℋA →
((ℂ2 )⊗(𝑚+1) )A0 ⊗ ℋÂ be the isometry whose existence follows from part (a) of the test, and Δ𝑌 the observable
on ℋÂ0 that represents the phase ambiguity (see Lemma 3.6). Then there exists a unitary Λ𝑅 on ℋÂ and
another unitary Λ𝑅 on ℋB̂ , such that each commutes with Δ𝑌 on the same system and
= 𝑂(poly(𝜀)),
2
Λ𝑅 ⊗ Λ𝑅 |auxi − |auxi (3.13)
where |auxi is the state defined in Lemma 3.6. Moreover, let 𝜏ˆ 𝑅 be any 𝑚-qubit Clifford unitary, acting
on the space (ℂ2 )⊗𝑚 into which the isometry 𝑉𝐴 maps, which satisfies the relations specified in (3.9),
where for any location 𝑖 ∈ {1, . . . , 𝑚} such that 𝑎 𝑖 = 𝑏 𝑖 = 1 we replace 𝜎𝑋 𝜎𝑍 by 𝜏𝑌 = 𝜎𝑌 ⊗ (𝑖Δ𝑌 ).11
11Note that 𝜏ˆ 𝑅 is uniquely defined up to phase.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 28
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Then, letting 𝜏𝑅 = 𝜏ˆ 𝑅 (IdA0 ⊗Λ𝑅 ) we have that under the same isometry,
𝑅 'poly(𝜀) 𝜏𝑅 .
In the lemma, the unitary Λ𝑅 is necessary because whenever a unitary 𝑅 satisfies the
relations (3.9) the unitary 𝑅 ⊗ Λ𝑅 satisfies them as well, where Λ𝑅 is any unitary acting on an
ancilla system. In Section 3.5 we show that these unitaries can be ignored when looking at
post-measurement states in the protocol, which is what will ultimately be important for us.
Note that 𝜏ˆ 𝑅 is only defined up to phase in the lemma. Any representative will do, as the
phase ambiguity can be absorbed in Λ𝑅 . As an example, in this notation we have
1 1
𝜏ˆ 𝐹 = √ − 𝜎𝑋 + 𝜎𝑌 ⊗ Δ𝑌 , 𝜏ˆ 𝐺 = √ 𝜎𝑋 + 𝜎𝑌 ⊗ Δ𝑌 ,
(3.14)
2 2
where the “honest” single-qubit Clifford observables 𝜎𝐹 and 𝜎𝐺 are defined in (2.2).
Completeness of the test is clear, as players making measurements on (𝑚 + 1) shared EPR
pairs using standard Pauli observables, 𝑅, and 𝐶(𝑎, 𝑏) defined in (3.4) with 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏)
as in (3.10) will pass all tests with probability 1.
Proof sketch. For 𝐷 ∈ {𝐴, 𝐵} let 𝑉𝐷 be the isometries that follow from part (a) of the test and
Lemma 3.6. According to (3.10), 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏) can each be expressed (up to phase) as a
tensor product of 𝑋 , 𝑌, 𝑍 operators, where the number of occurrences of 𝑌 modulo 2 is 𝑎 · 𝑏
for 𝐴(𝑎, 𝑏) and ℎ 𝑋 (𝑎, 𝑏) · ℎ 𝑍 (𝑎, 𝑏) = 𝑎 · 𝑏 mod 2 for 𝐵(𝑎, 𝑏). Thus the labels used to specify
the observables in 𝐴(𝑎, 𝑏) and 𝐵(𝑎, 𝑏) in part (b), together with the analysis of part (a) and
Lemma 3.6, imply that under the same isometry we have
𝐴(𝑎, 𝑏) '√𝜀 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ (𝑖Δ𝑌 )𝑎·𝑏 and 𝐵(𝑎, 𝑏) '√𝜀 𝜎𝑋 (ℎ 𝑋 (𝑎, 𝑏))𝜎𝑍 (ℎ 𝑍 (𝑎, 𝑏)) ⊗ (𝑖Δ𝑌 )𝑎·𝑏+ℎ𝑆 (𝑎,𝑏) ,
where the imaginary phase comes from (3.10). Applying the analysis of the conjugation test
given in Lemma 3.5 shows that 𝑋𝑅 must have the form in (3.4), for some 𝑅 that approximately
conjugates 𝐴(𝑎, 𝑏) to 𝐵(𝑎, 𝑏), on average over uniformly random 𝑎, 𝑏 ∈ {0, 1} 𝑚 .
Let 𝜏ˆ 𝑅 be as defined in the lemma. Note that 𝜏ˆ 𝑅 acts on ℋA0 and ℋÂ . After application of the
isometry, 𝑅 has an expansion
Õ
𝑅 ' 𝜏ˆ 𝑅 · 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ Λ𝑅 (𝑎, 𝑏) , (3.15)
𝑎,𝑏
for arbitrary Λ𝑅 (𝑎, 𝑏) on ℋÂ ; since 𝜏ˆ 𝑅 is invertible such an expansion exists for any operator.
Using the approximate version of (3.9) certified by the conjugation test (Lemma 3.5),
𝑎·𝑏+ℎ 𝑆 (𝑎,𝑏)
𝑅𝑉𝐴† 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ Δ𝑌𝑎·𝑏 𝑉𝐴 ≈ 𝑉𝐴† 𝜎𝑋 (ℎ 𝑋 (𝑎, 𝑏))𝜎𝑍 (ℎ 𝑍 (𝑎, 𝑏)) ⊗ Δ𝑌 𝑉𝐴 𝑅,
where the approximation holds on average over a uniformly random choice of (𝑎, 𝑏) and up to
error that is polynomial in 𝜀 but independent of 𝑚. Expanding out 𝑅 and using the consistency
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 29
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
relations between the two players,
Õ
𝜏ˆ 𝑅 𝜎𝑋 (𝑐)𝜎𝑍 (𝑑) ⊗ Λ𝑅 (𝑐, 𝑑) ⊗ (−1)𝑎·𝑏 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ Δ𝑌𝑎·𝑏
𝑐,𝑑
𝑎·𝑏+ℎ 𝑆 (𝑎,𝑏)
Õ
≈ 𝜎𝑋 (ℎ 𝑋 (𝑎, 𝑏))𝜎𝑍 (ℎ 𝑍 (𝑎, 𝑏)) ⊗ Δ𝑌 𝜏ˆ 𝑅 𝜎𝑋 (𝑐)𝜎𝑍 (𝑑) ⊗ Λ𝑅 (𝑐, 𝑑) ⊗ Id ,
𝑐,𝑑
(3.16)
where the factor (−1)𝑎·𝑏 comes from using
𝑇
𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ Id |EPRi ⊗𝑚 = Id ⊗ 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) |EPRi ⊗𝑚 .
The approximation in (3.16) and the following equations are meant on average over uniformly
random 𝑎, 𝑏 ∈ {0, 1} 𝑛 . Using the conjugation relations satisfied, by definition, by 𝜏ˆ 𝑅 , the
right-hand side of (3.16) simplifies to
Õ
𝜏ˆ 𝑅 𝜎𝑋 (𝑎)𝜎𝑍 (𝑏)𝜎𝑋 (𝑐)𝜎𝑍 (𝑑) ⊗ Δ𝑌𝑎·𝑏 Λ𝑅 (𝑐, 𝑑) ⊗ Id . (3.17)
𝑐,𝑑
Next using the fact that the state on which the approximations are measured is maximally
entangled across registers A and B together with the Pauli (anti-)commutation relations to
simplify the left-hand side of (3.16), together with (3.17) we arrive at the approximation
Õ
(−1)𝑎·𝑑+𝑏·𝑐 𝜎𝑋 (𝑎 + 𝑐)𝜎𝑍 (𝑏 + 𝑑) ⊗ Λ𝑅 (𝑐, 𝑑) ⊗ Id ⊗Δ𝑌𝑎·𝑏
𝑐,𝑑
Õ
≈ 𝜎𝑋 (𝑎 + 𝑐)𝜎𝑍 (𝑏 + 𝑑) ⊗ Δ𝑌𝑎·𝑏 Λ𝑅 (𝑐, 𝑑) ⊗ Id .
𝑐,𝑑
If (𝑐, 𝑑) ≠ (0, 0) a fraction about half of all (𝑎, 𝑏) such that 𝑎 · 𝑏 = 0 satisfy 𝑎 · 𝑑 + 𝑏 · 𝑐 = 1.
Using that {𝜎𝑋 (𝑎)𝜎𝑍 (𝑏) ⊗ Id |EPRi} are orthogonal for different (𝑎, 𝑏), the above then implies
that Λ𝑅 (𝑐, 𝑑) ≈ −Λ𝑅 (𝑐, 𝑑), on average over (𝑐, 𝑑) ≠ (0, 0). Hence Λ𝑅 (𝑐, 𝑑) ≈ 0, on average over
(𝑐, 𝑑) ≠ (0, 0). Considering (𝑎, 𝑏) such that 𝑎 ·𝑏 = 1 implies that Λ𝑅 (0, 0) approximately commutes
with Δ𝑌 . Finally, the relation (3.13) follows from consistency of 𝑋𝑅 with itself implicitly enforced
in the test (see Section 3.1.3).
3.4 Tensor products of single-qubit Clifford observables
We turn to testing observables in the 𝑚-fold direct product of the Clifford group. Although
the test can be formulated more generally, for our purposes it will be sufficient to specialize
it to the case where each element in the direct product is an observable taken from the set
Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺} associated with the single-qubit Pauli observables defined in Section 2.1.
Recall that the associated operators satisfy the conjugation relation 𝜎𝑌 𝜎𝐹 𝜎𝑌 = 𝜎𝐺 , which will be
tested as part of our procedures (specifically, item (c) in Figure 6).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 30
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
The test is described in Figure 6. It is divided in five parts. Part (a) of the test executes
conj-cliff(𝑊) to verify that an observable 𝑊 ∈ Σ𝑚 satisfies the appropriate Pauli conjugation
relations (3.9). Note that a priori test conj-cliff(𝑊) only tests for the observable 𝑋𝑊 obtained
from 𝑊 in blocks as 𝑋𝑅 from 𝑅 in (3.4) (indeed, in that test 𝑊 need not be an observable). Thus
part (b) of the test is introduced to verify that 𝑋𝑊 ≈ 𝑊 𝑋(𝑒 𝑚+1 ), where the (𝑚 + 1)-st qubit is
the one used to specify the block decomposition relating 𝑋𝑊 to 𝑊. The result of parts (a) and
(b) is that, under the same isometry as used to specify the Pauli 𝑋 and 𝑍, 𝑊 ' 𝜏ˆ𝑊 · (Id ⊗Λ𝑊 ),
according to the same decomposition as shown in Lemma 3.7. The goal of the remaining three
|{𝑖:𝑊 ∈{𝐹,𝐺}}|
parts of the test is to verify that Λ𝑊 = Λ𝐹 𝑖 , for a single observable Λ𝐹 . For this, part (c)
of the test verifies that Λ𝑊 only depends on the locations at which 𝑊𝑖 ∈ {𝐹, 𝐺}, but not on the
Î
specific observables at those locations. Part (d) verifies that Λ𝑊 ≈ 𝑖:𝑊𝑖 ∈{𝐹,𝐺} Λ𝑖 for commuting
observables Λ𝑖 . Finally, part (e) checks that Λ𝑖 is (approximately) independent of 𝑖.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 31
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Test cliff(Σ, 𝑚):
• Input: An integer 𝑚 and a subset Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺} of the single-qubit Clifford group.
• Test: Select 𝑊 ∈ Σ𝑚 uniformly at random. Execute each of the following with equal
probability:
(a) Execute the test conj-cliff(𝑊);
(b) Send one player either the query 𝑊, or 𝑋𝑊 and the other (𝑊 , 𝑋(𝑒 𝑚+1 )), where 𝑒 𝑚+1
indicates the control qubit used for part (a). Receive one bit from the first player,
and two from the second. If the query to the first player was 𝑊, check that the first
player’s answer is consistent with the second player’s first answer bit. If the query to
the first player was 𝑋𝑊 , then: If the second player’s second bit is 0, check that his first
bit is consistent with the first player’s; If the second player’s second bit is 1, check
that his first bit is different than the first player’s.
(c) Let 𝑆 and 𝑇 be subsets of the positions in which 𝑊𝑖 = 𝐹 and 𝑊𝑖 = 𝐺, respectively, are
chosen uniformly at random. Let 𝑊 0 equal 𝑊 except 𝑊𝑖0 = 𝐺 for 𝑖 ∈ 𝑆, and 𝑊𝑖0 = 𝐹
for 𝑖 ∈ 𝑇. Let 𝑅 = 𝑌( 𝑖∈𝑆∪𝑇 𝑒 𝑖 ). Execute test conj(𝑊 , 𝑊 0 , 𝑅).
Í
(d) Set 𝑊𝑖0 = 𝑋 , 𝑌, 𝐹, 𝐺 𝑖 whenever 𝑊𝑖 = 𝑌, 𝑋 , 𝐺 𝑖 , 𝐹, respectively. Set 𝑊𝑖0 = 𝑋 whenever
𝑊𝑖 = 𝑍. Execute test pbt(𝑊 , 𝑊 0) on 𝑚 qubits.
(e) Let 𝑆 and 𝑇 be subsets of (non-overlapping) pairs of positions in which 𝑊𝑖 = 𝐹 and
𝑊𝑖 = 𝐺, respectively, chosen uniformly at random. Send one player the query 𝑊,
with entries (𝑖, 𝑗) ∈ 𝑆 ∪ 𝑇 removed and replaced by Φ𝑖,𝑗 (indicating a measurement in
the Bell basis).
– With probability 1/2, send the other player the query 𝑊. Check consistency of
outcomes associated with positions not in 𝑆 ∪ 𝑇. For outcomes in 𝑆 ∪ 𝑇, check the
natural consistency as well. E. g., if the Bell measurement indicated the outcome
Φ00 , then the two outcomes reported by the other player at those locations should
be identical.
– With probability 1/2, execute an independent copy of the Bell measurement test
Bell (Figure 29) between the first and second players in each of the pair of qubits
in 𝑆 ∪ 𝑇.
Figure 6: The 𝑚-qubit Clifford test, cliff(Σ, 𝑚).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 32
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Theorem 3.8. Suppose a strategy for the players succeeds in test cliff(Σ, 𝑚) (Figure 6) with probability
at least 1 − 𝜀. Then for 𝐷 ∈ {𝐴, 𝐵} there exists an isometry
𝑉𝐷 : ℋD → (ℂ2 )D⊗𝑚
0 ⊗ ℋD̂
such that √
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRiA⊗𝑚 = 𝑂( 𝜀),
2
0 0 |auxiÂB̂ (3.18)
B
and
Id𝐴 ⊗ 𝑉𝐵 𝑊(𝑐) − 𝜏𝑊 (𝑐)𝑉𝐵 |𝜓iAB = 𝑂(poly(𝜀)).
2
E (3.19)
𝑊 ∈Σ𝑚 , 𝑐∈{0,1} 𝑚
Here 𝜏𝑊 is defined from 𝑊 as in Lemma 3.7, with Λ𝑊𝑖 = Id if 𝑊𝑖 ∈ {𝑋 , 𝑌, 𝑍} and Λ𝑊𝑖 = Λ𝐹 if
𝑊𝑖 ∈ {𝐹, 𝐺}, where Λ𝐹 is an observable on ℋB̂ that commutes with Δ𝑌 .
Proof sketch. We indicate all steps of the proof, but omit some of the more routine calculations
for legibility. The existence of the isometry, as well as (3.18) and (3.19) for 𝑊 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 ,
follows from the test pbt(𝑋 , 𝑌, 𝑍), executed as part of the Clifford conjugation test from part
(a), and Lemma 3.6. Using part (a) of the test and Lemma 3.7 it follows that every 𝑊 ∈ Σ𝑚 is
mapped under the same isometry to
𝑊 '√𝜀 𝜏𝑊 = 𝜏ˆ𝑊 (Id ⊗Λ𝑊 ), (3.20)
where 𝜏ˆ𝑊 is as defined in the lemma and Λ𝑊 is an observable on ℋÂ which may depend on the
whole string 𝑊; here we also use the consistency check in part (b) to relate the observable 𝑋𝑊
used in the Clifford conjugation test with the observable 𝑊 used in part (c). Note that from the
definition we can write 𝜏ˆ𝑊 = ⊗𝑖 𝜏ˆ𝑊𝑖 , where in particular 𝜏ˆ 𝑋 = 𝜎𝑋 , 𝜏ˆ 𝑍 = 𝜎𝑍 and 𝜏ˆ𝑌 = 𝜎𝑌 ⊗ Δ𝑌 .
The analysis of the conjugation test given in Lemma 3.5 shows that success with probability
1 − 𝑂(𝜀) in part (c) of the test implies the relations
𝜏ˆ𝑊 𝜏𝑅 (Id ⊗Λ𝑊 ) = 𝜏𝑅 𝜏ˆ𝑊 (Id ⊗Λ𝑊 )
≈√𝜀 𝜏ˆ𝑊 0 𝜏𝑅 (Id ⊗Λ𝑊 0 ),
where the first equality is by definition of 𝜏𝑅 , and uses that 𝜏𝑌 = 𝜎𝑌 ⊗ Δ𝑌 and Δ𝑌 commutes with
Λ𝑊 ; the approximation holds as a consequence of the conjugation test and should be understood
on average over a uniformly random choice of 𝑊 ∈ Σ𝑚 . Thus Λ𝑊 depends only on the locations
at which 𝑊𝑖 ∈ {𝐹, 𝐺}, but not on the particular values of the observables at those locations.
Part (d) of the test and Lemma 3.6 imply that the observables 𝑊(𝑎) satisfy approximate
linearity conditions 𝑊(𝑎)𝑊(𝑎 0) ≈ 𝑊(𝑎 + 𝑎 0), on average over a uniformly random choice of
𝑊 ∈ Σ𝑛 and 𝑎, 𝑎 0 ∈ {0, 1} 𝑛 . Using the form (3.20) for 𝑊 and the fact that the 𝜏ˆ𝑊 (𝑎) satisfy
the linearity relations by definition, we deduce that Λ𝑊(𝑎) Λ𝑊(𝑎0) ≈ Λ𝑊(𝑎+𝑎0) as well. Using the
analysis of the Pauli braiding test (Lemma 3.6), this implies that for each 𝑖 and 𝑊𝑖 there is an
Î
observable Λ𝑖,𝑊𝑖 such that the Λ𝑖,𝑊𝑖 pairwise commute and Λ𝑊 ≈ 𝑖 Λ𝑖,𝑊𝑖 . Using the preceding
observations, Λ𝑖,𝑊𝑖 ≈ Λ𝑖 if 𝑊𝑖 ∈ {𝐹, 𝐺}, and Λ𝑖,𝑊𝑖 ≈ Id if 𝑊𝑖 ∈ {𝑋 , 𝑌, 𝑍}.
Success in part (e) of the test implies the condition E𝑊 h𝜓|𝑊 ⊗ 𝑊Φ |𝜓i ≥ 1 − 𝑂(𝜀), where
𝑊 is distributed as in the test, and 𝑊Φ is the observable applied by the second player upon
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 33
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
a query 𝑊, with some locations, indexed by pairs in 𝑆 and 𝑇, have been replaced by the Φ
symbol (as described in the test). Let 𝑈 be the set of 𝑖 such that 𝑊𝑖 ∈ {𝐹, 𝐺}. Since Δ𝑌 commutes
with all observables in play, for clarity let us assume in the following that Δ𝑌 = Id. From the
decomposition of the observables 𝑊 obtained so far and the analysis of the test Bell given in
Lemma A.4 it follows that
Ö Ö
𝑊' ⊗𝑖 𝜏ˆ𝑊𝑖 ⊗ Λ𝑖 , and 𝑊Φ ' ⊗𝑖∉𝑆∪𝑇 𝜏ˆ𝑊𝑖 ⊗ ⊗(𝑖,𝑗)∈𝑆∪𝑇 SW𝑖,𝑗 ⊗ Λ𝑖 ,
𝑖∈𝑈 𝑖∈𝑈\𝑆∪𝑇
where the ordering of tensor products does not respect the ordering of qubits, but it should be
clear which registers each operator acts on. Using that for any operators 𝐴, 𝐵 and Δ,
1
hEPR| ⊗2 𝐴 ⊗ 𝐵 ⊗ |Φ00 ihΦ00 | |EPRi ⊗2 = Tr 𝐴𝐵𝑇 ,
8
the above conditions imply
E E Λ𝑠 𝑖 Λ𝑠 0𝑖 Λ𝑡 𝑖 Λ𝑡 𝑖0 ≈ Id,
𝑆={(𝑠 𝑖 ,𝑠 0𝑖 )} 𝑇={(𝑡 𝑖 ,𝑡 𝑖0 )}
where the expectation is taken over sets 𝑆 and 𝑇 specified as in part (e), for a given 𝑊, and on
average over the choice of 𝑊. Let Λ = E𝑖 Λ𝑖 . By an averaging argument it follows that for 𝑈 the
set of locations such that 𝑊𝑖 ∈ {𝐹, 𝐺}, 𝑖∈𝑈 Λ𝑖 ≈ Λ|𝑆| , again on average over the choice of 𝑊. To
Î
conclude we let Λ𝐹 = Λ/|Λ|, which is an observable and satisfies the required conditions.
3.5 Post-measurement states
We prove Theorem 3.1. The remaining work consists in “lifting” the phase ambiguity Λ𝑊 which
remains in the statement of Theorem 3.8 (in contrast to the ambiguity Δ𝑌 , which itself cannot be
lifted solely by examining correlations). This ambiguity means that the players have the liberty
of choosing to report opposite outcomes whenever they apply an 𝐹 or 𝐺 observable, but they
have to be consistent between themselves and across all of their qubits in doing so. To verify
that the provers use the “right” labeling for their outcomes we incorporate a small tomography
test. Our final test rigid(Σ, 𝑚), which builds on all tests developed in this section, is described
in Figure 7. Note that a drawback of the tomography is that the test no longer achieves perfect
completeness (although completeness remains exponentially close to 1).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 34
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Test rigid(Σ, 𝑚):
• Input: An integer 𝑚 and a subset Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺} of the single-qubit Clifford group.
• Test: execute each of the following with equal probability:
(a) Execute the test cliff(Σ, 𝑚);
(b) Send each player a uniformly random query 𝑊 , 𝑊 0 ∈ Σ𝑚 . Let 𝑇 ⊆ {1, . . . , 𝑚} be the
subset of positions 𝑖 such that 𝑊𝑖 ∈ {𝑋 , 𝑌} and 𝑊𝑖0 ∈ {𝐹, 𝐺}. Reject if the fraction of
answers (𝑎 𝑖 , 𝑏 𝑖 ), for 𝑖 ∈ 𝑇, from the players that satisfy the CHSH correlations (i. e.,
𝑎 𝑖 ≠ 𝑏 𝑖 if and only if (𝑊𝑖 , 𝑊𝑖0) = (𝑋 , 𝐹)) is not at least cos2 𝜋8 − 0.1.
Figure 7: The 𝑛-qubit rigidity test, rigid(Σ, 𝑚).
Proof of Theorem 3.1. From Theorem 3.8 and part (a) we get isometries 𝑉𝐴 , 𝑉𝐵 and commut-
ing observables Δ𝑌 , Λ𝐹 on ℋÂ such that the conclusions of the theorem hold. Write the
eigendecomposition Δ𝑌 = Δ𝑌+ − Δ𝑌− and Λ𝐹 = Λ+𝐹 − Λ−𝐹 . For 𝜆 ∈ {+, −}2 let
𝜏𝜆 = TrB̂ Id ⊗Δ𝑌𝜆1 Λ𝜆𝐹 2 |auxihaux| Id ⊗Δ𝑌𝜆1 Λ𝜆𝐹 2 .
Using that Δ𝑌 and Λ𝐹 commute and satisfy
Δ𝑌 ⊗ Δ𝑌 |auxi ≈ Λ𝐹 ⊗ Λ𝐹 |auxi ≈ |auxi
it follows that the (subnormalized) densities 𝜏𝜆 have (approximately) orthogonal support. In
particular the provers’ strategy in part (b) of the test is well-approximated by a mixture of
four strategies, labeled by (𝜆𝑌 , 𝜆𝐹 ) ∈ {±1}2 , such that the strategy with label (𝜆𝑌 , 𝜆𝐹 ) uses the
observables
1 1
(𝑋 , 𝑍, 𝑌, 𝐹, 𝐺) = 𝜎𝑋 , 𝜎𝑍 , 𝜆𝑌 𝜎𝑌 , √ 𝜆𝐹 − 𝜎𝑋 + 𝜆𝑌 𝜎𝑌 , √ 𝜆𝐹 𝜎𝑋 + 𝜆𝑌 𝜎𝑌 .
2 2
Among these four strategies, the two with 𝜆𝐹 = −1 fail part (b) of the test with probability
exponentially close to 1. Success in both parts of the test with probability at least 1 − 2𝜀 each
thus implies
Tr 𝜏+− + Tr 𝜏−− = poly(𝜀).
(3.21)
For 𝑊 ∈ Σ𝑚 and 𝑐 ∈ {0, 1} 𝑚 the observable 𝑊(𝑐) = ⊗𝑖 𝑊𝑖𝑐 𝑖 can be expanded in terms of a
2𝑚 -outcome projective measurement {𝑊 𝑢 } as
Õ
𝑊(𝑐) = (−1)𝑢·𝑐 𝑊 𝑢 .
𝑢∈{0,1} 𝑚
Similarly, by definition the projective measurement associated with the commuting Pauli
𝑐𝑖
observables 𝜏𝑊 (𝑐) = ⊗𝑖 𝜏𝑊 𝑖
, 𝑐 ∈ {0, 1} 𝑚 , is
Ì
𝑢
𝜏𝑊 = E (−1)𝑢·𝑐 𝜏𝑊 (𝑐) .
𝑐∈{0,1} 𝑚
𝑖
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 35
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Thus,
Id𝐴 ⊗ 𝑊(𝑐) − 𝑉𝐵† 𝜏𝑊 (𝑐)𝑉𝐵 |𝜓iAB
2
E
𝑐∈{0,1} 𝑚
Õ 2
(−1)𝑢·𝑐 Id𝐴 ⊗ 𝑊 𝑢 − 𝑉𝐵† 𝜏𝑊
𝑢
𝑉𝐵 |𝜓iAB
= E
𝑐∈{0,1} 𝑚
𝑢
Õ
Id𝐴 ⊗ 𝑊 𝑢 − 𝑉𝐵† 𝜏𝑊
𝑢
𝑉𝐵 |𝜓iAB ,
2
= (3.22)
𝑢∈{0,1} 𝑚
where the third line is obtained by expanding the square and using E𝑐∈{0,1}𝑚 (−1)𝑣·𝑐 = 1 if 𝑣 = 0𝑚 ,
and 0 otherwise. Using (3.19), the expression in (3.22), when averaged over all 𝑊 ∈ Σ𝑚 , is
bounded by 𝑂(poly(𝜀)). Using the Fuchs-van de Graaf inequality and the fact that trace distance
cannot increase under tracing out, we get that the following is 𝑂(poly(𝜀)):
Õ
𝑉𝐴 TrB (IdA ⊗𝑊 𝑢 )|𝜓ih𝜓|(IdA ⊗𝑊 𝑢 )† 𝑉𝐴† − TrB (IdA ⊗𝜏𝑊
𝑢 𝑢 †
. (3.23)
E𝑚 )|𝜓ih𝜓|(IdA ⊗𝜏𝑊 )
𝑊 ∈Σ 1
𝑢
Using that 𝜏𝑋 = 𝜎𝑋 , 𝜏𝑍 = 𝜎𝑍 , and 𝜏𝑌 = 𝜎𝑌 Δ𝑌 , we deduce the post-measurement states for
𝑢 ∈ {±1}
𝜏𝑋𝑢 = 𝜎𝑋
𝑢
, 𝜏𝑍𝑢 = 𝜎𝑍𝑢 , 𝜏𝑌𝑢 = 𝜎𝑌𝑢 ⊗ (𝜏++ + 𝜏+− ) + 𝜎𝑌−𝑢 ⊗ (𝜏−+ + 𝜏−− ).
Similarly, from 𝜏𝐹 = (−𝜏𝑋 + 𝜏𝑌 )Λ𝐹 and 𝜏𝐺 = (𝜏𝑋 + 𝜏𝑌 )Λ𝐹 we get, e. g., that the +1 eigenspace of
𝜏𝐹 is the combination of: √
• The simultaneous +1 eigenspace of 𝜎𝐹 = (−𝜎𝑋 + 𝜎𝑌 )/ 2, +1 eigenspace of Δ𝑌 , and +1
eigenspace of Λ𝐹 ;
• The simultaneous −1 eigenspace of 𝜎𝐹 , +1 eigenspace of√Δ𝑌 , and −1 eigenspace of Λ𝐹 ;
• The simultaneous −1 eigenspace of 𝜎𝐺 = −(−𝜎𝑋 − 𝜎𝑌 )/ 2, −1 eigenspace of Δ𝑌 , and +1
eigenspace of Λ𝐹 ;
• The simultaneous +1 eigenspace of 𝜎𝐺 , −1 eigenspace of Δ𝑌 , and −1 eigenspace of Λ𝐹 .
Proceeding similarly with 𝜏𝐺 , we obtain
𝜏𝐹𝑢 = 𝜎𝐹𝑢 ⊗ 𝜏++ + 𝜎𝐹−𝑢 ⊗ 𝜏+− + 𝜎𝐺
−𝑢 𝑢
⊗ 𝜏−+ + 𝜎𝐺 ⊗ 𝜏−− ,
𝜏𝐺𝑢 = 𝜎𝐺
𝑢 −𝑢
⊗ 𝜏++ + 𝜎𝐺 ⊗ 𝜏+− + 𝜎𝐹−𝑢 ⊗ 𝜏−+ + 𝜎𝐹𝑢 ⊗ 𝜏−− .
Starting from (3.23) and using (3.18) we obtain
Õ
𝑉𝐴 TrB (IdA ⊗𝑊 𝑢 )|𝜓ih𝜓|(IdA ⊗𝑊 𝑢 )† 𝑉𝐴†
E𝑚
𝑊 ∈Σ
𝑢
𝑢 𝑢 †
)|EPRihEPR| ⊗𝑚 ⊗ |auxihaux| ÂB̂ (IdA ⊗𝜏𝑊 = 𝑂(poly(𝜀)).
− TrB (IdA ⊗𝜏𝑊 )
1
Since TrB (Id ⊗𝐵|EPRihEPR| AB Id ⊗𝐵† ) = (𝐵† 𝐵)𝑇 /2 for any single-qubit operator 𝐵, to conclude
the bound claimed in the theorem it only remains to apply the calculations above and use (3.21)
to eliminate the contribution of 𝜏+− and 𝜏−− ; the factor 12 comes from the reduced density matrix
of an EPR pair.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 36
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
3.6 Tomography
Theorem 3.8 and Theorem 3.1 show that success in test rigid(Σ, 𝑚) gives us control over the
players’ observables and post-measurement states in the test. This allows us to use one of
the players to perform some kind of limited tomography (limited to post-measurement states
obtained from measurements in Σ), that will be useful for our analysis of the Dog-Walker
Protocol from Section 5.12
Let 1 ≤ 𝑚 0 ≤ 𝑚 and consider the test tom(Σ, 𝑚 0 , 𝑚) described in Figure 8. In this test,
one player is sent a question 𝑊 ∈ Σ𝑚 chosen uniformly at random. Assuming the players
are also successful in the test rigid(Σ, 𝑚) (which can be checked independently, with some
probability), using that the input distribution 𝜇 in rigid(Σ, 𝑚) assigns weight at least |Σ| −𝑚 /2 to
any 𝑊 0 ∈ Σ𝑚 , from Theorem 3.1 it follows that the second player’s post-measurement state is
close to a state consistent with the first player’s reported outcomes. Now suppose the second
player is sent a random subset 𝑆 ⊆ [𝑚] of size |𝑆| = 𝑚 0, and is allowed to report an arbitrary
string 𝑊 0 ∈ Σ𝑚 , together with outcomes 𝑢. Suppose also that for each 𝑖 ∈ 𝑆, we require that
0
𝑢𝑖 = 𝑎 𝑖 whenever 𝑊𝑖0 = 𝑊𝑖 . Since the latter condition is satisfied by a constant fraction of
𝑖 ∈ {1, . . . , 𝑚 0 }, irrespective of 𝑊 0, with very high probability, it follows that the only possibility
for the second player to satisfy the condition is to actually measure his qubits precisely in the
basis that he indicates. This allows us to check that a player performs a measurement of its
choice correctly (i. e., the player is forced to report the correct measurement made).
Tomography Test tom(Σ, 𝑚 0 , 𝑚):
• Input: Integer 1 ≤ 𝑚 0 ≤ 𝑚 and a subset Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺} of the single-qubit Clifford
group.
• Test: Let 𝑆 ⊆ [𝑚] be chosen uniformly at random among all sets of size |𝑆| = 𝑚 0. Select
𝑊 ∈ Σ𝑚 uniformly at random. Send 𝑊 to the first player, and the set 𝑆 to the second.
Receive 𝑎 from the first player, and 𝑊 0 ∈ Σ𝑚 and 𝑢 from the second. Accept only if 𝑎 𝑖 = 𝑢𝑖
0
whenever 𝑖 ∈ 𝑆 and 𝑊𝑖 = 𝑊𝑖0.
Figure 8: The 𝑚-qubit tomography test tom(Σ, 𝑚 0 , 𝑚).
Corollary 3.9. Let 𝜀 > 0 and 1 ≤ 𝑚 0 ≤ 𝑚 integer. Suppose a strategy for the players succeeds with
probability 1 − 𝜀 in both tests rigid(Σ, 𝑚) (Figure 7) and tom(Σ, 𝑚 0 , 𝑚) (Figure 8). Let 𝑉𝐴 , 𝑉𝐵 be the
isometries specified in Theorem 3.1. Let {𝑄 𝑊 ,𝑢 } be the projective measurement applied by the second
0
12The tomography test described in this section is different from subtest (b) in rigid(Σ, 𝑚) (Figure 7). The
tomography test described here is more general and designed to verify that a player prepares post-measurement
states of its choice.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 37
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
player in tom(Σ, 𝑚 0 , 𝑚). Then there exists a distribution 𝑞 on Σ𝑚 × {±} such that
0
Õ Õ
TrAB̂ (Id𝐴 ⊗𝑉𝐵 𝑄 𝑊 ,𝑢 )|𝜓ih𝜓| AB (Id𝐴 ⊗𝑉𝐵 𝑄 𝑊 ,𝑢 )†
0 0
0 0
𝑊 0 ∈Σ𝑚 𝑢∈{±1} 𝑚
𝑚0
Ì
𝑢𝑖
Õ 1
0
− 𝑞(𝑊 , 𝜆) 𝜎𝑊 0 ,𝜆 = 𝑂(poly(𝜀)),
2 𝑖 1
𝜆∈{±} 𝑖=1
where the notation is the same as in Theorem 3.1.
Moreover, players employing the honest strategy succeed with probability 1 in the tom(Σ, 𝑚 0 , 𝑚).
Proof. Success in rigid(Σ, 𝑚) allows us to apply Theorem 3.1. For any (𝑊 0 , 𝑢) let 𝜌𝑊 ,𝑢 0
A’ ,𝜆
be the
post-measurement state on the first player’s space, conditioned on the second player’s answer in
test tom(Σ, 𝑚 0 , 𝑚) being (𝑊 0 , 𝑢), after application of the isometry 𝑉𝐴 , and conditioned on ℋÂ
being in a state that lies in the support of 𝜏𝜆 (note this makes sense since 𝜏+ , 𝜏− have orthogonal
support). Using that for any 𝑖 ∈ 𝑆, 𝑊𝑖 = 𝑊𝑖0 with constant probability |Σ| −1 , it follows from (3.1)
and (3.2) in Theorem 3.1 that success in tom(Σ, 𝑚) implies the condition
|Σ| − 1 0
𝑢𝑖 𝑊 ,𝑢
Õ 1
E Tr(𝜏𝜆 ) Tr Id + ⊗𝑖∈𝑆 𝜎𝑊 0 ,𝜆 𝜌A’ ,𝜆 = 1 − 𝑂(poly(𝜀)). (3.24)
𝑆⊆{1,...,𝑚} 0 |Σ| |Σ| 𝑖
|𝑆|=𝑚 0 𝑊 ,𝜆,𝑢
Eq (3.24) concludes the proof, for some distribution 𝑞(𝑊 0 , 𝜆) ≈ 𝑢 Tr(𝜌𝑊 ,𝑢 Í 0
A’ ,𝜆
)Tr(𝜏𝜆 ) (the approx-
imation is due to the fact that the latter expression only specifies a distribution up to error
𝑂(poly(𝜀)).
4 The Verifier-on-a-Leash protocol
4.1 Protocol and statement of results
The Verifier-on-a-Leash Protocol (or “Leash Protocol” for short) involves a classical verifier and
two quantum provers. The idea behind the Leash Protocol is to have a first prover, nicknamed
PV for Prover 𝑉, carry out the quantum part of 𝑉𝐸𝑃𝑅 from Broadbent’s EPR Protocol by
𝑟
implementing the procedure 𝑉𝐸𝑃𝑅 .13 A second prover, nicknamed PP for Prover 𝑃, will play
the part of the prover 𝑃𝐸𝑃𝑅 . Unlike in the EPR Protocol, the interaction with PV (i. e., running
𝑟
𝑉𝐸𝑃𝑅 ) will take place first, and PV will be asked to perform random measurements from the set
Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺}. The values 𝑧®, rather than being chosen at random, will be chosen based
on the corresponding choice of observable. We let 𝑛 be the number of input bits and 𝑡 be the
number of T gates in 𝑄.
The protocol is divided into two subgames; which game is played is chosen by the verifier
by flipping a biased coin with probability (𝑝 𝑟 , 𝑝 𝑑 = 1 − 𝑝 𝑟 ).
13Throughout this section we assume that the circuit 𝑄 provided as input is compiled in the format described in
Section 2.4, which also provides a summary of the protocol and a description of 𝑉𝐸𝑃𝑅 .
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 38
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
• The first game is a sequential version of the rigidity game rigid(Σ, 𝑚) described in Figure 11.
This aims to enforce that PV performs precisely the right measurements;
• The second game is the delegation game, described in Figures 12, 13, and 14, and whose
structure is summarized in Figure 9. Here the verifier guides PP through the computation
in a similar way as in the EPR Protocol.
We call the resulting protocol the Leash Protocol with parameters (𝑝 𝑟 , 𝑝 𝑑 ). In both subgames
the parameter 𝑚 = Θ(𝑛 + 𝑡) is chosen large enough so that with probability close to 1 each
symbol in Σ appears in a random 𝑊 ∈ Σ𝑚 at least 𝑛 + 𝑡 times. It is important that PV is not
able to tell which kind of game is being played. Notice also that in order to ensure blindness,
we will require that the interaction with PV in the delegation game is sequential (more details
on this are found in Section 4.4). In order for the two subgames to be indistinguishable, we
also require that the rigidity game rigid(Σ, 𝑚) be played sequentially (i. e., certain subsets of
questions and answers are exchanged sequentially, but the acceptance condition in the test is the
same). Note, importantly, that the rigidity guarantees of rigid(Σ, 𝑚) hold verbatim when the
game is played sequentially, since this only reduces the number of ways that the provers can
cheat. The following theorem states the guarantees of the Leash Protocol.
Theorem 4.1. There are constants 𝑝 𝑟 , 𝑝 𝑑 = 1 − 𝑝 𝑟 , and Δ > 0 such that the following hold of the
Verifier-on-a-Leash Protocol with parameters (𝑝 𝑟 , 𝑝 𝑑 ), when executed on an input (𝑄, | 𝑥®i).
• (Completeness:) Suppose that kΠ0 𝑄| 𝑥®ik 2 ≥ 2/3. Then there is a strategy for PV and PP that is
accepted with probability at least 𝑝 compl = 𝑝 𝑟 (1 − e−Ω(𝑛+𝑡) ) + 8𝑝 𝑑 /9.
• (Soundness:) Suppose that kΠ0 𝑄| 𝑥®ik 2 ≤ 1/3. Then any strategy for PV and PP is accepted with
probability at most 𝑝 sound = 𝑝 compl − Δ.
Further, for any strategy of PV and PP, the reduced state of PV and PP, resp., at the end of the leash
protocol is independent of the input 𝑥®, aside from its length.
The proof of the completeness property is given in Lemma 4.2. The soundness property is
shown in Lemma 4.5. Blindness is established in Section 4.4. We first give a detailed description
of the protocol. We start by describing the delegation game, specified in Figures 12, 13 and 14,
which describe the protocol from the verifier’s view, an honest PV’s view, and an honest PP’s
view, respectively. This will motivate the need for a sequential version of the game rigid(Σ, 𝑚),
described in Figure 11. As we will show, the rigidity game forces PV to behave honestly. Thus,
for the purpose of exposition, we assume for now that PV behaves honestly, which results in the
joint behavior of PV and V being similar to that of the verifier 𝑉𝐸𝑃𝑅 in the EPR Protocol.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 39
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
𝐴, 𝑊𝐴 ∈ Σ|𝐴|
𝑒®𝐴 ∈ {0, 1} |𝐴|
𝐵1 , 𝑊𝐵1 ∈ Σ|𝐵1 |
𝑒®𝐵1 ∈ {0, 1} |𝐵1 | Prover 𝑉
..
.
𝐵 𝑑 , 𝑊𝐵𝑑 ∈ Σ|𝐵𝑑 |
𝑒®𝐵𝑑 ∈ {0, 1} |𝐵𝑑 |
Verifer
𝑇, 𝑁 ⊂ [𝑚]
𝑐®𝑇1 ∈ {0, 1}𝑇1
𝑧®𝑇1 ∈ {0, 1}𝑇1
..
.
Prover 𝑃
𝑐®𝑇ℓ ∈ {0, 1}𝑇ℓ
𝑧®𝑇ℓ ∈ {0, 1}𝑇ℓ
𝑐 𝑓 ∈ {0, 1}
Figure 9: Structure of the delegation game.
From the rigidity game we may also assume that PV and PP share 𝑚 EPR pairs, labeled
{1, . . . , 𝑚}, for 𝑚 = Θ(𝑛 + 𝑡). We will assume that the circuit 𝑄 is broken into 𝑑 layers,
𝑄 = 𝑄 1 . . . 𝑄 𝑑 , such that in every 𝑄ℓ , each wire has at most one T gate applied to it, after which
no other gates are applied to that wire. We will refer to 𝑑 as the T-depth of the circuit. We will
suppose the T gates are indexed from 1 to 𝑡, in order of layer.
The protocol begins with an interaction between the verifier and PV. The verifier selects
a uniformly random partition 𝐴, 𝐵1 , . . . , 𝐵 𝑑 of {1, . . . , 𝑚}, with |𝐴| = Θ(𝑛), and for every
ℓ ∈ {1, . . . , 𝑑}, |𝐵ℓ | = Θ(𝑡ℓ ), where 𝑡ℓ is the number of T gates in 𝑄ℓ . The verifier also selects a
uniformly random 𝑊 ∈ Σ𝑚 , and partitions it into substrings 𝑊𝐴 and 𝑊𝐵1 , . . . , 𝑊𝐵𝑑 , meant to
contain observables to initialize the computation qubits and auxiliary qubits, respectively, for
each layer of T gates. The verifier instructs PV to measure his halves of the EPR pairs using the
observables 𝑊𝐴 first, and then 𝑊𝐵1 , . . . , 𝑊𝐵𝑑 , sequentially. Upon being instructed to measure a
set of observables, PV measures the corresponding half-EPR pairs and returns the results 𝑒® to
the verifier. Breaking this interaction into multiple rounds is meant to enforce that, for example,
the results output by PV upon receiving 𝑊𝐵ℓ , which we call 𝑒®𝐵ℓ , cannot depend on the choice of
observables 𝑊𝐵ℓ +1 . This is required for blindness.
Once the interaction with PV has been completed, as in the EPR Protocol, V selects one of
three run types: computation (𝑟 = 0), 𝑋-test (𝑟 = 1), and 𝑍-test (𝑟 = 2). The verifier selects a
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 40
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
subset 𝑁 ⊂ 𝐴 of size 𝑛 of qubits to play the role of inputs to the computation. These are chosen
from the subset of 𝐴 corresponding to wires that PV has measured in the appropriate observable
for the run type (see Table 4). For example, in an 𝑋-test run, PV’s EPR halves corresponding to
input wires should be measured in the 𝑍 basis so that PP is left with a one-time pad of the state
|0i ⊗𝑛 , so in an 𝑋-test run, the computation wires are chosen from the set {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑍}. The
input wires 𝑁 are labeled by 𝒳1 , . . . , 𝒳𝑛 .
The verifier also chooses subsets 𝑇ℓ = 𝑇ℓ0 ∪ 𝑇ℓ1 ⊂ 𝐵ℓ where 𝑇ℓ0 and 𝑇ℓ1 have sizes 𝑡ℓ ,0 and
𝑡ℓ ,1 = 𝑡ℓ − 𝑡ℓ ,0 , respectively, where 𝑡ℓ ,0 is the number of odd T gates in the ℓ -th layer of 𝑄 (recall
the definition of even and odd T gates from Section 2.4). The wires 𝑇ℓ0 and 𝑇ℓ1 will play the role
of auxiliary states used to perform T gates from the ℓ -th layer. They are chosen from those wires
from 𝐵ℓ whose corresponding EPR halves have been measured in a correct basis, depending
on the run type. For example, in an 𝑋-test run, the auxiliaries corresponding to odd T gates
should be prepared by measuring the corresponding EPR half in either the 𝑋 or 𝑌 basis (see
Table 3), so in an 𝑋-test run, 𝑇ℓ1 is chosen from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝑋 , 𝑌}} (see Table 4). We will let
𝒯1 , . . . , 𝒯𝑡 label those EPR pairs that will be used as auxiliary states. In particular, the system 𝒯𝑖
will be used for the 𝑖-th T gate in the circuit, so if the 𝑖-th T gate is even, 𝒯𝑖 should be chosen
from 𝑇 0 = ∪ℓ 𝑇ℓ0 , and otherwise it should be chosen from 𝑇1 = ∪ℓ 𝑇ℓ1 . The verifier sends labels
𝒯1 , . . . , 𝒯𝑡 and 𝒳1 , . . . , 𝒳𝑛 to PP, who will act as 𝑃𝐸𝑃𝑅 on the 𝑛 + 𝑡 qubits specified by these labels.
Just as in the EPR Protocol, the input on PP’s system specified by 𝒳1 , . . . , 𝒳𝑛 is a quantum
one-time pad of either | 𝑥®i, |0i ⊗𝑛 , or |+i ⊗𝑛 , depending on the run type, with V holding the keys
(determined by 𝑒®). Throughout the interaction, PP always maintains a one-time pad of the
current state of the computation, with the verifier in possession of the one-time-pad keys. The
verifier updates her keys as the computation is carried out, using the rules in Table 2.
From PP’s perspective, the protocol works just as the EPR Protocol, except that he does not
receive the bit 𝑧 𝑖 needed to implement the T gadget until during the T gadget, after he has sent V
his measurement result 𝑐 𝑖 (see Figure 10).
𝒳𝑗 𝒳𝑗
P𝑧 𝑖
𝒯𝑖
PP
𝑐𝑖 𝑧𝑖
U𝑊𝑖
𝑎 𝑗 + 𝑐𝑖 if 𝑊𝑖 = 𝐺
PV
𝑗 + 𝑐𝑖 + 1
𝑎 if 𝑊𝑖 = 𝐹
𝑧 𝑖 = 𝑧 ∈𝑅 {0, 1} if 𝑊𝑖 = 𝑍
𝑊𝑖 ∈𝑅 {𝑋 , 𝑌, 𝑍, 𝐺, 𝐹} 𝑒𝑖
if 𝑊𝑖 = 𝑋
0
if 𝑊𝑖 = 𝑌
V V 1
Figure 10: The gadget for implementing the 𝑖-th T gate, on the 𝑗-th wire.
To perform the 𝑖-th T gate on the 𝑗-th wire, PP performs the circuit shown in Figure 10. As
Figure 10 shows, PV has already applied the observable specified by V to his half of the EPR
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 41
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
pair. The T gadget requires interaction with the verifier, to compute the bit 𝑧 𝑖 , which depends on
the measured 𝑐 𝑖 , the value 𝑊𝑖 , and one-time-pad key 𝑎 𝑗 , however, this interaction can be done
in parallel for T gates in the same layer.
It is simple to check that the T gadget in Figure 10 is the same as the T gadget for the EPR
Protocol shown in Figure 1. Note that in the EPR Protocol, we let 𝑎 0𝑖 denote the one-time-pad
key of the 𝑗-th wire just before application of the 𝑖-th T gate (to the 𝑗-th wire). Here we will
assume 𝑎 𝑗 denotes the current updated one-time-pad key of the 𝑗th wire, so it is the same as
𝑎 0𝑖 in the EPR Protocol. In the case of the leash protocol, 𝑊 is chosen at random, and then 𝑧® is
chosen accordingly, whereas in the case of the EPR Protocol, 𝑧® is chosen at random and then 𝑊
is chosen accordingly.
Computation Run 𝑋-test Run 𝑍-test Run
𝑁 {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑍} {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑍} {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑋}
𝑇ℓ {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝐺, 𝐹}} {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 = 𝑍}
0
{𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝑋 , 𝑌}}
𝑇ℓ1 {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝐺, 𝐹}} {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝑋 , 𝑌}} {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 = 𝑍}
Table 4: How the verifier chooses index sets 𝑇 = 𝑇 0 ∪ 𝑇 1 and 𝑁 for each type of run. These sets
determine which systems are labeled by {𝒯𝑖 } 𝑡𝑖=1 and {𝒳𝑗 } 𝑛𝑗=1 , respectively.
Let 𝑚, 𝑛, and 𝑡1 , . . . , 𝑡 𝑑 be parameters provided as input, such that 𝑚 = Θ(𝑛 + 𝑡1 + · · · + 𝑡 𝑑 ).
1. The verifier selects questions 𝑊 , 𝑊 0, for the first and second player, respectively, according
to the distribution of questions in the game rigid(Σ, 𝑚).
2. If 𝑊 ∉ Σ𝑚 or 𝑊 0 ∉ Σ𝑚 :
(a) The verifier partitions {1, . . . , 𝑚} at random into subsets 𝐴 and 𝐵ℓ , for ℓ ∈ {1, . . . , 𝑑},
of size |𝐴| = Θ(𝑛) and |𝐵ℓ | = Θ(𝑡ℓ ), exactly as in Step 1 of Figure 12.
(b) The verifier sends (𝐴, 𝑊𝐴 ), (𝐵1 , 𝑊𝐵1 ), .., (𝐵 𝑑 , 𝑊𝐵𝑑 ) and (𝐴, 𝑊𝐴0 ), (𝐵1 , 𝑊𝐵0 1 ), .., (𝐵 𝑑 , 𝑊𝐵0 )
𝑑
in sequence to the first and second prover, respectively. They sequentially return 𝑒®𝐴 ∈
{0, 1} |𝐴| , 𝑒®𝐵1 ∈ {0, 1} |𝐵1 | , .., 𝑒®𝐵𝑑 ∈ {0, 1} |𝐵𝑑 | and 𝑒®𝐴
0
∈ {0, 1} |𝐴| , 𝑒®𝐵0 1 ∈ {0, 1} |𝐵1 | , .., 𝑒®𝐵0 ∈
𝑑
{0, 1} |𝐵𝑑 | , respectively. Let 𝑒®, 𝑒®0 be the concatenation of 𝑒®𝐵𝑖 and 𝑒®0 in the correct order.
𝐵𝑖
3. Otherwise: (which happens when the verifier sends instructions for Bell measurements)
(a) The verifier sends 𝑊 and 𝑊 0 to the first and second prover, respectively.
(b) The first and second prover answer back with 𝑒® and 𝑒®0, respectively.
4. The verifier accepts if and only if 𝑒®, 𝑒®0 and 𝑊 , 𝑊 0 satisfy the winning condition of
rigid(Σ, 𝑚).
Figure 11: Sequential version of rigid(Σ, 𝑚).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 42
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Let (𝑄, 𝑥®) be the input to the verifier, where 𝑄 is compiled in the form described in Section 2.4.
Let 𝑛 be the size of the input to 𝑄. Let 𝑑 be the T-depth, and for ℓ ∈ {1, . . . , 𝑑} let 𝑡ℓ be the
number of T gates in the ℓ -th layer.
1. The verifier selects 𝑊 ∈𝑅 Σ𝑚 . She partitions {1, . . . , 𝑚} arbitrarily into non-overlapping
subsets 𝐴 and 𝐵1 , . . . , 𝐵 𝑑 such that 𝑊𝐴 contains at least 𝑛 copies of each symbol in Σ, and
for each ℓ ∈ {1, . . . , 𝑑}, 𝑊𝐵ℓ contains at least 𝑡ℓ copies of each symbol in Σ.
2. The verifier sends 𝐴, 𝑊𝐴 to PV, who returns 𝑒®𝐴 ∈ {0, 1} 𝐴 . The verifier sequentially sends
(𝐵1 , 𝑊𝐵1 ), . . . , (𝐵 𝑑 , 𝑊𝐵𝑑 ) to PV, each time receiving 𝑒®𝐵ℓ ∈ {0, 1} 𝐵ℓ as answer.
3. The verifier selects a run type uniformly at random. She selects sets 𝑁 ⊆ 𝐴 and 𝑇ℓ ⊆ 𝐵ℓ ,
for ℓ ∈ {1, . . . , 𝑑}, of sizes |𝑁 | = 𝑛 and |𝑇ℓ | = 𝑡ℓ , as follows:
Computation Run: 𝑁 is chosen at random from {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑍}. 𝑇ℓ is chosen at random
from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝐺, 𝐹}}. She sets 𝑎® = 𝑒®𝑁 + 𝑥® and 𝑏® = 0𝑛 .
𝑋-test Run: 𝑁 is chosen at random from {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑍}. 𝑇ℓ = 𝑇ℓ0 ∪ 𝑇ℓ1 , where 𝑇ℓ0 is
of size 𝑡ℓ ,0 chosen at random from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 = 𝑍} and 𝑇ℓ1 is of size 𝑡ℓ ,1 chosen at
random from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝑋 , 𝑌}}. She sets 𝑎® = 𝑒®𝑁 and 𝑏® = 0𝑛 .
𝑍-test Run: 𝑁 is chosen at random from {𝑖 ∈ 𝐴 : 𝑊𝑖 = 𝑋}. 𝑇ℓ = 𝑇ℓ0 ∪ 𝑇ℓ1 , where 𝑇ℓ0 is of
size 𝑡ℓ ,0 chosen at random from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 ∈ {𝑋 , 𝑌}} and 𝑇ℓ1 is of size 𝑡ℓ ,1 chosen at
random from {𝑖 ∈ 𝐵ℓ : 𝑊𝑖 = 𝑍}. She sets 𝑎® = 0𝑛 and 𝑏® = 𝑒®𝑁 .
The verifier sends the sets 𝑁 and 𝑇ℓ0 , 𝑇ℓ1 , for all ℓ ∈ {1, . . . , 𝑑}, to PP.
4. For ℓ = 1, . . . , 𝑑,
(a) For each Clifford gate in the ℓ -th layer, perform the appropriate key update (Table 2).
(b) The verifier receives 𝑐® = {𝑐 𝑖 } 𝑖∈𝑇ℓ from PP. If it is an 𝑋-test run and 𝑖 ∈ 𝑇ℓ0 , or it is a
𝑍-test run and 𝑖 ∈ 𝑇ℓ1 , reject if 𝑐 𝑖 ≠ 𝑎 𝑗 + 𝑒 𝑖 , where 𝑗 is the wire to which the 𝑖-th T gate
is applied.
(c) For each 𝑖 ∈ 𝑇ℓ , the verifier computes 𝑧® = {𝑧 𝑖 } 𝑖∈𝑇ℓ as follows:
Computation Run 𝑧 𝑖 = 𝑎 𝑗 + 1𝑊𝑖 =𝐹 + 𝑐 𝑖 ;
𝑋-test Run if 𝑖 ∈ 𝑇ℓ0 , 𝑧 𝑖 ∈𝑅 {0, 1}; else if 𝑖 ∈ 𝑇ℓ1 , 𝑧 𝑖 = 1𝑊𝑖 =𝑌 ;
𝑍-test Run if 𝑖 ∈ 𝑇ℓ0 , 𝑧 𝑖 = 1𝑊𝑖 =𝑌 ; else if 𝑖 ∈ 𝑇ℓ1 , 𝑧 𝑖 ∈𝑅 {0, 1}.
(d) The verifier sends 𝑧® to PP and updates keys for each T gate applied (Table 2).
5. The verifier receives a bit 𝑐 𝑓 from PP. She outputs reject if it is a computation or 𝑋-test
run and 𝑐 𝑓 + 𝑎 𝑓 ≠ 0, where 𝑎 𝑓 is the final X-key on the output wire; and accept otherwise.
Figure 12: The Delegation Game: Verifier’s point of view. Note that the condition 𝑐 𝑖 ≠ 𝑎 𝑗 + 𝑒 𝑖 is
the same as the condition 𝑐 𝑖 ≠ 𝑎 0𝑖 + 𝑒 𝑖 in the EPR Protocol — 𝑎 𝑗 here and 𝑎 0𝑖 in the EPR Protocol
both represent the one-time-pad key just before application of the 𝑖-th T gate.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 43
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
1. For ℓ = 0, 1, . . . , 𝑑,
(a) PV receives a string 𝑊𝑆 ∈ Σ𝑆 , for some subset 𝑆 of {1, . . . , 𝑚}, from V.
(b) For 𝑖 ∈ 𝑆, PV measures his half of the 𝑖-th EPR pair using the observable indicated by
𝑊𝑖 , obtaining an outcome 𝑒 𝑖 ∈ {0, 1}.
(c) PV returns 𝑒®𝑆 to V.
Figure 13: Honest strategy for PV in the Delegation game
Before describing the Delegation game, we present now the sequential version of the game
rigid(Σ, 𝑚) (Figure 11). We notice that this sequential version is no different than rigid(Σ, 𝑚),
except for the fact that certain subsets of questions and answers are exchanged sequentially, but
with the same acceptance condition. Running the game sequentially only reduces the provers’
ability to cheat, hence the guarantees from rigid(Σ, 𝑚) hold verbatim for the sequential version.
We now give the precise protocols for the delegation game V (Figure 12) and honest provers
PV (Figure 13) and PP (Figure 14).
1. PP receives subsets 𝑁 and 𝑇ℓ0 , 𝑇ℓ1 of {1, . . . , 𝑚}, for ℓ ∈ {1, . . . , 𝑑}, from the verifier.
2. For ℓ = 1, . . . , 𝑑,
(a) PP does the Clifford computations in the ℓ -th layer.
(b) For each 𝑖 ∈ 𝑇ℓ = 𝑇ℓ0 ∪ 𝑇ℓ1 , PP applies a CNOT from 𝒯𝑖 into the input register
corresponding to the wire on which this T gate should be performed, 𝒳𝑗 , and
measures this wire to get a value 𝑐 𝑖 . The register 𝒯𝑖 is relabeled 𝒳𝑗 . He sends
𝑐®𝑇ℓ = {𝑐 𝑖 } 𝑖∈𝑇ℓ to V.
(c) PP receives 𝑧®𝑇ℓ = {𝑧 𝑖 } 𝑖∈𝑇ℓ from V. For each 𝑖 ∈ 𝑇ℓ , he applies P𝑧 𝑖 to the correspond-
ing 𝒳𝑗 .
3. PP performs the final computations that occur after the 𝑑-th layer of T gates, measures the
output qubit, 𝒳1 , and sends the resulting bit, 𝑐 𝑓 , to V.
Figure 14: Honest strategy for PP in the Delegation game
With all of these subprotocols in hand, we can now present the Leash protocol (Figure 15).
Figure 16 illustrates the tree-like structure of all the different subgames and tests used within
the protocol.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 44
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
1. With probability 𝑝 𝑟 , the players run the sequential version of rigid(Σ, 𝑚) as described in
Figure 11.
2. With probability 𝑝 𝑑 , the players run the delegation game, described in Figures 12, 13,
and 14.
Figure 15: Leash protocol with parameters 𝑝 𝑟 and 𝑝 𝑑 .
4.2 Leash completeness
The honest provers in the Leash Protocol are essentially executing the EPR Protocol, with the
only difference being that in the case of the leash protocol, 𝑊 is chosen at random and then 𝑧® is
chosen accordingly, whereas in the case of the EPR Protocol, 𝑧® is chosen at random and then 𝑊
is chosen accordingly. The resulting distribution on 𝑧® and 𝑊 is the same, and so completeness
follows from that of the EPR Protocol.
Lemma 4.2. Suppose the verifier executes the rigidity game with probability 𝑝 𝑟 and the delegation game
with probability 𝑝 𝑑 = 1 − 𝑝 𝑟 , on an input (𝑄, | 𝑥®i) such that kΠ0 𝑄| 𝑥®ik 2 ≥ 2/3. Then there is a strategy
for the provers which is accepted with probability at least 𝑝 compl = 𝑝 𝑟 (1 − e−Ω(𝑛+𝑡) ) + 89 𝑝 𝑑 .
Proof. The provers PV and PP play the rigidity game in accordance with the honest strategy, and
the delegation game as described in Figures 13 and 14, respectively. Their success probability
in the delegation game is the same as the honest strategy in the EPR Protocol, which is at
least 23 + 23 13 = 89 , by Theorem 2.2 and since the verifier chooses each of the three types of runs
uniformly.
4.3 Leash soundness
We divide the soundness analysis into three parts. First we analyze the case of an honest
PV, and a cheating PP (Lemma 4.3). Then we show that if PV and PP pass the rigidity game
with almost optimal probability, then one can construct new provers PV0 and PP0, with PV0
honest, such that the probability that they are accepted in the delegation game is not changed
by much (Lemma 4.4). In Lemma 4.5, we combine the previous to derive the desired constant
soundness-completeness gap, where we exclude that the acceptance probability of the provers
in the rigidity game is too low by picking a 𝑝 𝑟 large enough.
Lemma 4.3 (Soundness against PP). Suppose the verifier executes the delegation game on input
(𝑄, | 𝑥®i) such that kΠ0 𝑄| 𝑥®ik 2 ≤ 1/3 with provers (PV, PP∗ ) such that PV plays the honest strategy.
Then the verifier accepts with probability at most 7/9.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 45
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Leash Protocol
Fig. 15
𝑝𝑑
𝑝𝑟 Delegation
Fig. 9 (Fig. 12, 13, and 14) PV
uses EPR Protocol to delegate
computation to PP
Rigidity 1/3 1/3
1/3
Ensure PV does mea-
surements he’s sup- 𝑋-test 𝑍-test Computation
posed to by running Ensure PP returns Ensure PP returns Run the computa-
the sequential version correctly measured correctly measured tion
(Fig. 11) of rigid bits, except for those bits on odd T gad-
rigid returned on odd T gets
Fig. 7 gadgets
1/2 (a) (b)
1/2
cliff
Fig. 6 Lift phase ambiguity in
Test tensor products of the definition of 𝐹, 𝐺
single-qubit Clifford gates
1/5 (a) (c)-(e)
(b) 3/5
conj-cliff 1/5
Fig. 5 Force same phase ambi-
Test block form of observ-
Test that each Clifford sat- guity in the definitions of
able 𝑋𝑊
isfies Pauli conjugation 𝐹, 𝐺 for all qubits
relations
1/2 (a)
(b)
1/2
pbt conj
Fig. 30 Fig. 4
Pauli braiding test Conjugation test
Figure 16: Structure of the Leash Protocol. The Verifier plays the rigidity game with probability
𝑝 𝑟 , and the delegation game with probability 𝑝 𝑑 = 1 − 𝑝 𝑟 . In either case, a subgame is chosen,
some of which involve their own subgames. We illustrate this structure here, letting probabilities
label branches in the tree. Note that not all random choices are shown. For example, when conj
is played, it is with a random choice of inputs, but this figure illustrates the high-level structure
of the protocol, and connection to different tests.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 46
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Proof. Let PP∗ be any prover. Assume that PV behaves honestly and applies the measurements
specified by his query 𝑊 on halves of EPR pairs shared with PP∗ . As a result the corresponding
half-EPR pair at PP∗ is projected onto the post-measurement state associated with the outcome
reported by PV to V.
From PP∗ , we define another prover, 𝑃 ∗ , such that if 𝑃 ∗ interacts with 𝑉𝐸𝑃𝑅 , the honest verifer
for the EPR Protocol (Figure 3a), then 𝑉𝐸𝑃𝑅 rejects with the same probability that V would reject
on interaction with PP∗ . The main idea of the proof can be seen by looking at Figure 10, and
noticing that: (1) the combined action of V and PV is unchanged if instead of choosing the
𝑊𝑖 -values at random and then choosing 𝑧 𝑖 as a function of these, the 𝑧 𝑖 are chosen uniformly at
random, and then the 𝑊𝑖 are chosen as a function of these; and (2) with this transformation, the
combined action of V and PV is now the same as the action of 𝑉𝐸𝑃𝑅 in the EPR Protocol.
We now define 𝑃 ∗ . 𝑃 ∗ acts on a system that includes 𝑛 + 𝑡 qubits that, in an honest run of
the EPR Protocol, are halves of EPR pairs shared with 𝑉𝐸𝑃𝑅 . 𝑃 ∗ receives {𝑧 𝑖 } 𝑡𝑖=1 from 𝑉𝐸𝑃𝑅 . 𝑃 ∗
creates 𝑚 − (𝑛 + 𝑡) half EPR pairs (i. e., single-qubit maximally mixed states) and randomly
permutes these with his 𝑛 + 𝑡 unmeasured qubits, 𝑛 of which correspond to computation qubits
on systems 𝒳1 , . . . , 𝒳𝑛 — he sets 𝑁 to be the indices of these qubits — and 𝑡 of which correspond
to T-auxiliary states — he sets 𝑇 0 and 𝑇 1 to be the indices of these qubits. 𝑃 ∗ simulates PP∗ on
these 𝑚 qubits in the following way. First, 𝑃 ∗ gives PP∗ the index sets 𝑁, 𝑇 0 , and 𝑇 1 . In the
ℓ -th iteration of the loop (Step 2. in Figure 14), PP∗ returns some bits {𝑐 𝑖 } 𝑖∈𝑇ℓ , and then expects
inputs {𝑧 𝑖 } 𝑖∈𝑇ℓ , which 𝑃 ∗ provides, using the bits he received from 𝑉𝐸𝑃𝑅 . Finally, at the end of
the computation, PP∗ returns a bit 𝑐 𝑓 , and 𝑃 ∗ outputs {𝑐 𝑖 } 𝑖∈𝑇 and 𝑐 𝑓 .
This completes the description of 𝑃 ∗ . To show the lemma we argue that for any input
(𝑄, | 𝑥®i) the probability that 𝑉 outputs accept on interaction with PV and PP∗ is the same as the
probability that 𝑉𝐸𝑃𝑅 outputs accept on interaction with 𝑃 ∗ , which is at most 23 𝑞 𝑡 + 13 𝑞 𝑐 whenever
kΠ0 𝑄| 𝑥®ik 2 ≤ 1/3, by Theorem 2.3. Using 𝛿 = 13 , Theorem 2.3 gives 𝑞 𝑐 ≤ 53 − 43 𝑞 𝑡 , which yields
2 1 5 2 7
𝑞𝑡 + 𝑞 𝑐 ≤ + 𝑞𝑡 ≤ .
3 3 9 9 9
There are two reasons that 𝑉𝐸𝑃𝑅 might reject: (1) in a computation or 𝑋-test run, the output
qubit decodes to 1; or (2) in an evaluation of the gadget in Figure 10 (either an 𝑋-test run for an
even T gate, or a 𝑍-test run for an odd T gate) the condition 𝑐 𝑖 = 𝑎 𝑗 ⊕ 𝑒 𝑖 fails. Note that in the
description of the EPR Protocol, the one-time-pad key just before application of the 𝑖-th T gate is
denoted 𝑎 0𝑖 , which we denote here by 𝑎 𝑗 .
We first consider case (1). This occurs exactly when 𝑐 𝑓 ⊕ 𝑎 𝑓 = 1, where 𝑎 𝑓 is the final X key of
the output wire, held by 𝑉𝐸𝑃𝑅 . We note that 𝑎 𝑓 is exactly the final X key that V would hold in the
Verifier-on-a-Leash Protocol, which follows from the fact that the update rules in both the EPR
Protocol and the leash protocol are the same. Thus, the probability that 𝑉𝐸𝑃𝑅 finds 𝑣 𝑓 ⊕ 𝑎 𝑓 = 1
on interaction with 𝑃 ∗ is exactly the probability that V finds 𝑐 𝑓 ⊕ 𝑎 𝑓 = 1 in Step 5 of Figure 12.
Next, consider case (2). The condition 𝑐 𝑖 ≠ 𝑎 𝑗 ⊕ 𝑒 𝑖 is exactly the condition in which a verifier
interacting with 𝑃 ∗ as in Figure 12 would reject (see Step 4.(b)).
Thus, the probability that 𝑉𝐸𝑃𝑅 outputs reject upon interaction with 𝑃 ∗ is exactly the
probability that V outputs reject on interaction with PP∗ , which, as discussed above, is at
most 7/9.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 47
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
The following lemma shows soundness against cheating PV∗ .
Lemma 4.4. Suppose the verifier executes the leash protocol on input (𝑄, | 𝑥®i) such that kΠ0 𝑄| 𝑥®ik 2 ≤ 1/3
with provers (PV∗ , PP∗ ), such that the provers are accepted with probability 1 − 𝜀, for some 𝜀 > 0, in
the rigidity game, and with probability at least 𝑞 in the delegation game. Then there exist provers PP0
and PV0 such that PV0 applies the honest strategy and PP0 and PV0 are accepted with probability at least
𝑞 − poly(𝜀) in the delegation game.
Proof. By assumption, PP∗ and PV∗ are accepted in the rigidity game with probability at least
1 − 𝜀. Let 𝑉𝐴 , 𝑉𝐵 be the local isometries guaranteed to exist by Theorem 3.1, and {𝜏𝜆 } the
subnormalized densities associated with PP∗ ’s Hilbert space (recall that playing the rigidity
game sequentially leaves the guarantees from Theorem 3.1 unchanged, since it only reduces the
provers’ ability to cheat).
First define provers PV00 and PP00 as follows. PP00 and PV00 initially share the state
Õ
𝑚
|𝜓0iAB = ⊗𝑖=1 |EPRihEPR| AB ⊗ |𝜆ih𝜆| A0 ⊗ |𝜆ih𝜆| B0 ⊗ (𝜏𝜆 )A00 ,
𝜆∈{±}
with registers AA0A00 in the possession of PP00 and BB0 in the possession of PV00. Upon receiving a
query 𝑊 ∈ Σ𝑚 , PV00 measures B0 to obtain a 𝜆 ∈ {±}. If 𝜆 = +, he proceeds honestly, measuring
his half-EPR pairs exactly as instructed. If 𝜆 = −, he proceeds honestly except that for every
honest single-qubit observable specified by 𝑊, he instead measures the complex conjugate
observable. Note that this strategy can be implemented irrespective of whether 𝑊 is given at
once, as in the game rigid, or sequentially, as in the Delegation Game. PP00 simply acts like PP∗ ,
just with the isometry 𝑉𝐴 applied.
First note that by Theorem 3.1, the distribution of answers of PV00 to the verifier, as well as
the subsequent interaction between the verifier and PP, generate (classical) transcripts that are
within statistical distance poly(𝜀) from those generated by PV∗ and PP∗ with the same verifier.
Next we observe that taking the complex conjugate of both provers’ actions does not change
their acceptance probability in the delegation game, since the interaction with the verifier is
completely classical. Define PP0 as follows: PP0 measures A0 to obtain the same 𝜆 as PV00, and
then executes PP00 or its complex conjugate depending on the value of 𝜆. Define PV0 to execute
the honest behavior (he measures to obtain 𝜆, but then discards it and does not take any complex
conjugates).
Then PV0 applies the honest strategy, and (PV0 , PP0) applies either the same strategy as
(PV00 , PP00) (if 𝜆 = +) or its complex conjugate (if 𝜆 = −). Therefore they are accepted in the
delegation game with exactly the same probability.
Combining Lemma 4.3 and Lemma 4.4 gives us the final soundness guarantee.
Lemma 4.5. (Constant soundness-completeness gap) There exist constants 𝑝 𝑟 , 𝑝 𝑑 = 1 − 𝑝 𝑟 and Δ > 0
such that if the verifier executes the leash protocol with parameters (𝑝 𝑟 , 𝑝 𝑑 ) on input (𝑄, | 𝑥®i) such that
kΠ0 𝑄| 𝑥®ik 2 ≤ 1/3, any provers (PV∗ , PP∗ ) are accepted with probability at most 𝑝 sound = 𝑝 compl − Δ.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 48
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Proof. Suppose provers PP∗ and PV∗ succeed in the delegation game with probability 79 + 𝑤
for some 𝑤 > 0, and the testing game with probability 1 − 𝜀∗ (𝑤), where 𝜀∗ (𝑤) will be specified
below. By Lemma 4.4, this implies that there exist provers PP0 and PV0 such that PV0 is honest
and the provers succeed in the delegation game with probability at least 79 + 𝑤 − 𝑔(𝜀∗ (𝑤)),
where 𝑔(𝜀) = poly(𝜀) is the function from the guarantee of Lemma 4.4. Let 𝜀∗ (𝑤) be such that
𝑔(𝜀∗ (𝑤)) ≤ 𝑤2 . In particular, 79 + 𝑤 − 𝑔(𝜀∗ (𝑤)) ≥ 79 + 𝑤2 > 79 . This contradicts Lemma 4.3.
Thus if provers PP and PV succeed in the delegation game with probability 79 + 𝑤 they must
succeed in the rigidity game with probability less than 1 − 𝜀∗ (𝑤). This implies that for any
strategy of the provers, on any no instance, the probability that they are accepted is at most
n 7 1 1 o
max 𝑝 𝑟 + (1 − 𝑝 𝑟 ) + , 𝑝 𝑟 1 − 𝜀∗ + (1 − 𝑝 𝑟 ) · 1 . (4.1)
9 18 18
Since 𝜀∗ ( 18
1
) is a positive constant, it is clear that one can pick 𝑝 𝑟 large enough so that
1 1 7
𝑝 𝑟 1 − 𝜀∗ + (1 − 𝑝 𝑟 ) · 1 < 𝑝 𝑟 + (1 − 𝑝 𝑟 )
. +(4.2)
18 9 18
Select the smallest such 𝑝 𝑟 . Then the probability that the two provers are accepted is at most
1 7 8
𝑝 sound := 𝑝 𝑟 + (1 − 𝑝 𝑟 ) < 𝑝 𝑟 1 − e−Ω(𝑛+𝑡) + (1 − 𝑝 𝑟 ) = 𝑝compl ,
+
9 18 9
which gives the desired constant completeness-soundness gap Δ.
4.4 Blindness
We now establish blindness of the Leash Protocol. In Lemma 4.6, we will prove that the protocol
has the property that neither prover can learn anything about the input to the circuit, 𝑥®, aside
from its length. Thus, the protocol can be turned into a blind protocol, where 𝑄 is also hidden, by
modifying any input (𝑄, 𝑥®) where 𝑄 has 𝑔 gates and acts on 𝑛 qubits, to an input (𝑈𝑔,𝑛 , (𝑄, 𝑥®)),
where 𝑈𝑔,𝑛 is a universal circuit that takes as input a description of a 𝑔-gate circuit 𝑄 on 𝑛 qubits,
and a string 𝑥®, and outputs 𝑄| 𝑥®i. The universal circuit 𝑈𝑔,𝑛 can be implemented in 𝑂(𝑔 log 𝑛)
gates. By Lemma 4.6, running the Leash Protocol on (𝑈𝑔,𝑛 , (𝑄, 𝑥®)) reveals nothing about 𝑄 or 𝑥®
aside from 𝑔 and 𝑛.
In the form presented in Figure 12, the verifier V interacts first with PV, sending him random
questions that are independent from the input 𝑥®, aside from the input length 𝑛. It is thus clear
that the protocol is blind with respect to PV.
In contrast, the questions to PP depend on PV’s answers and on the input, so it may a priori
seem like the questions can leak information to PP. To show that the protocol is also blind with
respect to PP, we show that there is an alternative formulation, in which the verifier first interacts
with PP, sending him random messages, and then only with PV, with whom the interaction is
now adaptive. We argue that, for an arbitrary strategy of the provers, the reduced state of all
registers available to either prover, PP or PV, is exactly the same in both formulations of the
protocol — the original and the alternative one. This establishes blindness for both provers. This
technique for proving blindness is already used in [37] to establish blindness of a two-prover
protocol based on computation by teleportation.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 49
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Lemma 4.6 (Blindness of the Leash Protocol). For any strategy of PV∗ and PP∗ , the reduced state of
PV∗ and PP∗ , resp., at the end of the leash protocol is independent of the input 𝑥®, aside from its length.
Proof. Let PV∗ and PP∗ denote two arbitrary strategies for the provers in the leash protocol. Each
of these strategies can be modeled as a super-operator
𝒯PV : L(ℋ𝑇PV ⊗ ℋPV ) → L(ℋ𝑇PV
0 ⊗ ℋPV ),
𝒯PP,𝑎𝑑 : L(ℋ𝑇PP ⊗ ℋPP ) → L(ℋ𝑇PP
0 ⊗ ℋPP ).
Here ℋ𝑇PV and ℋ𝑇PV 0 (ℋ𝑇
PP and ℋ𝑇PP ) are classical registers containing the inputs and outputs to
0
and from PV (PP , resp.) and ℋPV (ℋPP ) is the private space of PV∗ (PP∗ , resp.). Note that the
∗ ∗
interaction of each prover with the verifier is sequential, and we use 𝒯PV and 𝒯PP,𝑎𝑑 to denote the
combined action of the verifier and the prover, resp., across all rounds of interaction (formally
these are sequences of superoperators).
Consider an alternative protocol, which proceeds as follows. The verifier first interacts with
PP. From Figure 14 we see that the inputs required for PP are subsets 𝑁 and 𝑇1 , . . . , 𝑇𝑑 , and
values {𝑧 𝑖 } 𝑖∈𝑇ℓ for each ℓ ∈ {1, . . . , 𝑑}. To select the former, the verifier proceeds as in the first
step of the Delegation Game. She selects the latter uniformly at random. The verifier collects
values {𝑐 𝑖 } 𝑖∈𝑇ℓ from PP exactly as in the original Delegation Game.
Once the interaction with PP has been completed, the verifier interacts with PV. First, she
selects a random string 𝑊𝑁 ∈ Σ𝑁 , conditioned on the event that 𝑊𝑁 contains at least 𝑛 copies
of each symbol in Σ, and sends it to PV, collecting answers 𝑒®𝑁 . The verifier then follows the
same update rules as in the delegation game. We describe this explicitly for computation runs.
First, the verifier sets 𝑎® = 𝑒®𝑁 . Depending on the values {𝑐 𝑖 } 𝑖∈𝑇1 and {𝑧 𝑖 } 𝑖∈𝑇1 obtained in the
interaction with PP, using the equation 𝑧 𝑖 = 𝑎 𝑗 + 1𝑊𝑖 =𝐹 + 𝑐 𝑖 she deduces a value for 1𝑊𝑖 =𝐹 for each
𝑖 ∈ 𝑇1 ⊆ 𝐵1 . She then selects a uniformly random 𝑊𝐵1 ∈ Σ𝐵1 , conditioned on the event that 𝑊𝐵1
contains at least 𝑡1 copies of each symbol from Σ, and for 𝑖 ∈ 𝑇1 it holds that 𝑊𝑖 = 𝐹 if and only if
𝑧 𝑖 = 𝑎 𝑗 + 1 + 𝑐 𝑖 . The important observation is that, if 𝑇1 is a uniformly random, unknown subset,
the marginal distribution on 𝑊𝐵1 induced by the distribution described above is independent
of whether 𝑧 𝑖 = 𝑎 𝑗 + 1 + 𝑐 𝑖 or 𝑧 𝑖 = 𝑎 𝑗 + 0 + 𝑐 𝑖 : precisely, it is uniform conditioned on the event
that 𝑊𝐵1 contains at least 𝑡1 copies of each symbol from Σ. The verifier receives outcomes
𝑒®𝐵1 ∈ {0, 1} 𝐵1 from PV, and using these outcomes performs the appropriate key update rules;
she then proceeds to the second layer of the circuit, until the end of the computation. Finally,
the verifier accepts using the same rule as in the last step of the original delegation game.
We claim that both the original and alternative protocols generate the same joint final state:
0 ⊗ ℋV ⊗ ℋ𝑇 0 ⊗ ℋPV ,
𝒯PP,𝑎𝑑 ◦ 𝒯PV (𝜌 𝑜𝑟𝑖𝑔 ) = 𝒯PV,𝑎𝑑 ◦ 𝒯PP (𝜌 𝑎𝑙𝑡 ) ∈ ℋPP ⊗ ℋ𝑇PP (4.3)
PV
where we use 𝜌 𝑜𝑟𝑖𝑔 and 𝜌 𝑎𝑙𝑡 to denote the joint initial state of the provers, as well as the verifier’s
initialization of her workspace, in the original and alternative protocols, respectively, and
𝒯PV,𝑎𝑑 and 𝒯PP are the equivalent of 𝒯PV and 𝒯PP,𝑎𝑑 for the reversed protocol (in particular they
correspond to the same strategies PV∗ and PP∗ used to define 𝒯PV and 𝒯PP,𝑎𝑑 ). Notice that 𝒯PV,𝑎𝑑
and 𝒯PP are well-defined since neither prover can distinguish an execution of the original from
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 50
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
the alternative protocol.14 To see that equality holds in (4.3), it is possible to re-write the final
state of the protocol as the result of the following sequence of operations. First, the verifier
initializes the message registers with PP∗ and PV∗ using half-EPR pairs, keeping the other halves
in her private workspace. This simulates the generation of uniform random messages to both
provers. Then, the superoperator 𝒯PV ⊗ 𝒯PP is executed. Finally, the verifier post-selects by
applying a projection operator on ℋ𝑇PV ⊗ ℋ𝑇PV 0 ⊗ ℋ𝑇
PP ⊗ ℋ𝑇PP that projects onto valid transcripts
0
for the original protocol (i. e., transcripts in which the adaptive questions are chosen correctly).
This projection can be implemented in two equivalent ways: either the verifier first measures
ℋ𝑇PV ⊗ ℋ𝑇PV 0 , and then ℋ𝑇
PP ⊗ ℋ𝑇PP ; based on the outcomes she accepts a valid transcript for the
0
original protocol or she rejects. Or, she first measures ℋ𝑇PP ⊗ ℋ𝑇PP 0 , and then ℋ𝑇
PV ⊗ ℋ𝑇PV ; based
0
on the outcomes she accepts a valid transcript for the alternative protocol or she rejects. Using
the commutation of the provers’ actions, conditioned on the transcript being accepted, the first
gives rise to the first final state in (4.3), and the second to the second final state. The two are
equivalent because the acceptance condition for a valid transcript is identical in the two versions
of the protocol.
Since in the first case the reduced state on ℋ𝑇PV 0 ⊗ ℋPV is independent of the input to the
computation, 𝑥®, and in the second the reduced state on ℋPP ⊗ ℋ𝑇PP 0 is independent of 𝑥 ®, we
∗ ∗
deduce that the protocol hides the input from each of PV and PP .
5 Dog-Walker protocol
The Dog-Walker Protocol again involves a classical verifier V and two provers PV and PP.
As in the leash protocol presented in Section 4, PP and PV take the roles of 𝑃𝐸𝑃𝑅 and 𝑉𝐸𝑃𝑅
from [7], respectively. The main difference is that the Dog-Walker Protocol gives up blindness
in order to reduce the number of rounds to two (one round of interaction with each prover,
played sequentially). After one round of communication with PP, who returns a sequence of
measurement outcomes, V communicates all of PP’s outcomes, except for the one corresponding
to the output bit of the computation, as well as the input 𝑥®, to PV. With these, PV can perform
the required adaptive measurements without the need to interact with V. It may seem risky to
communicate bits sent by PP directly to PV — this seems to allow for communication between
the two provers! Indeed, blindness is lost. However, if PP is honest, his outcomes {𝑐 𝑖 } 𝑖 in the
computation run are the result of measurements he performs on half-EPR pairs, and are uniform
random bits. If he is dishonest, and does not return the outcomes obtained by performing the
right measurements, he will be caught in the test runs. It is only in computation runs that V
sends the measurement results {𝑐 𝑖 } 𝑖 to PV.
We note that PV has a much more important role in this protocol: he decides himself the
measurements to perform according to previous measurements’ outcomes as well as the input
𝑥. For this reason, we must use the Tomography test discussed in Section 3.6, in order to test if
PV remains honest with respect to these new tasks. With the tomography test, we can achieve
14One must ensure that a prover does not realize if the alternative protocol is executed instead of the original; this
is easily enforced by only interacting with any of the provers at specific, publicly decided times.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 51
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
a rigidity theorem that will allow us to prove the soundness of the Dog-walker protocol (see
Figure 21 for a glimpse of the proof structure).
Finally, the Dog-Walker Protocol can be easily extended to a classical-verifier two-prover
protocol for all languages in QMA. Along the same lines of the proof that QMIP = MIP∗ from [37],
one of the provers plays the role of PP, running the QMA verification circuit, while the second
prover creates and teleports the corresponding QMA witness. In our case, it is not hard to see
that the second prover can be re-used as PV in the Dog-Walker Protocol, creating the necessary
gadgets for the computation and allowing the Verifier to check the operations performed by the
first prover. We describe the protocol in Section 5.4.
5.1 Protocol and statement of results
Throughout this section we let Σ = {𝑋 , 𝑌, 𝑍, 𝐹, 𝐺}, and let 𝑚 = Θ(𝑛 + 𝑡) be chosen large enough
so that each symbol in Σ appears at least 𝑛 + 𝑡 times in a uniform random 𝑊 ∈ Σ𝑚 , with
probability close to 1. Let 𝜇(𝑊) denote the probability that a player receives input 𝑊 while
playing rigid(Σ, 𝑚) (recall that both players have the same marginals in rigid). Let 𝜇(𝑊 0 |𝑊)
denote the probability that one player receives 𝑊 0 given that the other player receives 𝑊.
The full protocols are presented in Figure 18 (verifier’s point of view), Figure 19 (PV’s point
of view) and Figure 20 (PP’s point of view). The protocol has two types of runs: EPR and
Rigidity. Within an EPR run are three types of subruns: Computation subrun, 𝑋-test subrun,
and 𝑍-test subrun. We will generally think of 𝑋- and 𝑍-test subruns as one subrun type (Test
subrun). Within a Rigidity run are two types of subruns: Tomography subrun, which should be
thought of as the Rigidity version of the EPR-Computation run; and Clifford subrun, which
should be thought of as the Rigidity version of the EPR-Test run. With some probability 𝑝1 , V
runs a Rigidity run, Clifford subrun; with some probability 𝑝 2 , V runs an EPR run, Test subrun;
with some probability 𝑝3 , V runs an EPR run, Computation subrun; and with probability
𝑝 4 = 1 − 𝑝 1 − 𝑝 2 − 𝑝 3 , V runs a Rigidity run, Tomography subrun. This structure is illustrated in
Figure 17. We call this the Dog-Walker Protocol with parameters (𝑝 1 , 𝑝2 , 𝑝3 , 𝑝4 ).
The following theorem states the guarantees of the Dog-Walker Protocol.
Theorem 5.1. There exist constants 𝑝 1 , 𝑝 2 , 𝑝3 , 𝑝 4 = 1 − 𝑝 1 − 𝑝2 − 𝑝 3 , and Δ > 0 such that the following
hold of the Dog-Walker Protocol with parameters (𝑝 1 , 𝑝2 , 𝑝3 , 𝑝4 ), when executed on input (𝑄, | 𝑥®i).
• (Completeness: ) Suppose that Π0 𝑄| 𝑥®i ≥ 2/3. Then there is a strategy for PV and PP that is
2
accepted with probability at least 𝑝 compl = 𝑝 1 (1 − e−Ω(𝑛+𝑡) ) + 𝑝 2 + 23 𝑝 3 + 𝑝 4 .
• (Soundness: ) Suppose that Π0 𝑄| 𝑥®i ≤ 1/3. Then any strategy for PV and PP is accepted with
2
probability at most 𝑝 sound = 𝑝 compl − Δ.
The proof of completeness is given in Lemma 5.2, and proof of soundness is given in Lemma 5.7.
5.2 Dog-Walker completeness
Lemma 5.2. Suppose V executes the Dog-Walker Protocol with parameters (𝑝 1 , 𝑝2 , 𝑝3 , 𝑝4 ). There is
a strategy for the provers such that, on any input (𝑄, | 𝑥®i) such that Π0 𝑄| 𝑥®i ≥ 32 , V accepts with
2
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 52
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Dog Walker
Fig. 20, Fig. 19, and Fig. 18
𝑝1 + 𝑝4 𝑝2 + 𝑝3
Rigidity Run EPR Run
PV uses EPR Protocol to
Ensure PV behaves
delegate computation to
honestly
PP
𝑝4 𝑝1 𝑝2 𝑝3
𝑝 1 +𝑝 4 𝑝1 +𝑝4 𝑝2 +𝑝3 𝑝2 +𝑝3
Computation Subrun Computation Subrun
Test Subrun Test Subrun
(Tomography) (Clifford) Run the computa-
Ensure PV applies tion
Ensure PV reports 1/2 1/2
correct measure- correct gates using
ments when he gets rigid (Fig. 7)
to choose measure- 𝑋-test 𝑍-test
ment to perform Ensure PP returns Ensure PP returns
using tom (Fig. 8) correctly measured correctly measured
bits, except for those bits on odd T gate
returned on odd T gadgets
gate gadgets
Figure 17: The structure of the Dog-Walker Protocol. We illustrate the structure of different
runs, subruns, and games/tests, letting probabilities label branches.
probability at least 𝑝 compl = 𝑝 1 (1 − 𝛿 𝑐 ) + 𝑝 2 + 32 𝑝 3 + 𝑝4 , for some 𝛿 𝑐 = e−Ω(𝑛+𝑡) .
Proof. The provers PV and PP play the strategy described in Figures 19 and 20, respectively. In the
Rigidity-Tomography run, the verification performed by V amounts to playing tom(Σ, 𝑛 + 𝑡, 𝑚)
with the provers (with an extra constraint on the output 𝑊 of PV that is always satisfied by the
honest strategy). This game has perfect completeness, which makes the V accept with probability
1 in the Rigidity-Tomography run. In the Rigidity-Clifford run, V plays rigid(Σ, 𝑚) with the
provers. The game has completeness at least 1 − 𝛿 𝑐 for some 𝛿 𝑐 = e−Ω(𝑛+𝑡) , since 𝑚 = Ω(𝑛 + 𝑡),
therefore their success probability in this run is at least 1 − 𝛿 𝑐 .
In the EPR run, the provers are exactly carrying out the EPR Protocol, with V using PV to run
𝑟
𝑉𝐸𝑃𝑅 , and PP playing the role of 𝑃𝐸𝑃𝑅 . Thus, test runs result in acceptance with probability 1,
and the computation run results in acceptance with probability Π0 𝑄 | 𝑥®i , by Theorem 2.2.
2
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 53
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
1. Select a run type EPR or Rigidity, and disjoint sets 𝑁 , 𝑇 0 , 𝑇 1 ⊂ {1, . . . , 𝑚} of sizes 𝑛, 𝑡0 and
𝑡 − 𝑡0 .
EPR Choose 𝑧® uniformly at random from {0, 1} 𝑡 and send it, along with 𝑁, 𝑇 0 and 𝑇 1 , to PP.
Receive measurement outcomes 𝑐® ∈ {0, 1} 𝑡 and 𝑐 𝑓 ∈ {0, 1} from PP.
Rigidity Choose 𝑊 0 according to 𝜇(·) and send it to PP. Receive 𝑒®0 ∈ {0, 1} 𝑚 from PP.
2. Select a subrun type at random from Computation, 𝑋-test or 𝑍-test.
Computation Based on whether it is an EPR or a Rigidity Run:
EPR (i) Send 𝑥®, 𝑧®, 𝑐® and sets 𝑁, 𝑇 0 and 𝑇 1 to PV, and receive measurement outcomes
𝑎® , 𝑏® ∈ {0, 1} 𝑛 and 𝑒® ∈ {0, 1} 𝑡 .
(ii) Apply the update rules from Table 2 gate-by-gate to obtain the final X key for the
output wire 𝑎 0𝑓 . If 𝑐 𝑓 + 𝑎 0𝑓 ≠ 0, reject.
Rigidity (Tomography) (i) Choose uniform random strings 𝑐®, 𝑧® ∈ {0, 1} 𝑡 , 𝑥® ∈ {0, 1} 𝑛 to
send to PV, along with 𝑁 and 𝑇, and receive measurement outcomes 𝑑® ∈ {0, 1} 𝑛
and 𝑒® ∈ {0, 1} 𝑡 .
® and 𝑒®, determine the adaptive measurements 𝑊 ∈ Σ𝑛+𝑡 that 𝑉 0
(ii) From 𝑥®, 𝑐®, 𝑧®, 𝑑, 𝐸𝑃𝑅
would have performed (based on Figure 3b), and reject if the input-output pairs
(𝑊 0 , 𝑒®0) and (𝑁 ∪𝑇, (𝑊 , 𝑒®)) do not satisfy the winning criterion for tom(Σ, 𝑛 +𝑡, 𝑚).
𝑋-test Based on whether it is an EPR or a Rigidity Run:
EPR (i) Choose 𝑊 ∈ Σ𝑚 uniformly at random among all strings satisfying: 𝑊𝑖 = 𝑍 for
all 𝑖 ∈ 𝑁; 𝑊𝑖 = 𝑍 for all 𝑖 ∈ 𝑇 0 ; and 𝑊𝑖 ∈ {𝑋 , 𝑌} for all 𝑖 ∈ 𝑇 1 . Send 𝑊 to PV and
receive measurement results 𝑒® ∈ {0, 1} 𝑚 . Let (®𝑎 , 𝑏) ® = (®𝑒 𝑁 , 0𝑛 ).
(ii) Apply update rules from Table 2 gate-by-gate to obtain ∀𝑖 ∈ [𝑡] the X key before
the 𝑖-th T gate is applied, 𝑎 0𝑖 , and the final X key for the output wire, 𝑎 0𝑓 . If ∃𝑖 s.t.
the 𝑖-th T gate is even and 𝑐 𝑖 ≠ 𝑎 0𝑖 + 𝑒 𝑖 , reject. If 𝑐 𝑓 + 𝑎 0𝑓 ≠ 0, reject.
Rigidity (Clifford) Choose 𝑊 according to the marginal conditioned on 𝑊 0, 𝜇(·|𝑊 0). Send
𝑊 to PV and receive 𝑒® ∈ {0, 1} 𝑚 . Reject if (𝑊 0 , 𝑒®0 , 𝑊 , 𝑒®) does not win rigid(Σ, 𝑚).
𝑍-test Based on whether it is an EPR or a Rigidity Run:
EPR (i) Choose 𝑊 ∈ Σ𝑚 uniformly at random among all strings satisfying: 𝑊𝑖 = 𝑋 for
all 𝑖 ∈ 𝑁; 𝑊𝑖 ∈ {𝑋 , 𝑌} for all 𝑖 ∈ 𝑇 0 ; and 𝑊𝑖 = 𝑍 for all 𝑖 ∈ 𝑇 1 . Send 𝑊 to PV and
receive measurement results 𝑒® ∈ {0, 1} 𝑚 . Let (®𝑎 , 𝑏) ® = (0𝑛 , 𝑒®𝑁 ).
(ii) Apply update rules from Table 2 gate-by-gate to obtain ∀𝑖 ∈ [𝑡], the X key before
the 𝑖-th T gate is applied, 𝑎 0𝑖 . If ∃𝑖 s.t. the 𝑖-th T gate is odd and 𝑐 𝑖 ≠ 𝑎 0𝑖 + 𝑒 𝑖 , reject.
Rigidity (Clifford) Identical to 𝑋-test case.
Figure 18: The Dog-Walker Protocol: Verifier’s point of view.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 54
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
1. If PV receives a question 𝑊 from V (he is playing rigid or an 𝑋- or 𝑍-test Run):
Measure the 𝑚 qubits in the observable indicated by 𝑊 — for example, if 𝑊 ∈ Σ𝑚 ,
for 𝑖 ∈ {1, . . . , 𝑚}, measure the 𝑖-th qubit in the basis indicated by 𝑊𝑖 — and report
the outcomes 𝑒® to V.
2. If PV receives 𝑥®, 𝑧®, 𝑐® and sets 𝑁, 𝑇 0 and 𝑇 1 from V (he is playing tom or a Computation
Run):
Run the procedure 𝑉𝐸𝑃𝑅 0
from Figure 3b on input 𝑥®, 𝑐®, 𝑧®, the 𝑛 qubits in 𝑁, and the 𝑡
qubits in 𝑇 0 ∪ 𝑇 1 . Report the outputs 𝑑® and 𝑒® of 𝑉 0 to V.
𝐸𝑃𝑅
Figure 19: The Dog-Walker Protocol: Honest strategy for PV.
1. If PP receives a question 𝑊 0 from V (he is playing tom or rigid):
Measure the 𝑚 qubits in the observable indicated by 𝑊 0 — for example, if 𝑊 0 ∈ Σ𝑚 ,
for 𝑖 ∈ {1, . . . , 𝑚}, measure the 𝑖-th qubit in the basis indicated by 𝑊𝑖0 — and report
the outcomes 𝑒®0 to V.
2. If PP receives 𝑧®, and sets 𝑁, 𝑇 0 and 𝑇 1 from V (he is playing the role of 𝑃𝐸𝑃𝑅 from the EPR
Protocol):
Run the prover 𝑃𝐸𝑃𝑅 from Figure 3c on input 𝑧®, the 𝑛 qubits in 𝑁, and the 𝑡 qubits in
𝑇 0 ∪ 𝑇 1 . Report the outputs 𝑐® ∈ {0, 1} 𝑡 and 𝑐 𝑓 ∈ {0, 1} of 𝑃𝐸𝑃𝑅 to V.
Figure 20: The Dog-Walker Protocol: Honest strategy for PP.
5.3 Dog-Walker soundness
Figure 21 summarizes the high-level structure of the soundness analysis. Intuitively, our ultimate
goal is to argue that both provers either apply the correct operations in EPR-Computation runs,
or are rejected with constant probability. This will be achieved by employing a form of “hybrid
argument” whereby it is argued that the provers, if they are not caught, must be using the
honest strategies described in Figure 20 and Figure 19 in the different types of runs considered
in the protocol. Towards this, we divide the run types into the following four scenarios:
1. Rigidity-Clifford: The run type is Rigidity and the subrun type is either 𝑋-test or 𝑍-test.
(When the provers are honest) PV behaves as in Item 1 of Figure 19, and PP behaves as in
Item 1 of Figure 20.
2. EPR-Test: The run type is EPR and the subrun type is either 𝑋-test or 𝑍-test. PV behaves
as in Item 1 of Figure 19, and PP behaves as in Item 2 of Figure 20.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 55
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
3. EPR-Computation: The run type is EPR and the subrun type is Computation. PV behaves
as in Item 2 of Figure 19, and PP behaves as in Item 2 of Figure 20.
4. Rigidity-Tomography: The run type is Rigidity and the subrun type is Computation. PV
behaves as in Item 2 of Figure 19, and PP behaves as in Item 1 of Figure 20.
Examining Figure 18, we can see the following. In the Rigidity-Clifford scenario, the verifier is
precisely playing the game rigid with the provers, as the provers receive questions 𝑊 0 and 𝑊
distributed according to 𝜇(·, ·), the distribution of questions for rigid(Σ, 𝑚); their answers are
tested against the winning conditions of rigid(Σ, 𝑚). In the Rigidity-Tomography scenario, the
verifier plays a variant of the game tom with the provers, in which PV’s choice of observable 𝑊
is uniquely determined by his inputs 𝑥®, 𝑐® and 𝑧®: it should match the observable implemented
𝑟
by 𝑉𝐸𝑃𝑅
0
on these inputs. In EPR runs, PV plays the part of 𝑉𝐸𝑃𝑅 from the EPR Protocol, and
PP plays the part of 𝑃𝐸𝑃𝑅 . The EPR-Test scenario corresponds to 𝑋- and 𝑍-tests from the EPR
Protocol, whereas the EPR-Computation scenario corresponds to computation runs from the
EPR Protocol.
PV PP
rigid Test
1 1 1 Rigidity-Clifford
Soundness of EPR
2 2 2 EPR-Test
}𝑖
f {𝑐 𝑖
ty o
formi
3 Uni 3 3 EPR-Computation
tom Test
4 4 4 Rigidity-Tomography
Figure 21: Overview of the soundness of the Dog-Walker Protocol
The structure of the proof is as follows (see also Figure 21):
(i) By the game rigid, in the Rigidity-Clifford runs, both PP and PV must be honest, or they
would lose the game.
(ii) Since PV cannot distinguish between Rigidity-Clifford and EPR-Test (both are Figure 19
Item 1 from his perspective, and the input distributions, while not identical, have total
variation distance 1 − 𝜂, for some constant 𝜂 > 0), PV must be honest in the EPR-Test runs,
by (i).
(iii) Since PP cannot distinguish between Rigidity-Clifford and Rigidity-Tomography (both are
Figure 20 Item 1 from his perspective), PP must be honest in the Rigidity-Tomography
runs, by (i).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 56
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
(iv) Since PV is honest in EPR-Test runs by (ii), PP must be honest in EPR-Test runs or he will
get caught, but in particular, he must output values {𝑐 𝑖 } 𝑖∈[𝑡] that are uniform random and
independent of 𝑧®. Since PP cannot distinguish between EPR-Test and EPR-Computation
runs, this is also true in EPR-Computation runs, when the verifier sends the values {𝑐 𝑖 } 𝑖
to PV.
(v) PV must be honest in Rigidity-Tomography runs, or the provers would lose the game tom.
(vi) Since PV cannot distinguish between Rigidity-Tomography runs and EPR-Computation
runs (both are Figure 19 Item 2 from his perspective), PV must be honest in EPR-
Computation runs, by (v), and his input distribution to both runs has total variation
distance 1 − 𝜂0, for some constant 𝜂0 > 0, by (iv).
(vii) Since PV is honest in EPR-Test runs by (ii), and EPR-Computation runs by (vi), the
combined behavior of V and PV in the EPR runs is that of 𝑉𝐸𝑃𝑅 in the EPR Protocol, so by
the soundness of the EPR Protocol, PP must be honest in EPR-Computation runs, or get
caught in the EPR-Test runs with high probability.
The following lemma establishes (i), (ii) and (iii).
Lemma 5.3. Suppose the verifier executes the Dog-Walker Protocol with provers (PV∗ , PP∗ ) such that
the provers are accepted with probability 𝑞1 ≥ 1 − 𝜀 in the Rigidity-Clifford Run, 𝑞2 in the EPR-Test
Run, 𝑞3 in the EPR-Computation Run, and 𝑞4 in the Rigidity-Tomography Run. Then there exist provers
(PV0 , PP0) such that:
• PV0 and PP0 both apply the honest strategy in the Rigidity-Clifford runs, PV0 applies the honest
strategy in the EPR-Test runs, and PP0 applies the honest strategy in the Rigidity-Tomography runs;
in particular, the state shared by the provers at the beginning of the protocol is a tensor product of
the honest state consisting of 𝑚 shared EPR pairs and an arbitrary shared ancilla;
• The provers are accepted with probability 𝑞 20 = 𝑞2 − 𝑂(poly(𝜀)) in the EPR-Test Run, 𝑞30 = 𝑞 3 in
the EPR-Computation Run, and 𝑞40 = 𝑞4 − 𝑂(poly(𝜀)) in the Rigidity-Tomography Run.
Proof. Using a similar argument as in Lemma 4.4, the strategy of PV∗ in Rigidity-Clifford
runs, which is also his strategy in EPR-Test runs (Figure 19 Item 1); and the strategy of PP∗ in
Rigidity-Clifford runs, which is also his strategy in Rigidity-Tomography runs (Figure 20 Item 1);
can both be replaced with the honest strategies. Since the distribution of inputs to PP∗ in the
Rigidity-Tomography runs and Rigidity-Clifford runs is the same, the success probability in
the Rigidity-Tomography runs is changed by at most 𝑂(poly(𝜀)) by using the honest strategy.
On the other hand, PV∗ ’s input distribution in EPR-Test runs is uniform on Σ𝑚 , whereas his
distribution in Rigidity-Clifford runs is given by 𝜇. However, from the description of the test
rigid it is clear that for all 𝑊 ∈ Σ𝑚 , 𝜇(𝑊) ≥ 𝑐|Σ|
1
𝑚 for some constant 𝑐 > 1, thus the total variation
distance between the two distributions is at most 1 − 1𝑐 . Thus, replacing PV∗ with the honest
strategy in the EPR-Test runs will change the success probability by at most 𝑂(poly(𝜀)).
Finally, since the provers’ strategy in the EPR-Computation run has not changed, the
acceptance probability in it remains unchanged.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 57
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Next, we will show that whenever PV∗ is honest in the EPR-Test runs this forces PP∗ to output
(close to) uniformly random {𝑐 𝑖 } 𝑖∈[𝑡] that are independent of the run type, even given 𝑧®. This
will allow us to verify that PP∗ is unable to signal to PV∗ whether the run is an EPR Run in the
EPR-Computation run, when PV∗ is sent 𝑧® and 𝑐®. This establishes (iv).
Lemma 5.4. Suppose the verifier executes the Dog-Walker Protocol with provers (PV∗ , PP∗ ) such that
the initial shared state of the provers consists of 𝑚 shared EPR pairs, together with an arbitrary shared
auxiliary state; PV∗ plays the honest strategy in the EPR-Test runs; the provers are accepted with
probability 𝑞1 in the Rigidity-Clifford Run, 𝑞2 = 1 − 𝜀0 in the EPR-Test Run, 𝑞3 in the EPR-Computation
Run, and 𝑞4 in the Rigidity-Tomography Run. Then the input (®𝑐 , 𝑧®) given by the verifier to PV∗ in the
EPR-Computation runs has a distribution that is within 𝑂(𝜀0) total variation distance of uniform on
{0, 1} 𝑡 × {0, 1} 𝑡 .
Proof. Let 𝑎 0𝑖 denote the X key of the wire to which the 𝑖-th T gate is applied, just before the
𝑖-th T gate is applied, and let 𝐷𝑖 be a random variable defined as follows. If the 𝑖-th T gate is
even, let 𝐷𝑖 = 𝑒 𝑖 + 𝑎 0𝑖 , where we interpret 𝑒 𝑖 and 𝑎 0𝑖 as the random variables representing the
measurement result and key V would get if she chooses to execute an 𝑋-test run. If the 𝑖-th T
gate is odd, let 𝐷𝑖 = 𝑒 𝑖 + 𝑎 0𝑖 , where we interpret 𝑒 𝑖 and 𝑎 0𝑖 as the measurement result and key
V would get if she chooses to execute an 𝑍-test run. Since PV∗ is assumed to play honestly in
EPR-Test runs, 𝐷 ® is uniformly distributed in {0, 1} 𝑡 . In particular, we have, for any 𝑑,
® 𝑧® ∈ {0, 1} 𝑡 ,
® 𝑍
® = 𝑑,
Pr[𝐷 ® = 𝑧®] = 1 . (5.1)
4𝑡
Let 𝐶 𝑖 be the random variable that corresponds to the measurement output of the 𝑖-th T
gadget by PP∗ in 𝑋-test run if the 𝑖-th T gate is even, or the measurement output of the 𝑖-th T
gadget by PP∗ in 𝑍-test run if the 𝑖-th T gate is odd.
Let 𝑇 0 ⊂ [𝑡] be the set of even T gates and 𝑇 1 ⊂ [𝑡] the set of odd T gates. In an 𝑋-test Run,
the provers are rejected whenever 𝑖 ∈ 𝑇 0 and 𝑐 𝑖 ≠ 𝑑 𝑖 , and in a 𝑍-test Run, they are rejected
whenever 𝑖 ∈ 𝑇 1 and 𝑐 𝑖 ≠ 𝑑 𝑖 . An EPR-Test Run consists of running one of these two runs with
equal probability, so:
Pr[𝐶® ≠ 𝐷]
® ≤ 2𝜀0 . (5.2)
We can express (5.2) as
® 𝑍)
Pr[(𝐶, ® ≠ (𝐷,
® 𝑍)]
® ≤ 2𝜀0 .
We conclude by using the easily verifiable fact that for any random variables 𝑋 and 𝑌 such that
Pr[𝑋 = 𝑌] ≥ 1 − 2𝜀0, the total variation distance between the marginal distributions on 𝑋 and 𝑌
is at most 2𝜀0.
Next, we can use the tomography test tom to establish (v), and then the fact that by Lemma 5.4
the input to PV is not very different in EPR-Computation and Rigidity-Tomography runs to
establish (vi):
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 58
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Lemma 5.5. Suppose the verifier executes the Dog-Walker Protocol with provers (PV∗ , PP∗ ) such
that: PV∗ applies the honest strategy in EPR-Test runs; PP∗ applies the honest strategy in the Rigidity-
Tomography runs; and the provers are accepted with probability 𝑞1 in the Rigidity-Clifford Run, 𝑞 2 = 1− 𝜀0
in the EPR-Test Run, 𝑞3 in the EPR-Computation Run, and 𝑞4 = 1 − 𝜀 in the Rigidity-Tomography Run.
Then there exist provers (PV0 , PP0) such that PV0 applies the honest strategy in the Rigidity-Tomography
runs and EPR-Computation runs, PP0 applies the honest strategy in Rigidity-Tomography runs, and the
provers are accepted with probability 𝑞1 in the Rigidity-Clifford Run, 𝑞2 = 1 − 𝜀0 in the EPR-Test Run
and 𝑞 3 − poly(𝜀) − 𝑂(𝜀0) in the EPR-Computation run.
Proof. The Rigidity-Tomography runs can be seen as V playing the Tomography Game with the
provers, except that whereas PV∗ gets no non-trivial input in the Tomography Game, in the
Rigidity-Tomography run, he gets random values 𝑐® and 𝑧® on which his strategy can depend. Fix
𝑥®, and let {𝑄 𝑐®𝑢,®𝑧 } 𝑢 be the projective measurement that PV∗ applies upon receiving 𝑐®, 𝑧® , 𝑥®, where
® 𝑒®) is the string of outcomes obtained by PV on the 𝑛 + 𝑡 single-qubit measurements he is
𝑢 = ( 𝑑,
to perform according to Step 2 in Figure 19.
By Corollary 3.9, since the provers win the Rigidity-Tomography run with probability 1 − 𝜀,
for every 𝑐®, 𝑧® ∈ {0, 1} 𝑡 , there exist distributions 𝑞 𝑐®,®𝑧 on Σ𝑚 × {±} such that the following is
𝑂(poly(𝜀)):
𝑢
𝑚 𝜎 𝑖0
!
𝑊 ,𝜆
Õ Õ Ì
E TrA,B̂ (IdA ⊗𝑉B 𝑄 𝑐®𝑢,®𝑧 )|𝜓ih𝜓| AB (IdA ⊗𝑉B 𝑄 𝑐®𝑢,®𝑧 )† − 0
𝑞 𝑐®,®𝑧 (𝑊 , 𝜆) 𝑖
.
𝑐®,®𝑧 2 1
𝑢∈{0,1} 𝑚 𝜆∈{±} 𝑖=1
(5.3)
Here we use the notation from Theorem 3.1 and 3.9. The string 𝑊 0 = 𝑊(®𝑐 , 𝑧® , 𝑢® ) ∈ Σ𝑚 is uniquely
determined by 𝑐®, 𝑧®, and the outcomes 𝑢 reported by PV∗ ; indeed it is using this string that PV∗ ’s
answers are checked against the measurement outcomes obtained by PP∗ , who by assumption
applies the honest strategy. For any fixed (𝑊 0 , 𝜆) the distribution on outcomes 𝑢 obtained in the
“honest” strategy represented by the right-hand side in (5.3) is uniform. Thus the outcomes 𝑢
reported by PV∗ are within poly(𝜀) of uniform. From this it follows that the joint distribution on
transcripts (®𝑐 , 𝑧® , 𝑢, 𝑊 0 = 𝑊(®𝑐 , 𝑧® , 𝑢)) that results from an interaction with PV∗ is within statistical
distance poly(𝜀) of the distribution generated by an interaction with the honest PV; furthermore,
by (5.3) the resulting post-measurement states on PP∗ are also poly(𝜀) close to the honest ones,
on average over this distribution.
We can now consider two provers PV0 and PP0 who, in Rigidity-Tomography runs, first apply
the isometries 𝑉𝐴 , 𝑉𝐵 from Corollary 3.9, then measure their auxiliary systems  and B̂ using
Δ𝑌 , obtaining a shared outcome 𝜆 ∈ {±}, and finally apply the honest strategy shown in Item 2
of Figure 19 (𝜆 = +) or its conjugate (𝜆 = −). Furthermore, conjugating the honest strategy
produces exactly the same statistics as the honest strategy itself, so we may in fact assume that
PV0 and PP0 both apply the honest strategy in Rigidity-Tomography runs.
A consequence of PV0 applying the honest strategy in Figure 19 Item 2 is that PV0 also plays
the honest strategy in EPR-Computation runs. Since PV0 is still honest in the EPR-Test run and
𝑞2 = 1 − 𝜀0, Lemma 5.4 implies that the distribution of the input to PV0 in EPR-Computation
runs is within poly(𝜀) + 𝑂(𝜀0) total variation distance of his input in Rigidity-Tomography
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 59
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
runs, therefore the provers’ success probability in EPR-Computation runs changes at most by
poly(𝜀) + 𝑂(𝜀0).
Finally, we show that if PV is honest, PP must be honest in EPR computation runs, or the
acceptance probability would be low, establishing (vii):
Lemma 5.6. Suppose V executes the Dog-Walker Protocol on an input (𝑄, | 𝑥®i) such that Π0 𝑄| 𝑥®i ≤
2
1/3, with provers (PV, PP) such that PV plays the honest strategy. Let 𝑞2 be the provers’ acceptance
probability in EPR-Test runs. Then the verifier accepts with probability at most 𝑝 1 (1 − 𝛿 𝑐 ) + 𝑝 2 𝑞2 +
𝑝 3 (5/3 − 4𝑞 2 /3) + 𝑝 4 .
Proof. With probability 𝑝 2 + 𝑝 3 , V executes an EPR run, in which case, she executes EPR-
𝑝3 𝑝2
Computation with probability 𝑝2 +𝑝 3
and EPR-Test with probability 𝑝2 +𝑝 3
. In the former case,
since PV is honest, he is executing 𝑉𝐸𝑃𝑅
0
. In fact, the behavior of an honest PV in the EPR-Test
𝑟
runs is also that of 𝑉𝐸𝑃𝑅 . Thus, the combined behavior of V and PV is that of 𝑉𝐸𝑃𝑅 . Then the
result follows from Theorem 2.3.
We can now combine Lemmas 5.3, 5.5, and 5.6 to get the main result of this section, the
“soundness” part of Theorem 5.1.
Lemma 5.7 (Constant soundness-completeness gap). There exist constants 𝑝1 , 𝑝2 , 𝑝3 , 𝑝4 =
1 − 𝑝 1 − 𝑝 2 − 𝑝3 and Δ > 0 such that if the verifier executes the Dog-Walker Protocol with parameters
(𝑝 1 , 𝑝2 , 𝑝3 , 𝑝4 ) on input (𝑄, | 𝑥®i) such that Π0 𝑄| 𝑥®i ≤ 1/3, then any provers (PV∗ , PP∗ ) are accepted
2
with probability at most 𝑝 sound = 𝑝 compl − Δ.
Proof. Suppose the provers PV∗ and PP∗ are such that the lowest acceptance probability in either
the Rigidity-Clifford run or the Rigidity-Tomography run is 1 − 𝜀, and they are accepted with
probability 1 − 𝜀0 in the EPR-Test run, and with probability 1/3 + 𝑤 in the Computation Run.
Applying Lemma 5.3 and Lemma 5.5 in sequence, we deduce the existence of provers (PV0 , PP0)
for which
𝑞10 = 1 − 𝑂(𝛿 𝑐 ),
𝑞20 = 1 − 𝜀0 − poly(𝜀),
1
𝑞30 = + 𝑤 − poly(𝜀) − 𝑂(𝜀0),
3
𝑞40 = 1,
where 𝑞 10 , 𝑞 20 , 𝑞30 and 𝑞 40 are their success probabilities in the four types of runs, and 1 − 𝛿 𝑐 is the
completeness of the rigid test; from Theorem 3.1 we have 𝛿 𝑐 = 2−Ω(𝑛+𝑡) . Moreover PV0 applies
the honest strategy in all runs, while PP0 applies the honest strategy in the Rigidity-Clifford and
Rigidity-Tomography runs. Applying Lemma 5.6, it follows that
𝑤 ≤ 𝑂(𝜀0) + poly(𝜀) + 𝑝 1 · 𝑂(𝛿 𝑐 ).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 60
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Therefore the prover’s overall success probability is at most
0 1
min(𝑝 1 , 𝑝4 )(1 − 𝜀) + max(𝑝 1 , 𝑝4 ) + 𝑝2 (1 − 𝜀 ) + 𝑝3 +𝑤
3
𝑝
+ 𝜀0 𝑝 2 + 𝜀 min(𝑝 1 , 𝑝4 ) + 𝑝 3 𝑂(𝜀0) + poly(𝜀) + (𝑝1 + 𝑝 3 𝑝1 ) · 𝑂(𝛿 𝑐 ),
3
≤𝑝 compl −
3
where recall from Lemma 5.2 that 𝑝compl = 𝑝 1 (1 − 𝛿 𝑐 ) + 𝑝 2 + 𝑝 4 + 23 𝑝 3 . Fixing 𝑝 2 to be a large
enough multiple of 𝑝 1 and of 𝑝 3 we can ensure that the net contribution of the terms involving
𝜀0 and 𝛿 𝑐 on the right-hand side is always non-positive. Choosing 𝑝 1 = 𝑝 4 and 𝑝 3 so that the
ratio 𝑝 3 /𝑝 1 is small enough we can ensure that the right-hand side is less than 𝑝 compl − Δ, for
some universal constant Δ > 0 and all 𝜀, 𝜀0 ≥ 0.
5.4 Two-prover game for QMA
In this section we propose a new two-prover game for QMA, which is based on the Dog-Walker
protocol. Such type of games are important in the context of the Quantum PCP conjecture [1],
more specifically to its game version that was recently proved [36].
A promise problem 𝐿 is in QMA if there is a uniform family of quantum circuits {𝑉𝑥 } 𝑥∈𝐿
⊗𝑛
such that if 𝑥 is a yes-instance, then there exists a quantum state |𝜓i ∈ ℂ2 𝑤 , such that 𝑉𝑥
accepts on input |𝜓i|0i ⊗𝑛 𝑎 with probability at least 23 , while for a no-instance 𝑥 and all states
⊗𝑛
|𝜓i ∈ ℂ2 𝑤 , 𝑉𝑥 rejects on input |𝜓i|0i ⊗𝑛 𝑎 with probability at least 23 . The run-time of the
circuit 𝑉𝑥 and the values 𝑛𝑤 and 𝑛 𝑎 are polynomially bounded in |𝑥|.
In a multi-prover game for a promise problem 𝐿, an instance 𝑥 ∈ 𝐿 is reduced to a game
𝐺 𝑥 such that if 𝑥 is a yes-instance, then the maximum acceptance probability in the game is at
least 𝑐, whereas if 𝑥 is a no-instance, then the maximum acceptance probability in the game is at
most 𝑠, for 𝑐 > 𝑠.
Here, we are interested in multi-prover games where the verifier is classical, the honest
provers run a polynomially bounded quantum computation on copies of an accepting witness
and the completeness-soundness gap 𝑐 − 𝑠 is constant. Using the Dog-Walker protocol, we are
able to construct, to the best of our knowledge, the first two-prover game for QMA with these
parameters. In our protocol the Verifier and provers exchange messages of polynomial size in
two rounds of communication, one with each prover.
Our protocol consists in the Verifier running the Dog-Walker protocol, with the following
changes:
• On 𝑋-test runs and 𝑍-test runs, the Verifier randomly selects positions where PV has
measured in the 𝑍 basis and 𝑋 basis, respectively, and sends them to PP. PP uses the EPR
pair halves in these positions as the witness register when he executes the circuit 𝑉𝑥 .
• On Rigidity-Computation runs, the Verifier informs PV of the halves of EPR pairs that
should be used to teleport the witness state to PP, and PV reports the outcomes of the
teleportation measurements along with the answers for the original Dog-Walker protocol.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 61
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
The Verifier ignores the measurements corresponding to the teleportation and uses the
remaining bits to perform the same checks as in the original Dog-Walker protocol.
• On EPR-Computation runs, the Verifier informs PP of the EPR pair halves that should
be used as the witness when he performs the circuit 𝑉𝑥 . The Verifier also informs PV of
these positions, who should use them to teleport the witness state to PP. The outcomes of
the teleportation measurements are reported to the Verifier along with the answers for
the original Dog-Walker protocol, in order that the Verifier can decrypt the output of the
computation.
The full description of the protocol is presented in Figures 22, 23 and 25, where the differences
to the original Dog-Walker protocol are underlined. We state our result in Lemma 5.8 and
provide a proof sketch for it.
Let 𝑥 be an instance of a language 𝐿 ∈ QMA and 𝑉𝑥 the associated verification circuit. 𝑉𝑥 takes
as input an 𝑛𝑤 -qubit witness register and an 𝑛 𝑎 -qubit ancilla register. It has 𝑡 T gates, 𝑡0 of which
are even and 𝑡 − 𝑡0 are odd (see Section 2.4 for the definition of even and odd T gates).
1. Select a run type EPR or Rigidity, and disjoint sets 𝑁 𝑤 , 𝑁 𝑎 , 𝑇 0 , 𝑇 1 ⊂ {1, . . . , 𝑚} of sizes 𝑛𝑤 ,
𝑛 𝑎 , 𝑡0 and 𝑡 − 𝑡0 , respectively.
EPR Choose 𝑧® uniformly at random from {0, 1} 𝑡 and send it, along with 𝑥®, 𝑁 𝑤 , 𝑁 𝑎 , 𝑇 0 and 𝑇 1 ,
to PP. Receive measurement outcomes 𝑐® ∈ {0, 1} 𝑡 and 𝑐 𝑓 ∈ {0, 1} from PP.
Rigidity Choose 𝑊 0 according to 𝜇(·) and send it to PP. Receive 𝑒®0 ∈ {0, 1} 𝑚 from PP.
2. Select a subrun type at random from Computation, X-test or Z-test. Based on this choice, as
well as the run type (EPR or Rigidity), proceed as in Figure 24.
Figure 22: QMA Protocol: Verifier’s point of view.
1. If PP receives a question 𝑊 0 from V (he is playing tom or rigid):
Measure the 𝑚 qubits in the observable indicated by 𝑊 0 — for example, if 𝑊 0 ∈ Σ𝑚 ,
for 𝑖 ∈ {1, . . . , 𝑚}, measure the 𝑖-th qubit in the basis indicated by 𝑊𝑖0 — and report
the outcomes 𝑒®0 to V.
2. If PP receives 𝑥®, 𝑧®, and sets 𝑁 𝑤 ,𝑁 𝑎 , 𝑇 0 and 𝑇 1 from V (he is playing the role of 𝑃𝐸𝑃𝑅 from
the EPR Protocol):
Run prover 𝑃𝐸𝑃𝑅 from Figure 3c with the 𝑉𝑥 as the circuit 𝑄, on input 𝑧®, the 𝑛𝑤 qubits
in 𝑁 𝑤 as the witness, the 𝑛 𝑎 qubits in 𝑁 𝑎 as the ancilla, and the 𝑡 qubits in 𝑇 0 ∪ 𝑇 1
for T gadgets. Report the outputs 𝑐® ∈ {0, 1} 𝑡 and 𝑐 𝑓 ∈ {0, 1} of 𝑃𝐸𝑃𝑅 to V.
Figure 23: QMA Protocol: Honest strategy for PP.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 62
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Computation Based on whether it is an EPR or a Rigidity Run:
EPR (i) Send 𝑥®, 𝑧®, 𝑐® and sets 𝑁 𝑤 , 𝑁 𝑎 , 𝑇 0 and 𝑇 1 to PV, and receive measurement
outcomes 𝑎® , 𝑏® ∈ {0, 1} 𝑛𝑤 +𝑛 𝑎 and 𝑒® ∈ {0, 1} 𝑡 .
(ii) Apply the update rules from Table 2 gate-by-gate to obtain the final X key for the
output wire 𝑎 0𝑓 . If 𝑐 𝑓 + 𝑎 0𝑓 ≠ 0, reject.
Rigidity (Tomography) (i) Choose uniform random strings 𝑐®, 𝑧® ∈ {0, 1} 𝑡 , 𝑥® ∈ {0, 1} 𝑛
to send to PV, along with 𝑁 𝑤 , 𝑁 𝑎 and 𝑇, and receive measurement outcomes
𝑎® , 𝑏® ∈ {0, 1} 𝑛𝑤 +𝑛 𝑎 and 𝑒® ∈ {0, 1} 𝑡 .
(ii) From 𝑥®, 𝑐®, 𝑧®, 𝑎®, 𝑏® and 𝑒®, determine the adaptive measurements 𝑊 ∈ Σ𝑛+𝑡
that 𝑉𝐸𝑃𝑅
0
would have performed (based on Figure 3b), and reject if the input-
output pairs (𝑊 0 , 𝑒®0) and (𝑁 ∪ 𝑇, (𝑊 , 𝑒®)) do not satisfy the winning criterion for
tom(Σ, 𝑛 + 𝑡, 𝑚).
𝑋-test Based on whether it is an EPR or a Rigidity Run:
EPR (i) Choose 𝑊 ∈ Σ𝑚 uniformly at random among all strings satisfying: 𝑊𝑖 = 𝑍 for
all 𝑖 ∈ 𝑁 𝑤 ∪ 𝑁 𝑎 ; 𝑊𝑖 = 𝑍 for all 𝑖 ∈ 𝑇 0 ; and 𝑊𝑖 ∈ {𝑋 , 𝑌} for all 𝑖 ∈ 𝑇 1 . Send 𝑊 to
PV and receive measurement results 𝑒® ∈ {0, 1} 𝑚 . Let (®𝑎 , 𝑏) ® = (®𝑒 𝑁 , 0𝑛 ).
(ii) Apply update rules from Table 2 gate-by-gate to obtain ∀𝑖 ∈ [𝑡] the X key before
the 𝑖-th T gate is applied, 𝑎 0𝑖 , and the final X key for the output wire, 𝑎 0𝑓 . If ∃𝑖 s.t.
the 𝑖-th T gate is even and 𝑐 𝑖 ≠ 𝑎 0𝑖 + 𝑒 𝑖 , reject. If 𝑐 𝑓 + 𝑎 0𝑓 ≠ 0, reject.
Rigidity (Clifford) Choose 𝑊 according to the marginal conditioned on 𝑊 0, 𝜇(·|𝑊 0). Send
𝑊 to PV and receive 𝑒® ∈ {0, 1} 𝑚 . Reject if (𝑊 0 , 𝑒®0 , 𝑊 , 𝑒®) does not win rigid(Σ, 𝑚).
𝑍-test Based on whether it is an EPR or a Rigidity Run:
EPR (i) Choose 𝑊 ∈ Σ𝑚 uniformly at random among all strings satisfying: 𝑊𝑖 = 𝑋 for
all 𝑖 ∈ 𝑁 𝑤 ∪ 𝑁 𝑎 ; 𝑊𝑖 ∈ {𝑋 , 𝑌} for all 𝑖 ∈ 𝑇 0 ; and 𝑊𝑖 = 𝑍 for all 𝑖 ∈ 𝑇 1 . Send 𝑊 to
PV and receive measurement results 𝑒® ∈ {0, 1} 𝑚 . Let (®𝑎 , 𝑏) ® = (0𝑛 , 𝑒®𝑁 ).
(ii) Apply update rules from Table 2 gate-by-gate to obtain ∀𝑖 ∈ [𝑡], the X key before
the 𝑖-th T gate is applied, 𝑎 0𝑖 . If ∃𝑖 s.t. the 𝑖-th T gate is odd and 𝑐 𝑖 ≠ 𝑎 0𝑖 + 𝑒 𝑖 , reject.
Rigidity (Clifford) Identical to 𝑋-test case.
Figure 24: QMA Protocol: Step 2 of Verifier’s point of view. Verifier’s behavior in Step 2 is
determined by the subrun type (Computation, X-test or Z-test) as well as the run type (EPR or
Rigidity).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 63
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
1. If PV receives a question 𝑊 from V (he is playing rigid or an 𝑋- or 𝑍-test Run):
Measure the 𝑚 qubits in the observable indicated by 𝑊 — for example, if 𝑊 ∈ Σ𝑚 ,
for 𝑖 ∈ {1, . . . , 𝑚}, measure the 𝑖-th qubit in the basis indicated by 𝑊𝑖 — and report
the outcomes 𝑒® to V.
2. If PV receives 𝑥®, 𝑧®, 𝑐® and sets 𝑁 𝑤 , 𝑁 𝑎 , 𝑇 0 and 𝑇 1 from V (he is playing tom or a Computation
Run):
Using the EPR pairs in 𝑁 𝑤 , teleports the witness state |𝜓i that makes 𝑉𝑥 accept with
high probability. Let (®𝑎 𝑁 𝑤 , 𝑏®𝑁 𝑤 ) be the corresponding outcomes of the teleportation
measurements.
Measure each qubit in 𝑁 𝑎 in the 𝑍 basis with outcomes 𝑑® and let (®𝑎 𝑁 𝑎 , 𝑏®𝑁 𝑎 ) = ( 𝑑,
® 0)
®
Run the second step of procedure 𝑉𝐸𝑃𝑅 0
from Figure 3b with 𝑉𝑥 as the circuit 𝑄, and
the values 𝑐®, 𝑧®, the 𝑛𝑤 qubits in 𝑁 as the witness, the 𝑛 𝑎 qubits in 𝑁 𝑎 as the ancilla,
𝑤
and the 𝑡 qubits in 𝑇 0 ∪ 𝑇 1 for T gadgets. Report the outputs 𝑎®, 𝑏® and 𝑒® of 𝑉𝐸𝑃𝑅
0
to V.
Figure 25: QMA Protocol: Honest strategy for PV.
Lemma 5.8. There exist universal constants 0 ≤ 𝑝compl ≤ 1 and Δ > 0 such that the following holds.
Let 𝐿 be a language in QMA and 𝑥 an instance of 𝐿 such that 𝑛 = |𝑥|. Let 𝑉𝑥 be the verification circuit
for this instance and 𝑔 the number of gates in 𝑉𝑥 (in the compiled form as described in Section 2). Then
there exists a two-round interactive protocol between a classical verifier and two entangled provers where
the Verifier sends 𝑂(𝑛 + 𝑔)-bit questions to the provers, the provers answer with 𝑂(𝑛 + 𝑔) bits and the
protocol satisfies the following properties.
Completeness: If 𝑥 is a yes-instance, then there is a strategy for the provers such that the Verifier accepts
with probability at least 𝑝 compl .
Soundness: If 𝑥 is a no-instance, then for all strategies of the provers, the Verifier accepts with probability
at most 𝑝 sound = 𝑝 compl − Δ.
Proof sketch. The Verifier performs the operations described in Figure 22.
The completeness of the protocol is straightforward: if PP and PV use the strategy in
Figures 23 and 25, respectively, then the Verifier accepts with high probability.
The soundness of the protocol follows from the combination of the soundness of the Dog-
Walker protocol and the soundness of the QMA verification circuit. Along the same lines
as Lemmas 5.3, 5.4 and 5.5, we can show that if the acceptance probability in Rigidity-Test,
Rigidity-Computation and EPR-Test runs is sufficiently high, then there is a strategy where
the provers follow the honest strategy and the acceptance probability in EPR-Computation
run is only slightly changed. In the case where the provers are honest in the Rigidity-Test,
Rigidity-Computation and EPR-Test runs, no matter which state is held by PP as witness state,
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 64
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
𝑉𝑥 rejects with high probability in the EPR-Computation run, by the soundness of the QMA
verification circuit. The proof of soundness can be completed by repeating the arguments in
Lemma 5.7.
6 Running our protocols in sequence
In order to make a fair comparison between previous delegated computation protocols and ours
(see Figure 1) the resource requirements are computed under the condition that they produce the
correct outcome of the computation with 99% probability. For most protocols, this is achieved
by sequentially repeating the original version, in order to amplify the completeness-soundness
gap.
In this section, we describe a sequential procedure that, starting from our protocols in
Sections 4 and 5, ensures that either the verifier aborts, or she obtains the correct outcome of
the computation with probability 99%. Moreover, for honest provers, the probability that the
procedure aborts is exponentially small in the number of sequential repetitions. Our sequential
procedure has a number of rounds which depends on the desired soundness. As long as one
only requires amplification of an arbitrarily small, but constant, soundness, to a fixed constant,
the number of sequential repetitions remains constant.
To emphasize the importance of having such a sequential procedure, we note that, firstly, the
current completeness-soundness gap between acceptance probability on yes and no instances,
for both the leash and the Dog-Walker protocol, is a very small constant. Secondly, if a classical
client wishes to employ our protocols to delegate a computation, we need to specify what
the client interprets, at the end of the protocol, as the outcome of the delegated computation.
The natural approach is to have the verifier interpret accept as a yes outcome and reject as a
no outcome. However, this is not enough, as our security model based on the constant gap
between acceptance probability for yes and no instances means that, while the provers have a
low probability of making the verifier accept a no instance as a yes, they can always make the
verifier accept a yes instance as a no, simply by behaving so that they are rejected.
The first point is addressed by running copies of the original protocol in sequence to amplify
the completeness-soundness gap. The second point is addressed by having the verifier run the
protocol twice: once for the circuit 𝑄, and once for the circuit 𝑄 0 defined by appending an X
gate to the output wire of 𝑄. If 𝑓 : 𝑋 → {0, 1} for some 𝑋 ⊆ {0, 1} 𝑛 is defined by 𝑓 (𝑥) = 1 if
kΠ0 𝑄|𝑥ik 2 ≥ 2/3, and 𝑓 (𝑥) = 0 if kΠ0 𝑄|𝑥ik 2 ≤ 1/3, i. e., 𝑄 decides 𝑓 with bounded error 1/3,
then it is easy to see that 𝑄 0 decides 1 − 𝑓 with bounded error 1/3. Thus, the verifier will accept
𝑥 as a yes instance of 𝑓 if the protocol outputs accept when running 𝑄 on 𝑥 and outputs reject
when running 𝑄 0 on 𝑥. The verifier accepts 𝑥 as a no instance of 𝑓 if the protocol outputs reject
when running 𝑄 on 𝑥 and outputs accept when running 𝑄 0 on 𝑥. The verifier aborts if she sees
accept-accept or reject-reject.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 65
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
6.1 Sequential version of our protocols
Let 𝑃 denote either the Verifier-on-a-Leash or the Dog-Walker protocol from Sections 4 and 5,
respectively, and let 𝑐 and Δ denote the completeness and the completeness-soundness gap,
resp. Let 𝜅 be a security parameter.
Protocol Seq(𝑃, 𝑐, Δ, 𝜅): Let (𝑄, 𝑥) be the verifier’s input.
1. The verifier runs 𝜅 copies of protocol 𝑃 in sequence on input (𝑄, 𝑥) with PP and PV. Then
she runs 𝜅 copies in sequence on input (𝑄 0 , 𝑥).
2. Let 𝑜®, 𝑜®˜ ∈ {0, 1}𝜅 be such that 𝑜 𝑖 = 1 iff the 𝑖-th copy on input (𝑄, 𝑥) accepts, and 𝑜˜ 𝑖 = 1 iff
the 𝑖-th copy on input (𝑄 0 , 𝑥) accepts. Let 𝑤𝑡(®𝑜 ) and 𝑤𝑡( 𝑜®˜) be their Hamming weights. Then,
the verifier accepts 1 as the outcome of the delegated computation if 𝑤𝑡(®𝑜 ) ≥ (𝑐 − Δ2 ) · 𝜅 and
𝑤𝑡( 𝑜®˜) < (𝑐 − Δ2 ) · 𝜅, and she accepts 0 as the outcome of the computation if 𝑤𝑡(®𝑜 ) < (𝑐 − Δ2 ) · 𝜅
and 𝑤𝑡(𝑜®˜) ≥ (𝑐 − Δ ) · 𝜅. Otherwise the verifier aborts.
2
Figure 26: Sequential version of our protocols
We state and prove completeness and soundness for the sequential protocol.
Theorem 6.1. Let 𝑐 and Δ be respectively the completeness and completeness-soundness gap of protocol
𝑃. On input (𝑄, 𝑥):
• If the provers are honest,
Δ2 𝜅
Pr Seq(𝑃, 𝑐, Δ, 𝜅) outputs 𝑓 (𝑥) ≥ 1 − 2 exp − .
2
• For any cheating provers,
Δ2 𝜅
Pr Seq(𝑃, 𝑐, Δ, 𝜅) outputs 1 − 𝑓 (𝑥) ≤ exp − .
8
Proof. We first show completeness. Let 𝑠 = 𝑐 − Δ be the soundness of protocol P. Suppose
𝑓 (𝑥) = 1 (the case 𝑓 (𝑥) = 0 is analogous). If the provers are honest, then the probability that the
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 66
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
verifier outputs 1 is:
Δ Δ
Pr(Verifier outputs 1) = Pr 𝑤𝑡(®𝑜 ) ≥ 𝑐 − · 𝜅 ∧ 𝑤𝑡( 𝑜®˜) < 𝑐 − ·𝜅
2 2
Δ Δ
≥ 1 − Pr 𝑤𝑡(®𝑜 ) < 𝑐 − · 𝜅 − Pr 𝑤𝑡( 𝑜®˜) ≥ 𝑐 − ·𝜅
2 2
Δ2 𝜅
≥ 1 − 2 exp −
2
by the Azuma–Hoeffding inequality (Theorem 2.1).
Next we show soundness. Again suppose 𝑓 (𝑥) = 1 (the case 𝑓 (𝑥) = 0 is analogous). Let
𝑊𝑗 be an indicator random variable for the event 𝑜˜ 𝑗 = 1, and let 𝐹 𝑗 = 𝑊𝑗 − 𝑠. One might be
tempted to immediately assert that E(𝐹 𝑗 |𝐹 𝑗−1 , .., 𝐹1 ) ≤ 0. However, because of the sequentiality
of the runs of protocol 𝑃, this is not in general true, and an analysis that treats protocol 𝑃 as a
black-box does not suffice when 𝑃 is the verifier-on-a-leash protocol (because such a protocol is
blind). We argue more precisely that E(𝐹 𝑗 |𝐹 𝑗−1 , .., 𝐹1 ) ≤ 0:
• When 𝑃 is the Dog-Walker protocol from Section 5 (which is not blind): suppose for a
contradiction that there were provers PV and PP, and a 𝑗 such that E(𝐹 𝑗 |𝐹 𝑗−1 , .., 𝐹1 ) ≤ 0.
Then one can construct provers PV0 and PP0 which break the soundness of protocol 𝑃.
Namely PV0 and PP0 simulate 𝑗 − 1 runs of protocol 𝑃. They then respectively invoke
PV and PP and forward to them the transcripts previously generated. PV0 and PP0 then
participate in the challenge protocol 𝑃 by forwarding all of the incoming messages to the
invocations of PV and PP, respectively. By the initial hypothesis, such PV0 and PP0 would
break the soundness of 𝑃.
• When 𝑃 is the Verifier-on-a-leash protocol from Section 4: the key observation is that
protocol 𝑃 remains sound even when 𝑥 is revealed to the provers. Then, notice that if it is
possible for provers to force E(𝐹 𝑗 |𝐹 𝑗−1 , .., 𝐹1 ) ≤ 0 when 𝑥 is not revealed, it is clearly also
possible to do so when 𝑥 is revealed. However, the latter is not possible, by an analogous
reduction to the one for the dog-walker protocol.
Define 𝑋0 = 0 and 𝑋ℓ = ℓ𝑗=1 𝐹 𝑗 , for ℓ = 1, .., 𝜅. The the sequence {𝑋ℓ } constitutes a supermartin-
Í
gale with |𝑋ℓ − 𝑋ℓ −1 | = |𝐹ℓ | ≤ 1 ∀ℓ . Hence,by the Azuma–Hoeffding inequality (Theorem 2.1),
𝑡2
for any 𝜅 ≥ 1 and 𝑡 ≥ 0, Pr(𝑋𝜅 ≥ 𝑡) ≤ exp(− 2𝜅 ). This implies that
𝜅 𝜅
𝑡
2
©Õ ©Õ
𝑊𝑗 − 𝜅 · 𝑠 ≥ 𝑡 ® = Pr 𝐹 𝑗 ≥ 𝑡 ® = Pr (𝑋𝜅 ≥ 𝑡) ≤ exp − .
ª ª
Pr
2𝜅
« 𝑗=1 ¬ « 𝑗=1 ¬
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 67
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Then, for any provers PP and PV,
Δ
Pr(Verifier outputs 0) ≤ Pr 𝑤𝑡( 𝑜®˜) ≥ (𝑐 − ) · 𝜅
2
𝜅
©Õ Δ
= Pr 𝑊𝑗 ≥ (𝑐 − ) · 𝜅®
ª
2
« 𝑗=1 ¬
𝜅
Õ Δª
= Pr 𝑊𝑗 − 𝜅 · 𝑠 ≥ 𝜅 · ®
©
2
« 𝑗=1 ¬
Δ2 𝜅
≤ exp − .
8
Finally, one can check that when 𝑃 is the verifier-on-a-leash protocol, then Seq(𝑃, 𝑐, Δ, 𝜅)
remains blind. This follows from a similar argument as in the proof of Lemma 4.6.
A Some simple tests
In this appendix we collect simple tests that will be used as building blocks. In Section A.1 and
Section A.2 we review elementary tests whose analysis is either immediate or can be found in
the literature. In Section A.3 we formulate a simple test for measurements in the Bell basis and
the associated two-qubit SWAP observable. Finally, in Section A.4, we show how to extend the
results from [35] to derive a robust self-test for the 𝑚-qubit Pauli group.
A.1 The Magic Square game
We use the Magic Square game [29] as a building block, noting that it provides a robust self-test
for the two-qubit Weyl–Heisenberg group (see Section 2.1 for the definition). A question in
this game is specified, either by a label corresponding to an entry from the square pictured in
Figure 27 (9 questions, labeled 𝐼𝑍, etc.), or by a triple of labels corresponding to the same row or
column (6 questions, labeled (𝐼𝑍, 𝑋𝐼, 𝑋𝑍), etc.); there are 15 questions in total. An answer is
composed of three values in {±1}, one for each of the labels making up the question. Answers
from the prover should be entrywise consistent, and such that the product of the answers
associated to any row or column except the last should be +1; for the last column it should
be −1. The labels indicate the “honest” strategy for the game, which consists of each prover
measuring two half-EPR pairs using the commuting Pauli observables indicated by the labels of
his question.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 68
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
𝐼𝑍 𝑍𝐼 𝑍𝑍
𝑋𝐼 𝐼𝑋 𝑋𝑋
𝑋𝑍 𝑍𝑋 𝑌𝑌
Figure 27: Questions, and a strategy, for the Magic Square game
The following lemma states some properties of the Magic Square game, interpreted as a
self-test (see, e. g., [40]).
Lemma A.1. Suppose a strategy for the provers, using state |𝜓i and observables 𝑊, succeeds with
probability at least 1 − 𝜀 in the Magic Square game. Then there exist isometries 𝑉𝐷 : ℋD →
(ℂ2 ⊗ ℂ2 )D’ ⊗ ℋD̂ , for 𝐷 ∈ {𝐴, 𝐵} and a state |auxiÂB̂ ∈ ℋÂ ⊗ ℋB̂ such that
√
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRiA⊗20B0 |auxiÂB̂ = 𝑂( 𝜀),
2
and for 𝑊 ∈ {𝐼, 𝑋 , 𝑍}2 ∪ {𝑌𝑌},
√
𝑊 − 𝑉𝐴† 𝜎𝑊 𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀).
2
A.2 Elementary tests
Figure 28 summarizes some elementary tests. For each test, “Inputs” refers to a subset of
designated questions in the test; “Relation” indicates a relation that the test aims to certify (in
the sense of Section 3.1); “Test” describes the certification protocol. (Recall that all our protocols
implicitly include a “consistency” test in which a question is chosen uniformly at random from
the marginal distribution and sent to both provers, whose answers are accepted if and only if
they are equal.)
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 69
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Test id(𝐴, 𝐵):
• Inputs: 𝐴, 𝐵 two observables on the same space ℋ .
• Relation: 𝐴 = 𝐵.
• Test: Send 𝑊 ∈ {𝐴, 𝐵} and 𝑊 0 ∈ {𝐴, 𝐵}, chosen uniformly at random, to the first and
second prover, respectively. Receive an answer in {±1} from each prover. Accept if and
only if the answers are equal whenever the questions are identical.
Test ac(𝑋 , 𝑍):
• Inputs: 𝑋, 𝑍 two observables on the same space ℋ .
• Relation: 𝑋𝑍 = −𝑍𝑋.
• Test: Execute the Magic Square game, using the label “𝑋” for the “𝑋𝐼” query and “𝑍”
for the “𝑍𝐼” query. All other queries, such as 𝐼𝑍, or (𝐼𝑍, 𝑍𝐼, 𝑍𝑍), are sent together
with the pair (𝑋 , 𝑍). (So, for example, the query “𝑍𝐼” in the Magic Square becomes “𝑍”
here, whereas the query “𝐼𝑍” becomes “𝐼𝑍, (𝑋 , 𝑍)”, where the first 𝐼𝑍 are simply letters,
whereas in (𝑋 , 𝑍) the 𝑋 and 𝑍 should be replaced by the inputs to this test.)
Test com(𝐴, 𝐵):
• Inputs: 𝐴, 𝐵 two observables on the same space ℋ .
• Relation: 𝐴𝐵 = 𝐵𝐴.
• Test: Send 𝑊 ∈ {𝐴, 𝐵} chosen uniformly at random to the first prover. Send (𝐴, 𝐵) to the
second prover. Receive a bit 𝑐 ∈ {±1} from the first prover, and two bits (𝑎 0 , 𝑏 0) ∈ {±1}2
from the second. Accept if and only if 𝑐 = 𝑎 0 if 𝑊 = 𝐴, and 𝑐 = 𝑏 0 if 𝑊 = 𝐵.
Test prod(𝐴, 𝐵, 𝐶):
• Inputs: 𝐴, 𝐵 and 𝐶 three observables on the same space ℋ .
• Relations: 𝐴𝐵 = 𝐵𝐴 = 𝐶.
• Test: Similar to the commutation game, but use 𝐶 to label the question (𝐴, 𝐵).
Figure 28: Some elementary tests.
Lemma A.2. Each of the tests described in Figure 28 is a robust (1, 𝛿) self-test for the indicated relation(s),
for some 𝛿 = 𝑂(𝜀1/2 ).
Proof. The proof for each test is similar. As an example we give it for the commutation test
com(𝐴, 𝐵).
First we verify completeness. Let 𝐴, 𝐵 be two commuting observables on ℋA = ℋB = ℋ ,
and |EPRiAB the maximally entangled state in ℋA ⊗ ℋB . Upon receiving question 𝐴 or 𝐵, the
prover measures the corresponding observable. If the question is (𝐴, 𝐵), he jointly measures 𝐴
and 𝐵. This strategy succeeds with probability 1 in the test.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 70
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Next we establish soundness. Let |𝜓i ∈ ℋA ⊗ ℋB be a state shared by the provers, 𝐴, 𝐵 their
observables on questions 𝐴, 𝐵, and {𝐶 𝑎,𝑏 } the four-outcome PVM applied on question (𝐴, 𝐵).
Assume the strategy succeeds with probability at least 1 − 𝜀. Recall that this includes both the
test described in Figure 28, and the automatic consistency test. Let 𝐶 𝐴 = 𝑎,𝑏 (−1)𝑎 𝐶 𝑎,𝑏 and
Í
𝐶 𝐵 = 𝑎,𝑏 (−1)𝑏 𝐶 𝑎,𝑏 . Then 𝐶 𝐴 and 𝐶 𝐵 commute. Thus
Í
𝐴A 𝐵A ⊗ IdB ≈√𝜀 𝐴A ⊗ (𝐶 𝐵 )B
≈√𝜀 IdA ⊗(𝐶 𝐵 )B (𝐶 𝐴 )B
= IdA ⊗(𝐶 𝐴 )B (𝐶 𝐵 )B
≈√𝜀 𝐵A ⊗ (𝐶 𝐴 )B
≈√𝜀 𝐵A 𝐴A ⊗ IdB .
Here each approximation uses the consistency condition provided by the test, as explained
in (3.3). Thus [𝐴, 𝐵] = (𝐴𝐵 − 𝐵𝐴) ≈√𝜀 0, as desired.
We will often make use of the following simple lemma, which expresses an application of
the above tests. Recall the notations [𝐴, 𝐵] for 𝐴𝐵 − 𝐵𝐴 and {𝐴, 𝐵} for 𝐴𝐵 + 𝐵𝐴.
Lemma A.3. Let |𝜓i ∈ ℋA ⊗ ℋB and 𝐴, 𝑋 observables on ℋA such that there exists an isometry
ℋA ' ℂ2 ⊗ ℋÂ under which the following conditions hold, for some 𝛿1 , 𝛿2 , 𝛿3 :15
(i) There exists an observable 𝐴0 on ℋB such that 𝐴 ⊗ Id ≈𝛿1 Id ⊗𝐴0;
(ii) |𝜓i '𝛿1 |EPRi|auxi and 𝑋 '𝛿1 𝜎𝑋 ⊗ Id;
(iii) [𝐴, 𝑋] ≈𝛿2 0;
(iv) {𝐴, 𝑋} ≈𝛿3 0.
Then there exist Hermitian 𝐴𝐼 , 𝐴𝑋 , 𝐴𝑌 , 𝐴𝑍 on ℋÂ such that 𝐴 '𝛿1 +𝛿2 Id ⊗𝐴𝐼 + 𝜎𝑋 ⊗ 𝐴𝑋 and
𝐴 '𝛿1 +𝛿3 𝜎𝑌 ⊗ 𝐴𝑌 + 𝜎𝑍 ⊗ 𝐴𝑍 . (A similar claim holds with 𝑋 replaced by 𝑍.)
Proof. After application of the isometry, an arbitrary observable 𝐴˜ on ℂ2 ⊗ℋÂ has a decomposition
𝐴˜ = 𝑃∈{𝐼,𝑋 ,𝑌,𝑍} 𝜎𝑃 ⊗ 𝐴𝑃 , for Hermitian operators 𝐴𝑃 on ℋÂ . We can compute
Í
˜ 𝜎𝑋 ⊗ Id] = −2𝑖 𝜎𝑍 ⊗ 𝐴𝑌 + 2𝑖 𝜎𝑌 ⊗ 𝐴𝑍 ,
[𝐴, (A.1)
˜ 𝜎𝑋 ⊗ Id} = 2 𝜎𝑋 ⊗ 𝐴𝐼 + 2 𝜎𝐼 ⊗ 𝐴𝑋 .
{ 𝐴, (A.2)
˜ 𝜎𝑋 ⊗ Id], so by (iii) and (A.1) we get k𝐴𝑌 |auxik 2 +
Assumptions (i) and (ii) imply [𝐴, 𝑋] '𝛿1 [𝐴,
k𝐴𝑍 |auxik = 𝑂(𝛿1 +𝛿2 ). Similarly, (iv) and (A.2) give k𝐴𝐼 |auxik 2 +k𝐴𝑋 |auxik 2 = 𝑂(𝛿1 +𝛿3 ).
2
15Note that we allow either 𝛿 𝑖 to equal 1. The lemma is interesting when 𝛿1 and either 𝛿 2 or 𝛿3 is small (but it is
correct for all triples of values in [0, 1])
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 71
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
A.3 The Bell basis
Given two commuting pairs of anti-commuting observables {𝑋1 , 𝑍1 } and {𝑋2 , 𝑍2 } we provide a
test for a four-outcome projective measurement in the Bell basis specified by these observables,
i. e., the joint eigenbasis of 𝑋1 𝑋2 and 𝑍1 𝑍2 . The same test can be extended to test the “SW”
observable,
1
Id +𝑋1 𝑋2 + 𝑍1 𝑍2 − (𝑋1 𝑍1 )(𝑋2 𝑍2 ) ,
SW = (A.3)
2
which exchanges the qubits specified by each pair of observables. The Bell measurement test
described in Figure 29 tests for both.
Test Bell(𝑋1 , 𝑋2 , 𝑍1 , 𝑍2 ):
• Inputs: For 𝑖 ∈ {1, 2}, {𝑋𝑖 , 𝑍 𝑖 } observables, {Φ𝑎𝑏 } 𝑎,𝑏∈{0,1} a four-outcome projective
measurement, and SW an observable, all acting on the same space ℋ .
• Relations: for all 𝑎, 𝑏 ∈ {0, 1}, Φ𝑎𝑏 = 41 Id +(−1)𝑎 𝑍1 𝑍2 Id +(−1)𝑏 𝑋1 𝑋2 , and SW =
Φ00 + Φ01 + Φ10 − Φ11 .
• Test: execute each of the following with equal probability:
(a) Execute the Magic Square game, labeling each entry of the square from Figure 27
(except entry (3, 3), labeled as 𝑌1𝑌2 ) using the observables 𝑋1 , 𝑍1 and 𝑋2 , 𝑍2 .
(b) Send Φ to one prover and the labels (𝑋1 𝑋2 , 𝑍1 𝑍2 , 𝑌1𝑌2 ) associated with the third
column of the Magic Square to the other. The first prover replies with 𝑎, 𝑏 ∈ {0, 1},
and the second with 𝑐, 𝑑, 𝑒 ∈ {±1}. The referee checks the provers’ answers for the
obvious consistency conditions. For example, if the first prover reports the outcome
(0, 0), then the referee rejects if (𝑐, 𝑑) ≠ (+1, +1).
(c) Send Φ to one prover and SW to the other. The first prover replies with 𝑎, 𝑏 ∈ {0, 1},
and the second with 𝑐 ∈ {±1}. Accept if and only 𝑐 = (−1)𝑎𝑏 .
Figure 29: The Bell measurement test.
Lemma A.4. The test Bell(𝑋1 , 𝑋2 , 𝑍1 , 𝑍2 ) is a robust (1, 𝛿) self-test for the Hermitian operators 𝑋1 ,
𝑋2 , 𝑍1 , 𝑍2 , {Φ𝑎𝑏 } 𝑎,𝑏∈{0,1} and SW and the relations
n o
ℛ= Φ𝑎𝑏 𝑎,𝑏∈{0,1} ∈ Proj, SW ∈ Obs
n 1 o
∪ Φ𝑎𝑏 = 1 + (−1)𝑎 𝑍1 𝑍2 1 + (−1)𝑏 𝑋1 𝑋2
4
∪ SW = Φ00 + Φ01 + Φ10 − Φ11 ,
√
for some 𝛿(𝜀) = 𝑂( 𝜀).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 72
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Proof. Completeness is clear: the provers can play the honest strategy for the Magic Square
game, use a measurement in the Bell basis on their two qubits for Φ, and measure the observable
in (A.3) for SW.
For soundness, let |𝜓i ∈ ℋA ⊗ ℋB , {𝑊1𝑊20 : 𝑊 , 𝑊 0 ∈ {𝐼, 𝑋 , 𝑍}}, {Φ𝑎𝑏 } and SW denote a
state and operators for a strategy that succeeds with probability at least 1 − 𝜀 in the test. From
the analysis of the Magic Square game (Lemma A.1) it follows that the provers’ observables
𝑋1 𝑋2 and 𝑍1 𝑍2 associated to questions with those labels approximately commute, and are each
the product of two commuting observables 𝑋1 𝐼, 𝐼𝑋2 and 𝑍1 𝐼, 𝐼𝑍2 , respectively, such that √ 𝑋1 𝐼
and 𝑍1 𝐼, and 𝐼𝑋2 and 𝐼𝑍2 , anti-commute; all approximate identities hold up to error 𝑂( 𝜀).
Since 𝑋1 𝑋2 and 𝑍1 𝑍2 appear together in the same question (the last column of the Magic
Square, Figure 27), each prover has a four-outcome projective measurement {𝑊 𝑐,𝑑 } 𝑐,𝑑∈{0,1}
such that 𝑑 (−1)𝑐 𝑊 𝑐,𝑑 = 𝑋1 𝑋2 and 𝑐 (−1)𝑑 𝑊 𝑐,𝑑 = 𝑍1 𝑍2 , from which it follows that 𝑊 𝑐,𝑑 =
Í Í
(1/4)(1 + (−1)𝑐 𝑍1 𝑍2 )(1 + (−1)𝑑 𝑋1 𝑋2 ).
The prover’s success probability in part (b) of the test is then
Õ Õ 1
h𝜓|Φ𝑎𝑏 ⊗ 𝑊 𝑎,𝑏 |𝜓i = h𝜓|Φ𝑎𝑏 ⊗ 1 + (−1)𝑎 𝑍1 𝑍2 1 + (−1)𝑏 𝑋1 𝑋2 |𝜓i.
4
𝑎,𝑏 𝑎,𝑏
Using that, by assumption, {Φ𝑎𝑏 } is a projective measurement, the condition that this expression
be at least 1 − 𝑂(𝜀) implies
1
1 + (−1)𝑎 𝑍1 𝑍2 1 + (−1)𝑏 𝑋1 𝑋2 .
Φ𝑎𝑏 ⊗ Id ≈√𝜀 Id ⊗
4
Combining this with the implicit consistency test yields the first relation. The last is guaranteed
by part (c) of the test, which checks for the correct relationship between SW and Φ; the analysis
is similar.
A.4 Multi-qubit tests
In this section we formulate a robust self-test for the 𝑚-qubit Pauli group. The result is an
extension of the results from [35] to allow testing of 𝜎𝑌 observables.
A.4.1 The 𝑚-qubit Weyl–Heisenberg group
We start by giving a self-test for tensor products of 𝜎𝑋 and 𝜎𝑍 observables acting on 𝑚 qubits,
i. e., the 𝑚-qubit Weyl–Heisenberg group ℋ (𝑚) (see Section 2.1). Let 𝒫 (𝑚) denote the relations
n 𝑚
Ö o
(𝑚) 𝑚
𝒫 {𝑋 , 𝑍} = 𝑊(𝑎) ∈ Obs : 𝑊 ∈ {𝑋𝑖 , 𝑍 𝑖 }, 𝑎 ∈ {0, 1}
𝑖=1
n 𝑚
Ö o
|{𝑖: 𝑊𝑖 ≠𝑊𝑖0 ∧𝑎 𝑖 𝑎 0𝑖 =1}|
0
∪ 𝑊(𝑎)𝑊 (𝑎 ) = (−1) 0 0 0
𝑊 (𝑎 )𝑊(𝑎) : 𝑊 , 𝑊 ∈ 0
{𝑋𝑖 , 𝑍 𝑖 }, 𝑎, 𝑎 0 ∈ {0, 1} 𝑚
𝑖=1
n 𝑚
Ö o
∪ 𝑊(𝑎)𝑊(𝑎 0) = 𝑊(𝑎 + 𝑎 0) : 𝑊 ∈ {𝑋𝑖 , 𝑍 𝑖 }, 𝑎, 𝑎 0 ∈ {0, 1} 𝑚 .
𝑖=1
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 73
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Recall the notation 𝑊(𝑎) for the string that is 𝑊𝑖 when 𝑎 𝑖 = 1 and 𝐼 otherwise. The set of relations
on the second line expresses the canonical anti-commutation relations. The last set of relations
expresses the obvious relations 𝜎𝑊 Id = Id 𝜎𝑊 and 𝜎𝑊 2
= Id, for 𝑊 ∈ {𝑋 , 𝑍}, coordinate-wise.
It is easy to verify that 𝒫 forms a defining set of relations for ℋ (𝑚) . Our choice of relations
(𝑚)
is suggested by the Pauli Braiding Test introduced in [35], which shows that the relations are
testable with a robustness parameter 𝛿(𝜀) that is independent of 𝑚. The test is denoted pbt(𝑋 , 𝑍).
For convenience here we use a slight variant of the test which includes more questions and more
answers; the test is summarized in Figure 30.
Test pbt(𝑋 , 𝑍):
Î𝑚 𝑚.
• Inputs: (𝑊 , 𝑎), for 𝑊 ∈ 𝑖=1 {𝑋 𝑖 , 𝑍 𝑖 } and 𝑎 ∈ {0, 1}
• Relations: 𝒫 (𝑚){𝑋 , 𝑍}.
• Test: Perform the following with probability 1/3 each. In each test, the question to a prover
takes the form 𝑊 or (𝑊 , 𝑎) for 𝑊 , 𝑎 as above. The answer from the prover is an 𝑚-bit
string 𝑐 ∈ {0, 1} 𝑚 or a single bit 𝑑 ∈ {0, 1}, respectively.
(a) Select 𝑊 , 𝑊 0 ∈ 𝑖 {𝑋𝑖 , 𝑍 𝑖 }, and 𝑎, 𝑎 0 ∈ {0, 1} 𝑚 , uniformly at random. If {𝑖 : 𝑊𝑖 ≠ 𝑊𝑖0 ∧
Î
𝑎 𝑖 = 𝑎 0𝑖 = 1} has even cardinality then execute test com((𝑊 , 𝑎), (𝑊 0 , 𝑎 0)). Otherwise,
execute test ac((𝑊 , 𝑎), (𝑊 0 , 𝑎 0)).
Î𝑚
(b) Select (𝑎, 𝑎 0) ∈ {0, 1} 𝑚 and 𝑊 ∈ 𝑖=1 {𝑋𝑖 , 𝑍 𝑖 } uniformly at random. Execute test
prod((𝑊 , 𝑎), (𝑊 , 𝑎 0), (𝑊 , 𝑎 + 𝑎 0)).
(c) Select 𝑊 ∈ 𝑚 𝑚
𝑖=1 {𝑋𝑖 , 𝑍 𝑖 } and 𝑎 ∈ {0, 1} uniformly at random. Send 𝑊 to one prover,
Î
receiving a string 𝑐 as answer, and (𝑊 , 𝑎) to the other, receiving a bit 𝑑. Accept if and
only if 𝑑 = 𝑐 · 𝑎, the inner product modulo 2.
Figure 30: The Pauli braiding test, pbt(𝑋 , 𝑍).
Lemma A.5 ([35]). The test pbt(𝑋 , 𝑍) is a robust (1, 𝛿) self-test for 𝒫 (𝑚){𝑋 , 𝑍}, for some 𝛿(𝜀) = 𝑂(𝜀1/2 ).
Moreover, suppose |𝜓i ∈ ℋA ⊗ ℋB and 𝑊(𝑎) ∈ Obs(ℋA ), for 𝑊 ∈ {𝑋 , 𝑍} 𝑚 and 𝑎 ∈ {0, 1} 𝑚 ,
and projective measurements {𝑊𝑐 } 𝑐∈{0,1}𝑛 on ℋA , for each 𝑊 ∈ {𝑋 , 𝑍} 𝑚 , specify a strategy for
the provers that has success probability at least 1 − 𝜀 in pbt(𝑋 , 𝑍). Then there exist isometries
𝑉𝐷 : ℋD → ((ℂ2 )⊗𝑚 )D’ ⊗ ℋ̂D̂ , for 𝐷 ∈ {𝐴, 𝐵}, such that
√
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRiA⊗𝑛 = 𝑂( 𝜀),
2
0 0 |auxiÂB̂
B
and on expectation over 𝑊 ∈ {𝑋 , 𝑍} 𝑚 ,
√
𝑊(𝑎) − 𝑉𝐴† (𝜎𝑊 (𝑎) ⊗ Id)𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀),
2
E (A.4)
𝑎∈{0,1} 𝑚
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 74
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
and
Õ
𝑐
√
𝑊𝑐 − 𝑉𝐴† (𝜎𝑊 = 𝑂( 𝜀) .
2
⊗ Id)𝑉𝐴 ⊗ Id𝐵 |𝜓i (A.5)
𝑐∈{0,1} 𝑚
The fact that the test specified in Figure 30 self-tests the relations 𝒫 (𝑚){𝑋 , 𝑍} follows
immediately from the definition of 𝒫 (𝑚){𝑋 , 𝑍} and the analysis of the tests com, prod and
ac given in Section A.2. The remainder of the lemma follows directly from Theorem 13 and
Theorem 14 in [35]. The only part not present in [35] is the last part, which considers the
POVM obtained from requiring a prover to report the outcome for each of its 𝑚 single-qubit
measurement (as opposed to its inner product with the string 𝑎). Eq. (A.5) follows from part (c)
of pbt(𝑋 , 𝑍) and the preceding parts of the lemma.
The next lemma is an extension of Lemma A.3 to the case of multi-qubit Pauli observables;
the lemma avoids any dependence of the error on the number of qubits, as would result from a
sequential application of Lemma A.3.
Lemma A.6. Let 𝑚 be an integer and 𝑐 ∈ {0, 1} 𝑚 . Let |𝜓i ∈ ℋA ⊗ ℋB be a state and 𝐴 and 𝑋(𝑎), for
𝑎 ∈ {0, 1} 𝑚 , observables on ℋA such that there exists an isometry ℋA ' (ℂ2 )⊗𝑚 ⊗ ℋÂ under which the
following conditions hold, for some 𝛿1 , 𝛿2 , 𝛿3 :
(i) There exists an observable 𝐴0 on ℋB such that 𝐴 ⊗ Id '𝛿1 Id ⊗𝐴0;
(ii) |𝜓i '𝛿1 |EPRi ⊗𝑚 |auxi, and 𝑋(𝑎) '𝛿1 𝜎𝑋 (𝑎) ⊗ Id;
(iii) [𝐴, 𝑋(𝑎)] '𝛿2 0;
(iv) Conditioned on 𝑎 · 𝑐 = 1, {𝐴, 𝑋(𝑎)} '𝛿3 0;
where conditions (ii) and (iii) are meant on average over a uniformly random 𝑎 ∈ {0, 1} 𝑚 , and the last
over a uniformly random 𝑎 such that 𝑎 · 𝑐 = 1. For any 𝑃 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 let 𝑥 𝑃 ∈ {0, 1} 𝑚 be such that
(𝑥 𝑃 )𝑖 = 1 if and only if 𝑃𝑖 ∈ {𝑌, 𝑍}. Then there exists Hermitian 𝐴𝑃 , for 𝑃 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 , on ℋÂ
such that
Õ Õ
𝐴 '𝛿1 +𝛿2 𝜎𝑃 ⊗ 𝐴 𝑃 , and 𝐴 '𝛿1 +𝛿3 𝜎𝑃 ⊗ 𝐴 𝑃 . (A.6)
𝑃∈{𝐼,𝑋} 𝑛 𝑃∈{𝐼,𝑋 ,𝑌,𝑍} 𝑚 :
𝑐 𝑖 =1 =⇒ 𝑃𝑖 ∈{𝑌,𝑍}
𝑐 𝑖 =0 =⇒ 𝑃𝑖 ∈{𝐼,𝑋}
(A similar claim holds with the roles of 𝑋 and 𝑍 exchanged.)
Proof. After application of the isometry, an arbitrary observable 𝐴˜ on (ℂ2 )⊗𝑚 ⊗ ℋÂ has a
decomposition 𝐴˜ = 𝑃∈{𝐼,𝑋 ,𝑌,𝑍}𝑚 𝜎𝑃 ⊗ 𝐴𝑃 , for Hermitian operators 𝐴𝑃 on ℋÂ . Then the
Í
analogue of (A.1) is
Õ
˜ 𝜎𝑋 (𝑎) ⊗ Id] = 2
[𝐴, 𝜎𝑃 𝜎𝑋 (𝑎) ⊗ 𝐴𝑃 .
𝑃: 𝑎·𝑥 𝑃 =1
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 75
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
Using that any string 𝑥 𝑃 which is not the 0𝑚 string satisfies 𝑎 · 𝑥 𝑃 = 1 with probability almost
1/2 for a uniform choice of 𝑎, orthogonality of the 𝜎𝑃 𝜎𝑋 (𝑎) for distinct 𝑃 lets us conclude the
proof of the first relation as in Lemma A.3. Similarly, the analogue of (A.2) gives
Õ
˜ 𝜎𝑋 (𝑎) ⊗ Id} = 2
{ 𝐴, 𝜎𝑃 𝜎𝑋 (𝑎) ⊗ 𝐴𝑃 .
𝑃: 𝑎·𝑥 𝑃 =0
Using that any string 𝑥 𝑃 which is not 𝑐 satisfies 𝑎 · 𝑥 𝑃 = 0 with probability almost 1/2 for a
uniform choice of 𝑎 such that 𝑎 · 𝑐 = 1, orthogonality of the 𝜎𝑃 𝜎𝑋 (𝑎) for distinct 𝑃 lets us conclude
the proof of the second relation.
A.4.2 The parallel Bell test
Before we move on to a test for the full Pauli group, including not only 𝑋 , 𝑍 but also 𝑌
observables, we use the Pauli braiding test introduced in the previous section to develop a
multi-qubit version of the Bell test from Section A.3.
Let 𝑘 ≥ 1 and 𝑚 = 2𝑘. Let 𝜏 be a bijection of {1, . . . , 𝑚}, which we interpret as a pairing
of the qubits: for 𝑖 ∈ {1, . . . , 𝑚}, qubit 𝜏(2𝑖 − 1) is paired with qubit 𝜏(2𝑖). The test ParBell(𝜏)
described in Figure 31 certifies that an 𝑚-qubit measurement performed by a prover is consistent
with a measurement of each pair of qubits (as specified by 𝜏) in the Bell basis.
The test has three components. In part (a) we execute the test pbt(𝑋 , 𝑍) in order to enforce an
𝑚-qubit structure and the existence of tensor product observables 𝑋 and 𝑍 on them, from which
the Bell basis is defined as in Section A.3. In part (b) we introduce questions 𝑊 such that each
pair of indices paired by 𝜏 contains the same label, 𝑋𝑋 or 𝑍𝑍. Since such question labels have
exponentially small probability under the uniform distribution, part (b) checks for consistency
against a uniformly random question, for all those locations where the bases happen to match.
In part (c) we ask one prover to measure in the Bell basis and check their results against those
reported by the other prover when asked to perform a measurement of the same type as in
part (b). Since the Bell basis is characterized as the joint eigenstates of 𝑋𝑋 and 𝑍𝑍 operators,
checking consistency of these outcomes is enough the characterize the measurement.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 76
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Test ParBell(𝜏). 𝜏 is a permutation on {1, . . . , 𝑚} where 𝑚 = 2𝑘.
Execute each of the following with equal probability:
(a) Execute pbt(𝑋 , 𝑍).
(b) Select 𝑊 ∈ {𝑋 , 𝑍} 𝑚 uniformly at random conditioned on 𝑊𝜏(2𝑖−1) = 𝑊𝜏(2𝑖) for each
𝑖 ∈ {1, . . . , 𝑚}. Let 𝑊 0 ∈ {𝑋 , 𝑍} 𝑚 be such that 𝑊𝜏(2𝑖−1)
0
= 𝑊𝜏(2𝑖−1) and 𝑊𝜏(2𝑖)
0
is uniformly
random in {𝑋 , 𝑍} for each 𝑖. Similarly, let 𝑊 be such that 𝑊𝜏(2𝑖) = 𝑊𝜏(2𝑖) and 𝑊𝜏(2𝑖−1)
00 00 00
is
uniformly random. Send 𝑊 to one prover and either 𝑊 or 𝑊 (with probability half each)
0 00
to the other. Receive 𝑎 ∈ {0, 1} 𝑚 from the first prover and 𝑏 ∈ {0, 1} 𝑚 from the second.
Accept if and only if for each 𝑖 ∈ {1, . . . , 𝑘}, 𝑎 𝜏(2𝑖−1) = 𝑏 𝜏(2𝑖−1) in case 𝑊 0 was sent, and
𝑎 𝜏(2𝑖) = 𝑏 𝜏(2𝑖) in case 𝑊 00 was sent.
(c) Select 𝑊 ∈ {𝑋 , 𝑍} 𝑚 uniformly at random conditioned on 𝑊𝜏(2𝑖−1) = 𝑊𝜏(2𝑖) for each
𝑖 ∈ {1, . . . , 𝑚}. Send 𝑊 to a prover and (Φ, 𝜏) to the other, where Φ is a label that
means “measure in the Bell basis” with the qubits being paired according to 𝜏. Receive
𝑎 ∈ {0, 1} 𝑚 from the first prover and 𝑏 ∈ {00, 01, 10, 11} 𝑘 from the second. Accept if
and only if, whenever 𝑊𝜏(2𝑖−1)𝑊𝜏(2𝑖) = 𝑋𝑋 then 𝑎 𝜏(2𝑖−1) ⊕ 𝑎 𝜏(2𝑖) = 𝑏 𝜏(2𝑖−1) and whenever
𝑊𝜏(2𝑖−1)𝑊𝜏(2𝑖) = 𝑍𝑍 then 𝑎 𝜏(2𝑖−1) ⊕ 𝑎 𝜏(2𝑖) = 𝑏 𝜏(2𝑖) .
Figure 31: The parallel bell test, ParBell(𝜏).
Lemma A.7. Let 𝑘 ≥ 1 and 𝜏 a permutation on {1, . . . , 𝑘}. Suppose given a strategy for the provers
that succeeds with probability at least 1 − 𝜀 in test ParBell(𝜏). Let 𝑉𝐴 and 𝑉𝐵 be the isometries obtained
from Lemma A.5. Then
Õ
𝑏𝑖 √
Φ𝑏 − 𝑉𝐴† (⊗𝑖 𝜎Φ,𝑖 = 𝑂( 𝜀),
2
)𝑉𝐴 ⊗ IdB |𝜓i
𝑏∈{00,01,10,11} 𝑘
𝑏𝑖
where {Φ𝑏 } 𝑏 is the POVM applied by a prover upon question (Φ, 𝜏) and 𝜎Φ,𝑖 denotes the projection on
the joint eigenvector of 𝜎𝑋 ,𝜏(2𝑖−1) 𝜎𝑋 ,𝜏(2𝑖) and 𝜎𝑍,𝜏(2𝑖−1) 𝜎𝑍,𝜏(2𝑖) with associated eigenvalues 𝑏 𝑖 .
Proof sketch. For ease of notation we give the proof when 𝜏 is the identity, the general case being
similar. Isometries 𝑉𝐴 and 𝑉𝐵 satisfying the conclusions of Lemma A.5 are obtained from part
(a) of the test. Using the conclusion of Lemma A.5 it follows that on average over 𝑊 ∈ {𝑋 , 𝑍} 𝑚 ,
Õ
𝑐
√
𝑊𝑐 − 𝑉𝐴† (𝜎𝑊 = 𝑂( 𝜀) .
2
⊗ Id)𝑉𝐴 ⊗ Id𝐵 |𝜓i (A.7)
𝑐∈{0,1} 𝑚
Part (b) of the test allows us to claim the same consequence, on average over 𝑊 ∈ {𝑋𝑋 , 𝑍𝑍} 𝑘 .
(1)
This can be seen as follows. For 𝑊 ∈ {𝑋 , 𝑍} 𝑚 and 𝑐 ∈ {0, 1} 𝑘 let 𝑊𝑐 be the sum of all 𝑊𝑐0
(2)
over 𝑐 0 ∈ {0, 1} 𝑚 such that 𝑐2𝑖−1
0
= 𝑐 𝑖 for each 𝑖 ∈ {1, . . . , 𝑘}, and define 𝑊𝑐 analogously, using
the condition 𝑐 2𝑖 0
= 𝑐 𝑖 . Using that both 𝑊 0 and 𝑊 00 in part (b) are uniformly distributed,
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 77
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
applying (A.7) and marginalizing over half the outcomes we get that on average over the choice
of 𝑊 0 ∈ {𝑋 , 𝑍} 𝑚 ,
Õ 0 (1) (1),𝑐 √
𝑊𝑐 − 𝑉𝐴† (𝜎𝑊 ⊗ Id)𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀) .
2
(A.8)
𝑐∈{0,1} 𝑘
00 (2)
A similar relation holds for 𝑊𝑐 . Recall that measurement operators used by the provers are
(1) (2)
always assumed projective. Thus for 𝑊 , 𝑊 0 , 𝑊 00 chosen as in part (b) it holds that 𝑊𝑐 = 𝑊𝑐0 𝑊𝑐00
where 𝑐 0 and 𝑐 00 are the odd and even substrings of 𝑐, respectively. Using this relation and (A.8)
0 00
for both 𝑊 (1) and for 𝑊 (2) we deduce that success in part (b) implies that on average over
𝑊 ∈ {𝑋𝑋 , 𝑍𝑍} 𝑘 ,
Õ
𝑐
√
𝑊𝑐 − 𝑉𝐴† (𝜎𝑊 ⊗ Id)𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀) .
2
(A.9)
𝑐∈{0,1} 𝑚
To conclude the proof of the lemma we note that in the honest case
𝑘
Ì Õ Õ
𝑏
𝜎𝑋𝑐 ,2𝑖−1 ⊗ 𝜎𝑋𝑐 ,2𝑖 · 𝑑 𝑑
0 0
𝜎Φ = 𝜎𝑍,2𝑖−1 ⊗ 𝜎𝑍,2𝑖 . (A.10)
𝑖=1 𝑐⊕𝑐 0 =𝑏2𝑖−1 𝑑⊕𝑑0 =𝑏2𝑖
This is precisely the relation checked in part (c). Thus the conclusion of the lemma follows
from (A.9), (A.10) and success in part (c).
A.4.3 The 𝑚-qubit Pauli group
We will use an extended version of the Pauli braiding test introduced in Section A.4.1 which
√ a third observable, 𝑌𝑖 , on each system. Ideally we would like to enforce the relation
self-tests
𝑌𝑖 = −1𝑋𝑖 𝑍 𝑖 . Unfortunately, the complex phase cannot be tested from classical correlations
alone: complex conjugation leaves correlations invariant, but does not correspond to a unitary
change of basis (see [38, Appendix A] for a discussion
√ of this issue). √
We represent the “choice” of complex phase, −1 or its conjugate − −1, by an observable
Δ that the prover measures on a system that is in a tensor product with all other systems on
which the prover acts. Informally, the outcome obtained when measuring Δ tells the prover to
use 𝑌 = 𝑖𝑋𝑍 or 𝑌 = −𝑖𝑋𝑍. While strategies determining the complex phase in such a way can
certainly not be prevented, the goal of the test is to ensure that the provers have exactly that
much freedom, and no more.
We first introduce 𝑌 and test that the triple {𝑋 , 𝑌, 𝑍} pairwise anticommute in each
coordinate. This corresponds to the following set of relations:
n o
𝒫 (𝑚){𝑋 , 𝑌, 𝑍} = 𝑊(𝑎) ∈ Obs : 𝑊 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 , 𝑎 ∈ {0, 1} 𝑚
n o
∪ 𝑊(𝑎)𝑊 0(𝑎 0) = (−1)|{𝑖: 𝑊𝑖 ≠𝑊𝑖 ∧𝑎 𝑖 𝑎 𝑖 =1}| 𝑊 0(𝑎 0)𝑊(𝑎) : 𝑊 , 𝑊 0 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 , 𝑎, 𝑎 0 ∈ {0, 1} 𝑚
0 0
n o
∪ 𝑊(𝑎)𝑊(𝑎 0) = 𝑊(𝑎 + 𝑎 0) : 𝑊 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 , 𝑎, 𝑎 0 ∈ {0, 1} 𝑚 .
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 78
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
Test pbt(𝑋 , 𝑌, 𝑍):
Î𝑚
• Inputs: 𝑊 ∈ 𝑖=1 {𝐼 𝑖 , 𝑋𝑖 , 𝑌𝑖 , 𝑍 𝑖 }
• Relations: 𝒫 (𝑚){𝑋 , 𝑌, 𝑍}.
• Test: Perform the following with equal probability:
(a) Execute test pbt(𝑋 , 𝑍).
(b) Let 𝑊 ∈ {𝑋 , 𝑍} 𝑚 be chosen uniformly at random. Let 𝑊 0 = 𝑌 𝑚 .
(i) Let 𝑐, 𝑐 0 ∈ {0, 1} 𝑚 be chosen uniformly at random. If 𝑐 · 𝑐 0 = 0 then execute
com((𝑊 , 𝑐), (𝑊 0 , 𝑐 0)). If 𝑐 · 𝑐 0 = 1 then execute ac((𝑊 , 𝑐), (𝑊 0 , 𝑐 0)).
(ii) Select (𝑎, 𝑎 0) ∈ {0, 1} 𝑚 . Execute test prod((𝑊 0 , 𝑎), (𝑊 0 , 𝑎 0), (𝑊 0 , 𝑎 + 𝑎 0)).
(iii) Select 𝑊 00 ∈ {𝐼, 𝑌} 𝑚 uniformly at random. Let 𝑐 be the indicator of the positions
in 𝑊 00 such that 𝑊𝑖00 = 1. Send one prover the string 𝑊 00 and the other the pair
(𝑊 0 , 𝑐). Let 𝑑 be the string reported by the first prover and 𝑒 the bit reported by
the second. Accept if and only if 𝑒 = 𝑐 · 𝑑.
(c) Select 𝑊 ∈ {𝑋 , 𝑍} 𝑚 and 𝑐 ∈ {0, 1} 𝑚 uniformly at random. Let 𝑊 0 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} be
such that 𝑊𝑖0 = 𝑊𝑖 whenever 𝑐 𝑖 = 1, and 𝑊𝑖0 is uniform in {𝐼, 𝑌} otherwise. Let 𝑊 00
be equal to 𝑊 0 with the positions in which 𝑊 0 equals 𝑋 or 𝑍 replaced by a uniformly
random entry in {𝐼, 𝑌}. Send one of 𝑊 , 𝑊 0 , 𝑊 00 at random to a prover, and another
one to the other. Accept if and only if the prover’s answers associated with identical
coordinates are identical.
(d) Select a random permutation 𝜎 ∈ 𝔖𝑚/2 , and 𝑊 ∈ {𝐼, 𝑌} 𝑚 uniformly at random. Write
𝑊 = 𝑊1𝑊2 , where 𝑊1 , 𝑊2 ∈ {𝐼, 𝑌} 𝑚/2 . Let 𝑊1𝜎 be the string 𝑊1 with its entries
permuted according to 𝜎. Do the following with equal probability:
(i) Send one prover 𝑊1𝑊1𝜎 and the other either 𝑊1𝑊2 or 𝑊2𝑊1𝜎 (chosen with
probability 1/2), and check consistency of the first or second half of the provers’
answer bits, respectively.
(ii) Execute the test ParBell(𝜏), where for 𝑖 ∈ {1, . . . , 𝑚/2}, 𝜏(2𝑖 − 1) = 𝑖 and
𝜏(2𝑖) = 𝜎(𝑖).
(iii) Send one prover 𝑊1𝑊1𝜎 , and the other (Φ, 𝜏). The first prover replies with
𝑎 ∈ {0, 1} 𝑚 and the second with 𝑏 ∈ {00, 01, 10, 11} 𝑚/2 . For each 𝑖 ∈ {1, . . . , 𝑚/2}
such that 𝑏 𝑖 = 00, check that 𝑎 𝑖 = 𝑎 𝑚/2+𝜎(𝑖) .
(iv) Let 𝑊 0 ∈ {𝑋 , 𝑍} 𝑚 be chosen uniformly at random. Send one prover 𝑊 0 and
the other (Φ, 𝜏). The first prover replies with 𝑎 ∈ {0, 1} 𝑚 and the second with
𝑏 ∈ {00, 01, 10, 11} 𝑚/2 . For each pair (𝑖, 𝑚/2 + 𝜎(𝑖)) such that 𝑊𝑖0 = 𝑊𝑚/2+𝜎(𝑖)
0
and
𝑏 𝑖 = 00 check that 𝑎 𝑖 = 𝑎 𝑚/2+𝜎(𝑖) .
Figure 32: The extended Pauli braiding test, pbt(𝑋 , 𝑌, 𝑍).
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 79
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
The test is described in Figure 32. It has four components. Part (a) of the test executes test
pbt(𝑋 , 𝑍), which gives us multi-qubit Pauli 𝑋 and 𝑍 observables. Part (b) of the test introduces
𝑌 𝑚 (𝑐) observables, and uses commutation and anti-commutation relations with 𝑋 and 𝑍 to
force 𝑌 𝑚 to respect the qubit structure obtained from part (a); the analysis of this part is based
on Lemma A.6. Part (c) of the test, while not strictly necessary for our applications, justifies
the test’s name, by introducing an observable associated with any tensor product of Paulis and
testing it for consistency against the observables tested in parts (a) and (b).
Part (d) of the test is meant to control the “phase” ambiguity in the definition of 𝑌(𝑐) that
remains after the analysis of part (b). Indeed, from that part it will follow that 𝑌(𝑐) ' 𝜎𝑌 (𝑐) ⊗ Δ(𝑐),
where Δ(𝑐) is an arbitrary observable acting on the ancilla system produced by the isometry
|𝑐|
obtained in part (a). We would like to impose Δ(𝑐) ' Δ𝑌 for a fixed observable Δ𝑌 which
represents the irreducible phase degree of freedom in the definition of 𝑌, as discussed above. To
obtain this, part (c) of the test performs a form of SWAP test between different 𝑌(𝑐) observables,
enforcing, e. g., that 𝑌(1, 0, 1) is consistent with 𝑌(1, 0, 0) after an appropriate Bell measurement
has “connected” registers 1 and 2. The Bell basis measurements are tested using ParBell(𝜏)
from the previous section.
Claim A.8. Let 𝐴 ∈ Obs(ℂ2A1 ⊗· · ·⊗ ℂ2A ⊗ℋ ) and 𝐵 ∈ Obs(ℂ2B1 ⊗· · ·⊗ ℂ2B ⊗ℋ ) be 𝑘-qubit observables
𝑘 𝑘
Î𝑘
acting on distinct registers A 𝑗 , B 𝑗 , as well as a common space ℋ , and ΦA’B’ = 𝑗=1 |EPRihEPR| A’ 𝑗 ,B’ 𝑗 the
projector on 𝑘 EPR pairs across registers A’ 𝑗 and B’ 𝑗 . Then
Ì
𝐴Aℋ ⊗ IdB
hEPR| A 𝑗 A’ 𝑗 hEPR| B 𝑗 B’ 𝑗 ⊗ Idℋ IdA ⊗𝐵Bℋ ⊗ ΦA’B’
𝑗
Ì 1 Õ 0 0
· |EPRiA 𝑗 A’ 𝑗 |EPRiB 𝑗 B’ 𝑗 ⊗ Idℋ = Tr 𝐴 𝑖 𝐵 𝑖 𝐴 𝑖 𝐵 𝑖 , (A.11)
𝑗
22𝑘 𝑖
where we write 𝐴 = 𝑖 𝐴 𝑖 ⊗ 𝐴 𝑖 and 𝐵 =
0
𝑖 𝐵 𝑖 ⊗ 𝐵 𝑖 , for 𝐴 𝑖 on ℋA , 𝐵 𝑖 on ℋB , and 𝐴 𝑖 , 𝐵 𝑖 on ℋ .
0 0 0
Í Í
Proof. We do the proof for 𝑘 = 1, as the general case is similar. Using that for any operators 𝑋AB
and 𝑌A’B’ ,
1
hEPR| AA’ hEPR| BB’ 𝑋AB ⊗ 𝑌A’B’ |EPRiAA’ |EPRiBB’ = Tr(𝑋𝑌 𝑇 ),
4
the left-hand side of (A.11) evaluates to
4−1 TrAB 𝐴Aℋ ⊗ IdB IdA ⊗𝐵Bℋ Φ𝑇A’B’ ⊗ Idℋ ,
which using the same identity again gives the right-hand side of (A.11).
Lemma A.9. Suppose |𝜓i ∈ ℋA ⊗ ℋB and 𝑊(𝑎) ∈ Obs(ℋA ), for 𝑊 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 and 𝑎 ∈ {0, 1} 𝑚 ,
specify a strategy for the provers that has success probability at least 1 − 𝜀 in the extended Pauli braiding
test pbt(𝑋 , 𝑌, 𝑍) described in Figure 32. Then there exist isometries 𝑉𝐷 : ℋD → ((ℂ2 )⊗𝑚 )D’ ⊗ ℋ̂D̂ , for
𝐷 ∈ {𝐴, 𝐵}, such that
√
(𝑉𝐴 ⊗ 𝑉𝐵 )|𝜓iAB − |EPRiA⊗𝑚 = 𝑂( 𝜀),
2
0 0 |auxiÂB̂
B
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 80
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
and on expectation over 𝑊 ∈ {𝐼, 𝑋 , 𝑌, 𝑍} 𝑚 ,
√
𝑊(𝑎) − 𝑉𝐴† (𝜎𝑊 (𝑎) ⊗ Δ𝑊 (𝑎))𝑉𝐴 ⊗ Id𝐵 |𝜓i = 𝑂( 𝜀),
2
E (A.12)
𝑎∈{0,1} 𝑚
Î 𝑎𝑖
where Δ𝑊 (𝑎) = 𝑖 Δ𝑊𝑖 ∈ Obs(ℋÂ ) are observables with Δ𝑋 = Δ𝑍 = Id and Δ𝑌 an arbitrary observable
on ℋ̂ such that
√
= 𝑂( 𝜀).
2
Δ𝑌 ⊗ Δ𝑌 |auxi − |auxi
Proof sketch. The existence of the isometries 𝑉𝐴 and 𝑉𝐵 follows Lemma A.5 and part (a) of
pbt(𝑋 , 𝑌, 𝑍). Under this isometry we have 𝑊(𝑎) '√𝜀 𝜎𝑊 (𝑎), on average over uniformly random
𝑐
𝑊 ∈ {𝑋 , 𝑍} 𝑚 and 𝑎 ∈ {0, 1} 𝑚 , and moreover 𝑊𝑐 ' 𝜎𝑊 on average over uniformly random
𝑊 ∈ {𝑋 , 𝑍} .𝑚
Applying Lemma A.6, the anti-commutation relations between 𝑌 𝑚 (𝑐) and 𝑊(𝑐) verified in
part (b)(i) of the test imply that under the same isometry,
𝑌(𝑐) ' 𝜎𝑌 (𝑐) ⊗ Δ(𝑐) , (A.13)
for some observable Δ(𝑐) on ℋÂ . Here 𝑌(𝑐) is shorthand for 𝑌 𝑚 (𝑐). This is because, for any 𝑐,
the test verifies that condition (iv) in Lemma A.6 is satisfied, where 𝑋 in the lemma is replaced
by any 𝑊 ∈ {𝑋 , 𝑍} 𝑛 (more precisely, the condition holds on the average, for 𝑊 ∈ {𝑋 , 𝑍} 𝑚 and
𝑎 ∈ {0, 1} 𝑚 both chosen uniformly at random). Thus the second centered equation in (A.6)
holds, where by varying the choice of 𝑋 in the lemma (corresponding to varying 𝑊 here) we get
that if 𝑐 𝑖 = 1 then 𝑃𝑖 ∈ {𝑌, 𝑍} ∩ {𝑌, 𝑋} = {𝑌} and if 𝑐 𝑖 = 0 then 𝑃𝑖 ∈ {𝐼, 𝑋} ∩ {𝐼, 𝑍} = {𝐼}. Thus
the lemma implies the claimed form (A.13), where Δ(𝑐) here is 𝐴𝑃 in the lemma for 𝑃 = 𝑌(𝑐).
Using the linearity relations that are verified in part (b)(ii) we may in addition express
Δ(𝑐) = 𝑖 Δ𝑐𝑖 𝑖 for (perfectly) commuting observables Δ𝑖 .
Î
(𝑐)
Using part (b)(iii) it follows that on average over uniformly random 𝑐, 𝑌(𝑐) ' 𝑑 (−1)𝑑·𝑐 𝑊𝑑
Í
where 𝑊 (𝑐) ∈ {𝐼, 𝑌} 𝑚 is the string that has a 𝑌 exactly at those positions 𝑖 such that 𝑐 𝑖 = 1.
Using Claim A.8, success probability at least 1 − 𝑂(𝜀) in part (d) of the test implies that on
average over a random permutation 𝜎 ∈ 𝔖𝑚/2 ,
𝑚/2
Ö 𝑐𝑖 √
2−𝑚 Tr 𝜎𝑌 (𝑐, 𝑐 𝜎 ) haux| |auxi = 1 − 𝑂( 𝜀),
E E Δ𝑖 Δ𝑚/2+𝜎(𝑖) (A.14)
𝜎 𝑐∈{0,1} 𝑚/2
𝑖=1
where we wrote (𝑐, 𝑐 𝜎 ) for the 𝑚-bit string (𝑐1 , . . . , 𝑐 𝑚/2 , 𝑐 𝜎(1) , . . . , 𝑐 𝜎(𝑚/2) ). Defining
Δ𝑖
Δ𝑌 = E , (A.15)
𝑖∈{ 𝑚2 +1,...,𝑚} | E 𝑖 Δ 𝑖 |
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 81
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
|𝑐|
We show that Eq. (A.14) implies that Δ(𝑐) ≈√𝜀 Δ𝑌 . Towards this we first observe that
𝑚/2
Ö |𝑐| 2
E Δ𝑐𝑖 𝑖 − 𝑚
E Δ𝑖 |auxi (A.16)
𝑐∈{0,1} 𝑚/2 𝑖∈{ 2 +1,...,𝑚}
𝑖=1
𝑚/2
Ö
Δ𝑐𝑖 𝑖 − 𝑐𝑖
Ö
|auxi .
2
≤E E Δ𝑔(𝑖) (A.17)
𝑐 𝑔:{1,..., 𝑚2 }→{ 𝑚2 +1,...,𝑚}
𝑖=1 𝑖
where the first inequality is by convexity, with the expectation taken over a random function 𝑔.
We would like to relate this last term to the expectation over a random permutation 𝜎 ∈ 𝔖𝑚/2 .
We do this by observing that with probability 1 − 𝑂(1/𝑚) over the choice of a uniformly random
𝑔 it is possible to write
𝑐0 𝑐 00
Ö Ö
𝑐𝑖
Ö
00 (𝑖) ,
𝑖 𝑖
Δ𝑔(𝑖) = Δ𝑚/2+𝜏0 (𝑖) Δ𝑚/2+𝜏
𝑖 𝑖 𝑖
where 𝑐 0𝑖 + 𝑐 00𝑖 = 𝑐 𝑖 for all 𝑖, 𝜏0 , 𝜏00 are permutations such that 𝑚/2 + 𝜏0(𝑖) = 𝑔(𝑖) if 𝑐 0𝑖 = 𝑐 𝑖 , and
𝑚/2 + 𝜏00(𝑖) = 𝑔(𝑖) if 𝑐 00𝑖 = 𝑐 𝑖 ; this is possible because 𝑔 might have two-element collisions, but
is unlikely to have any three-element collisions. Moreover, for uniformly random 𝑐 and 𝑔 we
can ensure that the marginal distribution on (𝑐 0 , 𝜏0) and (𝑐 00 , 𝜏00) is√uniform. Using this we can
apply (A.14) twice to bound the right-hand side of (A.17) by 𝑂( 𝜀) (after having expanded
the square). Thus the action of E𝑖 Δ𝑖 on |auxi is close to the action of an observable. It is then
|𝑐|
relatively routine work to show that Δ𝑌 defined in (A.15) satisfies Δ(𝑐) ≈√𝜀 Δ𝑌 , on average over
a uniformly random 𝑐.
The last condition in the lemma follows from the consistency relations, which imply that
|𝑎| |𝑎|
𝑋(𝑎) ⊗ 𝑋(𝑎), 𝑍(𝑏) ⊗ 𝑍(𝑏) and 𝑌(𝑐) ⊗ 𝑌(𝑐) all approximately stabilize |𝜓i; then Δ𝑌 ⊗ Δ𝑌 ≈
𝑋(𝑎)𝑍(𝑎)𝑌(𝑎) ⊗ 𝑋(𝑎)𝑍(𝑎)𝑌(𝑎) also does.
References
[1] Dorit Aharonov, Itai Arad, and Thomas Vidick: Guest column: The quantum PCP
conjecture. SIGACT News, 44(2):47–79, 2013. [doi:10.1145/2491533.2491549, arXiv:1309.7495]
61
[2] Dorit Aharonov, Michael Ben-Or, and Elad Eban: Interactive proofs for quantum
computations. In Proc. 1st Innovations in Comp. Sci. Conf. (ICS’10), pp. 453–469. Tsinghua U.,
2010. Tsinghua. [arXiv:0810.5375] 4
[3] Gorjan Alagic, Yfke Dulek, Christian Schaffner, and Florian Speelman: Quantum
fully homomorphic encryption with verification. In Proc. 23rd Internat. Conf. Theory
Appl. of Cryptology and Inform. Security (ASIACRYPT’17), pp. 438–467. Springer, 2017.
[doi:10.1007/978-3-319-70694-8_16, arXiv:1708.09156] 9
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 82
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
[4] John S. Bell: On the Einstein-Podolsky-Rosen paradox. Physics, 1(3):195–200, 1964.
[doi:10.1103/PhysicsPhysiqueFizika.1.195] 2
[5] Debajyoti Bera, Stephen A. Fenner, Frederic Green, and Steven Homer: Efficient universal
quantum circuits. Quantum Inf. Comput., 10(1&2):16–27, 2010. Preliminary version in
COCOON’09. [doi:10.26421/QIC10.1-2-2] 7
[6] Joseph Bowles, Ivan Šupić, Daniel Cavalcanti, and Antonio Acín: Self-testing of Pauli
observables for device-independent entanglement certification. Phys. Rev. A, 98(4/042336):1–
24, 2018. [doi:10.1103/PhysRevA.98.042336, arXiv:1801.10446] 8
[7] Anne Broadbent: How to verify a quantum computation. Theory of Computing, 14(11):1–37,
2018. [doi:10.4086/toc.2018.v014a011, arXiv:1509.09180] 4, 5, 6, 12, 15, 16, 51
[8] Davide Castelvecchi: IBM’s quantum cloud computer goes commercial. Nature News,
543(7644), 9 March 2017. [doi:10.1038/nature.2017.21585] 3
[9] Fan Chung and Linyuan Lu: Concentration inequalities and martingale inequalities: a
survey. Internet Mathematics, 3(1):79–127, 2006. [doi:10.1080/15427951.2006.10129115] 11
[10] John F. Clauser, Michael A. Horne, Abner Shimony, and Richard A. Holt: Proposed
experiment to test local hidden-variable theories. Phys. Rev. Lett., 23(15):880–884, 1969.
[doi:10.1103/PhysRevLett.23.880] 2
[11] Yfke Dulek, Christian Schaffner, and Florian Speelman: Quantum homomorphic
encryption for polynomial-sized circuits. Theory of Computing, 14(7):1–45, 2018. Preliminary
version in CRYPTO’16. [doi:10.4086/toc.2018.v014a007, arXiv:1603.09717] 9
[12] Joseph F. Fitzsimons: Private quantum computation: An introduction to blind quantum com-
puting and related protocols. npj Quantum Information, 3(23):1–11, 2017. [doi:10.1038/s41534-
017-0025-3, arXiv:1611.10107] 4
[13] Joseph F. Fitzsimons and Michal Hajdušek: Post hoc verification of quantum computation,
2015. [arXiv:1512.04375] 3, 5
[14] Joseph F. Fitzsimons, Michal Hajdušek, and Tomoyuki Morimae: Post hoc ver-
ification of quantum computation. Phys. Rev. Lett., 120(4/040501):1–5, 2018.
[doi:10.1103/PhysRevLett.120.040501, arXiv:1512.04375] 3, 4, 5
[15] Joseph F. Fitzsimons and Elham Kashefi: Unconditionally verifiable blind quantum
computation. Phys. Rev. A, 96(1/012303):1–27, 2017. [doi:10.1103/PhysRevA.96.012303,
arXiv:1203.5217] 4, 8
[16] Keisuke Fujii and Masahito Hayashi: Verifiable fault tolerance in measurement-
based quantum computation. Phys. Rev. A, 96(3/030301(R)):1–6, 2017.
[doi:10.1103/PhysRevA.96.030301, arXiv:1610.05216] 4
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 83
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
[17] Alexandru Gheorghiu, Elham Kashefi, and Petros Wallden: Robustness and device
independence of verifiable blind quantum computing. New J. Physics, 17(8/083040):1–22,
2015. [doi:10.1088/1367-2630/17/8/083040, arXiv:1610.05216] 3, 4
[18] Alexandru Gheorghiu and Thomas Vidick: Computationally-secure and composable
remote state preparation. In Proc. 60th FOCS, pp. 1024–1033. IEEE Comp. Soc., 2019.
[doi:10.1109/FOCS.2019.00066, arXiv:1904.06320] 4
[19] Alex B. Grilo: A simple protocol for verifiable delegation of quantum computation
in one round. In Proc. 46th Internat. Colloq. on Automata, Languages, and Program-
ming (ICALP’19), pp. 28:1–13. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, 2019.
[doi:10.4230/LIPIcs.ICALP.2019.28, arXiv:1711.09585] 8, 9
[20] Michal Hajdušek, Carlos A. Pérez-Delgado, and Joseph F. Fitzsimons: Device-independent
verifiable blind quantum computation, 2015. [arXiv:1502.02563] 3, 4
[21] Masahito Hayashi and Michal Hajdušek: Self-guaranteed measurement-based quantum
computation. Phys. Rev. A, 97(5/052308):1–16, 2018. [doi:10.1103/PhysRevA.97.052308,
arXiv:1603.02195] 3, 4
[22] Masahito Hayashi and Tomoyuki Morimae: Verifiable measurement-only blind quan-
tum computing with stabilizer testing. Phys. Rev. Lett., 115(22/220502):1–5, 2015.
[doi:10.1103/PhysRevLett.115.220502, arXiv:1505.07535] 4
[23] He-Liang Huang, Qi Zhao, Xiongfeng Ma, Chang Liu, Zu-En Su, Xi-Lin Wang, Li Li,
Nai-Le Liu, Barry C. Sanders, Chao-Yang Lu, and Jian-Wei Pan: Experimental blind
quantum computing for a classical client. Phys. Rev. Lett., 119(5/050503):1–5, 2017.
[doi:10.1103/PhysRevLett.119.050503, arXiv:1707.00400] 8
[24] Zhengfeng Ji: Classical verification of quantum proofs. Theory of Computing, 15(5):1–42,
2019. Preliminary version in STOC’16. [doi:10.4086/toc.2019.v015a005, arXiv:1505.07432] 3
[25] Urmila Mahadev: Classical verification of quantum computations. SIAM J. Comput.,
51(4):1172–1229, 2022. Preliminary version in FOCS’18. [doi:10.1137/20M1371828,
arXiv:1804.01082] 4, 9
[26] Urmila Mahadev: Classical homomorphic encryption for quantum circuits. SIAM J.
Comput., 52(6):189–215, 2023. Preliminary version in FOCS’18. [doi:10.1137/18M1231055,
arXiv:1708.02130] 9
[27] Dominic Mayers and Andrew Yao: Self testing quantum apparatus. Quantum Inf. Comput.,
4(4):273–286, 2004. ACM DL. 2
[28] Matthew McKague: Interactive proofs for BQP via self-tested graph states. Theory of
Computing, 12(3):1–42, 2016. [doi:10.4086/toc.2016.v012a003, arXiv:1309.5675] 3, 4
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 84
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
[29] N. David Mermin: Simple unified form for the major no-hidden-variables theorems. Phys.
Rev. Lett., 65(27):3373–3376, 1990. [doi:10.1103/PhysRevLett.65.3373] 68
[30] Michael Mitzenmacher and Eli Upfal: Probability and Computing: Randomized Algorithms
and Probabilistic Analysis. Cambridge Univ. Press, 2005. [doi:10.1017/CBO9780511813603]
11
[31] Ashely Montanaro: Quantum algorithms: an overview. npj Quantum Information, 2(15023),
2016. [doi:10.1038/npjqi.2015.23, arXiv:1511.04206] 2
[32] Tomoyuki Morimae: Verification for measurement-only blind quantum computing. Phys.
Rev. A, 89(6/060302(R)):1–4, 2014. [doi:10.1103/PhysRevA.89.060302] 4
[33] Tomoyuki Morimae and Joseph F. Fitzsimons: Post hoc verification with a single prover,
2016. [arXiv:1603.06046] 4
[34] Tomoyuki Morimae, Yuki Takeuchi, and Masahito Hayashi: Verification of hypergraph
states. Phys. Rev. A, 96(062321), 2017. [doi:10.1103/PhysRevA.96.062321, arXiv:1701.05688]
4
[35] Anand Natarajan and Thomas Vidick: A quantum linearity test for robustly verifying entan-
glement. In Proc. 49th STOC, pp. 1003–1015. ACM Press, 2017. [doi:10.1145/3055399.3055468]
3, 5, 6, 20, 27, 68, 73, 74, 75
[36] Anand Natarajan and Thomas Vidick: Low-degree testing for quantum states, and a
quantum entangled games PCP for QMA. In Proc. 59th FOCS, pp. 731–742. IEEE Comp.
Soc., 2018. [doi:10.1109/FOCS.2018.00075] 61
[37] Ben W. Reichardt, Falk Unger, and Umesh Vazirani: Classical command of quantum
systems. Nature, 496:456–460, 2013. Full version arXiv:1209.0448. [doi:10.1038/nature12035]
3, 4, 5, 8, 49, 52
[38] Ben W. Reichardt, Falk Unger, and Umesh Vazirani: A classical leash for a quantum
system: Command of quantum systems via rigidity of CHSH games. In Proc. 4th Innovations
in Theoret. Comp. Sci. Conf. (ITCS’13). ACM Press, 2013. [doi:10.1145/2422436.2422473,
arXiv:1209.0448] 18, 78
[39] William Slofstra: Tsirelson’s problem and an embedding theorem for groups arising from
non-local games. J. AMS, 33:1–56, 2020. [doi:10.1090/JAMS/929, arXiv:1606.03140] 6
[40] Xingyao Wu, Jean-Daniel Bancal, Matthew McKague, and Valerio Scarani: Device-
independent parallel self-testing of two singlets. Phys. Rev. A, 93(6/062121), 2016.
[doi:10.1103/PhysRevA.93.062121, arXiv:1512.02074] 69
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 85
A NDREA C OLADANGELO , A LEX B. G RILO , S TACEY J EFFERY AND T HOMAS V IDICK
AUTHORS
Andrea Coladangelo
Assistant Professor
Paul G. Allen School of Computer Science & Engineering
University of Washington
Seattle, Washington, USA
coladan cs.washington edu
https://andreacoladangelo.com
Alex Bredariol Grilo
CNRS Researcher
LIP6
Sorbonne Université and CNRS
Paris, France
Alex.Bredariol-Grilo lip6 fr
http://abgrilo.org
Stacey Jeffery
Professor
QuSoft, CWI & University of Amsterdam
Amsterdam, the Netherlands
jeffery cwi nl
https://homepages.cwi.nl/~jeffery/
Thomas Vidick
Professor
Computer Science and Applied Mathematics
Weizmann Institute of Science
Rehovot, Israel
thomas vidick weizmann ac il
https://www.weizmann.ac.il/math/vidick/
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 86
V ERIFIER - ON - A -L EASH : N EW S CHEMES FOR V ERIFIABLE D ELEGATED Q UANTUM C OMPUTATION
ABOUT THE AUTHORS
Andrea Coladangelo graduated from Caltech in 2020, advised by Thomas Vidick.
Andrea’s thesis focused on the study of foundational properties of quantum
correlations and entanglement, and their interplay with the certification of
quantum devices. He was a postdoc at UC Berkeley and the Simons Institute
for the Theory of Computing until the end of 2022. He is currently an Assistant
Professor in the Paul G. Allen School of Computer Science & Engineering at the
University of Washington.
Alex Bredariol Grilo (he/him) graduated from Université Paris Diderot (currently
Université de Paris) in 2018. During his Ph. D. studies he was affiliated with
IRIF and his advisor was Iordanis Kerenidis. After that, he was a postdoc at
CWI and QuSoft under the supervision of Stacey Jeffery, Ronald de Wolf and
Christian Schaffner (informal supervisor). From January to May 2020, he was
a Research Fellow at the Simons Institute for the Theory of Computing of UC
Berkeley. Then, in 2020 he became a CNRS researcher LIP6 (CNRS/Sorbonne
Université), where he focuses his research on quantum complexity theory and
cryptography.
Stacey Jeffery received her Ph. D. from the University of Waterloo in 2014, under the
supervision of Michele Mosca, after retiring from a highly successful musical
career, which culminated in singing the backup vocals for the soundtrack of the
trailer for a documentary about the making of a commercial in Peru. After a
postdoctoral fellowship at Caltech, she moved to CWI in Amsterdam, where
she continues to research quantum algorithms and cryptographic protocols, as
part of QuSoft, the research center for quantum software. Since 2023, she has
also been a professor at the University of Amsterdam. In her spare time she
sometimes reads Theory of Computing.
Thomas Vidick graduated from UC Berkeley in 2011; his advisor was Umesh
Vazirani. His thesis focused on the study of quantum entanglement in multiprover
interactive proof systems and in quantum cryptography. After a postdoctoral
scholarship at MIT under the supervision of Scott Aaronson, he moved back to
sunny California where he was a professor in Caltech’s department of Computing
and Mathematical Sciences and a member of the Institute of Quantum Information
and Matter until 2024. In 2022 he crossed the Atlantic and moved to the Weizmann
Institute of Science in Israel, where he currently resides and works.
T HEORY OF C OMPUTING, Volume 20 (3), 2024, pp. 1–87 87