ScottAaronson(UniversityofTexas,Austin)SimonsInstitute,Berkeley,June12,2018

BasedonjointworkwithLijieChen(CCC’2017,arXiv:1612.05903)andonforthcomingwork

Papersandslidesatwww.scottaaronson.com

QuantumSupremacyanditsApplications

HELLO HILBERT SPACE

#1Applicationofquantumcomputing:DisproveGilKalai!(AndtheExtendedChurch-TuringThesis)

|〉Mightactuallybeabletoachieveinthenextcoupleyears,e.g.withGoogle’s72-qubitBristleconechip.

“Obviouslyuselessforanythingelse,”butwhocares?

QUANTUMSUPREMACY

TheSamplingApproachPutforwardbyA.-Arkhipov2011(BosonSampling),

Bremner-Jozsa-Shepherd2011(IQPModel),andothers

PostBQP

PostBPP

PostBQP:whereweallowpostselectiononexponentially-unlikelymeasurementoutcomes

PostBPP:Classicalrandomizedsubclass

Theorem(A.2004):PostBQP=PP

PostBPPisinthepolynomialhierarchy

Considerproblemswherethegoalistosamplefromadesireddistributionovern-bitstrings

Comparedtoproblemswithasinglevalidoutput(likeFACTORING),samplingproblemscanbe

(1)  Easiertosolvewithnear-futurequantumdevices,and

(2)  Easiertoarguearehardforclassicalcomputers!

(We“merely”giveupon:practicalapplications,fastclassicalwaytoverifytheresult…?)

TheRandomQuantumCircuitProposal

GenerateaquantumcircuitConnqubitsina√n×√nlattice,withdlayersofrandomnearest-neighborgates

ApplyCto|0〉⊗nandmeasure.RepeatTtimes,toobtainsamplesx1,…,xTfrom{0,1}n

Checkwhetherx1,…,xTsolvethe“HeavyOutputGeneration”(HOG)problem—e.g.,doatleast2/3ofthexi’shavemorethanthemedianprobability?

(takesclassicalexponentialtime,whichisOKforn≈70)

PublishC.Challengeskepticstogeneratesamplespassingthetestinareasonableamountoftime

xxe−

xe−

OurStrongHardnessAssumptionThere’snopolynomial-timeclassicalalgorithmAsuchthat,givenauniformly-randomquantumcircuitCwithnqubitsandm>>ngates,

( ) ( )nnn

CCCA −⊗⊗

Ω+≥⎥⎦⎤

⎢⎣⎡ > 2

21median00 whether guesses Pr

2

Note:Thereisapolynomial-timeclassicalalgorithmthatguesseswithprobability

m41

21+≈

(justexpand〈0|⊗nC|0〉⊗noutasasumof4mterms,thensampleafewrandomones)

Theorem:AssumeSHA.ThengivenasinputarandomquantumcircuitC,withnqubitsandm>>ngates,there’snopolynomial-timeclassicalalgorithmthatevenpassesourstatisticaltestforC-samplingw.h.p.

ProofSketch:GivenacircuitC,first“hide”whichamplitudewecareaboutbyapplyingarandomXOR-masktotheoutputs,producingaC’suchthat nnn CzC ⊗⊗⊗

= 00'0

NowletAbeapoly-timeclassicalalgorithmthatpassesthetestforC’withprobability≥0.99.SupposeAoutputssamplesx1,…,xT.Thenifxi=zforsomei∈[T],guessthat

median002≥

⊗⊗ nnC

Otherwise,guessthatwithprobability122

1+

− nT

ViolatesSHA!

Ofcoursewe’dlikehardnessofrandomcircuitsamplingbasedonaweakercomplexity

assumption.RecentpartialprogressinthatdirectionbyBouland,Fefferman,Nirkhe,

VaziraniarXiv:1803.04402

Time-SpaceTradeoffsforSimulatingQuantumCircuits

Givenageneralquantumcircuitwithnqubitsandm>>ntwo-qubitgates,howshouldwesimulateitclassically?

“Schrödingerway”:

Storewholewavefunction

O(2n)memory,O(m2n)time

n=40,m=1000:FeasiblebutrequiresTBofRAM

“Feynmanway”:

Sumoverpaths

O(m+n)memory,O(4m)time

n=40,m=1000:InfeasiblebutrequireslittleRAM

Bestofbothworlds?

Theorem:LetCbeaquantumcircuitwithnqubitsanddlayersofgates.Thenwecancomputeeachtransitionamplitude,〈x|C|y〉,indO(n)timeandpoly(n,d)memory

Proof:Savitch’sTheorem!RecursivelydivideCintotwochunks,C1andC2,withd/2layerseach.Then

{ }∑∈

=nz

yCzzCxyCx1,0

21 ||||||

C1C2

Candobetterfornearest-neighborcircuits,orwhenmorememoryisavailable

Thisalgorithmstilldoesn’tfalsifytheSHA!Whynot?

WhatAboutErrors?

kbit-fliperrors⇒deviationfromtheuniformdistributionissuppressedbya1/exp(k)factor.Withouterror-correction,canonlytolerateafewerrors.Willcomedowntonumbers.

Verification

Needstobedifficultbutnotimpossible(likeBitcoinmining).Partlyusingourrecursiveapproach,Pednaultetal.fromIBMandChenetal.fromAlibabahavenowshownhowtohandleupto~70qubitsclassically.Perfectlyconsistentwithwhatwe’retryingtodo!

RandomBitsareObviouslyUseless…

1101000011010011110110110011001100010100100110100011111011110100

CertifiedRandomBits:WhoNeeds‘Em?

PostBQP

PostBPP

PostBQP:whereweallowpostselectiononexponentially-unlikelymeasurementoutcomes

PostBPP:Classicalrandomizedsubclass

Theorem(A.2004):PostBQP=PP

PostBPPisinthepolynomialhierarchy

Forprivateuse:Cryptographickeys(abigone!)

Forpublicuse:Electionauditing,lotteries,parametersforcryptosystems,zero-knowledgeprotocols,proof-of-stakecryptocurrencies…

TrivialQuantumRandomnessSolution!

H|0〉

Problem:WhatifyourquantumhardwarewasbackdooredbytheNSA?(LiketheDUAL_EC_DRBGpseudorandomgeneratorwas?)Wanttotrustadeterministicclassicalcomputeronly

EarlierApproach:Bell-CertifiedRandomnessGeneration

ColbeckandRenner,Pironioetal.,VaziraniandVidick,CoudronandYuen,MillerandShi…

Upside:Doesn’tneedaQC;usesonly“currenttechnology”(thoughloophole-freeBellviolationsareonly~2yearsold)

Downside:Ifyou’regettingtherandombitsovertheInternet,howdoyouknowAliceandBobwereseparated?

RandomnessfromQuantumSupremacyExperiments

Upsides:Requiresjustasingledevice—goodforcertifiedrandomnessovertheInternet.IdeallysuitedtoNISQdevices

Caveats:Requireshardnessassumptionsandinitialseedrandomness.Verification(withmyscheme)takesexp(n)time

KeyInsight:AQCcansolvecertainsamplingproblemsquickly—butunderplausiblehardnessassumptions,itcanonlydosobysampling(andhence,generatingrealentropy)

SEED

CH

ALLE

NG

ES

Applications

FortheQCowner:Privaterandomness

Theprotocoldoesrequirepseudorandomchallenges,but:

Evenifthepseudorandomgeneratorisbrokenlater,thetrulyrandombitswillremainsafe(“forwardsecrecy”)

Eveniftheseedwaspublic,therandombitscanbeprivate

Therandombitsdemonstrablyweren’tknowntoanyone,eventheQC,beforeitreceivedachallenge(freshness)

Forthoseconnectingoverthecloud:Publicrandomness

TheProtocol1.Theclassicalclientgeneratesn-qubitquantumcircuitsC1,…,CTpseudorandomly(mimickingarandomensemble)

2.Foreacht,theclientsendsCttotheserver,thendemandsaresponseStwithinaveryshorttime

Inthe“honest”case,theresponseisalistofksamplesfromtheoutputdistributionofCt|0〉⊗n

3.TheclientpicksO(1)randomiterationst,andforeachone,checkswhetherStsolves“HOG”(HeavyOutputGeneration)

4.Ifthesecheckspass,thentheclientfeedsS=〈S1,…,ST〉intoaclassicalrandomnessextractor,suchasGUV(Guruswami-Umans-Vadhan),togetnearlypurerandombits

MainResultSupposethatsuitablehardnessassumptionshold,andthattheserverdoesatmostnO(1)quantumcomputationperiteration.Supposealsothatweruntheprotocol,forT≤2nsteps,andtheclientacceptswithprobability>½.Thenconditionedontheclientaccepting,theoutputbitsSare1/exp(nΩ(1))-closeinvariationdistancetoadistributionwithmin-entropyΩ(Tn).

( )[ ]min 21: min log

PrxD

H Dx

=

Whichmeans:theextractorwilloutputΩ(Tn)bitsthatareexponentiallyclosetouniform

Hardestpart:showaccumulationofmin-entropyacrosstheTiterations.E.g.,ruleoutthatthesamplesarecorrelated

DifferentApproachBrakerski,Christiano,Mahadev,Vazirani,VidickarXiv:1804.00640

MethodforaQCtogeneraterandombits,assumingthequantumhardnessofbreakinglattice-basedcryptosystems

HugeadvantageoftheBCMVVschemeovermine:Polynomial-timeclassicalverification!

Advantageofmine:CanberunonNISQdevices!

2-to-1functionf,plustrapdoor

( )2x

x yx f x

+→∑

ff(x)

measurementbasismeasurementresult

FutureDirectionsCanwegetquantumsupremacy,aswellascertifiedrandomness,undermore“standard”andless“boutique”complexityassumptions?

Canwegetpolynomial-timeclassicalverificationandNISQimplementabilityatthesametime?

CanwegetmoreandmorecertifiedrandomnessbysamplingwiththesamecircuitCoverandover?Wouldgreatlyimprovethebitrate,removetheneedforaPRF

CanweproveourrandomnessschemesoundevenagainstadversariesthatareentangledwiththeQC?

ConclusionsWemightbecloseto~70-qubitquantumsupremacyexperiments.Wecansaynontrivialthingsaboutthehardnessofsimulatingtheseexperiments,butwe’dliketosaymore

Certifiedrandomnessgeneration:themostplausibleapplicationofvery-near-termQCs?

Thisapplicationrequiressamplingproblems:problemswithdefiniteanswers(likefactoring)areuseless!

Notonlycanwedoitwith~70qubits,wedon’twantmore.Noexpensiveencodingneeded;canfullyexploithardware

Withthisapplication,alltheweaknessesofsampling-basedquantumsupremacyexperimentsbecomestrengths!