Quantum Versus Classical Proofs and Advice

1. x{0,1}n Quantum Versus Classical Proofs and Advice ? | Scott AaronsonWaterloo  MIT Greg KuperbergUC Davis

2. Can “quantum proofs” let us verify certain theorems exponentially faster than classical proofs? Yes (we think!) But to argue for the power of quantum proofs, we’ll have to introduce a new kind of evidence:“Quantum Oracle Separations” (It’s not just that we failed to find the old kind of evidence—we can tell you exactly why we failed)

3. Schrödinger’s Zoo QMA:Quantum Merlin-ArthurClass of problems for which a “yes” answer can be verified in quantum polynomial-time, with help from a polynomial-size quantum witness state QCMA:Quantum Classical Merlin-ArthurSame, except now the witness has to be classical Closely related to quantum proofs is quantum advice… BQP/qpoly:Class of problems solvable in quantum polynomial time, with help from a “quantum advice state” |n that depends only on the input length n BQP/poly:Same, except now advice has to be classical

4. Surely it should at least be easy to separate these classes by oracles… PP/poly Dream on! PP QMA BQP/qpoly QCMA BQP/poly MA BQP P/poly

5. This Talk: Quantum Oracle Separations Theorem: There exist “quantum oracles” U and V such that QMAUQCMAU and BQPV/qpolyBQPV/poly Quantum oracle: A sequence of unitary transformations {Un} that a quantum algorithm can apply in a black-box fashion Models subroutines that take quantum input and produce quantum output A new kind of evidence that two complexity classes are different Idea has already found other applications in quantum computing [A07] [MS07]

6. The Oracle Problem We’ll Use • Choose an n-qubit state | uniformly at random • Let U be the unitary that maps ||0 to ||1, and ||0 to ||0 whenever |=0 • Problem: Given oracle access to U, decide whether • (YES) U=U for some , or • (NO) U=I is the identity transformation • Clearly this problem is in QMAU(The witness: | itself) • Claim: The problem is not in QCMAU

7. 2n-dimensional unit sphere “advice regions” Underlying Question: How much does an nk-bit classical hint help in searching for an unknown 2n-dimensional unit vector? Intuition: Not much!

8. To prove the intuition, we need a geometric lemma… Let  be a probability measure over N-dimensional unit vectors Call p-uniform if it can be obtained by starting from the uniform measure, and then conditioning on an event that occurs with probability  p Lemma: If  is p-uniform, then for every fixed quantum state |,

9. Intuition: Best you can do is let  be the uniform measure over the fraction p of states that are closest to | | 

10. Quantum oracles relative to which QMAUQCMAU and BQPU/qpolyBQPU/poly now follow by standard arguments Lower Bound • Theorem: Suppose we’re given oracle access to an n-qubit unitary U, and want to decide whether • U=I is the identity operator, or • U=U for some secret “marked state” |. • Then even if we’re given an m-bit classical witness in support of case (ii), we still need Proof uses BBBV hybrid argument queries to U to verify the witness.

11. Almost-Matching Upper Bound Theorem: We can find an n-qubit “marked state” | using an m-bit classical hint, together with queries to the quantum oracle U. (Provided m2n) Idea: A “mesh” of 2m states. Merlin tells Arthur the state closest to |, which Arthur then uses as a starting point for Grover’s algorithm

12. But What About A Classical Oracle Separation Between QMA and QCMA? • We’ve had essentially one candidate problem for this: Group Non-Membership (Babai) • Problem: Given a group G, a subgroup HG, and an element xG, is xH? • Here G and H are specified as black-box groups • I.e. every xG is labeled by a meaningless string s(x), and we’re given an oracle that maps s(x) and s(y) to s(xy) and s(x-1)

13. Conclusion: The Group Non-Membership problem cannot, alas, lead to an oracle separation between QMA and QCMA. Group Non-Membership (as an oracle problem) is known to be in AM but outside MA Watrous (2000) showed how to solve GNM in QMA, using the state as a witness • Our result: Arthur can verify xH using • a polynomial-size classical witness from Merlin, and • polynomially many quantum queries to the group oracle • (but possibly an exponential amount of computation)

14. Idea: “Pull the group out of the black box” Isomorphism claimed by Merlin Explicit group Black-box group

15. Merlin gives Arthur an explicit group, together with a claimed isomorphism f:G(defined by its action on generators) Arthur checks that f is a homomorphism using the BCLR tester He checks that f is one-to-one by solving an instance of the Hidden Subgroup Problem(f is one-to-one  kernel of f is trivial) Ettinger-Høyer-Knill: Hidden Subgroup Problem has polynomial quantum query complexity Once we’ve replaced G by an explicit group, no more queries to the group oracle are needed

16. Open Problems Can we prove a classical oracle separation between QMA and QCMA? Bigger question:Whenever we prove a quantum oracle separation, can we also prove a classical one? Is Group Non-Membership in QCMA?(I.e. is the computational complexity polynomial, in addition to the query complexity?) Other quantum oracle separations?QMA vs. QMA(2)