Quantum Proofs of Proximity

We initiate the systematic study of QMA algorithms in the setting of property testing, to which we refer as QMA proofs of proximity (QMAPs). These are quantum query algorithms that receive explicit access to a sublinear-size untrusted proof and are required to accept inputs having a property $\Pi$ and reject inputs that are $\varepsilon$-far from $\Pi$, while only probing a minuscule portion of their input. We investigate the complexity landscape of this model, showing that QMAPs can be exponentially stronger than both classical proofs of proximity and quantum testers. To this end, we extend the methodology of Blais, Brody, and Matulef (Computational Complexity, 2012) to prove quantum property testing lower bounds via reductions from communication complexity. This also resolves a question raised in 2013 by Montanaro and de Wolf (cf. Theory of Computing, 2016). Our algorithmic results include a purpose an algorithmic framework that enables quantum speedups for testing an expressive class of properties, namely, those that are succinctly decomposable. A consequence of this framework is a QMA algorithm to verify the Parity of an $n$-bit string with $O(n^{2/3})$ queries and proof length. We also propose a QMA algorithm for testing graph bipartitneness, a property that lies outside of this family, for which there is a quantum speedup.


Introduction
Quantum property testing is a fundamental model of sublinear-time quantum computation. Its importance stems both from the practical difficulty in manipulating large quantum states, as well as from the fertile ground that it provides for complexity theoretic investigations of the power of quantum mechanics as a computational resource. Accordingly, this model has garnered a large amount of attention in the last decade (see, e.g., [3,8,9,12,18,21,22,32,52,61,64], and the survey [60]).
Building on the vast literature of classical property testing (cf. the recent book [35]), quantum testers are defined as quantum query algorithms that solve the approximate decision problem of membership in a subset Π (of possibly quantum objects), which is typically referred to as a property; that is, the tester must accept if its input is in the property Π and reject if it is far from Π with respect to a natural metric.
This paper is concerned with the notion of QMA proofs, the quantum analogue of NP proofs, in property testing. Namely, we investigate the following question: What is the power of QMA proofs for quantum property testing?

Quantum proofs of proximity
The question of decision versus verification is foundational in theoretical computer science, and extends far beyond P vs. N P. Indeed, the study of classical proof systems in the property testing setting is well established [13-15, 29, 37, 41, 45-47, 53, 69, 71, 72]. These objects are called proofs of proximity, and include, among others, PCPs of proximity, interactive proofs of proximity, and MA proofs of proximity (MAPs). We henceforth adopt this standard terminology, noting it is synonymous with proof systems in the property testing setting.
A Quantum Merlin-Arthur (QMA) proof of proximity protocol for a property of unitaries Π, 1 with respect to proximity parameter ε, is defined as follows. The verifier, a computational device given oracle access to a unitary U , receives a quantum state |φ from an all-powerful but untrusted prover. Making use of these two resources, it must decide whether U ∈ Π or U is ε-far from Π with respect to a specific metric. 2 Such a protocol is said to verify (or test) Π if, with high probability, the verifier accepts in the former case and rejects in the latter (see Section 3 for a formal definition). We remark that the notion of QMA proofs of proximity is implicit in the literature as QMA query algorithms for approximate decision problems (e.g., the permutation testing problem [2,73]). In this paper, we initiate the systematic study of the notion of QMA proofs of proximity (QMAPs), and explore its power and limitations.
The complexity of a QMAP protocol is measured with respect to the amount of resources required by the verifier. Namely, we will evaluate the efficiency of a protocol by its proof complexity p (the number of qubits in the proof |ψ ) and query complexity q (the number of oracle calls made by the verifier for a worst-case input U ). In particular, both parameters should be sublinear in nontrivial protocols.
Before proceeding to state our results, we briefly discuss three applications that underscore the motivation to study quantum proofs of proximity.
as a special case of testing unitaries: a property Π of n-qubit states defines a property Λ of n-qubit unitaries U such that (say) U |0 n ∈ Π with the metric on unitaries induced by that on states. (One may also generalise testing mixed states similarly by considering quantum channels.) However, if Π is a set of states and allowing for entanglement between the state being tested and that given as proof yields a markedly different model; indeed, its study may shed light on the quantum PCP conjecture [5].

Our results
Our main results are divided into two parts: Section 1.2.1 charts fundamental aspects of the complexity landscape surrounding quantum proofs of proximity, while Section 1.2.2 covers algorithmic results, where we show sufficient conditions for properties to admit efficient QMAP protocols.
We write QMAP(ε, p, q) for the class of ε-testable properties by a QMA proof of proximity protocol with proof length p and query complexity q (non-calligraphic acronyms to refer to algorithms and protocols, while calligraphic letters denote complexity classes).

Complexity separations
Our first collection of results aims to chart the complexity landscape of quantum proofs of proximity. Recall that QMAP(ε, p, q) is the class of ε-testable properties by a QMAP with proof complexity p and query complexity q. The classes MAP (MA proofs of proximity) and IPP (interactive proofs of proximity) are defined analogously. PT (ε, q) and QPT (ε, q) are the properties admitting classical and quantum ε-testers with query complexity q, respectively, and QCMAP(ε, p, q) is the restriction of QMAP(ε, p, q) where the proofs are classical bit strings. Formal definitions of all of these classes can be found in Section 2 and Section 3.1.
We write complexity classes with the parameters omitted (e.g., QMAP) to denote the corresponding class of properties such that for some proximity parameter ε ∈ (0, 1) that is a universal constant, there is a protocol with proof and query complexities bounded by polylog(n).
We begin by showing the existence of a property that admits efficient QMAPs, yet neither quantum property testers nor MAPs can efficiently test it. Theorem 1. There exists a property Π such that, for any small enough constant ε > 0, Π ∈ QMAP(ε, log n, O (1)) and Π / ∈ QPT (ε, o(n 0.49 )) ∪ MAP(ε, p, q) when p · q = o(n 1/4 ). In particular, Theorem 1 is, in fact, implied by a stronger result. We show that, for certain properties, MAPs are stronger than quantum testers, i.e. MAP ⊆ QPT (Theorem 4.3); and, for others, quantum testers are stronger than MAPs, i.e. QPT ⊆ MAP (Theorem 4.4). Combining these results, we conclude that QCMAP ⊆ QPT ∪ MAP, i.e., even QMAPs with classical proofs suffice to obtain an exponential speedup over both MAPs and quantum testers.
Having shown the aforementioned separation, a natural question poses itself: are there cases in which a quantum proof cannot be substituted for a classical one? We observe Theorem 1 [46] Theorem A.1, implicit in [4] Theorem B.2, implied by [47,73] Figure 1: Classification of complexity classes. An arrow from A to B is present when there exists a property requiring n Ω(1) proof length or query complexity by algorithms of A but only polylog n proof/query complexity by algorithms of B (coloured red or grey when with respect to a proximity parameter ε = Ω(1) that is a universal constant; and violet when ε ≤ 1/ √ n). The grey arrows are previously known separations.
that a straightforward adaptation of a known result shows this is indeed the case, albeit only for subconstant proximity parameters: the QMA vs. QCMA oracle separation of Aaronson and Kuperberg [4] carries over to the property testing setting, implying QMAP(1/ √ n, log n, 1) ⊆ QCMAP(1/ √ n, p, q) if √ pq = o( √ n) (see Appendix A for details).
We then shift to proving limitations on the algorithmic power of QMAPs, showing that there exist explicit properties that are extremely difficult for such protocols. First, we observe that known lower bounds on the complexity of QMA protocols for the Permutation Testing problem [2,73] yield an explicit property that does not have any QMA protocol of polylogarithmic proof length and query complexity, and in fact establishes that IPP ⊆ QMAP (see Appendix B for details). We thus obtain the complexity landscape shown in Figure 1.
Finally, we present an entire class of properties that cannot be solved by efficient QMAP protocols. This extends and simplifies one of the main results of [30], which obtains the same result for classical MAPs.

Algorithms
We show two general classes of properties whose structure allows for efficient QMAP (QMA proof of proximity) protocols. Moreover, these protocols only require classical proofs (though the verifier is quantum). 3 The first class is comprised of what we call decomposable properties, which generalise the "parametrised concatenation properties" introduced in [46].
Roughly speaking, a property Π is (k, s)-decomposable if testing whether x ∈ Π can be reduced, with the help of a message of length s from the prover, to that of testing whether x (i) ∈ Λ (i) for k smaller strings x (i) and properties Λ (i) (see Definition 9). Since there may be several decompositions of the same string, the prover's message is said to specify a decomposition, i.e., mappings x → x (i) and Π → Λ (i) .
Theorem 3 (Theorem 7.1, informally stated). If a property Π is (k, s)-decomposable into strings of length m, each of which is ε-testable by a MAP protocol with proof complexity p and query complexity q = q(m, ε) = m α /ε β , then where q is much smaller than q for many parameter values α and β.
The second class of properties amenable to QMA proofs of proximity are those admitting one-sided (classical) MAPs which do not receive a proximity parameter explicitly, but rather reject strings ε-far from the property with probability that is a function of ε. Such algorithms are called proximity-oblivious MAPs and readily admit quantum speedups (via the technique of amplitude amplification; see Section 6).
Theorem 4. If a property Π admits a proximity-oblivious MAP protocol with proof complexity p and query complexity q, which always accepts x ∈ Π and rejects when x is ε-far from Π with probability ρ(ε) > 0, then As applications of Theorem 3, we show: Corollaries 2 and 3 achieve a dependence on ε that is quadratically better as compared to the best known MAPs [41,46], while Corollary 1 is more efficient than the best known (classical) testers and MAPs for a wide range of parameters (see Section 7.2).
Classically, casting exact decision problems in the framework of proofs of proximity (i.e., testing with respect to proximity parameter ε = 1/n) is completely trivial except for degenerate cases, as most functions of sublinear query complexity are extremely simple. Rather surprisingly, this is not the case quantumly, and indeed setting ε = 1/n in Corollaries 1 to 3 yields sublinear algorithms for the corresponding exact decision problems. For layered branching programs, we also prove the following, which improves on the parameters of Corollary 3 and lifts the read-once restriction: Theorem 5. There exists a QMA protocol for acceptance of n-bit strings by layered branching programs of width w = w(n) and length = (n) with query complexity O( 2/3 ) and proof complexity O( 2/3 log w).
For details on decomposability and its implications, see Section 7. Finally, we prove that QMAP protocols are useful beyond proximity-oblivious and decomposable properties. The problem of testing bipartiteness of a graph does not fit either class, yet admits an efficient protocol nonetheless (see Section 8).

Technical overview
In this section, we discuss the high-level ideas of the techniques used in the proofs of the results stated in Section 1.2. Our discussion is divided into lower bounds and algorithmic techniques. In Section 1.3.1, we introduce some of the lower bound techniques that we use in charting the complexity landscape of quantum proofs of proximity. En route, we extend the framework of Blais, Brody and Matulef [16] to show lower bounds for quantum property testers. To the best of our knowledge, this is the first quantum testing lower bound proved via a reduction from quantum communication complexity, an open question raised by Montanaro and de Wolf [60,Question 4]. In addition, we show how to prove lower bounds on QMAP algorithms via an argument about the threshold degree of Boolean functions.
In Section 1.3.2 we show how to construct quantum proofs of proximity for properties that can be decomposed into sub-problems, and we prove that these QMAP protocols outperform both quantum testers as well as classical proof of proximity protocols. Moreover, we give an overview of an efficient QMAP protocol for a natural property of bounded-degree graphs, bipartiteness, which does not fall into the decomposability paradigm.

Lower bounds
In this section, we highlight two techniques that we exploit to prove complexity separations and limitations on QMAPs: (1) proving quantum testing lower bounds via reductions from quantum communication complexity [16], which we use to show a separation between MAPs and quantum testers; and (2) proving QMAP lower bounds by studying the threshold degree of Boolean functions.

Quantum testing lower bounds via reductions from communication complexity.
The methodology of [16] has proven very successful for showing classical property testing lower bounds. However, extending this methodology to the quantum setting poses an inherent difficulty that we expand upon next. Following the exposition of [60], we illustrate the methodology and the difficulty in the quantum setting by considering the problem of testing whether a function f : {0, 1} n → {0, 1} is k-linear, i.e., a Fourier character of weight k.
We can obtain query complexity lower bounds on testers via a reduction from the randomised communication complexity problem of disjointness, as follows. Recall that, in the disjointness problem, Alice receives x ∈ {0, 1} n and Bob receives y ∈ {0, 1} n (for lower bound purposes, we may assume without loss of generality that both bit strings are promised to have Hamming weight k/2 for some known k ∈ [n]), and their goal is to decide whether or not there exists an index i ∈ [k] such that x i = y i = 1, while communicating a minimal number of bits.
Suppose that there exists a property tester for k-linearity with query complexity q. We will use this tester to construct a communication complexity protocol for disjointness (i.e., deciding if, for every i ∈ [n], either x i = 0 or y i = 0) as follows. First, Alice and Bob use shared randomness and simulate the tester on the input f , interpreted as a function mapping {0, To simulate a query f (z), Alice computes A(z) = i∈[n] z i · x i and sends it to Bob, while Bob computes B(z) = i∈[n] z i · y i and sends it to Alice. Since f (z) = A(z) ⊕ B(z), each query to f incurs 2 bits of communication. Moreover, if x and y are disjoint, then f is k-linear; and if they are not disjoint, f is -linear for some < k, and is in particular 1/2-far from every k-linear function. Therefore, the simulated tester indeed solves the communication problem, so that the Ω(k) lower bound for the latter implies an Ω(k) lower bound for testing k-linearity.
An attempt to extend this to quantum testers, however, reveals a severe bottleneck in the reduction. Note that, classically, the fact that Alice and Bob can use shared randomness to fix a deterministic tester to simulate is crucial: at every step, both parties know which query z the tester will make next without the need to communicate it. The problem is that there is no way to fix the "quantumness" using shared randomness. Details follow.
While disjointness is still hard in the quantum communication complexity model, communicating the query (which may be in a superposition) that the quantum tester requires will incur a linear overhead, rendering the reduction useless. Namely, to simulate a query to f in superposition, the parties need to exchange all n qubits at each round: Alice would apply the unitary (on n + 1 qubits) |z |b → |z |b ⊕ A(z) , and send the (n + 1)-qubit state to Bob, who applies |z |b ⊕ A(z) → |z |b ⊕ A(z) ⊕ B(z) = |z |b ⊕ f (z) and returns them to Alice. Simulating a single query then requires the communication of 2n + 2 qubits, rather than the 2 needed by a classical tester. Thus, the reduction can only prove a degenerate Ω(1) testing lower bound. This is, in fact, not suprising, since k-linearity is testable with O(1) queries by the Bernstein-Vazirani [19] algorithm! While the discussion above might suggest that communication complexity can only yield trivial quantum testing lower bounds, we show this is not the case; indeed, the absence of nontrivial (quantum) applications of the technique thus far points to a conceptual barrier that is clarified by a coding-theoretic perspective similar to [36], which reveals that the linear overhead is not inherent to any quantum reduction. Observe that testing k-linearity is a special case of testing a subset of a code: namely, a k-linear function f where f (z) = w·z corresponds to the Hadamard encoding of the string w with Hamming weight k (which maps w ∈ {0, 1} n into the codeword C(w) = (w · z : z ∈ {0, 1} n ) with blocklength n = 2 n ). Note that the aforementioned quantum simulation strategy is efficient, in the sense that it requires only O(log n ) qubits to communicate a representation of the length-n encoding; the issue is the Hadamard code's exponential blocklength n = 2 n , which renders the simulation's efficiency moot. As we see next, however, the same reduction yields nontrivial bounds if we choose the code appropriately.
Given a linear code C : {0, 1} n → {0, 1} n with n = poly(n), only log n = O(log n) qubits are necessary to represent C(x) and C(y). More precisely, Alice can apply the O(log n)-qubit unitary |i |b → |i |b ⊕ C(x) i and send all O(log n) qubits to Bob, who applies |i |b → |i |b ⊕ C(y) i and returns them. This composition of unitaries is simulating a query with logarithmic, rather than linear, overhead. Therefore, the Ω( √ n) quantum communication lower bound for disjointness [68] implies an (n ) Ω(1) lower bound for the problem of testing a subset of C. Indeed, we show that, for a linear code C : F n → F n (over a larger field of odd characteristic), the property {C(z) : z ∈ {0, 1} n }, of Booleanity, 5 which may be of interest in PCP constructions, has a quantum testing lower bound of Ω( √ n/ log n) via a reduction from disjointness (see Section 4.2 for details). We remark that since this technique is used to show a separation between quantum testers and MA proofs of proximity, we use codes that are locally testable and relaxed locally decodable, which allow for efficient testing by a MAP. Since there exist such codes with a nearly-linear blocklength [10,13], the lower bound we obtain is only slightly worse than a square root.
QMAP lower bounds via threshold degree. We prove lower bounds for QMAPs via the threshold degree of related functions. A function f : in other words, the threshold degree of f is the smallest degree of a polynomial that sign-represents f .
As a first step, we show that the inclusion QMA ⊆ PP [58] (in the polynomial-time setting, implied by the technique known as Marriott-Watrous amplification) carries over to the property testing setting, implying QMAP ⊆ UPP. 6 Next, we show that the query complexity of a UPP algorithm that computes f is exactly the threshold degree of f (this result is folklore, but we provide a proof for completeness). Since a property Π induces the (partial) function f Π such that f Π (x) = 1 when x ∈ Π and f Π (x) = 0 when x is ε-far from Π, the query complexity of a UPP algorithm that "tests" Π (i.e., computes f Π ) is a lower bound on the product pq of the proof and query complexities of any QMAP protocol for testing Π. Finally, we show that if Π is k-wise independent (i.e., looks perfectly random on any subset of k coordinates) and not too large, the threshold degree of f Π is at least k, so that pq = Ω(k) (see Section 5 for details).
In particular, any code with linear dual distance and small enough rate is an example of a hard property for QMAPs, requiring proof and query complexities that satisfy pq = Ω(n) for proximity parameter ε = Ω(1).

Algorithmic techniques
As a warm-up, consider the exact decision problem of verifying that an n-bit string x has even parity. This is maximally hard for both IP algorithms and quantum query algorithms, requiring Ω(n) queries to the bit string, and thus asymptotically no better than trivially querying every coordinate. As we will see next, however, QMA algorithms can capitalise on having a proof and quantum processing power to break the linear barrier.
We rely on the technique of amplitude amplification [17] to obtain such an algorithm with sublinear proof and query complexities. Loosely speaking, amplitude amplification takes a (randomised) decision algorithm that always accepts yes-inputs and rejects no-inputs with probability ρ, and produces an algorithm with rejection probability 2/3 (for no-inputs) using the former algorithm only O(1/ √ ρ) times as a subroutine.
We can thus obtain a QMA (query) algorithm for the parity problem as follows. The proof string specifies the purported parities of each block of an equipartition of the input x ∈ {0, 1} n into p blocks of length n/p. The verifier first checks that the proof string has even parity, rejecting immediately otherwise. Then, the verifier performs amplitude amplification on the following subroutine: sample i ∈ [p] uniformly at random, read the entire block of n/p bits and check that its parity coincides with that claimed by the proof; if so, accept, and reject otherwise.
Note that the aforementioned subroutine always accepts if x has even parity and the proof corresponds to the parity of every block. On the other hand, if a string has odd parity and the proof has even parity, at least one bit of the proof disagrees with the corresponding block, so that the subroutine rejects with probability at least 1/p. Since we need only repeat O( √ p) times, each of which queries n/p bits, the query complexity of our algorithm is This is a special case of a more general phenomenon, which holds for all decomposable properties (see Section 7.3 for a discussion of how exact decision follows as a special case). Since amplitude amplification can only be applied to one-sided algorithms (i.e., those that always accept a valid input), we restrict our attention to this type of algorithm hereafter.
Decomposable properties. Roughly speaking, a property Π is said (k, s)-decomposable if a "specification" of length s efficiently reduces testing Π to testing k smaller properties 1. there exists some s-bit string that specifies a set of k properties Λ (i) as well as k strings x (i) ∈ {0, 1} m i whose bits are determined by a small number of bits of x; and 2. ε-testing x ∈ {0, 1} n with respect to Π reduces to testing x (i) with respect to Λ (i) in the following sense: when x ∈ Π then x (i) ∈ Λ (i) for all i ∈ [k], whereas when x is ε-far from Π, then x (i) is ε i -far from Λ (i) for some ε i satisfying E i [ε i ] = Ω(ε), where the expectation over i means that i is sampled with probability proportional to m i .
If the specification is short (i.e., s = O(k log n)), we say Π is succinctly k-decomposable (see Section 7 for details). Decomposable properties generalise the notion of parametrised k-concatenation properties introduced in [46], which corresponds to the special case of a (k, 0)-decomposition that is an equipartition of the input string.
Our simplest example of a decomposable problem is that of testing the set of kmonotone functions f : [n] → {0, 1}, i.e., functions that change from non-decreasing to non-increasing and vice-versa at most k − 1 times. A natural decomposition of this property is to specify the set of at most k − 1 "critical points", which induce a set of at most k subfunctions f i that are monotone and overlap with f i−1 and f i+1 at their endpoints; then, it suffices to test for (1-)monotonicity of each subfunction. More precisely, this property is (k, (k − 1) log n)-decomposable (thus succinctly k-decomposable), and given the (alleged) critical points n 1 < n 2 < · · · < n k−1 , the subproperty Λ (i) for odd (resp. even) i is the set of non-decreasing (resp. non-increasing) functions on [m i ], where m i = n i − n i−1 + 1 (with n 0 = 1 and n k = n). Note, moreover, that if f is ε-far from k-monotone, then its absolute distance from all functions specified by the critical points is at least εn; thus, denoting by ε i the distance of f i to Λ (i) , we have i ε i m i ≥ εn, implying E i [ε i ] = Ω(ε). We remark that decomposing other properties (e.g., branching programs, context-free languages, and Eulerian graph orientations) is much less straightforward and often allows for breaking the property into any desired number of sub-properties, which in turn admits proof length versus query complexity tradeoffs. See Section 7 for details.
Given a (k, s)-decomposable property that admits MAPs for the subproperties Λ (i) , a natural protocol for Π is to sample i ∈ [k] uniformly at random and execute the verifier for Λ (i) . Note that, if these MAPs have proof complexity p and query complexity q, the protocol for Π has proof length s + kp. Moreover, E i [ε i ] = Ω(ε) means that a randomly chosen i ∈ [k] is (in expectation) at distance roughly ε from Λ (i) , so it is reasonable to expect that O(1/ε) classical repetitions of the base protocol would ensure a rejection with high probability, and that a QMAP protocol can make do with only O(1/ √ ε) repetitions using amplitude amplification.
The above outline glosses over the fact that we have no information on the distribution of errors (ε 1 , . . . , ε k ). For example, it may be that most ε i are of the same order of magnitude (in which case a random i ∈ [k] is likely to point to a mildly corrupted x (i) ), or it may be that a few ε i are very large while all other ε i are small or even zero (in which case x (i) is unlikely to be corrupted for a random i ∈ [k], but when it is, the amount of corruption is large). Fortunately, this issue can be addressed by the technique of precision sampling [55], incurring a merely logarithmic overhead. We thus obtain a QMAP protocol for ε-testing Π with proof complexity s + kp and query complexity comparable to q (and often smaller; see Theorem 7.1 for details).
Bipartiteness testing. Consider the problem of testing whether a bounded-degree graph G (given as an oracle to its adjacency list) is bipartite or far from any bipartite graph. (Note that this is not a decomposable property.) There exists a MAP protocol for a promise variant of this problem, where graphs are rapidly-mixing [46]. We will show that it is possible to combine quantum speedups obtained by amplitude amplification and by replacing a classical subroutine with a more efficient quantum analogue.
Let us first consider the (classical) MAP verifier for bipartiteness, which receives a subset of vertices S of size k, allegedly on the same side of a bipartition, as a proof. To test with respect to proximity parameter ε, the verifier repeats the following procedure: sample a uniformly random vertex v, take roughly n/(kε) short (lazy) random walks starting from v, recording whether the walk ended at a vertex in S as well as the parity of the walk (i.e., the parity of the number of non-lazy steps). If two walks start from the same vertex v and end in S with different parities, then reject; otherwise, accept. Setting m := n/k, the query complexity of (one iteration of) the verifier is m/ε (ignoring constants and polylogarithmic factors).
If the graph is bipartite and the proof S is indeed on the same side of a bipartition, there cannot exist two paths from the same vertex into S with different parities (as that would imply a path of odd length with both endpoints on the same side). Therefore, the verifier always accepts in this case. If the graph is ε-far from bipartite, however, each iteration finds evidence to this effect with probability Ω(ε). Thus, the classical verifier samples a new vertex roughly 1/ε times, for a total query complexity of m/ε 2 . Now, one immediate way to improve this algorithm is to perform amplitude amplification: the resulting algorithm repeats the procedure 1/ √ ε times, improving the query complexity to m/ε 3/2 . A second (and less straightforward) strategy is to use the quantum collision-finding algorithm [7] to reduce the number of random walks taken from each vertex to (m/ε) 2/3 , as in [8]. 8 This strategy reduces the required number of queries to m 2/3 /ε 5/3 , improving the dependency on m but achieving a worse one on ε.
Of course, this begs the question: why not apply both optimisations? Indeed, we show how to tweak the classical MAP verifier in order to do so, and thus simultaneously obtain the speedups from each of them. 9 More precisely, sample a uniformly random vertex v and let g v denote the mapping r → (a, b) ∈ {0, 1} 2 obtained by executing a random walk starting from v with r as its inner randomness, where a = 1 if the walk stops at a vertex in S and b is the parity of the walk. The collision-finding algorithm is capable of finding a pair r 0 , r 1 such that g v (r i ) = (1, i) for i ∈ {0, 1}, if such a pair exists. The query complexity of the collision-finding algorithm is the domain size to a 2/3 power, and, since we take m/ε walks from v, the number of queries is (m/ε) 2/3 . Although such a collision is not guaranteed to exist for all starting vertices v, it is for a fraction of roughly ε of them. By applying amplitude amplification to the procedure described in this paragraph, we obtain a QMAP protocol for bipartiteness with proof length O(k log n) and query complexityÕ((m/ε) 2/3 · 1/ √ ε) =Õ((n/k) 2/3 /ε 5/6 ) (see Theorem 8.1 for details).

Open problems
This work begins the exploration of quantum proofs of proximity, leaving a host of uncharted research directions. We wish to highlight a small number of open problems, which we find to be of particular interest.
In the diagram of complexity class separations of Figure 1, an evident shortcoming is the absence of QMAP ⊆ QCMAP in the natural setting of parameters, i.e., with proximity ε = Ω(1) rather than ε = Θ(1/ √ n).
Given our focus on quantum MA (i.e., non-interactive) proofs of proximity, it is natural to ask what is achievable by allowing quantum property testers to interact with quantum provers, as opposed to static proofs.

Open Question 2. What is the power of quantum IP proofs of proximity (QIPPs)?
More specifically, it is known that there exist classical interactive proof of proximity (IPP) protocols withÕ( √ n) proof and query complexities for large classes of languages [71,72]. Moreover, these complexities are optimal (up to polylogarithmic factors) for classical protocols, under reasonable cryptographic assumptions [53]. Could quantum interactive proofs break the square-root barrier?

Open Question 3. Can QIPPs test logspace-uniform N C languages with o(
√ n) proof and query complexities? f with 1-certificate complexity at most 2, uses Θ(n 2/3 ) queries and with constant probability outputs a 1-certificate when run on any input x ∈ f −1 (1).
Finally, while we show a strong lower bound for QMAPs for k-wise independent properties, they do not rule out the existence of sublinear QMAP protocols. Could a stronger lower bound be shown?
Open Question 4. Do there exist maximally hard properties for QMAPs, requiring Ω(n) query complexity when the proof complexity is p = cn for some c = Ω(1)?
We note that the question has an easy (negative) answer if we take c = 1: with a proof (allegedly) equal to the input string x, a QMAP based on Grover search can test [67] provides a (positive) answer for proximity parameter ε = 1/n: there exists a property Π ⊂ {0, 1} n for which deciding whether x ∈ Π or x / ∈ Π requires proof and query complexities satisfying p + q = Ω(n) (indeed, this is true of most bipartitions of {0, 1} n ). Then taking c = Ω(1) small enough implies q = Ω(n). Thus, similarly to Open Question 1, while we have answers for subconstant ε, the problem is open when ε = Ω(1).

Organisation
The rest of this paper is organised as follows. In Section 2, we discuss the preliminaries for the technical sections. QMA proofs of proximity are formally defined in Section 3, and we prove our complexity class separations in Section 4 (which Appendices A and B complement with separations implied by known results). Section 5 proves lower bounds for QMAPs and concludes the complexity-theoretic part of the paper. Proceeding to the algorithmic part, we show in Section 6 that QMAP protocols enable speedups for proximity-oblivious MAPs. In Section 7, we define decomposability and prove the bulk of our algorithmic results, including exact decision problems as a special case. Finally, in Section 8 we show a QMAP protocol for testing graph bipartiteness.

Preliminaries
We begin with standard notation. For an integer ≥ 1, we denote by [ ] the set {1, 2, . . . , }. We use polylog(n) to denote an arbitrary polylogarithmic function, i.e., a polynomial in the logarithm of n. For ease of notation, we also define N := 2 n .
We use H, K to denote arbitrary finite-dimensional Hilbert spaces and use indices to differentiate between distinct spaces. The set of linear operators mapping H to K is denoted by L ( A pure state is a unit vector in the Hilbert space H, and represented by the Dirac notation, e.g., |ψ . A mixed state is a distribution on pure states {p k , |ψ k }, represented as a density matrix ρ = p k |ψ k ψ k |. We write dim(H) to denote the dimension of the Hilbert space H. Also, for brevity, we represent |0 ⊗n as |0 , for an arbitrary n ≥ 1, where

Complexity classes.
We use the convention of writing complexity classes in calligraphic capitals and denoting algorithms or protocols by latin capitals, e.g., BQP is a complexity class whose problems are solvable by BQP algorithms and IP is a complexity class characterised by IP protocols.
Quantum query model. A quantum algorithm V with query access to a bit string x ∈ {0, 1} n is specified by a sequence of unitary operations V 0 . . . V q , that do not depend on the input x. A query to x is given by the unitary U x on log n + 1 qubits such that We denote by V U the output of V with oracle access to a unitary U . Similarly, V U (n) denotes the case where V has access to an additional explicit input n.
The final state of an algorithm that makes q queries to the oracle, before measurement, is given by The overall Hilbert space H used by the algorithm is split into three subspaces H in ⊗ H w ⊗ H out , and we denote by |0 = |0 ⊗ log(dim H) the initial state of the verifier's memory. The oracle acts on the space H in , the workspace H w can have arbitrary size and H out represents the single-qubit output of the algorithm. The final step of the algorithm is to measure the H out register in the computational basis and return the outcome.
Distance measures. Unless otherwise stated, we will assume the distance measure d for classical objects, such as strings of symbols in a finite field F, as that induced by normalised Hamming weight: for x, y ∈ F n , the (normalised) Hamming weight of x is |x| := |{i ∈ [n] : x i = 0}|/n and the distance between x and y is d(x, y) = |{i ∈ [n] : x i = y i }|/n. We will often refer to distances between bit strings, which corresponds to the case where For unitary matrices U, V , unless otherwise stated, we consider the distance measure to be that induced by the normalised Hilbert-Schmidt norm: the norm of U is U : is the i th eigenvalue of A (in some arbitrary order); and the distance between U and V is d( We say two objects X, Y are ε-close if d(X, Y ) ≤ ε, and otherwise they are ε-far. We also say X is ε-close to a set of objects Property testing. An interactive proof of proximity (IPP) for Π is a proof system that solves the approximate decision problem of membership in Π. The verifier algorithm receives as input a proximity parameter ε and has oracle access to x. It queries x in at most q coordinates and interacts with an all-powerful but untrusted prover by exchanging m messages, where the total number of communicated bits is c. The verifier must accept when x ∈ Π and reject when x is -far from Π, with bounded probability of error; the outcome of such an interaction is denoted P (x), V x . Formally, Definition 1. An interactive proof of proximity (IPP) for a property Π = ∪ n Π n is an interactive protocol with two parties: a (computationally unbounded) prover P and a verifier V , which is a probabilistic algorithm. The parties send messages to each other in turns, with the first sent from prover to verifier, and at the end of the communication, the following two conditions are satisfied: 1. Completeness: For every ε > 0, n ∈ N, and x ∈ Π n , there exists a prover P such that , where the probability is over the coin tosses of V .
2. Soundness: For every ε > 0, n ∈ N, x ∈ {0, 1} n that is ε-far from Π n and for every computationally unbounded (cheating) prover P * it holds that where the probability is over the coin tosses of V .
The query complexity q of the protocol is the maximum number of queries the verifier makes to x in its execution; the round complexity m is the number of messages exchanged between prover and verifier; and the communication complexity c is the total number of bits communicated by these messages.
The set of properties Π for which there exists an IPP protocol with proximity parameter ε with m messages, communication complexity c and query complexity q is denoted IPP(ε, c, q, m).
When the completeness condition holds with probability 1, i.e., the verifier always accepts when x ∈ Π, we call the protocol one-sided. Moreover, if the verifier does not receive ε explicitly, but rejects inputs that are ε-far from Π with detection probability ρ(n, ε) > 0, the procotol is said to be proximity-oblivious.
A Merlin-Arthur proof of proximity (MAP) for Π is an IPP where the entire communication is a single message from the prover to the verifier (i.e., an IPP with round complexity 1); the class MAP(ε, p, q) is thus defined as IPP(ε, p, q, 1). The formal definition of the quantum generalisation of MAPs is given in Section 3.1.
A property tester is an IPP with r = 0, i.e., where no communication occurs. In this case, the verifier is called a tester, and we define PT (ε, q) := IPP(ε, 0, q, 0).

Branching programs.
A branching program on n variables is a directed acyclic graph that has a unique source vertex v 0 with in-degree 0 and (possibly) multiple sink vertices with out-degree 0. Each sink vertex is labeled either with 0 (i.e., reject) or 1 (i.e., accept). Each non-sink vertex is labeled by an index i ∈ [n] and has exactly 2 outgoing edges, which are labeled by 0 and 1. The output of the branching program B on input x ∈ {0, 1} n , denoted B(x), is the label of the sink vertex reached by taking a walk, starting at the source vertex v 0 , such that at every vertex labeled by i ∈ [n], the step taken is on the edge labeled by x i .
A branching program is said to be read-once (or ROBP for short) if, along every path from source to sink, every index i ∈ [n] appears at most once. The size of a branching program B is the number of vertices in its graph.
A branching program is layered if its nodes can be partitioned into V 0 , V 1 , . . . , V , where V 0 only contains the source node, V are the sink nodes and every edge is between The length of a layered branching program is its number of (nontrivial) layers , and its width is the maximum size of its layers, i.e., max i∈[ ] {|V i |}.
Coding theory. A code C : F k → F n (where F is a finite field) is an injective mapping from messages of length k to codewords of blocklength n. The rate of the code C is k/n and its distance is the minimum, over all distinct messages x, y ∈ F k , of d(C(x), C(y)). We shall sometimes slightly abuse notation and use C to denote the set of all of its codewords If the mapping C is linear, we say C is a linear code.

QMA Proofs of Proximity
This section provides a formal definition of QMAPs.

Definition
A quantum Merlin-Arthur proof of proximity (QMAP) for a property Π = Π n is a proof system consisting of a quantum algorithm V , called a verifier, that is given as explicit input an integer n ∈ N and a proximity parameter > 0. It has oracle access to a unitary U ∈ V ⊆ U(2 n ) acting on n qubits, which belongs to a universe V with an associated distance measure. 10 Furthermore, the verifier receives a p-qubit quantum state ρ explicitly as a purported proof that U ∈ V.
We allow the oracles in the rest of the work to be quantum oracles, i.e., CP-Maps. However, using the Stinespring dilation [66,74], we view them as unitary operators again, in a larger Hilbert space, and the formalism generalises readily. This allows us to work with most general transformations allowable by quantum theory.
The verfier V receives n and ε as inputs, and outputs a sequence of unitary operators V 0 . . . V q that satisfies the two following conditions. 1. Completeness. For every n ∈ N and U ∈ Π n , there exists a p-qubit quantum state |ψ such that, 11 for every proximity parameter > 0, Equivalently, some p-qubit quantum state |ψ satisfies where |0 is the initial state of the verifier and W the unitary obtained by interspersing q calls to the oracle U between the V i ; that is, Equivalently, every p-qubit quantum state |ψ satisfies The query complexity of a QMAP is number of times the verifier calls the oracle U . More precisely, the query complexity is q = q(n, ε) if, for every n ∈ N, > 0 and U ∈ U(2 n ), the verifier makes at most q queries to the input. Its proof complexity is p = p(n, ε) if, for every n ∈ N and U ∈ Π n , there exists a 2 p -dimensional quantum state |ψ satisfying both of the above conditions. The running time t V = t V (n, ε) of the verifier is the minimum depth of the unitaries V 0 . . . V q , composed of gates from a fixed constant-qubit gate set. The running time t P = t P (n, ε, U ) of the prover is similarly the minimum depth of the circuit that prepares the proof state |ψ . Definition 2 (QMAP complexity class). Fix a universe set of unitary operators V and distance measure d : is the class of properties Π ⊆ V that admit a verifier for proximity parameter ε with query complexity q and proof complexity p such that the verifier and prover runtimes are t V and t P , respectively.
The complexity class QCMAP(ε, p, q, t V , t P ) is defined as above, with the additional restriction that the proof be classical, i.e., that the p-qubit quantum state given as proof is a computational basis state. For ease of notation, since the measures of complexity we will use throughout are proof and query complexity (but not time complexity), we will often use QMAP(ε, p, q) (and likewise for QCMAP) to denote the class as above, where t V , t P are arbitrary functions.
Remark 2 (Proofs are pure states). Without loss of generality, the quantum state given as the proof is a pure state on p qubits, i.e., a rank one positive semi-definite matrix. To see why, note that, if some mixed state ρ = p i |ψ i ψ i | causes the verifier to accept with probability 2/3, then, by convexity, there exists a state |ψ k in that mixture that would also cause the verifier to output 1 with probability at least 2/3. Hence, the proof can be the pure state |ψ k . Likewise, if no pure state can make the verifier accept with probability larger than 1/3, the same holds for mixed states.

Complexity separations
Armed with a formal definition of QMAPs, we begin to chart the landscape of complexity classes to which quantum proofs of proximity belong. In Section 4.1, we provide definitions that will be necessary in the remainder of the section, mainly pertaining to coding theory.
Our main goal is to prove Theorem 1, namely, that QMAPs can exploit quantum resources and the availability of a proof to gain expressivity that neither can provide separately. This theorem follows from the incomparabilty between the classes MAP and QPT : in Section 4.2, we exhibit a property Π B that is easy to test classically with a short proof, but requires many queries (without a proof) even for a quantum tester (Theorem 4.3); moreover, in Section 4.3, we show the existence of a property Π F that is easily testable quantumly but difficult to test classically, even with the aid of a proof (Theorem 4.4).
The aforementioned results immediately imply the existence of a property, namely Π B × Π F , which does not admit efficient MAPs nor quantum testers, requiring large proof or query complexity, whereas a QMAP with logarithmic proof and query complexities does exist (indeed, one with a classical proof). and when p · q = o(n 1/4 ).

Preliminaries
We first define the necessary notions of local codes that will be used in this section. We denote throughout a finite field of constant size by F.

Definition 3 (Locally Testable Codes (LTCs))
. A code C : F k → F n is locally testable, with respect to proximity parameter ε and error rate σ, if there exists a probabilistic algorithm T that makes q queries to a purported codeword w such that: Note that the algorithm T that an LTC admits is simply an ε-tester for the property of being a valid codeword of C.
Definition 4 (Locally Decodable Codes (LDCs)). A code C : F k → F n is locally decodable with decoding radius δ and error rate σ if there exists a probabilistic algorithm D that given index i ∈ [k] makes q queries to a string w promised to be δ-close to a codeword C(x), and satisfies Since the best known constructions of LDCs have superpolynomial blocklength, we will make use of a relaxation of this type of code that allows for much more efficient constructions and suffices for our purposes.
Definition 5 (Relaxed LDCs). A code C : F k → F n with relative distance δ C is a qlocal relaxed LDC with success rate ρ and decoding radius δ ∈ (0, δ C /2) if there exists a randomised algorithm D, known as a relaxed decoder that, on input i ∈ [k], makes at most q queries to an oracle w and satisfies the following conditions.

Relaxed Decoding:
For any i ∈ [k] and any w ∈ F n that is δ-close to a (unique) codeword C(x),

Success Rate:
There exists a constant ρ > 0 such that, for any w ∈ F n that is δ-close to a codeword C(x), there exists a set I w ⊆ [k] of size at least ρk such that for every As shown by [10,13,25,42], there exist linear codes of only slightly superlinear blocklength that are both locally testable and relaxed locally decodable: 12 Theorem 4.2. For any constant γ > 0, there exist linear codes over F with blocklength n = k 1+γ that are relaxed locally decodable with O(1) queries with respect to decoding radius δ = Ω(1). Moreover, given any constant proximity parameter ε ∈ (0, δ], the code is also locally testable with O(1) queries.
Moreover, the tester and local decoder for these codes are one-sided (i.e., always accept when given a valid codeword as input), and the blocklength cannot be improved to linear [27,44].
Communication complexity. In the model of quantum communcation complexity, two parties with unbounded computational power aim to compute a joint predicate by communicating the smallest number of qubits with each other. Alice knows x ∈ {0, 1} k , Bob knows y ∈ {0, 1} k and both hold a function f : {0, 1} 2k → {0, 1}, and, by communicating qubits with each other, they must compute f (x, y) with bounded probability of error.
The communication complexity of f is the worst-case number qubits that need to be communicated in order to compute f (x, y) over all x, y, minimised over all communication protocols.
We will make use of the well-known communication complexity problem of disjointness.
This problem is known to be hard for quantum communication protocols, requiring Ω( √ k) qubits of communication, as shown in [68].

MAPs versus quantum testers
We now set out to prove Theorem 4.3, which shows a property Π B that is efficiently testable with a short classical proof (Lemma 1) but for which a quantum tester must make a large number of queries (Lemma 2). The property in question is defined as follows. First, consider a linear code C : F k → F n with n = k 1.001 , over a field F of odd characteristic and size O(1), that is both relaxed locally decodable with O(1) queries and decoding radius δ = Ω(1); as well as locally testable with O(1) queries for any constant proximity parameter ε ∈ (0, δ] (recall that Theorem 4.2 shows that codes with these parameters exist).
The property Π B comprises the encoding of non-Boolean messages, that is: We first show that the property Π B is efficiently testable via a MAP protocol with a short proof. log n, O(1)).
Proof. The verifier will follow the following strategy to test Π B : first, test whether the input is ε-close to the code C (which can be accomplished with O(1) queries due to the local testability of C). If the tester rejects, then not only is the input far from Π B , but from all of C, in which case it rejects.
Except with small probability, if the tester accepts the input is δ-close to C, so we may locally decode any coordinate of the message (also with O(1) queries); using the proof string to determine this location, the verifier then checks if the symbol at that coordinate is Boolean-valued.
This strategy is laid out in Algorithm 1.

Algorithm 1: MAP verifier for Π B
Input: explicit access to a proximity parameter ε > 0 and a proof string π ∈ {0, 1} log n , as well as oracle access to x ∈ F n . 1 Test if the input w is a valid codeword with proximity parameter ε. Reject if the test rejects. Note that the proof complexity is log n by definition, and, since both local testing and local decoding have query complexity O(1), the verifier makes O(1) queries in total (note that querying an element of F requires O(1) bit queries, so the complexities of the tester and decoder are still constant in terms of bit queries). Moreover, if w ∈ Π B , then w = C(z) for some z ∈ F k \ {0, 1} k , and local testing succeeds with probability 1; and when the prover specifies a coordinate i such that z i / ∈ {0, 1}, local decoding also succeeds with probability 1, so completeness follows. Now, if w is ε-far from Π B , then either (1) the input w is ε-far from any codeword of the code C; or (2) w is ε-close to some C(z) such that z ∈ {0, 1} k .
In the first case, local testing (and thus the verifier) will reject with probability 2/3. In the second case, the testing step may not trigger a rejection, but the local decoder then outputs, regardless of the proof i ∈ [k], either ⊥ or z i ∈ {0, 1} with probability 2/3, any of which cause the verifier to reject.
The next lemma shows that, unlike MAPs, quantum testers cannot test Π B efficiently. Proof. Recall that in the disjointness problem, Alice is given as input x ∈ {0, 1} k , Bob is given y ∈ {0, 1} k and they must compute DISJ k (x, y); and that Π B is the encoding of non-Boolean strings of length k = n To show that any quantum tester needs Ω(n 0.49 ) queries to ε-test Π B , we give a reduction showing that a tester with query complexity q can be used to compute DISJ k by communicating O(q log n) qubits. Since the quantum communication complexity of DISJ k is Ω( √ k) = Ω(n 1 2 · 1 1.001 ) = Ω(n 0.499 ), the query complexity of the quantum tester follows. First, Alice and Bob use C to encode x and y, respectively. Now Alice holds C(x) ∈ F n and Bob holds C(y) ∈ F n . Note that, defining z := x + y ∈ F k , we have DISJ(x, y) = 0 ⇐⇒ z / ∈ {0, 1} k ⇐⇒ C(z) ∈ Π B (recall that the characteristic of F is larger than 2, so that if x i = y i = 1, we have z i = 2 / ∈ {0, 1}). Now, Alice and Bob respectively set up the unitaries U A and U B shown below, where the first register holds log n qubits and the second holds O(1) qubits (enough to specify a single element of F).
Alice then simulates the quantum tester and only communicates with Bob in order to make a query to the oracle; if the tester accepts, Alice outputs 0, and she outputs 1 otherwise.
More precisely, whenever the tester calls the oracle U , which acts as U |i |α = |i |α + C(z) i on a (log n + O(1))-bit quantum state ρ, Alice first applies U A to ρ, then sends all qubits to Bob; Bob then applies U B on the qubits it receives and returns them to Alice. This communicates a total of O(log n) qubits and implements the same transformation as querying U , since U B · U A |i |j = |i |j + C(x) i + C(y) i = |i |j + C(x + y) i by the linearity of the code C and the fact that z = x + y.
Each query made by the tester entails O(log n) qubits of communication, so that after q queries, Alice and Bob exchange O(q · log n) qubits in total. The tester accepts with probability at least 2/3 when C(z) ∈ Π B ⇐⇒ DISJ(x, y) = 0, in which case Alice outputs 0. If DISJ(x, y) = 1, we have that C(z) is δ-far from Π B (since the relative distance of C is δ). Since ε ≤ δ, the ε-tester rejects with probability 2/3 and Alice outputs 1 in this case.
Thus, Alice is able to compute DISJ k with O(q · log n) qubits of communication. Since the quantum communication complexity of DISJ k is Ω( √ k) [68], we conclude that the tester must make Ω( √ k/ log n) = Ω(n 0.499 / log n) = Ω(n 0.49 ) queries.

Remark 3.
Although we reduce DISJ to testing non-Booleanity, a symmetric argument shows the same lower bound for the (arguably more natural) property of Booleanity C(z) : z ∈ {0, 1} k . Often, one key step in PCP constructions is to check that an encoding corresponds to a logical assignment, i.e., that it is the encoding of a Boolean message. Therefore, bounds on Booleanity may have consequences for PCPs.
We conclude this section with the separation immediately implied by Lemma 1 and Lemma 2.

Quantum testers versus MAPs
In this section, we will show the existence of a property that is easily testable with a quantum tester, but for which a classical tester -even with additional access to a proofmust make a number of queries that depends strongly on the length of the input. More formally, we will show in Theorem 4.4 the existence of a property of n-bit strings in QPT (ε, O(1/ε)) that is not in MAP(ε, p, q) when p · q = o(n 1/4 ) and ε is a small enough constant.
The property in question is derived from Forrelation, a problem that strongly separates classical and quantum algorithms in the query model; in fact, the work that proved such a separation already shows that it carries over to the property testing setting [3], which we will extend to the setting of MAPs. Formally, we have

Lemma 3 ([3]). Define the property Π F as
where (f, g) are n/2-bit strings corresponding to pairs of log(n/2)-bit Boolean functions and Φ f,g = (n/2) −3/2 x,y∈{0,1} log(n/2) f (x)(−1) x·y g(y). Then, for any ε > 0 sufficiently small, Therefore, the property Π F is easy for quantum testers and hard for their classical counterparts. This section is thus devoted to showing that testing Π F is hard not only for property testers, but for MAPs as well: we will prove that a MAP for Π F requires proof length p and query complexity q satisfying pq = Ω(n 1/4 ). We first introduce relevant definitions and theorems, then describe the steps of the proof.
Recall that MA is the class of languages that are decidable in polynomial time with a (polynomial-size) proof string, the analogue of which is MAP in the property-testing setting. By [49], MA is contained in the class BPP path of languages decidable (with high probability) by a randomised Turing machine whose computational paths are all equally likely. 13 Query lower bounds for Forrelation (i.e., deciding whether |Φ f,g | ≤ 1/100 or Φ f,g > 3/5 for a pair (f, g) of Boolean functions) against the latter are known: 24]). Any BP P path algorithm for Forrelation must make Ω(n 1/4 ) queries to its input.
We are now ready to describe the three steps taken in proving hardness of Π F for MAP: we (1) show that transforming an MA algorithm with proof complexity p and query complexity q into a BP P path one [49] yields an algorithm with query complexity O(pq); (2) show how a MAP for Π F implies an MA algorithm with the same parameters for Forrelation; and (3) conclude that pq = o(n 1/4 ) implies a BPP path upper bound of O(pq) = o(n 1/4 ) for the query complexity of Forrelation, which contradicts Proposition 1.
The original proof of MA ⊆ BPP path ( [49], Theorem 3.7) takes an MA algorithm with proof complexity p and constant success probability, repeats the execution O(p) times, amplifying the success probability to 1 − O(2 −p ), and then defines a BPP path machine as follows. The machine (non-deterministically) guesses a proof string and simulates the MA algorithm with it, spawning "dummy" execution paths if the MA algorithm accepts. Inspecting this transformation in the query model, we obtain a quadratic overhead: if the MA algorithm has query complexity q and proof complexity p, the BPP path machine thus obtained has query complexity O(pq) (the O(p) repetitions of the MA algorithm increase its query complexity multiplicatively by this amount, while the dummy paths make no queries).
The second step is formalised by the following lemma.

Lemma 4. A MAP protocol for Π F with sufficiently small proximity parameter ε > 0 implies an MA algorithm for Forrelation with the same query and proof complexities as the MAP protocol.
Proof. We define an MA protocol for Forrelation (as a gap problem) the natural way: the proofs and queries correspond to the proofs and queries of the MAP, and the MA verifier accepts if and only if the MAP rejects.
To show correctness of this protocol, we follow the reduction of [3]. Specifically, [3,Lemma 40] shows that any (f , g ) such that f is ε-close to f and g is ε-close to g satisfies | f , Hg − f, Hg | = O( √ ε log(1/ε)). By choosing a suitably small ε, the right-hand side is at most (say) 1/100. Thus any (f, g) such that f, Hg > 3/5 is ε-far from Π, and it follows that the MAP protocol will accept (with high probability) pairs (f, g) such that | f, Hg | ≤ 1/100 and will reject if f, Hg > 3/5. Therefore, the MA protocol is able to distinguish between the two cases.
A simple argument now proves the separation.
Proof. Suppose, towards contradiction, that there existed a MAP for Π F with any proximity parameter ε, as well as proof complexity p and query complexity q satisfying p · q = o(n 1/4 ). By Lemma 4, there exists an MA protocol for Forrelation with the same query and proof complexities, which can then be transformed into a BP P path algorithm with query complexity O(p·q) = o(n 1/4 ) for the same problem. But this contradicts the Ω(n 1/4 ) lower bound of Proposition 1.
We are finally ready to prove the main separation, by exhibiting a property Π in QCMAP which is in neither MAP nor QPT .
Proof of Theorem 4.1. Recall that our goal is to show that the property Π = Π B × Π F that is efficiently ε-testable by a QCMAP, but not by a quantum tester (without a proof) nor classicaly with a proof, for some small enough ε = Ω(1). To this end, we invoke  Completeness follows immediately from Lemma 1 and Lemma 3, since the verifier for Π B accepts with certainty and the and tester for Π F accepts with probability 2/3 when x ∈ Π B and y ∈ Π F . If, on the other hand, (x, y) is ε-far from Π B × Π F , then either x is ε-far from Π B or y is ε-far from Π F , and either the verifier for Π B or the tester for Π F will reject (with probability 2/3). Thus, the QCMAP verifier for Π (executed with respect to proximity parameter ε = 2ε) implies Π ∈ QCMAP(ε, log n, O(1)).
All that remains is to show Π = Π B × Π F does not admit an efficient quantum tester nor a MAP. Assume, towards contradiction, that either Π ∈ QPT (ε, o(n 0.49 )) or Π ∈ MAP(ε, p, q) when p · q = o(n 1/4 ). In the first case, applying the tester for Π to Π B × {y} for some fixed y ∈ Π F shows that Π B ∈ QPT (ε, o(n 0.49 )), a contradiction with Lemma 2. In the second case, applying the MAP protocol for Π to {x} × Π F , for some fixed x ∈ Π B , shows that Π F ∈ MAP(ε, p, q), a contradiction with Theorem 4.4.

A hard class of problems for QMAPs
When introducing a new complexity class in the landscape of known classes, it is important not only to exhibit problems it can solve, but also problems it cannot. We set out to show a natural limitation on QMAPs in this section, by answering (negatively) the following question: if a property "looks random" on any subset of q coordinates, can a quantum proof be of any help to a verifier with query complexity q? Intuitively, the answer should be no: if querying q coordinates provides no information as to whether or not an input satisfies a property, then any proof (quantum or otherwise) should not be able to offer more information in conjunction with the queries than it does on its own.
We formalise this intuition in Theorem 5.2, which states the following: if a property Π ⊂ {0, 1} n is k-wise independent and sparse (i.e., its size |Π| is sufficiently small compared to the set of all 2 n bit strings), then k is a lower bound on the number of queries made by any randomised query algorithm that accepts all inputs in Π with probability strictly greater than 1/2, and rejects with probability strictly greater than 1/2 when run on any input that is far from Π. In other words, the UPP query complexity of testing Π is at least k (recall that UPP is the query model version of PP, which captures randomized computation with small bias). Note that some assumption on the sparsity of Π is necessary for any non-trivial lower bound to hold, if only to rule out, e.g., the trivially testable property Π = {0, 1} n .
Combining Theorem 5.2 with the well-known inclusion QMA ⊆ PP [58] allows us to conclude the following: for any k-wise independent and sufficiently sparse property Π, the product of proof and query complexities of a QMAP for verifying membership in Π with constant proximity parameter ε is Ω(k) (see Corollary 4).
The proof of Theorem 5.2 works as follows. Our analysis shows that the sparsity of Π ensures there exists a subset Π ⊂ {0, 1} n that is far from Π such that Π is also k-wise independent (see Lemma 5). This means that any query algorithm making fewer than k queries cannot distinguish a random input in Π from a random input in Π , as both sets "look random" when inspecting only k bits of a randomly chosen input from the set. Yet since Π is far from Π, any testing procedure for Π must distinguish Π from Π . Hence, any tester for Π must make k queries (even if it only outputs the correct answer on inputs in Π and Π with probability strictly greater than 1/2).

Technical Details.
We begin recalling the definition of k-wise independence.

Definition 7.
A set of strings S ⊆ {0, 1} n is called k-wise independent if, for any fixed set of indices I ⊂ [n] of size k, the string x |I is uniformly random when x is sampled uniformly from S. Equivalently, for every y ∈ {0, 1} k , We next show that, given any small enough set S of strings, there exists a Ω(n)-wise independent set that is ε-far from S. In the following lemma, H denotes the binary entropy function H(α) = −α log α − (1 − α) log(1 − α) (whose restriction to [0, 1/2] is bijective).
Proof. Let C : {0, 1} 3n/4 → {0, 1} n be a random linear code (where each entry of its generator matrix is a Bernoulli(1/2) random variable). Then, for every x ∈ {0, 1} 3n/4 , the codeword C(x) is uniformly random in {0, 1} n (but not independent of other codewords). Denoting by N ε (S) the ε-neighbourhood of S (i.e., the set of bit strings at distance at most ε from S), we have: and, by the probabilistic method, there exists a code C ⊂ {0, 1} n of size 2 3n/4 that is ε-far from S. Moreover, the dual code C ⊥ : {0, 1} n/4 → {0, 1} n is a linear code whose distance meets the Gilbert-Varshamov bound with high probability; that is, the distance of this dual code is Ω(n) with probability 1 − o(1), proving the claim.
The previous lemma, when applied to a "random-looking" set S (i.e., a k-wise independent S, for k = o(n)), will ensure that S and the code C are hard to distinguish. To make this precise, we first recall the definition of the threshold degree of a (partial) function.  14 The threshold degree of f , denoted thrdeg(f ), is the minimal degree of an n-variate polynomial p that sign-represents f , i.e., such that f (x) = sgn(p(x)) for all x ∈ X . 15 Note that no constraints are placed on the behaviour of p(x) at inputs in {1, −1} n \ X .
The threshold degree is a measure of complexity of Boolean functions (in particular), so that we expect functions with high threshold degree to also have high query complexity. This intuition is validated by the following folklore result: the minimal query complexity of a UPP algorithm that computes f is exactly equal to its threshold degree. We provide a proof of this fact for completeness, as, to the best of our knowledge, it is not explicitly proven in the literature.
We write f ∈ UPP(q) when there exists a UPP algorithm with query complexity q that computes f , and denote by q(f ) the integer such that f ∈ UPP(q(f )) but f / ∈ UPP(q(f ) − 1).
Let P (X 1 , . . . , X n ) = S⊂[n],|S|≤d α S i∈S X i be a polynomial of degree d that signrepresents f , i.e., such that f (x) = sgn(P (x)) for all x ∈ X . Consider the algorithm A that queries the set of coordinates S with probability |α S |/ |T |≤d |α T | and outputs sgn(α S ) · i∈S x i (note that its query complexity is d). Fix x ∈ X and suppose, without loss of generality, that f (x) = 1. We thus have To prove the reverse inequality, consider a UPP algorithm A that computes f with query complexity q := q(f ), given by a distribution over decision trees of depth at most q. To see that the function computed by each decision tree T can be sign-represented by a polynomial of degree at most q (which is a standard fact), we follow the exposition on leaf indicators in [43]. Denote by L the set of leaves of T , and identify each ∈ L with its indicator function : {1, −1} n → {0, 1} such that (x) = 1 if and only if is the unique leaf reached on input x in T .
Then, if c ∈ {1, −1} is the output of the decision tree when an execution ends at the leaf , the output of T on input x is ∈L c · (x). Thus, showing (·) can be represented by a polynomial of degree at most q implies the same degree bound for the computation of T . Fix ∈ L, let (i 1 , . . . , i d ) ∈ [n] q be the coordinates queried by the root-to-leaf path that ends at , and let the sequence of bits (b 1 , . . . , b d ) ∈ {1, −1} q correspond to the queried values that cause this path to be followed. Then, so (·) can be represented by the degree-q polynomial P (X 1 , . . . , X n ) = 2 −q q j=1 (X i j + b j )/b j . Thus, the output of A x when it selects this tree is the degree-q polynomial ∈L c · (x), and E[A x ] is a convex combination of such sums (which also has degree q). Since f (x) = sgn(E[A x ]) for all x ∈ X , we conclude that thrdeg(f ) ≤ q(f ) and the claim follows.
The final ingredient to show the lower bound is the next theorem, a special case of the "Theorem of the Alternative" [11,63]. We are now ready to prove the main result of this section. Proof. First, apply Lemma 5 to obtain a k-wise independent code C ⊆ {0, 1} n that is ε-far from Π. Let D be the distribution obtained by drawing a uniform random element of Π with probability 1/2 and drawing a uniform random element of C with probability 1/2. Then for every monomial m of degree less than k, The final equality above holds by virtue of the k-wise independence of both Π and C. Let X be the union of inputs in Π and inputs that are ε-far from Π. Define the partial function f over domain X via: By Theorem 5.1, the distribution D constructed above witnesses the fact that thrdeg(f ) ≥ k. Since the UPP query complexity of f is thrdeg(f ) by Lemma 6, the claim follows.
We conclude the section with a corollary that follows from the inclusion QMA ⊆ PP. The proof of this inclusion (in the polynomial-time setting) proceeds in two steps: (1) reducing the error rate of a QMA algorithm to roughly 2 −p , where p is the length of the proof given to the verifier, by repeating the algorithm O(p) times; and (2) running the verifier with the proof fixed to be the maximally mixed state. This exhibits a gap of roughly 2 −p between the acceptance probabilities of yes-and no-inputs, which suffices to place the problem in PP [58,77]. The same transformation, carried out in the query model, implies that any sufficiently small Π ∈ QMAP(ε, p, q) can be "ε-tested" by a UPP algorithm with query complexity O(pq); that is, any function f as in the statement of Theorem 5.2 is such that f ∈ UPP(O(pq)). Therefore, Corollary 4. For any sufficiently constant small ε > 0 and k-wise independent property Π ⊆ {0, 1} n such that |Π| < 2 n/5 , we have Π / ∈ QMAP(ε, p, q) unless pq = Ω(k).

Quantum speedups for proximity-oblivious MAPs
We now shift gears and move to our algorithmic results. We recall in this section the technique of quantum amplitude amplification, and prove its consequences for the classes of algorithms we consider in this work. Roughly speaking, given an algorithm that finds, with probability γ, We note that the theorem applies to classical randomised algorithms as a special case. An immediate corollary for promise problems in the query model (which is the setting for property testers, MAPs and variations thereof) is the following. 16 Corollary 5 (Amplitude amplification for promise problems in the query model). Let Y, N ⊆ {0, 1} n with Y ∩ N = ∅ define a promise problem on n-bit strings whose yes-and no-inputs are Y and N , respectively. Let A be a randomised algorithm with oracle access to a string x ∈ {0, 1} n that makes q queries, always accepts when x ∈ Y and rejects with probability at least γ when x ∈ N . Then, there exists a quantum algorithm B that makes O(q/ √ γ) queries to the unitary U x |i |b = |i |b ⊕ x i , always accepts when x ∈ Y and rejects with probability 2/3 when x ∈ N .
This follows from the observation that each where r is the number of random bits used by A. If A x accepts when the outcome of its random coin flips is s, we define f x (s) = 0, and if A x rejects when its random string is s, then f x (s) = 1. We then apply Theorem 6.1 to the algorithm A x , for each fixed x ∈ Y ∪ N (or, more precisely, to the modified algorithm that computes f x written as a reversible circuit and thus implements a query to x as (i, b) → (i, b ⊕ x i )), obtaining B Ux (recall that U x is the unitary mapping |i |b → |i |b ⊕ x i ). Measuring B Ux |0 , using the outcome as the random string for an execution of A x and outputting accordingly yields the claimed algorithm.
Note that Corollary 5 directly applies to one-sided proximity-oblivious testers, which are testers that always accept n-bit strings in the property and reject strings that are ε-far from it with detection probability ρ(ε, n). We now prove the following observation, which shows that the same speedup can be obtained for MAPs; more precisely, properties that admit one-sided proximity-oblivious MAPs allow for more efficient verification by a quantum algorithm using the same proof string. Theorem 6.2. Let Π be a property admitting a one-sided proximity-oblivious MAP protocol, which receives a proof of length p = p(n), makes q = q(n) queries and rejects strings ε-far from Π with probability at least ρ = ρ(ε, n). Then, for any ε ∈ (0, 1), Proof. Observe that the MAP verifier V can be equivalently described as a collection of probabilistic algorithms {V π : π ∈ {0, 1} p } indexed by all proof strings π. By definition, for every x ∈ Π there exists π ∈ {0, 1} p such that V x π always accepts; and, for every x that is ε-far from Π, every proof string π is such that V x π rejects with probability at least ρ. Therefore, V π solves the promise problem whose yes-inputs comprise the subset of Π for which π is a valid proof, and whose no-inputs are the strings ε-far from Π.
Let W π be the algorithm obtained from V π by Corollary 5. Then W x π accepts (with probability 1) when x ∈ Π and π is a valid proof for x, and W x π rejects (with probability 2/3) when x is ε-far from Π and π is any proof string; in other words, the algorithm W that executes W π when it receives π as a proof string is a QCMAP verifier for Π. Moreover, since the proof string is reused and W makes O(q/ √ ρ) queries, the proof and query complexities are as stated.
We conclude with two applications of Theorem 6.2: to read-once branching programs (ROBPs) and context-free languages (CFLs), which are shown to admit proximity-oblivious MAPs in [41] (see Remark 4 for details on these results).
Interestingly, these corollaries make explicit a phenomenon in quantum proofs of proximity that does not hold for their classical counterparts: it is possible to test with proximity ε = 1/n, i.e., solve the exact decision problem of acceptance by an ROBP and membership in a context-free language, with sublinear proof and query complexity. In particular, taking k = n 3/4 , both complexities are O(n 3/4 ). Nonetheless, for the case of branching programs, we will show in Section 7.3 how to lift the read-once restriction and improve on the parameters by directly exploiting decomposability.

Remark 4.
We note that a context-free language L is defined in terms of an alphabet of terminals (which is generally larger than {0, 1}) as well as an alphabet of variables. However, if both alphabets have constant size, we may represent symbols as bit strings with a constant overhead per query; thus Corollary 7 holds for languages over large (constantsize) alphabets.
Moreover, the results of [41] corresponding to Corollaries 6 and 7 are in fact stronger: both apply more generally to IPPs, and thus to MAPs as a special case (see [41,Section 3.2] for details). In addition, the detection probability of the MAP for ROBPs is εn/n if the branching program has an accepting path of length n ≤ n; and the MAP for context-free languages works for partial derivation languages, a generalisation of CFLs whose strings may include variable symbols as well as terminals.

Decomposable properties
In this section, we show how quantum speedups can be applied to proof of proximity protocols for properties that can be broken up into sub-problems in a distance-preserving manner. Roughly speaking, a property Π of n-bit strings is (k, s)-decomposable if, using s bits of information (which we call a specification), Π can be mapped to k properties Λ (i) and the input string x can be mapped to a set of k strings x (i) satisfying the following conditions: (1) when x ∈ Π, there exists a specification such that x (i) ∈ Λ (i) for all i ∈ [k]; and (2) when x is ε-far from Π, then, for some specification, x (i) is roughly ε-far from Λ (i) for an average i ∈ [k]. 1. If x ∈ Π, then there exists y ∈ S such that x (i) ∈ Λ (i) for all i ∈ [k]; and 2. If x is ε-far from Π, then, for all y ∈ S and i ∈ [k], the string Note that k-decompositions specified by O(k) coordinates of the input string are succinct. All of our applications are to succincly decomposable properties, and often the x (i) form an equipartition of x (so each bit of x (i) depends on a single bit of x) and D is thus the uniform distribution. However, note that if a decomposition is significantly asymmetric, then D preserves (average) distance while uniform sampling may deteriorate it to o(ε) (e.g., if m i = o(m 1 ) when i > 1 and x (1) concentrates all of the corruption). While the second condition of Definition 9 requires the expectation lower bound to hold for arbitrary ε, the definition is still meaningful when it holds only for restricted values of ε. Indeed, we will make use of it for exact decision problems in Section 7.3, where the only proximity parameter we consider is ε = 1/n; we call such properties decomposable (or partitionable) with respect to exact decision.
As we will see in the next sections, decomposable properties enable the construction of efficient proof of proximity protocols and generalise the notion of "parametrised concatenation properties" introduced by [46].

Boosting decompositions via amplitude amplification
As the next theorem shows, decomposable properties allow for quantum speedups regardless of whether they admit proximity-oblivious MAPs. Theorem 7.1. Let Π be a property that is (k, s)-decomposable into properties of m i -bit strings, and set m = max i∈ [k] {m i }. Suppose each bit of x (i) can be determined by reading b bits of the input string, and each Λ (i) admits a one-sided MAP with proximity parameter ε, query complexity q = q(m, ε) = m α /ε β and proof complexity p = p(m, ε). Then Π ∈ QCMAP(ε, s + kp, q ) , 17 We remark that the mappings Π → (Λ (1) , Λ (2) , . . . , Λ (k) ) and x → (x (1) , x (2) , . . . , x (k) ) are functions of the specification y ∈ S of the decomposition. Although the notation x (i),y and Λ (i),y is formally more accurate, the dependency on y will be clear from context and we omit it for ease of notation.
Before proceeding to the proof, we note that if the MAP protocols for the subproperties are proximity-oblivious, the query complexity can be improved (see Remark 5). Let us also summarise the proof strategy of [46], which we build upon and generalise.
Consider the special case where a property Π is k-partitionable and the strings x (i) are simply the substrings of x of length m = n/k which, concatenated, form x. Suppose, moreover, that the subproperties Λ (i) admit testers with query complexity q = m α /ε β and that Π is the union of Λ (1) × Λ (2) × · · · Λ (k) (over all strings in S). Note that while, in general, a specification must show how to obtain Λ (i) from Π and how to obtain x (i) from x, for an equipartition the latter is implicit.
A natural candidate for a (classical) MAP protocol for Π is to guess an index i ∈ [k] and run the tester for Λ (i) on x (i) . If x ∈ Π, then x (i) ∈ Λ (i) for i ∈ [k] and the tester always We now proceed to the proof of the general case, where the decomposition need not be a partition, and it suffices for the subproperties to admit a MAP (rather than a tester). Moreover, we show that quantum algorithms enable a speedup via amplitude amplification (but this requires the MAPs to be one-sided, unlike in the classical case).
Proof. Recall that we have a property Π that is (k, s)-decomposable by a collection of strings S ⊆ {0, 1} s , where each y ∈ S determines k properties Λ (i) ⊆ {0, 1} m i and a decomposition of x into k strings x (i) ∈ {0, 1} m i . Moreover, each Λ (i) admits a MAP with proof complexity p and query complexity m α /ε β . The verifier for Π executes the steps shown in Figure 3.
We note that a more naive strategy would succeed, albeit with a worse dependence on ε: choosing i ∈ [k] with probability proportional to m i yields a string x (i) which is ε/2-far from Λ (i) with probability at least ε/2, so that one could execute the MAP verifier for Λ (i) with proximity parameter ε/2 (and use amplitude amplification to achieve constant soundness by repeating this O(1/ √ ε) times). However, the technique of precision sampling [55] overcomes the issue of not knowing the distances ε i between x (i) and Λ (i) more economically: trying every proximity parameter 2 j with j ∈ [O(log 1/ε)], in the spirit of binary search, incurs a merely logarithmic overhead.
Completeness follows immediately: if x ∈ Π, then there exists a string y ∈ S such that x determines x (i) ∈ Λ (i) for all i ∈ [k]. Since the properties Λ (i) admit one-sided MAP protocols with proof complexity p, the procedure in Item 2(a) always accepts when given the proof string π = (y, π 1 , . . . , π k ), where π i is a valid proof for x (i) . Therefore, the verifier always accepts as well. Now, suppose x is ε-far from Π and the proof string π = (y, π 1 , . . . , π n ) is such that y ∈ S (since otherwise the verifier rejects immediately). Then, since Π is decomposable, x (i) is ε i -far from Λ (i) and E i←D [ε i ] = Ω(ε), where Λ (i) are the subproperties defined by y and D is the distribution over [k] that samples i with probability proportional to m i .
To show soundness, we will make use of the following (precision sampling) lemma.
1. Interpret the proof as a concatenation of a string y ∈ {0, 1} s with k strings π 1 , . . . , π k ∈ {0, 1} p . If y / ∈ S, i.e., y does not specify a decomposition, then reject.  . There exists j ∈ log 1 ε + 1 such that If the procedure in Item 2(a) samples i ∈ [k] such that ε i ≥ 2 −j , then it rejects with probability 2/3 (since the MAP has soundness 2/3). With j as ensured by Lemma 7, the probability it samples such an i ∈ [k] is Ω 2 j ε log 1/ε , so that the probability it rejects is 2 3 · Ω 2 j ε log 1/ε = Ω 2 j ε log 1/ε ; therefore, the algorithm M j obtained from Corollary 5 by O log 1/ε 2 j ε rounds of amplitude amplification rejects, causing the verifier to also reject, with probability 2/3. We now prove the stated upper bounds on the query complexity. For every j, each execution of the MAP verifier for Λ (i) makes q(m, 2 −j ) queries to x (i) , which translate into b · q(m, 2 −j ) queries to x (since each query to x (i) can be emulated with b queries to x). The total query complexity is therefore If q(m, ε) = m α /ε β with α > 0 and β ≥ 0, theñ If α = 0 and β > 0, we use the bound q(m, 2 −j ) ≤ m for all ε (from the trivial tester that queries the entire input) to obtain two upper bounds for the query complexity: the first is The second upper bound matches that obtained by the classical MAP, and is tighter when Finally, observe that, for testing with ε = 1/n (i.e., deciding exactly), one may take the MAPs for Λ (i) to be the trivial testers (with query complexity m and no proof). Moreover, it is unnecessary to iterate over j and apply Lemma 7; sampling i ∈ [k] uniformly and running the trivial tester requires bm queries to x and leads to a rejection with probability at least 1/k, since 1 k i∈ [k] ε i > 0 implies x (i) / ∈ Λ (i) for at least one i ∈ [k]. Therefore, applying O( √ k) rounds of amplitude amplification to this procedure ensures rejection of an x that is ε-far from Π with constant probability and yields query complexity O(bm √ k).
We finish this section with a corollary of Theorem 7.1 in the graph orientation model. A directed graph is called Eulerian if the in-degree of each of its vertices is equal to its out-degree. An orientation is a mapping from the edges to {0, 1}, representing whether each edge is oriented from i to j or from j to i, and the distance between two orientations is the fraction of edges whose orientation must be changed to transform one into the other. Let Π E be the property consisting of all Eulerian orientations of the complete bipartite graph K 2,n−2 , i.e., the graph with vertex set [n] and edge set {{i, j} : i ≤ 2, j ≥ 3}.
A MAP protocol for Π E parametrised by an integer k is constructed in [46]; its proof and query complexities are O(k · log n) andÕ(n/(εk)), respectively. That protocol is obtained by applying their (classical) version of Theorem 7.1 using the trivial tester for each of the subproperties. Using the same proof (and thus the same decomposition), and recalling that the trivial tester makes q(m, ε) = m queries for a sub-property of length m, we obtain Corollary 8. The property Π E has a one-sided QCMAP, with respect to proximity parameter ε, that uses a proof of length O(k · log n) and has query complexityÕ n k √ ε . Note that the query complexity of the classical MAP becomes linear with ε = Ω(1/k), whereas the QCMAP is able to decide exactly (i.e. test with ε = 1/n) with query complexity O(n 3/2 /k) (which is still sublinear whenever k = ω( √ n)). In particular, with k = n 3/4 , both query and communication complexities areÕ(n 3/4 ); see the Section 7.3 for further discussion and applications of Theorem 7.1 to exact decision problems.

k-monotonicity
In this section, we show that a generalisation of monotonicity of Boolean functions over the line [n] is efficiently testable by QCMAP protocols. A function f : This problem was studied in [20], where one-sided ε-testers for k-monotonicity on the line are shown to require Ω(k/ε) queries, while two-sided testers can achieve query complexityÕ(1/ε 7 ) (which, although a far worse dependence on ε than the lower bound, is independent of k).
In order to apply Theorem 7.1, we must only show that k-monotone functions are decomposable. Define Π k, [n] as the set of k-monotone Boolean functions on the line [n]. 18 Then, Theorem 7.2. For any k ∈ [n], the property Π k, [n] is succinctly k-decomposable.
Proof. Since a k-monotone function f has at most k − 1 critical points, where it changes from nondecreasing to nonincreasing or vice-versa, specifying these points yields a decomposition of f into (1-)monotone subfunctions.
More precisely, a string of length s ≤ (k − 1) log n determines a decomposition of the input f by specifying ≤ k − 1 integers 1 < n 1 < n 2 < · · · < n < n. Define n 0 = 1, n +1 = n, m i := n i − n i−1 + 1 and the function f i : [n] if and only if: It is clear that, when f ∈ Π k, [n] , there exists a set of ≤ k − 1 distinct integers in [2, n − 1] that satisfies both conditions. When f is ε-far from Π k, [n] , the sum of absolute distances ε i m i from each f i to Λ (i) is i ε i m i ≥ εn. Therefore, where D is the distribution over [ + 1] that has probability mass m i /( j∈[ +1] m j ) at point i. Finally, while this ensures ( + 1)-decomposability for some ≤ k − 1, one may deterministically transform it into a k-decomposition (and, in fact, a K-decomposition for any K ≥ ) by, for example, iteratively finding the largest interval and dividing it at its midpoint k − −1 times (with the requirement that nonincreasing functions in the large interval are monotone nonincreasing in both subintervals, and likewise for the nondecreasing case).
Since monotonicity on the line [m] is ε-testable with q(m, ε) = O(1/ε) queries [35, Proposition 1.5], applying (the second case of) Theorem 7.1 yields Corollary 1: a QCMAP protocol for k-monotonicity with proof complexity O(k log n) and query complexityÕ(1/ε) exists. (The theorem also gives an upper bound ofÕ( n/ε), which is no better:Õ(1/ε) is smaller up to ε ≈ 1/n, where the two bounds match.) It is worth noting that the standard monotonicity tester on the line is not proximityoblivious, unlike, e.g., on the Boolean hypercube, where both the "edge tester" [40] and the state-of-the-art [54] are proximity-oblivious; thus, one could not directly apply amplitude amplification, and must exploit decomposability via Theorem 7.1.
Note that the (one-sided) QCMAP for k-monotonicity is more efficient than any onesided tester, e.g., when k = Θ(log n) and ε = Θ(1/ log 2 n): then the QCMAP's proof and query complexities areÕ(log 2 n), whereas one-sided testers must make Ω(log 3 n) queries. Moreover, our QCMAP outperforms the best known two-sided tester of [20], which makes O(1/ε 7 ) queries, even with mild dependencies of the proximity parameter ε on n. Indeed, when ε = o(1/ log 1/7 n) and k = O(1), the tester's query complexity is superlogarithmic while the proof and query complexities of the QCMAP are logarithmic.
With the transformation from two-sided testers to one-sided MAPs of [46], it is also possible to compare our one-sided QCMAP against one-sided MAPs. From the aforementioned two-sided tester, one obtains a MAP with proof complexity polylog n and query complexity O(polylog(n/ε)/ε 7 ). Thus, the QCMAP remains advantageous except when k and ε are large (e.g., k = ω(polylog n) and ε = Ω(1)).

Exact problems
To conclude the discussion of decomposability and its consequences, we shift focus to a special case: that of testing n-bit strings with proximity parameter ε = 1/n. Since, for any Π ⊆ {0, 1} n and x ∈ {0, 1} n \ Π, the string x is at least 1/n-far from Π, this is the task of exactly deciding membership in Π.
Observe that for classical MAPs, nontrivial properties require Ω(n) queries in this case: even if a verifier receives as proof a claim x that is allegedly equal to its input string, it requires O(1/ε) = Ω(n) queries to check the validity of the claim. Remarkably, quantum algorithms are able to solve exact decision problems with sublinear queries (as illustrated by Grover's algorithm, which makes O( √ n) queries). Thus, as we show next, insights arising from decomposability are applicable to this setting. We begin by showing a nontrivial QCMA protocol for the parity of a bit string in Section 7.3.1, and then extend it to branching programs in Section 7.3.2.

Parity
Consider the problem of deciding if an n-bit string has even parity. This is clearly maximally hard, requiring Ω(n) queries even for interactive proofs with arbitrary communication, which we show next for completeness. Lemma 8. Any IP verifier that accepts strings of even parity and rejects strings of odd parity with probability 2/3 must make at least n/3 queries to its input.
Proof. Let V and P be a verifier and an honest prover for an IP for parity, and assume, towards contradiction, that the query complexity of V is less than n/3.
Fix an arbitrary input x ∈ {0, 1} n of even parity. Define S x as the random variable comprising all the coordinates queried by V in an execution V x , P (x) of the protocol, and let I ∈ [n] be a uniform random variable independent from S x . Then, since |S x | < n/3, Now, consider the execution of a protocol on input y ∈ {0, 1} n obtained by flipping the i th bit of x (i.e., such that y j = x j if j = i and y i = 1 − x i otherwise). LetP be a (malicious) prover that executes on y exactly as P does on x; that is, setP (y) = P (x). We thus have and, moreover, the following equalities between events hold: Therefore, contradicting the correctness of the protocol.
Rather surprisingly, however, there exists a quantum non-interactive protocol that exploits amplitude amplification and achieves sublinear query and communication complexities. This is a direct consequence of the following.
Proof. The set of strings that specify decompositions is S = y ∈ {0, 1} k : i∈[k] y i = 0 , i.e., the set of k-bit strings of even parity. A string y ∈ S specifies a decomposition where, for each i ∈ [k], the i th subproperty is Λ (i) = x (i) ∈ {0, 1} n/k : j∈[n/k] x (i) j = y i and x ∈ {0, 1} n induces x (i) as the substring of x consisting of the i th block of n/k bits, i.e.,

Bipartiteness in bounded-degree graphs
In the bounded-degree graph model, an algorithm is given query access to the adjacency list of a graph G whose vertices have their degree bounded by d = O(1). More precisely, given a vertex v and an index i ∈ [d], the oracle corresponds to the mapping (v, i) → w, where w is the i th neighbour of v (if it exists) or w = ⊥ (if v has fewer than i neighbours). The distance between two graphs is the fraction of pairs (v, i) whose outputs differ between the adjacency list mappings.
Our goal in this section will be to construct a QMAP protocol for testing whether a bounded-degree rapidly-mixing graph G (i.e., where the last vertex in a random walk of sufficiently large length = O(log n) starting from any vertex is distributed roughly uniformly), given as an adjacency list oracle, is bipartite or ε-far from every (rapidlymixing) bipartite graph. Note that this differs from the standard testing setting on graphs by the additional restriction that both yes-and no-inputs be rapidly mixing: whether G is bipartite or ε-far from bipartite, for any pair u, v of vertices, the length-random walk starting from u ends at v with probability between 1/(2n) and 2/n.
Our QMAP protocol for bipartiteness builds on the MAP protocol of [46, Theorem 7.1], modifying it to take full advantage of quantum speedups. In the strategy laid out in that work, the classical verifier receives as proof a set S of k vertices that are allegedly on the same side of a bipartition. It repeatedly samples a uniformly random vertex, takes many lazy random walks of length and, 19 for each of them, records if it stops at a vertex in S as well as the parity of the number of non-lazy steps (where the walk moves to another vertex). If two walks starting from the same vertex end in S with different parities, the verifier has found a witness to the fact that the graph is not bipartite and rejects.
For any proximity parameter ε and k ≤ n/2, the MAP protocol of [46] requires a proof of length k log n and makes O(ε −2 · n/k) queries. By making the verifier quantum (but using the same classical proof), we obtain improvements in the dependence on both n/k and ε: Theorem 8.1. For every k ≤ n/2, there exists a one-sided QCMAP for deciding whether an n-vertex bounded-degree graph G is bipartite or ε-far from being bipartite, under the promise that G is rapidly-mixing, with proof complexity k · log n and query complexitỹ O((n/k) 2/3 · ε −5/6 ).
Our strategy to obtain a quantum speedup uses the quantum collision-finding algorithm [7,8] to a suitable modification of the verifier strategy outlined above. 20 We note that the function f to which we will apply the collision-finding algorithm is not the adjacency list oracle, but one whose unitary representation can be obtained by adjacency list queries and classical computation. Theorem 8.2 (Quantum collision-finding [8,Theorem 9]). Let f : X → Y be a function given via a unitary oracle and R ⊆ Y × Y be a symmetric binary relation. There exists a quantum algorithm that makes O(|X| 2/3 polylog |Y |) queries to f , always accepts if (x, x ) / ∈ R for every distinct x, x ∈ X, and rejects with probability 2/3 if there exist distinct x, x ∈ X such that (x, x ) ∈ R. 19 A lazy random walk moves from a vertex v to a uniform random neighbour with probability dv 2d and otherwise stays at v, where dv is the degree of v and d = O(1) is the graph's degree bound. 20 We remark that collision-finding here refers to a generalisation of the element distinctness algorithm to symmetric relations beyond equality. In particular, it is not a quantum algorithm for the "r-to-1 collision problem", where (many) collisions are promised to exist.
Returning to the aforementioned classical MAP, observe that the information of each set of t random walks of length starting from a fixed vertex can be represented by a function f : T → {0, 1} 2 , where T ⊂ {0, 1} is composed of t strings of length = O( ) (note that each step of the random walk can be performed with O(1) bits, for a total of = O( ) random coins per walk) and f (r) encodes whether the walk reaches a vertex in S as well as its parity when its inner randomness corresponds to the string r. Now, applying the collision-finding algorithm to this function for each sampled vertex already yields a speedup [8]; but it can be improved by combining this strategy with amplitude amplification (which improves quadratically the number of samples taken as the starting vertices of the random walks), as we show next.
Proof of Theorem 8.1. We first consider the classical MAP outlined earlier when it samples a single starting vertex for a random walk, and apply collision-finding to the function f whose domain is T , a random (multi-)set of sequences of coin flips. The proof specifies a subset S ⊆ L of size k, for some L (allegedly) defining a bipartition V = L ∪ R of G with |L| ≥ |R|. The resulting algorithm (which is not yet the final QCMAP verifier), is shown in Figure 4.
Input: oracle access to the adjacency list of an n-vertex graph G, as well as explicit access to a proximity parameter ε > 0 and a proof string π ∈ {0, 1} k log n (representing a set S ⊂ V (G) of size k). 2. Let f : T → {0, 1} 2 be the function computed by the following subroutine: (a) Let r ∈ T be the input. Take the (lazy) random walk of length starting at v using r as the random bits. Let a ∈ {0, 1} be the indicator of whether the walk stops at a vertex in S and b ∈ {0, 1} be the parity of the walk (i.e., the number of non-lazy steps). Return (a, b).
3. Execute the algorithm of Theorem 8.2 with respect to f to find t and t such that f (t) = (a, b) and f (t ) = (a , b ) with a = a = 1 and b = b . Reject if such a pair is found, and accept otherwise. First, note that the function f contains a collision with respect to the relation R ⊂ {0, 1} 4 that comprises all pairs of pairs of the type ((1, b), (1, 1 − b)) if and only if there are two random walks of length that start from v end at a vertex in S with different parities.
If G is bipartite with vertex set L ∪ R and S ⊆ L, every path with both endpoints in S has even length. But the existence of two paths from the same vertex into S with different parities implies the existence of a path of odd length with both endpoints in S; therefore, since the function f does not contain a collision for any starting vertex v, the verifier always accepts when G is bipartite and the proof consists of k elements on the same side of a bipartition.
If G is ε-far from bipartite, then [46] (building on [38]) show the following: defining a as the indicator of whether a random walk of length = O(log n) starting from vertex v stops at a vertex in S, and b as the parity of this random walk, then an Ω(ε/ log n) fraction of vertices in V (G) are such that both P[a = 1, b = 0] and P[a = 1, b = 1] are Ω( kε n log n ). Therefore, with probability Ω(ε/ log n), the sampled vertex v ∈ V (G) satisfies this condition. If such a vertex was sampled, with probability Ω(1), in a sufficiently large number |T | = O( n log n kε ) of random walks starting from it there exists a pair of lengthwalks that end in S with different parities. Finally, since the algorithm of Theorem 8.2 rejects with constant probability if the function f contains a collision, the algorithm in Figure 4 rejects with probability Ω(ε/ log n).
The quantum collision-finding algorithm computes O(|T | 2/3 ) times the function f , each of which simulates a random walk of length = O(log n). Each step of the random walk requires O(1) queries to the graph G, so that O(log n) queries are made per walk. The query complexity of the algorithm in Figure 4 is therefore Finally, applying amplitude amplification (Theorem 6.1) to this algorithm (rather, more precisely, to a reversible quantum algorithm that is obtained from Figure 4 by deferring its measurements; see, e.g., [62]), we obtain a QCMAP verifier for bipartiteness of bounded-degree graphs with query complexitỹ We remark that classically testing bipartiteness in the bounded-degree model requires Ω( √ n) queries even under the rapidly-mixing promise, as shown by Goldreich and Ron [39]; therefore, for constant ε, a QCMAP with proof complexityÕ(n 1/4 ) is enough to overcome the testing lower bound, while the MAP of [46] requires a proof of lengthÕ( √ n). Of course, a fairer comparison would be to quantum testers, for whichÕ(n 1/3 ) queries suffice [7] but no nontrivial lower bound is known. The quantum tester is sound without the rapidly-mixing promise, however, so even though a QCMAP with proof lengthÕ( √ n) makes fewer queries than the best known quantum tester, it is not clear how the two algorithms compare.

Remark 6.
In the usual encoding of an oracle for an n-bit string x as a unitary |i |b → |i |b ⊕ x i , a Hamming distance of Θ(1) translates into Θ(1) distance in the Hilbert-Schmidt metric. Therefore, Theorem A.1 falls short of proving QMAP ⊆ QCMAP (where the omitted proof and query complexities are polylogarithmic, and the proximity parameter is constant).

B Interaction versus quantum proofs
In this section we compare the power of classical interactive proofs of proximity (IPPs) and non-interactive quantum proofs of proximity (QMAPs), and show that the rather well studied problem of permutation testing admits an efficient IPP but no efficient QMAP. In fact, for permutation testing, even an Arthur-Merlin Proof of Proximity is sufficient, as shown in [47]. Informally, an Arthur-Merlin Proof of Proximity (AMP) is a proof system with one round of communication where the verifier sends the first message.
Let Π P be the property (of functions f : [n] → [n]) defined as i.e., Π P is the set of all permutations. We note that in an oracle query to f , an algorithm sends x ∈ [n] and receives (the log n-bit string) f (x); accordingly, a quantum query maps (2 log n-qubit states via) |x |y → |x |y + f (x) . Moreover, distance is measured in terms of the fraction of inputs where functions disagree (rather than with respect to their representations as bit strings), i.e., f and g are ε-far when |{x ∈ [n] : f (x) = g(x)}|/n ≥ ε. The separation follows immediately from the two following theorems. Since AMP(ε, c, q, r) ⊆ IPP(ε, c, q, r + 1) (by initiating the protocol with a "dummy" message by the prover), the following corollary is immediate. Having established that Π P admits an efficient IPP, we must now show it is not efficiently testable by a QMAP: Lemma 9 ([73, Theorem 1.2]). Any QMAP protocol for testing Π P with respect to proximity parameter ε = Ω(1), using a proof of length p and making q queries, satisfies p · q 3 = Ω(n); i.e., Π P / ∈ QMAP(ε, p, q) when p · q 3 = o(n) .
Note that this implies that either p or q must be Ω(n 1/4 ) in any QMAP protocol for Π P . Finally, Theorem B.1 and Lemma 9 together imply the main result of this section.