Source-linked AI summary
Quantum computing on encrypted data
K. Fisher, A. Broadbent, L. K. Shalm, Z. Yan, J. Lavoie, R. Prevedel, T. Jennewein, K. J. Resch
TL;DR
The paper addresses how to perform arbitrary quantum computations on encrypted quantum data without revealing inputs to an untrusted server. It develops and proves a universal encrypted-gate protocol, including a simulation-based privacy argument, and identifies experimental and construction limits. The protocol achieves perfect information-theoretic privacy, while experimental security is constrained by multi-photon emissions and inefficient CNOT implementation.
Problem
The paper addresses the need for efficient delegated quantum computation on encrypted quantum information without exposing client inputs to a remote server.
Method
The protocol encrypts quantum inputs, uses a universal gate set with auxiliary qubits for non-Clifford gates, and proves privacy through a simulation-based definition and entanglement-based protocol.
Results
Theorem 1 establishes ϵ-private delegated quantum computation with ϵ = 0, corresponding to perfect information-theoretic privacy against an arbitrarily deviating server.
Takeaways & Limitations
The protocol provides a security level comparable to the one-time pad for delegated quantum computation, while its experimental implementation remains a proof of principle.
Takeaways & Limitations
Experimental security is limited by multi-photon emissions and the CNOT implementation’s 1/9 success probability, although the paper characterizes this issue as technological rather than fundamental.
Abstract
from arXiv · showhide
The ability to perform computations on encrypted data is a powerful tool for protecting privacy. Recently, protocols to achieve this on classical computing systems have been found. Here we present an efficient solution to the quantum analogue of this problem that enables arbitrary quantum computations to be carried out on encrypted quantum data. We prove that an untrusted server can implement a universal set of quantum gates on encrypted quantum bits (qubits) without learning any information about the inputs, while the client, knowing the decryption key, can easily decrypt the results of the computation. We experimentally demonstrate, using single photons and linear optics, the encryption and decryption scheme on a set of gates sufficient for arbitrary quantum computations. Because our protocol requires few extra resources compared to other schemes it can be easily incorporated into the design of future quantum servers. These results will play a key role in enabling the development of secure distributed quantum systems.
1 Universal Circuits
Universal circuits hide both the input data and the identity of the circuit being evaluated by embedding a circuit choice into encrypted auxiliary input. The resulting overhead depends on the circuit collection and the chosen universal circuit.
- 1 Universal Circuits: A circuit U is universal for a collection C when an encoding x makes U reproduce every circuit C in the collection on all inputs.The encoding is appended as an additional m-qubit basis state.
- 1 Universal Circuits: Applying encrypted computation to U with appended |x⟩ hides both the data and the circuit index represented by x.The scheme encrypts the input and the encoding state before evaluation.
- 1 Universal Circuits: The scheme’s communication and auxiliary-qubit complexity depends on the chosen circuit collection and universal circuit.This complexity can only increase relative to executing the original circuit directly on encrypted data.
- 1 Universal Circuits: For g-gate circuits whose positions may contain H, R, CNOT, or identity, a straightforward construction uses n + 3g qubits and twenty-four R gates per position.The gate choices are encoded in the control bits of the universal circuit.
2 Comparison with other schemes
The paper positions its scheme as providing functionality comparable to previous approaches while requiring fewer resources, with detailed comparisons summarized in Table 1.
- 2 Comparison with other schemes: Previous schemes achieved similar functionality but required more resources than the approach presented here.The paper directs readers to Table 1 for comparisons, where s denotes circuit size.
3 Correctness of the R-gate protocol
The R-gate protocol is proved correct by combining X-teleportation with circuit identities and controlled corrections. The derivation shows that the output has the intended transformed state up to known Pauli corrections.
- 3 Correctness of the R-gate protocol: The correctness proof uses an X-teleportation identity as the basic building block for the R-gate protocol.The proof also draws on circuit-manipulation techniques that produce outputs correct up to known Pauli corrections.
- 3 Correctness of the R-gate protocol: The derivation relies on commutation and composition identities for X, Z, P, and R gates, up to a global phase.These identities include relations such as RX = XZPR and P^2 = Z.
- 3 Correctness of the R-gate protocol: The first circuit identity swaps an arbitrary qubit |ψ⟩ with the state |+⟩.This identity supplies the initial transformation used in the teleportation construction.
- 3 Correctness of the R-gate protocol: Measuring the top qubit and classically controlling the output correction yields the X-teleportation circuit.The correction depends on the measurement result.
- 3 Correctness of the R-gate protocol: Redefining the input as RX^aZ^b|ψ⟩ produces an output of the form X^(a⊕c)Z^(a⊕b)PR|ψ⟩.The expression makes the resulting Pauli corrections explicit.
- 3 Correctness of the R-gate protocol: Adding the gates P^y, Z^d, and P^(a⊕y) to the lower wire gives the expected output after applying the stated commutation identities.The added gates implement the correction structure required by the encrypted R-gate protocol.
4 Security definition and proof
The paper defines privacy for delegated quantum computation through indistinguishability between a cheating server’s real-world channel and a simulator’s ideal-world channel, then proves perfect privacy using equivalent entanglement-based and delayed-measurement protocols.
- Quantum registers and channels: A quantum register is a finite collection of qubits represented by density operators, and admissible channels are completely positive, trace-preserving maps.
- Quantum registers and channels: The diamond norm quantifies how distinguishable two quantum channels are by relating their distance to the optimal one-use identification probability.
- Definition and proof of privacy: Privacy requires that every cheating server have a simulator whose induced channel is indistinguishable from the server’s real interaction for every input circuit and input state.
- Definition and proof of privacy: ϵ = 0 gives perfect privacy against arbitrarily deviating, computationally unbounded servers, and Theorem 1 establishes this guarantee for Protocol 1.
- Definition and proof of privacy: The proof replaces encryption and the R-gate procedure with equivalent teleportation- and entanglement-based protocols, then delays client measurements without changing the computation or server view.
- Definition and proof of privacy: The simulator reproduces the server’s induced mapping exactly, yielding diamond-norm distance 0 between real and simulated channels.
5 Ideal process matrices
The ideal process matrices express the universal gate set in the Pauli-operator basis and provide the completely depolarizing channels used to evaluate the server’s undecrypted outputs.
- Ideal process matrices: Process matrices are represented in the Pauli basis, using {1, X, Y, Z} for single-qubit processes and tensor-product Pauli operators for two-qubit processes.
- Ideal process matrices: The Z gate acts as Z|j⟩ → (−1)^j|j⟩, while Hadamard and phase gates are represented as superpositions of Pauli operators.
- Ideal process matrices: The R gate is represented using the Pauli decomposition R = (cos π/8)1 − i(sin π/8)Z.
- Ideal process matrices: The CNOT acts as CNOT|j⟩|k⟩ → |j⟩|k ⊕ j⟩ and is expressed in the two-qubit Pauli basis.
- Ideal process matrices: The server’s undecrypted processes are compared with the completely depolarizing channel, whose action averages over Pauli conjugations and whose process matrix is diagonal.
6 Analysis of experimental security
The experimental security analysis identifies imperfect encryption and photonic implementation as practical deviations from the ideal protocol. In particular, multiphoton emissions and inefficient CNOT operation can leak information about the client’s key, although faster switching and improved photon sources can reduce these risks.
- Imperfect encryption: Experimental imperfections cause the encryption operation to differ from the ideal XaZb transformation.The authors characterize this deviation using experimentally measured encryption fidelities and maximal trace distance rather than the computationally intensive diamond norm.
- Imperfect encryption: 0.014 is the maximum trace distance between the experimental and ideal encryption operations.The maximizing input state is close to ρ = |R⟩⟨R|.
- Multi-photon emissions: The R gate is vulnerable if a malicious server obtains multiple copies of its auxiliary BB84 qubit, because this can reveal the encryption bit a and part of the client’s key.The studied Clifford gates remain secure against multiple copies of encrypted qubits, but the R-gate auxiliary state creates this additional exposure.
- Multi-photon emissions: Faster Pockels-cell switching, better photon sources, pulse picking, and higher system efficiency would significantly improve experimental security.These changes target the possibility of multiple photons being present during a single auxiliary-state setting.
- Multi-photon emissions: The photonic CNOT has a success probability of 1/9 and can provide the server with additional photons that may help break the encryption.The authors characterize this as a technological rather than fundamental security issue and identify deterministic, high-fidelity CNOT as the remedy.
- Multi-photon emissions: The demonstration is a proof of principle, and a security proof incorporating the information leaked to the server remains beyond the work’s scope.The paper identifies entropic bounds as a subject for future research.