# Secure Multiparty Delegated Quantum Computation

This example protocol achieves the functionality of Delegation Quantum Computation to a server for multiple Clients with the guarantee that Server is unknown of any Clients' inputs, outputs, and computation. This protocol is an extension of Prepare-and-Send Universal Blind Quantum Computation in the multiparty setting.

## Assumptions

• The clients have secure access to classical multiparty functionalities, which will be treated as oracles.
• A set of malicious clients cannot corrupt the Server, and the other way around.

## Outline

The Protocol consists of 2 phases: Preparation phase and Computation phase.

### Preparation phase

• Input qubits: For the input qubit states, each client one-time pads their qubit and uses secret sharing schemes to share the secret values with other clients. The honest behaviour for every client is enforced via the given protocol. The server then one-time pads them and measures the one-time padded qubits and announces the measurement values.
• Non-output and non-input qubits: The clients send the qubits in random phases allowed in MBQC. The server then one-time pads them and announces the measurement values.
• Output qubits: The server prepares them in the ${\displaystyle |+\rangle }$ state.
• Graph state: The server entangles the qubits to a brickwork state.

### Computation phase

• Non-output qubits: All clients choose a random bit based on which they compute the measurement angle of the qubits. They send this angle to the server who then returns the result based on the measurement.
• Output qubits: The server sends the encrypted qubits to the corresponding clients. The clients then jointly compute the Pauli corrections and apply them to get the actual output.

## Notation

• ${\displaystyle n}$: Total clients.
• ${\displaystyle C_{k}}$: Client with index ${\displaystyle k}$.
• ${\displaystyle {\mathcal {C}}_{k}}$: Register of client ${\displaystyle C_{k}}$.
• ${\displaystyle S}$: Server performing the computation.
• ${\displaystyle I}$: Set of input qubits.
• ${\displaystyle O}$: Set of output qubits.
• ${\displaystyle O^{c}}$: Set of all qubits except the output qubits.
• ${\displaystyle {\mathcal {S}}_{k}}$: Register of server with register index ${\displaystyle k}$.
• ${\displaystyle t_{j}^{i}}$: Outcome of the measurement for the qubit corresponding to ${\displaystyle i^{th}}$ client for ${\displaystyle j^{th}}$ qubit.
• ${\displaystyle a_{j}}$: Random bit chosen by ${\displaystyle j^{th}}$ client in preparation phase.
• ${\displaystyle r_{j}^{k}}$: Random bit chosen by ${\displaystyle k^{th}}$ client for ${\displaystyle j^{th}}$ qubit in computation phase.
• ${\displaystyle \theta _{j}^{j}}$: Random phase given by ${\displaystyle j^{th}}$ client to ${\displaystyle j^{th}}$ qubit.
• ${\displaystyle \delta _{j}}$: Measurement angle for encrypted qubit ${\displaystyle j}$.
• ${\displaystyle \phi _{j}}$: Measurementangle for ${\displaystyle j^{th}}$ decrypted qubit.
• ${\displaystyle s_{j}^{X}}$: ${\displaystyle X}$ correction term for ${\displaystyle j^{th}}$ qubit.
• ${\displaystyle s_{j}^{Z}}$: ${\displaystyle Z}$ correction term for ${\displaystyle j^{th}}$ qubit.

## Requirements

• The quantum operations required from the clients are limited to creating ${\displaystyle |+\rangle }$ states and applying X gates and rotations around the z-axis.

## Properties

• There is no need of quantum memory for the clients as the quantum communication from the clients to the server can be done in single-qubit rounds.
• The protocol provides security against a dishonest Server and against a coalition of dishonest clients.
• Security in the more general scenario where a Server and some clients collaborate to cheat is not guaranteed.
• No guarantee is given on the correctness of the computation outcome.
• The protocol uses Verifiable Secret Sharing (VSS) schemes and a computation oracle to calculate the necessary values at each step of the protocol and to ensure that the clients behave honestly.

## Protocol Description

• Enforcing honest behavior for client ${\displaystyle C_{k}}$
1. Client ${\displaystyle C_{k}}$ sends ${\displaystyle m}$ qubits ${\displaystyle |+_{\theta _{i}^{k}}\rangle ={\frac {1}{\sqrt {2}}}(|0\rangle +e^{i\theta _{i}^{k}}|1\rangle )}$ to the Server and secret-shares the values ${\displaystyle \{\theta _{i}^{k}\}_{i=1}^{m}}$ with all clients, using a VSS scheme.
2. The Server requests the shared values from the clients for all but one qubit, and measures in the resconstructed bases. If the bases agree with the results of the measurements, then with high probability, the remaining state is correctly formed in relation to the shared angle.
• State preparation for ${\displaystyle j\in I}$)
1. Server stores states received from clients ${\displaystyle C_{k}}$ to distinct registers ${\displaystyle {\mathcal {S}}_{k}\subset {\mathcal {S}}}$ (${\displaystyle k=1,\dots ,n}$);
1. for ${\displaystyle k=1,\dots ,n-1}$
1. if ${\displaystyle k=j}$ then break;
2. if ${\displaystyle k=n-1}$ and ${\displaystyle j=n}$ then break;
3. if ${\displaystyle k=j-1}$, then
1. CNOT on ${\displaystyle {\mathcal {S}}_{k}\otimes {\mathcal {S}}_{k+2}}$;
4. else
1. CNOT on ${\displaystyle {\mathcal {S}}_{k}\otimes {\mathcal {S}}_{k+1}}$;
5. measure state in ${\displaystyle {\mathcal {S}}_{k}}$ and get outcome ${\displaystyle t_{j}^{k}}$;
2. if ${\displaystyle j=n}$ then
1. CNOT on ${\displaystyle {\mathcal {S}}_{n-1}\otimes {\mathcal {S}}_{n}}$;
1. Measure state in ${\displaystyle {\mathcal {S}}_{n-1}}$ and get outcome ${\displaystyle t_{n}^{n-1}}$;
3. else
1. CNOT on ${\displaystyle ({\mathcal {S}}_{n}\otimes {\mathcal {S}}_{j})}$;
1. Measure state in ${\displaystyle {\mathcal {S}}_{n}}$ and get outcome ${\displaystyle t_{j}^{n}}$;

\begin{figure}[H]

   \centerline{
\Qcircuit @C=0.5em @R=1.5em {
\lstick{C_1:20:28, 17 April 2019 (CEST)20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^1}}}	&\qw	&\targ &\meter	&	\cw 	& t_j^1\\
\lstick{C_2:20:28, 17 April 2019 (CEST)20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^2}}}  	&\qw		&\ctrl{-1}&\qw	&\targ		 &	\meter 	&	\cw		&	t_j^2\\
\lstick{C_3:20:28, 17 April 2019 (CEST)20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^3}}} 	&\qw		&\qw	  &\qw	  	&\ctrl{-1}		&\qw &\targ{+1} & \meter	&	\cw		& \cw	&Shraddha (talk) 20:28, 17 April 2019 (CEST)  t_j^3\\
\lstick{\vdots \hspace{1in}\vdots}  				&				 &		   &		&		 &			&	\vdots	&		&	& & & & 	&  &  & & \ddots \\
\lstick{C_n:20:28, 17 April 2019 (CEST)20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^n}}}				&\qw   			 &\qw 	   &\qw		& \qw	 &\qw		&\qw		&\qw	&\qw	& \qw	&\qw	&\qw &\qw & \qw &\ctrl{-1}		&\qw &\targ & \meter	&	\cw		& \cw &20:28, 17 April 2019 (CEST)~	t_j^n\\
\lstick{C_j:~X^{a_j}Z(\theta_j^j)\big[\mathcal{C}_j\big] } 	Shraddha (talk) 20:28, 17 April 2019 (CEST)			&\qw   			 &\qw 	   &\qw		& \qw	 &\qw		&\qw		&\qw	&\qw	& \qw	&\qw	&\qw & \qw & \qw	& \qw	&\qw	& \ctrl{-1}	&\qw & \qw & & &\hspace{0.7in}X^{a_j}Z(\theta_j)\big[\mathcal{C}_j\big] \\\\
}
}
\caption{Remote State Preparation with quantum input (Protocol \ref{Algo2}). Client [/itex]C_j[/itex] performs a one-time pad on his register [/itex]\mathcal{C}_j[/itex] and the result of the circuit remains one-time padded, where [/itex]\theta_j=\theta_j^j+\sum_{k=1,k\neq j}^n (-1)^{\bigoplus_{i=k}^n t_j^i+a_j}\theta_j^k[/itex].}\label{fig:algo1}


\end{figure}

#### State preparation for (${\displaystyle j\in O^{c}\setminus I}$)

1. Server stores states received from clients ${\displaystyle C_{k}}$ to distinct registers ${\displaystyle {\mathcal {S}}_{k}\subset {\mathcal {S}}}$ (${\displaystyle k=1,\dots ,n}$);
2. For ${\displaystyle k=1,\dots ,n-1}$
1. CNOT on ${\displaystyle {\mathcal {S}}_{k}\otimes {\mathcal {S}}_{k+1}}$;
2. Measure state in ${\displaystyle {\mathcal {S}}_{k}}$ and get outcome ${\displaystyle t_{j}^{k}}$;

\begin{figure}[H]

   \centerline{
\Qcircuit @C=0.5em @R=1.5em {
\lstick{C_1:Shraddha (talk) 20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^1}}}	&\qw  &\targ &\meter	&	\cw 	& t_j^1\\
\lstick{C_2:Shraddha (talk) 20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^2}}}  	&\qw		&\ctrl{-1}&\qw	&\targ		 &	\meter 	&	\cw		&	t_j^2\\
\lstick{C_3:Shraddha (talk) 20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^3}}} 	&\qw		&\qw	  &\qw	  	&\ctrl{-1}		&\qw &\targ & \meter	&	\cw		& \cw	&Shraddha (talk) 20:28, 17 April 2019 (CEST)  t_j^3\\
\lstick{\vdots \hspace{0.7in}\vdots}  \hspace{0.5in}				&				 &		   &		&		 &			&	\vdots	&		&	& & & & 	&  &  & & \ddots \\
\lstick{C_{n-1}:\hspace{0.1in}\ket{+_{\theta_j^{n-1}}}}				&\qw   			 &\qw 	   &\qw		& \qw	 &\qw		&\qw		&\qw	&\qw	& \qw	&\qw	&\qw &\qw & \qw &\ctrl{-1}		&\qw &\targ & \meter	&	\cw		& \cw & 20:28, 17 April 2019 (CEST)	t_j^{n-1}\\
\lstick{C_n:Shraddha (talk) 20:28, 17 April 2019 (CEST)\ket{+_{\theta_j^n}}}				&\qw   			 &\qw 	   &\qw		& \qw	 &\qw		&\qw		&\qw	&\qw	& \qw	&\qw	&\qw & \qw & \qw	& \qw	&\qw	& \ctrl{-1}	&\qw & \qw & & &\hspace{0.3in}\mathbf{\ket{+_{\theta_j}}}\\
}
}
\caption{Remote State Preparation without quantum input (Protocol \ref{Algo3}), where [/itex]\theta_j=\theta_j^n+\sum_{k=1}^{n-1} (-1)^{\bigoplus_{i=k}^{n-1} t_j^i}\theta_j^k[/itex].}\label{fig:algo2}


\end{figure}

#### Multiparty Quantum Computing Protocol

• A quantum input ${\displaystyle \rho _{in}}$ and measurement angles ${\displaystyle \{\phi _{j}\}_{j=1}^{q}}$ for qubits ${\displaystyle j\in O^{c}}$ .

Preparation phase

Quantum input: For ${\displaystyle j\in I}$

1. Client ${\displaystyle C_{j}}$ applies a one-time pad ${\displaystyle X^{a_{j}}Z(\theta _{j}^{j})}$ to his qubit, where ${\displaystyle a_{j}\in _{R}\{0,1\}}$ and ${\displaystyle \theta _{j}^{j}\in _{R}\{l\pi /4\}_{l=0}^{7}}$ and sends it to the Server. He secret-shares the values ${\displaystyle a_{j}}$ and ${\displaystyle \theta _{j}^{j}}$ with the other clients.
2. Each client ${\displaystyle C_{k}(k\neq j)}$, runs Protocol 1 with the Server. If all clients pass the test, the Server at the end has ${\displaystyle n-1}$ states ${\displaystyle |+_{\theta _{j}^{k}}\rangle ={\frac {1}{\sqrt {2}}}{\big (}|0\rangle +e^{i\theta _{j}^{k}}|1\rangle {\big )}}$ for ${\displaystyle k\neq j}$.
3. The Server runs Protocol2 and announces outcome vector ${\displaystyle \mathbf {t} _{j}}$.

At this point the Server has the state ${\displaystyle \rho '_{in}={\big (}X^{a_{1}}Z(\theta _{1})\otimes \dots \otimes X^{a_{n}}Z(\theta _{n})\otimes \mathbf {1} _{\mathcal {R}}{\big )}\cdot \rho _{in}}$, where ${\displaystyle \theta _{j}=\theta _{j}^{j}+\sum _{k=1,k\neq j}^{n}(-1)^{\bigoplus _{i=k}^{n}t_{j}^{i}+a_{j}}\theta _{j}^{k}}$

1. [non-output / non-input qubits:] For ${\displaystyle j\in O^{c}\setminus I}$
       \begin{enumerate}
\item[4.] All clients [/itex]C_k[/itex], [/itex]k\in[n][/itex]  run Protocol \ref{Algo1} with the Server. If all clients pass the test, the Server at the end has [/itex]n[/itex] states [/itex]\ket{+_{\theta_j^k}}=\frac{1}{\sqrt{2}}\big(\ket{0}+e^{i\theta_j^k}\ket{1}  \big)[/itex] for [/itex]k=1,\dots,n[/itex].
\item[5.] The Server runs Protocol \ref{Algo3} getting outcome vector [/itex]\mathbf{t}_j[/itex]. He ends up with the state [/itex]\ket{+_{\theta_j}}[/itex], where:
$$\label{eq:entangle2} \theta_j=\theta_j^n+\sum_{k=1}^{n-1} (-1)^{\bigoplus_{i=k}^{n-1} t_j^i}\theta_j^k$$
\end{enumerate}
\item[output qubits:] For [/itex]j\in O[/itex], the Server prepares [/itex]\ket{+}[/itex] states.
\item[graph state:] The Server entangles the [/itex]n+q[/itex] qubits to a brickwork state by applying ctrl-[/itex]Z[/itex] gates.

\end{description}

\begin{flushleft}
\underline{\emph{Computation phase}}
\vspace{-7pt}
\end{flushleft}

\begin{description}
\item[non-output qubits:] For [/itex]j\in O^c[/itex]
\begin{enumerate}
\item All clients [/itex]C_k[/itex], [/itex]k=1,\dots,n[/itex] choose random [/itex]r_j^k\in\{0,1\}[/itex], which they secret-share with the other clients. Then using a computation oracle, they compute the measurement angle of qubit [/itex]j[/itex]:
$$\label{angle} \delta_j:=\phi'_j+\pi r_j+\theta_j$$
where undefined values are equal to zero, or otherwise:
\begin{itemize}
\item [/itex]\phi'_j=(-1)^{a_j+s_j^X}\phi_j+s^Z_j\pi+a_{f^{-1}(j)}\pi[/itex].
\item [/itex]r_j=\bigoplus\limits_{k=1}^n r_j^k[/itex].
\item [/itex]s_i=b_i\oplus r_i[/itex], for [/itex]i\leq j[/itex].
\end{itemize}
\item The Server receives [/itex]\delta_j[/itex] and measures qubit [/itex]j[/itex] in basis [/itex]\{\ket{+_{\delta_j}},\ket{-_{\delta_j}}\}[/itex], getting result [/itex]b_j[/itex]. He announces [/itex]b_j[/itex] to the clients.
\end{enumerate}
\item[output qubits:] For [/itex]j\in O[/itex], the Server sends the encrypted quantum state to client [/itex]C_{j-q}[/itex]. All participants jointly compute [/itex]s_j^X[/itex] and [/itex]s_j^Z[/itex] and send it to client [/itex]C_{j-q}[/itex], who applies operation [/itex]Z^{s_j^Z}X^{s_j^X}[/itex] to retrieve the actual quantum output.
\end{description}


\end{algorithm}

*contributed by Natansh Mathur