Experimental Demonstration of Blind Quantum Computing

Optimised blind quantum computing

It is a conceptual strength of the BQC protocol that perfect security can be established over a subset of computations even if not all of the qubits are unknown to the server. In fact, for the four-qubit blind cluster state it is sufficient for the client to be able to prepare only one or two of the qubits in arbitrary states ${\lvert}\theta_{j}\rangle$ for delegating various one- and two-qubit circuits as well as quantum algorithms, see Figure 2. This is a remarkable optimisation for the experimental requirements and is demonstrated for the first time here (see Appendix for theoretical details). Furthermore this optimisation is scalable beyond our four-qubit experimental setting and creates an interesting challenge on the design level to construct a computation such that the sensitive measurements remain hidden.

We thus fix $\theta_{1}$ and $\theta_{4}$ equal to zero, while varying the choices of $\theta_{2}$ and $\theta_{3}$. The resulting four-qubit linear blind cluster state is:

Our experimental implementation of BQC is based on such a family of four-qubit linear blind cluster states. These are produced using photon emissions of a non-collinear type-II spontaneous parametric down-conversion process (SPDC) Kwiat1995 ; Walther2005a , as described in detail in the Appendix. If four photons are emitted into the output modes of the polarizing beam splitters 1, 2, 3 and 4 (see Figure 3A), they are in a highly entangled state which is equivalent to the state ${\lvert}\Phi^{\hat{\theta}}\rangle$ under the local unitary operation $H\otimes\mathbf{I}\otimes\mathbf{I}\otimes H$:

where $\hat{\theta}=(n_{2},n_{3})$ and $(\theta_{2},\theta_{3})=(\frac{n_{2}\pi}{4},\frac{n_{3}\pi}{4})$. In the experiment, we use the polarization of photons to represent the qubits, with ${\lvert}0\rangle$ denoting the horizontal polarization state and ${\lvert}1\rangle$ denoting the vertical polarization state.

The client prepares the value of $\theta_{j}$, which is done in our case by a human client. By aligning our setup to produce ${\lvert}\Phi^{(2,n)}_{L}\rangle$ for $n=0,\ldots,7$ and ${\lvert}\Phi^{(6,m)}_{L}\rangle$ for $m=0,4$, we have demonstrated for the first time the preparation of various four-qubit blind cluster states. Moreover, we have implemented $1962$ different four-qubit measurements with 31392 measured outcomes. These measurements outcomes can be seen as implementing all possible computational branches (due to different measurement outcomes), which is equivalent to directly performing the feed-forward mechanism Prevedel2007a . However, the remarkably feature of the BQC protocol is that the client’s privacy is always preserved, whether or not feed-forward mechanisms have been implemented. Similarly, obtaining all the possible measurement outcomes is equivalent to implementing all possible values of $r_{j}$, as if the client randomly re-interprets the measurement outcomes, implicitly subsuming $r_{j}$. Note that, whenever all qubits are measured in our setup, this method allows the client’s choice of configuration to also be hidden from the server.

We use an over-complete state tomography for each of our cluster states, in order to reconstruct the four-qubit density matrix. The most likely physical density matrix for each four-qubit state is extracted using a maximum-likelihood reconstruction James2001 (see Figure 3B). Uncertainties in quantities extracted from these density matrices are calculated using a Monte Carlo routine and assumed Poissonian errors. Our computed fidelities for the various blind cluster states achieve maximum values of up to $67.9\pm 0.4\%$ via local unitary transformation. These non-ideal fidelities arise due to experimental imperfections (see Appendix). It is important to note that experimental influences on the server’s side only affect the correctness of the computation, while imperfections in the client’s qubit preparation might also weaken the assumption of an unbiased state distribution.

Blind single- and two-qubit unitaries

The four-qubit linear blind cluster ${\lvert}\Phi^{\widehat{\theta}}\rangle_{\rightarrow}$(Figure 2) can be used to implement an arbitrary single-qubit unitary gate. Measuring qubit 1 in the eigenstates of $\sigma_{x}$, $\sigma_{y}$, or $\sigma_{z}$ has the effect of preparing the input on qubit 2 in the state ${\lvert}0\rangle$, ${\lvert}+_{i}\rangle$ or ${\lvert}+\rangle$, respectively, where ${\lvert}+_{i}\rangle=1/\sqrt{2}({\lvert}0\rangle+i{\lvert}1\rangle)$. We are thus left with a three-qubit linear cluster state that implements a single-qubit rotation gate with rotations determined by the measurements of the second and third qubits; this rotates the input qubit ${\lvert}\Psi_{\text{in}}\rangle$ to the final state ${\lvert}\Psi_{\text{out}}\rangle=R_{x}(-\phi_{3})R_{z}(-\phi_{2}){\lvert}\Psi_{\text{in}}\rangle$, where $R_{x}(\alpha)=\exp(-i\alpha\sigma_{x}/2)$. By fixing $\theta_{2}$ and varying $\theta_{3}$, we can experimentally demonstrate a blind $X$-rotation. In the same way, a blind $Z$-rotation can be shown experimentally by using the four-qubit linear blind cluster state ${\lvert}\Phi^{\widehat{\theta}}\rangle_{\leftarrow}$, which has the order of measurements going from qubit 4 down to qubit 1. Figure 3C depicts an experimental demonstration of a blind $Z$-rotation. By varying $\theta_{3}$ and averaging over all resulting density matrices, we obtain a totally mixed state with a linear entropy of $0.989\pm 0.010$ that is close to the entropy of 1 for a perfectly mixed state (see Figure 3C). As the experiments include the preparation of all eight blind cluster states ${\lvert}\Phi_{L}^{(2,n)}\rangle$, we can quantify the blindness of the single-qubit rotations demonstrated experimentally. The value of the Holevo information $\chi$ (see Appendix for details) must then be between (for perfect blindness) and $3$ (for no blindness). Using the tomographic measurements performed on these input states we determine $\chi$ of such states to be $0.169\pm 0.074$, far below the three bits necessary to uniquely identify the client’s choice of $\phi_{2}$ and $\phi_{3}$, proving that within the assumptions of our model these experimental implementations of the protocol maintains close to perfect blindness. The above value of $\chi$ assumes initial state is chosen uniformly at random. However even when this value is maximised over all possible prior distributions on the choice of states, it increases only slightly to $0.185\pm 0.087$.

Two-qubit gates are required for universal quantum computation; by choosing the order of measurements in a suitable way, the blind cluster ${\lvert}\Phi^{\hat{\theta}}\rangle$ implements blind two-qubit gates (Figure 2C–F). One family of two-qubit gates generated in our experiment is based on the blind horseshoe cluster ${\lvert}\Phi^{\hat{\theta}}\rangle_{\subset}$, where measuring qubits 2 and 3 of the blind cluster state performs a transformation on the logical input qubits (Figure 2C). Both implemented rotations are blind and the entire computation remains hidden. Analyzing the output state, i.e. measuring qubits 1 and 4, delivers the result of the computation. Figure 3D shows an example of a two-qubit computation using the blind horseshoe cluster. Consistency with blindness can be seen by averaging over all output states, giving as a result a totally mixed state with a linear entropy of $0.955\pm 0.011$. It is an interesting challenge to demonstrate the consistency with blindness in full generality by producing 64 blind cluster states. Our demonstration uses a selection of four states which suffices to hide the choice of rotations among four possibilities: $R_{z}(\pi/2\pm\pi)\otimes R_{z}(\pi/2\pm\pi)$. In a similar way, the consistency with blindness of the rotated horseshoe cluster ${\lvert}\Phi^{\hat{\theta}}\rangle_{\supset}$ (Figure 2D) can be shown.

We also realize blind computations based on the blind staircase cluster ${\lvert}\Phi^{\hat{\theta}}\rangle_{\lrcorner\ulcorner}$ (Figure 2E) and blind triangle cluster ${\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}$ (Figure 2F). The state ${\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}$ is obtained via local complementation VandenNest2004 on qubit 2 of ${\lvert}\Phi^{\hat{\theta}}\rangle_{\subset}$. Thus $U{\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}={\lvert}\Phi^{\hat{\theta}}\rangle_{\subset}$ where $U=\sqrt{\sigma_{z}}\otimes\sqrt{\sigma_{x}}\otimes\sqrt{\sigma_{z}}\otimes I$ (with $U$ acting on qubits ordered as 1,2,3,4), and measuring the qubits of ${\lvert}\Phi^{\hat{\theta}}\rangle_{\subset}$ by absorbing the action of $U$ into the measurements yields a computation on ${\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}$ as represented by measurement instructions $\delta^{\prime}$ in Figure 2F. However, blindness on qubit $i$ is guaranteed only if the resulting measurement can be expressed as a basis ${\lvert}\pm_{\delta_{i}^{\prime}}\rangle$. We show in the next sections the blind staircase cluster allows for the blind implementation of Deutsch’s algorithm, while the blind triangle cluster allows for the blind implementation of Grover’s algorithm.

Blind algorithms

One of the most prominent examples where quantum mechanics demonstrates its superiority in computational speedup is Grover’s search algorithm Grover1996 ; Boyer1998 , which provides a quadratic speedup to the following problem: Given a function $f:\{0,1\}^{n}\rightarrow\{0,1\}$, find an $x$ such that $f(x)=1$. Here we demonstrate a blind implementation of Grover’s search for $n=2$, where blindness ensures that the server is unable to distinguish the actual computation from within a given family of circuits implementing $(I\otimes R_{z}(\xi)H)$. Whereas previous realisations Walther2005a ; Prevedel2007a are not amenable to blind implementations, our computation, embedded into the blind triangle cluster ${\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}$ (Figure 2F), remains blind. The algorithm proceeds as follows: the values of $x$ are represented by the states ${\lvert}00\rangle$, ${\lvert}01\rangle$, ${\lvert}10\rangle$ and ${\lvert}11\rangle$, respectively. A superposition of all four states is initially created and the oracle tags one element by applying a phase of $\pi$, thus flipping the sign of this term (see Figure 4A). Then each of the four states is mapped to an output such that measuring both qubits in the basis ${\lvert}\pm_{i}\rangle$ reveals the tagged item. This computation can be embedded into the blind triangle cluster, ${\lvert}\Phi^{\hat{\theta}}\rangle_{\triangle}$ (Figure 2F), the choice of $\phi_{2}$ and $\phi_{3}$ determines which element is tagged. Figure 4C shows the results of a Grover search for the tagging of the state ${\lvert}01\rangle$. For each blind cluster state, we show the probability of identifying the tagged state as well as the probabilities of finding the unwanted states, due to the experimental noise. We achieve probabilities of finding these positive events of up to $0.850\pm 0.039$ with an average over all blind states of $0.720\pm 0.015$. Note that no classical algorithm can succeed in this scenario with probability higher than $0.5$.

Another algorithm which demonstrates the power of quantum computing, is the Deutsch-Josza algorithm Deutsch1992 that takes as input an oracle (or black-box) for computing an unknown function $f:\{0,1\}^{n}\rightarrow\{0,1\}$ with the promise that $f$ is either constant, meaning $f(x)$ is the same for all $x$, or balanced, meaning $f(x)=0$ for exactly half of the inputs $x$ and $f(x)=1$ for the other half. The algorithm determines whether $f$ is constant or balanced by making queries to the oracle. While the best possible classical algorithm to solve this problem uses at least $2^{n-1}+1$ queries in the worst case, the Deutsch-Jozsa algorithm takes advantage of quantum superposition and interference to determine whether $f$ is constant or balanced with only one query. In contrast to previously realized implementations of Deutsch’s algorithm using traditional cluster states Tame2007 ; Vallone2010 , we exploit blind staircase cluster states ${\lvert}\Phi^{\hat{\theta}}\rangle_{\lrcorner\ulcorner}$ for the implementation of this quantum algorithm for the case $n=1$. Figure 5A shows the quantum circuits that realise oracles corresponding to constant and balanced functions. The corresponding implementation on ${\lvert}\Phi^{\hat{\theta}}\rangle_{\lrcorner\ulcorner}$ is given in Figure 5B, where the choice of oracle is done by fixing the measurement on qubits 2 and 3. Blindness of qubit 3 guarantees that the quantum server will not recognize the implementation of a constant oracle from the Grover algorithm or general circuits implementing $R_{z}(\xi)H\otimes I$, and a balanced oracle from $(I\otimes H)\mbox{CPhase}(R_{z}(\xi)H\otimes H)$, see Figure 5.

Figure 5C and 5D show the outcome of our measurement for the case of ${\lvert}\Phi^{(6,4)}\rangle_{\lrcorner\ulcorner}$. A tomography of the state of qubit 4 is performed in order to fully characterize the output of the computation. In this case, the obtained fidelity for the output state is $F=0.930\pm 0.025$ for the constant oracle and $F=0.887\pm 0.033$ for the balanced oracle, with the algorithm producing the correct result with probabilities $0.899\pm 0.006$ for the constant and $0.895\pm 0.022$ for the balanced oracle.

Towards verifying the quantumness

Self-testing is a verification process for the operations of a collection of untrusted quantum devices Magniez2006 ; McKague2011 ; a key application of the blind computing protocol is also towards such verification of quantum devices Broadbent2009 ; Aharonov2010 . In the setting of our experiment we demonstrate a notion of verification that can be used as a heuristic probabilistic test for whether the server indeed possesses any quantum technology or is a completely classical device. For this, the client chooses a measurement setting for which, for each measurement outcome, there exists a state with a detection probability of zero. Due to blindness, however, the quantum server has no information about which initial states the client has prepared. If it has no quantum technology in hand, it attempts to use its classical devices and guesses the outcome for the client’s computation wrong with probability at least 1/8. Better bounds can be achieved using statistics of several rounds by comparing it with the known theoretical statistics to test whether the quantum-computing server is producing the expected outcome or not.

We experimentally demonstrate the testing procedure using statistics of several outcomes for different measurement instructions. Figure 6 shows relevant theoretical predictions as well as experimental outcomes which confirm the quantum nature of the server. By instructing the quantum server to measure, for example, this statistical distribution, the client can see if the outcomes coincide with the expectations. Our demonstration is the first step towards an efficient verification scheme for quantum technology and acts as experimental benchmark for future fault-tolerant protocols using more qubits, that is expected to enable the detection of a cheating quantum server with probability exponentially close to one.

Discussion

We have experimentally demonstrated the concept of blind quantum computing. Generating a family of four-qubit blind cluster states, we obtained a universal set of single-qubit and non-trivial two-qubit quantum logic gates, as well as implementations of Deutsch’s and Grover’s algorithms. We use the photon’s mobility, an intrinsic advantage of this physical quantum system, for preparing various qubits on the client’s side which are then processed by a locally separated quantum server.

On the path from our proof-of-principle experiment to a full implementation of the BQC scheme, there are several technical challenges to be faced: Emitted photons that do not contribute to the generation of the cluster state can in principle reveal information about the blind phases. Furthermore, post-selection and photon losses decrease the efficiency of the protocol. Therefore, the realization of single-qubit states on demand and the heralded generation of blind cluster states using measurement-induced interactions with high fidelity and low losses will be crucial for future applications. In our experiment, the blind angles were chosen by the human client and the measurement settings were selected from a prepared list. Ideally, the source of randomness should be carefully scrutinized to avoid any correlations with the server, and an efficient shot-by-shot randomization should be implemented. Considering the photon rates in our experiment, the realization of full randomization for each measurement is a major challenge, but seems within reach by advancing current technologies. The question of how far imbalances and deviations from the uniform distribution can be acceptable is a topic of current research.

Our experiment is the first step towards unconditionally secure quantum computing in a client-server environment, where the client’s entire computation remains hidden — a functionality not known to be achievable in the classical world. We anticipate that this will become an important privacy-preserving technique in future quantum computing networks or clouds Hayes2008 . Especially considering the tremendous challenges encountered in making quantum computers widely available, such future networks could consist of a few powerful quantum-computer nodes. The only quantum requirement for the clients would be to communicate with the nodes via quantum links enabling the transfer of arbitrary qubits. Although photonic quantum systems seem to be ideally suited for privacy-preserving quantum computing, we stress that our results are applicable to any physical implementation of qubits and that in the near future the precise quantum control of multi-qubit quantum systems Monz2011 will allow for implementing more complex algorithms.

The authors are grateful to C. Brukner, V. Danos and R. Prevedel for discussions, and to F. Cipcigan and J. Schmöle for support. We acknowledge support from the European Commission, Q-ESSENCE (No 248095), ERC senior grant (QIT4QAD), JTF, Austrian Science Fund (FWF): [SFB-FOCUS] and [Y585-N20], EPSRC, grant EP/E059600/1, Canada’s NSERC, the Institute for Quantum Computing, QuantumWorks, the National Research Foundation and Ministry of Education, Singapore, and from the Air Force Office of Scientific Research, Air Force Material Command, USAF, under grant number FA8655-11-1-3004.

References

I Appendix

Our optimised protocol guarantees full blindness of a computation, even though not all qubits have an a initial rotation. Here, we show that algorithms that admit a measurement pattern in which the secret can be encoded over a few qubits can be made fully blind using only a few blind qubits. This construction works as long as measurements following the blind qubit measurements are chosen in the Clifford group (integer multiples of $\pi/2$), and thus our constructions works for Deutsch’s and Grover’s algorithms.

I.2 Leakage of information in experimental blind quantum computing

In order to quantify any deviation from perfect blindness introduced by experimental imperfections we need a model for the information received by the server during a run of the protocol. To this end, we assume that the only information obtained by the server is the initial quantum state supplied by the client, as well as the classical set of angles $\delta_{i}$ received during the protocol. We also assume that the state produced by the experimental setup for a given choice of the ideal input state is fixed, and that the client’s choices can be considered uniformly random. In such a model, the amount of information leaked is bounded by the Holevo information of the quantum state, $\rho$ received by the server, $\chi=-\mbox{Tr}(\rho\log_{2}\rho)+\sum_{\theta}\frac{1}{8}\mbox{Tr}(\rho_{\theta}\log_{2}\rho_{\theta})$, where $\rho_{\theta}=\frac{1}{2}(\rho^{\prime}_{\theta}+\rho^{\prime}_{\theta+\pi})$ and $\rho^{\prime}_{\theta}$ is the state produced in the experimental apparatus for the client’s choice of $\theta$.

I.3 Experimental setup

In our experiment (main paper, Fig. 3A), entangled photon pairs are produced by exploiting the emissions of a non-collinear type-II SPDC process. For this, a mode-locked Mira HP Ti:Sa oscillator is pumped by a Coherent Inc. Verdi V-10 laser. The pulsed-laser output ($\tau$ = $200\,$fs, $\lambda$= $789\,$nm, $76\,$MHz) is frequency-doubled using a $2\,$mm-thick Lithium triborate (LBO) crystal, resulting in UV pulses of $0.8\,$W cw average. We achieve a stable source of UV-pulses by translating the LBO to avoid optical damage to the anti-reflection coating of the crystal. Afterwards, dichroic mirrors are used to separate the up-converted light from the infrared laser light. The UV beam is focused on a $2\,$mm-thick $\beta$-barium borate (BBO) crystal cut for non-collinear type-II parametric down-conversion. Afterwards the beam is reflected and passes the crystal a second time. Entangled photon pairs are emitted into the forward modes, $a$ and $b$, and the backward modes, $c$ and $d$. Half-wave plates (HWPs) and additional BBO crystals compensate walk-off effects and allow the production of any Bell state in the forward and backward mode. The modes of the different pairs $a$, $c$ and $b$, $d$, respectively, are then coherently overlapped at polarizing beam splitters (PBSs) by equalizing the different path lengths. Narrow-band interference filters ($\Delta\lambda$ = $3\,$ nm) are used to spatially and spectrally select the down-converted photons which are then coupled into single-mode fibers that guide them to the polarization analysis setup. There, different polarization measurements are performed using quarter-wave plates (QWPs), HWPs and polarizing beam splitters.

I.4 Experimental preparation of blind cluster states

The blind cluster state in the laboratory basis is composed of four terms that correspond to different emissions of four photons. Such four-photon emissions can experimentally be obtained either by an emission of two entangled pairs, one in the forward and one in the backward mode, or by double-pair emissions into the forward or the backward mode. The production of our cluster state exploits coherent superpositions of these different four-pair contributions and utilizes the properties of the polarising beam splitters (PBSs) as well as post-selection to obtain the appropriate state. In order to produce the desired state, we align our setup such that a ${\lvert}{\Phi}^{-}_{\theta_{3}}\rangle=({\lvert}HH\rangle-e^{i\theta_{3}}{\lvert}VV\rangle)/\sqrt{2}$ state is emitted in the forward direction and a ${\lvert}{\Phi}^{+}_{\theta_{2}}\rangle=({\lvert}HH\rangle+e^{i\theta_{2}}{\lvert}VV\rangle)/\sqrt{2}$ state in the backward direction, where ${\lvert}H\rangle$ (${\lvert}V\rangle$) denotes the horizontal (vertical) polarization state. The emission of only one entangled pair in the forward direction and only one pair in the backward direction results in two different four-photon terms: ${\lvert}H\rangle_{1}{\lvert}H\rangle_{2}{\lvert}H\rangle_{3}{\lvert}H\rangle_{4}$ and $-e^{i(\theta_{2}+\theta_{3})}{\lvert}V\rangle_{1}{\lvert}V\rangle_{2}{\lvert}V\rangle_{3}{\lvert}V\rangle_{4}$ due to the properties of the PBSs. The two-pair emissions also lead to fourfold coincidences, namely to a $-e^{i\theta_{3}}{\lvert}H\rangle_{1}{\lvert}H\rangle_{2}{\lvert}V\rangle_{3}{\lvert}V\rangle_{4}$ state and a $e^{i\theta_{2}}{\lvert}V\rangle_{1}{\lvert}V\rangle_{2}{\lvert}H\rangle_{3}{\lvert}H\rangle_{4}$ state for a double-pair emission in the forward and in the backward direction, respectively. We shift the phase of the term $-e^{i\theta_{3}}{\lvert}H\rangle_{1}{\lvert}H\rangle_{2}{\lvert}V\rangle_{3}{\lvert}V\rangle_{4}$ by $\pi$ to generate a sign shift. For this, we use the method Walther2005a where a rotation of an additional wave plate has the desired effect. The final output state is a superposition of all these four terms. In our setup we use a combination of quarter-wave plates and half-wave plates to adapt the phase of the state that is emitted into the forward mode. The phase of the backward pair is adapted by tilting one of the compensation crystals. Note that after the PBS two quarter-wave plates are inserted in modes 3 and 4 to compensate for birefringence effects. By changing the phases of the entangled pairs, we can now manipulate the values of $\theta_{2}$ and $\theta_{3}$ of the client’s qubits.

In our experiment, the emitted Bell pairs show a typical visibility of about $0.9$, depending on the specific experimental setting. The different photon emissions then interfere at the PBSs with average visibilities of $0.85$. Additional errors arise due to phase drifts during the measurements. These main error contributions, together with minor errors like polarisation drifts, decrease the fidelity of our blind cluster states with respect to the ideal state. In our calculations, we always assume Poissonian errors. In fact, these indicate a lower bound for the actual error that takes all the experimental imperfections into account. This is underlined by an analysis of the data of Figure 6 (main paper) where we obtain a value of $\chi^{2}$ of $1.6$ when assuming Poissonian errors only. Including the errors mentioned above, we obtain a $\chi^{2}$ value satisfactorily close to one (about $1.1$).

In the context of BQC, the client has access to the various four-photon emissions and prepares the encoded phases, for example $\theta_{2}$ and $\theta_{3}$, by applying local operations. These photons are then sent to the quantum server who generates entangled blind cluster states by superimposing these qubits on two polarizing beam splitters, followed by a successful detection of a four-fold coincidence in the output modes 1-4. The settings for the computation are set by phase retarders in each of the output modes to align the setting for the consecutive projective measurements. We note that due to the down-conversion process the client rather prepares arbitrarily rotated Bell pairs instead of single qubits, which enables a compact client-server network without affecting the blindness.