Verifiable cloud-based variational quantum algorithms

Abstract

Variational quantum algorithms (VQAs) have shown potential for quantum advantage with noisy intermediate-scale quantum (NISQ) devices for quantum machine learning (QML). However, given the high cost and limited availability of quantum resources, delegating VQAs via cloud networks is a more practical solution for a client with limited quantum capabilities. Recently, Shingu et al. proposed a variational secure cloud quantum computing protocol that leverages ancilla-driven quantum computation (ADQC) to perform cloud-based VQAs with minimal quantum resource consumption. However, their protocol lacks verifiability, which exposes it to potential malicious behaviors by the server. Additionally, channel loss requires frequent re-delegation as the size of the delegated variational circuit grows, complicating verification due to increased circuit complexity. This paper introduces a novel protocol that addresses these challenges by incorporating verifiability and increasing tolerance to channel loss while maintaining low quantum resource consumption for the server and requiring minimal quantum capabilities from the client.

1 Introduction

Quantum computation [1] has rapidly transitioned from theoretical speculation to practical application, leveraging the principles of quantum mechanics to tackle problems intractable for classical computers. Despite this progress, quantum resources remain scarce and costly, primarily accessible to large corporations. This limitation has spurred efforts to make quantum computation more accessible, especially for a client with limited quantum capabilities.

Blind quantum computation (BQC), a subset of delegated quantum computation (DQC), was first introduced by Childs [2]. It employs quantum one-time padding [3] in gate-based quantum computation (GBQC), enabling a client to delegate quantum computations while ensuring blindness, i.e., the client’s input, output, and algorithm remain hidden from the server. Building on this concept, Broadbent et al. [4] proposed the universal blind quantum computation (UBQC) protocol, also known as the BFK protocol. This protocol uses brickwork states as resource states within measurement-based quantum computation (MBQC) [5] on the server side, requiring the client only to prepare a set of qubits $\left\{\frac{1}{\sqrt{2}}(\ket{0}+exp(i\frac{k\pi}{4})\ket{1})\mid k\in\{0,1,\ldots,7\}\right\}$ while maintaining blindness. This protocol has spurred research in areas such as verification [6, 7, 8], the reduction of the client’s quantum capabilities  [9, 10, 11, 12, 13, 14, 15], joint computational tasks [16], and various applications, including Shor’s algorithm [17] and Grover’s algorithm [18]. Experimental demonstrations of BQC have also been conducted [19, 20].

In parallel, variational quantum algorithms (VQAs)[21] have emerged as a promising framework for leveraging noisy intermediate-scale quantum (NISQ) devices in quantum machine learning (QML)[22]. VQAs have demonstrated potential quantum advantages [23] in domains such as quantum federated learning (QFL)[24], quantum support vector machines (QSVMs)[25], and quantum reinforcement learning (QRL) [26].

Integrating VQAs with BQC provides a promising method for the client with limited quantum capabilities to delegate VQAs to a remote server via cloud networks securely. In previous work, Li et al. [27] combined the BFK protocol [4] with VQAs to implement delegated QFL. However, this approach requires significant quantum resources, with the server needing to entangle $w\cdot d$ qubits, where $w$ is the number of qubits required by the original NISQ algorithms and $d$ is the depth of the brickwork states [4] in the BFK protocol. Wang et al. [28] mitigated this by employing qubit reuse [29], lowering the server’s quantum resource consumption to $2w+1$ qubits.

Shingu et al.[30] further minimized the server’s quantum resource consumption while upholding the principles of BQC by proposing a variational secure cloud quantum computing protocol. This protocol leverages ancilla-driven quantum computation (ADQC)[31] and the no-signaling principle [9] to implement variational quantum algorithms (VQAs) securely. Their approach requires the server to use only $w+1$ qubits per operation. However, this protocol lacks verification and is vulnerable to potential malicious operations by the server. Additionally, it is not robust against channel loss, requiring frequent re-delegation as the size of the delegated variational circuit increases, complicating verification. This paper introduces a new protocol that extends their work by incorporating verifiability and increasing tolerance to channel loss while maintaining low quantum resource consumption for the server and requiring minimal quantum capabilities from the client.

The paper is organized as follows: Section 2 covers the preliminaries, including ADQC, VQAs, and a review of Shingu et al.’s protocol [30]. Section 3 describes the proposed protocol. Section 4 provides an analysis of the protocol, with a focus on verifiability, blindness, correctness, and comparisons with existing protocols. Finally, Section 5 concludes the paper by discussing potential extensions and suggesting directions for future research.

Figure 1: Circuit for the $J(\phi)$ operator: The prepared qubits are $\ket{\psi}_{R}$ and $\ket{+}_{A}$, where the subscripts $R$ and $A$ denote the register qubits and ancillary qubit, respectively. The highlighted section represents the measurement of the ancillary qubit $\ket{+}_{A}$ in the basis $\left\{\frac{1}{\sqrt{2}}(\ket{0}\pm exp(-i\phi)\ket{1})\right\}$. After measurement, the operation $X^{s}HR_{Z}(\phi)$ is obtained, where $X$ is the Pauli $X$ operator and $s$ is the measurement result.

2 Preliminaries

2.1 Ancilla-Driven Quantum Computation

Ancilla-driven quantum computation (ADQC) [31] is a hybrid model that integrates elements of MBQC and GBQC. In ADQC, an ancillary qubit $\ket{+}$ is coupled with a register qubit to implement a single-qubit operation $J(\phi)$:

$$J(\phi)=HR_{Z}(\phi),$$ (1)

where $\phi$ represents the designated rotation angle. Alternatively, it can be coupled with two register qubits to implement a controlled-Z gate using the fixed coupling operation $(H_{R}\otimes H_{A})CZ_{RA}$. Here, $CZ_{RA}$ denotes the controlled-Z gate between the register and ancillary qubits, with $H_{R}$ ($H_{A}$) representing the Hadamard gate applied to the register (ancillary) qubit. The ancillary qubit is then measured in a specific basis, consistent with MBQC, to ensure determinism, and the measurement outcome determines the evolution of the register qubit(s), as illustrated in Fig. 1 for $J(\phi)$ operator.

Ancillary qubits can be realized as optical photons in optical systems [32] and transmitted to distant locations after being coupled to the register qubits, enabling ADQC to be performed remotely by measuring the ancillary qubits in the basis:

$$M(-\phi)=\left\{\frac{1}{\sqrt{2}}(\ket{0}\pm exp(-i\phi)\ket{1})\right\}.$$ (2)

2.2 Variational quantum algorithms

Variational quantum algorithms (VQAs) utilize parameterized quantum gates, such as $R_{X}$, $R_{Y}$, and $R_{Z}$ [21], which rotate qubits around the x, y, and z axes of the Bloch sphere, respectively. The rotation angles in the variational circuit $\ket{\psi(\vec{\theta})}$ are optimized, where $\ket{\psi(\vec{\theta})}$ denotes a parameterized quantum state.

When incorporating classical data into VQAs, encoding techniques such as amplitude encoding [33] are used to transform the data into quantum states. The general structure of the circuit is illustrated in Fig. 2. VQA circuits can be conceptualized as quantum neural networks [34], where qubits serve as nodes, and quantum gates, represented by matrices, correspond to the weights of a neural network, directly influencing the qubit states.

Figure 2: General variational quantum circuit: All qubits are initialized in the state $\ket{0}$. The operator $En$ encodes classical data $\vec{x}$ into the quantum state $En(\vec{x})\ket{0}^{\otimes w}$. The unitary operator $U(\vec{\theta})=\prod_{i=1}^{n}U_{i}(\vec{\theta}^{i})$ represents the variational layers, forming a specifically designed ansatz, where each $U_{i}(\vec{\theta^{i}})$ corresponds to the $i$-th layer of the $n$ variational layers.

The variational parameters $\vec{\theta}=\left\{\theta_{1},\theta_{2},\ldots,\theta_{L}\right\}$, where $L$ denotes the total number of parameters, are iteratively updated and optimized by a classical optimizer, such as Adam [35], using measurement outcomes from the quantum circuit along with the cost function:

$$C(\vec{\theta}) =f(E(\vec{\theta}))$$ (3)

$$=f(\bra{\psi(\vec{\theta})}O\ket{\psi(\vec{\theta})}),$$

where $E(\vec{\theta})$ denotes the expectation value of the output state $\ket{\psi(\vec{\theta})}$ for a given set of parameters $\vec{\theta}$, and $O$ is the measurement observable. The function $f$ represents the objective function, such as mean squared error (MSE) or cross-entropy.

The parameters $\vec{\theta}=\left\{\theta_{j}\right\}_{j=1}^{L}$ are iteratively updated via gradient descent, such that $\vec{\theta}\leftarrow\vec{\theta}-\eta\nabla C(\vec{\theta})$, where $\eta$ denotes the learning rate. The gradients $\nabla C(\vec{\theta})=\left\{\frac{\partial C(\vec{\theta})}{\partial\theta_{j}}\right\}_{j=1}^{L}$ are computed using the parameter-shift rule [36]. Specifically, the gradient $\frac{\partial C(\vec{\theta})}{\partial\theta_{j}}$ is given by:

$$\frac{\partial C(\vec{\theta})}{\partial\theta_{j}} =\frac{\partial f(E(\vec{\theta}))}{\partial E(\vec{\theta})}\cdot\frac{\partial E(\vec{\theta})}{\partial\theta_{j}}$$ (4)

$$=\frac{1}{2}\frac{\partial f(E(\vec{\theta}))}{\partial E(\vec{\theta})}\cdot\left[E\left(\theta_{j+}\right)-E\left(\theta_{j-}\right)\right],$$

where $\theta_{j\pm}=\left\{\theta_{1},\ldots,\theta_{j}\pm\frac{\pi}{2},\ldots,\theta_{L}\right\}$.

2.3 Review of Shingu et al.’s Protocol

The variational secure cloud quantum computing protocol proposed by Shingu et al. employs the circuit depicted in Fig. 1 to perform single-qubit gates and necessitates additional gates to execute two-qubit controlled gates, as shown in Fig. 3.

Figure 3: Circuit for the two-qubit controlled gates: The server interacts with the client to obtain 6 $J(\phi)$ operators with parameters $\alpha$, $\beta$, $\gamma$, and $\delta$.

Specifically, a single-qubit gate $U$ is implemented using three consecutive $J(\phi)$ operators with $\phi_{1}$, $\phi_{2}$, and $\phi_{3}$, following Euler’s rotation theorem [37]. Here, $U=J(\phi_{1})J(\phi_{2})J(\phi_{3})$ and $HU=R_{Z}(\phi_{1})R_{X}(\phi_{2})R_{Z}(\phi_{3})$, where $\phi_{1}$, $\phi_{2}$, and $\phi_{3}$ are Euler angles. In contrast, a two-qubit controlled gate $CU$ is realized by decomposing it into multiple $J(\phi)$ operators to be delegated, along with additional $CZ$ gates, Hadamard ($H$) gates, the $S$ gate, and its conjugate transpose, the $S^{\dagger}$ gate, which are directly performed by the server, as shown in Fig. 3. The client receives and measures ancillary qubits sent by the server to evolve the register qubits according to ADQC. Subsequently, the server measures the output register qubits and sends the results to the client.

The protocol proceeds as follows:

A1(Preparation phase):

1. The server publicly announces the following: the number of original and variational quantum circuits for gradient calculations, $G$; the set of unitary operators $\{U^{(c)}_{AN}\}_{c=1}^{G}$, where $c$ denotes the $c$-th circuit; the set of measurement observables $\{\hat{A}_{1}^{(c)},\hat{A}_{2}^{(c)},\ldots,\hat{A}_{K^{(c)}}^{(c)}\}_{c=1}^{G}$, where $K^{(c)}$ is the number of observables measured in the $c$-th circuit; the number of circuit repetitions $\{\mathcal{R}^{(c)}\}_{c=1}^{G}$; the initial states $\{\ket{\psi_{out}^{(c)}(\vec{\theta}[0])}\}_{c=1}^{G}$, where $\vec{\theta}[0]$ indicates the initial parameters at the current iteration step; the number of variational parameters, $L$; and the total number of iteration steps for VQAs, $\mathcal{I}$.

2. The server prepares $w$ register qubits $\ket{0}_{R}$ and one ancillary qubit $\ket{+}_{A}$.

A2(Computation phase):

1. Adopt the quantum circuits $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ using the circuits depicted in Fig. 1 and Fig. 3 to generate the trial wave functions $\left\{\left|\psi^{(c)}(\vec{\theta}[1])\right\rangle\right\}_{c=1}^{G}$.

2. The server measures the output register qubits’ states with the measurement observables $\{\hat{A}^{(c)}_{1},\hat{A}^{(c)}_{2},\ldots,\hat{A}^{(c)}_{K^{(c)}}\}_{c=1}^{G}$ and sends the results to the client via classical communication.

3. The client compensates for the Pauli byproduct effect.

4. The server reprepares ancillary qubit $\ket{+}_{A}$.

A3(Parameters updating phase):

1. The server and the client repeat A2 $\{\mathcal{R}^{(c)}\}_{c=1}^{G}$ times to derive the expectation values of $\{\hat{A}^{(c)}_{1},\hat{A}^{(c)}_{2},\ldots,\hat{A}^{(c)}_{K^{(c)}}\}_{c=1}^{G}$.

2. The client updates the parameters using its optimizer according to Eq. 4, resulting in $\vec{\theta}[2]=(\theta_{1}[2],\ldots,\theta_{L}[2])^{T}$ for the next iteration.

3. The client computes the measurement angles for the circuits $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ using the parameters $\vec{\theta}[2]$.

4. The client and server reiterate the above steps $(\mathcal{I}-2)$ times with $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ and $\vec{\theta}[j]$. Based on the results from the $j$-th step, the client’s optimizer updates the parameters to $\vec{\theta}[j+1]$ for $j=2,3,\ldots,\mathcal{I}-1$.

This protocol enables the delegation of VQAs through interaction between the server and the client, requiring only $w$ register qubits and a single ancillary qubit. However, if any of the coupled ancillary qubits are lost during transmission, the circuit needs to be re-delegated, which results in a low tolerance to channel loss. Even the most efficient single-photon detectors in optics, which have shown 99% efficiency in recent studies [38, 39], are not immune to this issue. For sufficiently large circuits, the probability of re-delegation becomes significant. For example, consider a circuit where each block consists of an average of four single-qubit gates and one two-qubit control gate. A circuit with six blocks would require $4\times 3\times 6+1\times 6\times 6=108$ $J(\phi)$ operators. The probability of needing to re-delegate the circuit is approximately $(1-0.99^{108})\approx 66.22\%$ per delegated $J(\phi)$ operator, increasing exponentially with the number of $J(\phi)$ operators.

Due to channel loss, adding dummy gates for verification becomes impractical, as the circuit would require enough extra trap wires for dummy gates without affecting the wires used for computation. This increases the circuit size and leads to frequent circuit re-delegation. One potential solution to mitigate channel loss is to share Bell pairs between the server and the client, with repeated entanglement generation until successful [9]. However, during each delegation of the $J(\phi)$ operator, as illustrated in Fig. 1, the ancillary qubit is sent to the client for measurement after being coupled with the register qubit. Although the server can send one half of the Bell pair to the client for measurement, additional measurements on the remaining half are required on the server side after being coupled with the register qubit. However, the server cannot perform these measurements in the context of Fig. 1, where measurement on the ancillary qubit is performed by the client, rendering the use of Bell pairs ineffective in this context.

3 The Proposed Protocol

We adopt the strategy outlined in [40], where the server performs measurements after coupling the ancillary qubits with the register qubits, effectively addressing the limitations of using Bell pairs to tolerate channel loss in Shingu et al.’s protocol. The client is required to perform measurements in the bases $\left\{M(-\frac{k\pi}{4})\mid k\in\{0,1,\ldots,7\}\right\}$. For verification, we use trap qubits to create dummy gates in the trap wires as the circuit is transformed into the universal gate patterns shown in Fig. 4(a). Additionally, we delegate encrypted measurements of the output register qubits to the server, making it difficult to identify the trap wires in the circuits.

Figure 4: (a) The universal gate patterns: Composed of multiple blocks, each representing a gate pattern. (b) The gate pattern circuit: Consisting of 8 $J(\phi)$ operators and 2 $CZ$ gates. (c) Realization of the $J(\phi)$ operator: The server sends one half of a Bell pair to the client, who measures in the basis $M\left(-\frac{k\pi}{4}\right)$ with result $s_{0}$. The server then performs operations on the ancillary and register qubits, including a fixed coupling operation $(H_{R}\otimes I_{A})CX_{RA}$, where $CX$ denotes the controlled-X gate and $I$ is the identity gate, followed by measurements in the $Z$ basis or in the $M(\phi^{\prime})$ basis on the ancillary qubits with results $s_{1}$ to $s_{3}$.

The client delegates the $J(\phi)$ operators within the universal gate patterns shown in Fig. 4(a), while the server provides the $CZ$ gates. This process includes preparation, computation, verification, and parameter updating phases, as briefly illustrated in Fig. 5. The specific steps are as follows:

Figure 5: Brief process of the proposed protocol: The server sends an ancillary qubit, as one half of a Bell pair, to the client, who measures it in the basis $M(-\frac{k\pi}{4})$. The client then sends the reception status back to the server, requesting a resend if the qubit is lost. The server performs encrypted measurements as instructed by the client and returns the results, enabling the client to verify the server’s honesty and calculate encrypted measurement angles and gradients for the optimizer.

B1(Preparation phase):

1. The server publicly announces the following: the number of original and variant variational quantum circuits for gradient calculation, $G$; the set of transformed unitary operators, $\{U^{(c)}_{AN}\}_{c=1}^{G}$; the number of circuit repetitions, $\{\mathcal{R}^{(c)}\}_{c=1}^{G}$; the initial states, $\{\ket{\psi_{out}^{(c)}(\vec{\theta}[0])}\}_{c=1}^{G}$, for the $G$ circuits; the number of variational parameters, $L$; the total number of iteration steps for VQAs, $\mathcal{I}$; and the size of the transformed circuits, $\{N\times M\}_{c=1}^{G}$, where $N=3w$ and $M$ represent the number of input qubits and the circuit depth, respectively.

2. The server prepares $N$ register qubits $\ket{0}_{R}$, one ancillary qubit $\ket{+}_{A}$, one ancillary qubit $\ket{0}_{A}$ and two ancillary qubits $\frac{1}{\sqrt{2}}(\ket{00}_{A}+\ket{11}_{A})$ as a Bell pair. Meanwhile, the client chooses $2N/3$ register qubits as trap qubits for verification, which is optimal [6].

B2(Computation phase):

1. The server sends one qubit from the Bell pair to the client, who measures it in the basis $M\left(-\frac{k\pi}{4}\right)$, yielding the result $s_{0}$, where $k$ is randomly and uniformly selected from $\{0,1,\ldots,7\}$. The client generates a random bit recv_status to indicate the reception status, setting it to 0 if the qubit arrived successfully or to 1 if it was lost. This status is communicated to the server, who generates a new Bell pair and resends half of it to the client until the qubit arrives successfully. The other half of the Bell pair will eventually be in the state:

   $$Z^{s_{0}}R_{Z}\left(\frac{k\pi}{4}\right)\ket{+}_{A}=\frac{1}{\sqrt{2}}\left[\ket{0}_{A}+\exp\left(i\left(\frac{k}{4}+s_{0}\right)\pi\right)\ket{1}_{A}\right].$$ (5)

2. The server employs the transformed circuits $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ using the $J(\phi)$ operator, as depicted in Fig. 4(c), to generate the trial wave functions $\left\{\left|\psi^{(c)}(\vec{\theta}[1])\right\rangle\right\}_{c=1}^{G}$. In each delegation of the $J(\phi)$ operator, the $Z$ measurement results $s_{1}$ and $s_{2}$ are first sent to the client. The client then uses $s_{1}$ to compute the encrypted measurement angle:

   $$\phi^{\prime}=-\phi+(-1)^{s_{1}}\left(\frac{k}{4}+s_{0}\right)\pi+r\pi,$$ (6)

   where $r\in\{0,1\}$ is a random bit chosen by the client. This encrypted angle $\phi^{\prime}$ is sent to the server, which measures in the basis $M(\phi^{\prime})$. The resulting measurement outcome $s_{3}$ is then sent to the client. The actual measurement angle $\phi$ is adaptively chosen based on prior Pauli byproducts to ensure determinism in MBQC.

3. In each transformed circuit, $2N/3$ of the wires are randomly designated as trap wires, where dummy operations are implemented. On half of these trap wires, the identity gate is applied $M$ times on each wire. On the remaining trap wires, a single Hadamard gate is randomly inserted on each wire, while the identity gate occupies the other $M-1$ positions.

4. The server measures the output register qubits, each with Pauli byproducts $\{X^{x_{j}}\}_{j=1}^{N}$ and $\{Z^{z_{j}}\}_{j=1}^{N}$, in the $Z$ basis. To measure in the $X$ basis, the client applies an additional Hadamard gate at the end of the original circuit before measuring in the $X$ basis. This transformation can be expressed as:

   $$\begin{split}\braket{X_{R_{j}}}&=\sum_{m=0}^{1}\left(\bra{\Psi}_{R_{j}}Z^{x_{j}}X^{z_{j}}\right)H\ket{m}\bra{m}H\left(X^{z_{j}}Z^{x_{j}}\ket{\Psi}_{R_{j}}\right)\\ &=\sum_{m=0}^{1}\left(\bra{\Psi}_{R_{j}}Z^{x_{j}}X^{z_{j}}H\right)\ket{m}\bra{m}\left(HX^{z_{j}}Z^{x_{j}}\ket{\Psi}_{R_{j}}\right)\\ &=\sum_{m=0}^{1}\left(\bra{\Psi}_{R_{j}}HX^{x_{j}}Z^{z_{j}}\right)\ket{m}\bra{m}\left(Z^{z_{j}}X^{x_{j}}H\ket{\Psi}_{R_{j}}\right)\\ &=\braket{Z_{R_{j}}}.\end{split}$$ (7)

   where $\ket{\Psi}_{R_{j}}$ is the $j$-th output register qubit of $\ket{\Psi}_{R}$ for $j=1,\dots,N$. $\braket{X_{R_{j}}}$ is the expectation value of $X$ in the state $X^{z_{j}}Z^{x_{j}}\ket{\Psi}_{R_{j}}$, and $\braket{Z_{R_{j}}}$ is the expectation value of $Z$ in the state $X^{x_{j}}Z^{z_{j}}H\ket{\Psi}_{R_{j}}$.

5. The client compensates for the Pauli byproducts on all output register qubits by flipping the measurement results according to $\left\{x_{j}\right\}_{j=1}^{N}$ and $\left\{z_{j}\right\}_{j=1}^{N}$.

6. The server resets one ancillary qubit to $\ket{+}_{A}$, one to $\ket{0}_{A}$, and reprepares Bell pair $\frac{1}{\sqrt{2}}(\ket{00}_{A}+\ket{11}_{A})$.

B3(Verification phase):

1. At the end of B2-3, the output register qubits consist of non-trap qubits and trap qubits in a random permutation designed by the client. The output state can be written as:

   $$\ket{\Psi}_{R}=\sigma_{q}P\left(\ket{\psi}_{out}^{\frac{N}{3}}\otimes\ket{0}_{T}^{\frac{N}{3}}\otimes\ket{+}_{T}^{\frac{N}{3}}\right),$$ (8)

   where $\ket{\psi}_{out}$ represents the non-trap qubits, and $\sigma_{q}$ is the Pauli byproduct operator. The subscript $R$ includes both non-trap qubits ($out$) and trap qubits ($T$), with $P$ as the permutation.

2. The client instructs the server to measure all desired trap qubits, $\ket{0}_{T}^{\frac{N}{3}}$ in the $Z$ basis and $\ket{+}_{T}^{\frac{N}{3}}$ in the $X$ basis, in B2-4. If any undesired output $\ket{1}_{T}$ in the $Z$ basis or $\ket{-}_{T}$ in the $X$ basis is obtained after compensating for the Pauli byproduct effect, the protocol is terminated.

B4 (Parameters updating phase):

1. The server and the client repeat B2 to B3 $\{\mathcal{R}^{(c)}\}_{c=1}^{G}$ times to derive the expectation values of $Z$ or $X$ in each output register qubit.

2. The client utilizes its optimizer to update the parameters according to Eq. 4, resulting in $\vec{\theta}[2]=(\theta_{1}[2],\cdots,\theta_{L}[2])^{T}$ for the next step.

3. The client calculates the measurement angles for circuits $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ using $\vec{\theta}[2]$.

4. The client and server reiterate the above steps $(\mathcal{I}-2)$ times with $\{U^{(c)}_{\rm{AN}}\}_{c=1}^{G}$ and $\vec{\theta}[j]$. Based on the results from the $j$-th step, the client’s optimizer updates the parameters to $\vec{\theta}[j+1]$ for $j=2,3,\ldots,\mathcal{I}-1$.

4 Analysis

4.1 Verifiability

We use trap qubits to detect malicious operations on the output register qubits. The verifiability of the proposed protocol is demonstrated in Theorem I, which follows a method similar to that in [6], where further details can be found.

Theorem 1.

The probability of the client being tricked by the server is exponentially small.

Proof.

If the server is malicious, it may deviate from the state:

$$\rho=\sigma_{q}|\Psi\rangle_{R}\langle\Psi|_{R}\sigma^{\dagger}_{q}$$ (9)

to an arbitrary state. However, due to the completely positive trace preserving (CPTP) map [11], this deviation can be detected as a random Pauli attack.

Suppose $\sigma_{\alpha}$ represents a random Pauli attack, where the weight of $\sigma_{\alpha}$ ($|\alpha|$) is the number of non-trivial operators in $\sigma_{\alpha}$, such that $|\alpha|=a+b+c$, where $a$, $b$, and $c$ are the numbers of $X$, $Z$, and $XZ$ operators in $\sigma_{\alpha}$, respectively. We have $|\alpha|=a+b+c\leq 3\max(a,b,c)$. When these operators are applied to the output trap qubits $\ket{0}_{T}$ and $\ket{+}_{T}$, $X$ will only change $\ket{0}_{T}$ to $\ket{1}_{T}$, $Z$ will only change $\ket{+}_{T}$ to $\ket{-}_{T}$, and $XZ$ will change both $\ket{0}_{T}$ and $\ket{+}_{T}$ to $\ket{1}_{T}$ and $\ket{-}_{T}$, respectively.

We can calculate the probabilities that each operator in $\sigma_{\alpha}$ does not change any trap qubits. Suppose $\max(a,b,c)=a$. An $X$ operator that does not change any trap qubits will only act on $\ket{+}_{T}$ and non-trap qubits, the number of which is $2N/3$. Thus, the probability is:

$$\begin{split}\frac{C\left(\frac{2N}{3},a\right)}{C(N,a)}&=\left(\frac{2}{3}\right)^{a}\frac{\prod_{k=0}^{a-1}\left(N-\frac{3}{2}k\right)}{\prod_{k=0}^{a-1}(N-k)}\\ &\leq\left(\frac{2}{3}\right)^{a}\leq\left(\frac{2}{3}\right)^{\frac{|\alpha|}{3}}.\end{split}$$ (10)

Similarly, for $\max(a,b,c)=b$, the probability $\frac{C\left(\frac{2N}{3},b\right)}{C(N,b)}\leq\left(\frac{2}{3}\right)^{\frac{|\alpha|}{3}}$, and for $\max(a,b,c)=c$, the probability $\frac{C\left(\frac{N}{3},c\right)}{C(N,c)}\leq\left(\frac{1}{3}\right)^{\frac{|\alpha|}{3}}$ can be calculated in the same way.

The proposed protocol requires the client to send qubits, qubit reception statuses, and encrypted measurement angles, which seems to conflict with the no-signaling principle. However, the permutation $P$ is not transmitted, ensuring its secrecy. The server is only aware of measuring in the $Z$ basis, while the $X$ basis is implemented by delegating an additional Hadamard gate at the end of the original circuit. Consequently, the server cannot distinguish between trap and non-trap qubits, thereby further protecting $P$ without any leakage to the server.

After the client randomly selects a permutation $P$, the probability that $P^{\dagger}\sigma_{\alpha}P$ does not alter any trap qubits is at most $\left(\frac{2}{3}\right)^{\frac{|\alpha|}{3}}$. Consequently, the probability that the server deceives the client is at most:

$$\prod_{c=1}^{G}\left(\frac{2}{3}\right)^{\frac{\mathcal{R}^{(c)}|\alpha|}{3}}=\left(\frac{2}{3}\right)^{\frac{\sum_{c=1}^{G}\mathcal{R}^{(c)}|\alpha|}{3}},$$ (11)

where $G$ is the number of original and variant quantum circuits used to calculate gradients, and $\{\mathcal{R}^{(c)}\}_{c=1}^{G}$ is the set of circuit repetitions. This probability becomes exponentially small when $\sum_{c=1}^{G}\mathcal{R}^{(c)}$ is sufficiently large, ensuring the protocol’s verifiability.

∎

4.2 Blindness and Correctness

We utilize universal gate patterns in the proposed protocol to ensure both blindness and correctness during computation, with minimal information leakage. Specifically, only the size of the delegated circuit, corresponding to the size of the universal gate patterns, is revealed. The following theorems establish the blindness and correctness of the proposed protocol in the context of cloud-based VQAs.

Theorem 2.

The proposed protocol guarantees input, output, and algorithm blindness.

Proof.

Input Blindness: After the client measures one qubit of the Bell pair, the remaining qubit is left in a maximally mixed state:

$$\frac{1}{16}\sum_{s_{0}=0}^{1}\sum_{k=0}^{7}\left(Z^{s_{0}}R_{Z}\left(\frac{k\pi}{4}\right)\ket{+}_{A}\bra{+}_{A}R_{Z}^{\dagger}\left(\frac{k\pi}{4}\right)Z^{s_{0}\dagger}\right)=\frac{I}{2},$$ (12)

with the value of $k$ hidden from the server.

Output Blindness: After applying the $J(\phi)$ operator, the register qubit is $X^{s_{3}\oplus r}HR_{Z}(\phi)\ket{\psi}_{R}$. Upon completion of the delegated circuit, the output register qubits are $X^{x_{out}}Z^{z_{out}}U\ket{\Psi}_{R}$, where $X^{x_{out}}Z^{z_{out}}$ are Pauli byproducts. Since the server cannot determine $r$, it cannot compensate for $X^{s_{3}\oplus r}$, and therefore cannot compensate for $X^{x_{out}}Z^{z_{out}}$, leaving the output qubits in a maximally mixed state.

Algorithm Blindness: When the client sends the encrypted measurement angle $\phi^{\prime}=-\phi+(-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)+r\pi$ to the server, the true measurement angle $\phi$ remains concealed, as $k$ and $r$ are randomly chosen, and $s_{0}$ is never revealed.

Therefore, the server can only deduce the general structure of the universal gate patterns. ∎

Theorem 3.

The proposed protocol ensures correctness throughout the computation.

Proof.

In each gate pattern, as depicted in Fig. 4(b), the server directly applies the $CZ$ gate, while the $J(\phi)$ operator is implemented using the circuit shown in Fig. 4(c). This procedure results in the state $HR_{Z}(\phi)\ket{\psi}_{R}$ with Pauli byproducts. Further details on this mathematical derivation are provided in  A.

The client subsequently adjusts the measurement results provided by the server to account for these Pauli byproducts, ensuring the correct realization of $J(\phi)$ operators within the universal gate patterns. Each gate pattern is parameterized by $\{\phi_{i}\}_{i=0}^{7}$, enabling the implementation of arbitrary single-qubit gates. For example, the operation $U_{1}\otimes U_{2}$ can be achieved by setting $\phi_{5}=\phi_{7}=0$ while appropriately selecting the remaining parameters. Here, $U_{1}$ and $U_{2}$ denote arbitrary single-qubit gates, which can be decomposed as $U_{1}=R_{Z}(\phi_{0})R_{x}(\phi_{1})R_{Z}(\phi_{2})$ and $U_{2}=R_{Z}(\phi_{4})R_{x}(\phi_{5})R_{Z}(\phi_{6})$, following Euler’s rotation theorem [37]. Additionally, the $CX$ gate can be realized within this pattern by setting $\phi_{2}=\phi_{5}=\frac{\pi}{2}$ and $\phi_{7}=-\frac{\pi}{2}$, while setting the others to $0$.

Using these gates, any quantum gate in VQAs can be realized. Moreover, the delegated computation adheres to the rules of MBQC, where measurement angles are adaptively chosen to move all Pauli byproducts to the leftmost position, resulting in $X^{x_{\text{out}}}Z^{z_{\text{out}}}U\ket{\Psi}_{R}$. By appropriately correcting the measurement results, the client ultimately obtains the desired state $U\ket{\psi}_{\text{out}}$. ∎

Table 1: Comparison among different protocols for cloud-based VQAs

	Verifiable	Client’s quantum capabilities	Tolerance to channel loss	Server’s quantum resource consumption
Li et al.’s BFK-based protocol [27]	Yes	Prepare qubits	Yes	$6w\cdot d$
Wang et al.’s BFK-based protocol [28]	Yes	Measure qubits	Yes	$6w+1$
Shingu et al.’s protocol [30]	No	Measure qubits	No	$w+1$
The proposed protocol	Yes	Measure qubits	Yes	$3w+4$

4.3 Comparisons

Table 1 compares the proposed protocol with related protocols for cloud-based VQAs. Our protocol extends the method introduced by Shingu et al. [30] by incorporating verification and increasing tolerance to channel loss. Regarding the client’s quantum capabilities, our protocol requires only minimal quantum resource consumption; specifically, the client needs only to perform measurements in specific bases, which is significantly easier than preparing qubits in optical systems [9].

An additional advantage of our protocol is its improved tolerance to channel loss. In Shingu et al.’s protocol, the loss of any ancillary qubit during transmission necessitates the re-delegation of the entire circuit, which becomes particularly problematic for large circuits. In contrast, our protocol allows the server to perform encrypted measurements, thereby achieving tolerance by sharing Bell pairs between the server and client. While both Wang et al.’s [28] and Li et al.’s [27] BFK-based protocols also tolerate channel loss, Wang et al.’s protocol requires $6w\cdot d$ qubits with verification, and Li et al.’s protocol requires $6w+1$ qubits with verification, where $w$ is the number of qubits in the original NISQ algorithms and $d$ is the depth of the brickwork states in the BFK protocols. In contrast, our protocol, adapted from Shingu et al.’s approach, requires only $3w$ register qubits and four ancillary qubits. Although our protocol employs more qubits due to the added verification step, it still uses significantly fewer qubits than the BFK-based protocols.

5 Conclusion and Discussion

In this paper, we propose a protocol for cloud-based VQAs that extends the work of Shingu et al. by incorporating verifiability and increasing tolerance to channel loss. We have also demonstrated the protocol’s blindness and correctness, ensuring security and accuracy in cloud-based VQAs. Additionally, we compare the client’s quantum capabilities and the server’s resource consumption with those in Shingu et al.’s protocol and BFK-based protocols, demonstrating that our protocol maintains low quantum resource consumption for the server and minimal quantum capabilities for the client.

The proposed protocol can be further extended through two potential schemes. First, if the client possesses multiple photon detectors, the $J(\phi)$ operators can be performed on multiple register qubits in parallel, thereby accelerating the protocol’s runtime. However, this approach increases the server’s quantum resource consumption due to the preparation of additional ancillary qubits. Second, the protocol can be adapted for the client without quantum capabilities by employing the double-server blind quantum computation method [11], which is compatible with the proposed protocol.

Further research is necessary in several areas. Reducing communication costs while ensuring security remains a significant challenge. Additionally, exploring alternative verification methods to reduce quantum resource consumption further would be beneficial. Lastly, instead of directly transforming parameterized gate-based quantum circuits into MBQC patterns, adopting an MBQC-native approach [41, 42, 43] for VQAs could offer improved circuit depth reduction, making it suitable for adaptation to cloud-based VQAs. Our protocol has the potential to pave the way for real-world applications of cloud-based quantum computing.

Appendix A Derivation of $J(\phi)$ within Universal Gate Patterns

We analyze the operations within the circuit depicted in Fig. 4(c), involving three ancillary qubits and one register qubit $R=\ket{\psi}_{R}$. Let $A_{1}$, $A_{2}$, and $A_{3}$ represent the ancillary qubits. After the client measures one half of the Bell pair, yielding the result $s_{0}$, the ancillary qubits are prepared in the initial states:

$$A_{1}=Z^{s_{0}}R_{Z}\left(\frac{k\pi}{4}\right)\ket{+}_{A_{1}},\quad A_{2}=\ket{+}_{A_{2}},\quad A_{3}=\ket{0}_{A_{3}}.$$ (13)

Let $s_{1}$, $s_{2}$, and $s_{3}$ denote the measurement results of $A_{1}$, $A_{2}$, and $A_{3}$, respectively. The resulting operations on the register and ancillary qubits are:

$$\begin{split}&\bigl{[}H_{R}\otimes M_{A_{3}}(\phi^{\prime})\bigr{]}CX_{R{A_{3}}}\bigl{[}H_{R}\otimes M_{A_{2}}(Z)\bigr{]}CX_{R{A_{2}}}\bigl{[}H_{R}\otimes M_{A_{1}}(Z)\bigr{]}\\ &\quad CX_{R{A_{1}}}\left[\ket{\psi}_{R}\otimes Z^{s_{0}}R_{Z}\left(\frac{k\pi}{4}\right)\ket{+}_{A_{1}}\otimes\ket{+}_{A_{2}}\otimes\ket{0}_{A_{3}}\right]\\ &=\bigl{[}H_{R}\otimes M_{A_{3}}(\phi^{\prime})\bigr{]}CX_{R{A_{3}}}\bigl{[}H_{R}\otimes M_{A_{2}}(Z)\bigr{]}CX_{R{A_{2}}}\\ &\quad\Bigl{\{}\frac{1}{\sqrt{2}}\left[H_{R}R_{Z}\left(\frac{k\pi}{4}+s_{0}\pi\right)\ket{\psi}_{R}\otimes\ket{0}_{A_{1}}\right]\otimes\ket{+}_{A_{2}}\otimes\ket{0}_{A_{3}}+\\ &\quad\frac{1}{\sqrt{2}}\left[H_{R}R_{Z}\left(-\frac{k\pi}{4}-s_{0}\pi\right)\ket{\psi}_{R}\otimes\ket{1}_{A_{1}}\right]\otimes\ket{+}_{A_{2}}\otimes\ket{0}_{A_{3}}\Bigr{\}}.\end{split}$$ (14)

The measurement result $s_{1}$ of $A_{1}$ determines the $Z$-rotation angle for $\ket{\psi}_{R}$. We can simplify the above expression by omitting $A_{1}$:

$$\begin{split}&\left[H_{R}\otimes M_{A_{3}}(\phi^{\prime})\right]CX_{R{A_{3}}}\left[H_{R}\otimes M_{A_{2}}(Z)\right]CX_{R{A_{2}}}\\ &\quad\left[H_{R}R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)\right)\ket{\psi}_{R}\otimes\ket{+}_{A_{2}}\otimes\ket{0}_{A_{3}}\right]\\ &=\left[H_{R}\otimes M_{A_{3}}(\phi^{\prime})\right]CX_{R{A_{3}}}\left[I_{R}\otimes\left(M_{A_{2}}(Z)H_{A_{2}}\right)\right]CZ_{R{A_{2}}}\\ &\quad\left[R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)\right)\ket{\psi}_{R}\otimes\ket{0}_{A_{2}}\otimes\ket{0}_{A_{3}}\right].\end{split}$$ (15)

Since the $CZ$ operation does not entangle $\ket{0}_{A_{2}}$ with the register qubit, we can omit the operations on $A_{2}$. Thus, we obtain the following expression for the remaining qubits:

$$\begin{split}&\left[H_{R}\otimes M_{A_{3}}(\phi^{\prime})\right]CX_{R{A_{3}}}\\ &\quad\left[R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)\right)\ket{\psi}_{R}\otimes\ket{0}_{A_{3}}\right]\\ &=\frac{1}{\sqrt{2}}H_{R}R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)-\phi^{\prime}\right)\ket{\psi}_{R}\otimes\ket{0}_{A_{3}}+\\ &\quad\frac{1}{\sqrt{2}}XH_{R}R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)-\phi^{\prime}\right)\ket{\psi}_{R}\otimes\ket{1}_{A_{3}}.\end{split}$$ (16)

The measurement result $s_{3}$ of $A_{3}$ determines the state of $R$:

$$R=X^{s_{3}}H_{R}R_{Z}\left((-1)^{s_{1}}\left(\frac{k\pi}{4}+s_{0}\pi\right)-\phi^{\prime}\right)\ket{\psi}_{R}.$$ (17)

Applying Eq. 6, the above simplifies to:

$$\begin{split}R&=X^{s_{3}}H_{R}R_{Z}\left(\phi-r\pi\right)\ket{\psi}_{R}\\ &=X^{s_{3}\oplus r}H_{R}R_{Z}(\phi)\ket{\psi}_{R}.\end{split}$$ (18)

Thus, $J(\phi)$ is obtained with Pauli byproducts on the register qubit $R$.