Demonstration of measurement-only blind quantum computing

Blind quantum computing allows for secure cloud networks of quasi-classical clients and a fully fledged quantum server. Recently, a new protocol has been proposed, which requires a client to perform only measurements. We demonstrate a proof-of-principle implementation of this measurement-only blind quantum computing, exploiting a photonic setup to generate four-qubit cluster states for computation and verification. Feasible technological requirements for the client and the device-independent blindness make this scheme very applicable for future secure quantum networks.


Introduction
Quantum physics enables one to enhance security for processing data over a distributed network. In particular, quantum cloud computing allows quasi-classical clients (i.e. clients with a limited amount of quantum resources, such as qubit preparation or detection) to do calculations beyond their computational power, namely perform quantum algorithms. The first proposed and demonstrated two-party secure quantum cloud computation protocol is known as blind quantum computing (BQC) [1]: a client, Alice, who can generate only single-qubit states, delegates her quantum computing to a remote server, Bob, who has a fullyfledged quantum computer, without leaking any of her privacy. Many theoretical studies based on this have been performed recently [2][3][4][5][6][7][8][9][10][11], and also experimental demonstrations have been reported [12][13][14]. A simplified and novel version for secure quantum computing consists of a two-party protocol [2,15], where Alice only makes measurements and Bob's blindness is proven by the no-signaling principle [16]. Here blindness indicates that whatever Bob does;he cannot learn any of Alice's privacy.
In order to underline the feasibility of the measurement-only BQC we demonstrate the computation protocol in a photonic experiment. Bob generates four-qubit resource states that are used by Alice to implement generic two-qubit entangling gates and verification protocols.

Theory
The idea of measurement-only BQC is shown in figure 1. Bob generates a resource state for measurement-based quantum computing (MBQC) [17,18], and he sends the corresponding qubits, one by one, through a one-way quantum channel to Alice. She measures each qubit according to her program. For any kind of a malicious Bob, he cannot learn anything about Alice's quantum computation, because information is sent only in one direction. The no-signaling principle then ensures that if Alice and Bob share a system (classical, quantum, or superquantum) and she measures her part, this does not transmit any information to Bob. This principle is more fundamental than quantum physics [16] and consequently provides security even against superquantum attacks.
We remark that the original BQC examines a different approach. A quasi-classical Alice must be able togenerate randomlyrotated single-qubit states, send these via a quantum channel to Bob, and interact via classical channels in order to control and receive the computation results. Recently, the single-qubit generation requirement is extended to the coherent state generation Vedran or single-qubit measurement [19]. The measurement-only BQC scheme centers on a quasi-classical Alice, who now only receives qubits that she then measures. This alternative concept produces a practical computing protocol. In particular, in optical systems, the technological demand for a client is readily available. An additional feature of measurement-only BQC is the device-independent blindness: even if Alice owns a malicious device(probably bought from another company), no information is transmitted to Bob because of the no-signaling principle. In our case, we obtain device independence regarding blindness; recently, the concept of device independence has also been generalized to verifiability [19,20]. Furthermore the full-fledged quantum computer can be based on any model of MBQC (see [2] for more detailed discussion).
The concept of secure quantum computing openedup feasible verification methods [3,13,15] where Alice can test whether Bob is performing the computation correctly. It was shown that the verification is possible for the original protocol [3,13] as well as for the measurement-only protocol [15]. The central idea in these protocols is that Alice secretly hides some 'trap' qubits in the resource state. This fundamentally reduces to the situation where Alice tries to verifyBob's quantum resource with a minimal set of measurements [21][22][23]. If Bob deviates from the correct protocol, he changes the states of the traps, and if Alice detects the change of any trap, she can detect Bob's malicious behaviour and abort the computation. The security corresponds to the probability that Alice does not accept the results received by a cheating Bob.
In measurement-only BQC, the trap qubits are randomly prepared and placed via measurements by Alice within the computation resource and are associated to qubit states in Z and X basis (corresponding to Pauli operators z s and x s respectively). When Alice receives the traps, she measures the qubits in the respective basis.
For the special case of a four-qubit linear cluster state, a verification protocol with only two different trap measurements exists. This protocol runs as follows: 1. Bob prepares the four-qubit linear cluster stateand sends each qubit one by one to Alice.
2. Alice chooses one of the two tests randomly below: a. Alice measures qubits 1 and 3 in the Z basisand qubits 2 and 4 in the X basis.
b. Alice measures qubits 2 and 4 in the Z basisand qubits 1 and 3 in the X basis.
If she chooses option (a), qubits 2 and 4 becometrap qubits. If any trap qubit is changed(i.e. she does not getthe expected result), then she detects Bob's malicious behavior. We call this the option (1,3) test. On the other hand, if she chooses option (b), qubits 1 and 3 become trap qubits, and she can check those. We call this the option (2,4) test. We show now that Bob has to prepare the exact four-qubit linear cluster state in order to pass all Alice's trap tests in the limit of n repetitions, where n tends toward infinity. In the original verification protocols [3,15], it is shown that the probability that Alice is fooled by Bob can be exponentially small, by using quantum error-correcting codes.
Here, let us show the case without a quantum error-correcting code, which leads to a probability of accepting a wrong outcome to be polynomially small. We want to point out that this probability can be minimized to become exponentially small by exploiting standard error amplification techniques [24] via repeating the computation a number of times proportional to n. Bob can generate any state, but in order to pass the (1,3) test, Bob has to prepare the state: where a j {| } ñ are certain states of Bob's ancilla, which are normalized a a 1 j j 2 | | | á ñ = , but not necesarily mutually orthogonal. We consider ancilla states, since Bob could prepare a larger system and keep a subsystem. Since Bob does not know which option Alice takes, this state also has to pass Alice's other test, i.e. the (2, 4) test. Assume that Alice gets the result 0, 0 ( )when she measures qubits 2 and 4. Then the state after the measurement becomes a a a a In order to pass the (2, 4) test (again in the limit of n repetitions), this state must be b This means that, first, the reduced density operator of |Y ¢ ñ for Bob's ancilla 0 0 e 0 1 e 1 0 e 1 1 .
Next, in order for this state to be b Therefore, repeating both tests Alice verifies that Bob has the exact four-qubit cluster state, except for a small probability of undetected cheating.
In a general case, Alice can choose to use the resource state for either verification or computation. Increasing the number of verifications per computation provides a higher level of security at the cost of efficiency. The probability of undetected errors, i. e. Bob cheats in the computation and not in the verification, is linearly bounded as in [13]. In [13] Alice is assumed to send qubits, whereas here Alice measures the received qubits.
Remarkably the same technique of verification can be applied in both schemes: Alice generates trap qubits via either choosing Bob's measurement settings or by directly performing the measurements at her side. This allows for the same analysis, discussed already in [13]. In our case, Alice can randomly choose between the two verification options and a regular computation on a four-qubit linear cluster. Reference [25] describes the asymptotic behavior of the scaling for linear cluster states of increasing length.
It is worth to note that in [1], a random-number generator is necessary for the blindness, whereas in measurement-only BQC [2], no random-number generator is required for Alice to guarantee the blindness. If we add the option of the verification, both protocols require random-number generators, since Alice has to randomly place trap qubits. Nevertheless the use of quantum random numbers is nowadays accessible at the consumer grade [26].

Experiment and results
We practically realize a proof-of-principle implementation of the protocol using photons, computing two-qubit entangling gates and verifying two single-trap qubits. In contrast to the proposed theoretical scheme [15], where traps are hidden within the computation resource, our experiment exploits a four-qubit cluster state either for a computation or for a verification run, due to the number of available qubits.
The four-qubit resource for measurement-only BQC(figures 3(a) and (b))is produced in Bob's laboratory via a photonic setup in a so-called railway-crossing configuration(see figure 2). A double spontaneous parametric downconversion process allows us to generate two pairs of polarization entangled photons. Interferometers with polarizing beam splitters (PBSs) entangle the four photons. Additional half-wave plates (HWPs) on both pairs directions enable the generation of different graph states. The scheme has already been exploited in several other works to create four-qubit linear cluster states and states that can be obtained from them via local complementations (see e.g. [12,27]). Here we focus on the generation of a four-qubit star cluster state and a four-qubit linear cluster state, respectively (figure 3(a) and (b)): The four-qubit star cluster was generated within this setup only recently (see [22] for details) and now exploited for quantum information computing. Switching between the two entangled classes involvespreparing specific Bell states at each SPDC process, different photonic interferences between the two pairs of photons, precise wavelength-scale alignment, and, therefore, high stability.
Alice's laboratory consists of four HWPs, four quarter-wave plates (QWPs), four PBSs and eight single photon counting detectors (APDs) in order to speed up the data acquisition (four APDs are sufficient to measure all possible polarization-basis of four-qubit state) and proceed to a complete analysis using quantum state tomography (QST) [28]. The connecting quantum channel from Bob to Alice is achieved by four single-mode fibers, which carry the photonic qubits. We reconstructed through overcomplete QST the density matrix of the two four-qubit resources, obtaining fidelities of the state with respect to the ideal star cluster and linear cluster of

Computation
The four-qubit star and linear cluster states are the minimal resources for one-way computation, since the full universal set of gates can be reproduced [17]. This has been already demonstrated in few works [29][30][31][32][33][34]. In this work we reproduce different two-qubit entangling gates using the star clusterin order to validate the  computation from Alice's device. An entangling gate is performed using a star cluster, where qubits 1 and 2 are acting as input control (C) and target (T) qubits, respectively, whereas qubits 1 and 4 present the output control (C ¢ ) and target (T ¢ ) qubits, respectively, as shown in figure 3(c). Different combinations of measurement bases for qubit 2 and 3 enable to create entanglement between the output qubits. Detailed analysis for some entangling gates are reported in the SI. In table 1 we present, as an example, the results related to measuring qubits 2 and 3 in the Y X

Verification
The four-qubit linear cluster allows verifying computation with only two different trap measurements and is especially suited for the verification protocol as described in the theory section. We present the results for this state along with the results for a four-qubit star cluster state. As has been shown in [13], the probability that Alice is fooled by Bob is bounded in such a setting.
For the case of the four-qubit linear cluster state, we implement the (1,3) and (2,4) tests by having Alice choosing the respective basis. Per trap we analyze the measurement outcomes in order to quantify the probabilities that Alice obtains the correct state(see figure 4). For a single trap, the results are within the values 0.74 0.03, 0.98 0.01 [ ]   , where the range is due to unbalanced phase noises in the setup. Each of Alice's measures has an acquisitiontime of h 1 to decrease the uncertainty. Alice verified the resource with nonideal probability, due to experimental imperfections of the setup, which are present during the generation of the fourqubit resource as already seen from the full QST fidelity of the state.
Additionally, we performed the verification protocol on a four-qubit star cluster state, which we used before to implement entangling gates. We report the two trap tests performed on the star cluster state, equivalently to the linear cluster case) see figure 5). In this case, in order to get two trap qubits each time Alice measures Z Z 1 3 (expecting trap qubits in X basis) for the (1,3)test, and Z X 2 4 (expecting one trap qubit in X basis and one in Z) for the (2,4)test. The single probabilities of individual trap qubits, corresponding to Alice's expected results, Table 1. Results from measuring qubit 2 and qubit 3 of the star cluster onto Y X 2 3 , which corresponds to a CNOT gate on states i |+ + ñ and i | + -ñ up to a Z Z s 1 4 1 3 ( ) + , where s 2 and s 3 are the measurement outcomes. The fidelities of the tomographic reconstructed two-qubit state with respect of the ideal state are reported. s s 2 3 Ideal Output State Fidelity with an acquisition time of 600 s per single measurement (see SI for details). The imbalance of the obtained probabilities with respect to the quantum state fidelity is due to asymmetric noise.
Here we want to point out that the small increased value of fidelity of the star cluster, with respect to the linear cluster, leads to significant improvements for the verification results.

Discussion
The use of four-qubit photonic cluster states allows us to prove the feasibility of two-party measurement-only BQC in current quantum optics laboratories. Nevertheless the demonstration can be expanded to several quantum systems and other MBQC models. In the photonic case, we want to emphasize that just one HWP, one QWP, one PBS, and one APD would be sufficient for Alice to measure every qubit received from Bob and consequently to implement computation and verification. The only additional requirement in Bob's laboratory would be a time-delay multiplexer (such as the one used in [35]) or a delay line in each photon's path (such as in [36]). The tomographic reconstruction of Bob's resource state, as we did in our experiment, is in fact superfluous for Alice's computation, since already from the single-qubit measurement she can verify Bob's state. The quantum power required for Alice is then restricted to measuring the state of the qubits. It is important to note the high losses, either due to low detection efficiencies or imperfect quantum channels, would break Alice's computation. However, the threshold for losses can be increased by using fault-tolerant MBQC models, which are robust against errors and losses [37], and besides, detection devices with almost unit efficiencies are now available [38,39].
In conclusion the demonstrated protocol constitutes a step further to more realisticsecure quantum computing models.