Quantum Simultaneous Protocols Without Public Coins Using Modified Equality Queries

We observe that quite a few problems studied in the literature can be solved by repeatedly executing the following type of query, ${\mathrm{MEQ}}_{k,n}(i,j,y,z)$: for two indices $i,j\in [k]$, and two strings $y,z\in {\{0,1\}}^n$ known only to the referee, is it the case that $x_i\oplus y=x_j\oplus z$? (Here, $x_i,x_j\in {\{0,1\}}^n$ are the inputs of players $i,j$, respectively.) We refer to such queries as modified equality queries.

There is a well-known quantum simultaneous protocol [9] for “plain” equality queries, where we merely wish to determine whether $x_i=x_j$ (without the modifying strings $y,z$). In the protocol of [9], each player computes a short quantum fingerprint of its input and sends it to the referee, who then uses the quantum fingerprints to compare the players’ inputs (with some error probability; see Section 2 for the details). We observe that quantum fingerprints also allow us to implement modified equality queries, and moreover, this can be done even if the players do not know the strings $y,z$:

We stress that Lemma 3 only states that the referee can compute ${\mathrm{MEQ}}_{k,n}(i,j,y,z)$ for one 4-tuple $(i,j,y,z)$. Unlike classical protocols, in the quantum world it is not technically immediate to re-use information sent by the players to compute the value of the query for more than one 4-tuple (showing how to bypass this difficulty is indeed one of the main contributions of this paper).

Although Lemma 3 allows us to implement a single modified equality query, by itself it is not enough to obtain an efficient protocol for many of the problems we want to solve, as these problems require us to execute many such queries. For example, in the distinct elements problem, the goal is to determine the number of distinct values among $x_1,\mathrm{\dots },x_k$. Solving this problem requires $\left(\genfrac{}{}{0pt}{}{k}{2}\right)$ “plain” equality queries, as every player’s input must be compared against all the others. In general, our goal is to work with protocols represented by an ${\mathrm{𝑀𝐸𝑄}}_{k,n}$ decision tree: a rooted binary tree whose inner nodes are labeled by ${\mathrm{MEQ}}_{k,n}$ queries, and whose leaves are labeled by output values (e.g., 0 or 1 if the tree computes a Boolean function). The tree is evaluated starting from the root, and at each step we evaluate the query written in the current node, proceeding to the left child if the answer is 0 and to right child if the answer is 1, until we eventually reach a leaf and output the value written in it.

A naïve application of Lemma 3 results in a quantum protocol whose communication cost scales linearly with the depth of the decision tree, as we must call the protocol from Lemma 3 at each step. However, we can do much better: we show that we can compile a decision tree into a quantum protocol whose communication cost depends only logarithmically on the depth of the tree. The key is to re-use information: instead of evaluating each modified equality query on its own, we would like to re-use the information sent by the players, so that evaluating multiple queries that involve the same player $i$ will not require player $i$ to send fresh information each time.

As already mentioned, unlike classical protocols, in the quantum world it is not technically immediate to re-use information sent by the players. First, quantum states cannot be duplicated (this is a consequence of the no-cloning theorem in quantum information theory). Second, if at any point we measure a quantum state, we may cause it to collapse, losing all the information that was stored in it (except for the outcome of the measurement), and preventing it from being re-used. This indeed happens in the protocol from Lemma 3. To avoid this pitfall, we use gentle measurements (see, e.g., [1, Section 1.3]), relying on the fact that a measurement whose outcome is “nearly certain” has very little effect on the quantum state we are measuring. To ensure that the outcome of each measurement we make is “nearly certain”, we amplify the success probability of each query ${\mathrm{MEQ}}_{k,n}(i,j,y,z)$ so that if $x_i\oplus y=x_j\oplus z$ then the measurement returns 1 with probability nearly 1, and if $x_i\oplus y\ne x_j\oplus z$ then the measurement returns 1 with probability nearly 0. Finally, we observe that the quantum union bound by Gao [16] can be used and conclude that the measurements can be applied sequentially on the same state with only a small decrease of the success probability.

Ultimately, our result is the following:

We give several applications of our compiler in Section 4. Several are technically straightforward. For instance, using “plain” equality queries, we can compare all the players’ inputs to one another, which allows us to count the number of distinct elements or compute other frequency moments of the input. Next we turn to more complex applications involving graphs: we show that in the number-in-hand network model [8] (a special case of the $\mathrm{𝖲𝖬𝖯}$ model also sometimes called broadcast congested clique), we can use our compiler to obtain efficient simultaneous quantum protocols for $P_3$- and $P_4$-induced subgraph freeness [29, 36], computing neighborhood diversity [31], enumerating isolated cliques [30] and reconstructing distance-hereditary graphs [29, 36]. For all these problems, we obtain efficient quantum protocols that do not require public randomness: in all of our protocols, each player only sends $\mathrm{polylog}(n,k)$ qubits. This cost matches the cost of public-coin classical protocols and improves exponentially the cost of private-coin classical protocols.⁴⁴4For private-coin classical protocols a lower bound of the form $\mathrm{\Omega }(\sqrt{n})$ or $\mathrm{\Omega }(\sqrt{k})$ trivially follows from the lower bound on the cost of private-coin classical protocols for the two-party equality function [5, 38].

Several works [2, 3, 4, 10, 11, 12, 14, 15, 17, 20, 22, 26, 27, 32, 33, 34, 35, 40, 41] have investigated how quantum communication can help for various computational tasks and settings in distributed computing. To our knowledge, theoretical aspects of the quantum multi-party $\mathrm{𝖲𝖬𝖯}$ model have only been considered in Ref. [17], which we already mentioned, and Ref. [19], which focuses on a different input model (the number-on-the-forehead model). There are also a few experimental investigations of multiparty simultaneous quantum protocols [21, 39], but these works are mainly empirical and not concerned with asymptotic complexity.

For any integer $n\ge 1$, we write $[n]=\{1,\mathrm{\dots },n\}$. For any strings $x,x^{\prime }\in {\{0,1\}}^n$, we denote by ${\mathrm{\Delta }}_n(x,x^{\prime })$ the Hamming distance between $x$ and $x^{\prime }$.

In this paper we consider undirected graphs with no self-loops $G=(V,E)$ over $k=|V|$ nodes (since the number of nodes will always match the number of players in the protocol, we use the same notation $k$ for both). We use $\mathrm{deg}(v)$ to denote the degree of node $v\in V$. We often implicitly assume that $V=\{1,\mathrm{\dots },k\}$. Let $N(v)\subseteq V$ denote the neighbors of node $v\in V$ in $G$, and ${\nu }_v\in {\{0,1\}}^k$ denote the characteristic vector of $N(v)$, where ${\nu }_v[u]=1$ iff $\{v,u\}\in E$ for each $u\in [k]$. Let $e_v\in {\{0,1\}}^k$ be the characteristic vector of the singleton $\left\{v\right\}$, i.e., the vector where $e_v[u]=1$ iff $u=v$. For a subset $S\subseteq V$, we use $G[S]$ to denote the subgraph of $G$ induced by $S$. For a node $v\in V$, we define $G-v$ as $G-v=G[V\backslash \{v\}]$.

A node $v$ in $G$ is called pendant if $v$ has only one neighbor. Two nodes $u,v$ in $G$ are called false twins (resp., true twins) if $u$ and $v$ are not adjacent (resp., adjacent), and have the same neighborhood, that is, $N(u)=N(v)$ (resp., $N(u)\cup \left\{u\right\}=N(v)\cup \left\{v\right\}$, or equivalently, $N(u)\setminus \{v\}=N(v)\setminus \{u\}$). We say that $u,v$ are twins if they are either true twins or false twins. Note that two non-adjacent nodes $u,v$ cannot have $N(u)\cup \left\{u\right\}=N(v)\cup \left\{v\right\}$, and because there are no self-loops in the graph, two adjacent nodes $u,v$ cannot have $N(u)=N(v)$. Therefore, in terms of neighborhood vectors, we have:

A simultaneous message-passing ($\mathrm{𝖲𝖬𝖯}$) protocol features $k$ players with inputs $x_1,\mathrm{\dots },x_k\in {\{0,1\}}^n$, respectively, and a referee, who does not know $x_1,\mathrm{\dots },x_k$. In the protocol, each player sends one message to the referee, and the referee then produces an output. The goal of the referee is to compute some function $f(x_1,\mathrm{\dots },x_k)$ of the inputs, and we say that the protocol succeeds whenever the referee’s output is correct. The communication cost of the protocol is the maximum total number of bits sent by the players to the referee in any execution of the protocol, on any input. We say that a protocol is bounded-error if for any input, it outputs the correct answer with probability at least $2/3$. In this paper we do not assume that the players have shared randomness; each player’s message depends only on its own input.

A special case of the $\mathrm{𝖲𝖬𝖯}$ model is the number-in-hand (NIH) network model [8]. Here, the input to the computation is an undirected graph $G=(V,E)$ over $k$ nodes, and each party represents a node in the graph. The input to player $v\in [k]$ is the neighborhood vector ${\nu }_v\in {\{0,1\}}^k$ (we thus have $n=k$ in this case), and the referee is asked to solve some graph problem on $G$.

In the quantum versions of the $\mathrm{𝖲𝖬𝖯}$ model and the NIH network model, the only difference is that players are allowed to send quantum information to the referee. The communication cost of the protocol is the maximum total number of quantum bits (qubits) sent by the players to the referee in any execution of the protocol. We do not assume that the players have shared randomness or shared entanglement; each player’s message depends again only on its own input.

The most basic notion in quantum information is the concept of quantum bit (qubit), which represents the state of an elementary physical system that follows the laws of quantum mechanics (e.g., one photon). Qubits are physically stored in quantum registers. Mathematically, the state of a quantum register consisting of $q$ qubits is described by a unit-norm complex vector of dimension $m$, where $m=2^q$, and usually written using Dirac’s notation as $|\psi ⟩$. By taking an orthonormal basis of the $m$-dimensional complex vector space and indexing these basis vectors (again using Dirac’s notation) as $|j⟩$ for all $j\in \{1,\mathrm{\dots },m\}$, we can write $|\psi ⟩={\sum }_{j=1}^m{\alpha }_j|j⟩$ for complex numbers ${\alpha }_j$ such that the state has norm 1 (i.e., satisfying ${\sum }_{j=1}^m{|{\alpha }_j|}^2=1$).

All transformations on quantum registers need to be unitary, i.e., described by unitary matrices. The main unitary matrices that will appear in the technical parts of this paper are the Hadamard gate (denoted $H$) and the Pauli $X$ gate, both acting on 1 qubit, and the $\mathrm{𝐶𝑁𝑂𝑇}$ gate acting on two qubits. The precise definition of these gates will not be necessary for understanding this paper.

Information can only be extracted from a quantum register by measurements. The most elementary type of measurements is measurement of a 1-qubit register in the computational basis. For a 1-qubit register in the state $|\psi ⟩=\alpha |0⟩+\beta |1⟩$ where ${|\alpha |}^2+{|\beta |}^2=1$, measuring it in the computational basis gives as outcome 1 bit: the outcome is $0$ with probability ${|\alpha |}^2$ and $1$ with probability ${|\beta |}^2$. Importantly, the state collapses (i.e., is irreversibly modified) after the measurement: in the former case the postmeasurement state is $|0⟩$, while in the later case the postmeasurement state is $|1⟩$.

Several more general kinds of measurements are allowed by quantum mechanics. In this paper, we will mostly use the 2-outcome measurements defined as follows. A 2-outcome measurement of a $q$-qubit register $𝖱$ is the following process: introduce a new 1-qubit register $𝖲$ initialized to $|0⟩$, apply a unitary transform $U$ on the whole system, and then measure Register $𝖲$ in the computational basis, which gives as outcome a bit $b\in \{0,1\}$. We refer to Figure 3 in Appendix A for an illustration of the process. We denote such a 2-outcome measurement by $ℳ$. We will also use the following notation: for any bit $b\in \{0,1\}$ and any $q$-qubit quantum state $|\psi ⟩$, we denote by ${ℳ}^b(|\psi ⟩)$ the probability of obtaining outcome $b$ by $ℳ$ when the initial state in $𝖱$ is $|\psi ⟩$.

We now present the quantum union bound by Gao [16]. While this bound only applies to a special type of 2-outcome measurements called 2-outcome projective measurements (defined in Appendix B), any 2-outcome measurement can actually be efficiently converted into a 2-outcome projective measurement (the conversion is described in Appendix B).

Consider several 2-outcome projective measurements ${ℳ}_1,\mathrm{\dots },{ℳ}_N$ acting on the same $q$-qubit register. Consider what happens when performing these $N$ measurements sequentially. Specifically, assume that the system is initially in state $|\psi ⟩$. We first perform ${ℳ}_1$ on $|\psi ⟩$ and obtain a postmeasurement state $|{\psi }_1⟩$. Then we perform ${ℳ}_2$ on $|{\psi }_1⟩$ and obtain the postmeasurement state $|{\psi }_2⟩$. And so it carries on, with each measurement being performed on the state resulting from the previous measurement. After $N$ measurements, we obtain the state $|{\psi }_N⟩$. For an arbitrary binary string $s\in {\{0,1\}}^N$, we would like to estimate the probability that the sequence of outcomes of this measurement process is $s$, i.e., the probability that for all $i\in \{1,\mathrm{\dots },N\}$, the outcome of measurement ${ℳ}_i$ is the bit $s_i$. The following theorem by Gao [16] shows that this probability is high when for each $i\in \{1,\mathrm{\dots },N\}$ applying measurement ${ℳ}_i$ on the initial state $|\psi ⟩$ gives outcome $s_i$ with high probability.

The SWAP test [7, 9] is a quantum protocol that checks whether two quantum states $|{\psi }_1⟩$ and $|{\psi }_2⟩$ stored in two $q$-qubit registers ${𝖱}_1$ and ${𝖱}_2$, respectively, are close or not (i.e., estimates their inner product). For completeness we give a detailed description of the test in Appendix C (this detailed description is not needed to understand the claims of this paper). The main property of the SWAP test is that the test outputs $1$ with probability $\frac{1}{2}+\frac{1}{2}{|⟨{\psi }_1|{\psi }_2⟩|}^2$ (and outputs 0 with probability $\frac{1}{2}-\frac{1}{2}|⟨{\psi }_1|{\psi }_2⟩{|}^2)$, where $⟨{\psi }_1|{\psi }_2⟩$ denotes the inner product between $|{\psi }_1⟩$ and $|{\psi }_2⟩$.

The SWAP test is especially useful when combined with the notion of quantum fingerprints. We first give the definition of this concept.

For a quantum fingerprint family $\{|h_x⟩:x\in {\{0,1\}}^n\}$, the SWAP test on states $|{\psi }_1⟩=|h_x⟩$ and $|{\psi }_2⟩=|h_{x^{\prime }}⟩$ outputs 1 with probability 1 if $x=x^{\prime }$ (since $⟨h_x|h_x⟩=1$) and outputs 1 with probability at most $\frac{1}{2}+\frac{{\zeta }^2}{2}$ if $x\ne x^{\prime }$ (since $|⟨h_x|h_{x^{\prime }}⟩|\le \zeta$). For later reference, we state this result in the following lemma.

Ref. [9] showed how to create quantum fingerprint families. We will actually need a special kind of quantum fingerprint families, also used in [18], that satisfies the following additional property: for any known string $y\in {\{0,1\}}^n$, the fingerprint of $x$ can be converted to the fingerprint of $x\oplus y$ (by a unitary transformation depending on $y$) without knowing the fingerprint of $x$. We call a quantum fingerprint family satisfying this additional property a linear quantum fingerprint family. Ref. [18] showed how to construct a linear quantum fingerprint family, which we write $\{|{\mathrm{\Psi }}_x⟩:x\in {\{0,1\}}^n\}$.

For completeness, we briefly describe the construction from [18], which is based on constant rate linear error-correcting codes (the details of the construction will not be needed to understand the results in this paper). Take a linear function $E:{\{0,1\}}^n\to {\{0,1\}}^m$ where $m=O(n)$ such that ${\mathrm{\Delta }}_m(E(x),E(x^{\prime }))=\mathrm{\Omega }(m)$ for any distinct $x,x^{\prime }\in {\{0,1\}}^n$. The corresponding quantum fingerprint of $x$ is then defined as the $O(\log n)$-qubit quantum state

where $E{(x)}_j$ denotes the $j$th bit of $E(x)$. It is easy to check that this family of states satisfies all the required conditions. In particular, for any $y\in {\{0,1\}}^n$, the state $|{\mathrm{\Psi }}_x⟩$ can be converted to $|{\mathrm{\Psi }}_{x\oplus y}⟩$ by a unitary transformation (depending on $y$) without knowing $|{\mathrm{\Psi }}_x⟩$.