A classical client can check quantum work and keep its output
The Entire Quantum Computer on a Classical Leash · arXiv:2610.31775
In plain words
A classical client may want a quantum server to run a private computation, but checking the answer can destroy the quantum state needed for a sample or another computation.
The paper gives a protocol where the client sends classical messages to check a record of the computation while preserving the state. Assuming a standard hardness condition, the authors prove it can verify samples from a quantum circuit with only negligible additional verification error. The guarantee also allows the server to abort.
The research
A classical client may need a quantum server’s sample or quantum output for another computation, but ordinary checking can consume the state. Can the client verify the server’s work through classical messages and still keep that state available, even if the server may be malicious?
The authors combine state-preserving checks, encrypted circuit evaluation, and authenticated memory into a classical-communication protocol for quantum computation.
The client and server use state-preserving tests on a committed record of the computation, then recover the required classical and quantum outputs. Encrypted circuit evaluation hides the client’s computation, while authentication lets its quantum memory persist across later computations.
The authors prove that sampling verification adds only negligible computational distinguishing error, separate from the circuit’s approximation error. They also prove remote state preparation for sender-chosen, efficiently preparable states.
The main security guarantee is ε-simulation: for each inverse-polynomial ε, a simulator can achieve error ε with running time polynomial in 1/ε. The detailed construction is for real circuits and assumes an honest-but-curious classical client; the authors describe generic upgrades for these limits.
What the evidence shows
- A state worth preserving
The paper introduces a two-party protocol for secure quantum computation between a classical client and a quantum server. The client communicates classically, can keep its circuit private, and receives designated classical outputs; designated quantum outputs stay with the server.
The central question is how the client can verify a computation when the output state must remain available for sampling or further use.
- Test the computation record
The protocol’s answer begins with an input-preserving computation: the client privately evaluates a classical function on the server’s quantum input, receives the measured result, and the protocol returns the corresponding residual state to the server.
For a public circuit, the server commits to a history state that records successive computation states and a clock. The client tests local consistency conditions on that committed record, then opens the clock to recover the required output while the server recovers the prescribed quantum output.
- Keep the state bound
Repeated tests only help if the server remains bound to the same evolving state. The authors use continual binding so the commitment remains defined after measurement queries, and show how the server can recover the committed state after testing.
To hide the client’s circuit, the protocol has the server evaluate an encrypted description. To retain private memory across computations, the client authenticates the stored state and checks it during the next computation.
- Two proven capabilities
The security theorem supports two distinct applications. For sampling from a prescribed quantum circuit, the authors prove that classical verification adds only negligible computational distinguishing error; this is separate from any approximation error in the circuit’s distribution.
For remote state preparation, a sender’s private description selects an efficiently preparable real-circuit state, and replacing one quantum message in an efficiently falsifiable game incurs negligible loss in an adversary’s maximum winning probability.
- Read the guarantee narrowly
The result depends on post-quantum LWE hardness. Its main guarantee is ε-simulation with abort: for every inverse-polynomial ε, a simulator can achieve error ε with running time polynomial in 1/ε.
The detailed construction addresses real circuits and treats the classical client as honest-but-curious, although the authors describe generic upgrades for complex circuits and malicious classical clients.
Deep
- Original paper authors
- Yael Tauman Kalai, Dakshita Khurana, Justin Raizes
- Submitted to arXiv
- License
- CC BY 4.0