Untrusted quantum devices - Home |...
Transcript of Untrusted quantum devices - Home |...
![Page 1: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/1.jpg)
Untrusted quantum devicesYaoyun Shi
University of Michigan updated Feb. 1, 2014
![Page 2: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/2.jpg)
Quantum power is incredible!
![Page 3: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/3.jpg)
Quantum power is incredible!
![Page 4: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/4.jpg)
Quantum power is incredible!
Spooky action at a distance
![Page 5: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/5.jpg)
Quantum power is incredible!simulating
quantum physics
Spooky action at a distance
![Page 6: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/6.jpg)
Quantum power is incredible!
super-fast factoring
simulating quantum physics
Spooky action at a distance
![Page 7: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/7.jpg)
Quantum power is incredible!
super-fast factoring
simulating quantum physics
Spooky action at a distance
Unbreakable codes
![Page 8: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/8.jpg)
Quantum power is incredible!
super-fast factoring
simulating quantum physics
Spooky action at a distance
Unbreakable codes
Bla..bla..bla..
![Page 9: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/9.jpg)
![Page 10: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/10.jpg)
![Page 11: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/11.jpg)
Do you believe in half-dead half-alive cats?
![Page 12: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/12.jpg)
Do you believe in half-dead half-alive cats?
!
Quantum Poems, No. 4 by Smita Krishnaswamy A group of physicist perform a hoax about a cat half-alive half-dead in a box The equations so well worked out And observations to toutOnly mathematicians fall for such jokes! !
![Page 13: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/13.jpg)
Quantum power is incredible!
![Page 14: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/14.jpg)
Quantum power is incredible!
•We are classical beings…
![Page 15: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/15.jpg)
Quantum power is incredible!
•We are classical beings…
![Page 16: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/16.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
![Page 17: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/17.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
![Page 18: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/18.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
![Page 19: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/19.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
![Page 20: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/20.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
•Entanglement experiments still have “Loopholes”
![Page 21: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/21.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
•Entanglement experiments still have “Loopholes”
•Security concerns
![Page 22: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/22.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
•Entanglement experiments still have “Loopholes”
•Security concerns
![Page 23: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/23.jpg)
It’s THE CAT!
Quantum power is incredible!
•We are classical beings…
•Technological challenges
•Entanglement experiments still have “Loopholes”
•Security concerns
Certified by ???
![Page 24: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/24.jpg)
![Page 25: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/25.jpg)
Can we still reap the quantum benefits without trusting the device?
![Page 26: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/26.jpg)
Can we still reap the quantum benefits without trusting the device?
![Page 27: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/27.jpg)
Can we still reap the quantum benefits without trusting the device?
•Untrusted-device quantum computation
![Page 28: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/28.jpg)
Can we still reap the quantum benefits without trusting the device?
•Untrusted-device quantum computation
•Untrusted-device randomness extraction
![Page 29: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/29.jpg)
Can we still reap the quantum benefits without trusting the device?
•Untrusted-device quantum computation
•Untrusted-device randomness extraction
•Untrusted-device key distribution
![Page 30: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/30.jpg)
![Page 31: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/31.jpg)
Foundation: Classical Test of a Quantum Duck
![Page 32: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/32.jpg)
Foundation: Classical Test of a Quantum Duck
![Page 33: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/33.jpg)
Foundation: Classical Test of a Quantum Duck
•Interrogate the device classically, check if behaving like the ideal q. device
![Page 34: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/34.jpg)
Foundation: Classical Test of a Quantum Duck
•Interrogate the device classically, check if behaving like the ideal q. device
•Self-testing: if behaving exactly as ideal, then must be ideal
![Page 35: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/35.jpg)
Foundation: Classical Test of a Quantum Duck
•Interrogate the device classically, check if behaving like the ideal q. device
•Self-testing: if behaving exactly as ideal, then must be ideal
•Robust Self-testing: if behaving close to ideal, then must be close to the ideal
![Page 36: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/36.jpg)
![Page 37: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/37.jpg)
Strategy: mixing work and play (test)
![Page 38: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/38.jpg)
Strategy: mixing work and play (test)
![Page 39: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/39.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test
![Page 40: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/40.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test• If trying to avoid work, will fail
the test
![Page 41: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/41.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test• If trying to avoid work, will fail
the test•Two guarantees
![Page 42: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/42.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test• If trying to avoid work, will fail
the test•Two guarantees
•Completeness. On honest device (thus job well-done), accept w.h.p.
![Page 43: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/43.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test• If trying to avoid work, will fail
the test•Two guarantees
•Completeness. On honest device (thus job well-done), accept w.h.p.
•Soundness. On any device, almost always reject or accept a well-done job
![Page 44: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/44.jpg)
Strategy: mixing work and play (test)
•The device can’t tell if it’s work or test• If trying to avoid work, will fail
the test•Two guarantees
•Completeness. On honest device (thus job well-done), accept w.h.p.
•Soundness. On any device, almost always reject or accept a well-done job•Reject a malicious device w.h.p.
![Page 45: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/45.jpg)
How could self-testing be possible?
•Impossible if no additional constraints on the device
Do you love me, daughters?
Dear father, we do!
![Page 46: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/46.jpg)
Additional constraint: Spatial separation
Communication impossible
A B
![Page 47: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/47.jpg)
Additional constraint: Spatial separation
•Device has multiple-parts
Communication impossible
A B
![Page 48: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/48.jpg)
Additional constraint: Spatial separation
•Device has multiple-parts
•Spatially separated so that no communications allowed among parts within the testing time
Communication impossible
A B
![Page 49: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/49.jpg)
The CHSH game
y
a
x
b
A B
![Page 50: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/50.jpg)
The CHSH game
•Each part receives a bit, outputs a bit
y
a
x
b
A B
![Page 51: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/51.jpg)
The CHSH game
•Each part receives a bit, outputs a bit• Input bits are uniformly random
y
a
x
b
A B
![Page 52: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/52.jpg)
The CHSH game
•Each part receives a bit, outputs a bit• Input bits are uniformly random•Device wins if a⊕b=x∧y
y
a
x
b
A B
![Page 53: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/53.jpg)
Classical strategies
y
a
x
b
A B
![Page 54: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/54.jpg)
Classical strategies
y
a
x
b
A B
![Page 55: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/55.jpg)
Classical strategies
•Each applies a deterministic function on his/her input
y
a
x
b
A B
![Page 56: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/56.jpg)
Classical strategies
•Each applies a deterministic function on his/her input•Best classical winning prob: ≤3/4
y
a
x
b
A B
![Page 57: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/57.jpg)
Classical strategies
•Each applies a deterministic function on his/her input•Best classical winning prob: ≤3/4 Bell-type
inequality
y
a
x
b
A B
![Page 58: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/58.jpg)
Classical strategies
•Each applies a deterministic function on his/her input•Best classical winning prob: ≤3/4
•both output 0 on all inputs achieves 3/4Bell-type inequality
y
a
x
b
A B
![Page 59: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/59.jpg)
Quantum strategies
y
a
x
b
A B
![Page 60: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/60.jpg)
Quantum strategies
y
a
x
b
A B
![Page 61: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/61.jpg)
Quantum strategies
•Share entanglement before game starts
y
a
x
b
A B
![Page 62: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/62.jpg)
Quantum strategies
•Share entanglement before game starts•Each applies a local measurement chosen by the input
y
a
x
b
A B
![Page 63: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/63.jpg)
Quantum strategies
•Share entanglement before game starts•Each applies a local measurement chosen by the input•Best quantum winning prob: ≤ cos2ᴨ/8
y
a
x
b
A B
![Page 64: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/64.jpg)
Quantum strategies
•Share entanglement before game starts•Each applies a local measurement chosen by the input•Best quantum winning prob: ≤ cos2ᴨ/8
•Achievable
y
a
x
b
A B
![Page 65: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/65.jpg)
Quantum strategies
•Share entanglement before game starts•Each applies a local measurement chosen by the input•Best quantum winning prob: ≤ cos2ᴨ/8
•Achievable Tsirelsen-type inequality
y
a
x
b
A B
![Page 66: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/66.jpg)
CHSH is a strong self-testy
a
x
b
A B
![Page 67: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/67.jpg)
CHSH is a strong self-testy
a
x
b
A B
![Page 68: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/68.jpg)
CHSH is a strong self-test
• Self-test [Popescu,Rorhlick 1999]: Any q. strategy achieving cos2ᴨ/8 must be the ideal protocol (up to local isometry)
y
a
x
b
A B
![Page 69: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/69.jpg)
CHSH is a strong self-test
• Self-test [Popescu,Rorhlick 1999]: Any q. strategy achieving cos2ᴨ/8 must be the ideal protocol (up to local isometry)
• Robust self-test [McKague et al., Miller-S, Reichardt et al. 2012],: Any q. strategy achieving close to cos2ᴨ/8 must be close to ideal
y
a
x
b
A B
![Page 70: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/70.jpg)
CHSH is a strong self-test
• Self-test [Popescu,Rorhlick 1999]: Any q. strategy achieving cos2ᴨ/8 must be the ideal protocol (up to local isometry)
• Robust self-test [McKague et al., Miller-S, Reichardt et al. 2012],: Any q. strategy achieving close to cos2ᴨ/8 must be close to ideal
• Strong (robust) self-test [Miller-S, Reichardt et al. 2012]: ϵ-close in prob implies O(√ϵ)-close to ideal (strongest possible)
y
a
x
b
A B
![Page 71: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/71.jpg)
Many other robust self-testsy
a
x
bA B
z
cC
![Page 72: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/72.jpg)
Many other robust self-testsy
a
x
bA B
z
cC
![Page 73: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/73.jpg)
Many other robust self-tests
•GHZ-game: classical 3/4 vs quantum 1
y
a
x
bA B
z
cC
![Page 74: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/74.jpg)
Many other robust self-tests
•GHZ-game: classical 3/4 vs quantum 1•Binary XOR games: input/output binary, XOR of output
bits determines game outcome
y
a
x
bA B
z
cC
![Page 75: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/75.jpg)
Many other robust self-tests
•GHZ-game: classical 3/4 vs quantum 1•Binary XOR games: input/output binary, XOR of output
bits determines game outcome•All strong delft-testing binary XOR games
characterized in [Miller, Shi 2012]
y
a
x
bA B
z
cC
![Page 76: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/76.jpg)
Self-testing sequential CHSH [Reichardt, Unger, Vazirani 2012]
Theorem [RUV12]If an average game wins with very close to quantum optimal, a random block of significant length is close to ideal tensor strategy.
y1
a1
x1
b1A B
y2
a2
x2
b2A B
y3
a3
x3
b3A B
yN
aN
xN
bNA B
time
![Page 77: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/77.jpg)
Self-testing graph states [McKague 2013]
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 78: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/78.jpg)
Self-testing graph states [McKague 2013]
•Graph statesFigure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 79: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/79.jpg)
Self-testing graph states [McKague 2013]
•Graph states•Each vertex corresponds to a qubit
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 80: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/80.jpg)
Self-testing graph states [McKague 2013]
•Graph states•Each vertex corresponds to a qubit•May be highly entangled
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 81: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/81.jpg)
Self-testing graph states [McKague 2013]
•Graph states•Each vertex corresponds to a qubit•May be highly entangled
•Robust self-testing
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 82: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/82.jpg)
Self-testing graph states [McKague 2013]
•Graph states•Each vertex corresponds to a qubit•May be highly entangled
•Robust self-testing•translated error depends on vertex number linearly.
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 83: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/83.jpg)
Toward untrusted-device quantum computation
random bitsdeterministic
Randomized algorithm
Quantumresource
restricted q.operations
Quantum algorithm
![Page 84: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/84.jpg)
Toward untrusted-device quantum computation
•Randomized algorithm = deterministic algorithm + random bits
random bitsdeterministic
Randomized algorithm
Quantumresource
restricted q.operations
Quantum algorithm
![Page 85: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/85.jpg)
Toward untrusted-device quantum computation
•Randomized algorithm = deterministic algorithm + random bits
•Quantum algorithm = quantum resources + restricted operations
random bitsdeterministic
Randomized algorithm
Quantumresource
restricted q.operations
Quantum algorithm
![Page 86: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/86.jpg)
Computation by Teleportation[Gottesman and Chuang 1999]
EPR pairs Bell-measurements +single-qubit operations
Quantum algorithm
![Page 87: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/87.jpg)
UD quantum computation by Self-testing sequential CHSH
[Reichardt, Unger, Vazirani 2012]
AB
Randomizedclassical Verifier
![Page 88: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/88.jpg)
UD quantum computation by Self-testing sequential CHSH
[Reichardt, Unger, Vazirani 2012]
AB
Randomizedclassical Verifier
• Mix sequential CHSH test with work for teleportation-based computation
![Page 89: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/89.jpg)
UD quantum computation by Self-testing sequential CHSH
[Reichardt, Unger, Vazirani 2012]
AB
Randomizedclassical Verifier
• Mix sequential CHSH test with work for teleportation-based computation• Not following
instruction risks failing the test
![Page 90: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/90.jpg)
UD quantum computation by Self-testing sequential CHSH
[Reichardt, Unger, Vazirani 2012]
AB
Randomizedclassical Verifier
• Mix sequential CHSH test with work for teleportation-based computation• Not following
instruction risks failing the test
• Honest device starts with EPR pairs, applies instructed measurements and single-qubit operations
![Page 91: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/91.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 92: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/92.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
•Each vertex is a device component
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 93: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/93.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
•Each vertex is a device component
•No communications among them
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 94: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/94.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
•Each vertex is a device component
•No communications among them
•A single message to and from each component
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 95: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/95.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
•Each vertex is a device component
•No communications among them
•A single message to and from each component
•Mix test with workFigure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 96: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/96.jpg)
UD quantum computation by Self-testing graph state
[McKague 2013]
Randomizedclassical Verifier
•Each vertex is a device component
•No communications among them
•A single message to and from each component
•Mix test with work•Honest device stores the
graph state, applies instructed measurements
Figure 1: A triangular lattice graph
Let us use the shorthand notation Mx =N
n
j=1
Mxj
j
, where x is an n-bit string, and Mj
operateson the j-th subsystem. Then the stabilizer group for |Gi is generated by the operators
Sv
= Xv
ZA1v . (4)
That is, Sv
has X on vertex v and Z on each of the neighbours of v. The stabilizers are productsof the generators, and have the form (�1)
12 t·AtXtZAt for some n-bit string t. In particular, if T is
a triangle in G with characteristic vector ⌧ then the operator �X⌧ZA⌧ is a stabilizer for |Gi.The graph states that we will be considering are triangular cluster states which are graph states
where the underlying graph is a triangular lattice such as in figure 1.
Triangular cluster state model - We will make use of the following theorem, due to Mahallaand Perdrix [MP12], which allows us to transform any quantum circuit into a measurement-basedquantum computation in a form which we can test.
Theorem 2 (Mahalla and Perdrix [MP12]). Triangular cluster states are universal resources formeasurement-based computation based on measurements X,Z, X±Zp
2
, and the number of vertices in
the cluster state is polynomial in the size of the original circuit we wish to perform.
The algorithm for making a measurement-based computation in this model is given in Algo-rithm 3. The measurement settings for each qubit M(L, x, a
1
, . . . av�1
) 2 {X,Z, X±Zp2
} and the
output RESULT(L, x, a1
. . . an
) can be computed in polynomial time. An important aspect of thisalgorithm is that the measurement settings are adaptive, meaning that the measurement settingfor vertex v can depend on the outcome of previously applied measurements.
Algorithm 3 CALCULATE(L, x)
Prepare a triangular cluster state of size n = poly(|x|)for v = 1 to n do
Measure vertex v in basis M(L, x, a1
. . . av�1
) to obtain outcome av
end for
Output RESULT(L, x, a1
. . . an
).
In order to put CALCULATE(L, x) into a form that we can test, we distribute the n-qubitcluster state to n provers, one vertex per prover. Honest provers will accept a measurement settingin {X,Z, X±Zp
2
}, measure their qubit in the specified basis, and return the result as ±1. For
the dishonest case, we will assume that the n provers are non-communicating and are limited toquantum operations (no “post-quantum” operations allowed.) We put no further restrictions onthe provers, and in particular we make no assumptions about the dimension of the Hilbert spaceof their states.
6
Submission number 133 to STOC 2014: DO NOT DISTRIBUTE!
![Page 97: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/97.jpg)
Randomness is vital
![Page 98: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/98.jpg)
Randomness is vital
•Digital security
![Page 99: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/99.jpg)
Randomness is vital
•Digital security
![Page 100: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/100.jpg)
Randomness is vital
•Digital security
•Randomized algorithms
![Page 101: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/101.jpg)
Randomness is vital
•Digital security
•Randomized algorithms
•Scientific simulations
![Page 102: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/102.jpg)
Randomness is vital
•Digital security
•Randomized algorithms
•Scientific simulations
•Gambling
![Page 103: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/103.jpg)
Wish list for randomness
![Page 104: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/104.jpg)
Wish list for randomness•High quality
![Page 105: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/105.jpg)
Wish list for randomness•High quality
![Page 106: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/106.jpg)
Wish list for randomness•High quality
•close to uniform
![Page 107: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/107.jpg)
Wish list for randomness•High quality
•close to uniform•secure
![Page 108: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/108.jpg)
Wish list for randomness•High quality
•close to uniform•secure•Crypto secure
![Page 109: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/109.jpg)
Wish list for randomness•High quality
•close to uniform•secure•Crypto secure
•Large quantity
![Page 110: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/110.jpg)
Wish list for randomness•High quality
•close to uniform•secure•Crypto secure
•Large quantity•1 trillion bits/day?
![Page 111: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/111.jpg)
Wish list for randomness•High quality
•close to uniform•secure•Crypto secure
•Large quantity•1 trillion bits/day?
•Minimum assumptions
![Page 112: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/112.jpg)
Wish list for randomness•High quality
•close to uniform•secure•Crypto secure
•Large quantity•1 trillion bits/day?
•Minimum assumptions•least amount of trust
![Page 113: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/113.jpg)
Widely used: Linux’s random number generator
Deterministic
Deterministic stretch
system boot timecurrent process id
user inputOn-chip circuit
![Page 114: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/114.jpg)
The perils of the lack of randomness and blinded trust
![Page 115: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/115.jpg)
The perils of the lack of randomness and blinded trust
•The lack of initial randomness has led to a large number of broken keys
![Page 116: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/116.jpg)
The perils of the lack of randomness and blinded trust
•The lack of initial randomness has led to a large number of broken keys
•Backdoors built-in chips and standards
![Page 117: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/117.jpg)
The perils of the lack of randomness and blinded trust
•The lack of initial randomness has led to a large number of broken keys
•Backdoors built-in chips and standards
•Security based on unproved computational assumptions
![Page 118: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/118.jpg)
The perils of the lack of randomness and blinded trust
•The lack of initial randomness has led to a large number of broken keys
•Backdoors built-in chips and standards
•Security based on unproved computational assumptions•vulnerable to advances in
algorithms and technology
![Page 119: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/119.jpg)
![Page 120: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/120.jpg)
How can we be sure it’s random?
![Page 121: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/121.jpg)
How can we be sure it’s random?
How could fundamentally unpredictable events possible?
![Page 122: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/122.jpg)
![Page 123: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/123.jpg)
We can’t be sure
![Page 124: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/124.jpg)
We can’t be sure… without believing
![Page 125: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/125.jpg)
We can’t be sure… without believingfirst of all its existence
![Page 126: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/126.jpg)
How can we generate a large number of provably
unconditional secure random bits with minimal assumptions?
![Page 127: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/127.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 128: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/128.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
•Classical theory of Randomness Extraction
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 129: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/129.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
•Classical theory of Randomness Extraction•Models weak source as min-entropy string
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 130: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/130.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
•Classical theory of Randomness Extraction•Models weak source as min-entropy string•Min-entropy=k: adversary can’t predict with > 2-k prob
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 131: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/131.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
•Classical theory of Randomness Extraction•Models weak source as min-entropy string•Min-entropy=k: adversary can’t predict with > 2-k prob
•Possible only when having 2 or more independent sources!
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 132: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/132.jpg)
Classical theory is inadequate: Independence requirement for min-
entropy sources
•Classical theory of Randomness Extraction•Models weak source as min-entropy string•Min-entropy=k: adversary can’t predict with > 2-k prob
•Possible only when having 2 or more independent sources!•How to be sure of independence? Impossible!
deterministic
Min-entropy source Min-entropy sourceMust be
independent!
![Page 133: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/133.jpg)
Can we get around the
independence requirement?
![Page 134: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/134.jpg)
Trusting quantum device solves almost all the problems
![Page 135: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/135.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness
![Page 136: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/136.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob
![Page 137: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/137.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob•Commercial products available
![Page 138: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/138.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob•Commercial products available• Problem: Should we trust
![Page 139: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/139.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob•Commercial products available• Problem: Should we trust
•the device not malicious?
![Page 140: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/140.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob•Commercial products available• Problem: Should we trust
•the device not malicious?•the device working properly?
![Page 141: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/141.jpg)
Trusting quantum device solves almost all the problems
•Postulates of quantum mechanics promise true randomness•Measuring the |+> state
gives 0/1 with equal prob•Commercial products available• Problem: Should we trust
•the device not malicious?•the device working properly?•trust the device maker and
the certifying agency?
![Page 142: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/142.jpg)
Randomness from untrusted quantum device
![Page 143: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/143.jpg)
Randomness from untrusted quantum device
Randomness Amplification[Colbeck and Renner 2012]
![Page 144: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/144.jpg)
Randomness from untrusted quantum device
Randomness Amplification[Colbeck and Renner 2012]
SV-source untrusted q. devices
one nearperfectrandom bit
![Page 145: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/145.jpg)
Randomness from untrusted quantum device
Randomness Amplification[Colbeck and Renner 2012]
• SV source: each bit of constant bias conditioned on previous bits
SV-source untrusted q. devices
one nearperfectrandom bit
![Page 146: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/146.jpg)
Randomness from untrusted quantum device
Randomness Amplification[Colbeck and Renner 2012]
• SV source: each bit of constant bias conditioned on previous bits
SV-source untrusted q. devices
one nearperfectrandom bit
Randomness Expansion[Colbeck 2006; Colbeck and Kent 2011]
![Page 147: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/147.jpg)
Randomness from untrusted quantum device
Randomness Amplification[Colbeck and Renner 2012]
• SV source: each bit of constant bias conditioned on previous bits
SV-source untrusted q. devices
one nearperfectrandom bit
Randomness Expansion[Colbeck 2006; Colbeck and Kent 2011]
Perfectrandomness untrusted
q. devices
more near perfectrandomness
![Page 148: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/148.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 149: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/149.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 150: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/150.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 151: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/151.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 152: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/152.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
• Device: multi-component
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 153: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/153.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
• Device: multi-component• User: deterministic
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 154: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/154.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
• Device: multi-component• User: deterministic
• can restrict communication among device components
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 155: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/155.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
• Device: multi-component• User: deterministic
• can restrict communication among device components
• Min-entropy source
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 156: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/156.jpg)
Framework for extracting untrusted quantum device
[Chung, Shi, Wu 2014]• Adversary: all powerful
• prepares/may entangle with device
• can’t talk to/change device after protocol starts
• Device: multi-component• User: deterministic
• can restrict communication among device components
• Min-entropy source• necessary; otherwise
Adversary can cheat
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 157: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/157.jpg)
Amplification and expansion seen in the framework
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 158: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/158.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 159: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/159.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
SV untrusted one bit
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 160: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/160.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
SV untrusted one bit
• Randomness Expansion: seeded extraction (classical source perfectly random)
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 161: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/161.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
SV untrusted one bit
• Randomness Expansion: seeded extraction (classical source perfectly random)
Perfectuntrusted
more
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 162: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/162.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
SV untrusted one bit
• Randomness Expansion: seeded extraction (classical source perfectly random)
Perfectuntrusted
more
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
Randomness to be extracted is in the device
![Page 163: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/163.jpg)
Amplification and expansion seen in the framework
• Randomness Amplification: seedless extraction with an SV source
SV untrusted one bit
• Randomness Expansion: seeded extraction (classical source perfectly random)
Perfectuntrusted
more
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
Randomness to be extracted is in the device
Used to unlock the randomness
![Page 164: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/164.jpg)
Goals: basic list
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 165: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/165.jpg)
Goals: basic list
1. Security: quantumAdversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 166: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/166.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 167: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/167.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
• Completeness error
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 168: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/168.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
• Completeness error• Soundness error,
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 169: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/169.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
• Completeness error• Soundness error,• Cryptographic security
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 170: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/170.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
• Completeness error• Soundness error,• Cryptographic security
3. Output length: extract full device capacity
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 171: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/171.jpg)
Goals: basic list
1. Security: quantum2. Quality: negligible errors
• Completeness error• Soundness error,• Cryptographic security
3. Output length: extract full device capacity
4. Classical source: arbitrary min-entropy source
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 172: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/172.jpg)
Goals: Premium listcritical for realization
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 173: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/173.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 174: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/174.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
• Model noise by deviation from ideal
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 175: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/175.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
• Model noise by deviation from ideal
6. Efficiency
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 176: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/176.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
• Model noise by deviation from ideal
6. Efficiency• Minimize device number
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 177: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/177.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
• Model noise by deviation from ideal
6. Efficiency• Minimize device number• Computationally efficient
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 178: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/178.jpg)
Goals: Premium listcritical for realization
5. Robustness: tolerate a constant-level device imprecision
• Model noise by deviation from ideal
6. Efficiency• Minimize device number• Computationally efficient
7. Quantum memory: the smaller needed the better
Adversary
deterministicmin-entropy
sourcealmost perfect
randomness
Device A
DeviceB
![Page 179: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/179.jpg)
Seeded extraction of Vazirani-Vidick [2012] and subsequent works
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 180: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/180.jpg)
Seeded extraction of Vazirani-Vidick [2012] and subsequent works
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
•1 device (2 components), play N sequential CHSH
N rounds of CHSH
![Page 181: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/181.jpg)
Seeded extraction of Vazirani-Vidick [2012] and subsequent works
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
•1 device (2 components), play N sequential CHSH
•choose a small number of games for testing ; others for generating
N rounds of CHSH
![Page 182: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/182.jpg)
Seeded extraction of Vazirani-Vidick [2012] and subsequent works
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
•1 device (2 components), play N sequential CHSH
•choose a small number of games for testing ; others for generating
•Test round: use random inputGenerating round: use constant
N rounds of CHSH
![Page 183: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/183.jpg)
Seeded extraction of Vazirani-Vidick [2012] and subsequent works
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
•1 device (2 components), play N sequential CHSH
•choose a small number of games for testing ; others for generating
•Test round: use random inputGenerating round: use constant
•Abort when losing too much in test rounds
N rounds of CHSH
![Page 184: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/184.jpg)
Self-testing and generating random numbers
y
a
x
b
A B
![Page 185: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/185.jpg)
Self-testing and generating random numbers
•Optimal quantum strategy: a is uniform (to adversary)
y
a
x
b
A B
![Page 186: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/186.jpg)
Self-testing and generating random numbers
•Optimal quantum strategy: a is uniform (to adversary)•by strong self-testing: close to optimal implies close
to uniform
y
a
x
b
A B
![Page 187: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/187.jpg)
Intuition for why it should work
![Page 188: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/188.jpg)
Intuition for why it should work
0
A B0
Generating
0011
A B
0011
Testing
![Page 189: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/189.jpg)
Intuition for why it should work
•Mix work and test: cheating on input 0 risks failing test
0
A B0
Generating
0011
A B
0011
Testing
![Page 190: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/190.jpg)
Intuition for why it should work
•Mix work and test: cheating on input 0 risks failing test
•Winning ratio of testing rounds good estimate for that of generating rounds
0
A B0
Generating
0011
A B
0011
Testing
![Page 191: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/191.jpg)
Intuition for why it should work
•Mix work and test: cheating on input 0 risks failing test
•Winning ratio of testing rounds good estimate for that of generating rounds
•Strong self-testing ensures randomness if many rounds’ strategy close to optimal
0
A B0
Generating
0011
A B
0011
Testing
![Page 192: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/192.jpg)
Intuition for why it should work
•Mix work and test: cheating on input 0 risks failing test
•Winning ratio of testing rounds good estimate for that of generating rounds
•Strong self-testing ensures randomness if many rounds’ strategy close to optimal
•Actual proof is very difficult
0
A B0
Generating
0011
A B
0011
Testing
![Page 193: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/193.jpg)
Intuition for why it should work
•Mix work and test: cheating on input 0 risks failing test
•Winning ratio of testing rounds good estimate for that of generating rounds
•Strong self-testing ensures randomness if many rounds’ strategy close to optimal
•Actual proof is very difficult
0
A B0
Generating
0011
A B
0011
Testing
really?
![Page 194: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/194.jpg)
Seeded extraction of Miller-Shi [2014]
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 195: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/195.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 196: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/196.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 197: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/197.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
• Constant size q. memory: allow in-between-rounds communications
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 198: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/198.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
• Constant size q. memory: allow in-between-rounds communications
• Any strong self-test can be used (including CHSH and GHZ)
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 199: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/199.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
• Constant size q. memory: allow in-between-rounds communications
• Any strong self-test can be used (including CHSH and GHZ)
• Translates to QKD: exponential expansion at the same timedeterministic
k uniform bits exp(kc)-bitsexp(-kc’) error
N rounds of CHSH
![Page 200: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/200.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
• Constant size q. memory: allow in-between-rounds communications
• Any strong self-test can be used (including CHSH and GHZ)
• Translates to QKD: exponential expansion at the same time
• Composed for unbounded expansiondeterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 201: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/201.jpg)
Seeded extraction of Miller-Shi [2014]
• Cryptographic security: errors = negligible in running time
• Robustness: OPT - constant winning prob. suffices
• Constant size q. memory: allow in-between-rounds communications
• Any strong self-test can be used (including CHSH and GHZ)
• Translates to QKD: exponential expansion at the same time
• Composed for unbounded expansion• Proof quite involved
deterministick uniform bits exp(kc)-bits
exp(-kc’) error
N rounds of CHSH
![Page 202: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/202.jpg)
Quantum-proof seeded extractors for min-entropy source
[De et al. 2012]
deterministic
min-entropy source
near uniform
shortseed
![Page 203: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/203.jpg)
Quantum-proof seeded extractors for min-entropy source
[De et al. 2012]
!
Trevisan’s Extractors still work against quantum adversaries
deterministic
min-entropy source
near uniform
shortseed
![Page 204: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/204.jpg)
Quantum Somewhere Randomness [Chung, Shi, Wu 2014]
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
Adversary
y1…0y0…0 y1…1
![Page 205: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/205.jpg)
Quantum Somewhere Randomness [Chung, Shi, Wu 2014]
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
Adversary
y1…0y0…0 y1…1
•The average of y’s is close to uniform to Adversary
![Page 206: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/206.jpg)
Quantum Somewhere Randomness [Chung, Shi, Wu 2014]
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
Adversary
y1…0y0…0 y1…1
•The average of y’s is close to uniform to Adversary•A y in an unknown location is close to uniform to
Adversary
![Page 207: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/207.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
Adversary
X YD
![Page 208: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/208.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
•If: X uniformly random to Device
Adversary
X YD
![Page 209: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/209.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
•If: X uniformly random to Device•could be known completely to
AdversaryAdversary
X YD
![Page 210: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/210.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
•If: X uniformly random to Device•could be known completely to
Adversary•Then: Y is close to uniform to all
except Device
Adversary
X YD
![Page 211: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/211.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
•If: X uniformly random to Device•could be known completely to
Adversary•Then: Y is close to uniform to all
except Device• In particular Y is random to
Adversary, even conditioned on X
Adversary
X YD
![Page 212: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/212.jpg)
Randomness Decoupling [Chung, Shi, Wu 2014]
•If: X uniformly random to Device•could be known completely to
Adversary•Then: Y is close to uniform to all
except Device• In particular Y is random to
Adversary, even conditioned on X
•Turn local randomness to global randomness
Adversary
X YD
![Page 213: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/213.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 214: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/214.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 215: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/215.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
• Delicate composition of quantum-proof extractors for min-entropy source and Randomness Decoupling
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 216: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/216.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
• Delicate composition of quantum-proof extractors for min-entropy source and Randomness Decoupling
• First create “quantum somewhere randomness”, then transformed to global randomness through Randomness Decoupling
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 217: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/217.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
• Delicate composition of quantum-proof extractors for min-entropy source and Randomness Decoupling
• First create “quantum somewhere randomness”, then transformed to global randomness through Randomness Decoupling
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
random to device
![Page 218: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/218.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
• Delicate composition of quantum-proof extractors for min-entropy source and Randomness Decoupling
• First create “quantum somewhere randomness”, then transformed to global randomness through Randomness Decoupling
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
random to device
random to all
![Page 219: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/219.jpg)
Seedless extraction of Chung-Shi-Wu [2014]
• Input: arbitrary min-entropy source
• Delicate composition of quantum-proof extractors for min-entropy source and Randomness Decoupling
• First create “quantum somewhere randomness”, then transformed to global randomness through Randomness Decoupling
• XORed with others still globally random
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
random to device
random to all
![Page 220: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/220.jpg)
Y
Equivalent
X
X
Y
Adversary
X
global-uniform
P works for global-uniform input if and only if P works for uniform-to-device input
Equivalence Lemma [Chung, Shi, Wu 2014]
X
Adversary
uniform to device
![Page 221: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/221.jpg)
Y
Equivalent
X
X
Y
Adversary
X
global-uniform
P works for global-uniform input if and only if P works for uniform-to-device input
Equivalence Lemma [Chung, Shi, Wu 2014]
• Copying X to Adversary commutes with P: b/c no interaction between Adversary and Device
X
Adversary
uniform to device
![Page 222: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/222.jpg)
Y
Equivalent
X
X
Y
Adversary
X
global-uniform
P works for global-uniform input if and only if P works for uniform-to-device input
Equivalence Lemma [Chung, Shi, Wu 2014]
• Copying X to Adversary commutes with P: b/c no interaction between Adversary and Device
• Uniform-to-device = Apply commuting operation on global-uniform
X
Adversary
uniform to device
![Page 223: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/223.jpg)
Implication of E.L: Instantiation of seedless extraction
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 224: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/224.jpg)
Implication of E.L: Instantiation of seedless extraction
• X needs only to have min-entropy against Devices
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 225: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/225.jpg)
Implication of E.L: Instantiation of seedless extraction
• X needs only to have min-entropy against Devices
• П can be any untrusted device expansion or KD protocol
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 226: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/226.jpg)
Implication of E.L: Instantiation of seedless extraction
• X needs only to have min-entropy against Devices
• П can be any untrusted device expansion or KD protocol•Vazirani-Vidick for
expansion (not robust)
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 227: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/227.jpg)
Implication of E.L: Instantiation of seedless extraction
• X needs only to have min-entropy against Devices
• П can be any untrusted device expansion or KD protocol•Vazirani-Vidick for
expansion (not robust)•Miller-Shi (robust)
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 228: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/228.jpg)
Implication of E.L: Instantiation of seedless extraction
• X needs only to have min-entropy against Devices
• П can be any untrusted device expansion or KD protocol•Vazirani-Vidick for
expansion (not robust)•Miller-Shi (robust)•Vazirani-Vidick for KD
(robust)
Min-entropy Source X
Ext
seed=1 · · · 0· · · · · ·Ext
seed=0 · · · 0Ext
seed=1 · · · 1
⇧
· · · · · ·⇧ ⇧
�^
Output YAccept/Abort G
X X
X
Y0···0 Y1···1Y1···0G0···0 G1···1G1···0
Figure 1: A physical extractor extracting from untrusted quantum devices and a min-entropysource. The input from the min-entropy source X is duplicated. Each copy is used as the in-put for an instance of a seeded quantum-proof randomness extractor Ext. For each possible valueof the extractor seed there is one instance of the extractor with the seed fixed to that value. Theoutput of each extractor instance is used as the input to a “randomness decoupling” (RD) protocol⇧. A RD protocol makes use of a untrusted quantum device and transforms an input random to thedevice to an output (almost perfectly) random to all systems other than the device. It also outputsa bit indicating Accept/Abort. We show several existing untrusted-device quantum protocols arerandomness decoupling. The output strings of the ⇧ protocols are XOR’ed to form the final outputstring. The protocol accepts if all the RD protocol accepts.
5
![Page 229: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/229.jpg)
Unbounded Expansion
![Page 230: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/230.jpg)
!!
• Straightforward by sequential composition • To get N bits need only O(log* N)
applications of an exp expanding protocol
• Seed length independent of N • Classically seed length >=log N
• Multiple-Device extraction • Not surprising in our view since
randomness comes from device
Unbounded Expansion
![Page 231: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/231.jpg)
!!
• Straightforward by sequential composition • To get N bits need only O(log* N)
applications of an exp expanding protocol
• Seed length independent of N • Classically seed length >=log N
• Multiple-Device extraction • Not surprising in our view since
randomness comes from device
X0
Y0,Y2,Y4,…Y2N
X1,X3,X5,…X2N+1
Y1,Y3,Y5,…Y2N-1
X2,X4,…X2NY2N+1D0 D1
Unbounded Expansion
![Page 232: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/232.jpg)
!!
• Straightforward by sequential composition • To get N bits need only O(log* N)
applications of an exp expanding protocol
• Seed length independent of N • Classically seed length >=log N
• Multiple-Device extraction • Not surprising in our view since
randomness comes from device
X0
Y0,Y2,Y4,…Y2N
X1,X3,X5,…X2N+1
Y1,Y3,Y5,…Y2N-1
X2,X4,…X2NY2N+1D0 D1
Unbounded Expansion
!!
• Reduce log*N to a constant? Cross-feeding composition problem: the output of D0 when used by D1 is not global-uniform [Fehr-Gelles-Schaffner’13]
• Constant-number-device Unbounded (non-robust) expansion first claimed by Coudron-Yuen [2013] • Use sequential rigidity of CHSH [RUV]
to transform device-uniform input to adversary-uniform output
![Page 233: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/233.jpg)
Implication of E.L.: Unbounded Expansion using 2 devices and any
sub-protocol
![Page 234: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/234.jpg)
Implication of E.L.: Unbounded Expansion using 2 devices and any
sub-protocol
X0
Y0,Y2,Y4,…Y2N
X1,X3,X5,…X2N+1
Y1,Y3,Y5,…Y2N-1
X2,X4,…X2NY2N+1D0 D1
![Page 235: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/235.jpg)
Implication of E.L.: Unbounded Expansion using 2 devices and any
sub-protocol
X0
Y0,Y2,Y4,…Y2N
X1,X3,X5,…X2N+1
Y1,Y3,Y5,…Y2N-1
X2,X4,…X2NY2N+1D0 D1
!!• Each output is random to the other device, ensuring next output is
globally random by E.L. • Any expansion protocol can be used:
• Vazirani-Vidick (not robust) • Miller-Shi (robust)
![Page 236: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/236.jpg)
Put together MS and CSW
Θ(k)-bit local randomness
CSWMS for
unbounded expansion
Adversary
k min-entropy
N-bit
exp(-kc)-close to uniform
2 devicesmany devices
![Page 237: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/237.jpg)
Put together MS and CSW
•Robust unbounded expansion from an arbitrary min-entropy source
Θ(k)-bit local randomness
CSWMS for
unbounded expansion
Adversary
k min-entropy
N-bit
exp(-kc)-close to uniform
2 devicesmany devices
![Page 238: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/238.jpg)
Put together MS and CSW
•Robust unbounded expansion from an arbitrary min-entropy source
•Based on an arbitrary strong self-test
Θ(k)-bit local randomness
CSWMS for
unbounded expansion
Adversary
k min-entropy
N-bit
exp(-kc)-close to uniform
2 devicesmany devices
![Page 239: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/239.jpg)
Adversarypublic
channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 240: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/240.jpg)
Adversary• Coordinate through public
channel
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 241: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/241.jpg)
Adversary• Coordinate through public
channel• Not a problem by
Equivalence Lemma
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 242: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/242.jpg)
Adversary• Coordinate through public
channel• Not a problem by
Equivalence Lemma• Leakage due to classical
post-processing
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 243: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/243.jpg)
Adversary• Coordinate through public
channel• Not a problem by
Equivalence Lemma• Leakage due to classical
post-processing• Miller-Shi
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 244: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/244.jpg)
Adversary• Coordinate through public
channel• Not a problem by
Equivalence Lemma• Leakage due to classical
post-processing• Miller-Shi
• expansion at the same time
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 245: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/245.jpg)
Adversary• Coordinate through public
channel• Not a problem by
Equivalence Lemma• Leakage due to classical
post-processing• Miller-Shi
• expansion at the same time
• Any strong self-test
public channel
BobAlice
Y Y
X
Untrusted Device Key Distribution [Vazirani, Vidick 2013], [Miller, Shi 2014]
![Page 246: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/246.jpg)
![Page 247: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/247.jpg)
Conclusions
![Page 248: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/248.jpg)
Conclusions
![Page 249: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/249.jpg)
Conclusions
•We may not want to trust quantum devices
![Page 250: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/250.jpg)
Conclusions
•We may not want to trust quantum devices
•Yet we can still make them work their magic
![Page 251: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/251.jpg)
Conclusions
•We may not want to trust quantum devices
•Yet we can still make them work their magic
•Many fundamental questions remain open
![Page 252: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/252.jpg)
Open Problems on robust self-testing
y
a
x
bA B
y1
a1
x1
b1A B
y2
a2
x2
b2A B
y3
a3
x3
b3A B
yN
aN
xN
bNA B
time
![Page 253: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/253.jpg)
Open Problems on robust self-testing
•Characterize all (robust) self-testing non-local games
y
a
x
bA B
y1
a1
x1
b1A B
y2
a2
x2
b2A B
y3
a3
x3
b3A B
yN
aN
xN
bNA B
time
![Page 254: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/254.jpg)
Open Problems on robust self-testing
•Characterize all (robust) self-testing non-local games•going beyond binary XOR
games and graph states
y
a
x
bA B
y1
a1
x1
b1A B
y2
a2
x2
b2A B
y3
a3
x3
b3A B
yN
aN
xN
bNA B
time
![Page 255: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/255.jpg)
Open Problems on robust self-testing
•Characterize all (robust) self-testing non-local games•going beyond binary XOR
games and graph states•Characterize all sequentially
self-testing games
y
a
x
bA B
y1
a1
x1
b1A B
y2
a2
x2
b2A B
y3
a3
x3
b3A B
yN
aN
xN
bNA B
time
![Page 256: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/256.jpg)
Open Problems on untrusted device q. computation
AB
Randomizedclassical Verifier
![Page 257: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/257.jpg)
Open Problems on untrusted device q. computation
•RobustnessAB
Randomizedclassical Verifier
![Page 258: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/258.jpg)
Open Problems on untrusted device q. computation
•Robustness•Quantum memory
AB
Randomizedclassical Verifier
![Page 259: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/259.jpg)
Open Problems on untrusted device q. computation
•Robustness•Quantum memory•Broader class of games
AB
Randomizedclassical Verifier
![Page 260: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/260.jpg)
Perfect Untrusted-Device Extractor?
![Page 261: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/261.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?
![Page 262: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/262.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source
![Page 263: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/263.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
![Page 264: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/264.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device
![Page 265: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/265.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device•Robust
![Page 266: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/266.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device•Robust•Constant quantum memory
![Page 267: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/267.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device•Robust•Constant quantum memory
•Output:
![Page 268: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/268.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device•Robust•Constant quantum memory
•Output: •Exponential expanding (or even more?)
![Page 269: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/269.jpg)
Perfect Untrusted-Device Extractor?
Is there a untrusted device protocol achieving the following simultaneously?•Classical source: arbitrary min-entropy source•Device (honest):
•Single (multi-part) device•Robust•Constant quantum memory
•Output: •Exponential expanding (or even more?)•Quantum crypto security
![Page 270: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/270.jpg)
Other open problems in untrusted-device extractors
![Page 271: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/271.jpg)
Other open problems in untrusted-device extractors
•Parameter limits and tradeoffs in seeded extraction
![Page 272: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/272.jpg)
Other open problems in untrusted-device extractors
•Parameter limits and tradeoffs in seeded extraction•output length in terms of entanglement
![Page 273: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/273.jpg)
Other open problems in untrusted-device extractors
•Parameter limits and tradeoffs in seeded extraction•output length in terms of entanglement•maximum output length for a fixed number of devices
![Page 274: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/274.jpg)
Other open problems in untrusted-device extractors
•Parameter limits and tradeoffs in seeded extraction•output length in terms of entanglement•maximum output length for a fixed number of devices
•Security proof based only on non-signaling (local changes will not affect other systems’ local behavior)
![Page 275: Untrusted quantum devices - Home | EECSweb.eecs.umich.edu/~shiyy/mypapers/untrusted-devices.pdfUntrusted quantum devices Yaoyun Shi University of Michigan updated Feb. 1, 2014 . Quantum](https://reader031.fdocuments.net/reader031/viewer/2022011723/5aa4fc3d7f8b9a185d8cb9ab/html5/thumbnails/275.jpg)
Physical Extractors: a new paradigm for randomness extraction
•Allow “physical sources” •Base security of the validity of physical theory •Any different systems?
deterministic physicalsources
Min-entropy sources
Near uniformbits