Constructing a virtual two-qubit gate by sampling single-qubit operations

We show a certain kind of non-local operations can be simulated by sampling a set of local operations with a quasi-probability distribution when the task of a quantum circuit is to evaluate an expectation value of observables. Utilizing the result, we describe a strategy to decompose a two-qubit gate to a sequence of single-qubit operations. Required operations are projective measurement of a qubit in Pauli basis, and $\pi/2$ rotation around x, y, and z axes. The required number of sampling to get an expectation value of a target observable within an error of $\epsilon$ is roughly $O(9^k/\epsilon^2)$, where $k$ is the number of"cuts"performed. The proposed technique enables to perform"virtual"gates between a distant pair of qubits, where there is no direct interaction and thus a number of swap gates are inevitable otherwise. It can also be utilized to improve the simulation of a large quantum computer with a small-sized quantum device, which is an idea put forward by [Peng, et al., arXiv:1904.00102]. This work can enhance the connectivity of qubits on near-term, noisy quantum computers.


Introduction
Quantum computers have attracted much attention recently, mainly due to the rapid development of actual hardware [1][2][3]. The quantum computer that is to appear shortly is called noisy intermediate scale quantum devices, or in short, NISQ devices [4]. We expect NISQ devices to have ∼100 of qubits with non-negligible noise in the near future. Such devices are believed to be not simulatable by classical computers when the control precision of the qubits is sufficiently high [5][6][7][8]. In this sense, NISQ devices have computational power that exceeds classical computers. Many researchers are actively developing ways to exploit their power for practical applications [9][10][11][12][13][14][15]. However, we still suffer from the limited number of qubits available on actual devices and the limited depth of circuits that can be run while maintaining the resultant quantum state meaningful.
If techniques to decompose a quantum circuit to smaller ones are developed, they can extend the applicability of such devices. Smaller quantum circuits may refer to ones with the smaller number of qubits or gates. Peng et al recently proposed a clustering approach based on a tensor network representation of a quantum circuit [16], which greatly progressed the technical development. They showed that we can 'cut' an identity gate, by sampling measure-and-prepare channels on a qubit according to a certain quasi-probability distribution. In reference [17], we proposed methods to construct quantum circuits equivalent to the Hadamard test, which successfully reduces the depth of certain quantum circuits. These techniques share a same idea in that they reconstruct a result of a coherent quantum operation from certain incoherent operations by combining the results obtained from them.
An approach which has the same flavor as the above have been utilized in the context of memory-efficient classical simulation of quantum circuits. Since the direct simulation of a quantum circuit with over 50 qubits breaks down due to the need of storing 2 50 complex numbers in memory, the classical simulator must decompose the given quantum circuit to smaller ones, especially in the number of qubits. References [18,19] have provided one way for such decomposition, which 'cuts' controlled-Z gates by separately simulating two cases where the control qubit is |0 or |1 and then combining them, and they performed classical simulation of over 50-qubit quantum circuits. A similar technique has been utilized by Bravyi et al in reference [20] to remove a relatively small number of qubits from a large quantum circuit by replacing the qubits with a classical simulator. Their approach can be viewed as 'space-like' cut rather than the 'time-like' cut proposed by Peng et al [16]. However, their techniques are intended to run on a classical computer and cannot be utilized for simulating a large quantum circuit with a small quantum computer.
In this work, we present a technique to perform 'space-like' cut on a quantum computer. More specifically, we present a way to decompose a controlled gate into a sequence of single-qubit operations which consists of projective measurements of Pauli X, Y, and Z operators, and single-qubit rotations around x, y, and z-axes. We note that our method does not generate any entanglement between the qubits as it is impossible to do so with such single-qubit operations. Our method only 'simulates' effects of entanglement using classical post-processing and sampling. More concretely, although entangling gates cannot be performed with local operations and classical communications in single-shot experiments as widely known [21], we show that it is possible to perform a computational task of evaluating expectation values of the output of entangling circuits by sampling certain sets of gates and applying classical post-processing. The overhead required for our proposed technique, which scales exponentially to the number of decomposition performed, gives a characterization of the entangling gates from a computational viewpoint, which is different from the existing theories of entanglement quantification in e.g. [22].
The method proposed here can be considered as a generalization of our previous work [17] and a variant of the quantum circuit decomposition presented in reference [16]. It can also be viewed as a fully quantum version of the technique utilized in efficient classical simulation schemes [18][19][20]. In some cases, our method provides a better scaling against reference [16] when simulating a large quantum circuit with smaller ones. The proposed technique is also useful when we want to apply two-qubit gates between a distant pair of qubits, which otherwise would require many swap operations to perform. This work extends the applicability of NISQ devices whose circuit depth and connectivity are limited.

Tensor network representation of quantum circuits
Quantum computation is completely specified with a quantum circuit, U, an initial state with its density matrix representation, ρ, and an observable, O, measured at the output. Given U, ρ, and O, any quantum computation can be represented by a tensor network [23][24][25]. We define the tensor representation of U, ρ, and O in the following manner.
Suppose that our quantum computer has n qubits. We define a complete set of basis in the space of 2 × 2 complex matrix and its dual as {|e i } 4 i=1 and { e i |} 4 i=1 respectively, and assume orthonormality under the trace inner product; e i |e j = δ ij . We use the trace inner product, that is, for matrices A and B, A|B = Tr(A † B). A density matrix ρ can be decomposed into the sum of |e j 1 ⊗ |e j 2 ⊗ · · · ⊗ |e j n = |e j 1 e j 2 . . . e j n as |ρ = where j = (j 1 , j 2 , . . . , j n ). We refer to the elements ρ j = e j 1 e j 2 . . . e j n |ρ as the tensor representation of ρ. An observable O can also be decomposed into the same form. Note that we can naturally assume tensor representations of observables and density matrices consist of real numbers because they are always Hermitian and we can choose the basis {|e i } 4 i=1 as Hermitian, e.g. we can use the Pauli matrices {I, X, Y, Z} as the basis. Therefore, we assume ρ i and O i are real henceforth. The quantum circuit, U, transforms ρ into UρU † . We define a corresponding superoperator S(U) whose action is defined by S(U)ρ = UρU † . Superoperator can be decomposed as, S(U) = j 1 ,...,j n k 1 ,...,k n S(U) j,k |e j 1 . . . e j n e k 1 . . . e k n |. (2) Note that this decomposition is not limited to superoperators of unitary matrices, but also is applicable for any linear operator that acts on a density matrix. We call S(U) j,k = e j 1 . . . e j n |S(U)|e k 1 . . . e k n tensor representation of S(U). When we use the Pauli operators as basis set, S(U) j,k is referred as Pauli transfer matrix. Quantum computation ends with measuring the observable O. This output can be written down as, In many cases, U is a product of elementary gates The tensor representation of the overall gate, S(U), is also a product of S(U i ); S(U) = S(U L ) . . . S(U 1 ). An important note is that as long as the tensor representation of each element is unchanged, the result of the overall computation is also unchanged. If S(U) can be represented by a sum of some simple operations as S(U) = i c i S(V i ) with coefficients {c i }, the expectation value of an observable O can be computed with the following equality, Note that c i can, in general, depend on the state |ρ . We use this scheme to perform the 'decomposition' of a circuit in this work. It is noteworthy that as we perform decompositions of a superoperator rather than an operator such as U itself, the method becomes friendly for a realistic quantum device. A direct decomposition of U into some simple operators {V i }, i.e. U = i c i V i , can also be utilized for the same task; however, as expectation values are calculated as 0|U † OU|0 where |0 is an initial state, this approach requires us to evaluate i,j c i c * j 0|V † j OV i |0 which are rather hard for the NISQ devices. This fact demonstrates the advantage of using the above formalism. The tensor network representation of the superoperator formalism allows us to graphically understand the decompositions.

Virtual two-qubit gate
We can show the following, which can then be utilized to decompose any two-qubit gate into a sequence of single-qubit operations.
To prove this, we can directly check the tensor representation of both hand side is equivalent. For detailed calculation, see appendix A1. This theorem is schematically depicted in figure 1(a). Notice that the operation that is proportional to I ± A and I ± iA for A ∈ {X, Y, Z} can respectively be performed by a projective measurement and a single-qubit rotation.
The correspondence with a single-qubit rotation is clear from the formula, e ±iπA/4 = 1 √ 2 (I ± iA), which is the rotation of angle π/2 around the A axis. Let M A be the projective measurement on the A basis (A ∈ {X, Y, Z}), that is, M A acts on a density matrix ρ as, , that is, where M A,α is a measurement operation postselected with the measurement outcome α. Tr ρ I+αA 2 is the probability of getting the result α by measuring ρ on the A basis. Lemma 1 with this fact implies that the gate e iθA 1 ⊗A 2 can be decomposed, in a sense of equation (5), into a sum of I ⊗ I, A 1 ⊗ A 2 , M A 1 ⊗ e ±iπA 2 /4 , and e ±iπA 1 /4 ⊗ M A 2 , which can be stated as lemma below. Notably, this technique can be applied for any θ, which enables us to perform continuous two-qubit gates.

Lemma 2.
A quantum gate e iθA 1 ⊗A 2 with operators A 1 and A 2 such that A 2 1 = I and A 2 2 = I can be decomposed into six single-qubit operations. For any quantum state |ρ , to achieve the error of the decomposition with respect to the trace distance with probability at least 1 − δ, the required number of circuit runs is The detailed proof is given in appendix B. Intuitively, since the error comes from the probabilistic part of the decomposition, that is the renormalization factor in equation (8) ignoring the global phase. This means we can decompose a CZ gate using lemma 2. The decomposition is shown in figure 2. Similar decompositions can be performed on some basic two-qubit gates such as CNOT. Endo et al [26] also provides such decomposition (reference [26], appendix B). However, our protocol above is slightly advantageous in that the number of single-qubit operations required is six compared to theirs which requires nine of them.

Virtual non-destructive measurement of two-qubit operators
In the previous subsection, we showed that any two-qubit rotation can be decomposed into a sum of single-qubit operations. Here, we extend the strategy to construct virtual non-destructive measurement of two-qubit operators. Similar to the previous section, we can show the following. This theorem is schematically shown in figure 1(b).

Lemma 3.
For operators A 1 and A 2 such that A 2 1 = I and A 2 2 = I, This can also be shown by the direct calculation of both hand side. See appendix A2 for detailed calculation. The above lemma can be utilized to show the following. with operators A 1 and A 2 such that A 2 1 = 1 and A 2 2 = 2 can be decomposed into six single-qubit operations. For any quantum state |ρ , to achieve the error of the decomposition with respect to the trace distance with probability at least 1 − δ, the required number of circuit runs is O(log(1/δ)/ 2 ).
This can be shown with exactly the same approach taken to prove lemma 2, which is provided in appendix B.

Simulation of large quantum circuits
The idea of simulating a large quantum circuit by a small quantum computer has been put forward in reference [16]. Peng et al utilized the equivalence shown in figure 3. In the figure, where The symbols and denotes the measurement of a certain observable and the preparation of a certain state, respectively. Contrasting this technique and ours, we refer to the former and the latter as 'time-like' and 'space-like' cut, respectively. More concretely, a time-like cut of a quantum channel can be defined as a decomposition of the channel in the sense of equation (5) using measure-and-prepare channels only. In contrast, a space-like cut of a non-local quantum channel is a decomposition of the channel using local quantum channels only.
The decomposition presented in the previous section can also be used in this direction. Let us compare the scaling of cost of our decomposition scheme and that of Peng et al by a simple example. We consider the case where we have an n-qubit quantum computer to simulate a 2n-qubit quantum circuit of figure 4, which has only one CZ gate between n-qubit 'cluster'. The task is to estimate the expectation value of a final observable O f by measuring it in the computational basis. To simplify the discussion, we assume O f is a string of Pauli Z's.
Let v be a desired variance of the estimation of the expectation value of O f . We can show a naive algorithm, which runs the equal number of circuits for each terms appearing in the decomposition, to perform the decomposition with time-like cuts, in the worst case, requires 2048/v runs of n-qubit circuit,  while the space-like cut approach takes 15 2v runs. The analysis of this simple example is given in appendix D. Although the analysis given here is based on a naive algorithm and there are possibilities to improve it, this analysis somewhat shows the enhancement provided by our space-like cut protocol.

General case.
We can consider a general case where we perform the time-like and space-like cuts simultaneously to make a given m-qubit quantum circuit runnable on an n-qubit quantum computer. Let the number of time-like and space-like cuts be M t and M s , respectively. See figure 5 for a schematic illustration. For space-like cuts, we assume they are performed only on CZ gates. The input state ρ is initialized in |0 0| ⊗m and O f is an output (diagonal) observable calculated from some output function f : {0, 1} m → [−1, 1]. Our task here is to estimate the expectation E[f (y)] for a random bitstring y ∈ {0, 1} m sampled from the original circuit. This model is adopted from reference [16] which originates in reference [20]. With this definition, we can get the following. This implies that the decomposition of the circuit should be performed to minimize 9 M s 16 M t . A detailed proof is given in appendix E, however, the above can roughly be explained as follows. At each space-like cut, we get six different sets of single-qubit operations, so M s cuts induce 6 M s terms. Likewise, M t time-like cuts induce 8 M t terms, which makes the total number of circuits in decomposition 6 M s 8 M t . With this decomposition, we can take a Monte-Carlo approach to estimate the sum, that is, we randomly choose circuits to run and average them. Hoeffding's inequality can be used to bound the error of such protocol, which states that if a magnitude of a random variable is always bounded by some constant a, then O(a 2 / 2 ) samples would suffice to obtain an accuracy of . In this case, we are to estimate thus we can apply the Hoeffding bound to get the result.

Distant two-qubit gates
The theorem introduced above can be utilized to 'virtually' perform a two-qubit gate between qubits at distance. Figure 6 shows an example of such a virtual two-qubit gate. Notice that this protocol works irrespective of the distance between the qubits. Many swap gates are otherwise necessary for performing such gates, which makes them impractical on NISQ devices due to the non-negligible amount of decoherence and gate error of such devices.
This protocol might be useful for the variational algorithms such as the variational quantum eigensolver (VQE) [9] and the quantum approximate optimization algorithms (QAOA) [12]. Here, we describe an example in the QAOA. In the QAOA, we seek to find a ground state of a Hamiltonian H on n-qubit which is a sum of Pauli Z's and its products. For example, a Hamiltonian may have the form of, The QAOA tries to solve the problem by converting it to an optimization problem of a continuous variable β and γ. The optimization of β and γ are performed so as to minimize the function, where, This algorithm has been experimentally demonstrated [13] with the connectivity of the target Hamiltonian being equivalent to the connectivity of the actual device. The equivalence of the connectivity is almost necessary from the requirement to perform e iγH . This requirement can somewhat be relaxed by our protocol which enables qubits to virtually interact irrespective of the distance between them. Let us now assume that an available device has a square-lattice connectivity of figure 6, and a Hamiltonian of the QAOA which we aim to solve has an interaction between one pair of qubits that is not included in the hardware connectivity graph. In this case, to execute the QAOA circuit (equation (14)), we can use our space-like technique p times to virtually apply the unitary. The scaling of the cost can be bounded by setting M t = 0 and M s = p in theorem 5 which gives us a scaling of 9 p −2 log[1/(2δ)]. The time-like cut approach of Peng et al [16] can also be utilized in this direction. However, as this approach would require 4 cuts per gate, the cost scaling is bounded by 16 4p −2 log[1/(2δ)] by setting M t = 4p and M s = 0 in theorem 5. This demonstrates an advantage, albeit in this special settings, of our technique over the previous result.
In the context of the VQE, which is also an algorithm to find a ground state of a Hamiltonian but mainly targets a concrete physical system such as molecules, it has been proposed to use the same kind of quantum circuits as the QAOA [27,28]. Our result may also be applicable in constructing such circuits.

Discussion and conclusion
We described a technique to decompose a non-local operations into a sequence of local operations. As the single-qubit operations are generally more accurate on NISQ devices, the proposed technique can be used to enhance their capability. We believe intrinsic noise on single-qubit operations can be compensated by recent sophisticated error mitigation techniques [26]. In particular, our technique of the space-like cut of two-qubit gates can improve the simulation of a large quantum circuit with a small quantum computer in some cases. It would be interesting to investigate the best strategy to perform 'cuts' to reduce the number of qubits compatible with an available device. Also, the algorithm we have given to bound the cost scaling is rather straight forward and we believe it can be improved with a more sophisticated strategy.
The proposed algorithm can also be compared to the classical simulation strategy that splits a large circuit by decomposing two-qubit gates. For example, a controlled-NOT gate can be splitted using a tensor network based technique [29]. However, such techniques generally does not focus on decompositions of S(U) considered in this work but rather the two-qubit unitary U itself, which takes makes them difficult to be used on NISQ devices as equation (5) cannot be utilized anymore.
Our technique can induce an entanglement-like effect without performing any two-qubit gate with the cost mentioned in lemmas 2 and 4. This connects this work to areas like quantum communication. This 'virtual' entanglement creation could be done with the time-like cut proposed by Peng et al, but our work lowered the cost to perform the task. It is interesting to know whether ours is the optimal protocol or there is a more efficient way.
To summarize, our technique allows qubits to virtually interact irrespective of physical distances between them. The result is useful for applying a two-qubit gate to a distant pair of qubits. In particular, when applied to the NISQ devices, this may be employed to enhance the power of them. Future direction can be to explore if we can lower the resource to perform such virtual operations. i,j=1 is as follows.

Acknowledgments
Let, Tr e i ⊗ e j e k ⊗ e l Tr e i ⊗ e j (A 1 ⊗ I)e k ⊗ e l Tr e k ⊗ e l (A 1 ⊗ I)e i ⊗ e j Tr e i ⊗ e j (I ⊗ A 2 )e k ⊗ e l Tr e k ⊗ e l (I ⊗ The relation can be summarized in matrix form,  = cos 2 θa 1,ijkl + i sin θ cos θ a 6,ijkl − a 7,ijkl + sin 2 θa 16,ijkl .
Observe that, where we abbreviated the subscripts ijkl. We can solve the above for i(a 6 − a 7 ), and obtain Combining this with equation (A5) completes the proof.

A.2. Proof of lemma 3
We first write down the tensor representation of the projective measurement, I + βA 1 ⊗ A 2 for β = ±1.

A.3. Relation with reference [20]
Bravyi et al has considered to remove k qubits in a given n + k-qubit circuit at the cost of O(kd2 k ) classical computation, where d defined to be proportional to the number of gates applied to the k-qubit system. The technique utilized in their work, in particular, figure 2 in reference [20] can also provide a derivation to the above lemmas when combined with our recent technique developed in reference [28].

Appendix B. Proof of lemma 2
Suppose that we are applying S(e iθA 1 ⊗A 2 ) to some state ρ and want to decompose the gate. We name each operation in the decomposition as, which is not physical when β 3,4,5,6 = −1 but achievable with classical post processing. M A i ,β is a postselective measurement operation, which has been introduced in the main text. For convenience, we define coefficients {c i } 6 i=1 as c 1 = cos 2 θ, Then, We take a naive algorithm to bound the error of the decomposition. We define a probabilistic map below where M A i acts on a state ρ probabilistically as, where b is a random variable with probability distribution p(b = ±1) = Tr ρ I±A i 2 . Again, when b = −1 this map is non-physical but can be realized with classical post processing. Φ i becomes Φ i,b with probability Tr ρ I±A i 2 , and therefore, for i = 3, 4. A similar equality holds for i = 5, 6. This yields, Suppose that we take N samples for each i = 1, . . . , 6 to estimate E[Φ i |ρ ]. The i = 1, 2 cases are not probabilistic and hence do not introduce error. We are left to consider the error induced by i = 3, 4, 5, 6. In this case, we can estimate |μ i = E[Φ i |ρ ] by where {b ij } N j=1 are samples drawn from the distribution which is identical to the above mentioned b. Now the difference between the true state S(e iθA 1 ⊗A 2 )|ρ and the estimated 6 i=1 c i |μ i is, 1±b ij 2 is a Bernouilli random variable with the expectation I±A 1 2 and I±A 2 2 respectively for i = 3, 4 and i = 5, 6. This means that, for example, the difference between 1 2N N j=1 (b 3j + 1) and I+A 1 2 is bounded by > 0, that is, 1 with probability at most 1 − exp(−2 2 N) from Hoeffding's inequality. The same bound holds for every term in equation (B12). Noting that if also holds, the probability that at least one of the differences in equation (B12) is larger than is at most 4 exp(−2 2 N), by union bound. Therefore, with probability at least 1-4 exp(−2 2 N), holds for any norm · . The second inequality follows from the triangle inequality. Considering the trace norm · 1 , which gives Φ i,β |ρ 1 = 1, and taking |c i | 1 into account, we get With this, we conclude that, given the desired error 1/ and a probability 1 − δ by which we wish to lower-bound the probability of getting the error larger than , we can take N = − 32 2 ln(1 − δ).

Appendix C. Time-like cut for identity channel
The time-like cut approach proposed in reference [16] can be derived in the following manner. Let us consider an identity channel I a on the ath qubit. It can be expanded as, |e i a e j a | e i a |I a |e j a .
Since we assumed |e i are orthonormal to each other and I|ρ = |ρ for any ρ, If we apply this to a n-qubit density matrix |ρ = j 1 ,...,j n ρ j |e j 1 e j 2 . . . e j n in this form, we see, |e i a e i a |ρ (C3) Tr a (e i a ρ) ⊗ |e i a .
Choosing |e j 1 to be Pauli matrices {I, X, Y, Z}/ √ 2, we conclude, This equation implies that we can first measure expectation values of X, Y, Z at the ath qubit and then re-input each eigenstates.

D.1. Cost of time-like cut
First, we consider the 'time-like' cut approach. Let us name two-qubit on which the CZ gate acts a and b, and let σ a and σ b be their 1-qubit reduced density matrices after the gate U 1 ⊗ V 1 . We assume, • One n-qubit device is available.
• Qubits that are measured in the basis of an observable O i can be reused to prepare the input state ρ j . We take the following naive approach to estimate O f . First, divide the allowed number of circuit runs N into N/2 to run the divided circuit for equal times. N/2 runs are further divided into N/128 runs to run the circuit with O i and ρ j for i, j ∈ {1, 2 1 N/128 , for sufficiently large N. Therefore, with N/128 runs of a quantum circuit, we can estimate the value of the above tensor network with the variance 128 N at most. We can obtain the same result for the other cluster. For each i, j, k, l, the tensor in the sum of figure 4 is estimated by the product of the above estimators because the measurement result is independent on each cluster. The variance of each tensor network can be evaluated because they are a product of two random variables approximately drawn from normal distribution with variance at most 128 N , and it is at most 64 N . We have that c ijkl ∈ {±1/2 4 }. This reduces the variance of each term in the summation to 1/(2N). However, when we take the sum since each term can be approximated by a normal distribution with the variance at most 1/(2N) and we take summation of 8 4 = 4096 terms, the result has the variance at most 2048/N.

D.2. Cost of space-like cut
For the space-like cut, we divide the allowed number of circuit runs, N, to N/6 [31]. First, we run eight circuits that do not involve the measurement in the middle and obtain estimators for these four tensor network. Each of the estimators has the variance at most 6/N. Let us now move on to the circuits with the measurement. For arbitrary density matrix ρ , the Z measurement produces the density matrix I+α 2 ρ I+α 2 /p α with probability p α . Therefore, to obtain the above decomposition, we need to know the normalization factor p α . With N/6 circuit runs, p α is estimated to the variance p α (1 − p α )/(N/6) which is at most 6/(4N) = 3/(2N). Note that when N is large, the distribution of the estimatorp α can be thought of as a normal distribution. Conditioned on α, we construct an estimator of O f . Since α is obtained with probability p α , for each α we have p α N/6 samples to estimate O f . Therefore, for each α, the estimator of O f has the variance of 6/p α N. Since the estimator of the tensor network is the product of the estimators of conditioned O f and p α , its variance is 6 2N . Each pair of the tensor network in figure 2 is multiplied together, and if we perform this with the estimators obtained above, the variance of each term is at most 3 N . We further multiply each term with ±1/2, then the variance is reduced to 3 4N . Finally, the summation of 10 such term leads to the variance of 15 2N .

Appendix E. Proof of theorem 5
We follow the approach taken in reference [16]. The task here is to perform the decomposition of m-qubit circuit like the one shown in figure 5 so that the original quantum circuit can be approximated with an n-qubit quantum computer, where the input state ρ is initialized in |0 0| ⊗m and O f is an output (diagonal) observable calculated from some output function f : {0, 1} m → [−1, 1]. We want to estimate E y [f (y)] for n-bit measurement outcomes y to some accuracy > 0 with some high probability 1 − δ. Let the number of space-like cuts and time-like cuts performed in the decomposition be M s and M t respectively. We assume the space-like cuts are performed only on CZ gates. We redefine the probabilistic map Φ i that is used to decompose S(e iθA⊗B ) as, Φ 1 = S(I ⊗ I), Therefore, for given and the probability 1 − δ to which we want to bound the probability of getting an error larger than , we take N = 2·9 Ms ·16 M t 2 ln 1 2δ .