Download presentation

Presentation is loading. Please wait.

Published byYuliana Holloway Modified over 3 years ago

1
Quantum Information and the PCP Theorem Ran Raz Weizmann Institute

2
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

3
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

4
Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

5
x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

6
Part I: The Information of a Quantum State

7
Information of a Quantum State: A quantum state | i of n qubits is described by 2 n complex numbers. However, a measurement only gives n bits of information about | i (and the rest is lost) How much of the information in | i can be used ?

8
Holevo’s Theorem (1973): If Bob encodes a 1,..,a n by | i s.t. Alice can retrieve a 1,..,a n from | i then | i is a state of ¸ n qubits. If Alice retrieves each bit a i with prob 1- then | i is a state of ¸ [1-H( )] ¢ n qubits We can’t communicate n bits by sending less than n qubits

9
ANTV-Nayak’s Theorem (1999): If Bob encodes a 1,..,a n by | i s.t. 8 i Alice can retrieve a i from | i then | i is a state of ¸ n qubits. If Alice can retrieve each bit a i with prob 1- then | i is a state of ¸ [1-H( )] ¢ n qubits Holevo’s: Alice retrieves a 1,..,a n Nayak’s: Alice retrieves only one a i (of her choice)

10
Our Result: Bob can encode N=2 n bits a 1,..,a N by a state | i of O(n) qubits, s.t. 8 i, a i can be retrieved from | i by a (one round) Arthur-Merlin interactive protocol of size poly(n) (with a third party, Merlin) (classical messages) (polynomially small error)

11
Retrieving a i from | i : Alice measures | i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits)

12
Retrieving a i from | i : Alice measures | i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits) Bob is trustworthy (| i is correct) Merlin knows a 1,..,a N

13
More Generally: 1) Any constant number of elements from a 1,..,a N can be retrieved in the same way, by a protocol of size poly(n) 2) Any k elements can be retrieved by a protocol of size k ¢ poly(n) 3) Each a i can be 2 {1,..,N}

14
A Dequantumized Protocol: | i is not needed: Bob can send a (poly-size) random secret classical string , If Merlin doesn’t know The protocol works as before

15
Part II: The Retrieval Protocol

16
Multilinear Extension: Given a 0,..,a N (N=2 n -1) F = field of size n 2 A: F n ! F, s.t.: 1) 8 i 2 {0,1} n, A(i) = a i 2) A is multilinear (deg(A) · n)

17
Quantum Multilinear Extension: A= multilinear extension of a 0,..,a N 1) | i is a state of poly(n) qubits 2) When Alice measures | i, she gets z,A(z) for a random z 2 F n (Merlin doesn’t know z)

18
Retrieving A(i): Alice knows A(z) and wants A(i) l = the line through i,z (in F n ) A l : l ! F = restriction of A to l (deg(A l ) · n)

19
The Protocol: Alice sends l, Merlin is required to give A l : l ! F. Merlin answers by g : l ! F (deg(g) · n) If g(z) A l (z) Alice rejects Otherwise, Alice assumes A(i)=g(i) If g A l then w.h.p. g(z) A l (z) (since both are low degree) Otherwise, A(i) is correct

20
A Dequantumized Protocol: | i is not needed: Bob can send z,A(z), for a random z 2 F n (s.t., Merlin doesn’t know z) The protocol works as before

21
Part III: The Exceptional Power of QIP/qpoly

22
The Class QIP/qpoly: IP: [B][GMR] x 2 L can be proved by a poly-size interactive proof QIP: [Wat] x 2 L can be proved by a poly-size quantum interactive proof QIP/qpoly: x 2 L can be proved by a poly-size quantum interactive proof with poly-size quantum advice

23
Quantum Advice: (captures quantum non-uniformity) A (poly-size) quantum state | L,n i given to the verifier as an advice Alternatively, the verifier is a quantum circuit with working space initiated with | L,n i [NY],[Aar]: Limitations on BQP/qpoly

24
QIP/qpoly: QIP/qpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a poly-size quantum circuit with working space initiated with an arbitrary state | L,n i Our Result: QIP/qpoly contains all languages

25
Proof: Denote a i 2 {0,1}, a i =1 iff i 2 L | L,n i = the quantum multilinear extension of a 0,..,a N (N=2 n -1) a i can be retrieved from | L,n i by Arthur-Merlin interactive protocol of size poly(n) (one round, classical communication)

26
Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits

27
Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits IP/rpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a distribution over poly-size classical circuits IP/rpoly contains all languages

28
Part IV: Quantum Versions of the PCP Theorem

29
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

30
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

31
Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

32
We Show: x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

33
We Show: x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

34
Naive Attempt: a 1,..,a N = classical PCP (N=poly(n)) | i = quantum multilinear extension of a 1,..,a N O(log N) qubits p = Merlin’s answers in the retrieval protocol The verifier retrieves a constant number of bits by reading one block

35
Problem: The verifier can’t trust that | i is a quantum multilinear extension In the settings of communication or quantum advice, the verifier could trust that | i is correct. In the setting of PCP, | i can be anything e.g. | i is concentrated on a point

36
Quantum Low Degree Test: The verifier checks that | i is a quantum encoding of a low degree polynomial. This is done with the aid of the classical proof (or equivalently, a classical prover)

37
Problem: We are only allowed one query How can we do both: quantum low degree test and retrieval of bits We combine the two tasks using ideas from [DFKRS]

38
Part V: Scaling up to NEXP

39
Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state | i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring | i the verifier needs to read only one block of p

40
Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state | i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring | i the verifier needs to read only one block of p

41
Alternatively (for L 2 NEXP): x 2 L has a 3 messages (MAM) interactive proof, where the prover is quantum in round 1 and classical in round 2: 1) Prover sends | i 2) Verifier sends q 3) Prover answers p(q)

42
Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second

43
Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second IP(3) µ IP µ PSPACE QIP(3) µ QIP µ EXP [KW] Our result: HIP(3) = NEXP

44
Why the prover in our protocol can’t be quantum in both rounds ? A quantum prover can answer in round 2, based on a measurement of a state entangled to the state given in round 1 (fancy version of the EPR paradox)

45
The End

Similar presentations

OK

Cryptography In the Bounded Quantum-Storage Model Christian Schaffner, BRICS University of Århus, Denmark ECRYPT Autumn School, Bertinoro Wednesday, October.

Cryptography In the Bounded Quantum-Storage Model Christian Schaffner, BRICS University of Århus, Denmark ECRYPT Autumn School, Bertinoro Wednesday, October.

© 2018 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google

Ppt on credit default swaps aig Ppt on dc motor working animation Historical backgrounds for ppt on social media Download ppt on indian air force Ppt on articles in english grammar Ppt on chapter 3 atoms and molecules for kids Ppt on 7 wonders of the world 2012 Ppt on conservation of water resources Ppt on building information modeling degree Ppt on the art of war book