Quantum processing by remote quantum control

Client-server models enable computations to be hosted remotely on quantum servers. We present a novel protocol for realizing this task, with practical advantages when using technology feasible in the near term. Client tasks are realized as linear combinations of operations implemented by the server, where the linear coefficients are hidden from the server. We report on an experimental demonstration of our protocol using linear optics, which realizes linear combination of two single-qubit operations by a remote single-qubit control. In addition, we explain when our protocol can remain efficient for larger computations, as well as some ways in which privacy can be maintained using our protocol.


Introduction
Quantum computing offers the possibility of achieving substantial algorithm speedups compared to classical computing [1][2][3], and can preserve the privacy of computations while doing so. Given the intrinsic difficulties in building a quantum computer, this privacy preservation will be crucial for any client-server model, which will likely provide a practical and efficient way to access quantum computing resources. In the scenario where a client delegates his computation to a quantum server, the data can readily be hidden from the server by using algorithms designed to work on encrypted data [4][5][6][7][8]. A protocol for 'blind' quantum computing, based on the paradigm of measurement-based quantum computing [9,10], was recently demonstrated using linear optics [11]. Here the client implements an algorithm by requesting that the server performs consecutive adaptive single-qubit measurements on a (large) blind cluster state-a multi-particle entangled state created from qubits transmitted by the client. Since the states of the transmitted qubits are chosen randomly by the client, the computations on the blind cluster state do not reveal any data or the algorithm to the server [11]. The randomness source that is used by the client should be carefully examined to avoid any correlations with the server and must achieve high-speed operation (such as was recently reported in [12]). Full-scale demonstrations of this blind quantum computing protocol would also require that the server has the ability to create large cluster states, which is beyond the capabilities of current quantum technologies.
Here we propose a fundamentally new type of protocol for allowing clients to execute quantum processing on a remote server. In our approach, the client translates his task into a linear combination of quantum operations performed by server. Arbitrary unitary operations can be represented in a linear-combination form using the Cartan decomposition [13]. The linear coefficients are then encoded in a quantum state, and transmitted from client to server using quantum teleportation. As we will argue, the client can keep the linear coefficients hidden from the server. To enable the required linear combining of quantum operations in our protocol, we will utilize circuits based on a technique to add coherent control to arbitrary (unknown) quantum operations, demonstrated in [14]. This technique is based on gates which can exploit extensions of the logical Hilbert space used for computation. A comparison between our protocol and blind quantum computing can be found in the appendix. We will proceed as follows: we will first explain circuits for realizing linear-combinations of a fixed family of quantum operations, before explaining in detail how they can be used to enable quantum computation in a client-server model. Then we will report a proof-of-principle experimental demonstration of our protocol in a linear-optic setup, which implements arbitrary linear combinations of two single-qubit quantum operations by a remote one-qubit control.

Linear combining of quantum operations
Suppose that we want to implement some unitary U T which can be expressed in the form, where the V j are gates acting on a d-dimensional target (T) subspace, and the a j are complex coefficients satisfying When controlled-V j gates are available, we can implement U T probabilistically through the circuit illustrated in figure 1(A). Here the a j are encoded in the initial state for the k-qubit control (C), n 2 k and j labels the computational basis, and the circuit succeeds when all control qubits are measured to be 0 in the computational basis at the end.
However, this approach for implementing U T cannot work when the V j ʼs must be assumed to be black-box operations, due to a no-go theorem which states that adding control to unknown quantum operations is impossible in the (conventional) quantum circuit model [15,16]: any protocol which attempts to add control to a black-box operation must be able to differentiate V j and q ( )V exp i j , but standard quantum circuits always generate identical measurement outcomes for these two cases. Nonetheless, control can be added in many systems, by exploiting the fact that physical operations often act non-trivially on some degrees of freedom or subspaces of quantum states, while acting trivially on others. The description of V j for such cases should be modified to Å V I j , and control can be added even when this extension is one dimensional [15]. It has been shown that control qubits can be simply added to a single-qubit unitary by moving part of the state of a target qubit into an expanded Hilbert space [17]. A more general scheme was proposed in reference [14] for adding control to an arbitrary quantum operation, with the implementation of its optical version based on the controlled-path (CP) gate [18] that controls the target photon's path conditioned on the control photon's polarization. The CP gate was first proposed for realizing quantum controlled gates in the context of weak optical cross-Kerr nonlinearities [19,20]. Techniques based on expanding the computational Hilbert space have also been demonstrated for adding control for subroutines of quantum computation [21] and implementing the The LCC implements the same conditional operation as in (A) but without controlled V j gates, with T extended to( ) n d -dimensions, using operations on subspaces of T.
Fredkin gate [22]. Here we use the same techniques to implement a linear-combination circuit (LCC) which is illustrated in figure 1(B).
LCCs can exploit black box unitaries to implement a target quantum evolution using coherent control, using the control state as in equation (3), acting on a( ) n d -dimensional target subspace T. T decomposes into n ddimensional subspaces, with the jth subspace is spanned by basis elements The LCC uses a series of subspace-swap operations, ( ) X j 0, (which exchange corresponding basis elements for the 0th and jth subspaces) which are controlled by qubits in C, and performs the sum operation Å = implements the same operation as V j previously but on the jth subspace of T. The initial state for T is taken to be Following the step-by-step evolution given in supplementary material is available online at stacks.iop.org/QST/ 2/045002/mmedia, it is straight forward to verify that, when the control qubits are all measured to be 0 in the computational basis, the target evolves according to Note here ( ) V j 0 implements V j on the 0th subspace of T as defined before. The success probability is readily found to be n 1 , which is independent of the size of the V j . Any arbitrary quantum unitary operation can in principle be decomposed into a linear sum of elementary operations. Using Cartan's KAK decomposition, we can explicitly rewrite any two-qubit unitary operation, ( ) U SU 4 , as a linear combination of four tensor products of two single-qubit gates. Furthermore, Cartan's decomposition allows an n-qubit unitary operation ( ) U SU 2 n to be recast as a linear combination of tensor products of n single-qubit gates [23]. Such a decomposition is, in general, not efficient, in the sense that there may be exponentially many terms. And thus, the success probability of LCC for general ( ) U SU 2 n can be exponentially small. However, for somenon-trivial families of unitary operations the linear decomposition method can be efficient. For example, an n-qubit controlled-unitary gate CU can be decomposed as Ä + Ä s s + - [14]. Only one control qubit is required to implement this operation and high success probability can be obtained. Although the number of linearcombining terms is restricted, the size of each term can be large and reconfigurable, providing sufficient computing power and flexibility for various applications. It is worth noting that the proposed LCC can also be interpreted by using the notion of duality quantum computation [24][25][26], which was originally proposed to exploit the wave-particle duality and then developed to work within the framework of conventional quantum computing.
3 Implementing quantum processing by remote quantum state control The LCC described above provides a way to implement quantum information processing using a client-server model, as illustrated in figure 2. We assume now the V j ʼs are the computational resources provided by the server and the a j ʼs are configured by the client to encode an algorithm. The a j ʼs are encoded into the control state fñ | C and transmitted from the client to the server remotely. The transmission of states between the client and the server is performed by a (multi-)qubit teleportation protocol [27,28] using generalized Bell measurements. The control state fñ | C has k qubits, and k EPR channels must be shared between the client and server to enable teleportation of this state. Similarly, ⎡ ⎢ ⎤ ⎥ d log 2 EPR channels are required to teleport the computational input Y ñ | T ext from client to server, and a further ⎡ ⎢ ⎤ ⎥ d log 2 EPR channels are required to teleport the computational Figure 2. Protocol for remote quantum processing: for each of the client's requests, the server first repeatedly runs the LCC till it succeeds. The client then teleports a quantum control state fñ | C to the server using quantum teleportation EPR channels to complete his computation. The computational input Y ñ | T ext can be transmitted to the server (and the computational output Y ñ | U T T ext back to the client) using additional quantum-teleportation channels or direct transmissions. output from server to client (d is defined as previously). To start the computation, the client requests the server to run the LCC, and the server repeatedly runs the LCC on the EPR channels (resetting them as required). When the LCC succeeds, the server informs the client and performs teleportation measurements on the LCC output and corresponding EPR channels. Finally, the client performs teleportation measurements on fñ | C and Y ñ | T ext (and the corresponding EPR channels). When all LCC and teleportation steps succeed, By keeping the control state fñ | C hidden from the server, this protocol can provide security for the client's computation. We first consider the simplest case where the client only sends a one-qubit control state to the server so that a linear combination of two quantum operations A and B can be implemented. The corresponding quantum circuit is shown in figure 3(A), where we assume that A and B are not black-box operations and also ignore the teleportation of the input state for the computation. The circuit starts from the initial state 4 . In the case where the server follows the protocol, the server first runs the LCC until it succeeds-the qubit 3 (local control qubit) is then measured to be '0' in computational basis. The state of remaining qubits is . The client then performs the quantum teleportation. When he measures the qubit 1 and qubit 2 to be '0' in computational basis, the state of remaining qubit becomes immediately. During the whole process, the server does not have any chance to detect the control state (encoded in the qubit 1 by the client's local operation P), because he needs to measure the local control qubit (qubit 3) before the client performs the configuration of control.
Next we consider the case where the server does not perform the measurement on the local qubit before the teleportation as our protocol demands. In this case, the circuit will evolve as shown in figure 3(B). When the client measures the qubit 1 and qubit 2 to be '0', the state of remaining qubits will be a (we denoted it as Yñ | ). Now the question is that whether the server can extract the information of the control state f without being detectable to the client. To achieve this, the server needs to extract fñ | C and also output the correct result of the computation a b j to the client. In other words, the server needs to find an operation U s satisfying Such an operation U s does not exist for unknown parameters α and β, because it would allow copying of an unknown quantum state which violates the no-cloning theorem [29,30]. However, it is possible for the server (or a third party) to generate a copy of the control state with imperfect fidelity, for example, by using a universal quantum cloning machine (UQCM) [31,32] even with a single copy of the control state. Such cloning attacks are difficult to prevent since they could be disguised as channel loss, and thus can lead to leaking of information about the client's computation. For many applications such as Shor's factorization algorithm [1] and Grover's search algorithm [2], the client can get the result by just running the protocol a few times. Then the server (or a third party) might potentially obtain partial information about the control state by using UQCM. For applications that require many runs of the protocol, the client would need to send excess copies of the control state, and thus the server might potentially gain complete information about the control state, for example, by using quantum state tomography. To address this vulnerability we present a modified protocol below. 3 is the EPR state shared between the client and the server. A and B are two arbitrarily large quantum operation of the same size. jñ | 4 is the input state for the client's computation. We ignore the teleportation process of jñ | 4 from the client to the server. P is a local single-qubit operation to configure the one-qubit control state fñ | C . The server repeatedly runs the LCC until he measures the local control qubit (qubit 3) to be '0', and then he informs the client to start the configuration and teleportation of the control state. (B) In this case, the server tries to cheat by not performing the measurement on the local control qubit, and directs the client to start the teleportation process. Yñ | represents the state of remaining qubits that the server obtains when the quantum teleportation succeeds. A step-by-step evolution is shown in supplementary material.
For a computation with the control state r where n is the number of dimensions of ρ and   < -( ) n 0 1 1. r m can be generated by sending its eigenstates with probabilities given by corresponding eigenvalues. On each run of the protocol, the client sends the control state ρ with probability   + ( ) 1 and the decoy state r m with probability  + ( ) 1 1 . As the client knows exactly what state he sent each run, he can just discard the output states corresponding to the decoy states and keep the correct ones for further applications. From the perspective of the server, the state received will be The state  n has the maximal entropy (= n log ), implying that the server has no knowledge about the received states at all.
The client can verify the result directly for certain applications (e.g. Shor's factorization and Grover's search) but not others (e.g. some large quantum simulations). However, the client is still able to verify (or monitor) the computation process for applications whose results cannot be verified directly. We have shown that the decomposed component V i can be as simple as a tensor product of single-qubit gates and can therefore be verified with limited resources. Throughout the full computation process, the client can randomly send each basis state ñ |i ( = - i n 0, 1, , 1) to the server, and since only the corresponding component V i is applied, the output can be checked (via state tomography or measurements in multiple bases). This approach allows the client to diagnose whether the server is running the LCC correctly, and it can be combined with the strategy above for preventing the control state from being measured by the server (or a third party): the client chooses a proportion of the runs of the protocol for performing computation and the rest of the runs of the protocol for verification. Assuming the proportion of runs of the protocol for computation to be τ ( t < < 0 1), the client would send the control state ρ with probability   t + ( ) 1 , the decoy state r m with probability  t + ( ) 1 , and each basis state ñ |i with probability t -( ) n 1 on each run. The state the server receives is then Therefore, although the whole computation process takes longer, the server is given no information about whether the states it receives are for verification purposes or for performing an algorithm, and no information about the control state. If the server intercepts a fixed proportion of the control qubits in a way which randomizes the results, the probability that the server is not detected is suppressed exponentially as the number of runs of the protocol grows. We have shown that the success probability of the LCC decreases exponentially with the number of control qubits. However, in the secure quantum processing protocol, the server only needs to inform the client when the LCC succeeds, ensuring that the LCC works with 100% success probability from the standpoint of the client. The success probability for teleporting the control state exponentially decreases with the number of teleported qubits, implying poor scaling with large control states. Therefore, our protocol is practical only for small control states, i.e. the number of linear terms n should be polynomial-sized with respect to the problem size. For a typical case of the modified protocol combining verification and computation where  = -( ) n 1 1 and t = 1 2, the probability of the client sending the control state ρ for each run will be n 1 2 , and thus the number of runs of the protocol required will be ( ) O n 2 times more than the original protocol, which brings only polynomially increasing cost. The whole client-server computation scheme could (where required) include the quantum teleportation of the computation input and output. Teleporting the output has 100% success probability with necessary correction operations, while the success probability of teleporting the input depends on the dimension d of the target operation (specifically, equals to d 1 2 ) since the correction operations generally do not commute with the target operation. Taking these teleportation steps into account, the success probability of the whole scheme is poly . The client here is required to have the capability to create small control states, which is trivial compared to the capabilities that the server must have. It is also noteworthy that the success probability could be further improved by using port-based teleportation (rather than conventional quantum teleportation) [33,34], which transmits a one-qubit state to one of K output ports using K EPR pairs and is asymptotically faithful and deterministic for large K.

Experimental demonstration
Here we report on a demonstration of our protocol using a linear-optic setup, which realizes a circuit for generating linear combinations of two single-qubit gates with one-qubit quantum control, as shown in figure 4(A). Our experimental setup exploits both path and polarization degrees of freedom of photons. Since direct implementation of controlled-V j ʼs is very challenging using current technology, we demonstrate a LCC using the method shown in figure 4(B). To understand how it works, suppose that server starts with a single photon in the state a y b where yñ | is an (arbitrary) polarization-encoded qubit, b and r label the blue and red spatial modes, and ñ |vac represents unoccupied modes (and will be dropped below). Two single-qubit gates A and B act only on photon in the blue or red path respectively, yielding the state: r . The blue and red modes are then mixed on a (non-polarizing) beam splitter (BS) to remove path information. In the case where the photon exits at port 2, the output state of the photon which is obtained is a b y , which corresponds to the action of linear combination a b + A Bon yñ | . In the remote quantum processing scenario, client and server start by sharing a pair of entangled photons in state f y f y V (client photon) and yñ | (server photon) encodes a qubit in the polarization basis. When the blue and red modes of client's photon are mixed on a polarizing beam splitter (PBS), the client-server state becomes a y b y a y b y and contributions corresponding to anti-diagonal polarization at 1 and ¢ 1 have been dropped (corresponding to postselection on detection outcomes with diagonal-polarization only). In the case where client's photon exits at port 1, the state of the server's photon is given by equation (10), and the operation a b + A Bis implemented as above. The experimental setup is shown in figure 4(C), and the details are shown in appendix.
It is worth noting that an arbitrary single-qubit quantum operation (see details in supplementary material). Therefore, linear combination of four gates would be required to implement an arbitrary single-qubit operation if the server were to provide only Pauli gates as the resource to the client. In our experimental setup, the two single-qubit gates provided by the server can be arbitrarily configured, which allows us to demonstrate the secure realization of a wide range of linear-combination operations. We tested a series of linear-combination operations where the two single-qubit gates are set to be  . When the photons exit at port 1 and 2, the output state of the photon on server's side will be a b y , where α and β are controlled by client's one-qubit control state f In our setup, entangled photon pairs are generated by a SPDC source using paired type-I BiBO crystal in a sandwich configuration. P 1b and P 1r (Q 2b and Q 2r ) configure fñ | ( yñ | ). A and B can implement arbitrary single-qubit gates. Further details are given in the appendix.
The linear combinations of A and B are always unitary when the client's one-qubit control state has real amplitudes. Our main results are shown in figure 5, and additional results are also given in supplementary material. Our protocol also allows the client to implement non-unitary operations (even though the server provides only unitary gates). For example, when the two gates A and B are set to be X (Pauli-X) and Z (Pauli-Z) gates respectively, the client can implement non-unitary operation To evaluate the performance of each the operations we tested, we performed quantum process tomography and reconstructed corresponding process (χ) matrices from the experimental data, using the maximum-likelihood-estimation technique. As shown in figure 5, all of the reconstructed process matrices achieve high process fidelities compared to the corresponding ideal cases.
Our experiment serves as a proof-of-principle demonstration of the essential part of our protocol-a remote control state can be used to implement the linear-combining operation. As we mentioned above, the server (or a third party) could use a UQCM to extract partial information about the control state. Also, as post-selection was used in the experiments to choose cases where the teleportation of the control state and the LCC succeed simultaneously, the server can obtain extra copies of the control state by disguising his measurements as failures of the LCC, leading to potential information leak of the control state.
The proposed modified protocol aims to eliminate possible leak of the control state, but requires enhanced capability of the experimental setup. In particular, it costs much increased experimental time to generate the required mixed states and thus needs improved robustness and stability-which would be challenging for our current bulk-optical setup (but could potentially be achieved in a future experiment using integrated photonic waveguide techniques [35][36][37]). Possible issues for future demonstration of the modified protocol include experimental imperfections, loss in transmission channels and the photon source. Imperfections in the server's gates (such as A, B, Q 2b , Q 2r shown in figure 4(C)) do not affect the security of the protocol, rather just the outcome of the computation. Imperfections in the client's gates (such as P 1b , P 1r shown in figure 4(C)) can affect the creation of the mixed state  n (and also potentially mimic effects of a malicious third party or server) and thereby reduce the security offered by the modified protocol. However, loss in the transmission channels would not cause any added security issue for the modified protocol, since it would just act as a normalization factor for the mixed state  n. The SPDC photon source creates photon pairs probabilistically, which can be viewed as being equivalent to loss in the channels from a deterministic source, and the security is similarly unaffected by this. A completely quantitative security analysis is beyond the scope of this work and is for future research.

Conclusion
In summary, we have described and demonstrated a novel protocol, which can enable a client to implement complex quantum processing on a remote server without revealing the precise algorithm to the server. We leave as an interesting open question whether unconditional security can always be guaranteed using our protocol, which will require an information-theoretic analysis of diverse attacks on the security, as well as the effects of experimental imperfections, such as multi-pair contributions to the state generated by the SPDC source. Although our discussion has focused on protecting the privacy of the client's algorithm, it can be extended to protect the privacy of the client's data by exploiting existing encryption schemes [4]. Our protocol cannot always achieve efficient implementation of arbitrary quantum circuits (efficient universality), but it could be suitable for some practicable applications, for example, adding control to a remote operation, with less resources and experimental difficulties. The LCC circuits used by our protocol are based on decompositions into linear combinations of elementary gates, and differ greatly from the circuits generated by the Solovay-Kitaev algorithm [38] for example. Compared with more conventional techniques to implement quantum computation, such linear-combination-based methods would lead to greater efficiency for some problems: Several works have shown that simulations of Hamiltonian dynamics based on linear combinations of unitary operations can achieve exponentially improved precision-dependence compared to the conventional product-formula-based algorithms [39,40], and even nearly optimal dependence on all parameters [41]. By using the linearcombination technique, the dependence on precision can be exponentially improved [42] compared to the Harrow-Hassidim-Lloyd algorithm [43] for the quantum linear systems problem. It can also reduce the query complexity and improve precision for simulations of open quantum systems [26] based on linear combinations of Kraus operators [44]. These applications generally require linear combinations of a great number of unitary operations. It is an interesting open question whether there exist some particular instances that can critically benefit using only a limited number of linear terms.Considering the alternative interpretation of the LCCs in duality quantum computation, our protocol could be treated as an interesting and important application of duality quantum computation. Finally, the protocol we have demonstrated here can be implemented in a wide range of physical systems. For example, future photonic demonstrations of our protocol could exploit time-bin and orbital angular momentum degrees of freedom (which can offer high-dimensional quantum subspaces) to implement complex controlled operations.