week ending

PRL 119, 050503 (2017) PHYSICAL REVIEW LETTERS 4 AUGUST 2017

Experimental Blind Quantum Computing for a Classical Client

He-Liang Huang,1,2,3 Qi Zhao,4 Xiongfeng Ma,4,* Chang Liu,1,2 Zu-En Su,1,2 Xi-Lin Wang,1,2 Li Li,1,2,† Nai-Le Liu,1,2,‡
Barry C. Sanders,1,2,5,6 Chao-Yang Lu,1,2,§ and Jian-Wei Pan1,2
1
Hefei National Laboratory for Physical Sciences at Microscale and Department of Modern Physics,
University of Science and Technology of China, Hefei, Anhui 230026, China
2
CAS-Alibaba Quantum Computing Laboratory, CAS Centre for Excellence in Quantum Information and Quantum Physics,
University of Science and Technology of China, Shanghai 201315, China
3
Henan Key Laboratory of Quantum Information and Cryptography, Zhengzhou Information Science and Technology Institute,
Zhengzhou, Henan 450000, China
4
Center for Quantum Information, Institute for Interdisciplinary Information Sciences, Tsinghua University, Beijing 100084, China
5
Institute for Quantum Science and Technology, University of Calgary, Alberta T2N 1N4, Canada
6
Program in Quantum Information Science, Canadian Institute for Advanced Research, Toronto, Ontario M5G 1M1, Canada
(Received 13 February 2017; published 2 August 2017)
To date, blind quantum computing demonstrations require clients to have weak quantum devices. Here we
implement a proof-of-principle experiment for completely classical clients. Via classically interacting with two
quantum servers that share entanglement, the client accomplishes the task of having the number 15 factorized
by servers who are denied information about the computation itself. This concealment is accompanied by a
verification protocol that tests servers’ honesty and correctness. Our demonstration shows the feasibility of
completely classical clients and thus is a key milestone towards secure cloud quantum computing.

DOI: 10.1103/PhysRevLett.119.050503

Whereas quantum computers could exponentially out- Besides security, verifiability is another important con-
perform classical computers for certain computational tasks, cern for BQC, i.e., the ability of a client to test whether or
inaccessibility due to implementation complexity would not the servers perform the task correctly and honestly. As
hinder widespread adoption of quantum computing. Thus, the complexity of quantum many-body systems scales up,
quantum computation is increasingly being performed “in verifiability becomes a major experimental challenge, not
the cloud,” such as IBM’s 5-qubit quantum cloud service [1]. only in BQC, but also in quantum chemistry [22], quantum
In this approach, quantum computing is outsourced from a simulation [23], boson sampling [24], and other quantum
client with classical hardware to a server who possesses algorithms. Thus, a verification protocol for BQC is
expensive quantum hardware. Considering the types of significant not only as a cryptographic protocol but also
applications to which quantum computing is likely to be for exploring the relation between quantum physics and
applied, imformation security is important as clients may computer science.
wish to keep the computation perfectly secret from untrusted Here we demonstrate a proof-of-principle implementa-
servers implementing the quantum computation. tion of BQC for completely classical clients. In our
A solution to this issue is offered by blind quantum experiment, we realize Shor’s algorithm [25] for factorizing
computing (BQC) [2], which is a quantum cryptographic N ¼ 15 via the framework of verifiable BQC based on the
protocol that enables a classical client with limited quantum Reichardt, Unger, and Vazirani protocol [14]. The scheme
technology to delegate a computation to the quantum employs quantum gate teleportation for computation and
server(s) without leaking any information about her com- combines the rigidity of Clauser-Horne-Shimony-Holt
putation to the server(s). Thus far various BQC protocols (CHSH) tests [14] and stabilizer tests for verification,
have been proposed [2–15], and some proof-of-principle thereby providing a method for a client to control quantum
experiments have been performed with photonic qubits servers classically.
[16–20]. However, all these experimental demonstrations Suppose we are given two quantum servers, Alice and
only support quasiclassical clients. That is, the clients Bob, that share Einstein-Podolsky-Rosen (EPR) states but
require the ability to prepare or measure single-qubit states, cannot communicate with each other (enforced, e.g.,
but wide use of quantum computing on the cloud would be through spacelike separation of the devices). The client
much more attractive if clients did not require the ability to Charlie, holding a completely classical device, wants to
perform quantum tasks. Although using only classical delegate quantum computing to the remote servers without
communication between a classical client and a single leaking any information about the computation to servers.
quantum server may be infeasible for secure BQC [21], He can decompose the circuit into two parts, computation A
classical communication between a classical client and and computation B, and send these two tasks to Alice and
multiquantum servers can work [14]. Bob, respectively. Alice and Bob operate on their respective

0031-9007=17=119(5)=050503(5) 050503-1 © 2017 American Physical Society

 week ending
PRL 119, 050503 (2017) PHYSICAL REVIEW LETTERS 4 AUGUST 2017

halves of the shared EPR states according to Charlie’s state after the first CNOT gate in the circuit in Fig. 1(b). Then
commands and return to Charlie the measurement results. Bob implements computation B to achieve the second CNOT
As Alice and Bob cannot communicate with each other, gate and measures his second qubit in the Pauli X basis to
they cannot learn the results from each other, so this output the result of Shor’s algorithm. Bob’s remaining two
delegated computation is “blind,” meaning that each server qubits contribute nothing to the outcome and are both
learns nothing more about the computation than its measured in the Pauli Z basis as they can be employed in
length [14]. the validation procedure described below.
For the task of factorizing N using Shor’s algorithm, if When performing such a computation on untrusted
we pick a random number a that is coprime to N, Shor’s quantum servers, clients also wish to test the honesty of
algorithm can yield the minimum integer r that satisfies servers: did they implement the computation as promised?
ar mod N ¼ 1. From this period r, the prime factors of N To realize this test, Charlie randomly switches tasks being
are given by the greatest common divisor (GCD) of ar=2 1 implemented by Alice and Bob between the desired
and N, which is solved classically. The quantum circuit for computation and “dummy” protocols. The dummy proto-
N ¼ 15 and a ¼ 11 is shown in Fig. 1(a) [26]. In fact, The cols are constructed such that Alice and Bob are unable to
inverse QFT is unnecessary for any order-2l circuit [27]. distinguish whether they are implementing the proper
Moreover, two qubits j0i2 and j1i4 evolve trivially during computation or the dummy, but such that Charlie is able
the computation and thus can be omitted. This fact allows to detect if the dummy tasks are being implemented
us to simplify the circuit to Fig. 1(b) by omitting obsolete dishonestly. Via repeated application of this randomized
qubits and operations marked by dotted lines in the circuit procedure, Charlie then determines whether Alice and Bob
in Fig. 1(a). are being honest. Specifically, Charlie can randomly
To delegate the circuit in Fig. 1(b) to two remote command the servers [see Fig. 2(a)] to implement the four
quantum servers, Charlie decomposes it into two parts subprotocols below:
[see Fig. 1(c)] and sends the tasks to Alice and Bob, 1. Computation. As shown in Fig. 1(c), the computation
respectively. Each observable of Alice (Bob) has eigen- is realized as the joint evolution of two isolated quantum
values 1 such that each outcome ai ðbi Þ reported to servers. In our experiment, computation A and computation
Charlie takes values of 1, where i denotes the ith qubit B can be compiled into the setup in Fig. 2(b), where the
of Alice (Bob). By design, computation A performs the first logical qubits j0i and j1i are encoded by horizontal (H) and
controlled-NOT (CNOT) gate of the circuit and prepares the vertical (V) polarizations of single photons, respectively.
third input state j0i for Bob. If Alice implements compu- Instead of implementing the standard CNOT gate between
tation A honestly, Bob’s share of EPR states collapses into the first and second qubits in computation A, Charlie can
jΨ ijβi, where jΨ i is one of the four Bell states, and ask Alice to use a polarizing beam splitter to postselect
jβi ∈ fj0i; j1ig, according to Alice’s results. In particular, events where there is exactly one photon exiting each
when Alice reports a1 ¼ a2 ¼ a3 ¼ 1, Bob’s state collap- output
pffiffiffi [the first two EPR states are transformed into
ses into thepdesired
ffiffiffi resource state jϕi ¼ jΦþ ij0i, where 1= 2ðj0i1 j0iA2 j0iB1 j0iB2 þ j1iA1 j1iA2 j1iB1 j1iB2 Þ after postse-
A

jΦ i ¼ ð1= 2Þðj00i  j11iÞ, which is equivalent to the lection, where A (B) represents Alice (Bob)], and measure
(a) (c)
these two photons in the Pauli X basis.
|0
R1
H H Computation-A If Alice’s reported results yield a1 a2 ¼ a3 ¼ 1, then
|0
R2
H Z H Bob’s share of the EPR states collapses onto the desired
|0 1 Alice
H state jϕi. The CNOT gate in computation B can be realized
|0 2 by combining three polarization-dependent beam splitters
|0 3 (PDBS)—an overlapping PDBS (T H ¼ 1 and T V ¼ 1=3),
EPR

|1
4
and two supplementary PDBSs (T V ¼ 1 and T H ¼ 1=3) at
Initialization
Modular
Exponentiation
Inverse QFT each exit port of the overlapping PDBS, along with two
(b) H Hadamard gates (HWP) on the target photon before and
Bob
|0
R2 H H after the PDBS [28]. The different treatment of the CNOT
|0 1
Computation-B
gates arises because Bob is required to complete the
|0 3 computation and convey the final outcomes, so he is
instructed to implement the complete Bell measurement.
FIG. 1. Quantum circuit for factorizing N ¼ 15 using Shor’s However, Alice only needs to prepare resource states for
algorithm. (a) Quantum circuit for N ¼ 15 and a ¼ 11 [26]. The Bob. As long as Alice can prepare the desired states, we
modular exponential function is implemented by two CNOT gates,
deem her to be honest.
and the quantum Fourier transformation (QFT) is implemented
by Hadamard rotations and two-qubit conditional-phase gates.
2. CHSH test. Charlie sends random bits A ∈ f0; 1g and
(b) The simplified version of the circuit in (a), omitting the qubits B ∈ f0; 1g to Alice and Bob, respectively, which deter-
and operations marked by dotted lines in (a). (c) The scheme of mines their measurement bases, and they respond with bits
cloud quantum computing for factorizing N ¼ 15. Each meas- M ∈ f0; 1g and N ∈ f0; 1g corresponding to their binary
urement is in the Z basis. measurement outcomes [see Fig. 2(c)]. In this test, Alice
050503-2
 week ending
PRL 119, 050503 (2017) PHYSICAL REVIEW LETTERS 4 AUGUST 2017

(a)

Charlie
CHSH CHSH

Computation-A Alice Bob Computation-B

(b) (c) (d) (e)

Alice

HWP
UV-Pulse

BBO
CNOT

Bob PDBS
QWP
PBS

Computation CHSH games State tomography Process tomography

FIG. 2. Experimental setup. (a) Outline of the scheme. Charlie classically interacts with quantum servers Alice and Bob who share
entanglement. Each of the quantum servers is randomly commanded to implement one of the two types of operations, CHSH and
computation AðBÞ. (b) Computation setup. Ultraviolet laser pulses with a central wavelength of 394 nm, pulse duration of 150 fs, and
repetition
pffiffiffi rate of 80 MHz pass through three β-barium borate (BBO) crystals to produce three polarization-entangled pairs
ð1=pffiffi2ffiÞðjHijVi þ jVijHiÞ. A half-wave plate (HWP) is placed at an arm of the entangled pairs to produce EPR states
ð1= 2ÞðjHijHi þ jVijViÞ. To achieve good spatial and temporal overlap, all photons are spectrally filtered with 3-nm bandwidth
filters. The final measurement results are then read out by single-photon detectors with dual-channel structure, which partially eliminates
higher-order events. (c) CHSH test setup. (d) State tomography setup. (e) Process tomography setup.

and Bob “win” if AB ¼ M ⊕ N, and they can win with reports the wrong stabilizer syndrome in even a single
probability ω ¼ cos2 ðπ=8Þ ≈ 0.854 if Bob measures in the round, Charlie can reject. If Alice plays honestly, Charlie
Pauli Z basis for B ¼ 0 or PaulipXffiffiffi basis for B ¼ 1, and if accepts with high probability.
Alice measures ½Z þ ð−1ÞA X= 2. According to Alice’s 4. Process tomography. Charlie asks Bob to implement
and Bob’s measurement outcomes a and b, i.e., 1, Charlie computation B while running the CHSH test with Alice
sets M and N to 0 or 1. In contrast, classical servers can win [see Fig. 2(e)]. If Bob honestly implements the command,
with probability at most 3=4. In our protocol, Charlie can Alice’s state collapses to jβijΨ i. Alice is required to
also change the strategy to simultaneously swap the measure in the bases Z1 X2 X3 or Z1 Z2 Z3, where the last
measurement bases of Alice and Bob; that is, Alice pffiffiffi two bases, X2 X3 and Z2 Z3 , are the Bell-state stabilizers,
measures Z or X, and Bob measures ½Z þ ð−1ÞB X= 2. and the first basis Z1 is the stabilizer of jβi. Therefore, if
According to the rigidity of the CHSH test [14], if the Alice reports the wrong stabilizer syndrome in even a single
servers win with probability close to ω , the implement round, Charlie can reject. If Bob plays honestly, Charlie
strategy is close to the ideal strategy. To ensure servers’ accepts with high probability.
honesty, Charlie runs n rounds of CHSH tests with Charlie runs protocol 1 with a small probability η, and
both servers, and rejects if the serverspffiffiffifail
pto win at least
ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi another three alternative protocols with probability ð1−ηÞ=3

ðω − εÞn rounds, where ε ¼ ½1=ð2 2Þ log n=n is the so that servers are not aware of which protocol their
error threshold [29,30]. measurements belong to. For instance, from Alice’s per-
3. State tomography. Charlie asks Alice to implement spective, she is entirely unaware whether Bob is implement-
computation A while running the CHSH test with Bob [see ing the CHSH test or computation B. From the CHSH test
Fig. 2(d)]. If Alice honestly implements the command, and stabilizer test, Charlie can determine whether the servers
Bob’s state collapses to jΦ i ⊗ jβi. Bob is required to are being honest or not. The relationship among η, computa-
measure in the bases X1 X2 Z3 or Z1 Z2 Z3, where the first tional efficiency, and security parameters are analyzed in
two bases X1 X2 and Z1 Z2 are the stabilizers for the Bell Supplemental Material [30].
states, and Z3 is the stabilizer of jβi. In these cases, Bob’s To demonstrate the scheme, we employ polarization-
measurement outcomes are deterministic, depending on entangled photons jΦþ i generated by spontaneous para-
Alice’s results. Thus, Charlie can test whether Alice is metric down-conversion using a HWP-sandwiched β-barium
honest according Bob’s measurement outcomes. If Bob borate (BBO) crystal [34]. For protocol 1, experimental
050503-3
 week ending
PRL 119, 050503 (2017) PHYSICAL REVIEW LETTERS 4 AUGUST 2017

(a) (b) (c)

FIG. 3. Experimental results for honest Alice and Bob. (a) Output of quantum computing for factorizing N ¼ 15, which is determined
by the results of the second photon Bob observed in the subprotocol computation. Theoretical predictions and measured expectation
values are shown as red and blue bars, respectively. (b) The probability that Alice passes the tests of state tomography when Bob
measures in the X 1 X 2 Z3 and Z1 Z2 Z3 bases. (c) The probability that Bob passes the tests of process tomography when Alice measures in
the Z1 X 2 X 3 and Z1 Z2 Z3 bases.

results are shown in Fig. 3(a). If Alice and Bob play honestly, Z3 , the probability of passing the tests for X 1 X2 Z3 and
then, with probability ∼51.9%, the output is j0i, correspond- Z1 Z2 Z3 measurements is 0.47(4) and 0.49(4) [Fig. 4(b)],
ing to a failure. The remaining ∼48.1% probability yields respectively. Obviously, Charlie can easily identify that
j1i. Combining these with the known state of the redundant Alice is dishonest based on Bob’s reported results.
qubit j0iR1 using classical processing yields the period Protocol 4 monitors whether Bob honestly executes
r ¼ 2. Thus, GCDð112=2  1; 15Þ ¼ 3, 5, yielding a suc- computation B. If Bob plays honestly, Alice’s measurement
cessful factorization. To quantify the performance of the outcomes are deterministic, depending on Bob’s results.
CNOT operations realized by the PDBS, we measure process Figure 3(c) shows the theoretical and experimental results.
fidelity [35] for the CNOT gate as 0.87ð2Þ ≤ Fprocess ≤ The probability that Bob passes the tests is 0.87(2) and
0.93ð2Þ (see Supplemental Material [30] for details). 0.86(2) when Alice measures in the Z1 X2 X3 and Z1 Z2 Z3
In our experiment, we run n ¼ 6000 rounds of bases (see Supplemental Material [30] for details), respec-
CHSH tests; tively. To demonstrate that the method detects whether Bob is
pffiffiffi then the error threshold is calculated as
pffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
ε ¼ ½1=ð2 2Þ log n=n ¼ 0.014. Two honest quantum cheating, we consider two possible circumstances: (1) If Bob
servers win with the probability ∼0.846ð6Þ, from which ε measures the last two qubits in the Z2 Z3 basis instead of the
is calculated as ε ¼ 0.007ð6Þ—below the error threshold. X2 Z3 basis, the probability of passing the tests [Fig. 4(c)]
Thus, Charlie accepts the protocol (see Supplemental drops to 0.52(4) when Alice measures in the Z1 X2 X3 basis
Material [30] for more detailed security analysis). On the and remains at 0.89(3) in the Z1 Z2 Z3 basis. (2) If Bob’s first
other hand, if the quantum servers play dishonestly, for measurement basis is Z1 instead of X1 , the probability of
example, making the angle of the HWP in Bob’s measure- passing Z1 X2 X3 and Z1 Z2 Z3 tests is 0.41(4) and 0.47(3)
ment setup always 5° higher than the target angle, they win [Fig. 4(d)], respectively. Thus, Bob’s cheating can easily be
with probability ∼0.814ð5Þ and thus ε ¼ 0.047ð5Þ, which is caught.
above the threshold, and Charlie rejects. This scheme is device independent, in that it mitigates
Protocol 3 is designed to monitor whether Alice honestly the need for clients to place trust in any preexisting device.
executes computation A. If Alice plays honestly, Bob’s The scheme is theoretically efficient, in the sense that its
measurement outcomes are deterministic, depending on number of rounds scales with circuit size n, Oðnc Þ, where c
Alice’s results. Figure 3(b) shows the theoretical and is a constant [11,14]. Subsequent results indicate that
experimental results. The probability that Alice passes the number of rounds can be reduced if we require only
the tests is 0.92(2) and 0.94(2) when Bob measures in one-sided device independence [15].
the X 1 X 2 Z3 and Z1 Z2 Z3 bases (see Supplemental Material In summary, we experimentally demonstrate secure com-
[30] for details), respectively. To illustrate that the method putation on quantum cloud servers using a photonic setup
can detect whether Alice is cheating, we consider two where three EPR states are shared between two quantum
typical potential means of cheating: (1) If Alice deliberately servers. In our implementation, the correctness of results can
reports the opposite outcomes of the first qubit, and the be tested through verification protocols, based on the rigidity
reported results yield a1 a2 ¼ 1ð−1Þ, then Bob’s share of of the CHSH test and stabilizer tests. Our experiment
the EPR state collapses into jΦ− ij0i (jΦþ ij0i) instead of introduces the features of multiple servers, device independ-
into jΦþ ij0i (jΦ− ij0i) so the probability of passing the ence, and, especially, a completely classical client, leading to
tests [see Fig. 4(a)] drops to 0.06(2) when Bob measures in a heuristic exploration for future secure distributed quantum
the X1 X2 Z3 basis and remains at 0.91(2) in the Z1 Z2 Z3 networks in the cloud. This type of encryption is crucial to
basis; (2) if Alice’s third measurement basis is X3 instead of enable scalable models for secure, outsourced quantum
050503-4
 week ending
PRL 119, 050503 (2017) PHYSICAL REVIEW LETTERS 4 AUGUST 2017

(a) (b) [8] M. Hayashi and T. Morimae, Phys. Rev. Lett. 115, 220502
(2015).
[9] V. Dunjko, E. Kashefi, and A. Leverrier, Phys. Rev. Lett.
108, 200502 (2012).
[10] M. Hajdušek, C. A. Pérez-Delgado, and J. F. Fitzsimons,
arXiv:1502.02563.
[11] A. Gheorghiu, E. Kashefi, and P. Wallden, New J. Phys. 17,
083040 (2015).
[12] A. Mantri, C. A. Pérez-Delgado, and J. F. Fitzsimons, Phys.
Rev. Lett. 111, 230502 (2013).
(c) (d)
[13] C. A. Pérez-Delgado and J. F. Fitzsimons, Phys. Rev. Lett.
114, 220502 (2015).
[14] B. W. Reichardt, F. Unger, and U. Vazirani, Nature
(London) 496, 456 (2013).
[15] A. Gheorghiu, P. Wallden, and E. Kashefi, New J. Phys. 19,
023043 (2017).
[16] S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons,
A. Zeilinger, and P. Walther, Science 335, 303 (2012).
[17] S. Barz, J. F. Fitzsimons, E. Kashefi, and P. Walther, Nat.
Phys. 9, 727 (2013).
FIG. 4. Experimental result for dishonest Alice and Bob. [18] K. Fisher, A. Broadbent, L. Shalm, Z. Yan, J. Lavoie,
(a) Probability that Alice passes the tests of state tomography R. Prevedel, T. Jennewein, and K. Resch, Nat. Commun. 5,
when Bob measures in X 1 X 2 Z3 and Z1 Z2 Z3 bases, if Alice 3074 (2014).
deliberately reports the opposite results for the first qubit. [19] C. Greganti, M.-C. Roehsner, S. Barz, T. Morimae, and
(b) Probability that Alice passes the tests of state tomography P. Walther, New J. Phys. 18, 013020 (2016).
when Bob measures in X 1 X 2 Z3 and Z1 Z2 Z3 bases, if Alice’s third [20] K. Marshall, C. S. Jacobsen, C. Schäfermeier, T. Gehring,
measurement basis is X 3 instead of Z3 . (c) Probability that Bob C. Weedbrook, and U. L. Andersen, Nat. Commun. 7,
passes the tests of process tomography when Alice measures in 13795 (2016).
Z1 X 2 X 3 and Z1 Z2 Z3 bases, if Bob measures the last two qubits in [21] S. Aaronson, A. Cojocaru, A. Gheorghiu, and E. Kashefi,
Z2 Z3 instead of the X 2 Z3 basis. (d) Probability that Bob passes the arXiv:1704.08482.
tests of process tomography when Alice measures in Z1 X 2 X 3 and [22] Z. Gan and R. J. Harrison, in Proceedings of the ACM/IEEE
Z1 Z2 Z3 bases, if Bob’s first measurement basis is Z1 instead of X 1 . SC 2005 Conference (IEEE, New York, 2005), p. 22.
[23] C. Senko, J. Smith, P. Richerme, A. Lee, W. Campbell, and
C. Monroe, Science 345, 430 (2014).
computation to emerge, paving the way for the commer- [24] S. Aaronson and A. Arkhipov, Quantum Inf. Comput. 14,
cialization and widespread adoption of quantum computer 1383 (2014).
technology. [25] P. W. Shor, SIAM J. Comput. 26, 1484 (1997).
[26] C.-Y. Lu, D. E. Browne, T. Yang, and J.-W. Pan, Phys. Rev.
We thank P. Rohde, M. McKague, X. Wu, Y.-H. Luo, Lett. 99, 250504 (2007).
C.-Y. Lai, K.-M. Chung, and X. Yuan for helpful [27] B. P. Lanyon, T. J. Weinhold, N. K. Langford, M. Barbieri,
discussions. This work was supported by the National D. F. V. James, A. Gilchrist, and A. G. White, Phys. Rev.
Natural Science Foundation of China, the Chinese Lett. 99, 250505 (2007).
Academy of Sciences, and the National Fundamental [28] N. Kiesel, C. Schmid, U. Weber, R. Ursin, and H.
Research Program. B. C. S. acknowledges financial support Weinfurter, Phys. Rev. Lett. 95, 210505 (2005).
from AITF, NSERC, and China’s 1000 Talent Plan. [29] B. W. Reichardt, F. Unger, and U. Vazirani, arXiv:
1209.0448.
[30] See Supplemental Material http://link.aps.org/supplemental/
10.1103/PhysRevLett.119.050503 for more information
* about the security analysis, and the details for CNOT gates,
[email protected] CHSH games, state tomography, and process tomography,
†
[email protected] which includes Refs. [31–33].
‡
[email protected] [31] M. McKague, New J. Phys. 18, 045013 (2016).
§
[email protected] [32] A. W. Coladangelo, Quantum Inf. Comput. 17, 0831 (2017).
[1] IBM, http://www.research.ibm.com/quantum/. [33] X. Wu, J.-D. Bancal, M. McKague, and V. Scarani, Phys.
[2] A. Broadbent, J. Fitzsimons, and E. Kashefi, in Proceedings Rev. A 93, 062121 (2016).
of the 50th Annual IEEE Symposium on Foundations of [34] X.-L. Wang, L.-K. Chen, W. Li, H.-L. Huang, C. Liu,
Computer Science (IEEE, New York, 2009), pp. 517–526. C. Chen, Y.-H. Luo, Z.-E. Su, D. Wu, Z.-D. Li, H. Lu,
[3] J. F. Fitzsimons and E. Kashefi, arXiv:1203.5217. Y. Hu, X. Jiang, C.-Z. Peng, L. Li, N.-L. Liu, Y.-A. Chen,
[4] D. Aharonov, M. Ben-Or, and E. Eban, arXiv:0810.5375. C.-Y. Lu, and J.-W. Pan, Phys. Rev. Lett. 117, 210502
[5] T. Morimae and K. Fujii, Nat. Commun. 3, 1036 (2012). (2016).
[6] T. Morimae and K. Fujii, Phys. Rev. A 87, 050301 (2013). [35] H. F. Hofmann, Phys. Rev. Lett. 94, 160504 (2005).
[7] T. Morimae, Phys. Rev. A 89, 060302 (2014).

050503-5