Nonadaptive fault-tolerant verification of quantum supremacy with noise

Quantum samplers are believed capable of sampling efficiently from distributions that are classically hard to sample from. We consider a sampler inspired by the classical Ising model. It is nonadaptive and therefore experimentally amenable. Under a plausible conjecture, classical sampling upto additive errors from this model is known to be hard. We present a trap-based verification scheme for quantum supremacy that only requires the verifier to prepare single-qubit states. The verification is done on the same model as the original sampler, a square lattice, with only a constant overhead. We next revamp our verification scheme in two distinct ways using fault tolerance that preserves the nonadaptivity. The first has a lower overhead based on error correction with the same threshold as universal quantum computation. The second has a higher overhead but an improved threshold (1.97\%) based on error detection. We show that classically sampling upto additive errors is likely hard in both these schemes. Our results are applicable to other sampling problems such as the Instantaneous Quantum Polynomial-time (IQP) computation model. They should also assist near-term attempts at experimentally demonstrating quantum supremacy and guide long-term ones.


I. INTRODUCTION
Considerable experimental efforts are being directed towards the realisation of quantum information processing technologies, with the eventual aim of constructing universal quantum computers and simulators [1][2][3][4]. One of the motivations for this exercise is their expected ability to simulate physical systems that are believed to be intractable classically [5,6]. An example of such a system is a lattice of interacting spins in the presence of a magnetic field, represented by the Ising model [7]. The Ising model is a workhorse in condensed matter physics, employed to study magnetic properties of spin glasses [8] and spin liquids [9] as well as phase transitions in manybody systems such as lattice gases [10], and numerous other problems. The partition function is a quantity central to most of these studies. Computing the partition function (and ground state) of the Ising model in an external magnetic field is, however, NP-hard even in two dimensions [11]. Although NP-hard problems are not expected to be solvable efficiently on a universal quantum computer, theoretical results [12][13][14][15][16][17][18][19] suggest the possibility of demonstrating 'quantum supremacy' [20] in devices that do not require the full complement of DiVincenzo's criteria [21] for their implementation. Their scalable implementation is thus anticipated to be more achievable than a universal quantum computer's, providing tangible demonstrations of quantum supremacy sooner [17,[22][23][24][25]. This expectation is purchased at the price of sacrificing the full power of universal quantum computers, promising only to efficiently sample from certain distributions instead. Among them is a non-universal quantum simulator based on a nonadaptive translationally-invariant Ising model that allows sampling from the distribution of Ising * T.Kapourniotis@warwick.ac.uk † animesh.datta@warwick.ac.uk model partition functions [18]. It shows, in line with other models [13][14][15][16][17], that under an average-case hardness conjecture, a highly unexpected collapse of the polynomial hierarchy to the third level occurs if a classical sampler can sample the partition function distribution upto additive errors. Unlike these models, however, the hardness results of the Ising sampler [18] hold for a single fixed instance of the problem, relieving the burden of creating random instances.
We tackle two crucial challenges facing any experimental demonstration of quantum supremacy for the Ising sampler. The first is verifying that the output distribution is indeed from the correct quantum sampler, as opposed to a classical sampler emulating a similar distribution [26]. The second is ensuring that the sampling task remains classically hard to simulate even in the presence of experimental noise and decoherence [26].
In this paper, we present a nonadaptive verification scheme with exponentially low probability of failure and only linear complexity for the Ising sampler (prover). Our scheme applies to a totally untrusted prover with entangling and measuring capabilities, limited only by the laws of quantum mechanics, and requires the verifier to prepare random, single-qubit states with constant local errors. We first present a verification scheme that should aid demonstrating quantum supremacy with few qubits (Theorem 1). We then prove a fault-tolerant version (Theorem 2), which is achieved by an amalgamation of trap-based verification techniques for decision problems [27] with recent results on demonstrating quantum supremacy by emulating fault-tolerance via postselection [25]. For the former, we develop a simpler construction performing verification and computation on different planar graphs. For the latter, we prove that our fault-tolerant verifiable model is classically hard subject to the same average-case hardness conjecture (Theorem 3). Our work thus opens the way for tailored trapbased, fault-tolerant verification techniques for quantum sampling problems.
Our fault-tolerant verification scheme applies to any nonadaptive sampler based on cluster states, however we will use the Ising sampler [18] as a particular example, thus keeping the benefit of the single instance property and experimental feasibility of this model. Our work is however a significant improvement on the verification method of [18], which was based on certification techniques [28,29], requiring local measurements with errors polynomially small in the total number of qubits and quadratically many qubit transfers from prover to verifier.

II. QUANTUM SAMPLING IN THE VERIFIER-PROVER SETTING
In the verifier-prover setting, the verifier can prepare bounded-error, single-qubit states and the prover implements the rest of the computation including the measurements, and returns the output samples to the verifier. The role of the verifier is to ascertain if the prover is acting honestly and executing the correct operation. The prover is, in general, malicious, trying to pass any tests designed by the verifier while deviating from the correct implementation at the same time. This malice may be intentional if the prover is trying to convince the verifier of its quantum power when it has none, or incidental if the prover possesses an imperfect quantum device prone to noise and errors. We assume that the prover's deviations are governed by quantum mechanics. We begin by adapting the Ising spin model to a blind verifier-prover cryptographic setting [30]. Blindness, which ensures that the prover remains ignorant of the actual computation, is a necessary ingredient in our verification scheme. Our Ising spin model consists of qubits in state |+ subject to nearest neighbour controlled π-phase rotations, denoted by cZ. All the qubits are measured simultaneously in a basis in the xy-plane of the Bloch sphere. The measurement outcome of classical bits is the output sample. This model corresponds to the well-studied measurement-based quantum computing (MBQC) model [31] without the adaptive measurements. This last restriction, which relaxes one of Di-Vincenzo's criteria, makes this model non-universal for quantum computing.
In the particular Ising sampler presented in [18] (for more details see Appendix B), the structure of the graph state is fixed, but its size scales with the width m and depth n. The measurement angles are also fixed to specific values from the set {−π/4, −π/8, 0, π/8, π/4}. This choice of graph, which we call the 'extended' brickwork state, and a fixed angle for each physical qubit has the following benefit: Each possible combination of measurement outcomes 'chooses' a different angle for each qubit of the original brickwork state from the set {kπ/4}, k = {0, . . . , 7}. This effectively makes a single instance of the model a random quantum circuit generator, a property exploited to prove its hardness. The correspondence to a quantum Ising model comes from the locality of spin interactions and decomposing each MBQC measurement into a unitary rotation around the z-axis corresponding to an external magnetic field, followed by a Pauli X measurement. The quantum state just before the Pauli X measurement is given by the unitary evolution due to the Hamiltonian where J is the local interaction term, B i the local field strength and Z i the Pauli Z operator on qubit i. The probability p(x) of measuring a bit string x corresponds to the partition function Z x of the Ising model with Hamiltonian H ≡ H + π 2 i x i Z i is given by where N = mn. The second term in H comes from the measurement outcomes of the Pauli X measurements, and the partition function is evaluated at an imaginary temperature β = 1/k B T = i. Although the partition function at imaginary temperatures may appear unphysical, it has deep connections to quantum complexity theory [32] as well as quantum statistical and condensed matter physics via analytic continuations. The model could thus be used to sample from the partition function of the classical Ising model with real temperatures [33], but the probability of observing a sample is exponentially low in the problem size.
Testing the honesty of the prover, in our case the Ising sampler, requires the 'blind' injection of certain 'trap' qubits. To keep the identity of these trap qubits from the prover, the verifier applies some encoding on the original translationally-invariant Ising spin model, making the model translationally variant. Now both the participating qubits and the measurement angles on the graph state have a randomly chosen extra rotation according to the scheme described next. Incidentally, this relaxation away from translational invariance could arguably go a long way in easing its experimental implementation. Specifically, each qubit i is individually prepared by the verifier in the state |+ θi , where θ i is chosen uniformly at random from the set A = {0, π 8 , 2π 8 , . . . , 15π 8 }. Instead of the prover measuring in fixed predetermined angles, as in the original Ising sampler, the verifier sends encrypted angles to the prover: Rotations by θ i on the qubit and on the angles mutually cancel and the classical information that the prover receives (containing the actual measurement angles φ i ) is classically one time padded by θ i . The bits r i , r i provide some extra randomness to restrict the information the prover gets from the quantum state and can be corrected by classical post-processing of the sample. Our innovation over [30] lies in the number of angles used in the set A, and comes from the fact that we use a different decomposition of the computation. We next present the details of the construction of our verification protocol.

III. VERIFICATION OF ISING SAMPLERS
This section contains our main results, in two stages, on the verification of the Ising sampler's output. We first present a non-fault-tolerant verification scheme (Theorem 1). Since it requires decreasing qubit preparation errors with increasing system size, this is only viable in small-sized experimental demonstrations of quantum supremacy. We next present a fault-tolerant version (Theorem 2) which is scalable but requires qubit preparation errors below certain thresholds. Establishing verifiability consists of proving correctness and soundness. Correctness means that the protocol performs the correct computation when the prover is honest. A protocol is sound if, for any deviation of the prover, the verifier is able with a good confidence level, to accept or reject the hypothesis that the output distribution is close to the correct one. This deviation captures both a malevolent prover who tries to cheat and uncontrollable errors in the prover's device. The soundness parameter [27] is a bound on the probability that the hypothesis test fails for any deviation of the prover.

A. Non-fault-tolerant verification
The output of a quantum sampler must be classical for it to be comparable to that of a classical sampler, a prerequisite for demonstrating quantum supremacy. This allows us to simplify trap-based verification strategies for universal quantum computation [27,34,35] to having disjointed computational resource and trap states -an idea also used in circuit-based verification [36]. This permits an exponentially small error in our estimation of the fidelity of the output using a square lattice. Finally, a trap-based technique instead of certification ones [18,28] enables us to reduce the resource complexity of the verification protocol from quadratic to linear. Our verification protocol relies on judiciously selecting the measurement angles and placing special dummy qubits prepared in the state |0 , which, together with xyplane measurements, allows us to carve different types of graphs from a square lattice graph, as shown in Fig. (1). Placing one dummy qubit between any two other qubits prevents the prover's entangling operators to have any entangling effect between the participating qubits, so the prover can apply exactly the same operations that produce the square lattice but create a different graph state. The graphs carved out are the 'extended' brickwork state (Appendix B) and two other graphs containing special 'trap' qubits in the state |+ . The extended brickwork state is used to run the Ising sampler. The traps in the test graphs are measured in the same basis as prepared, yielding a deterministic test for the prover. Two different types of the trap graphs are needed to enable placing a trap at any position in the graph with equal probability. The order of the graphs is chosen at random and the whole procedure implemented blindly to κ identical test graphs on the right of figure (ii) which have traps (starred nodes) on the even parity positions of the subgraph that corresponds to the computational graph; and κ identical graphs on the right of figure (iii) which have traps on the odd parity positions of the sub-graph that corresponds to the computational graph. All of these graphs can be generated from a square lattice (on the left) by replacing |+ qubits with |0 at the positions (isolated dot nodes) we do not want entangled with their neighbours when cZ is applied. Further detail on the carving procedure, which can be made blind (Section II), is provided in Appendix A.
thwart the prover from distinguishing test and computation qubits. A sketch of the protocol appears in Fig. (2), and the details in Appendix B. The protocol has constant time complexity of the quantum operations and needs O(N ) qubits, where N is the number of the qubits of the Ising sampler. We prove the correctness of our protocol in Appendix B 1. For its soundness, we have Theorem 1 (Soundness). Suppose the qubit preparation error by the verifier is local and bounded by . After α/(2N 2 2 ) repetitions of the non-fault tolerant protocol in Fig. (2) with κ = 2 (thus 5 graphs for each repetition), the verifier can decide with confidence level 2 −α , whether or not the total variation distance between the actual q (x) and the correct (honest) distribution q(x) of the Ising sampler is bounded by = 8N + 1 5 , where the sum is over all binary strings x of size N that represent the output samples of all measurements in the computational graph.
1. Verifier selects a random ordering of 2κ + 1 graphs, 1 computational and κ from each type of test graphs.
2. Verifier prepares, one by one, the qubits needed for the blind implementation of the 2κ + 1 cluster states and sends them to the prover.
3. Verifier sends the encrypted measurement angles to the prover. 4. Prover entangles all received qubits in the 2κ + 1 cluster states. 5. Prover measures all qubits simultaneously in the instructed angles and returns the results. 6. Verifier decrypts the outputs and accepts if all trap results are correct, otherwise rejects.

FIG. 2. Nonadaptive verification protocol
The value of 1/5 above is a consequence of choosing κ = 2 and comes from an explicit arithmetic calculation. While it is sufficient for our arguments, it can be reduced by allowing more rounds of testing in the protocol. A sketch of our proof appears in Appendix B 2 and a full proof in Appendix D. Using our verifiable quantum sampler to demonstrate quantum supremacy is underwritten by results which show that approximating the Ising sampler upto constant total variation distance is hard classically, subject to the same average case hardness conjecture as in the original model [18]. N must be constant for the approximation to be constant in Theorem 1, requiring the local error decrease linearly with the number of qubits. This is only realistic in quantum supremacy experiments involving few qubits. To overcome this restriction, we next consider a faulttolerant version of our verification protocol.

B. Fault-tolerant verification
Ensuring N in Theorem 1 to be constant will get harder experimentally for increasing N . Therefore, we present a new verification scheme where the total noise scales linearly with the size, and prove that it provides a distribution that is hard to sample classically from upto constant additive error. We then prove that noise scaling with system size does not affect our strategy of proving the soundness of verifying the prover's distribution. Quantum error correction can overcome noise and faulttolerance ensuring scalability, but requires adaptive operations. Our new scheme allows for fault-tolerant computation, but does not apply any corrections, since they require adaptivity which is prohibited within the Ising sampler. Leveraging arguments due to Fujii [25] and his improved fault-tolerant thresholds, we prove the hardness of the scheme by relying only on conditional probabilities that post-select the null syndromes in the syndrome measurements. Our verification scheme performs actual fault-tolerance on the trap computations. Since these trap computations only involve Clifford operations, their fault tolerance can be performed nonadaptively, and corrected by classical post-processing. An additional intricacy needs resolving. Since blindness is an ingredient in our verification scheme, its straightforward application (on the logical level) risks leaking the logical measurement angles in the distillation procedure, where many copies of the same magic state need to be sent. Also, for the distillation procedure to be effective, we need to reveal information about the state distilled.
Our stratagem for circumventing this is to apply blindness on the lowest level of MBQC, on which the faulttolerant construction is based. On the other hand, traps are applied at the logical MBQC level, since those are the qubits needing protection from noise, as outlined in Fig. (3). The fault-tolerant verification protocol has the same structure as in Fig. (2) but based on a different cluster state. We use the lattice by Raussendorf-Harrington-Goyal (RHG) [37] and their topological fault-tolerant procedure implemented on MBQC. Time complexity of the quantum operations in the protocol is constant and the number of qubits needed is O(N P olyLog(N )) [37], the polylogarithmic overhead coming from the properties of the topological code and the use of concatenation in the distillation procedure. The full protocol and explanation is given in Appendix C.
Our proof of the classical hardness of Ising sampling in this case (Theorem 3) relies on proving the soundness of verifying conditional probabilities (Theorem 2). They are proved in Appendices G and E respectively. Theorem 2 (Fault-tolerant soundness). Suppose the qubit preparation error by the verifier is local and bounded by < thres , the threshold. After α/2 2 repetitions of the fault-tolerant protocol with κ = 2, the verifier can decide with confidence level 2 −α , whether or not the total variation distance (when they are conditioned on the syndrome measurement outcome y giving the null result) between the actual distribution q (x|y = 0) and the correct (honest) distribution q(x|y = 0) of the Ising sampler is bounded by = 8 + 1 5 . Here is the error rate of the code and the sum is over all binary strings x of size N that represent the output samples of all measurements. The threshold for the topological code running on MBQC is thres = 0.75% [37]. Assuming the following conjecture, the quantum supremacy theorem (Theorem 3) for the noisy case holds. Conjecture 1. Approximating q(x|y = 0) by where 2 ≤ γ, is as hard as the worst case (#P -hard) for more than 1 − γ instances of x.
The above encapsulates within it two conjectured properties for the Ising sampler: the worst to average case hardness equivalence for multiplicative approximations and the probability anti-concentration conjecture. Theorem 3 (Fault-tolerant Hardness). Assume that Conjecture 1 is true. Then weakly sampling from the distribution q (x, y) of the actual noisy Ising sampler with a classical machine, assuming the hypothesis test passes, implies a collapse in the polynomial hierarchy to the third level.
The proof of this theorem is given in Appendix G. The proof uses Stockmeyer's theorem [38], which is based on a hypothetical machine and predicts, if classical sampling is possible, the collapse of the polynomial hierarchy to the third level. The collapse of the infinite polynomial hierarchy at any level is considered a highly unlikely event in computational complexity theory.

IV. DISCUSSIONS
We have taken the first steps towards tackling the two crucial challenges facing experimental demonstrations of quantum supremacy for the Ising sampler -verifying the output distribution of a noisy quantum sampler and proving that the sampling task remains classically hard to simulate even in the presence of experimental noise. Our work should direct near-term demonstrations of supremacy of quantum sampling and illuminate the design of long-term quantum simulators. The trap-based techniques developed here have a wide applicability range and are merely applied to the Ising sampler as a specific example of a model for quantum supremacy. For example, they could be applied in implementations of the Boson Sampling model [14] in a fault-tolerant quantum computer based on qubits [39]. Our methods should also apply to the random circuit IQP model [40] which, in the 'graph program' implementation [41] requires a smaller than the Ising sampler, but non-planar, resource state. Finally, it can be applied to recently studied quantum supremacy architectures on low-periodicity planar lattices [42]. The only requirement for our round-based technique is that the underlying graph state is bipartite. Thus, it can be used even to simplify the original verification protocol [27] for a universal quantum computer, in the case it runs a classical-output decision problem, and use our technique to implement it in fault-tolerant way.
Trap-based techniques require blindness, which is not believed possible with a classical verifier [43,44]. Even verification protocols that do not require blindness, such as [45], still need some level of quantum encryption. This is true for any protocol based on quantum authentication schemes [46], made possible by a quantum verifier. Verification protocols with classical verifiers exist [41,47], but require extra assumptions such as additional computational hardness conjectures or non-communicating provers respectively. An open problem we leave for our verification scheme is to find a graph state with local rotations being only multiples of π/4 and still generate random universal logical measurement angles as in the existing scheme. This will make the fault-tolerant version easier because it will be based on more standard magic states. Also, other universal constructions with xy-plane measurements can also be considered [48]. Our work is one of the first on fault-tolerant verification, which is known to be a challenging open question. Another recent progress [49] presents a fault-tolerant verification technique for universal MBQC requires the verifier to perform measurements, as opposed to preparations as in our scheme. Our scheme is complementary to contemperaneous work on composable verification of IQP, which is a classical hypothesis test with the verifier preparing perfect stabilizer states and the prover using a non-planar graph [50]. A formal proof of composability of our protocol is a desirable next step and may be developed using the methods given in [51]. To understand the procedure of carving a specific graph out of a square lattice state by only xy-plane measurements we need to explain two types of operations originally introduced in [27,52]. The first type is break operators. Let i be a vertex we want to remove from the original graph, together with the connection to its neighbours. One can achieve this by performing a Pauli Z measurement on the qubit that corresponds to i and discard the outcome. However, we do not have the power to perform measurements out of the xy-plane in our protocol (otherwise we risk revealing the position of the traps by asking the prover to change the basis). Pauli Z-measurements can be simulated by preparing |0 qubits called dummy qubits. Then, when the prover applies cZ the operation does not have any effect in entangling it with its neighbours. The measurement can have any arbitrary rotation since the qubit is isolated and does not participate in the computation. In order to keep the whole procedure blind we instead prepare the qubit in state |d i for d i chosen independently and uniformly at random from {0, 1} (so that the state looks identical to the maximally mixed state as it is the case for the other qubits in the blind protocol). Also, we apply on each of its neighbours Pauli operation Z di , before sending them to the prover, so that we cancel the effect that the prover's entangling will have on that neighbour. The second type is called bridge operators. Let i be a vertex of degree 2 that we want to remove in the original graph and join its neighbours by an new edge. To achieve this we apply a Pauli Y measurement (measurement angle π/2) on the qubit that corresponds to vertex i and add π/2 on the angles of each the two neighbours. Conditioned on this measurement giving 0, the resulting graph when we trace out the measured qubit is the desired one. If the measurement outcome is 1 then, in order to get the correct graph, we need to apply a Z correction on the neighbours. Since our Ising sampler model is nonadaptive and all our measurements are in the xy plane we can achieve this by flipping the measurement outcomes of the corresponding qubits. Notice that this is not an issue in the test rounds that we explain in Appendix B since there are no bridge operations in this case.

Appendix B: Non-fault-tolerant verification protocol
Here follows the full description of the protocol introduced in Section III A: Protocol 1: 1. Verifier selects a random ordering of 2κ + 1 graphs, one for computation and 2κ for testing' as in Fig. (1). This fixes the position of computational basis qubits called the dummy qubits (see Appendix A) and the measurement angles where N = m × n is the total number of qubits, so that: (a) in the computational graph we carve from the square lattice a universal resource state, the 'extended' brickwork state of Figure (4) and fix the rest of the measurement angles according to the Ising sampler model. (b) in the test graphs the dummy qubits are used to isolate the traps, which are placed at fixed positions: for half of the graphs in positions with odd parity that correspond to non-dummy qubits in the computational graph and in the other hald in positions with even parity that correspond to nondummies in the computational graph. The traps are measured with angles φ = 0 so that the measurement is deterministic. Crucially, the trap graphs do not contain any 'bridge' operations so there is no need for adaptive corrections. 2. Verifier prepares the qubits that will compose the cluster state one by one and sends them to the prover.
(a) The dummy qubits are prepared in The rest of the qubits are prepared in Z d k∼j |+ θj = 1 √ 2 (|0 + e i(θj +d k∼j π) |1 ), where θ j is chosen uniformly at random from the set A = {0, π 8 , 2π 8 , . . . , 15π 8 }} and d k∼j is the parity of the d's of all neighbours of j. Notice that the set A is different from the original trap-based protocol of Ref. [27]. 3. Verifier sends the encrypted computational measurement angles to the prover: δ i = θ i + (−1) r i φ i + r i π for r i , r i ∈ R {0, 1}. Parameters r i , r i create a classical one-time pad on measurement outputs. 4. Prover entangles all received qubits according to the 2κ + 1 cluster states, each of dimension n × m, by applying cZ gates for every edge of each cluster. 5. Prover measures all qubits simultaneously in angles δ i and returns the measurement results to the verifier. 6. The verifier applies a bit flip to the output bit i when r i = 1 and to its (non-dummy) neighbours when r i = 1 to undo the classical one time pad. The output string of the measurements of the computation round is the output of the protocol. The verifier sets an extra bit to accept if all the traps give the correct result (decoded measurement result 0). A variation of the protocol will be to ask to the prover to entangle all the graphs, instead of the square lattice state, directly in the 'extended brickwork state'. This will leak no extra more information to the prover from what is publicly known. However, one may want to have a more generic prover and keep the protocol as presented. Now we count the resources required in more detail. The number of qubits prepared by the verifier and sent to the prover one-by-one is (2κ + 1)N where N is the original size of the computation. The classical information exchanged is linear on N and can be sent in one round. Similarly the classical outcomes of the measurements can be sent at once. The prover's requirement is to entangle all neighbouring qubits in a square lattice and apply single qubit measurements in the xy-plane.

Correctness
We have to show that the protocol performs the correct operation if the prover honestly follows the prescribed steps. We begin with a circuit diagram of the operations on the prover's side in Fig. (5). Any measurement by angle {δ i } for the prover is here mathematically decomposed into a z-rotation (R z ) controlled by δ i and a Pauli X measurement. Without loss of generality, since everything before the measurements is unitary we can assume that even a dishonest prover will apply the correct unitary operators and then chose his deviation U B on all systems, including his private qubits |0 ⊗|B| . Since we are proving correctness in this section we assume U B = I. Also the measurement angles δ i received by the prover are here represented as (computational basis) multi-qubit states |δ i . This circuit can be simplified in a number of ways, resulting in the circuit of Fig. (6). The cZ gates between the dummy qubits and their neighbours cancel the Pauli Z pre-rotation on the neighbours. Also, we can write explicitly the rotation angles on each of the controlled R z gates and remove the control lines. Further simplification is done when the z-rotations by θ i which are part of the R z gates and the z-rotations by θ i applied by the verifier to the qubits before sending them to the prover mutually cancel after commuting with the cZ gates. Notice that the dummy qubits are an exception since θ i rotations remain but have no effect other than a global phase. Moreover, we can extract the Pauli operators from the R z by applying identities: R z (−χ) = XR z (χ)X and R z (χ + π) = ZR z (χ). The Pauli X operators from the left hand side of R z can be rewritten as Z rotations on their entangled neighbours. This results in the circuit diagram depicted in Fig. (7). Notice that the remaining Pauli X operators do not have any effect on the Pauli X measurements (we remind the reader that in this proof U B = I) and the Pauli Z operators flip the measurement results. Let us denote all the measurement outcomes of the protocol except the dummy qubit measurements by the binary vector x and q(x) the probability of obtaining it. Let p(x) denote the probability of obtaining x in an ideal MBQC implementation using the same measurement pattern {φ} N i as input. The only difference between the actual and the ideal case are the Pauli Z operators before the measurements, which flip the outcomes. Therefore, by relabelling the probabilities q(x) to q(x ), where x i = x i ⊕ r i ⊕ j r j∼i , we get p(x) = q(x ). In other words, we can sample from the correct distribution by simply correcting the bit flips caused by the random Pauli Z, which are known to the verifier. In MBQC, we can also write the distribution in terms

Soundness
The proof of Theorem 1 is based on the fact that the acceptance rate of the protocol is indeed a good estimator for the average fidelity of the computational output. Thus, looking at the acceptance rate gives us with high confidence a lower bound on the fidelity, or similarly an upper bound on the trace distance between the actual and the ideal computation. We outline the main arguments employed to prove this theorem in stages here, and provide the explicit algebraic derivations in Appendix (D).  Firstly, a unitary deviation U B applied before the measurements, depicted in Fig. (7), captures in all generality the prover's dishonesty. To see this, consider the case when the prover performs measurements different from the honest ones. This corresponds to applying a unitary basis rotation followed by Pauli X measurements. Then, U B applies also on the prover's private subsystem so he can use this power to replace the qubits he receives with any other qubits he chooses to prepare privately. In any case, he has to report some classical measurement results so we always keep the final Pauli X measurements in the picture. Our proof should therefore apply to any choice of U B . Secondly, we bound the total variation distance of the output distribution via the trace distance D(ρ c , ρ c ), where ρ c represents the state of the computational system just after the Pauli X measurements if the prover is honest and ρ c the same state if the prover is dishonest. Thus, The main idea leading to the statement of the theorem is that the fidelities of the computational system F (ρ c , ρ c ) and the trap system F (ρ t , ρ t ) are close in absolute difference, when averaged over the random parameters and considering the preparation noise. Therefore, by estimating the fidelity of the trap system (by counting the number of acceptances over many repetitions of the protocol), we get a good estimate of the fidelity of the computational system and therefore of the total variation distance between the honest and the dishonest distribution. We begin our analysis for the case of perfect preparations and will incorporate the effect of noise after. Averaged over the random parameters, the fidelity of the trap system just after the trap measurements, which is equal to the probability of getting all trap outcomes 1 isF where ρ t and ρ t represent the honest and dishonest state of the trap system just after the Pauli X measurements. Tracing over the prover's private system and dummy system, and summing over the random variables r i , r i , d i and θ i , we get (Appendix D) where t is the vector of the indices of the positions of the traps in all 2κ test systems and t takes all possible values allowed by the construction with equal probability p(t). The summation over the random parameters results in the attack on the trap system to be transformed into a convex combination of Pauli operators P k , each with probability |α k | 2 . By P k|i we represents the Pauli operator that applies on qubit i. A similar calculation for the average fidelityF c of the computational system leads tō where c(t) denotes the positions of the qubits that participate in the computation and depends on the random ordering of the 2κ + 1 rounds and therefore is a function of the position of the traps. Choosing κ = 2 we obtain (Appendix D) If the initial preparations are erroneous, the initial trap and computational fidelities are no more that N apart from their perfect counterparts. As all the prover's operations are contractive, these distances are not increased and |F t −F c | ≤ 1 10 + 2N . By averaging over α repetitions of the protocol, Hoeffiding's inequality leads to high confidence in the estimation of the average trap fi-delityF t , which leads to the statement of the theorem. See Appendix D for details.
FIG. 8. Distillation step [53]. A logical |+ is produced using the quantum (15, 1, 3) Reed-Muller code. Then a transversal T gate applied using the technique of Figure (10), stabilizer measurements and teleportation to an auxiliary qubit gives a 'cleaner' magic state (up to Pauli Z correction on the teleported qubit) when the error syndromes are correct. Everything is topologically protected. Picture adapted from Ref. [15].
FIG. 9. 3D cluster state used in the RHG code using MBQC. Blue dots are the qubits that represent the primal cubic lattice edges (or equivalently the dual cubic lattice faces) and red dots are the qubits that represent the primal cubic lattice faces (or equivalently the dual cubic lattice edges). Entangling operations (cZ) are represented by blue lines. On the right hand side you can see the primal and dual cubes. Pictures adapted from Refs. [37,54].
under post-selection type arguments. For the trap runs, however, we do not have these two problems (we have only |+ 'distillation' with error correction) and therefore verification is fault-tolerant. All other topological corrections are implemented by the verifier keeping track of the Pauli frame. 4. Prover runs the computation, by entangling, measuring all at once and returning the results. 5. The verifier classically corrects the returned outcomes using the correction procedure of the quantum error correcting code used in distillation and the topological code and undoes the r, r pad.
6. Verifier accepts if all the results of the logical trap computations are correct, otherwise rejects. Correctness of the protocol comes by applying the same analysis as in the non-fault-tolerant case. We can eliminate the pre-rotations by the θ's of the computation in the low level MBQC due to θ being in δ and, then, the computation is the correct up to Pauli Z corrections before the measurements. Local noise in the trap runs is taken care of by the error correction if is lower than the threshold of the RHG code. Thus we avoid scaling issues that we had in the non-fault tolerant protocol. The proof of soundness is given in Appendix E.
Appendix D: Proof of Theorem 1 Proof. Let U P (r, d) denote the correct unitary operation of the protocol. It includes everything preceeding U B in Figure (7), and we have only included in the arguments the random parameters that will be averaged over later. In the honest case, after U P (r, d) is applied, the state of the trap system becomes ρ t = i∈t Z ri |+ i +| i Z ri , where the index i takes values from the elements of t that represent the positions of the traps. In the dishonest case (again based on Figure 7), tracing out the prover's private system, the deviation U B becomes an arbitrary CPTP map denoted by E. The fidelity of the trap system ρ t , right after the measurements, can be written as: where the second trace in the formula is taken over all the systems except the trap system. Summing over θ's creates the maximally mixed state for the δ's and summing over the r's and d's of the computational system and the dummy system creates the maximally mixed state for those systems and therefore we can trace them out and update the CPTP map E to a new CPTP map E that applies on the remaining system (of dimension 2 N ) and does not depend on the secret parameters. The CPTP map E can be written as a Kraus decomposition, where the Kraus operators {E u } obey u E u E † u = I 2 N , where I 2 N is the identity on a 2 N dimension system. Each Kraus operator can be further decomposed into the Pauli basis as E u = k a u,k P k , where {P k } are all generalized elements of the Pauli basis applying on a 2 N dimension system and {a u,k } are complex coefficients. Also, we remind the reader that the φ parameters of the trap qubits are all zero and therefore the remaining honest operation consists only of the rotations by the r parameters.
where P k|i denotes the Pauli operator that applies on qubit with index i from the generalized Pauli basis operator P k . Because of the structure of the state we can add for free some Pauli X operators randomized by new parameters r taken uniform at random.
F t = rt,r t ,t,bt p(r t , r t , t)Tr u,k,l a u,k a * u,l i∈t By changing variables b i = b i + r i and applying the cyclic property of the trace to move Z ri X r i around F t = rt,r t ,t,b t p(r t , r t , t)Tr u,k,l a u,k a * u,l i∈t By applying the Pauli twirl lemma [56] (proven in Appendix (F)) when averaging over r t , r t , we get where |α k | 2 = u |a u,k | 2 and k |α k | 2 = 1 from the unital property of the attack. A similar analysis is applied to calculate the average fidelityF c = F (ρ c , ρ c ) of the computational state after the measurements. In the honest case the computational state ρ c just before the measurement will be disentangled from the rest of the system: i∈c where c(t) are the positions of the computational qubits for a choice of trap positions t and |G G| is the computational graph state (E G i∈c |+ i +| i E † G ). In the dishonest case, for an attack E the fidelityF c is Summing over the θ's of the δ's and the r's and the d's of the trap and the dummy system creates the maximally mixed system for these systems which can be traced over. Expressing the attack on the remaining system (of dimension 2 N ) using the Kraus decomposition with each Kraus element decomposed in the Pauli basis, as before, we get By changing variables b = b + r and applying the cyclic property of the tracē Using Corollary 1 in Appendix (F) and the cyclic property of the trace and sum over r c(t) , we can eliminate all Pauli X operators of the attack that differ in the two sides (we denote this by replacing the summation over l with a summation over l x where the element P l agrees with P k on all the Pauli X components). We also use the cyclic property of the trace to get Then, the X r i (X r j ) operators that are next to |G ( G|) can be rewritten as Pauli Z operators on their neighbours, which then commute with z rotations and the attack (since the Pauli X operators of the attack are the same from both sides) and with the projectors Z b i |+ +| Z b i , by changing variable b i = b i + r i , and cancel each other. The X r i operators that are next to projectors Z b i |+ +| Z b i commute with them triviallȳ Then we can use again Corollary 1, but with Q, Q being Pauli Z+identity operators and {P i } all tensor products of Pauli X+identity operators, and sum over r c(t) to eliminate the Pauli Z components of the attack the differ in the two sides. Thus, given that u,k |a u,k | 2 = 1 from the unital property of the attack, the attack becomes a convex combination of Pauli operators: The Pauli X component of P k|i can be replaced by I since the only effect is, depending on b i , to change the sign of the quantity inside the absolute and the sign is eliminated. Then, we can sum over the b's to get identity and since E † G R z (−φ i ) now commutes with the attack Pauli operators, it cancels with R z (φ i )E G . Also, as before, we set It is easy to see by the symmetry of the trap construction that, for attacks that are exactly the same on any of the 2κ + 1 graphs of the different the rounds of the protocol, Equation D6 and Equation D13 give the same result when averaged over t. However, one needs to deal with more clever attacks which attack a different qubit at every round trying to coincide with dummies instead of traps with non-zero probability, i.e. for some of the possible permutations of the 2κ + 1 graphs. For the case of κ = 2, we numerically calculate the gap between the fidelities when averaged over the permutations to be 1 10 . In the case that there is error in the preparation there is an extra 2N distance between the fidelities. This comes from the following facts: the initial state of the system the prover receives now is N -close to the correct state (from subadditivity of the trace distance). The operations applied by the prover are contractive so they cannot increase the trace distance. Therefore, the final fidelity is N close to the one calculated above in both the case of the actual fidelity and the fidelity that comes from the traps. By simple calculation the absolute difference between the two fidelities is bounded by 2N + 1 10 . Our estimate for the fidelity of the trap comes s repetitions of the protocol. By Hoeffding's inequality, repeating s = α/(2N 2 2 ) times gets us N -close in our estimation with confidence 2 −α . Let us set the limit for accepting the estimated fidelity to (1 − N ), we can be sure with the aforementioned confidence that the actual fidelity of the computation is lower bounded by 1 − 4N − 1 10 . This means that for the total variation distance we have an upper bound = 8N + 1 5 .
Appendix E: Proof of Theorem 2 Proof. To show soundness we need again to show that the fidelity on a computational round and the fidelity of a test round are the same averaged over the random choice of the ordering of computation/test. Crucially, we assume that the physical noise is symmetric and does not depend on this choice. The total variation distance between the actual (noisy and potentially dishonest) distribution of the Ising sampler q (x|y = 0), where y = 0 implies conditioning on the null syndrome, and the correct (noiseless and honest) one q(x|y = 0) = q(x) after the measurements is where ρ c is the correct state and ρ post c the actual state, post-selected on the null syndrome measurements, after all measurements. For the rest of this section we denote q (y = 0) as q 0 for simplicity. For the computation round, the average fidelityF c is calculated in the physical level of the computation and similarly to the non-fault-tolerant case. The qubits are pre-rotated by θ i or flipped by d i in the case of dummies. Since the computation is applied in a single time-step we represent the noise as a single CPTP-map N applied on the whole of the system, after the (possibly dishonest) operations and before the measurements. The noise operator is such that the noise strength ||I − N || is smaller than the size of the system times the threshold value. We apply the same twirling steps as in the proof of Theorem 1 to twirl the CPTP map that is the composition of the attack and the noise. Notice that the twirl on the post-selected qubits is trivial since there is no sum over b i . Thus, where b i 's take fixed values in the sum for the syndrome measurements such that the syndrome indicates null errors. Operator N is the noise operator after the twirl: a convex combination of Pauli operators, i β i P i , with i β i = 1. The only noise and attack operators that have an effect on the above quantity are tensor products of identity and Pauli Z. These operators flip the measurement outcome of the particular qubit. By linearity of the classical decoding procedure, the effect of the noise operator N ' and the attack operators P k|i can be considered separately. Detectable attacks disappear because of the projector to null syndromes. The undetected attacks that come from operators P k|i can be written as logical bit flips on the subsequent measurements -since it will affect the classical post-processing. Using Theorem 1 from [25], noise in this post-selected setting is reduced to exponentially small additive error (independent of the size of the computation), assuming that the local noise is below the code threshold. Also, the normalization factor vanishes when we trace over the syndrome systems. Therefore, at the logical MBQC level where ≈ means -close in absolute difference. We can now sum over the index b c(t) to simplify the expression, by cancelling also the rotation and entangling operators. On the logical dummy system the logical Pauli Z attacks have no effect, therefore it has trace 1 and can be simplified tō The same technique can be employed for the test rounds, resulting in the same argument as in the non-fault-tolerance case, but now the confidence does not depend in the size of the computation.
where ρ is a matrix of dimension 2 n × 2 n , Q, Q are two arbitrary n-fold tensor products of Pauli+identity operators {I, X, Y, Z}, and {P i } is the set of all n-fold tensor products of Pauli operators and the identity {I, X, Y, Z}.
A proof of this lemma is also provided in Ref. [56].
Proof. We can write Q as Z a X a = Z a1 ⊗ . . . ⊗ Z an X a 1 ⊗ . . . ⊗ X a n , for arbitrary binary vectors a = (a 1 , . . . , a n ), a = (a 1 , . . . , a n ), and similarly Q = Z b X b . Assuming Q = Q , either a = b or a = b . Summing over all P k,k 's which are the n-fold tensor products of the form Z k X k = Z k 1 ⊗ . . . ⊗ Z k n X k1 ⊗ . . . ⊗ X kn for binary vectors k = (k 1 , . . . , k n ), k = (k 1 , . . . , k n ), we get k,k P k,k QP k,k ρP k,k Q P k,k If either a = b or a = b the summation k ((−1) k ·(a⊕b) ) or k ((−1) k·(a ⊕b ) ) is equal to zero respectively, because (in either case) exactly half of the elements of the summation will be −1 and half will be 1. Therefore, since our assumption was that either a = b or a = b or both, the whole expression equals zero.
where ρ is a matrix of dimension 2 n × 2 n , Q, Q are two arbitrary n-fold tensor products of Pauli X and identity operators {I, X}, and {P i } is the set of all n-fold tensor products of Pauli Z and identity operators {I, Z}.
Proof. Since Q = Q , Lemma 1 gives where {P i } is the set of all n-fold tensor products of the Pauli operators and the identity {I, X, Y, Z}. But since Q and Q have only identity and Pauli X tensor elements the Pauli X operators of {P i } commute with Q and Q on each side and give identity. Our hardness proof follows a similar line of reasoning as the proof of the original translation invariant Ising sampler [18] -proof by contradiction. If we can classically weakly sample from q (x, y), then estimating the probabilities of the distribution with fixed accuracy is in #P . We can construct a polynomial time non-deterministic Turing machine that uses the sampler as an oracle and accepts when a specific event happens, so that the probability can be estimated by counting the accepting branches. We can also estimate the marginal probabilities q (y) in such a manner. From Stockmeyer's theorem [38], there exists an F BP P N P machine that can compute explicitly the values p(x, y), such that for every x, y |p(x, y) − q (x, y)| ≤ q (x, y) poly(N ) .
From Eqn. (4), assuming that the verification test has passed, it follows that the expectation of |q (x|y = 0) − q(x|y = 0)| is ≤ 2 mn , where m, n are the dimensions of the logical 'extended' brickwork state. Markov inequality relates a probability with its expectation. For a random variable X and γ > 0, Applying the Markov inequality to the second term in Eqn. (G3) p(|q (x|y = 0) − q(x|y = 0)| ≥ γ) ≤ 2 mn γ .