Certification of a functionality in a quantum network stage

IID. Protocol 1 (see section 3.3) implements n executions of a ping-pong procedure, each of them containing at most k rounds. In section 4 (prover-verifier view) we assume that the execution of each of these ping-pong procedures is independent of the others and identical. In particular, this means that the provers' strategy will be the same in every execution of the ping-pong procedure, i.e. their strategy is independent and identically distributed (IID) across executions. However, within one execution, the provers' strategy can involve arbitrary correlation across rounds. Furthermore, in section 5 (estimation view), we assume that every round of the ping-pong procedure is independent of the others, although does not have to be identical.

EPR pairs. The main objective in the quantum memory network stage is using quantum memory in the presence of local gates. Therefore, for simplicity, we assume that any pair of nodes can generate a perfect EPR pair between them. This assumption is strictly speaking not necessary, but merely serves as an aid in understanding our test. In section 5.5 we show how to remove this assumption and how the noise associated with an EPR pair can be absorbed into the noise of the quantum memory.

State preparation and measurement. For the same reasons as above, we also assume that any node can perfectly prepare a local qubit state and perfectly measure at the end of a protocol. In section 5.5 we also discuss how to relax this assumption.

Hilbert space dimension. For the sake of clarity, throughout the rest of the manuscript we will assume that protocols run on a single qubit. We remark that the results we present generalize for any number Q of qubits (for details see appendix G).

Device stability. In the estimation view section 5 (in particular in theorem 6) we assume that after the devices were tested with the ping-pong test, their behavior does not change. That is, the devices used during the test and in a k-round protocol are identical. Note that this can be understood as a consequence of the above IID assumption for the estimation view.

We start with formally describing k-round protocols. A bipartite k-round protocol between any two nodes A and B consists of the following consecutive operations:

• (a)  
  Local preparation PREP of a perfect qubit state |ψ⟩ by node A.
• (b)  
  Sending deterministically the local qubit from node A to node B and vice versa, using a quantum channel ${\mathcal{E}}_{A\to B}$. Note that the time t_send it takes to send a qubit (or a classical bit) from node A to B is upper-bounded by the distance between them and the transmission speed for the qubit carrier. For example, for optical qubits the transmission speed can be understood as the speed of photons in a fiber [3].
• (c)  
  Storing the local qubit by nodes A or B, denoted by M_A and M_B respectively. Storage of the qubit takes time t_M.
• (d)  
  Applying an arbitrary local operation by a node on the local qubit. We describe this operation by a gate G_A ∈ G and G_B ∈ G, where G is an arbitrary set of gates, for example the single-qubit Clifford gates. Executing a circuit of depth z takes time ℓ_z.
• (e)  
  Perfect local measurement of the local qubit at the end of the protocol. The measurements are specified by operators Π_A and Π_B for nodes A and B respectively.

Steps (b)–(d) are performed in rounds j = 1, ..., k a total number of k times. We call k the depth of the protocol. Each round takes time Δt = t_send + t_M + ℓ_z, so that t_j+1 − t_j = Δt, for all j. Without loss of generality we assume here that the protocols always start at node A. Note that the parity of j indicates at which node the single qubit is located, i.e., for odd j the qubit is held (sent) by A and for even j—by B. Therefore, we denote the local operations performed by A or B at a jth round by simply putting M_j, G_j. In particular, in this notation ${\mathcal{E}}_{j}$ means that a qubit is sent by A and received by B for odd j (${\mathcal{E}}_{j}\equiv {\mathcal{E}}_{{A}_{j}\to {B}_{j}}$), and vice-versa for even j.

Definition 1 (k-round protocols). We define a k-round protocol as a map of the form ${\Pi}{\circ}{\mathcal{P}}^{k}{\circ}\text{Prep}$, where:

• PREP is a preparation of a local qubit |ψ⟩ (step (a)).
• ${\mathcal{P}}^{k}$ is a map describing k rounds of local operations—memories M_j and gates G_j, as well as sending a qubit between A and B (steps (b)–(d)),
  $$\begin{equation}{\mathcal{P}}^{k}={{\lgwhtcircle}}_{j=1}^{k}\;{G}_{j}{\circ}{M}_{j}{\circ}{\mathcal{E}}_{j}.\end{equation} \tag{ 1 }$$
• Π is a local measurement of all the local qubits (step (e)). Note that depending on the parity of k the measurement is performed either on A's or B's side.

In this section we describe our ping-pong test. The test is a simple instance of a k-round protocol as in definition 1. As we will see in next sections, passing the test will allow us to draw conclusion about the whole class of k-round protocols.

Since our test will be later on viewed from two different angles, we introduce a node V which will interact with the nodes A and B. In the prover-verifier view, section 4, the node V will act as a verifier. Whereas, in the estimation view, section 5, the nodes A and B can take up the role of V. We choose the testing nodes A and B to be farthest apart in the network. For those nodes it is the hardest to fulfill the test, since they must account for the longest communication delays.

3.3.1. General ping-pong test

In our test, the task of the nodes is to send ('ping-pong') an unknown state an unknown number of times and at every ping-pong round apply a quantum operation given by V, see figure 1. Additionally, at every round V gives the nodes a challenge denoted by f—either to output the quantum state or continue the ping-pong. At the end of each execution of the test, i = 1, ..., n, the nodes output a state. V measures this output and produces a single classical bit vⁱ: 1 means 'accept' and 0 means 'reject', see test 1. As stated before, we assume that the nodes' operations are independent and identical across executions i of the test. This implies that vⁱ are independent and identically distributed (IID) random variables. We define a winning rate in such a game as the ratio of wins to the total number of executions:

$$\begin{equation}R=\frac{1}{n}\sum _{i=1}^{n}{v}^{i}.\end{equation} \tag{ 2 }$$

Zoom In Zoom Out Reset image size

Test 1. General ping-pong test (k, $\mathsf{G},\mathcal{X}$).

Fix maximum depth k, gate set G and set of states $\mathcal{X}$. Fix a total number of executions n.
1: for i = 1, ..., n do
2: V chooses depth κ uniformly at random and constructs a challenge string ${\to {f}}_{\kappa }=1\cdots 110$ of length κ
3: V samples independently κ gates from the set G and creates a sequence ${\to {g}}_{\kappa }={G}_{1}\cdots {G}_{\kappa }$
4: V samples a state $\vert \psi \rangle \in \mathcal{X}$ and distributes it to A	⊳ t1 = 0
5: for j = 1, ..., κ do
6:  if j odd then
7:   A sends |ψ〉 to B using ${\mathcal{E}}_{j}$	⊳ tj
8:   B stores the received state in memory Mj	⊳ tj + tsend
9:   V gives a classical description of Gj to B	⊳ tj + tsend + tM
10:   B applies Gj to the state in the memory
11:   V distributes a challenge bit fj ∈ {0, 1} to B according to the string ${\to {f}}_{\kappa }$	⊳ tj + tsend + tM + ℓ
12:   if fj = 1 then
13:    j = j + 1
14:    continue
15:   else
16:    B outputs his state
17:
18:    V decides on the value vi ('0' accept, '1' reject)
19:    break
20: else if j even then
21:   B sends |ψ〉 to A using ${\mathcal{E}}_{j}$	⊳ tj
22:   A stores the received state in memory Mj	⊳ tj + tsend
23:   V gives a classical description of Gj to A	⊳ tj + tsend + tM
24:   A applies Gj to the state in the memory
25:   V distributes a challenge bit fj ∈ {0, 1} to A according to the string ${\to {f}}_{\kappa }$	⊳ tj + tsend + tM + ℓ
26:   if fj = 1 then
27:    j = j + 1
28:    continue
29:   else
30:    A outputs her state
31:
32:    V decides on the value vi (‛0' accept, ‛1' reject)
33:    break

The ping-pong test of depth κ for a sequence of chosen gates ${\to {g}}_{\kappa }={G}_{1},\cdots ,\;{G}_{\kappa }$ can be associated with the following operator

$$\begin{equation}{\mathcal{S}}_{\kappa }={{\lgwhtcircle}}_{j=1}^{\kappa }\;{G}_{j}{\circ}{M}_{j}{\circ}{\mathcal{E}}_{j}.\end{equation} \tag{ 3 }$$

In a single execution of test 1, the test can succeed with a certain probability. For all executions i, we define such probability, conditioned on a specific input state |ψ⟩, a fixed depth κ and a fixed sequence of gates ${\to {g}}_{\kappa }$ as

$$\begin{equation}{p}_{{\checkmark}\vert \psi ,{\to {g}}_{\kappa },\kappa }=\mathrm{Tr}\left[{\mathcal{S}}_{\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{\kappa }^{{\checkmark}}\right]\end{equation} \tag{ 4 }$$

and similarly the probability of failure, . Note that ${p}_{{\checkmark}\vert \psi ,{\to {g}}_{\kappa },\kappa }$ does not depend on the execution i, since we assume that executions are IID. Here denotes the measurement performed by V at the end of each execution i. We fix the figure of merit to be the average probability P_✓ that the nodes succeed (v_i = 1) in the test.

Definition 2 (Average probability of success for test 1). The probability of success in the general ping-pong test, test 2, averaged over depths κ, strings of gates ${\to {g}}_{\kappa }$ of length κ, and states $\vert \psi \rangle \in \mathcal{X}$ is defined as

$$\begin{equation}\begin{aligned}\hfill {P}_{{\checkmark}}& =\frac{1}{n}\sum _{i}\frac{1}{k}\sum _{\kappa }\frac{1}{\vert \mathcal{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{G}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {g}}_{\kappa },\kappa }\hfill \\ \hfill & =\frac{1}{k}\sum _{\kappa }\frac{1}{\vert \mathcal{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{G}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {g}}_{\kappa },\kappa },\hfill \end{aligned}\end{equation} \tag{ 5 }$$

where the last equality holds due to the IID assumption. Here k is the maximum depth of the test, $\mathcal{X}$ is the chosen set of states and G is the chosen set of gates.

Test 2. Teleportation-based ping-pong test (k, Cliff, X).

Fix maximum depth k, fix the gate set to Clifford set Cliff and the set of states to the set of six Pauli states X. Fix
the total number of executions n.
1: for i = 1, ..., n do
2:  V chooses depth κ and constructs a challenge string ${\to {f}}_{\kappa }=1\cdots 110$ of length κ
3:  V samples independently and uniformly at random κ gates from the set Cliff and creates a sequence
$\quad \quad {\to {c}}_{\kappa }={C}_{1}\cdots {C}_{\kappa }$
4:  V samples independently and uniformly at random a state |ψ〉 ∈ X and distributes it to A	⊳ t1 = 0
5:  for j = 1, ..., κ do
6:  if j odd then
7:   A sends |ψ〉 to B using deterministic teleportation	⊳ tj
8:   B stores half of his teleportation EPR pair in memory ${M}_{j}^{\mathcal{T}}$ for time τ
9:   V gives a classical description of Cj to B	⊳ tj + τ
10:   B applies Cj to the state in the memory
11:   V distributes a challenge bit fj ∈ {0, 1} to B according to the string ${\to {f}}_{\kappa }$	⊳ tj + τ + ℓ
12:   if fj = 1 then
13:    Set B = A and A = B
14:    continue
15:   else
16:    B outputs his state
17:
18:    V decides on the value vi (‛0' reject, ‛1' accept)
19:    break
20:  else if j even then
21:   B sends |ψ〉 to A using deterministic teleportation	⊳ tj
22:   A stores half of her teleportation EPR pair in memory ${M}_{j}^{\mathcal{T}}$ for time τ
23:   V gives a classical description of Cj to A	⊳ tj + τ
24:   A applies Cj to the state in the memory
25:   V distributes a challenge bit fj ∈ {0, 1} to A according to the string ${\to {f}}_{\kappa }$	⊳ tj + τ + ℓ
26:   if fj = 1 then
27:    continue
28:   else
29:    A outputs her state
30:
31:    V decides on the value vi ('0' reject, '1' accept)
32:    break

3.3.2. Teleportation-based ping-pong test

In the case when $\mathcal{X}$ is the set of all single-qubit states, the average probability of success gives us an estimate on the average fidelity of the test, see section 5. This would require sampling from $\mathcal{X}$ according to the Haar measure in the test. However, the same can be achieved more efficiently, by using sampling from the finite set of the six Pauli states X. The reason for this is that X has a property of a 2-design, meaning that discrete uniform averaging over states (polynomials of degree 2) in X, reproduces the Haar average over the full state space. A similar observation holds for Haar sampling from a set of gates G in the case when G is a full unitary group. Then, it is enough to consider sampling from the Clifford group of single-qubit gates Cliff to reproduce the average probability of success. Note that this allows us to estimate the average fidelity of the test, even in the case when one is not able to implement the full unitary group. Lastly, we remark that any set of states and unitary gates with 2-design properties can be used in place of the Pauli states and Clifford gates. For more details on 2-design properties of the above sets see appendix D.

Therefore, we consider a more efficient version of the ping-pong test, test 2. Motivated by the above and the fact that for a quantum network quantum channels between the nodes are realized by quantum teleportation, we choose:

• (a)  
  The set of states is the set of six Pauli eigenstates, |ψ⟩ ∈ X with a uniform probability distribution $\frac{1}{\vert \mathsf{X}\vert }=\frac{1}{6}$;
• (b)  
  The set of gates is the Clifford set for a single qubit, C_j ∈ Cliff with a uniform probability distribution $\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}\vert }$;
• (c)  
  Sending a qubit from node A to B is done with perfect deterministic teleportation.

We describe the teleportation-based ping-pong test with a triple (k, Cliff, X). Note that in this case the quantum channel at round j, ${\mathcal{E}}_{j}$, is equivalent to applying a quantum memory ${M}_{j}^{\mathcal{T}}$ to a half of the EPR pair by one of the provers. We can put τ = t_M + t_send, which is the time required to generate one maximally entangled state and send over a classical message from node A to B. Hence, a teleportation-based ping-pong test of depth κ for a sequence of chosen Clifford gates ${\to {c}}_{\kappa }={C}_{1},\cdots ,\;{C}_{\kappa }$ can be associated with the following operator

$$\begin{equation}{\mathcal{T}}_{\kappa }={{\lgwhtcircle}}_{j=1}^{\kappa }\;{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}.\end{equation} \tag{ 6 }$$

For detailed mathematical description of the test, we refer the reader to appendix B.

By using definition 2 with the set of Pauli states X and the set of Clifford gates Cliff, the average probability of success for the teleportation-based ping-pong, test 2, is

$$\begin{equation}\begin{aligned}\hfill {P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }.\end{aligned}\end{equation} \tag{ 7 }$$

Note that in test 2 the sampling of depths, gates and states is done uniformly at random. Using the definition of the expected value and the IID assumption ($\forall i,j\;\mathbb{E}\left[{v}_{i}\right]=\mathbb{E}\left[{v}_{j}\right]$), we can write that the winning rate has the expected value .

Lemma 1. The expected value of the winning rate R in test 2, equation (2), is equal to the average probability of success P_✓,

$$\begin{equation}\mathbb{E}\left[R\right]={P}_{{\checkmark}}.\end{equation} \tag{ 8 }$$

Corollary 1 (Finite statistics). The probability that the winning rate R differs from the average probability of success P_✓ by more than is exponentially small in ,

$$\begin{equation}\mathrm{Pr}\left[\vert R-{P}_{{\checkmark}}\vert {\leqslant}{\epsilon}\right]{\geqslant}1-2{\mathrm{e}}^{-2n{{\epsilon}}^{2}}.\end{equation} \tag{ 9 }$$

Furthermore, let us set $\delta =2{\mathrm{e}}^{-2n{{\epsilon}}^{2}}$. If one fixes confidence δ and accuracy , then the minimum number of rounds n necessary to attain these parameters is given by $n{\geqslant}\frac{\mathrm{ln}\left(2{\delta }^{-1}\right)}{2{{\epsilon}}^{2}}.$

Let us now introduce a framework that formalizes what we mean by a round of a quantum communication. Whereas numerous schemes to describe local operations exist [4–10] it is not clear how to certify a round of quantum communication. To achieve this, we will assume that the provers are not honest, and might therefore employ an arbitrary strategy leading to a high probability of success. In particular, they might even try to not use a communication channel at all in some rounds of the protocol. As a consequence, we have to specify what we mean by a round of communication.

For sending classical bits one typically considers the following scenario: A chooses a random bit ${b}_{{A}_{0}}{\in }_{R}\left\{0,1\right\}$ at time t₀ and wishes to send it to B. We then say that the nodes used a classical channel ${\mathcal{E}}_{\mathrm{c}\mathrm{l}}:A\to B$ if the probability at time t₁ that B's bit is the same as A's, is equal to 1, $\mathrm{Pr}\left[{b}_{{B}_{1}}={b}_{{A}_{0}}\right]=1$. In analogy, we could say that quantum communication through a quantum channel $\mathcal{E}:{A}_{0}\to {B}_{1}$ occurred if at time t₀ a quantum state $\vert {\psi \rangle }_{{A}_{0}}$ was input on node A and at time t₁ it appeared on node B with probability 1, $\mathrm{Pr}\left[{\rho }_{{B}_{1}}=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right]=1$.

Note that in the classical case, we can prove that the channel was used to send information about the bit only for one round, by giving a uniformly random bit to A and ask B to guess it. Indeed if B guesses it with probability higher than 1/2 then some information must have traveled from A to B. Given a single bit as an input, one cannot generalize that to many rounds with a 'ping-pong' type of protocol like test 2. This is due to the fact that before A sends information to B in the first round, she can keep a copy of the bit. However, this issue can be avoided in a quantum setting due to the no-cloning theorem [17]. Indeed, if A gets a random unknown state and B is able to output the exact same state (with probability 1), then not only did all the (quantum) information about the state traveled from A to B, but also A could not have kept any information about the state to herself (see theorem 2).

While the above definition provides a good intuition of what is going on, it becomes impractical when states do not have a unit probability of being transmitted through a channel (which in relation to our test means t < 1). In such a scenario, classically, we can say that the nodes used a classical channel ${\mathcal{E}}_{\mathrm{c}\mathrm{l}}:{A}_{0}\to {B}_{1}$ if the probability of correctly identifying A's input bit on B's side increased in time, $\mathrm{Pr}\left[{\text{out}}_{{B}_{1}}={b}_{{A}_{0}}\right]{ >}\mathrm{Pr}\left[{\text{out}}_{{B}_{0}}={b}_{{A}_{0}}\right]$. This implies that some information about the bit must have been transferred from A to B, see figure 2. Our definition of quantum communication is, therefore, a generalization of the above to the quantum case. We say that quantum communication $\mathcal{E}:{A}_{0}\to {B}_{1}$ occurred if the probability of correctly outputting A's input quantum state on B's side increased in time, see definition 3.

Zoom In Zoom Out Reset image size

In words, we say that a sending channel was used by the nodes if the fidelity averaged over all states, and optimized over all operations Γ that the nodes can locally do, increased from instant t₀ to t₁. Note that the above definition implies that any communication, quantum or classical, which increases fidelity of the state is considered a sending channel. As an example consider the following strategy. Node A receives an unknown state from the verifier, measures it in the standard basis and sends the measurement outcome to B. Without loss of generality, let this measurement outcome be 0. Before receiving A's measurement outcome, B has average probability $\frac{1}{2}$ of correctly passing verifier's test. However, after receiving A's measurement outcome, B can locally prepare |0⟩ state which increases the average probability of correctly identifying verifier's state to $\frac{2}{3}$. Therefore, there exists a purely classical strategy which satisfies our definition. As a consequence, we say that whenever the nodes do not use a sending channel $\mathcal{E}$, no communication (quantum or classical) occurred between them.

Definition 3   (Sending channel). A channel ${\mathcal{E}}_{{A}_{0}\to {B}_{1}}$ is a sending channel if there exists a CPTP map ${{\Omega}}_{{A}_{0}\to {A}_{0}{B}_{0}}$ such that $\forall \vert {\psi \rangle }_{{A}_{0}}$ it creates a state ${\rho }_{{A}_{0}{B}_{0}}^{\psi }={\Omega}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right)$ and

$$\begin{equation}\underset{{{\Gamma}}_{{B}_{0}{B}_{1}}}{\mathrm{sup}}\int \mathrm{d}\psi \;\mathrm{Tr}\left[{{\Gamma}}_{{B}_{0}{B}_{1}}\left({\rho }_{{B}_{0}{B}_{1}}^{\psi }\right)\cdot \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right]{ >}\underset{{{\Gamma}}_{{B}_{0}}}{\mathrm{sup}}\int \mathrm{d}\psi \;\mathrm{Tr}\left[{{\Gamma}}_{{B}_{0}}\left({\rho }_{{A}_{0}{B}_{0}}^{\psi }\right)\cdot \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right],\end{equation} \tag{ 10 }$$

where ${\rho }_{{B}_{0}{B}_{1}}^{\psi }={\mathcal{E}}_{{A}_{0}\to {B}_{1}}\left({\rho }_{{A}_{0}{B}_{0}}^{\psi }\right)$, Γ is a CPTP map which traces out additional registers of A and B and outputs a qubit state. In particular, if

$$\begin{equation}\underset{{{\Gamma}}_{{B}_{0}{B}_{1}}}{\mathrm{sup}}\int \mathrm{d}\psi \;\mathrm{Tr}\left[{{\Gamma}}_{{B}_{0}{B}_{1}}\left({\rho }_{{B}_{0}{B}_{1}}^{\psi }\right)\cdot \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right]=1\quad \text{and}\quad \underset{{{\Gamma}}_{{B}_{0}}}{\mathrm{sup}}\int \mathrm{d}\psi \;\mathrm{Tr}\left[{{\Gamma}}_{{B}_{0}}\left({\rho }_{{A}_{0}{B}_{0}}^{\psi }\right)\cdot \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{0}}\right]=\frac{1}{2}\end{equation} \tag{ 11 }$$

then we talk about an exact sending channel.

Definition 4  (m-cheating). Provers A and B are m-cheating if their cheating strategy uses a sending channel $\mathcal{E}$ between them at most m times. We assume that the provers choose a strategy—in which round they use a sending channel and in which they do not—prior to the beginning of the test.

To investigate the power of test 2 in verifying capabilities of the network, we first consider an instructive case when P_✓ = 1. If the nodes are able to perfectly execute the test then they succeed with a unit probability, trivially satisfying the completeness, see theorem 1. On the other hand, if we demand that the nodes always succeed in the game, we can ask the question whether the nodes have the ability to perfectly execute protocols that have the form of test 2, i.e., whether the test is sound. We answer this question positively in theorem 2 below.

Theorem 1  (Exact completeness). If the provers are honest and they are able to perfectly execute test 2 then they succeed P_✓ = 1.

Theorem 2  (Exact soundness). If the provers win the test with P_✓ = 1 then they must be able to perfectly execute test 2 and they use an exact sending channel $\mathcal{E}$ between them k times.

Idea of the proof. To prove the theorem, we argue that P_✓ = 1 implies that the probability of winning ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$ for all states, all Clifford gates and all depths should be 1 (in particular, this implies that the provers are able to apply the required Clifford gates on the input state). Therefore, the average fidelity at every depth κ should be 1. That is, if at step κ − 1 A has fidelity 1 it means that the state on A is pure, and by a purifying argument, B's average fidelity at step κ − 1 must be 1/2. At step κ B has fidelity 1, which means that whatever channel A and B have used between step κ − 1 and κ, it must be an exact sending channel (see definition 3). For more details see appendix E.1. □

Note that in practice we are only able to observe the winning rate R and, due to the finite statistics of our test, we cannot certify P_✓ = 1.

Therefore, let us explore the implications of test 2, given that the winning rate R > t is observed. If the provers are honest and their devices are sufficiently good, their winning rate should be larger than threshold t with high probability. More specifically, let memories and gates at every round j be described in terms of the average fidelity. Assume that the quality of memory and gates is the same at every round j, i.e. for all j, the average fidelity $\overline{\mu }=\int \mathrm{d}\psi \mathrm{Tr}\left[{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {C}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]$. Below we show that for honest provers, a certain fidelity of operations implies a bound on the winning rate. In order to satisfy both completeness and soundness we choose the winning threshold $t{ >}\frac{5}{6}$, since the test 2 does not lead to any conclusion in the case when $t{\leqslant}\frac{5}{6}$, see theorem 4. Let ${h}_{k}\left(\overline{\mu }\right)=\frac{\overline{\mu }\left({\overline{\mu }}^{k}-1\right)}{k\left(\overline{\mu }-1\right)}$.

Theorem 3  (Completeness). If provers are honest and their individual operations satisfy $\overline{\mu }{\geqslant}{h}_{k}^{-1}\left(t\right)+{\epsilon}$, then the winning rate R in test 2 is bounded by R ⩾ t with probability at least $1-{\mathrm{e}}^{-n{{\epsilon}}^{2}}$, where $t\in \left(\frac{5}{6},1\right]$ is a winning threshold and is given by equation (9).

Idea of the proof. Using 2-design properties of the set of states X and the set of gates Cliff, we show that in the regime where fidelity $\overline{\mu }$ is the same for every round j, we can express the average probability of success as a sum of powers of $\overline{\mu }$. That is, ${P}_{{\checkmark}}=\frac{1}{k}{\sum }_{\kappa =1}^{k}{\overline{\mu }}^{\kappa }=\frac{\overline{\mu }\left({\overline{\mu }}^{k}-1\right)}{k\left(\overline{\mu }-1\right)}={h}_{k}\left(\overline{\mu }\right)$, see appendix E.2 for details. Since we want the winning rate R to be higher than the threshold t, we invert the function h_k to obtain a bound on the fidelity of the devices $\overline{\mu }$. We plot the inverse ${h}_{k}^{-1}\left(t\right)$ in figure 3 for $t\in \left(\frac{5}{6},1\right]$. □

Zoom In Zoom Out Reset image size

Moreover, we can ask whether the converse of the above statement is true, i.e. whether a certain winning rate R > t implies something about test 2. When the provers are honest, we can reverse the completeness statement obtaining a bound on the quality of their devices. If the provers are dishonest (m-cheating) then they do not have to exactly follow the test. However, in this case we will show that the winning rate R allows us to certify that the provers used a sending channel (definition 3) a certain number of times.

Theorem 4  (Soundness). If the provers are m-cheating then the winning rate in test 2 is bounded by $R{\leqslant}\frac{1}{k}\left(m+\frac{5}{6}\left(k-m\right)\right)+{\epsilon}$, with probability exponentially close to 1, i.e. at least $1-{\mathrm{e}}^{-n{{\epsilon}}^{2}}$, where ∈ (0, 1).

Idea of the proof. In the case when the provers are m-cheating they can agree on a cheating strategy which uses a quantum channel $\mathcal{E}$ between them at most m times, see definition 4. To prove soundness in this case we look at the average probability of winning for A and B at time steps κ − 1 and κ. In appendix E.2 we argue that whenever the provers use the channel $\mathcal{E}$, this probability is bounded by 1. On the other hand, whenever they do not use the channel and no communication occurred, we argue that the average probability of winning at both time steps is bounded by $\frac{5}{6}$ which is the bound provided by the approximate cloning theorem [18]. Since the nodes use the channel $\mathcal{E}$ at least m times, their overall average probability of winning P_✓ is bounded by $\frac{1}{k}\left(m+\frac{5}{6}\left(k-m\right)\right)$. □

The above theorem implies that in the situation when we do not trust the nodes, the higher m we would like to certify, the higher the winning threshold should be. Indeed, for P_✓ ⩾ t we obtain m ⩾ k(6t − 5). If we now set t = 1 − η, for some small η, then m ⩾ k − 6kη. For m ∼ k, one should set at least $\eta =\mathcal{O}\left({k}^{-1}\right)$.

Remark. Note that in theorem 2 we are able to fully certify the action of the provers, even if they are not trusted. In particular, we know that they have perfectly sent the state to each other k times. On the other hand, theorem 4 only certifies the use of some quantum or classical channel regardless of its quality. In particular, in the limit where P_✓ = 1, theorem 4 show that m = k sending channels have been used, but we cannot explicitly certify the quality of the channel. However, the exact soundness statement, theorem 2, suggests that even in the imperfect case, the test should be able to certify the quality of each individual operation used by the provers.

In this section we introduce mathematical tools which will be useful for (i) checking whether the test is consistent when the honest nodes use devices of a certain quality, section 5.2, and (ii) drawing conclusions about the performance of k-round protocols, sections 5.3 and 5.4.

We describe the quality of individual devices with a noise model. Specifically, we assume that the individual operations used in the test, i.e. memories M_j and gates C_j, have been tested individually for each round j, to obtain an estimate on their performance. More formally, let the quality of a noisy gate ${\tilde {C}}_{j}$ at round j, be described with the average fidelity, $\overline{F}\left({\tilde {C}}_{j}\right)=\int \mathrm{d}\psi \mathrm{Tr}\left[{\tilde {C}}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {C}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]$, for all j = 1, ..., k. Furthermore, let the average fidelity have an empirical estimate ${r}_{{C}_{j}}$, which is known with certain precision [19], such that

$$\begin{equation}\mathrm{Pr}\left[\vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert {\leqslant}{{\epsilon}}_{{C}_{j}}\right]{\geqslant}1-{\delta }_{{C}_{j}},\end{equation} \tag{ 12 }$$

where ${\delta }_{{C}_{j}}=2{\mathrm{e}}^{-2{n}_{{C}_{j}}{{\epsilon}}_{{C}_{j}}^{2}}$. Here ${n}_{{C}_{j}}$ is the number of repetitions with which the estimate ${r}_{{C}_{j}}$ was obtained. Similarly, for ${\tilde {M}}_{j}^{\mathcal{T}}$ a noisy quantum memory at round j, average fidelity is $\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)=\int \mathrm{d}\psi \mathrm{Tr}\left[{\tilde {M}}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]$. This average fidelity has an empirical estimate ${r}_{{M}_{j}^{\mathcal{T}}}$ and a precision bound

$$\begin{equation}\mathrm{Pr}\left[\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert {\leqslant}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\right]{\geqslant}1-{\delta }_{{M}_{j}^{\mathcal{T}}},\end{equation} \tag{ 13 }$$

where ${\delta }_{{M}_{j}^{\mathcal{T}}}=2{\mathrm{e}}^{-2{n}_{{M}_{j}^{\mathcal{T}}}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}^{2}}$. Furthermore, we assume that the nodes can locally and perfectly prepare and measure a quantum state.

The teleportation-based ping-pong test, test 2, is performed the total of n times. Note that one can easily record which executions i were performed for depths κ, states ψ and strings of Clifford gates ${\to {c}}_{\kappa }$. Then, in analogy to equation (2), we can define the winning rate for a fixed depth κ and string ${\to {c}}_{\kappa }$,

$$\begin{equation}{R}_{{\to {c}}_{\kappa },\kappa }=\frac{1}{{n}_{{\to {c}}_{\kappa },\kappa }}\sum _{i}{v}_{{\to {c}}_{\kappa },\kappa }^{i},\end{equation} \tag{ 14 }$$

where ${n}_{{\to {c}}_{\kappa },\kappa }$ is a total number of executions for fixed κ and ${\to {c}}_{\kappa }$, and ${v}_{{\to {c}}_{\kappa },\kappa }^{i}$ is a corresponding random variable assuming values 0 and 1 for 'lose' and 'win' events respectively. Analogously, we can record which executions correspond to a fixed depth κ only. We define

$$\begin{equation}{R}_{\kappa }=\frac{1}{{n}_{\kappa }}\sum _{i}{v}_{\kappa }^{i}\end{equation} \tag{ 15 }$$

as the winning rate for a fixed κ. Here n_κ is a total number of executions for depth κ and ${v}_{\kappa }^{i}$ is a corresponding random variable recording the wins in the test.

Now we will relate the above winning rates to the measures of quality of the test. Intuitively, the higher the winning rate the better the test performs and the less noise is present in the setup. In the remaining part of this section we make that statement rigorous.

Lemma 2. Let the average fidelity of a noisy realization of test 2, ${\tilde {\mathcal{T}}}_{\kappa }$, for a fixed depth κ and a fixed string of Clifford gates ${\to {c}}_{\kappa }$ be defined as ${\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)=\int \mathrm{d}\psi \mathrm{Tr}\left[{\tilde {\mathcal{T}}}_{\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{\kappa }^{{\checkmark}}\right]$, where ${\mathcal{T}}_{\kappa }$ is defined as in equation (6). The expected value of the winning rate ${R}_{{\to {c}}_{\kappa },\kappa }$ over the set of states X, is equal to the average fidelity of the test ${\tilde {\mathcal{T}}}_{\kappa }$,

$$\begin{equation}\mathbb{E}{\left[{R}_{{\to {c}}_{\kappa },\kappa }\right]}_{\mathsf{X}}={\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right).\end{equation} \tag{ 16 }$$

Idea of the proof. The first step of the proof is to notice that the expected value of the variable ${v}_{{\to {c}}_{\kappa },\kappa }^{i}$ is the probability of success in a single round averaged over all the states in X,

The second step is based on relating the above quantity to the average fidelity. Here the key idea is to observe that the expression under the trace contains only polynomials of degree 2 in $\left\vert \psi \right\rangle \left\langle \psi \right\vert$. Therefore one can use the 2-design properties of the set X to equate the discrete averaging over the six Pauli states to the continuous Haar averaging over the whole state space in average fidelity. The details of the proof can be found in appendix F.1.

The above lemma has a simple useful corollary, namely, that the average fidelity and the winning rate ${R}_{{\to {c}}_{\kappa },\kappa }$ can be related through the Hoeffding inequality,

$$\begin{equation}\mathrm{Pr}\left[\vert {R}_{{\to {c}}_{\kappa },\kappa }-{\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)\vert {\geqslant}{{\epsilon}}_{{\to {c}}_{\kappa },\kappa }\right]{\geqslant}1-2{\mathrm{e}}^{-2{n}_{{\to {c}}_{\kappa },\kappa }{{\epsilon}}_{{\to {c}}_{\kappa },\kappa }^{2}}.\end{equation} \tag{ 18 }$$

Before we make a similar connection for the rate R_κ, let us define a useful quantity.

Definition 5  (Double-averaged fidelity). Let ${\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)$ be the average fidelity of a the teleportation-based ping-pong test, test 2, defined for a fixed depth κ and a fixed sting of Clifford gates ${\to {c}}_{\kappa }$. We define the quantity

$$\begin{equation}{\overline{\overline{F}}}_{\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right){:=}\int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa }{\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right).\end{equation} \tag{ 19 }$$

as double-averaged fidelity. The averaging for every gate C_j is taken according to the Haar measure.

Lemma 3. The expected value of the winning rate R_κ in test 2, for a fixed depth κ, taken over the set of states X and set of Clifford gates, is equal to the double-averaged fidelity of the test ${\tilde {\mathcal{T}}}_{\kappa }$,

$$\begin{equation}\mathbb{E}{\left[{R}_{\kappa }\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}={\overline{\overline{F}}}_{\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right).\end{equation} \tag{ 20 }$$

The intuition behind the above lemma is that discrete averaging in $\mathbb{E}{\left[{R}_{\kappa }\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}$ over the Clifford gates is equal to the continuous averaging in the definition of ${\overline{\overline{F}}}_{\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)$. This statement follows from the unitary 2-design properties of the Clifford set, see appendix F.2 for details.

Finally, the probability that the empirical data R_κ differs from double-averaged fidelity by more than _κ is bounded by the Hoeffding inequality,

$$\begin{equation}\mathrm{Pr}\left[\vert {R}_{\kappa }-{\overline{\overline{F}}}_{\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)\vert {\leqslant}{{\epsilon}}_{\kappa }\right]{\geqslant}1-2{\mathrm{e}}^{-2{n}_{\kappa }{{\epsilon}}_{\kappa }^{2}}.\end{equation} \tag{ 21 }$$

In the following we demonstrate how to use the winning rates defined above to check for consistency, i.e. that devices with certain fidelities were used together in test 2. Specifically, we provide a relation between the quality of the test in terms of ${R}_{{\to {c}}_{\kappa },\kappa }$ and what one may expect given individual devices with estimates of average fidelities ${r}_{{M}_{j}^{\mathcal{T}}}$ and ${r}_{{C}_{j}}$. Not satisfying this consistency-check relation implies that there is an internal contradiction in the reported values of individual average fidelities and observed rate ${R}_{{\to {c}}_{\kappa },\kappa }$.

Theorem 5  (Consistency check). Let ${r}_{{M}_{j}^{\mathcal{T}}}$ and ${r}_{{C}_{j}}$, j = 1, ..., k, be empirical estimates of the average fidelity of all individual memories and gates respectively. Moreover let ${R}_{{\to {c}}_{\kappa },\kappa }$ be an empirical estimate of the average fidelity of the teleportation-based ping-pong test, test 2, for a fixed depth κ and a fixed string of Clifford gates ${\to {c}}_{\kappa }$. Devices with estimates ${r}_{{M}_{j}^{\mathcal{T}}}$ and ${r}_{{C}_{j}}$ were used together in the test ${\tilde {\mathcal{T}}}_{\kappa }$ if the following inequality is satisfied [20],

$$\begin{equation}{R}_{{\to {c}}_{\kappa },\kappa }{\geqslant}\frac{2\;{\mathrm{c}\mathrm{o}\mathrm{s}}^{2}\left(\sum _{j=1}^{\kappa }\mathrm{acos}\sqrt{\frac{3{r}_{{M}_{j}^{\mathcal{T}}}-1}{2}}+\mathrm{acos}\sqrt{\frac{3{r}_{{C}_{j}}-1}{2}}\right)+1}{3}-{{\epsilon}}_{{\to {c}}_{\kappa },\kappa }\end{equation} \tag{ 22 }$$

The bound holds for any 2κ quantum channels such that ${\sum }_{j=1}^{\kappa }\mathrm{acos}\sqrt{\frac{3{r}_{{M}_{j}^{\mathcal{T}}}-1}{2}}+\mathrm{acos}\sqrt{\frac{3{r}_{{C}_{j}}-1}{2}}{\leqslant}\frac{\pi }{2}$, and ${{\epsilon}}_{{\to {c}}_{\kappa },\kappa }$ is given by equation (18).

Recall that the individual estimates are known with certain confidence. That means that the above consistency check will be satisfied with a certain probability. We state it formally in the corollary below.

Corollary 2. Given the estimates of average fidelities for memories ${r}_{{M}_{j}^{\mathcal{T}}}$ and gates ${r}_{{C}_{j}}$ are known with confidence ${{\epsilon}}_{{M}_{j}^{\mathcal{T}}}$ and ${{\epsilon}}_{{C}_{j}}$ respectively, the bound from theorem 5 is satisfied by noisy devices with probability at least $1-2{\sum }_{j=1}^{\kappa }\left({\mathrm{e}}^{-2{n}_{{C}_{j}}{{\epsilon}}_{{C}_{j}}^{2}}+{\mathrm{e}}^{-2{n}_{{M}_{j}^{\mathcal{T}}}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}^{2}}\right)$.

Idea of the proof. The probability that the bound (22) is satisfied is equal to the unity, minus the probability that at least one of the bounds for individual devices is not satisfied. By properties of probability one arrives at the statement above, see appendix F.3 for details. □

In this section we investigate the implications of test 2 for the performance of more general k-round protocols ${\tilde {\mathcal{P}}}^{k}$, see definition 1. We show that their performance can be bounded using the winning rate R_κ (section 5.1) in the teleportation-based ping-pong test.

To explore the performance of protocols ${\tilde {\mathcal{P}}}^{k}$ we consider the diamond distance [21], $\parallel {\Pi}{\circ}{\tilde {\mathcal{P}}}^{k}{\circ}\text{Prep}-{\Pi}{\circ}{\mathcal{P}}^{k}{\circ}\text{Prep}{\parallel }_{\diamond }$. However, since Prep and Π are perfect by assumption, the above diamond distance is upper-bounded by $\parallel {\tilde {\mathcal{P}}}^{k}-{\mathcal{P}}^{k}{\parallel }_{\diamond }$, which we fix to be the figure of merit in this section. It can be shown that the diamond distance is related to the average fidelity in the following way [22],

$$\begin{equation}\parallel {\tilde {\mathcal{P}}}^{k}-{\mathcal{P}}^{k}{\parallel }_{\diamond }{\leqslant}2\sqrt{6}\sqrt{\left(1-{\bar{F}}_{k,{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\right)},\end{equation} \tag{ 23 }$$

where ${\overline{F}}_{k,{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)=\int \mathrm{d}\psi \mathrm{Tr}\left[{\tilde {\mathcal{P}}}^{k}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {\mathcal{P}}^{k}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]$ is the average fidelity of a protocol ${\tilde {\mathcal{P}}}^{k}$ of a fixed depth k and for a fixed string of gates ${\to {g}}_{k}$. Note that the average fidelity differs depending on the sequence of gates one chooses to apply. Therefore, to estimate the behavior of protocol ${\tilde {\mathcal{P}}}^{k}$ one would have to know fidelities ${\overline{F}}_{k,{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)$ for all possible gate sequences G₁, ..., G_k, which is unfeasible in practice. For this reason, it is much more convenient to use double-averaged fidelity to bound the performance of a protocol ${\tilde {\mathcal{P}}}^{k}$. We formalize this argument in the following theorem.

Theorem 6  (Performance of k-round protocols). The performance of single-qubit k-round protocols, definition 1, can be bounded in terms of an estimate for the double-averaged fidelity R_k of the k-round teleportation-based ping-pong test, test 2, in the following way

$$\begin{equation}\parallel {\tilde {\mathcal{P}}}^{k}-{\mathcal{P}}^{k}{\parallel }_{\diamond }{\leqslant}2\sqrt{6}\sqrt{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{k}\left(1-{R}_{k}+{{\epsilon}}_{k}\right)}\end{equation} \tag{ 24 }$$

where |Cliff| is the size of the Clifford group for dimension 2 and _k is given by equation (21). The bound is satisfied with probability $1-{\mathrm{e}}^{-2{n}_{\kappa }{{\epsilon}}_{\kappa }^{2}}$.

Idea of the proof. To prove the theorem, one first needs to observe that the double-averaged fidelity, $\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right)$, can be lower-bounded by ${\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)$ minimized over all possible strings of gates ${\to {g}}_{\kappa }$, see appendix F for details.

Moreover we have that ${\overline{\overline{F}}}_{k}\left({\tilde {\mathcal{P}}}^{k}\right)={\overline{\overline{F}}}_{\kappa =k}\left({\tilde {\mathcal{T}}}^{\kappa =k}\right)$. It follows from the fact that averaging over the Clifford group is equivalent to averaging over the entire unitary group, since the Clifford group forms a 2-design. Furthermore, the equality is possible, since we have put ${M}_{j}^{\mathcal{T}}\equiv {M}_{j}{\circ}{\mathcal{E}}_{j}$, and ${M}_{j}^{\mathcal{T}}$ encompasses operations associated with sending (in the test–teleporting) and storing the qubit. Combining the above with equations (20) and (23) yields the desired result. □

Finally, observe the above results can be straightforwardly generalized to bound the performance of protocols ${\tilde {\mathcal{P}}}^{K}$ for depth K > k. Since the teleportation-based ping-pong test is performed for all 1 ⩽ κ ⩽ k, we can define a set S such that ∑_κ∈Sκ = K. Then ${\tilde {\mathcal{P}}}^{K}={{\lgwhtcircle}}_{\kappa \in S}\;{\tilde {\mathcal{P}}}^{\kappa }$. Using the triangle inequality for the diamond distance, theorem 6 can be, therefore, rewritten as

$$\begin{equation}\parallel {\tilde {\mathcal{P}}}^{K}-{\mathcal{P}}^{K}{\parallel }_{\diamond }{\leqslant}2\sqrt{6}\sum _{\kappa \in S}\sqrt{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }\left(1-{R}_{\kappa }+{{\epsilon}}_{\kappa }\right)},\end{equation} \tag{ 25 }$$

where _κ is given by equation (21).

To gain intuition on how the test performs in this section we consider a few numerical examples. First, we discuss the implications of the consistency check, theorem 5 and articulate the relation between the average fidelity of individual devices and the maximal depth of the test k. Second, we discuss the performance of the test under common noise models, depolarizing and dephasing noise. Finally, we comment on bounding the noisy protocols ${\tilde {\mathcal{P}}}^{k}$ based on numerical results from the teleportation-based ping-pong test.

Assume a test of maximum depth k = 2, where we teleport a single qubit state at most two times between A and B. Moreover, for simplicity say that A and B have access to memories and gates of equal fidelities, ${r}_{{M}_{j}^{\mathcal{T}}}={r}_{{C}_{j}}=r$. Observe that the higher depth of the test κ, i.e. the more devices one is testing, the higher individual fidelities should be, see figure 4. Finally, note that the bound used for consistency check (22) was derived for a generic noise model and it was shown to be tight [20]. This means that if one does not have any additional knowledge about the noise present in the devices then the results presented here cannot be further improved.

Zoom In Zoom Out Reset image size

Let us now look at two specific noise models. Namely, let us model memories and gates to be (i) single-qubit depolarizing channels, i.e. $\mathcal{D}\left(\rho \right)=p\rho +\left(1-p\right)\mathbb{1}/2$ and (ii) single-qubit dephasing channels, i.e. $\mathcal{F}\left(\rho \right)=q\rho +\left(1-q\right)\left(Z\rho {Z}^{{\dagger}}\right)/2$, where Z is the Pauli Z gate. Again, in these two cases let us fix the average fidelity estimate of individual devices r. Figure 5 presents the simulated behavior of the test as a function of individual estimates r in the two cases. Observe that the test performs according to intuitive expectations—if the noise is modeled as dephasing, the average fidelity of the test is higher than in the case of depolarizing noise, since the dephasing channel subjects any input state only to the Z component of the Pauli noise, whereas depolarizing channel to all X, Y and Z components. Therefore, we expect 'more' noise when the state is subjected to the depolarizing noise.

Zoom In Zoom Out Reset image size

Although in our network model we assume that the state preparation is perfect, it is interesting to see the behavior of the test once imperfect states are used. Figure 5 shows a result of simulation of the test when the initial state is submitted to a small dephasing noise, such that fidelity of the input state is 0.9. Note that if one has access to the average fidelity estimate of the noisy channel acting on the initial state, then one can use it in the consistency check (22), simply treating the noise of the state as an additional channel in the protocol.

Let us also comment on the bound from theorem 6. Already for a single qubit one obtains a constant prefactor of $2\sqrt{d\left(d+1\right)}\approx 4.9$. In addition to that, bound (24) contains a factor associated with the size of the Clifford group—for a single qubit |Cliff| = 24. If one considers protocols of maximum depth k = 2 then to obtain a non-trivial bound on the behavior of protocols in the class, the estimate of double-averaged fidelity must be of order R_κ = 1–10⁻⁵. This puts a very high precision requirement on double-averaged fidelity and, consequently, on individual devices.

As an example consider the quantum gambling (QG) protocol [23]. In the protocol, A chooses one of the states {|0_z⟩, |0_x⟩} and sends it to B. After receiving the state B stores the state and communicates classically his guess on the state sent by A. A upon receiving the classical message from B, communicates back whether B won or lost. After this round of communication B measures the state either in Z basis or X basis. Let the protocol be described with a map ${\mathcal{P}}_{\mathrm{Q}\mathrm{G}}$ which consists of local operations on the state (except measurement and state preparation, as before). Then ${\mathcal{P}}_{\mathrm{Q}\mathrm{G}}$ consists of k = 2 rounds of communication during which B has to store the state. Assume that in the protocol quantum memory is modeled as a depolarizing channel with fidelity 1–10⁻⁵. Then explicit evaluation of the diamond distance $\parallel {\tilde {\mathcal{P}}}_{\mathrm{Q}\mathrm{G}}-{\mathcal{P}}_{\mathrm{Q}\mathrm{G}}{\parallel }_{\diamond }$ yields value 6 ⋅ 10⁻⁵. On the other hand if one uses a two-round test to bound the behavior of the protocol, without explicit a priori knowledge about the noise model of the memories then the bound from theorem 6 has the value 0.7436. However, note that in the quantum gambling protocol one does not perform any gates. Using this explicit knowledge about the protocol one could in principle tailor a ping-pong teleportation-based test without any gates. In this case, there would be no need to average over gates and therefore, the bound from theorem 6 would not carry the |Cliff|^k term. Consequently, the bound could be improved to value 0.0310.

In our network model we have assumed that state preparation, measurement, sending qubits as well as preparing an EPR pair can be done perfectly. In particular, this implies that in our test teleportation is carried out perfectly. However, the test can still be performed without major changes if one wishes to take into account noisy teleportation.

We consider two main noise sources arising in teleportation—noise coming from performing imperfect Bell measurement and recovery operation, and noise originating from creation of an EPR pair. In appendix C.1 we show that in a single round j of our test both of these noise types can be absorbed into the noise coming from the memory ${\tilde {M}}_{j}^{\mathcal{T}}$, for all j. For the former noise source we assume a noise model where the imperfections follow the Bell measurement but precede recovery operation. For the latter noise source, we assume that noise is local for each half of the EPR pair and that it can be modeled as mixed-unitary noise. That is, each half of the EPR pair is subjected to $N\left(\cdot \right)={\sum }_{l}{p}_{l}{U}_{l}^{{\dagger}}\left(\cdot \right){U}_{l}$, where U_l is a unitary operation, and p_l is a probability. Then all the teleportation noise can be included in the noise of the memory and we can carry out the test as described above, i.e. by sending qubits via perfect teleportation.

Similarly to the analysis outlined in the previous paragraph, we can treat the noise of the state preparation as if it arose in the teleportation. Indeed, one can absorb the noise in the initial state similarly to the analysis in appendix C.1. Note that in figure 5 we indicate what one might expect from the test if the initial state is noisy. As for the noise in the final measurement, if we consider that the noisy measurement is described by a noise map N followed by a perfect measurement, then N can be treated as another noisy memory applied to the state before measuring. In this case, the analysis carried out in lemma 7 of appendix D still holds.

Finally, we remark that our test can be extended onto multi-qubit settings, where the number of qubits in the k-round protocol is Q. For a detailed description we refer the reader to appendix G.

We describe a general test test 1 as a CPTP map which we will denote ${\mathcal{S}}_{\kappa }$. We first consider all the registers available to the nodes. We call κ the depth of the test and assume that κ is a natural number upper-bounded by given k. The time for performing one round j = 1, ..., κ of the protocol is equal for all the rounds, i.e. Δt = t_j+1 − t_j = t_send + t_M + ℓ.

We will describe a round where node A initiates sending of the state, which implies that j is odd. However, this description is fully symmetric and for even j it is enough to interchange registers of A with registers of B. A sends the qubit $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}$ to node B using channel ${\mathcal{E}}_{{A}_{j}^{\text{in}}\to {B}_{j}}$ which takes time upper-bounded by t_send. After time t_send + t_M the verifier chooses a gate according to distribution p_G and gives its classical description $\left\vert {g}_{j}\right\rangle {\left\langle {g}_{j}\right\vert }_{{G}_{j}}$ to B. B applies the quantum gate that corresponds to the description and that we describe with a CPTP map ${G}_{{G}_{j}{B}_{j}\to {G}_{j}}$. This takes time ℓ. After this, at time t_send + t_M + ℓ the verifier distributes a challenge bit $\left\vert {f}_{j}\right\rangle {\left\langle {f}_{j}\right\vert }_{{F}_{j}}$ chosen uniformly at random (0 means 'teleport back', 1 means 'output'). Depending on the challenge, B applies ${\mathrm{I}\mathrm{N}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j+1}^{\text{in}}}$ for f_j = 0 and ${\mathrm{O}\mathrm{U}\mathrm{T}}_{{F}_{j}{B}_{j}\to {B}_{j}^{\text{out}}}$ for f_j = 1.

Definition 10   (Honest round j). Round j of a general test, where provers are honest, can be described as

$$\begin{equation}{\hat{{\Lambda}}}_{{A}_{j}^{\text{in}}{F}_{j}{G}_{j}\to {B}_{j+1}^{\text{in}}}={\mathrm{I}\mathrm{N}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j+1}^{\text{in}}}{\circ}{G}_{{G}_{j}{B}_{j}\to {B}_{j}}{\circ}{M}_{{B}_{j}\to {B}_{j}}{\circ}{\mathcal{E}}_{{A}_{j}^{\text{in}}\to {B}_{j}}\end{equation} \tag{ B1 }$$

whenever the challenge bit is 0, or

$$\begin{equation}{\hat{{\Lambda}}}_{{A}_{j}^{\text{in}}{F}_{j}{G}_{j}\to {B}_{j}^{\text{out}}}={\mathrm{O}\mathrm{U}\mathrm{T}}_{{F}_{j}{B}_{j}\to {B}_{j}^{\text{out}}}{\circ}{G}_{{G}_{j}{B}_{j}\to {B}_{j}}{\circ}{M}_{{B}_{j}\to {B}_{j}}{\circ}{\mathcal{E}}_{{A}_{j}^{\text{in}}\to {B}_{j}}\end{equation} \tag{ B2 }$$

whenever the challenge bit is 1.

Note that challenge bits form a string of length κ, f₁...f_κ, in registers F₁...F_κ, consisting of κ − 1 ones and a single zero bit on κ-th position. We denote such a string by $\to {f}$, i.e. ${\to {f}}_{\kappa }=\underset{\kappa }{\underbrace{1\cdots 10}}$. For simplicity we will use a short notation for multiple registers, e.g. F_[1,κ] ≡ F₁...F_κ. Similarly, we will denote by ${\to {g}}_{\kappa }$ a sequence of κ gates chosen by the verifier, each of the gates chosen at the time step defined above. By G_[1,κ] ≡ G₁⋯G_k we denote k registers for the choice of a gate.

Definition 11 The ping-pong testing protocol of depth κ for a state $\left\vert \psi \right\rangle \left\langle \psi \right\vert \in \mathcal{X}$, a sequence of gates ${\to {g}}_{\kappa }\in {\mathcal{G}}^{\kappa }$ and a string of challenges ${\to {f}}_{\kappa }=1\cdots 10$ is defined as a CPTP map ${\mathcal{S}}_{\kappa }$ such that

$$\begin{equation}{\mathcal{S}}_{\kappa }\equiv {\mathcal{S}}_{{A}_{1}^{\text{in}}{F}_{\left[1,\kappa \right]}{G}_{\left[1,\kappa \right]}\to {B}_{\kappa }^{\text{out}}}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \left\vert {\to {f}}_{\kappa }\right\rangle {\left\langle {\to {f}}_{\kappa }\right\vert }_{{F}_{\left[1,\kappa \right]}}\otimes \left\vert {\to {g}}_{\kappa }\right\rangle {\left\langle {\to {g}}_{\kappa }\right\vert }_{{G}_{\left[1,\kappa \right]}}\right)\end{equation} \tag{ B3 }$$

$$\begin{equation}={\hat{{\Lambda}}}_{{A}_{j}^{\text{in}}{F}_{j}{G}_{j}\to {B}_{j}^{\text{out}}}{\circ}{{\lgwhtcircle}}_{j=1}^{\kappa -1}{\hat{{\Lambda}}}_{{A}_{j}^{\text{in}}{F}_{j}{G}_{j}\to {B}_{j+1}^{\text{in}}}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \left\vert {\to {f}}_{\kappa }\right\rangle {\left\langle {\to {f}}_{\kappa }\right\vert }_{{F}_{\left[1,\kappa \right]}}\otimes \left\vert {\to {g}}_{\kappa }\right\rangle {\left\langle {\to {g}}_{\kappa }\right\vert }_{{G}_{\left[1,\kappa \right]}}\right)\end{equation} \tag{ B4 }$$

We now describe a single round j of the test when the quantum communication is performed with teleportation, ${\mathcal{T}}_{\kappa }$ (see test 2). Let node A initiate the teleportation, i.e. j is odd. A round j starts with placing the state to be teleported $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}$ in an input register of A, ${A}_{j}^{\text{in}}$. Nodes generate an EPR pair between each other, ${{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}$. A, using the generated pair, teleports the state $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}$ to B by performing a Bell state measurement and sending a classical message m ∈ M. This action is described by a CPTP map ${\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}$. At the same time B applies quantum memory to his half of the EPR pair while waiting for the classical message from A to arrive, which takes time t_M. We describe the action of the memory with a CPTP map ${M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}$. Upon receiving classical message B now applies a recovery map ${\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}$ to recover the state which A teleported. Then, B applies a random gate chosen by the verifier from the set of Clifford gates Cliff(2). This choice is announced by the verifier with a classical register $\left\vert {c}_{j}\right\rangle {\left\langle {c}_{j}\right\vert }_{{C}_{j}}$. B then applies the gate to his recovered state, which we describe with a CPTP map ${C}_{{C}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}$. This operation takes time ℓ.

Now, at time t_M + ℓ the verifier announces a flag in register F_j with the challenge bit, 0: teleport back, 1: output. The choice of the challenge is uniform and random. Depending on the challenge, B applies ${\mathrm{I}\mathrm{N}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j+1}^{\text{in}}}$ for f_j = 0 and ${\mathrm{O}\mathrm{U}\mathrm{T}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{out}}}$ for f_j = 1. The whole round j takes time Δt = t_M + ℓ.

Definition 12   (Round j of the teleportation-based test). We define a jth round of teleportation as a sequence of following maps

$$\begin{equation}{{\Lambda}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}{F}_{j}{C}_{j}\to {B}_{j+1}^{\text{in}}}={\mathrm{I}\mathrm{N}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j+1}^{\text{in}}}{\circ}{C}_{{C}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\end{equation} \tag{ B5 }$$

whenever the challenge bit is 0, or

$$\begin{equation}{{\Lambda}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}{F}_{j}{C}_{j}\to {B}_{j}^{\text{out}}}={\mathrm{O}\mathrm{U}\mathrm{T}}_{{F}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{out}}}{\circ}{C}_{{C}_{j}{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\end{equation} \tag{ B6 }$$

whenever the challenge bit is 1.

Note that, for simplicity, in the main text we denote ${M}_{j}^{\mathcal{T}}={\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}$.

Having defined a single round of a protocol we describe the ping-pong teleportation protocol of depth κ. Such a protocol is simply a κ-round teleportation, where first κ − 1 maps have form (B5) and the last map outputs the state and so has the form (B6).

Definition 13. The teleportation-based ping-pong testing protocol of depth κ for a state $\left\vert \psi \right\rangle \left\langle \psi \right\vert \in \mathsf{X}$, a sequence of gates ${\to {c}}_{\kappa }\in {\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}^{\kappa }$ and a string of challenges ${\to {f}}_{\kappa }=1\cdots 10$ is defined as a CPTP map ${\mathcal{T}}_{\kappa }$ such that

$$\begin{equation}{\mathcal{T}}_{\kappa }\equiv {\mathcal{T}}_{{A}_{1}^{\text{in}}{A}_{\left[1,\kappa \right]}^{\text{EPR}}{B}_{\left[1,\kappa \right]}^{\text{EPR}}{F}_{\left[1,\kappa \right]}{C}_{\left[1,\kappa \right]}\to {B}_{\kappa }^{\text{out}}}={{\Lambda}}_{{A}_{\kappa }^{\text{in}}{A}_{\kappa }^{\text{EPR}}{B}_{\kappa }^{\text{EPR}}{F}_{\kappa }{C}_{\kappa }\to {B}_{\kappa }^{\text{out}}}{\circ}{{\lgwhtcircle}}_{j=1}^{\kappa -1}{{\Lambda}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}{F}_{j}{C}_{j}\to {B}_{j+1}^{\text{in}}}\end{equation} \tag{ B7 }$$

applied to the input state

$$\begin{equation}\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \underset{j=1}{\overset{\kappa }{\otimes }}{{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\otimes \left\vert {\to {f}}_{\kappa }\right\rangle {\left\langle {\to {f}}_{\kappa }\right\vert }_{{F}_{\left[1,\kappa \right]}}\otimes \left\vert {\to {c}}_{\kappa }\right\rangle {\left\langle {\to {c}}_{\kappa }\right\vert }_{{C}_{\left[1,\kappa \right]}}\end{equation} \tag{ B8 }$$

where Λ's are defined as in definition 12.

Upon receiving requested state from either A or B, V must check its consistency with the distributed state, as well as confirm applying desired gates. This can be achieved by projecting outcomes onto the state ${C}_{\kappa }{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }^{\text{out}}}$, which is the original state rotated with κ Clifford channels.

Definition 14   (POVM elements for the node V). Measurements performed by V in the teleportation-based ping-pong test can be described by POVM elements,

$$\begin{equation}{{\Pi}}_{{\checkmark}}^{\kappa }={C}_{\kappa }{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }^{\text{out}}}\end{equation} \tag{ B9 }$$

for all κ = 1, ..., k. κ denotes here the output register of the κ-th party, depending on the parity either A or B.

Now that we have formalized the testing protocol in detail, we will justify using notation for a teleportation channel used in the main text. That is, we will show that a teleportation channel with noisy memory acting on $\left\vert \psi \right\rangle \left\langle \otimes \right\vert {{\Phi}}^{+}$ can be viewed as a channel ${M}_{j}^{\mathcal{T}}$ acting only on $\left\vert \psi \right\rangle \left\langle \psi \right\vert$.

Recall definition 12. In a single round j of the protocol A performs a Bell measurement on the state $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}$ and her part of EPR pair. This action is described described by an operator ${\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}$, acting on two registers on A's side and producing a classical message m ∈ M which is then sent to B. The initial state $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}\otimes {{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}$ becomes

$$\begin{equation}\begin{aligned}\hfill {\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}\otimes {{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)& ={\mathrm{Tr}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}}\left[\sum _{m\in M}{p}_{m}{{{\Psi}}^{\prime }}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}},m}\otimes {\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M},\right]\hfill \\ \hfill & =\sum _{m\in M}{p}_{m}{\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{1}^{\text{EPR}}}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M}\hfill \end{aligned}\end{equation} \tag{ B11 }$$

where ${{{\Psi}}^{\prime }}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}},m}$ is one of four Bell states resulting from the Bell measurement, p_m ⩾ 0, ∑_mp_m = 1 is a probability of an outcome m occurring. ${\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}$ is a state on B's register after the Bell measurement. Note that this is simply a unitary applied to the initial state. $\left\vert m\right\rangle \left\langle m\right\vert$ is a classical message register, which A sends to B in order for him to correct the state. Next, B applies a memory ${M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}$ to his share of the state:

$$\begin{equation}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}\otimes {{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)={M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}\sum _{m\in M}{p}_{m}{\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M}\end{equation} \tag{ B12 }$$

$$\begin{equation}=\sum _{m\in M}{p}_{m}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M}\end{equation} \tag{ B13 }$$

Upon receiving a classical message m B undoes the unitary operations to recover the teleported state. This operation is described by a map ${\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}\left(\cdot \right)={\mathrm{Tr}}_{M}\left[{\sum }_{m}{U}_{m}\left(\cdot \right){U}_{m}^{{\dagger}}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M}\right]$,

$$\begin{equation}\begin{aligned}\hfill & {\mathcal{R}}_{M{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{j}^{\text{in}}}\otimes {{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\hfill \\ \hfill & \quad ={\mathrm{Tr}}_{M}\left[\sum _{m\in M}{p}_{m}{U}_{m}^{{\dagger}}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}{U}_{m}\otimes \left\vert m\right\rangle {\left\langle m\right\vert }_{M}\right]\hfill \\ \hfill & \quad =\sum _{m\in M}{p}_{m}{U}_{m}^{{\dagger}}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\left({U}_{m}\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}_{m}^{{\dagger}}\right)}_{{B}_{j}^{\text{EPR}}}{U}_{m}\hfill \\ \hfill & \quad =\sum _{m\in M}{p}_{m}{\mathcal{U}}_{m}^{{\dagger}}{\circ}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}{\circ}{\mathcal{U}}_{m}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)=:{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\hfill \end{aligned}\end{equation} \tag{ B14 }$$

Then, the test of depth κ can be described as in the main text

$$\begin{equation}{\mathcal{T}}^{\kappa }={\mathcal{T}}_{{A}_{1}^{\text{in}}{A}_{\left[1,\kappa \right]}^{\text{EPR}}{B}_{\left[1,\kappa \right]}^{\text{EPR}}{F}_{\left[1,\kappa \right]}{C}_{\left[1,\kappa \right]}\to {B}_{\kappa }^{\text{out}}}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \underset{j=1}{\overset{\kappa }{\otimes }}{{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\otimes \left\vert {\to {f}}_{\kappa }\right\rangle {\left\langle {\to {f}}_{\kappa }\right\vert }_{{F}_{\left[1,k\right]}}\otimes \left\vert {\to {c}}_{\kappa }\right\rangle {\left\langle {\to {c}}_{\kappa }\right\vert }_{{C}_{\left[1,k\right]}}\right)\end{equation} \tag{ B15 }$$

$$\begin{equation}\equiv {{\lgwhtcircle}}_{j=1}^{\kappa }{{\Lambda}}_{j}={{\lgwhtcircle}}_{j=1}^{\kappa }\;{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\end{equation} \tag{ B16 }$$

As it is often done in the estimation literature for quantum computing, see e.g. [8–10], we will model teleportation as a perfect operation followed (or preceded) by noise. This will allow us to consider teleportation as a perfect operation i.e. with perfect Bell measurement and recovery operation as well as perfect EPR pair, and absorb all the associated noise into the quantum memory.

C.1.1. Noisy operations

C.1.2. Noisy EPR pair

The situation is similar for a noisy EPR pair. Assume an EPR pair is affected by local noise, i.e. teleportation occurs on a state ${N}_{{A}_{j}^{\text{EPR}}}\otimes {N}_{{B}_{j}^{\text{EPR}}}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)$. Here the maps N are mixed-unitary channels, i.e. have the form $N\left(\cdot \right)={\sum }_{l}{p}_{l}{U}_{l}\left(\cdot \right){U}_{l}^{{\dagger}}$, with p_l being a probability and U_l a unitary. Note that this is not the most general type of noise, however the most common ones (e.g. depolarizing, dephasing) can be modeled this way. Moreover, note that for an EPR pair it holds that

$$\begin{equation}{U}_{{A}_{j}^{\text{EPR}}}\otimes {U}_{{B}_{j}^{\text{EPR}}}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)={\text{id}}_{{A}_{j}^{\text{EPR}}}\otimes {U}_{{B}_{j}^{\text{EPR}}}{U}_{{A}_{j}^{\text{EPR}}}^{T}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right).\end{equation} \tag{ C1 }$$

Therefore, using an explicit form of maps N and the above statement, we can write,

$$\begin{equation}{N}_{{A}_{j}^{\text{EPR}}}\otimes {N}_{{B}_{j}^{\text{EPR}}}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)=\sum _{l,{l}^{\prime }}{p}_{l,{l}^{\prime }}{U}_{{A}_{j}^{\text{EPR}}}\otimes {U}_{{B}_{j}^{\text{EPR}}}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C2 }$$

$$\begin{equation}=\sum _{l,{l}^{\prime }}{p}_{l,{l}^{\prime }}{\text{id}}_{{A}_{j}^{\text{EPR}}}\otimes {U}_{{B}_{j}^{\text{EPR}}}{U}_{{A}_{j}^{\text{EPR}}}^{T}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C3 }$$

$$\begin{equation}=:{\text{id}}_{{A}_{j}^{\text{EPR}}}\otimes {N}_{{B}_{j}^{\text{EPR}}}^{\prime }\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C4 }$$

In particular, this means that noise acting on the EPR pair, which has the mixed-unitary form, can be absorbed into the memory map,

$$\begin{equation}{M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}^{\prime }{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}{\circ}\left({N}_{{A}_{j}^{\text{EPR}}}\otimes {N}_{{B}_{j}^{\text{EPR}}}\right)\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C5 }$$

$$\begin{equation}\quad ={M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}^{\prime }{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}{\circ}\left({\text{id}}_{{A}_{j}^{\text{EPR}}}\otimes {N}_{{B}_{j}^{\text{EPR}}}^{\prime }\right)\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C6 }$$

$$\begin{equation}\quad ={M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}^{\prime }{\circ}{N}_{{B}_{j}^{\text{EPR}}}^{\prime }{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C7 }$$

$$\begin{equation}\quad \equiv {M}_{{B}_{j}^{\text{EPR}}\to {B}_{j}^{\text{EPR}}}^{{\prime\prime}}{\circ}{\mathcal{B}}_{{A}_{j}^{\text{in}}{A}_{j}^{\text{EPR}}\to M}\left({{\Phi}}_{{A}_{j}^{\text{EPR}}{B}_{j}^{\text{EPR}}}^{+}\right)\end{equation} \tag{ C8 }$$

Lemma 6. Averaging the probability of success for a single execution of test 2, ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$, over Pauli states is equal to averaging over all qubit states according to the Haar measure,

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\int \mathrm{d}\psi \;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }.\end{equation} \tag{ D1 }$$

Proof of lemma 2. We can write the left-hand side explicitly as,

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\mathrm{Tr}\left[{\mathcal{T}}_{\kappa }\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\right)\cdot {{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }^{\text{out}}}\right]\end{equation} \tag{ D2 }$$

where we explicitly write A and B's input and output registers. Let $X,Y\in \mathcal{L}\left(\mathcal{H}\right)$ be linear operators over the Hilbert space. The inner product ⟨X⟩Y := Tr[X^†Y] is invariant $\forall U:\mathcal{L}\left(\mathcal{H}\right)\to \mathcal{L}\left(\mathcal{H}\right)$, i.e. ⟨U(X)⟩U(Y) = Tr[(U(X))^† ⋅ U(Y)] = Tr[X^† ⋅ Y] = ⟨X⟩Y. Note that ${{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}$ is a unitary channel and therefore, we can write,

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\mathrm{Tr}\left[{\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{\mathcal{T}}_{\kappa }\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\right)\cdot {\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }^{\text{out}}}\right]\end{equation} \tag{ D3 }$$

$$\begin{equation}=\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\mathrm{Tr}\left[{\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{\mathcal{T}}_{\kappa }\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\right)\cdot \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{B}_{\kappa }^{\text{out}}}\right]\end{equation} \tag{ D4 }$$

Now, using Choi–Jamiolkowski theorem, see lemma 5, we can write

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\vert {A}_{1}^{{\text{in}}^{\prime }}\vert \mathrm{Tr}\left[\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{B}_{\kappa }^{\text{out}}}{\omega }_{{A}_{1}^{{\text{in}}^{\prime }}{B}_{\kappa }^{\text{out}}}^{{\Gamma}}\right]\end{equation} \tag{ D5 }$$

${\omega }_{{A}_{1}^{{\text{in}}^{\prime }}{B}_{\kappa }^{\text{out}}}^{{\Gamma}}$ is a Choi–Jamiolkowski state associated with the map ${\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{\tilde {\mathcal{T}}}_{\kappa }$. It is now clear that averaging is taken over a polynomial of degree 2 under the trace and we can use properties of a 2-design. Therefore,

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\int \mathrm{d}\psi \vert {A}_{1}^{{\text{in}}^{\prime }}\vert \mathrm{Tr}\left[\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\otimes \left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{B}_{\kappa }^{\text{out}}}{\omega }_{{A}_{1}^{{\text{in}}^{\prime }}{B}_{\kappa }^{\text{out}}}^{{\Gamma}}\right]\end{equation} \tag{ D6 }$$

$$\begin{equation}=\int \mathrm{d}\psi \mathrm{Tr}\left[{\mathcal{T}}_{\kappa }\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}_{1}^{\text{in}}}\right)\cdot {{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }^{\text{out}}}\right]\end{equation} \tag{ D7 }$$

$$\begin{equation}=\int \mathrm{d}\psi \;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }\end{equation} \tag{ D8 }$$

where we used Choi–Jamiolkowski isomorphism and properties of the trace again. We define ${\overline{F}}_{{\to {c}}_{\kappa },\kappa }=\int \mathrm{d}\psi \;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },kt}$ as the average fidelity. □

Now we will prove that averaging ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$ over the Clifford set reproduces averaging over the whole unitary set taken according to the Haar measure.

Lemma 7. Averaging the probability of success for a single execution of test 2, ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$, over Pauli states and over Clifford gates is equal to averaging over all qubit states and all 2-qubit unitary gates according to the Haar measure,

$$\begin{equation}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\int \mathrm{d}\psi \int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa }\;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }.\end{equation} \tag{ D9 }$$

Proof. Just like in the previous lemma, let us first use cyclicity of the trace,

$$\begin{equation}\text{LHS}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\;\mathrm{Tr}\left[{\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{\mathcal{T}}_{\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\end{equation} \tag{ D10 }$$

$$\begin{equation}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa }^{{\dagger}}{\circ}{C}_{\kappa }{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}{\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\end{equation} \tag{ D11 }$$

$$\begin{align}\hfill & \hfill =\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa -1}}\sum _{{C}_{1},\cdots ,{C}_{\kappa -1}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa -1}^{{\dagger}}{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}\right.\\ \hfill & \hfill \left.\quad {\times}{\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\end{align} \tag{ D12 }$$

$$\begin{align}\hfill & =\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa -1}}\sum _{{C}_{1},\cdots ,{C}_{\kappa -2}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa -2}^{{\dagger}}\left(\sum _{{C}_{\kappa -1}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{\kappa -1}^{{\dagger}}{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}\right)\right.\hfill \\ \hfill & \left.\quad {\times}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}{\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right],\hfill \end{align} \tag{ D13 }$$

where in the last step we pulled the summation over κ − 1 under the trace. Note that $\left({\sum }_{{C}_{\kappa -1}}{C}_{\kappa -1}^{{\dagger}}{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}\right)$ is an unnormalized twirl over Cliff and therefore it commutes with all Clifford gates C ∈ Cliff. By repeating pulling the summation under the trace, we can write,

$$\begin{align}\hfill \text{LHS}& =\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa -1}}\sum _{{C}_{1},\cdots ,{C}_{\kappa -3}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa -3}^{{\dagger}}\left(\sum _{{C}_{\kappa -2}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{\kappa -2}^{{\dagger}}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}{C}_{\kappa -2}\right)\right.\hfill \\ \hfill & \left.\quad {\circ}\left(\sum _{{C}_{\kappa -1}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{\kappa -1}^{{\dagger}}{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}\right),{\circ}{M}_{\kappa -2}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}{\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\hfill \end{align} \tag{ D14 }$$

$$\begin{equation}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa -1}}\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\sum _{{C}_{j}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right].\end{equation} \tag{ D15 }$$

Now we are left with a rather awkward map ${M}_{1}^{\mathcal{T}}$ which is not twirled. However, since the Haar measure is invariant under unitary transformations, for all E ∈ Cliff it holds that

$$\begin{equation}\text{LHS}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa -1}}\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\sum _{{C}_{j}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}{M}_{1}^{\mathcal{T}}{\circ}E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]\end{equation} \tag{ D16 }$$

$$\begin{equation}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{E\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\sum _{{C}_{j}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}{M}_{1}^{\mathcal{T}}{\circ}E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]\end{equation} \tag{ D17 }$$

where in the last line we used the fact that the value of the expression does not depend on E. Now, using cyclicity of the trace and commutativity properties of E, we get

$$\begin{equation}\text{LHS}=\int \mathrm{d}\psi \frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\sum _{{C}_{j}\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}\left(\sum _{E\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}{E}^{{\dagger}}{\circ}{M}_{1}^{\mathcal{T}}{\circ}E\right)\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right].\end{equation} \tag{ D18 }$$

Now we can change discrete averaging to the continuous one by definition of the unitary 2-design, see definition 8 and [27]. We have

$$\begin{equation}\text{LHS}=\int \mathrm{d}\psi \;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\int \mathrm{d}{C}_{j}\;{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}\left(\int \mathrm{d}E\;{E}^{{\dagger}}{\circ}{M}_{1}^{\mathcal{T}}{\circ}E\right)\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right].\end{equation} \tag{ D19 }$$

To get back to the expression for ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$, we can invert the procedure we just applied, i.e.

$$\begin{equation}\text{LHS}=\int \mathrm{d}\psi \int \mathrm{d}E\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\int \mathrm{d}{C}_{j}\;{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}\left({E}^{{\dagger}}{\circ}{M}_{1}^{\mathcal{T}}{\circ}E\right)\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]\end{equation} \tag{ D20 }$$

$$\begin{equation}=\int \mathrm{d}\psi \int \mathrm{d}E\;\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa -1}\left(\int \mathrm{d}{C}_{j}\;{C}_{j}^{{\dagger}}{\circ}{M}_{j+1}^{\mathcal{T}}{\circ}{C}_{j}\right){\circ}{M}_{1}^{\mathcal{T}}{\circ}E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot E\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]\end{equation} \tag{ D21 }$$

$$\begin{align}\hfill & \hfill =\int \mathrm{d}\psi \int \mathrm{d}E\int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa -1}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa -1}^{{\dagger}}{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}\right.\\ \hfill & \left.\quad {\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\hfill \end{align} \tag{ D22 }$$

$$\begin{align}\hfill & \hfill =\int \mathrm{d}\psi \int \mathrm{d}E\int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa -1}\;\mathrm{Tr}\left[{C}_{1}^{{\dagger}}{\circ}\cdots {\circ}{C}_{\kappa -1}^{{\dagger}}{\circ}{E}^{{\dagger}}{\circ}E{\circ}{M}_{\kappa }^{\mathcal{T}}{\circ}{C}_{\kappa -1}{\circ}{M}_{\kappa -1}^{\mathcal{T}}{\circ}\cdots {\circ}{C}_{1}\right.\\ \hfill & \left.\quad {\circ}{M}_{1}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\hfill \end{align} \tag{ D23 }$$

If now we put E = C_κ we obtain the desired result. We define ${\overline{\overline{F}}}_{\kappa }=\int \mathrm{d}\psi \int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa }\;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }$ as double-averaged fidelity. □

To keep this section more compact, we use notation from the main text. That is we express test 2 as ${\mathcal{T}}_{\kappa }={{\lgwhtcircle}}_{j=1}^{\kappa }\;{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}$, see equation (6).

Proof of theorem 1. First, we prove that test 2 is exactly correct when the winning threshold P_✓ = 1. That is, for honest A and B and for any 1 ⩽ κ ⩽ k after κ rounds the state that the verifier obtains at output κ is ${{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$. To prove this, we need to make sure that for all the rounds preceding κ the state at outputs j = 1, ..., κ are correct. The above can be proven by induction. For κ = 1 the verifier measures ${C}_{1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$. On the other hand, ${C}_{1}{\circ}{M}_{1}^{\mathcal{T}}={C}_{1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$, since the setup is perfect. Repeating this step inductively we get for all κ,

$$\begin{equation}{{\lgwhtcircle}}_{j=1}^{\kappa }\;{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)={{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\end{equation} \tag{ E1 }$$

Hence, P_✓ = 1. □

Before proving theorem 2 we formally prove a known fact related to no-cloning theorem [17].

Lemma 8. Let V_A→A'B be an arbitrary isometry, and let for any qubit state |ψ⟩_A, |Ψ⟩_A'B := V|ψ⟩_A. If for all |ψ⟩, ${\mathrm{Tr}}_{B}\left(\left\vert {\Psi}\right\rangle {\left\langle {\Psi}\right\vert }_{{A}^{\prime }B}\right)=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}$, then |Ψ⟩_A'B = |ψ⟩_A' ⊗ |junk⟩_B, where |junk⟩ is a pure state independent of |ψ⟩.

Proof. If the above is true for all |ψ⟩ it is in particular true for |0⟩, namely, V|0⟩ = |0⟩ ⊗ |σ₀⟩. Similarly V|1⟩ = |1⟩ ⊗ |σ₁⟩. When now computing the action of V on the state | + ⟩, we have $V\vert +\rangle =\frac{\vert 0\rangle \otimes \vert {\sigma }_{0}\rangle +\vert 1\rangle \otimes \vert {\sigma }_{1}\rangle }{\sqrt{2}}$. But since ${\mathrm{Tr}}_{B}\left(V\left\vert +\right\rangle {\left\langle V\right\vert }^{{\dagger}}\right)=\left\vert +\right\rangle \left\langle +\right\vert$, we must have |σ₀⟩ = |σ₁⟩ ≕ |junk⟩ □

Corollary 3. Let Ω_A→A'B be an arbitrary CPTP map, and let for any qubit state $\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{A}$, ${\rho }_{{A}^{\prime }B}{:=}{\Omega}\left(\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{A}\right)$. If for all |ψ⟩, ${\mathrm{Tr}}_{B}\left({\rho }_{{A}^{\prime }B}\right)=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}$, then ${\rho }_{{A}^{\prime }B}=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}\otimes {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}_{B}$, where junk is a state independent of $\left\vert \psi \right\rangle \left\langle \psi \right\vert$.

Proof. By Stinespring dilation ∃V_A→A'BE Ω(⋅) = Tr_E(V(⋅)V^†). Since ${\mathrm{Tr}}_{B}\left({\rho }_{{A}^{\prime }B}\right)=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}={\text{tr}}_{BE}\left(V\left\vert \psi \right\rangle \left\langle \psi \right\vert {V}^{{\dagger}}\right)$ we must have by the above lemma that $V\left\vert \psi \right\rangle \left\langle \psi \right\vert {V}^{{\dagger}}=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}\otimes \left\vert {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}^{\prime }\right\rangle {\left\langle {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}^{\prime }\right\vert }_{BE}$, and therefore ${\rho }_{{A}^{\prime }B}=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}\otimes {\mathrm{Tr}}_{E}\left(\left\vert {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}^{\prime }\right\rangle {\left\langle {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}^{\prime }\right\vert }_{BE}\right)=\left\vert \psi \right\rangle {\left\langle \psi \right\vert }_{{A}^{\prime }}\otimes {\mathrm{j}\mathrm{u}\mathrm{n}\mathrm{k}}_{B}$. □

Proof of theorem 2. Now we prove that test 2 is exactly sound. That is, if the average probability of success P_✓ = 1, then nodes A and B have the ability to correctly execute test 2. The intuition behind our proof is that challenges given by the verifier impose a certain structure on the provers strategy. We first show that if the nodes win the test with probability 1, then their strategy must produce the correct state at each time step κ. Then, we argue that this implies that the nodes must have passed the state around, and therefore use a quantum channel between them exactly κ times.□

Lemma 9. Let ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }$ be an arbitrary strategy of the provers, which can depend on the information available throughout the protocol, i.e. depth κ and Clifford string ${\to {c}}_{\kappa }$. If the average probability of success in test 2 is P_✓ = 1, then for all depths κ = 1, ..., k, all Clifford strings ${\to {c}}_{\kappa }$ and all input states ψ ∈ X, ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }$ outputs the correct state.

Proof. This statement is essentially the inverse of the exact completeness statement. Let us explicitly write the average probability of success,

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi \in \mathsf{X}}\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }\in {\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}^{\kappa }}\mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]=1.\end{equation} \tag{ E2 }$$

This implies that for all states, gates and depths the trace must be equal to 1,

$$\begin{equation}\forall \psi \in \mathsf{X},\;\forall {\to {c}}_{\kappa }\in {\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}^{\kappa },\;\forall \kappa =1,\cdots ,\;k:\quad \mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]=1.\end{equation} \tag{ E3 }$$

Therefore,

$$\begin{equation}\forall \psi \in \mathsf{X},\;\forall {\to {c}}_{\kappa }\in {\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}^{\kappa },\;\forall \kappa =1,\cdots ,\;k:\quad {\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)={C}_{\kappa }{\circ}\cdots {\circ}{C}_{1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\end{equation} \tag{ E4 }$$

and the state at every κ must be exactly the one requested by the verifier. □

Lemma 10. If the average probability of success in test 2 is P_✓ = 1, then for all depths κ = 1, ..., k, all Clifford strings ${\to {c}}_{\kappa }$ and all input states ψ ∈ X, ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }$ uses an exact sending channel κ times and apply an operation equivalent to the one described by ${\to {c}}_{\kappa }$.

Proof. In our test at every time step κ the provers must produce some state. Since at every time step a state has to be defined, ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }$ can be described by

$$\begin{equation}{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }={{\lgwhtcircle}}_{j=1}^{\kappa }{\mathcal{E}}_{{\to {c}}_{j},j}\end{equation} \tag{ E5 }$$

Let ${\hat{{\Gamma}}}_{{A}_{\kappa -1}}$ and ${\hat{{\Gamma}}}_{{B}_{\kappa -1},{B}_{\kappa }}$ denote CPTP maps which act on registers of A and B respectively, and output qubit states, and let ${{\Gamma}}_{{A}_{\kappa -1}}$ and ${{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}$ be ${\mathrm{Tr}}_{{B}_{\kappa -1},{B}_{\kappa }}\left[{\hat{{\Gamma}}}_{{A}_{\kappa -1}}\left(\cdot \right)\right]$ and ${\mathrm{Tr}}_{{A}_{\kappa -1}}\left[{\hat{{\Gamma}}}_{{B}_{\kappa -1},{B}_{\kappa }}\left(\cdot \right)\right]$ respectively. The above fact together with lemmas 6 and 10 implies that at time steps κ and κ − 1

$$\begin{equation}\int \mathrm{d}\psi \mathrm{Tr}\left[{\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }{\circ}{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]=1{\Rightarrow}\underset{{{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa }-1,{B}_{\kappa }}\left({\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]=1\end{equation} \tag{ E6 }$$

$$\begin{equation}\int \mathrm{d}\psi \mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]=1{\Rightarrow}\underset{{{\Gamma}}_{{A}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{A}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]=1\end{equation} \tag{ E7 }$$

Moreover, we have put ${\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }{:=}{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$ to denote a joint state of A and B at time step κ − 1. Observe that for all κ, ${{\Pi}}_{{\checkmark}}^{\kappa }={C}_{\kappa }{\circ}\cdots {\circ}{C}_{1}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$ projects onto a pure state. Therefore, for all κ, the states at output registers κ − 1 for A, and κ for B, must be pure,

$$\begin{equation}{{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}\left({\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)\right)={C}_{\kappa }{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{B}_{\kappa }}\end{equation} \tag{ E8 }$$

$$\begin{equation}{{\Gamma}}_{{A}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)={C}_{\kappa -1}{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{A}_{\kappa -1}}\end{equation} \tag{ E9 }$$

Let ${\sigma }^{\psi }=\left({\hat{{\Gamma}}}_{{A}_{\kappa -1}}\otimes \mathbb{1}\right)\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)$ be the joint state of A and B at time step κ − 1, and after applying ${\hat{{\Gamma}}}_{{A}_{\kappa -1}}$ on A. Using equation (E9) we have that,

$$\begin{equation}{\mathrm{Tr}}_{{B}_{\kappa -1}}\left({\sigma }^{\psi }\right)={C}_{\kappa -1}{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{A}_{\kappa -1}},\end{equation} \tag{ E10 }$$

which is a pure state on A, and therefore any extension of this state has tensor product form across A and B, in particular,

$$\begin{equation}{\sigma }^{\psi }={C}_{\kappa -1}{\circ}\cdots {\circ}{C}_{1}{\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)}_{{A}_{\kappa -1}}\otimes {\sigma }_{{B}_{\kappa -1}},\end{equation} \tag{ E11 }$$

where ${\sigma }_{{B}_{\kappa -1}}$ is a state on B independent of ψ by corollary 3. Therefore the (maximum) average fidelity of the state on B's side is,

$$\begin{equation}\underset{{{\Gamma}}_{{B}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]=\underset{{{\Gamma}}_{{B}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{\sigma }_{{B}_{\kappa -1}}\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]=\underset{{{\Gamma}}_{{B}_{\kappa -1}}}{\mathrm{sup}}\mathrm{Tr}\left[{\sigma }_{{B}_{\kappa -1}}\cdot \frac{\mathbb{1}}{2}\right]=\frac{1}{2}\end{equation} \tag{ E12 }$$

This, together with equation (E6), implies that ${\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }$ is an exact sending channel at time step κ. Since the statement holds for all κ, the provers necessarily use the exact sending channel k times.□

Proof of theorem 3. Completeness. As stated in the main text, we assume that the quality of operations is quantified by average fidelity and that at every round j the quality of operations is the same, i.e. for all j, $\overline{\mu }=\int \mathrm{d}\psi \mathrm{Tr}\left[{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {C}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\right]$. In the following we bound the average probability of success P_✓ in terms of $\overline{\mu }$. Let us write P_✓ explicitly,

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{\kappa }^{{\checkmark}}\right]\end{equation} \tag{ E13 }$$

From lemma 7 we have that

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }\int \mathrm{d}\psi \int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{\kappa }\mathrm{Tr}\left[{\left({{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}\right)}^{-1}{\circ}{{\lgwhtcircle}}_{j=1}^{\kappa }{C}_{j}{\circ}{M}_{j}^{\mathcal{T}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right],\end{equation} \tag{ E14 }$$

$$\begin{equation}=\frac{1}{k}\sum _{\kappa }\int \mathrm{d}\psi \mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa }\;\left(\int \mathrm{d}{C}_{j}\;{C}_{j}^{{\dagger}}{\circ}{M}_{j}^{\mathcal{T}}{\circ}{C}_{j}\right)\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right].\end{equation} \tag{ E15 }$$

Observe that ${\left({M}_{j}^{\mathcal{T}}\right)}_{\mathrm{t}\mathrm{w}\mathrm{i}\mathrm{r}\mathrm{l}}=\int \mathrm{d}{C}_{j}\;{C}_{j}^{{\dagger}}{\circ}{M}_{j}^{\mathcal{T}}{\circ}{C}_{j}$ is a twirl of the operator ${M}_{j}^{\mathcal{T}}$ [28]. Furthermore, twirling any map is equivalent to the action of a depolarizing channel, i.e. ${\left({M}_{j}^{\mathcal{T}}\right)}_{\mathrm{t}\mathrm{w}\mathrm{i}\mathrm{r}\mathrm{l}}\left(\rho \right)={\mathcal{D}}_{j}\left(\rho \right)=p\rho +\left(1-p\right)\mathbb{1}/2$, for some parameter p and any state ρ. Using properties of the depolarizing channel we can write,

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }\int \mathrm{d}\psi \mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa }{\left({M}_{j}^{\mathcal{T}}\right)}_{\mathrm{t}\mathrm{w}\mathrm{i}\mathrm{r}\mathrm{l}}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\end{equation} \tag{ E16 }$$

$$\begin{equation}=\frac{1}{k}\sum _{\kappa }\int \mathrm{d}\psi \mathrm{Tr}\left[{{\lgwhtcircle}}_{j=1}^{\kappa }{\mathcal{D}}_{j}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot \left\vert \psi \right\rangle \left\langle \psi \right\vert \right]\end{equation} \tag{ E17 }$$

$$\begin{equation}=\frac{1}{k}\sum _{\kappa }\prod _{j=1}^{\kappa }\overline{F}\left({\mathcal{D}}_{j}\right)\end{equation} \tag{ E18 }$$

$$\begin{equation}=\frac{1}{k}\sum _{\kappa }\prod _{j=1}^{\kappa }\overline{F}\left({\left({M}_{j}^{\mathcal{T}}\right)}_{\mathrm{t}\mathrm{w}\mathrm{i}\mathrm{r}\mathrm{l}}\right)\end{equation} \tag{ E19 }$$

Additionally, the average fidelity of a twirled map is equal to the average fidelity of the same map without a twirl [28], therefore, ${P}_{{\checkmark}}=\frac{1}{k}{\sum }_{\kappa }{\prod }_{j=1}^{\kappa }\overline{F}\left({M}_{j}^{\mathcal{T}}\right)$. By assumption, $\forall j\;\overline{F}\left({M}_{j}^{\mathcal{T}}\right)=\overline{\mu }$, and

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{k}\sum _{\kappa }{\overline{\mu }}^{\kappa }=\frac{1}{k}\frac{\overline{\mu }\left({\overline{\mu }}^{k}-1\right)}{k\left(\overline{\mu }-1\right)}={h}_{k}\left(\overline{\mu }\right).\end{equation} \tag{ E20 }$$

If we demand that P_✓ ⩾ t then $\overline{\mu }{\geqslant}{h}_{k}^{-1}\left(t\right)$. □

Proof of theorem 4. Soundness. In the case when the nodes A and B are honest, the soundness statement is the converse of the completeness, see the proof above. Here we prove soundness of test 2 in the case when the nodes are dishonest (m-cheating). Just like before, we will assume that output for a fixed κ happens at node B.

The idea behind this proof is that we bound the average probability of success of the provers when they use a quantum channel between them, and when they do not. More specifically, let ${\rho }_{{A}_{\kappa -1}^{\text{out}}}$ be a state available at A's output at time step κ − 1 and ${\rho }_{{B}_{\kappa }}^{\text{out}}$ be a state available at B's at time step κ. We show that whenever the provers use the channel, the average fidelity between these two states is bounded by 1. However, whenever they do not use the channel, the average fidelity between these two states is at most as large as the average fidelity between the states at time step κ − 1, i.e. ${\rho }_{{A}_{\kappa -1}^{\text{out}}}$ and ${\rho }_{{B}_{\kappa -1}^{\text{out}}}$. This average fidelity is intrinsically bounded by the approximate cloning theorem [18], and here takes value $\frac{5}{6}$. If the provers are m-cheating, they use the channel between at least m times. We prove that, as a consequence, their overall average probability of winning P_✓ is upper-bounded by $\frac{1}{k}\left(m+\frac{5}{6}\left(k-m\right)\right)$.

When the provers are m-cheating they adapt an arbitrary strategy ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m}$ which depends on the maximum number of channel uses m between the nodes. It can also depend on all the information available throughout the protocol, i.e. the challenges and gates distributed by the verifier. We assume that the executions of the test are IID (independent and identically distributed) and the probability of winning a single execution i = 1, ..., n is expressed as

$$\begin{equation}\forall \;{\to {c}}_{\kappa },\kappa ,\psi \quad {p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m}\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right].\end{equation} \tag{ E21 }$$

The configuration of channel uses, i.e. at which time step the provers use the channel between them, does not need to be fixed. At each execution, the provers can choose a particular strategy ${\mathcal{Q}}^{m,\nu }$ which describes a configuration ν of channel uses between the nodes. We assume that the provers are non-adaptive and throughout an execution i their strategy does not change. Therefore, the fact whether the provers choose to send the state or not, is independent of the information available throughout the protocol. I.e. ν is independent of κ and ${\to {c}}_{\kappa }$, and we have q_ν ⩾ 0, ∑_νq_ν = 1, such that

$$\begin{equation}{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m}=\sum _{\nu }{q}_{\nu }{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }.\end{equation} \tag{ E22 }$$

Note that there are $\left(\genfrac{}{}{0pt}{}{k}{m}\right)$ such strategies. Furthermore, let us define

$$\begin{equation}{p}_{{\checkmark}\vert \nu ,\psi ,{\to {c}}_{\kappa },\kappa }{:=}\mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right].\end{equation} \tag{ E23 }$$

Let us rewrite the average probability of success, equation (7),

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{2}\left(\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }+\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }\right).\end{equation} \tag{ E24 }$$

Now, we will move the summation in the second component of the sum over κ—instead of going through (1, 2, ..., k − 1, k) we will set it to go (k, 1, 2, ..., k − 1),

$$\begin{equation}{P}_{{\checkmark}}=\frac{1}{2}\left(\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }+\frac{1}{k}\sum _{\kappa =k}^{k-1}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }\right).\end{equation} \tag{ E25 }$$

Let us define ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{0},0}{:=}1$ for round κ = 0, which one can interpret as simply giving the state to node A and immediately requesting it back. Now since for κ = k it holds that ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{k},k}{\leqslant}1$, we have ${p}_{{\checkmark}\vert \psi ,{\to {c}}_{k},k}{\leqslant}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{0},0}$. Therefore,

$$\begin{equation}{P}_{{\checkmark}}{\leqslant}\frac{1}{2}\left(\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }+\frac{1}{k}\sum _{\kappa =0}^{k-1}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }\right).\end{equation} \tag{ E26 }$$

Now we write the expression as a single summation,

$$\begin{equation}{P}_{{\checkmark}}{\leqslant}\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\frac{{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }+{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa -1},\kappa -1}}{2}\end{equation} \tag{ E27 }$$

$$\begin{equation}=\sum _{\nu }{q}_{\nu }\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{X}\vert }\sum _{\psi }\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\frac{1}{2}\left({p}_{{\checkmark}\vert \nu ,\psi ,{\to {c}}_{\kappa },\kappa }+{p}_{{\checkmark}\vert \nu ,\psi ,{\to {c}}_{\kappa -1},\kappa -1}\right)\end{equation} \tag{ E28 }$$

$$\begin{equation}=\sum _{\nu }{q}_{\nu }\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\frac{1}{2}\left({\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }+{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}\right)\end{equation} \tag{ E29 }$$

In line (E28) we used the linearity property of the trace, and in line (E29) we used 2-design properties of the set X (see argument in section 6) together with the fact that ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }$ does not depend on the state.

In our test at every time step κ the provers must produce some state. Since at every time step a state has to be defined, ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }$ can be described by

$$\begin{equation}{\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }={{\lgwhtcircle}}_{j=1}^{\kappa }{\mathcal{E}}_{{\to {c}}_{j},j}^{m,\nu }\end{equation} \tag{ E30 }$$

Now our goal is to bound the probability of winning P_✓ if ${\mathcal{Q}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }$ has exactly m sending channels $\mathcal{E}$, as defined in definition 3. We will consider two cases: when the channel $\mathcal{E}$ is a sending channel and when it is not.

• (a)  
  $\mathcal{E}$ is a sending channel. In this case the provers can output the correct state at both time steps, κ − 1 and κ. Therefore, in this case we use the trivial bound that each of the fidelities is upper-bounded by 1, and

  $$\begin{equation}\frac{1}{2}\left({\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }+{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}\right){\leqslant}1.\end{equation} \tag{ E31 }$$
• (b)  
  $\mathcal{E}$ is not a sending channel. Consider average fidelity expressions at time steps κ and κ − 1 for the same execution i, and assume that κ is odd and output is requested at B's side. Each of the fidelities can be upper-bounded by its supremum,

  $$\begin{equation}{\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }=\int \mathrm{d}\psi \mathrm{Tr}\left[{\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }{\circ}{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]\end{equation} \tag{ E32 }$$

  $$\begin{equation}{\leqslant}\underset{{{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa }-1,{B}_{\kappa }}\left({\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]\end{equation} \tag{ E33 }$$

  and

  $$\begin{equation}{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}=\int \mathrm{d}\psi \mathrm{Tr}\left[{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]\end{equation} \tag{ E34 }$$

  $$\begin{equation}{\leqslant}\underset{{{\Gamma}}_{{A}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{A}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right].\end{equation} \tag{ E35 }$$

  Here ${{\Gamma}}_{{A}_{\kappa -1}}$ and ${{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}$ denote CPTP maps which trace out additional registers of A and B and output a qubit state. Moreover, we have put ${\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }{:=}{\mathcal{Q}}_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu }\left(\left\vert \psi \right\rangle \left\langle \psi \right\vert \right)$ to denote a joint state of A and B at time step κ − 1.

According to definition 3 if the channel is not sending then we can bound

$$\begin{equation}\underset{{{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa -1},{B}_{\kappa }}\left({\mathcal{E}}_{{\to {c}}_{\kappa },\kappa }^{m,\nu }\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]{\leqslant}\underset{{{\Gamma}}_{{B}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa }\right]\end{equation} \tag{ E36 }$$

and hence,

$$\begin{align}\hfill \frac{1}{2}\left({\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }+{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}\right)& {\leqslant}\frac{1}{2}\left(\underset{{{\Gamma}}_{{B}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{B}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]\right.\hfill \\ \hfill & \hfill \left.\quad +\underset{{{\Gamma}}_{{A}_{\kappa -1}}}{\mathrm{sup}}\int \mathrm{d}\psi \mathrm{Tr}\left[{{\Gamma}}_{{A}_{\kappa -1}}\left({\rho }_{{\to {c}}_{\kappa -1},\kappa -1}^{m,\nu ,\psi }\right)\cdot {{\Pi}}_{{\checkmark}}^{\kappa -1}\right]\right)\end{align} \tag{ E37 }$$

The right-hand side of the above equation is bounded by $\frac{5}{6}$ due to the approximate cloning theorem [18]. Therefore, we have

$$\begin{equation}\frac{1}{2}\left({\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }+{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}\right){\leqslant}\frac{5}{6}.\end{equation} \tag{ E38 }$$

There are at most k − m time steps κ = 1, ..., k such that the channel $\mathcal{E}$ is not sending. Therefore, using equations (E31) and (E38) we can write (E29)

$$\begin{equation}{P}_{{\checkmark}}{\leqslant}\sum _{\nu }{q}_{\nu }\frac{1}{k}\sum _{\kappa =1}^{k}\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\sum _{{\to {c}}_{\kappa }}\frac{{\overline{F}}_{\nu ,{\to {c}}_{\kappa },\kappa }+{\overline{F}}_{\nu ,{\to {c}}_{\kappa -1},\kappa -1}}{2}\end{equation} \tag{ E39 }$$

$$\begin{equation}{\leqslant}\sum _{\nu }{q}_{\nu }\frac{1}{k}\left(m\cdot 1+\left(k-m\right)\cdot \frac{5}{6}\right)\end{equation} \tag{ E40 }$$

$$\begin{equation}=\frac{1}{k}\left(m+\frac{5}{6}\left(k-m\right)\right)\end{equation} \tag{ E41 }$$

where in the last line we used the fact that ∑_νq_ν = 1. □

Here we prove that the expected value of rate ${R}_{{\to {c}}_{\kappa },\kappa }$, for specific depth κ and string of Clifford gates ${\to {c}}_{\kappa }$, is equal to fidelity ${\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)$ averaged over the state space.

Proof of lemma 2. By definition, the expected value of ${v}_{{\to {c}}_{\kappa },\kappa }^{i}$ as,

From the 2-design properties of set X, lemma 6, we have that

$$\begin{equation}\mathbb{E}{\left[{v}_{{\to {c}}_{\kappa },\kappa }^{i}\right]}_{\mathsf{X}}=\int \mathrm{d}\psi \;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }={\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)\end{equation} \tag{ F2 }$$

By linearity property of expected value,

$$\begin{equation}\mathbb{E}{\left[\sum _{i}{v}_{{\to {c}}_{\kappa },\kappa }^{i}\right]}_{\mathsf{X}}=\sum _{i}\mathbb{E}{\left[{v}_{{\to {c}}_{\kappa },\kappa }^{i}\right]}_{\mathsf{X}}=\sum _{i}{\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)={n}_{{\to {c}}_{\kappa },\kappa }{\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right).\end{equation} \tag{ F3 }$$

And therefore,

$$\begin{equation}\mathbb{E}{\left[{R}_{{\to {c}}_{\kappa },\kappa }\right]}_{\mathsf{X}}=\mathbb{E}{\left[\frac{\sum _{i}{v}_{{\to {c}}_{\kappa },\kappa }^{i}}{{n}_{{\to {c}}_{\kappa },\kappa }}\right]}_{\mathsf{X}}={\overline{F}}_{{\to {c}}_{\kappa },\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)\end{equation} \tag{ F4 }$$

□

Here we present a proof that is analogous to the previous one, and shows that expected value of rate R_κ for a fixed depth κ, is equal to double-average fidelity.

Proof of lemma 3. By definition, the expected value $\mathbb{E}{\left[{v}_{\kappa }^{i}\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}$ as

$$\begin{equation}=\frac{1}{\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{\kappa }}\frac{1}{\vert \mathsf{X}\vert }\sum _{{C}_{1},\cdots ,{C}_{\kappa }\in \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}\sum _{\psi \in \mathsf{X}}{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }\end{equation} \tag{ F6 }$$

By 2-design properties of the Clifford set, lemma 7, we have that

$$\begin{equation}\mathbb{E}{\left[{v}_{\kappa }^{i}\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}=\int \mathrm{d}\psi \int {C}_{1}\cdots \int {C}_{\kappa }\;{p}_{{\checkmark}\vert \psi ,{\to {c}}_{\kappa },\kappa }=\overline{\overline{F}}\left({\tilde {\mathcal{T}}}_{\kappa }\right).\end{equation} \tag{ F7 }$$

Since $\mathbb{E}{\left[{R}_{\kappa }\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}=\frac{{\sum }_{i}^{{n}_{\kappa }}\mathbb{E}{\left[{v}_{\kappa }^{i}\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}}{{n}_{\kappa }}$, with n_κ being a total number of executions for a fixed κ, we have that $\mathbb{E}{\left[{R}_{\kappa }\right]}_{\mathsf{X},\mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}}={\overline{\overline{F}}}_{\kappa }\left({\tilde {\mathcal{T}}}_{\kappa }\right)$. □

Next, we prove that the consistency check, theorem 5, is satisfied with a certain probability, determined by the estimates on the performance of individual devices.

Proof of corollary 2. The probability that the bound (22) is satisfied is equal to probability that all the individual bounds are satisfied, i.e. $\text{Pr}\left[\left({\bigwedge }_{j=1}^{\kappa }\left(\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert { >}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\wedge \vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert { >}{{\epsilon}}_{{C}_{j}}\right)\right)\right]$. This is equal to

$$\begin{equation}\mathrm{Pr}\left[\left({\bigwedge }_{j=1}^{\kappa }\left(\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert { >}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\wedge \vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert { >}{{\epsilon}}_{{C}_{j}}\right)\right)\right]\end{equation} \tag{ F8 }$$

$$\begin{equation}\quad =1-\mathrm{Pr}\left[\left(\underset{j=1}{\overset{\kappa }{\bigvee }}\left(\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert {\leqslant}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\vee \vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert {\leqslant}{{\epsilon}}_{{C}_{j}}\right)\right)\right].\end{equation} \tag{ F9 }$$

Since Pr[A ∨ B] ⩽ Pr[A] + Pr[B], we can write that

$$\begin{equation}\mathrm{Pr}\left[\left(\underset{j=1}{\overset{\kappa }{\bigvee }}\left(\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert {\leqslant}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\vee \vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert {\leqslant}{{\epsilon}}_{{C}_{j}}\right)\right)\right]\end{equation} \tag{ F10 }$$

$$\begin{equation}{\leqslant}\sum _{j=1}^{\kappa }\mathrm{Pr}\left[\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert {\leqslant}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\right]+\mathrm{Pr}\left[\vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert {\leqslant}{{\epsilon}}_{{C}_{j}}\right]\end{equation} \tag{ F11 }$$

$$\begin{equation}{\leqslant}2\sum _{j=1}^{\kappa }\left({\mathrm{e}}^{-2{n}_{{C}_{j}}{{\epsilon}}_{{C}_{j}}^{2}}+{\mathrm{e}}^{-2{n}_{{M}_{j}^{\mathcal{T}}}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}^{2}}\right)\end{equation} \tag{ F12 }$$

where in the last line we used Hoeffding inequality, equations (12) and (13). Hence, we can write that $\text{Pr}\left[\left({\bigwedge }_{j=1}^{\kappa }\left(\vert {r}_{{M}_{j}^{\mathcal{T}}}-\overline{F}\left({\tilde {M}}_{j}^{\mathcal{T}}\right)\vert { >}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}\wedge \vert {r}_{{C}_{j}}-\overline{F}\left({\tilde {C}}_{j}\right)\vert { >}{{\epsilon}}_{{C}_{j}}\right)\right)\right]{\geqslant}1-2{\sum }_{j=1}^{\kappa }\left({\mathrm{e}}^{-2{n}_{{C}_{j}}{{\epsilon}}_{{C}_{j}}^{2}}+{\mathrm{e}}^{-2{n}_{{M}_{j}^{\mathcal{T}}}{{\epsilon}}_{{M}_{j}^{\mathcal{T}}}^{2}}\right)$. □

Here we prove our bound on the performance of k-round protocols in terms of winning rate R_κ in test 2. The core of this theorem is the following lemma, which relates the diamond distance between the ideal and real implementation of a k-round protocol, and the double-average fidelity.

Lemma 11. The performance of a k-round protocol can be bounded by the double-averaged fidelity in the following way

$$\begin{equation}\parallel {\tilde {\mathcal{P}}}^{k}-{\mathcal{P}}^{k}{\parallel }_{\diamond }{\leqslant}2\sqrt{d\left(d+1\right)\vert \mathsf{C}\mathsf{l}\mathsf{i}\mathsf{ff}{\vert }^{k}\left(1-\bar{\bar{F}}\left({\tilde {\mathcal{P}}}^{k}\right)\right)}\end{equation} \tag{ F13 }$$

where d is the dimension of the underlying Hilbert space, and |Cliff| is a size of the Clifford group for dimension d.

Proof of lemma 11. To prove the inequality from lemma 11 one needs to show dependence between ${\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)$ and $\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right)$. In particular, to preserve the direction of inequality we want that ${\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right){\geqslant}\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right)$. Firstly, we trivially have that

$$\begin{equation}{\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right){\geqslant}{\mathrm{min}}_{{\to {g}}_{k}}{\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\end{equation} \tag{ F14 }$$

On the other hand,

$$\begin{equation}\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right)=\int \mathrm{d}{G}_{1}\cdots \int \mathrm{d}{G}_{k}{\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\end{equation} \tag{ F15 }$$

$$\begin{equation}=\int \mathrm{d}{C}_{1}\cdots \int \mathrm{d}{C}_{k}{\overline{F}}_{{\to {c}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\end{equation} \tag{ F16 }$$

$$\begin{equation}=\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}\sum _{{\to {c}}_{k}\in \mathsf{Cliff}}{\overline{F}}_{{\to {c}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\end{equation} \tag{ F17 }$$

$$\begin{equation}=\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}\left({\overline{F}}_{{\to {c}}_{k}^{\mathrm{min}}}\left({\tilde {\mathcal{P}}}^{k}\right)+\sum _{{\to {c}}_{k}\ne {\to {c}}_{k}^{\mathrm{min}}}\underset{{\leqslant}1}{\underbrace{{\overline{F}}_{{\to {c}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)}}\right)\end{equation} \tag{ F18 }$$

$$\begin{equation}{\leqslant}\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}{\overline{F}}_{{\to {c}}_{k}^{\mathrm{min}}}\left({\tilde {\mathcal{P}}}^{k}\right)+1-\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}=1-\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}\left(1-{\overline{F}}_{{\to {c}}_{k}^{\mathrm{min}}}\left({\tilde {\mathcal{P}}}^{k}\right)\right),\end{equation} \tag{ F19 }$$

where in lines (F16) and (F17) we used lemma 7, and in line (F18) we separated the minimum element out of the summation and in line (F19) we bounded each element under the sum by 1.

Now let us relate the minimum over the Clifford group to a minimum over the whole unitary group. Note that the Clifford group rotated by any unitary $\mathcal{U}$ remains a Clifford group. Therefore, let us rotate every C_j by a constant ${\mathcal{U}}_{j}$, j = 1, ..., k, such that the minimum over the Clifford sets corresponds to the minimum over the whole unitary group. Let us write ${\to {u}}_{k}={\mathcal{U}}_{1},\cdots ,\;{\mathcal{U}}_{k}$,

$$\begin{equation}{\overline{F}}_{{\to {u}}_{k}{\to {c}}_{\kappa }^{\mathrm{min}}}\left({\tilde {\mathcal{P}}}^{k}\right)={\mathrm{min}}_{{\to {g}}_{k}}{\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right).\end{equation} \tag{ F20 }$$

We obtain

$$\begin{equation}\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right){\leqslant}1-\frac{1}{\vert \mathsf{Cliff}{\vert }^{k}}\left(1-{\mathrm{min}}_{{\to {g}}_{k}}{\overline{F}}_{{\to {g}}_{k}}\left({\tilde {\mathcal{P}}}^{k}\right)\right)\end{equation} \tag{ F21 }$$

and so

$$\begin{equation}\parallel {\tilde {\mathcal{P}}}^{k}-{\mathcal{P}}^{k}{\parallel }_{\diamond }{\leqslant}2\sqrt{d\left(d+1\right)}\sqrt{\vert \mathsf{Cliff}{\vert }^{k}\left(1-\bar{\bar{F}}\left({\tilde {\mathcal{P}}}^{k}\right)\right)}.\end{equation} \tag{ F22 }$$

□

Now we will relate the double-average fidelity of a k-round protocol to the double-average fidelity of the test. Indeed, we will show that these quantities are equal.

Lemma 12. Double-averaged fidelity of a k-round protocol ${\tilde {\mathcal{P}}}^{k}$ of depth k is equal to double averaged fidelity of the test ${\tilde {\mathcal{T}}}_{\kappa }$ of the same depth, κ = k,

$$\begin{equation}\overline{\overline{F}}\left({\tilde {\mathcal{P}}}^{k}\right)=\overline{\overline{F}}\left({\tilde {\mathcal{T}}}_{\kappa }\right)\end{equation} \tag{ F23 }$$

Proof. As stated in the main text, the proof of this lemma follows from noticing that the expression for double-averaged fidelity contains only polynomials of degree 2 in every Clifford gate C_j. Therefore, here averaging over the Clifford group is equivalent to averaging over the entire unitary group, since the Clifford group forms a 2-design. Furthermore, the equality is possible, since we have put ${M}_{j}^{\mathcal{T}}\equiv {M}_{j}{\circ}{\mathcal{E}}_{j}$, and ${M}_{j}^{\mathcal{T}}$ encompasses operations associated with sending and storing the qubit. □

The above two lemmas, combined with the Hoeffding bound on R_κ, equation (21) complete the proof theorem 6.