Shadow Tomography of Quantum States

1.  Shadow Tomography of Quantum States Scott Aaronson (University of Texas at Austin) STOC, Los Angeles, June 26, 2018

2. Measurements in QM are Destructive One qubit has infinitely many bits in the amplitudes ,—but when you measure, the state “collapses” to just 1 bit! (0 with probability ||2, 1 with probability ||2) This destructiveness opens cryptographic possibilities, like quantum key distribution and quantum money—but it’s also a huge practical limitation!

3. And there’s a lot to be destroyed! An n-qubit pure state requires 2n complex numbers to specify, even approximately: Yet measuring yields at most n bits (Holevo’s Theorem) So should we say that the 2n complex numbers are “really there” in a single copy of |—or “just in our heads”? A probability distribution over n-bit strings also involves 2n real numbers. But probabilities don’t interfere!

4. Interlude: Mixed States DD Hermitian positive semidefinite matrix with Tr()=1 The most general kind of state in QM: encodes (everything measurable about) a distribution where each superposition |i occurs with probability pi A yes-or-no measurement can be represented by a DD Hermitian psd matrix E with all eigenvalues in [0,1] The measurement “accepts”  with probability Tr(E), and “rejects”  with probability 1-Tr(E)

5. Quantum State Tomography Task: Given lots of copies of an unknown D-dimensional quantum mixed state , produce an approximate classical description of  O’Donnell and Wright and Haah et al., STOC’2016: ~(D2) copies of  are necessary and sufficient for this Experimental Record: Song et al. (2017), 10 qubits, millions of measurement settings!Keep in mind: D = 2n

6. Shadow Tomography Given: Unknown D-dimensional mixed state , known 2-outcome measurements E1,…,EM Goal: Estimate Tr(Ei) to within additive error , for every i[M], with (say) 2/3 success probability How many copies of  must we measure? Clearly Õ(D2) copies suffice, and also Õ(M) copies. But what about poly(log D, log M)? Main Result: It’s possible to do Shadow Tomography using only copies Doesn’t this violate Holevo’s Theorem? Nope…

7. Implications Given an n-qubit state |, for any fixed polynomial p, by measuring nO(1) copies of |, we can learn |’s behavior on every accepting/rejecting circuit with p(n) gates Any scheme for quantum money (with small secret) or quantum software copy protection must require computational assumptions Given any language in PromiseBQP/qpoly, nO(1) copies of the advice state are enough to reconstruct the whole truth table on n-bit inputs … even without knowing the promise! (Can also phrase in terms of quantum 1-way communication protocols) Any experimental use???

8. Interlude: Gentle Measurement Winter 1999, A. 2004, Wilde 2013 Suppose a measurement of a mixed state  yields a certain outcome with probability 1- Then after the measurement, we still have a state ’ that’s -close to  in trace distance Moreover, we can apply M such measurements in succession, and they’ll all accept w.p. 1-2M Often combined with amplification: measure k copies of  and take a majority to push down error by 1/exp(k)

9. Why Doesn’t Gentle Measurement Immediately Solve the Problem? Implies a promise gap version of shadow tomography: Given measurements E1,…,EM and real numbers c1,…,cM, and promised that for each i, either Tr(Ei)ci or Tr(Ei)ci-, we can decide which for every i using only O(log M / 2) copies of  When there’s no promise, we can never rule out that we’re on the knife-edge between acceptance and rejection—in which case, measuring  is dangerous! Our main contribution is to solve this

10. The proof combines several ingredients. The first is a “postselected learning theorem” (A. 2004) 1 2 3 I Key point: for boosting / multiplicative weights type reasons, this process must converge after T = O(log D*) iterations, at some state T that behaves like  on E1,…,EM(even if it’s far from  in trace distance) Alice is trying to describe a mixed state  to Bob (actually an amplified version), with respect to its behavior on E1,…,EM Initially, Bob knows nothing about , so he guesses it’s the maximally mixed state0=I (actually ) Then Alice helps Bob improve, by repeatedly telling him a measurement Ei(t) on which his current guess t-1 badly fails Bob lets t be the state obtained by starting from t-1, then performing Ei(t) and postselecting on getting the right outcome Previously used to proveBQP/qpoly  PP/poly and to do online learning of quantum states (A. et al. 2017)

11. Alas, postselected learning doesn’t suffice by itself for shadow tomography, because it gives us no idea how to find the informative measurements Ei(1),Ei(2),…. So we need to combine with another result called the…Quantum OR Bound • Let  be an unknown mixed state, and let E1,…,EM be known 2-outcome measurements. Suppose we’re promised that either • there exists an i such that Tr(Ei)c, or else • Tr(Ei)c- for all i[M]. • Then we can decide which, with high probability, given only O((log M)/2) copies of 

12. [A. 2006] claimed a proof of the Quantum OR Bound, based on just applying amplified Ei’s in a random order [Harrow-Lin-Montanaro, SODA’2017] discovered an error in my proof—but also fixed it! Using a procedure that involves preparing a control qubit in the |+ state, applying Ei’s conditional on the control qubit being |1, and repeatedly measuring the control qubit to see whether it’s decohered It remains open whether my original, simpler procedure is also sound Using binary search, can boost the OR Bound to a “gentle search procedure,” which actually finds an Ei that accepts  w.h.p. using O(log4M) copies of 

13. True Sample Complexity of Shadow Tomography? Best lower bound I could prove (which holds even in the classical case): Open whether any dependence on D is needed! [A.-Rothblum, not yet published]: Using a brand-new connection between gentle measurement and differential privacy (!), we can improve the dependence on log M, while also making shadow tomography “online”

14. Computation Cost of Shadow Tomography? Our procedure uses Õ(LM) + DO(log log D) time, where L is the circuit complexity of implementing a single Ei Brandão et al. 2017: By combining our ideas with recent SDP algorithms, achieve shadow tomography with poly(log M, log D) copies and Õ(LM) + DO(1) time Note: Even writing the input takes ~MD2 bits, and output takes ~M bits, unless we use implicit representations If “hyper-efficient” shadow tomography is possible (poly(log M, log D) time), then BQP/qpoly=BQP/poly and there’s no quantum copy-protection But can we do it in special cases?