8/9/2019 qcmip

1/10

Simulating MIP(2,1) protocols by MIP (3,1) , and IP protocols byMIP (2,1)

Hirotada Kobayashi and Keiji Matsumoto

February 25, 2008

1 IntroductionWe simulate classical interactive proof systems by the ones with the quantum provers and the classical verier.Here, quantum provers may share an arbitrary entangled state. Especially, we simulate (1) 1-round 2-provers MIPproof systems by 1-round 3-quantum provers MIP* proof systems, and (2) polynomial-rounds IP proof systems with1-round 2-quantum provers MIP* proof systems.

2 Notations and conventions

jjthe dierence of probability distributions jj1 means the total variation (statistical distance). P i : the ith prover.( i = 1 ; 2; :), V : the verier.

P i : the private space of ith prover. V : V s private space. : the initial state of Ni P i .

3 Simulating polynomial round classical single prover by 2-quantumprover

3.1 AssertionTheorem 1 Suppose there is a classical single prover, r-rounds interactive proof system which accepts a language L with the probability pc and ps for completeness side and soundness side, respectively. Suppose also that the probability distribution for the th and 0th round question are mutually independent. Based on such a protocol, we can construct a classical protocol for a proof system with two quantum provers such that the acceptance probability for the completeness side is pc , and the acceptance probability for the soundness pqcc is upperbounded as follows.

pqcs 1 1 ps5 (r 1)

2

:

Here, the provers may share an arbitrary entangled state.

3.2 A protocolSuppose that in a classical protocol, the verier asks question q ( = 1 ; ; r) and the prover replies a at thround ( = 1 ; ; r ). The set of questions q := q 1q 2 q r is denoted by Q . A corresponding 2-quantum proverprotocol is described as follows.

(1) The verier generates q , according to the distribution p(q 1 ; q 2 ; ; q r ) = Qr =1 p (q ). The verier asks q =q 1q 2 q r to P 1 , and q r 0 := q 1 q r 0 to P 2 . where r 0 2 f1; r 1g is chosen randomly.(2) P 1 and P 2 sends a1 a r and a 0r 0 := a

01 a0r 0 to the verier, respectively.

1

8/9/2019 qcmip

2/10

(3) The verier checks the consistency of the answers. If the consistency is checked, he proceeds to the vericationprocedure of the classical IP protocol.

3.3 Proof of the theorem1Obviously, the acceptance probability of the protocol for the completeness side cannot be smaller than the classicalprotocol, since the provers can only do classical operations, generating a depending only on q . Hence, we belowdiscuss only the soundness side, where the dishonest provers can increase the probability of acceptance.

If the provers are dishonest, in general, the state of P 1 P 2 can be an entangled state. Each prover performsa local measurement, whose composition depends on q and q r 0 respectively, and sends its measurement result, aand a 0r 0 , respectively, to the verier. (Composition of unitary operations, measurements, and computations areencapsulated in a measurement.) Since our protocol is single round, we are only interested in the statistics of eachmeasurement, which is encapsulated in a POVM. We denote by fM qa g the POVM of the measurement by P 1 . Here,subscript indicates the measurement result corresponding to each operator, and the composition of the measurementdepends on the question from the verier indicated as the superscript. Hence, Pa M qa = 1 . Similarly, we denote byn ~M q r 0a r 0 o the POVM by P 2 , and Pa r 0 ~M q r 0a r 0 = 1 .Let q = q 1 q 2 q r be an elements of Q . The way to choose q will be discussed later, but for a while,we chooseit randomly according to the same distribution as q .

Let us dene M qa := M q1 q q +1 q ra and denote by M qa the marginal of M qa on a = a1 a . We dene

the following CP maps: q

a ( ) := p M q

a p M q

a , q

a ( ) := qM q

a qM q

a , ~q

a ( ) := q ~M

q

a q ~M

q

a . We alsodeneqa := Xa 1 qa :

Note that qa is not the marginal of qa . Note also that qa and qa depends on q +1 q r , though we do not

write explicitly.By c (r 0), we denote the probability that the answer from the two provers are consistent conditioned that the

particular value of r 0 is chosen. c is the average probability of consistency, and c = 1r 1 Prr 0 =1 c (r 0).Our strategy is to show qa q ra r q 2a 2 q 1a 1 , or (6). This means that P 1 is forced to generate a dependingonly on q . First we show the key inequalities used in the proof. Below, E means the expectation.Lemma 2 We have following inequalities:

Eqq Xa +q +a + ~qa q

+a + I ( ) 1 3p 1 c ( ) ; (1)

Eqq Xa + qa ~qa I ~qa ( ) 1 3p 1 c ( ) : (2)Eqq Xa I ~qa qa I ( ) 1 6p 1 c ( ) ; (3)

Eqq Xa qa ~q 1a 1 qa ~q 1a 1 ( ) 1 = 1 c ( 1) (4)Its proof will be presented in the appendix B. Here, we show intuitive discussion which suggests these inequalities.A key observation is as follows. If a particular measurement result occurs with certainty, the quantum state

cannot be changed by the measurement. In our case, by convention, suppose P 1 does his measurement rst. Then,the perfect coincidence means that P 2s measurement cannot demolish the state after the measurement by P 1 . Byreplacing the order of the measurement, we also have that P 1s measurement cannot demolish the post measurementstate by P 2 . Since the coincidence has to occur only with high probability, non-demolishment has to be true onlyapproximately, and goodness of this approximation should be increasing in 1 c . Thus, the inequalities (1)-(3).

(3) follows from the inequalities (1)-(3) and the triangle inequality. Note also, for a 0 1 6= a 1 , we haveq 1 qa

0

1 a ~q 1

a 1 0;since the coincidence occurs with high probability. Hence the inequality (4) has to be true.Combination of (1)-(4) leads to the following lemma.

2

8/9/2019 qcmip

3/10

Lemma 3Eqq Xa qa qa q 1a 1 I ( ) 1 10p 1 c ( 1) :

Proof.

Eqq Xa qa I qa q 1a 1 I ( ) 1 Eqq Xa

qa I

q

a ~q 1a 1 ( ) 1 + E qq Xa

q

a ~q 1a 1

q

aq 1a 1 I ( ) 1 (5)

The rst term of the RHS of (5) is evaluated as follows.

Eqq Xa qa I qa ~q 1a 1 ( ) 1 Eqq Xa qa ~q 1a 1 qa ~q 1a 1 ( ) 1 + E qq Xa qa I qa ~q 1a 1 ( ) 1 (1 c ( 1)) + 3p 1 c ( 1) 4p 1 c ( 1);where the inequality in the third line is due to the identity (4) and the inequality (1). The second term of (5) is,

using the lemma10, upperbounded by

Eqq Xa I ~q 1a 1 q 1a 1 I ( ) 1 6p 1 c ( 1) ;where the inequality is due to (3).

We had almost proven the theorem. The rest of the task is to concatenate the lemma3 and to show the existenceof good choice of q . First, we have

Eqq Xa qa q ra r q 2a 2 q 1a 1 I ( ) 1 Eqq

r 1

Xr 0 =1

Xa

q ra r

q r 0 +2a r 0 +2

q r 0 +1a r 0 +1

q ra r

q r 0 +2a r 0 +2

q r 0 +1a r 0 +1

q r 0a r 0

I ( ) 1

Eqqr 1

Xr 0 =1 Xa 1 a r 0 +1 q r 0 +1a r 0 +1 q r 0 +1a r 0 +1 q r 0a r 0 I ( ) 1r 1

Xr 0 =1 10p 1 c (r 0) 10 (r 1) p 1 c :

The inequality in the third line is due to the lemma10, the inequality in the fourth line is due to the lemma3, andthe last inequality is due to convexity of p . Since this is true for the average over all q , there at least is a particularpair of q with

Eq

Xa

qa

q ra r

q 2a 2

q 1a 1 I ( ) 1

10 (r 1) p 1 c : (6)

Therefore, if x =2 L, the input is accepted with the probability not larger than

c max(1; ps + 12Eq Xa qa q ra r q 2a 2 q 1a 1 I ( ) 1)= c max 1; ps + 5 ( r 1) p 1 c

1 1 ps5 (r 1)

2

:

3

8/9/2019 qcmip

4/10

3.4 Correlated sequence of questionsSo far, we have assumed that the probability distribution for q and q 0 are independent, since it is sucient toaccept PSPACE. However, it may be interesting to simulate simulate correlated sequence of questions by singleround protocol. Indeed, it turns out to be possible, and the proof of the validity of the protocol is easier.

(1) The verier generates q , according to the distribution p(q 1 ; q 2 ; ; q r ), and choose r0 2 f1; r 1g uniformlyrandomly. The verier asks q r 0 := q 1 q r 0 to P 2 , and ips a coin. With probability 12 , he asks P 1 either q r 0or q r 0 +1 , respectively.

(2) P 1 and P 2 reply.

(3) The verier checks the consistency of the answers. If the verier had asked q r to P 1 , after checking theconsistency, he proceeds to the verication procedure of the classical IP protocol.

Theorem 4 Suppose there is a classical single prover, r-rounds interactive proof system which accepts a language L with the probability pc and ps for completeness side and soundness side, respectively. Also, we assume that the question to the questions are generated non-adaptively, i.e., all the questions q 1 , q 2 , , q r 0 are generated before the protocol starts. Based on such a protocol, we can construct a classical protocol for a proof system with two quantum provers such that the acceptance probability for the completeness side is

pqcc = pc + 2 ( r 1) 1

2 (r 1) = 1

1 pc

2 (r 1);

and the acceptance probability for the soundness pqcc is upperbounded as follows.

pqcs 1 12

1 pc6 (r 1)

2

:

Here, the provers may share an arbitrary entangled state.

pqcc is trivial. Hence, we analyze pqcs .If the provers are dishonest, in general, the state of P 1 P 2 can be an entangled state. Each prover performs alocal measurement, whose composition depends on the questions from the verier, and send back the measurement

result. In this section, we denote by M qa and

n ~M qa

othe POVM of the measurement by P 1 and P 2 when

the question is q . M qa ( ) is the marginal of M

qa on a = a1 a . We dene the following CP maps:

qa ( ) := qM qa qM qa , ~qa ( ) := q ~M qa q ~M qa , qa := Pa +1 a r qa Let us denote by c ( ; ) theprobability of the consistency when q and q is send to P 1 and P 2 , respectively.

The evaluation of the performance of this protocol is indeed easier than the previous one, where we had toconstruct q 1a 1 , ,

q r 1a r 1 from the real provers action qa . In this protocol, qa is real.

Lemma 5

Eq Xa qa ~q 1a 1 qa I ( ) 1 3p 1 c ( ; 1) ; (7)Eq Xa qa ~qa qa I ( ) 1 3p 1 c ( ; ) ; (8)Eq Xa

qa ~qa I ~qa ( ) 1 3p 1 c ( ; ) ; (9)Eq Xa I ~qa qa I ( ) 1 6p 1 c ( ; ) ; (10)

Eq Xa qa ~q 1a 1 qa ~q 1a 1 ( ) 1 = 1 c ( ; 1) (11)The proof of this is similar to the inequalities (1)-(4). Using these inequalities, we have the following lemma.

4

8/9/2019 qcmip

5/10

Lemma 6

Eq Xa qa qa q 1a 1 I ( ) 1 6p 1 c ( ; 1) + 6p 1 c ( 1; 1):Proof.

Eq

Xa

qa I

qa

q 1a 1

I ( )1

Eq Xa qa I qa ~q 1a 1 ( ) 1 + E q Xa qa ~q 1a 1 qa q 1a 1 I ( ) 1 (12)The rst term of the RHS of (12) is evaluated as follows.

Eq Xa qa I qa ~q 1a 1 ( ) 1 Eq Xa qa ~q 1a 1 qa ~q 1a 1 ( ) 1 + E q Xa qa I qa ~q 1a 1 ( ) 1 (1 c ( ; 1)) + 3p 1 c ( ; 1) 4p

1 c ( ; 1);

where the inequality in the third line is due to the identity (11) and the inequality (7). The second term of (12) is,using the lemma10, upperbounded by

Eq Xa I ~q 1a 1 q 1a 1 I ( ) 1 6p 1 c ( 1; 1) ;where the inequality is due to (10).

We had almost proven the theorem. The rest of the task is to concatenate the lemma 6. First, we have

Eq Xa qa q ra r q 2a 2 q 1a 1 I ( ) 1 Eq

r 1

Xr 0 =1 Xaq ra r

q r 0 +2a r 0 +2

q r 0 +1a r 0 +1 q ra r

q r 0 +2a r 0 +2

q r 0 +1a r 0 +1

q r 0a r 0

I ( ) 1

Eqr 1

Xr 0 =1 Xa 1 a r 0 +1 q r 0 +1a r 0 +1 q r 0 +1a r 0 +1 q r 0a r 0 I ( ) 1r 1

Xr 0 =1 6p 1 c (r 0 + 1 ; r 0) + 6p 1 c (r 0 ; r 0) 12 (r 1) p 1 c :Therefore, if x =2 L, the input is accepted with the probability not larger than

1 1

2 (r 1)c +

1

2 (r 1)

max

(1; ps +

1

2

Eq

Xa

qa

q ra r

q 2a 2

q 1a 1 I ( ) 1

)1 12 (r 1) c + 12 (r 1) max 1; ps + 6 ( r 1) p 1 c 1 1

12 (r 1)

1 p6 (r 1)

2

1 12

1 p6 (r 1)

2

5

8/9/2019 qcmip

6/10

4 Simulating classical 2-classical-prover proof system by 3-quantum-prover proof system

4.1 AssertionTheorem 7 Suppose there is a classical two provers one round interactive proof system which accepts a language L with the probability pc and ps for completeness side and soundness side, respectively. Based on this protocol, we can construct a classical protocol for three quantum provers with unlimited entanglement such that the acceptance probability for the completeness side is pc , and the acceptance probability for the soundness pqcc is upperbounded as follows:

pqcs 1 1 ps

6max fjQ 1j; jQ 2jg2

:

Corollary 8 NP MIP (3; 1; 1; 1 1polynomial ), NEXP MIP (3; 1; 1; 1 1exp( cn ) ).

4.2 A protocolSuppose that the verier asks q 1 2 Q 1 and q 2 2 Q 2 to the rst and the second prover respectively, in a given thissymmetrized classical proof system. Our quantum protocol with classical messages is as follows.(1) The verier ask q 1

2Q 1 and q 2

2Q 2 to P 1 and P 2 , respectively. With probability 12 , he asks P 3 either q

1

2Q 1

or q 2 2Q 2 . The joint probability distribution of q 1 , q 2 is denoted by p(q 1 ; q 2), and its marginal distributionsare denoted by p1(q 1) and p2(q 2).(2) P 1 and P 2 performs the measurement nM q 1a oa 2 A 1 andnN q 2a oa 2 A 2 , and send the measurement result a1 2 A 1

and a2 2A 2 to the verier. Meantime, P 3 performs nfM q 1a oa 2 A 1 (neN

;q 2a oa 2 A 2 ), in case that the question fromthe verier is an element of Q 1( Q 2 , respectively). He sends the measurement result a3to the verier.

(3) The verier checks the relation a1 = a3 ( a2 = a3), in case that the veriers question is an element of Q 1(Q 2 ,respectively).

4.3 Some more denitions

12 := tr P 3

qa ( ) := p M qa p M qa , ~qa ( ) := p ~M qa p ~M qa , q := Pa qa qa ( ) := p N qa p N qa , ~qa ( ) := p ~N qa p ~N qa , q := Pqa qa 1c (q ) := Pa trM qa 1 fM

qa , 2c (q ) := Pa tr1 N qa eN

qa

c := 12 Pq1 2 Q 1 p1 q 1 1c q 1 + 12 Pq2 2 Q 2 p2 q 2 1c q 24.4 Proof of the theoremLemma 9

q I 12 12 1 6p 11c (q ); (13)

I q 12 12 1 6p 1 1c (q ) (14)Proof. We only prove the rst one. By monotonicity of the trace distance,

q I 12 12 1 q I I ( ) I I ~q ( ) 1 :Using the same argument as the proof of the inequality (3), we have (13).

6

8/9/2019 qcmip

7/10

Observe that

q 0 q q 00 q 000 12 121

q0

q q00

q000 12 q 0 q 00 q 000 12

1

+ q0

q00

q000 12 I q

00q

000 121

+ I q00 q 000 12 I q

00 121

+ I q00 12 12

1q I 12 12 1 +

q 0 I 12 121

+ I q000 12 12

1+ I q

00 12 12

6p 1 1c (q ) + 6p 1 1c (q 0) + 6p 1 2c (q 00) + 6p 1 2c (q 000); (15)where the last inequality is due to (13).

Suppose that, prior to the protocol starts, the provers had measure their quantum state by a sequence of measurements

1

Y= jQ 1 j

q 11

Y= jQ 2 j

q 2 ;

and reply to the veriers question obeying this measurement outcome. Obviously, with such a strategy, the proverscannot cheat the verier beyond the classical limit. Below, we show that any provers starategy can be approximatedby such an imaginary strategy in terms of the joint probability distribution of a1

0, a2

0for all 0 and 0 .

The joint probability distribution of a10, a2

0of the imaginary strategy is

Xa tr1

Y= jQ 1 j q 1a 1

Y= jQ 2 j q 2a 12 = tr q 1 0a 01

Y= 0 1 q 1 q 2 0a 01

Y= 0 1 q 2 12 :where the sum in the LHS is taken for variables a1 , and a2 with 6= 0 , 6= 0 . We are interested in the dierence( 0 ; 0) between this and the real probability distribution tr

q 10

a 0

q 20

a 012 .

( 0 ; 0) = Xa 0 ;a 0 tr q1

0a 0

1

Y= 0 1 q 1 q 2 0a 01

Y= 0 1 q 2 12 tr q 1 0a 0 q 2 0a 0 121

Y= 0 1 q 11

Y= 0 1 q 2 12 12 1 6

0 1

X=1 p 1 1c (q 1 ) + 60 1

X=1 q1 2c q 2where the inequality in the last line is due to (15).

7

8/9/2019 qcmip

8/10

Therefore, if pi (q i1) pi (q i2) pi (q ijQ i j) (this can be assumed without loss of generality),

X0 ; 0 p(q 1 0 ; q 2 0 ) ( 0 ; 0) 6

jQ 1 j

X0 =1 p1(q 1 0 )0 1

X=1 p 1 1c (q 1 ) + 6jQ 2 j

X0 =1 p2(q 2 0 )0 1

X=1 q1 2c q 2= 6

jQ 1 j

X=1jQ 1 j

X0 = +1 p1(q 1 0 )p 1 1c (q 1 ) + 6jQ 2 j

X=1jQ 2 j

X0 = +1 p2(q 2 0 )q1 2c q 2 6

jQ 1 j

X=1 jQ 1j p1(q 1 )p 1 1c (q 1 ) + 6jQ 2 j

X=1 jQ 2j p2(q 2 )q1 2c q 2 12 max fjQ 1j; jQ 2jg0@

12

jQ 1 j

X=1 p1(q 1 )p 1 1c (q 1 ) + 12jQ 2 j

X=1 p2(q 2 )q1 2c q 2 1A 12 max fjQ 1j; jQ 2jgv uu

t

12

jQ 1 j

X=1 p1(q 1 ) (1 1c (q 1 )) + 12jQ 2 j

X=1 p2(q 2 ) 2c q 2= 12max fjQ 1j; jQ 2jgp 1 c

Suppose that there is a classical protocol which accepts the language L with the probability pc and ps for com-pleteness side and soundness side, respectively. Based on this protocol, our modied quantum protocol with classicalmessage will accept L with the probability pc . The acceptance probability for the soundness pqcs is upperboundedas follows:

pqcs c min241; ps + 12 X0 ; 0 p(q 1 0 ; q 2 0 ) ( 0 ; 0)35

c min 1; ps + 6 max fjQ 1j; jQ 2jgp 1 c

1 1 ps

6max fjQ 1j; jQ 2jg2

:

To see this, let y = p 1 c and see how the functionf (y) = (1 y2)( ps + 6 y max fjQ 1j; jQ 2jg) ;

behaves in the interval [0; 1]. At y = 0 ; f (0) = pc 1, f 0(0) > 0. f 0(y) stays positive until y reaches y , and thenf 0(y) turns to negative, and in the end, f (1) = 0 : Meantime, pc + 6 y max fjQ 1j; jQ 2jg is monotone increasing, andreaches f (y) = 1 at y = y := 1 p s6 max fj Q 1 j; jQ 2 jg . Observe y is smaller than y . Therefore, the upperbound to pqcccequals f (y) in the interval [0; y ] and equals 1 y2 in the interval [y ; 1], which takes maximum at y = y , andwe have the upperbound presented above.

References[1] A. Winter, "Coding Theorems of Quantum Information Theory," doctoral thesis, quant-ph/9907077 (1999)

A Some useful factsLemma 10 Let f a g be an instrument, i.e., a is a CP map and Pa a is trance preserving. Then,Xa k a (X ) a (Y )k1 kX Y k1

8

8/9/2019 qcmip

9/10

Proof. Observe that an instrument can be viewed as a CPTP map from a state to a pair of classical informationsand states. In other words, the map

X ! Ma a (X )is a CPTP map. Therefore,

Xa k

a (X ) a (Y )

k1 =

Xa

Ma

a (X )

Ma

a (Y )1

kX Y k1 :

Lemma 11 (Lemma 1.4, winter ) Let be a state, X be a positive operator with X 1 . Then, we have p X p X

1 3p 1 tr X

Letting := La a and X := La X a , we have the following lemma.Lemma 12 Let X a and a be a positive Hermitian matrices with

Pa X a 1 and

Pa tr a = 1 . Then,

Xa a p X a ap X a 1 3s 1 Xa tr X a aB Proof of the lemma 2In the proof or the following lemma, we repeatedly use the following argument. Since q and q obey the sameprobability distribution and the probability distribution of q and q 0 are independent, we have

Eqq Xa + tr q +a + ~qa ( ) = E qq Xa + tr q + q + +1 q ra + ~qa ( )= E qq

Xa +

tr M q + q + +1 q ra + ~M qa

= E q Xa + tr M qa + ~M qa= E q Xa tr M qa ~M qa= c ( ) : (16)

Proof. We use the lemma 12. Let a + :=q +a + I ( ) and X a + := I ~M qa , and we obtain

Xa + q +a + ~qa q +a + I ( ) 1 3s 1 Xa + tr I ~M qa q +a + I ( )= 3s 1 Xa + tr

q +a + ~

qa ( );

Since p is concave, taking the average both side, we have the inequality (1). The inequality (2) is proved almostanalogously. Let a + := I ~

qa + ( ) and X a := M

qa I , and we obtain

Eqq Xa q +a + ~qa I ~qa ( ) 1 3s 1 Eqq Xa tr q +a + ~qa ( );9

8/9/2019 qcmip

10/10

which is nothing but our second inequality. The inequalities (1)-(2), with the help of the triangle inequality, leadsto (3).

The identity (4) is proved as follows. Since qa 1 ( ) qa 1 ( ) due to the denition of qa ,Eqq Xa qa ~q 1a 1 qa ~q 1a 1 ( ) 1 = E qq Xa ntr qa ~q 1a 1 ( ) tr qa ~q 1a 1 ( )o

= 1 Eqq tr qa ~q 1a 1 ( ) :

Combining this identity with the identity (16), we have (4).

10