Quantum Pseudorandomness and Classical Complexity

Given the importance of pseudorandom states and unitaries across quantum complexity theory, cryptography, and physics, in this work we seek to better understand the theoretical basis for the existence of these primitives. We start with a very basic question: what hardness assumptions are necessary for the existence of PRSs,²²2Note that PRUs imply PRSs, so we focus only on PRSs for this part. and which unlikely complexity collapses (such as $\mathsf{P}=\mathsf{PSPACE}$ or $\mathsf{BQP}=\mathsf{QMA}$) would invalidate the security of PRSs? Viewed another way, we ask: what computational power suffices to distinguish PRSs from Haar-random states?

At first glance, it appears that an “obvious” upper bound on the power needed to break PRSs is $\mathsf{QMA}$, the quantum analogue of $\mathsf{NP}$ consisting of problems decidable by a polynomial-time quantum Merlin-Arthur protocol (or even $\mathsf{QCMA}$, where the witness is restricted to be classical). If Arthur holds many copies of a pure quantum state $|\psi\rangle$ that can be prepared by some polynomial-size quantum circuit $C$, then Merlin can send Arthur a classical description of $C$, and Arthur can verify via the swap test that the output of $C$ approximates $|\psi\rangle$. By contrast, most Haar-random states cannot even be approximated by small quantum circuits. So, in some sense, PRSs can be “distinguished” from Haar-random by quantum Merlin-Arthur adversaries.

There is a subtle problem here, though: $\mathsf{QMA}$ is defined as a set of decision problems where the inputs are classical bit strings, whereas an adversary against a PRS ensemble inherently operates on a quantum input. As a result, it is unclear whether the hardness of breaking PRSs can be related to the hardness of $\mathsf{QMA}$, or any other standard complexity class. Even if we had a proof that $\mathsf{BQP}=\mathsf{QMA}$, this might not give rise to an efficient algorithm for breaking the security of PRSs.

One way to tackle this is to consider quantum adversaries that can query a classical oracle. If we can show that PRSs can be broken by a polynomial-time quantum algorithm with oracle access to some language $\mathcal{L}:\{0,1\}^{*}\to\{0,1\}$, we conclude that if PRSs exist, then $\mathcal{L}\not\in\mathsf{BQP}$. A priori, it is not immediately obvious whether oracle access to any language $\mathcal{L}$ suffices for a polynomial-time quantum adversary to break PRSs. For our first result, we show that a $\mathsf{PP}$-complete language works. Hence, if $\mathsf{BQP}=\mathsf{PP}$, then PRSs do not exist.

This raises the natural question of whether the $\mathsf{PP}$ oracle in the above theorem can be made weaker. For instance, can we break PRSs with a $\mathsf{QCMA}$ or $\mathsf{QMA}$ oracle, coinciding with our intuition that the task is solvable by a quantum Merlin-Arthur protocol? In our second result, we show that this intuition is perhaps misguided, as we construct a quantum oracle relative to which such a $\mathsf{QMA}$ reduction is impossible.

In fact, our oracle $\mathcal{O}$ also satisfies $\mathsf{PromiseBQP}^{\mathcal{O}}=\mathsf{PromiseQMA}^{\mathcal{O}}$, which is stronger. For the sake of clarity, in this introduction we will only state our results in terms of classes of languages (e.g. $\mathsf{QMA}$) instead of classes of promise problems (e.g. $\mathsf{PromiseQMA}$), unless the distinction matters.

Let us remark how bizarre this theorem appears from a cryptographer’s point of view. If $\mathsf{BQP}=\mathsf{QMA}$, then no computationally-secure classical cryptographic primitives exist, because such primitives can be broken in $\mathsf{NP}$, which is contained in $\mathsf{QMA}$. So, our construction is a black-box separation between PRUs and all nontrivial quantum-secure classical cryptography—a relativized world in which any computationally-secure cryptography must use quantum communication. Theorem 2 thus provides a negative answer (in the quantum black box setting) to a question of Ji, Liu, and Song [JLS18] that asks if quantum-secure one-way functions are necessary for pseudorandom states.

Theorem 2 illustrates a stark contrast between quantum and classical cryptography, because the existence of hard problems in $\mathsf{NP}$ is necessary to have classical cryptography that is secure against polynomial-time adversaries. One can view our result as evidence that the same is not necessary for the existence of quantum cryptography; perhaps weaker assumptions suffice. Indeed, because a major goal in cryptography is to build cryptosystems from minimal computational assumptions, Theorem 2 has served as the primary motivation for many recent works that have built cryptography from pseudorandom states and unitaries [AQY22, MY22b, BCQ23, MY22a, HMY23]. Note that these works all appeared after this work was originally published [Kre21a].

An immediate corollary of our results is a new impossibility result for shadow tomography. Aaronson [Aar18] defined the shadow tomography problem as the following estimation task: given copies of an $n$-qubit mixed state $\rho$ and a list of two-outcome measurements $O_{1},\ldots,O_{M}$, estimate $\mathrm{Tr}(O_{i}\rho)$ for each $i$ up to additive error $\varepsilon$. Aaronson showed that, remarkably, this is possible using very few copies of $\rho$: just $\mathrm{poly}(n,\log M,\frac{1}{\varepsilon})$ copies suffice, which is polylogarithmic in both the dimension of $\rho$ and the number of quantities to be estimated.

Aaronson then asked in what cases shadow tomography can be made computationally efficient with respect to $n$ and $\log M$. Of course, just writing down the input to the problem would take $\Omega(4^{n}M)$ time if the measurements are given explicitly as Hermitian matrices, and listing the outputs would also take $\Omega(M)$ time. But perhaps one could hope for an algorithm that only operates implicitly on both the inputs and outputs. For example, suppose we stipulate the existence of a quantum algorithm that performs the measurement $O_{i}$ given input $i\in[M]$, and that this algorithm runs in time $\mathrm{poly}(n,\log M)$. Consider a shadow tomography procedure that takes a description of such an algorithm as input, and that outputs a quantum circuit $C$ such that $|C(i)-\mathrm{Tr}(O_{i}\rho)|\leq\varepsilon$ for each $i\in[M]$.³³3Note the slight abuse of notation here, as the shadow tomography procedure can err with some small probability, and $C$ itself might be a probabilistic quantum circuit. For simplicity, we assume that the shadow tomography procedure always succeeds and that $C$ is deterministic in this exposition. Aaronson calls this a “hyperefficient” shadow tomography protocol if it additionally runs in time $\mathrm{poly}(n,\log M,\frac{1}{\varepsilon})$.

Aaronson gave some evidence that hyperefficient shadow tomography is unlikely to exist, by observing that if hyperefficient shadow tomography is possible, then quantum advice can always be efficiently replaced by classical advice—in other words, $\mathsf{BQP/qpoly}=\mathsf{BQP/poly}$. However, Aaronson and Kuperberg [AK07] showed a quantum oracle $\mathcal{U}$ relative to which $\mathsf{BQP^{\mathcal{U}}/qpoly}\neq\mathsf{BQP^{\mathcal{U}}/poly}$, which implies that hyperefficient shadow tomography is impossible if the observables are merely given as a black box that implements the measurement. The proof of this oracle separation amounts to showing that if the oracle $\mathcal{U}$ either (1) implements a reflection about a Haar-random $n$-qubit state, or (2) acts as the identity, then no $\mathrm{poly}(n)$-query algorithm can distinguish these two cases, even given a classical witness of size $\mathrm{poly}(n)$.

One can consider stronger forms of query access to the observables. For instance, in the common scenario where each observable measures fidelity with a pure state, meaning it has the form $O_{i}=|\psi_{i}\rangle\langle\psi_{i}|$, then in addition to the ability to measure overlap with $|\psi_{i}\rangle$, one might also have the power to produce copies of $|\psi_{i}\rangle$. Note that the ability to prepare $|\psi_{i}\rangle$ is generally much more powerful than the ability to recognize $|\psi_{i}\rangle$, the latter of which is equivalent to oracle access to the reflection $I-2|\psi_{i}\rangle\langle\psi_{i}|$. For example, Aaronson and Kuperberg’s oracle separation of $\mathsf{QCMA}$ and $\mathsf{QMA}$ [AK07] amounts to building an oracle relative to which certain quantum states can be recognized efficiently but cannot be approximately prepared by small quantum circuits. Other black-box separations of state preparation and state reflection are known, e.g. [BR20], so one might hope that this type of query access could be substantially more powerful for shadow tomography as well.

Nevertheless, our results imply that black-box hyperefficient shadow tomography is impossible even in this setting where we have state preparation access to the observables. This follows from the simple observation that hyperefficient shadow tomography of this form would suffice to break PRS ensembles with a ($\mathsf{Promise}$)$\mathsf{QCMA}$ oracle.

The above theorem also relativizes, in the sense that if the shadow tomography procedure only accesses the state preparation algorithm via a black box $\mathcal{O}$, then hyperefficient shadow tomography lets us break PRSs in polynomial time with oracle access to $\mathcal{O}$ and $\mathsf{PromiseQCMA}^{\mathcal{O}}$. Since Theorem 2 gives an oracle relative to which $\mathsf{PromiseBQP}^{\mathcal{O}}=\mathsf{PromiseQCMA}^{\mathcal{O}}=\mathsf{PromiseQMA}^{\mathcal{O}}$ and PRSs exist, we conclude that hyperefficient shadow tomography is impossible with only black-box state preparation access to the observables.

We briefly summarize the proof techniques used in our main results.

Can we prove a similar result to Theorem 2 using a classical oracle, for either PRUs or PRSs? Attempting to resolve this question seems to run into many of the same difficulties that arise in constructing a classical oracle separation between $\mathsf{QCMA}$ and $\mathsf{QMA}$, which also remains an open problem [AK07]. For one, as pointed out in [AK07], we do not even know whether every $n$-qubit unitary transformation can be approximately implemented in $\mathrm{poly}(n)$ time relative to some classical oracle—this is sometimes known as the unitary synthesis problem [Aar16, Ros21, LMW24]. Even if one could resolve this, it is not clear whether the resulting PRUs or PRSs would be secure against adversaries with the power of $\mathsf{QMA}$. For instance, we show in Appendix A that an existing construction of PRSs, whose security is provable in the random oracle model [BS19], can be broken with an $\mathsf{NP}$ oracle. Nevertheless, recent work by Kretschmer, Qian, Sinha, and Tal [KQST23] makes progress on this question by constructing an oracle relative to which $\mathsf{P}=\mathsf{NP}$ and a weaker version of pseudorandom states (with only single-copy security) exist.

What else can be said about the hardness of learning quantum states and unitary transformations, either in the worst case or on average? A related question is to explore the hardness of problems involving quantum meta-complexity: that is, problems that themselves encode computational complexity or difficulty. Consider, for example, a version of the minimum circuit size problem ($\mathsf{MCSP}$) for quantum states: given copies of a pure quantum state $|\psi\rangle$, determine the size of the smallest quantum circuit that approximately outputs $|\psi\rangle$. If PRSs exist, then this task should be hard, but placing an upper bound on the complexity of this task might be difficult in light of our results. We view this problem as particularly intriguing because it does not appear to have an obvious classical analogue, and also because of its relevance to the wormhole growth paradox and Susskind’s Complexity=Volume conjecture in AdS/CFT [BFV20, Sus16b, Sus16a]. A number of recent breakthroughs in complexity theory have involved ideas from meta-complexity (see surveys by Allender [All17, All20] or Lu and Oliveira [LO22]), and it would be interesting to see which of these techniques could be ported to the quantum setting.

What other complexity-theoretic evidence can be given for the existence of PRSs and PRUs? Can we give candidate constructions of PRSs or PRUs that do not rely on the assumption $\mathsf{BQP}\neq\mathsf{QMA}$? To give a specific example, an interesting question is whether polynomial-size quantum circuits with random local gates form PRUs. Random circuits are known to information-theoretically approximate the Haar measure in the sense that they form approximate unitary designs [BHH16b], and it seems conceivable that they could also be computationally pseudorandom.

This paper improves upon the earlier conference version [Kre21a] in two major ways. First, the section on $t$-designs (Section 3) is a new addition. Second, the oracle $\mathcal{O}=(\mathcal{U},\mathcal{C})$ that we use to collapse $\mathsf{PromiseQMA}^{\mathcal{U},\mathcal{C}}$ to $\mathsf{PromiseBQP}^{\mathcal{U},\mathcal{C}}$ is different. In both versions, the quantum part $\mathcal{U}$ is the same. However, the conference version claimed that the classical oracle $\mathcal{C}$ could be any $\mathsf{PSPACE}$-complete language. By contrast, in this paper $\mathcal{C}$ is a specific recursively-constructed language. The reason for this change is an error that was discovered in the proof. We discuss this error, along with the prospects of restoring the original oracle construction, in Section 5.4.

Throughout, $[n]$ denotes the set of integers $\{1,2,\ldots,n\}$. If $x\in\{0,1\}^{n}$ is a binary string, then $|x|$ denotes the length of $x$, and $\operatorname{wt}(x)$ denotes its Hamming weight. For $X$ a finite set, we let $|X|$ denote the size of $X$. If $X$ is a probability distribution, then we use $x\sim X$ to denote a random variable $x$ sampled according to $X$. When $X$ is a finite set, we also use $x\sim X$ to indicate a random variable $x$ drawn uniformly from $X$. A function $f(n)$ is negligible if for every constant $c>0$, $f(n)\leq\frac{1}{n^{c}}$ for all sufficiently large $n$. We use $\mathrm{negl}(n)$ to denote an arbitrary negligible function, and $\mathrm{poly}(n)$ to denote an arbitrary polynomially-bounded function.

We require two basic facts about probability. The first regards the optimality of the Bayes decision rule, which is a strategy for guessing a random variable $X$ from posterior information $Y$. The Bayes decision rule is to always guess the value of $X$ that maximizes the posterior probability given $Y$. The Bayes decision rule is optimal, in the sense that any other strategy that guesses $X$ using $Y$ errs at least as often as the Bayes decision rule. We only need the following special case of this fact, which also applies more generally (see [Ber13, Chapter 4.4.1] for further discussion).

The other fact we need is the Borel–Cantelli lemma for sequences of probabilistic events. It gives a criterion under which at most finitely many of the events occur, with probability $1$.

We let $\mathrm{TD}(\rho,\sigma)$ denote the trace distance between density matrices $\rho$ and $\sigma$. For a matrix $M$ we use $||M||_{F}\coloneqq\sqrt{\mathrm{Tr}\left(M^{\dagger}M\right)}$ to denote its Frobenius norm.

When $A$ and $B$ are Hermitian matrices, we use $A\preceq B$ to denote the semidefinite ordering, i.e. that $B-A$ is positive semidefinite. We extend this notation to superoperators $A$ and $B$: $A\preceq B$ denotes that $B-A$ is completely positive. A superoperator $\Lambda$ is said to be completely positive if, for any identity superoperator $I$ and positive semidefinite matrix $\rho$, $(\Lambda\otimes I)(\rho)$ is positive semidefinite. If $\Lambda$ has input dimension $N$, a criterion equivalent to complete positivity is

where $I_{N}$ is the $N$-dimensional identity channel, and $|\Phi_{N}\rangle\coloneqq\frac{1}{\sqrt{N}}\sum_{i=1}^{N}|i\rangle|i\rangle$ is the standard maximally entangled state of dimension $N\times N$ [BHH16b].

For a unitary matrix $U$, we use $U\cdot U^{\dagger}$ to denote the superoperator that maps a density matrix $\rho$ to $U\rho U^{\dagger}$. In a slight abuse of notation, if $\mathcal{A}$ denotes a quantum algorithm (which may consist of unitary gates, measurements, oracle queries, and initialization of ancilla qubits), then we also use $\mathcal{A}$ to denote the superoperator corresponding to the action of $\mathcal{A}$ on input density matrices.

We let $\left|\left|\mathcal{A}\right|\right|_{\diamond}$ denote the diamond norm [AKN98] of a superoperator $\mathcal{A}$ acting on density matrices, which is defined by

where $I$ denotes the identity superoperator acting on a space of the same dimension as $\mathcal{A}$. Intuitively, the diamond norm gives an analogue of trace distance for channels: the distance between two channels in the diamond norm captures the maximum bias by which those two channels can be distinguished. In particular, we have the following:

We use the following formula for the distance between unitary superoperators in the diamond norm.

A consequence of 8 is the following well-known bound relating distance in diamond norm to the Frobenius norm for unitary channels. We provide a proof for completeness.

We use $\mathbb{S}(N)$ to denote the set of $N$-dimensional pure quantum states, and $\mathbb{U}(N)$ to denote the group of $N\times N$ unitary matrices. When $N=2^{n}$, we identify these with $n$-qubit states and unitary transformations, respectively. We use $\sigma_{N}$ to denote the Haar measure on $\mathbb{S}(N)$, and we let $\mu_{N}$ denote the Haar measure over $\mathbb{U}(N)$. We write $\mathbb{U}(N)^{M}$ for the space of $MN\times MN$ block-diagonal unitary matrices, where each block has size $N\times N$, and we also identify $\mathbb{U}(N)^{M}$ with $M$-tuples of $N\times N$ unitary matrices. We use $\mu_{N}^{M}$ to denote the product measure $\mu_{N}^{M}(U_{1},U_{2},\ldots,U_{M})\coloneqq\mu_{N}(U_{1})\cdot\mu_{N}(U_{2})\cdots\mu_{N}(U_{M})$ on $\mathbb{U}(N)^{M}$, which we interpret as a distribution over a direct sum $U_{1}\oplus U_{2}\oplus\ldots\oplus U_{M}$ of matrices.

We require the following concentration inequality on the Haar measure, which is stated in terms of Lipschitz continuous functions. For a metric space $\mathcal{M}$ with metric $d$, a function $f:\mathcal{M}\to\mathbb{R}$ is $L$-Lipschitz if for all $x,y\in\mathcal{M}$, $|f(x)-f(y)|\leq L\cdot d(x,y)$.

A language is a function $L:\{0,1\}^{*}\to\{0,1\}$. A promise problem is a function $\Pi:\{0,1\}^{*}\to\{0,1,\bot\}$. The domain of a promise problem $\Pi$, denoted $\mathrm{Dom}(\Pi)$, is

We assume familiarity with standard complexity classes such as $\mathsf{BQP}$ and $\mathsf{PP}$. For completeness, we define some complexity classes used prominently in this work.

Note: we will sometimes call any algorithm of the form $\mathcal{V}(x,|\psi\rangle)$ a $\mathsf{QMA}$ verifier, even if it does not satisfy the promise of a $\mathsf{QMA}$ language.