1. Quantum Versus Classical Proofs and Advice Scott Aaronson Waterloo MIT Greg Kuperberg UC Davis | x {0,1} n ?

2. Can quantum proofs let us verify certain theorems exponentially faster than classical proofs? Yes (we think!) But to argue for the power of quantum proofs, well have to introduce a new kind of evidence: Quantum Oracle Separations (Its not just that we failed to find the old kind of evidencewe can tell you exactly why we failed)

3. QMA: Quantum Merlin-Arthur Class of problems for which a yes answer can be verified in quantum polynomial-time, with help from a polynomial-size quantum witness state Schrödingers Zoo QCMA: Quantum Classical Merlin-Arthur Same, except now the witness has to be classical BQP/qpoly: Class of problems solvable in quantum polynomial time, with help from a quantum advice state | n that depends only on the input length n BQP/poly: Same, except now advice has to be classical Closely related to quantum proofs is quantum advice…

4. BQP QCMA QMA BQP/poly BQP/qpoly PP PP/poly MAP/poly Surely it should at least be easy to separate these classes by oracles… Dream on!

5. Theorem: There exist quantum oracles U and V such that QMA U QCMA U and BQP V /qpoly BQP V /poly Quantum oracle: A sequence of unitary transformations {U n } that a quantum algorithm can apply in a black-box fashion Models subroutines that take quantum input and produce quantum output A new kind of evidence that two complexity classes are different Idea has already found other applications in quantum computing [A07] [MS07] This Talk: Quantum Oracle Separations

6. Choose an n-qubit state | uniformly at random Let U be the unitary that maps | |0 to | |1, and | |0 to | |0 whenever | =0 Problem: Given oracle access to U, decide whether (YES) U=U for some, or (NO) U=I is the identity transformation Clearly this problem is in QMA U (The witness: | itself) Claim: The problem is not in QCMA U The Oracle Problem Well Use

7. Intuition: Not much! Underlying Question: How much does an n k -bit classical hint help in searching for an unknown 2 n -dimensional unit vector? advice regions 2 n -dimensional unit sphere

8. Let be a probability measure over N-dimensional unit vectors Call p-uniform if it can be obtained by starting from the uniform measure, and then conditioning on an event that occurs with probability p Lemma: If is p-uniform, then for every fixed quantum state |, To prove the intuition, we need a geometric lemma…

9. Intuition: Best you can do is let be the uniform measure over the fraction p of states that are closest to | |

10. Theorem: Suppose were given oracle access to an n-qubit unitary U, and want to decide whether (i) U=I is the identity operator, or (ii) U=U for some secret marked state |. Then even if were given an m-bit classical witness in support of case (ii), we still need Lower Bound queries to U to verify the witness. Proof uses BBBV hybrid argument Quantum oracles relative to which QMA U QCMA U and BQP U /qpoly BQP U /poly now follow by standard arguments

11. Theorem: We can find an n-qubit marked state | using an m-bit classical hint, together with Almost-Matching Upper Bound queries to the quantum oracle U. (Provided m 2n) Idea: A mesh of 2 m states. Merlin tells Arthur the state closest to |, which Arthur then uses as a starting point for Grovers algorithm

12. But What About A Classical Oracle Separation Between QMA and QCMA? Weve had essentially one candidate problem for this: Group Non-Membership (Babai) Problem: Given a group G, a subgroup H G, and an element x G, is x H? Here G and H are specified as black-box groups I.e. every x G is labeled by a meaningless string s(x), and were given an oracle that maps s(x) and s(y) to s(xy) and s(x -1 )

13. Watrous (2000) showed how to solve GNM in QMA, using the state as a witness Group Non-Membership (as an oracle problem) is known to be in AM but outside MA Our result: Arthur can verify x H using (1) a polynomial-size classical witness from Merlin, and (2) polynomially many quantum queries to the group oracle (but possibly an exponential amount of computation) Conclusion: The Group Non-Membership problem cannot, alas, lead to an oracle separation between QMA and QCMA.

14. Idea: Pull the group out of the black box Explicit group Black-box group Isomorphism claimed by Merlin

15. Merlin gives Arthur an explicit group, together with a claimed isomorphism f: G (defined by its action on generators) Arthur checks that f is a homomorphism using the BCLR tester He checks that f is one-to-one by solving an instance of the Hidden Subgroup Problem (f is one-to-one kernel of f is trivial) Ettinger-Høyer-Knill: Hidden Subgroup Problem has polynomial quantum query complexity Once weve replaced G by an explicit group, no more queries to the group oracle are needed

16. Can we prove a classical oracle separation between QMA and QCMA? Bigger question: Whenever we prove a quantum oracle separation, can we also prove a classical one? Is Group Non-Membership in QCMA? (I.e. is the computational complexity polynomial, in addition to the query complexity?) Other quantum oracle separations? QMA vs. QMA(2) Open Problems