1. Quantum Information and the PCP Theorem Ran Raz Weizmann Institute

2. PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

3. PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

4. Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

5. x 2 SAT can be proved by 1) a log-size quantum state |  i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring |  i the verifier needs to read only one block of p

6. Part I: The Information of a Quantum State

7. Information of a Quantum State: A quantum state |  i of n qubits is described by 2 n complex numbers. However, a measurement only gives n bits of information about |  i (and the rest is lost) How much of the information in |  i can be used ?

8. Holevo’s Theorem (1973): If Bob encodes a 1,..,a n by |  i s.t. Alice can retrieve a 1,..,a n from |  i then |  i is a state of ¸ n qubits. If Alice retrieves each bit a i with prob 1-  then |  i is a state of ¸ [1-H(  )] ¢ n qubits We can’t communicate n bits by sending less than n qubits

9. ANTV-Nayak’s Theorem (1999): If Bob encodes a 1,..,a n by |  i s.t. 8 i Alice can retrieve a i from |  i then |  i is a state of ¸ n qubits. If Alice can retrieve each bit a i with prob 1-  then |  i is a state of ¸ [1-H(  )] ¢ n qubits Holevo’s: Alice retrieves a 1,..,a n Nayak’s: Alice retrieves only one a i (of her choice)

10. Our Result: Bob can encode N=2 n bits a 1,..,a N by a state |  i of O(n) qubits, s.t. 8 i, a i can be retrieved from |  i by a (one round) Arthur-Merlin interactive protocol of size poly(n) (with a third party, Merlin) (classical messages) (polynomially small error)

11. Retrieving a i from |  i : Alice measures |  i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits)

12. Retrieving a i from |  i : Alice measures |  i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits) Bob is trustworthy (|  i is correct) Merlin knows a 1,..,a N

13. More Generally: 1) Any constant number of elements from a 1,..,a N can be retrieved in the same way, by a protocol of size poly(n) 2) Any k elements can be retrieved by a protocol of size k ¢ poly(n) 3) Each a i can be 2 {1,..,N}

14. A Dequantumized Protocol: |  i is not needed: Bob can send a (poly-size) random secret classical string , If Merlin doesn’t know  The protocol works as before

15. Part II: The Retrieval Protocol

16. Multilinear Extension: Given a 0,..,a N (N=2 n -1) F = field of size n 2 A: F n ! F, s.t.: 1) 8 i 2 {0,1} n, A(i) = a i 2) A is multilinear (deg(A) · n)

17. Quantum Multilinear Extension: A= multilinear extension of a 0,..,a N 1) |  i is a state of poly(n) qubits 2) When Alice measures |  i, she gets z,A(z) for a random z 2 F n (Merlin doesn’t know z)

18. Retrieving A(i): Alice knows A(z) and wants A(i) l = the line through i,z (in F n ) A l : l ! F = restriction of A to l (deg(A l ) · n)

19. The Protocol: Alice sends l, Merlin is required to give A l : l ! F. Merlin answers by g : l ! F (deg(g) · n) If g(z)  A l (z) Alice rejects Otherwise, Alice assumes A(i)=g(i) If g  A l then w.h.p. g(z)  A l (z) (since both are low degree) Otherwise, A(i) is correct

20. A Dequantumized Protocol: |  i is not needed: Bob can send z,A(z), for a random z 2 F n (s.t., Merlin doesn’t know z) The protocol works as before

21. Part III: The Exceptional Power of QIP/qpoly

22. The Class QIP/qpoly: IP: [B][GMR] x 2 L can be proved by a poly-size interactive proof QIP: [Wat] x 2 L can be proved by a poly-size quantum interactive proof QIP/qpoly: x 2 L can be proved by a poly-size quantum interactive proof with poly-size quantum advice

23. Quantum Advice: (captures quantum non-uniformity) A (poly-size) quantum state |  L,n i given to the verifier as an advice Alternatively, the verifier is a quantum circuit with working space initiated with |  L,n i [NY],[Aar]: Limitations on BQP/qpoly

24. QIP/qpoly: QIP/qpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a poly-size quantum circuit with working space initiated with an arbitrary state |  L,n i Our Result: QIP/qpoly contains all languages

25. Proof: Denote a i 2 {0,1}, a i =1 iff i 2 L |  L,n i = the quantum multilinear extension of a 0,..,a N (N=2 n -1) a i can be retrieved from |  L,n i by Arthur-Merlin interactive protocol of size poly(n) (one round, classical communication)

26. Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits

27. Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits IP/rpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a distribution over poly-size classical circuits IP/rpoly contains all languages

28. Part IV: Quantum Versions of the PCP Theorem

29. PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

30. PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

31. Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

32. We Show: x 2 SAT can be proved by 1) a log-size quantum state |  i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring |  i the verifier needs to read only one block of p

33. We Show: x 2 SAT can be proved by 1) a log-size quantum state |  i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring |  i the verifier needs to read only one block of p

34. Naive Attempt: a 1,..,a N = classical PCP (N=poly(n)) |  i = quantum multilinear extension of a 1,..,a N O(log N) qubits p = Merlin’s answers in the retrieval protocol The verifier retrieves a constant number of bits by reading one block

35. Problem: The verifier can’t trust that |  i is a quantum multilinear extension In the settings of communication or quantum advice, the verifier could trust that |  i is correct. In the setting of PCP, |  i can be anything e.g. |  i is concentrated on a point

36. Quantum Low Degree Test: The verifier checks that |  i is a quantum encoding of a low degree polynomial. This is done with the aid of the classical proof (or equivalently, a classical prover)

37. Problem: We are only allowed one query How can we do both: quantum low degree test and retrieval of bits We combine the two tasks using ideas from [DFKRS]

38. Part V: Scaling up to NEXP

39. Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state |  i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring |  i the verifier needs to read only one block of p

40. Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state |  i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring |  i the verifier needs to read only one block of p

41. Alternatively (for L 2 NEXP): x 2 L has a 3 messages (MAM) interactive proof, where the prover is quantum in round 1 and classical in round 2: 1) Prover sends |  i 2) Verifier sends q 3) Prover answers p(q)

42. Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second

43. Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second IP(3) µ IP µ PSPACE QIP(3) µ QIP µ EXP [KW] Our result: HIP(3) = NEXP

44. Why the prover in our protocol can’t be quantum in both rounds ? A quantum prover can answer in round 2, based on a measurement of a state entangled to the state given in round 1 (fancy version of the EPR paradox)

45. The End