Efficient Simulation of Random States and Random Unitaries Gorjan - - PowerPoint PPT Presentation

▶
efficient simulation of random states and random unitaries
SMART_READER_LITE
LIVE PREVIEW

Efficient Simulation of Random States and Random Unitaries Gorjan - - PowerPoint PPT Presentation

Jul 22, 2023 209 likes •849 views

Efficient Simulation of Random States and Random Unitaries Gorjan Alagic, Christian Majenz and Alexander Russell Eurocrypt 2020, in Cyberspace Results overview We study the simulation of random quantum objects , i.e. random states and

slide-1
SLIDE 1

Efficient Simulation of Random States and Random Unitaries

Gorjan Alagic, Christian Majenz and Alexander Russell

Eurocrypt 2020, in Cyberspace

slide-2
SLIDE 2

Results — overview

  • We study the simulation of random quantum objects, i.e. random states

and random unitary operations

  • We develop a theory of their stateful simulation, a quantum analogue of

Lazy sampling

  • For random states, we develop an efficient protocol for stateful simulation
  • For random unitaries, we devise a simulation method that runs in

polynomial space

  • As an application, we design a quantum money scheme that is

unconditionally unforgeable and untraceable.

slide-3
SLIDE 3

Introduction

slide-4
SLIDE 4

Randomness…

…is extremely useful. Applications:

  • All of cryptography
  • Monte Carlo simulation
  • Randomized algorithms
  • …
slide-5
SLIDE 5

Easy example: random string

Random element x ∈R {0,1}n

slide-6
SLIDE 6

Easy example: random string

Random element x ∈R {0,1}n Randomness cost Runtime limit distinguisher Exact No

n

slide-7
SLIDE 7

Easy example: random string

Random element x ∈R {0,1}n Randomness cost Runtime limit distinguisher Exact No Pseudorandom generator

n poly(λ) poly(λ)

slide-8
SLIDE 8

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

slide-9
SLIDE 9

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Runtime limit distinguisher Query limit distinguisher Exact No None None

n ⋅ 2m

f

slide-10
SLIDE 10

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Runtime limit distinguisher Query limit distinguisher Exact No None None

n ⋅ 2m

f runtime, memory

≤

slide-11
SLIDE 11

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Runtime limit distinguisher Query limit distinguisher Exact No None None

  • wise

independent function No None

n ⋅ 2m

f

t

O(t ⋅ n)

t

slide-12
SLIDE 12

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Runtime limit distinguisher Query limit distinguisher Exact No None None

  • wise

independent function No None Pseudorandom function No None

n ⋅ 2m

f

poly(λ) poly(λ)

t

O(t ⋅ n)

t

slide-13
SLIDE 13

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Runtime limit distinguisher Query limit distinguisher Exact No None None

  • wise

independent function No None Pseudorandom function No None “Lazy sampling” Yes None None

n ⋅ 2m

f

poly(λ) poly(λ)

t

O(t ⋅ n)

t

q ⋅ n

# of queries

slide-14
SLIDE 14

Quantum states and operations

slide-15
SLIDE 15

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere

slide-16
SLIDE 16

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

slide-17
SLIDE 17

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

slide-18
SLIDE 18

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

Really nice mathematical objects with a natural notion of a uniform distribution!

slide-19
SLIDE 19

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

Really nice mathematical objects with a natural notion of a uniform distribution! Haar measure

slide-20
SLIDE 20

Example application: Haar money

No-cloning principle: quantum information cannot be copied.

slide-21
SLIDE 21

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it!

slide-22
SLIDE 22

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n Haar money (JLS ’19):

slide-23
SLIDE 23

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Haar money (JLS ’19):

slide-24
SLIDE 24

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Haar money (JLS ’19):

slide-25
SLIDE 25

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Untraceable ✓ Haar money (JLS ’19):

slide-26
SLIDE 26

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19):

slide-27
SLIDE 27

Simulation of random quantum

  • bjects
slide-28
SLIDE 28

Can we sample a random quantum state?

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n

slide-29
SLIDE 29

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

∞

1 ↦ |ϕ⟩ Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n

slide-30
SLIDE 30

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None

∞

1 ↦ |ϕ⟩ Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) O (1/ε)

ε

slide-31
SLIDE 31

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None State -design efficient, stateless None

∞

1 ↦ |ϕ⟩

t

poly(n, t)

t

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) O (1/ε)

ε

slide-32
SLIDE 32

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None State -design efficient, stateless None

Pseudorandom quantum state (JLS ’19, BS ’20)

efficient, stateless None

∞

1 ↦ |ϕ⟩

poly(λ) poly(λ)

t

poly(n, t)

t

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) O (1/ε)

ε

slide-33
SLIDE 33

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None State -design efficient, stateless None

Pseudorandom quantum state (JLS ’19, BS ’20)

efficient, stateless None This work: quantum “lazy sampling” efficient, stateful None None

∞

1 ↦ |ϕ⟩

poly(λ) poly(λ)

t

poly(n, t)

t

poly(q, n)

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) O (1/ε)

ε

# of queries

slide-34
SLIDE 34

Can we simulate a random unitary?

Haar-random unitary U ∈ U(2n)

slide-35
SLIDE 35

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None Haar-random unitary U ∈ U(2n)

∞

O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-36
SLIDE 36

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None Unitary

  • design

efficient, stateless None

t

poly(n, t)

t

Haar-random unitary U ∈ U(2n)

∞

O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-37
SLIDE 37

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None Unitary

  • design

efficient, stateless None

Pseudorandom unitary??? (JLS ’19)

efficient, stateless None

poly(λ) poly(λ)

t

poly(n, t)

t

Haar-random unitary U ∈ U(2n)

∞

O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-38
SLIDE 38

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Runtime limit distinguisher Query limit distinguisher Exact inefficient, stateless None None

  • Net

inefficient, stateless None Unitary

  • design

efficient, stateless None

Pseudorandom unitary??? (JLS ’19)

efficient, stateless None This work space-efficient, stateful None None

poly(λ) poly(λ)

t

poly(n, t)

t

poly(q, n)

Haar-random unitary U ∈ U(2n)

# of queries

∞

O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-39
SLIDE 39

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it!

slide-40
SLIDE 40

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it!

slide-41
SLIDE 41

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it! Two options:

  • Use pseudorandom quantum state, computationally

secure untraceable quantum money (JLS ’19)

slide-42
SLIDE 42

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it! Two options:

  • Use pseudorandom quantum state, computationally

secure untraceable quantum money (JLS ’19)

  • Use stateful simulation, unconditionally secure

untraceable quantum money (AMR)

slide-43
SLIDE 43

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

slide-44
SLIDE 44

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

slide-45
SLIDE 45

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Also works for random states sampled according to different measures.

slide-46
SLIDE 46

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Statelessness implies query limit! Also works for random states sampled according to different measures.

slide-47
SLIDE 47

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Statelessness implies query limit! Also works for random states sampled according to different measures. Similar argument for unitaries.

slide-48
SLIDE 48

Techniques

slide-49
SLIDE 49

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.
slide-50
SLIDE 50

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

slide-51
SLIDE 51

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

  • 2. A random state and part of an entangled state look the same.
slide-52
SLIDE 52

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

  • 2. A random state and part of an entangled state look the same.

Deterministic

slide-53
SLIDE 53

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

  • 2. A random state and part of an entangled state look the same.

Random!

slide-54
SLIDE 54

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

  • 2. A random state and part of an entangled state look the same.

Random!

stateful oracle simulation without any randomness, just by maintaining entanglement with the distinguisher!

⇒

slide-55
SLIDE 55

Diving deep into quantum theory…

  • 1. Quantum theory is inherently probabilistic.

no need for an external source of randomness

⇒

  • 2. A random state and part of an entangled state look the same.

Random!

stateful oracle simulation without any randomness, just by maintaining entanglement with the distinguisher!

⇒

Fact: copies of a Haar random state look like a single Haar random state on the symmetric subspace

  • f

looks like half a maximally entangled state on

n Symd,n ℂd ⊗ ℂd ⊗ … ⊗ ℂd Symd,n ⊗ Symd,n

slide-56
SLIDE 56

Technical contributions

slide-57
SLIDE 57

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
slide-58
SLIDE 58

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

slide-59
SLIDE 59

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
slide-60
SLIDE 60

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
slide-61
SLIDE 61

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
  • Exact adaptive-to-nonadaptive reduction using “postselection”
slide-62
SLIDE 62

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
  • Exact adaptive-to-nonadaptive reduction using “postselection”
  • Uniqueness property of the Stinespring dilation
slide-63
SLIDE 63

Summary, open questions

Summary:

  • We develop a theory of stateful simulation of random quantum primitives.
  • Random quantum states can be approximately simulated efficiently using a stateful

algorithm

  • Random unitaries can be simulated exactly in a space-efficient using a stateful algorithm.
  • The random state simulator can be used to construct unconditionally secure untraceable

quantum money. Open questions:

  • Can we simulate random unitaries efficiently?
  • (From JLS ’19) Construct pseudorandom unitaries!