Quantum Supremacy and its Applications HELLO HILBERT SPACE

Quantum Supremacy and its Applications (!) HELLO HILBERT SPACE Scott Aaronson UT Austin (and Scientific Adviser to QC Ware) Q 2 B, Mountain View, CA, December 12, 2018 Papers and slides at www. scottaaronson. com

QUANTUM SUPREMACY | #1 Application of quantum computing: Refute the QC skeptics! You heard yesterday from groups that are racing to achieve this with ~50 -100 qubit systems. “Even if it’s useless, who cares? ”

“Sure, building 100 high-quality qubits is tough. But once you do, just throw them at any optimization or machine learning or other application problem you want, and clearly it’ll take 2100 steps to solve the same problem classically!” Kerenidis-Prakash 2016: Quantum algorithm for recommending products in Netflix-like systems in logarithmic time (given a QRAM and a suitable data structure)—exponentially faster than any classical algorithm known at the time Me, Preskill in last year’s Q 2 B: Can we show that any classical algorithm for this task needs polynomially many memory accesses, and hence that this speedup is real?

Ewin Tang’s Breakthrough (2018) Fundamental obstruction to ruling out a fast classical algorithm for the Kerenidis-Prakash problem: There is such an algorithm (a “dequantization”)! Last month, was generalized to dequantize essentially all quantum ML algorithms based on low-rank linear algebra (though not HHL) QC applications realizable with 0 Gilyen-Lloyd-Tang, Chia-Lin-Wang qubits!

What if we just want maximum confidence that we’re solving something that’s classically exponentially hard? Theoretical work (Terhal-Di. Vincenzo 2004, A. -Arkhipov 2011, Bremner-Jozsa-Shepherd 2011…) has uncovered many advantages to switching our attention from problems with a single valid answer to sampling problems The classical hardness of sampling problems can even be based on the belief that the polynomial hierarchy is infinite Additional huge advantage: potential to realize these sampling speedups using NISQ devices We “merely” give up on: obvious applications, a fast classical way to verify the result…?

The Random Quantum Circuit Proposal Generate a quantum circuit C on n qubits in a n n lattice, with d layers of random nearest-neighbor gates Apply C to |0 n and measure. Repeat T times, to obtain samples x 1, …, x. T from {0, 1}n Check whether x 1, …, x. T solve the “Heavy Output Generation” (HOG) problem—e. g. , do at least 2/3 of the xi’s have more than the median probability? (takes classical exponential time, which is OK for n 70) Publish C. Challenge skeptics to generate samples passing the test in a reasonable amount of time

A. and Lijie Chen, ar. Xiv: 1612. 05903 Theorem (paraphrased): Suppose there’s a poly-time classical “faking” algorithm—one that, given a a random quantum circuit C, with n qubits and m>>n gates, solves HOG with high probability. Then there’s also a poly-time classical algorithm to guess whether Pr[C outputs 0 n] exceeds some threshold , with ~1/2 n bias over flipping a coin Theorem: There is a poly-time classical algorithm to guess if Pr[C outputs 0 n] > with 1/exp(m) bias Theorem: There’s also a recursive classical algorithm to simulate C using m. O(n) time and linear memory— “interpolating between Schrödinger and Feynman” But neither of these yield guessing algorithms that undermine the presumed hardness of HOG!

“But even if these sampling-based supremacy experiments work, they’ll just produce mostly-random bits, which is obviously useless…” 110100001101001111011011001100010100100 00

Certified Random Bits: Who Needs ‘Em? For private use: Cryptographic keys (a big one!) For public use: Election auditing, lotteries, parameters for cryptosystems, zero-knowledge protocols, proofof-stake cryptocurrencies… Trivial Quantum Randomness Solution! |0 H Problem: What if your quantum hardware was backdoored by the NSA? (Like the DUAL_EC_DRBG pseudorandom generator apparently was? ) Want to trust a deterministic classical computer only

Earlier Approach: Bell-Certified Randomness Generation Colbeck and Renner, Pironio et al. , Vazirani and Vidick, Coudron and Yuen, Miller and Shi… Upside: Doesn’t need a QC; uses only “current technology” (though loophole-free Bell violations are only ~2 years old) Downside: If you’re getting the random bits over the Internet, how do you know Alice and Bob were separated?

SEED CHALLENGES Randomness from Quantum Supremacy Experiments Key Insight: A QC can solve certain sampling problems quickly —but under plausible hardness assumptions, it can only do so by sampling (and hence, generating real entropy) Upsides: Requires just a single device—good for certified randomness over the Internet. Ideal for near-term devices Caveats: Requires hardness assumptions and initial seed randomness. Verification (with my scheme) takes exp(n)

INHERENTLY REQUIRES QUANTUM Why? Because a classical server could always replace its randomness source by a pseudorandom one without the client being able to detect it Indeed, our protocol requires certain tasks (e. g. , finding heavy outputs of a quantum circuit) to be easy for QCs, and other tasks (e. g. , finding the same heavy outputs every time) to be hard for QCs!

The Protocol 1. The classical client generates n-qubit quantum circuits C 1, …, CT pseudorandomly (mimicking a random ensemble) 2. For each t, the client sends Ct to the server, then demands a response St within a very short time Soundness theorem (in preparation): Under In the “honest” case, the response is a list of k samples from the suitable (strong)ofcomputational hardness output distribution Ct|0 n assumptions, if the server is a fast QC and the 3. The clientaccepts picks O(1) random t, and for each one, w. h. p. , theniterations conditioned on the checksclient whether St solves problem must be accepting, cnthe bits. HOG of min-entropy generated per iteration, for some constant c>0 4. If these checks pass, then the client feeds S= S , …, S into 1 T a classical randomness extractor, to get nearly pure random bits

Applications For the QC owner: Private randomness For those connecting over the cloud: Public randomness The protocol does require pseudorandom challenges, but: Even if the pseudorandom generator is broken later, the truly random bits will remain safe (“forward secrecy”) Even if the seed was public, the random bits can be private The random bits demonstrably weren’t known to anyone, even the QC, before it received a challenge (freshness)

Different Approach Brakerski, Christiano, Mahadev, Vazirani, Vidick ar. Xiv: 1804. 00640 Method for a QC to generate random bits, assuming the quantum hardness of breaking lattice-based cryptosystems 2 -to-1 function f, plus trapdoor f f(x) measurement basis measurement result Huge advantage of the BCMVV scheme over mine: Polynomial-time classical verification! Advantage of mine: Can be run on near-term devices!

Some Future Directions Can we prove quantum supremacy, as well as certified randomness, under more “standard” and less “boutique” computational hardness assumptions? Can we get polynomial-time classical verification with any of the problems solvable by NISQ devices? Can we get more and more certified randomness by sampling with the same circuit C over and over? Would greatly improve the bit rate

Conclusions We might be close to 50 -70 qubit quantum supremacy experiments. We can say interesting things about the hardness of simulating them classically; we’d like to say more Certified randomness generation: the most plausible application of a very-near-term QC? This application requires sampling problems: problems with definite answers (like factoring) are useless! Not only can we do it with ~70 qubits, we don’t want more. No expensive encoding needed; can fully exploit hardware “Try to embrace the weaknesses of NISQ devices, and turn them into strengths…”