5 A test for codewords

h^ψ^EPR|^ψ^′i² ≥ ¹−^O(^pδW). This completes the proof of Lemma4.1.

In this section we show that the low-degree test Q-LOWDEG can be combined with any weakly self-dual quantum CSS code C defined over F_q to obtain a self-test for states in the n-fold tensor product of the codespace, as well as certain tensor products of generalized Pauli observables on the codespace (including all single-qudit Pauli observables). The test uses as many provers as the dimension of the code.

5.1 CSS codes

We consider weakly self-dual Calderbank-Shor-Steane (CSS) codes [CS96, Ste96]. Let C be a classical [k, k^′]linear error-correcting code over F_q, for a prime powerq: C is specified by a generator matrix G ∈ F^k×^k^′

q and a parity check matrix K∈ ^F⁽q^k⁻^k^′^)×^ksuch thatC= Im(G) =ker(K). We say thatC is weakly self-dual if the dual codeC^⊥, with generator matrixK^T, is such thatC ⊆ ^C^⊥; equivalently,G^TG = 0. To any such code C we associate a subspace C ^of(^C^q)^⊗^k that is the simultaneous +1 eigenspace of a set of stabilizers{^SW,j}W∈{^X,Z}^,j∈{^1,...,k^′}such thatSW,jis a tensor product of PauliW observables over Fqin the locations indicated by thej-th column of the generator matrix G, i.e.

SW,j=τ_W(G1j) ⊗^τW(G2j) ⊗^{. . .}⊗^τW(Gkj),

whereGij is the(i, j)-th entry ofG. The condition that G^TG=0 implies that all the SW,jcommute, so that Cis well-defined. We refer to [Got99,KKKS06] for more background on the theory of stabilizer codes over qudits.

Example 5.1 (EPR code). A simple example of a weakly self-dual 2-qudit code with dimension 1 is the

“EPR code” (our terminology) with generator matrixG = ¹ 1

in caseq= 2, and G =

√ 1

−^{1 mod q}

for q ≡ 1 mod 4. The associated code subspace C has dimension 1, and it is spanned by a maximally entangled state of two qudits.

Example 5.2 (Quadratic residue code). The7-qudit code is a weakly self-dual CSS code that has k = 7, k^′ =3, and encodes one qudit over Fqfor any prime powerq= p^esuch thatp is a quadratic residue modulo 7. For example p = 2 is a quadratic residue modulo 7. See Theorem 40 in [KKKS06] for a more general construction.

5.2 TheCODE-CHECK test

Let n be an integer and C a weakly self-dual [k, k^′] linear code. Let C be the associated CSS code, as described in Section5.1.⁸ The testCODE-CHECK(C, n)is summarized in Figure2. The test builds on the (composed) low-degree test described in Figure1. Recall the following properties of the honest strategy for the provers in the test (see Section3.2):

8All results in this and the next section can be obtained by restricting attention to the7-qubit code described in Example5.2.

• In the first part of the test, each prover is sent a query of the form (W, s, s^′), whereW ∈ {^{X, Z}} designates a choice of basis ands, s^′ are the specification of a pair of subspaces. The honest prover measures each of hisn qudits in the basis W, obtaining a string a ∈ ^Fⁿq. From a, the prover com-putes the degree-d polynomial gaspecified in (5), and returns the restriction of the (suitably encoded) bivariate polynomial(ga)_|_sto the subspaces^′.

• In the second part of the test, the prover is sent a query of the form (W1, W2), where W1, W2 ∈ {^{X, Z, Y}}ⁿare commutingn-qudit observables. The honest prover jointly measures W1 andW2and returns the pair of outcomes obtained.

We now describe the test CODE-CHECK(C, n). In the test, the verifier splits thek provers into two groups.

One prover, indexed byt ∈ {1, . . . , k}, is chosen at random and called the “special prover”. The remaining (k−¹)provers are jointly called “composite prover”. In general a prover is not told whether it is the special prover, or a composite prover. In the test the verifier simulates queries from the two-prover low-degree test for the special and composite provers using the following scheme.

Definition 5.3 (Composite queries and answers). LetG∈^F^kq^×^k^′be the generator matrix for a[k, k^′]weakly self-dual codeC. Let Q be a query in the test ^Q-LOWDEG.

1. The composite query associated withQ, denotedQ, is obtained by sending each prover forming the composite prover the queryQ.

2. Given answers(Aj)_j₆₌_tfrom the(k−¹)provers forming the composite prover, the composite answer Ais obtained by selecting a uniformly random vectorv in the column span of G such that vt = 1, and computing the sumA= −^∑j6=^tv_jA_j.⁹

This definition is consistent with the notationMused inQ-LOWDEG; in both cases, the answers obtained from the composite prover (in the case of the two-player test, the second prover) are multiplied by the appropriate entry of the generator matrix of a code. The test Q-LOWDEG differs only insofar as the EPR state is not a CSS code state, so theX and Z stabilizers are not identical. Moreover, in both cases, for honest strategies, the special and composite prover obtain the same outcome when given the same query. This fact is formalized in the following lemma.

Lemma 5.4. Letℓ ≥ 1 be an integer and f : Fⁿ_q →^F^ℓqa linear function. Suppose that k provers share a (nk)-qudit state|^Ψithat is a valid qudit-by-qudit encoding of ann-qudit state|^ψiaccording to ak-qudit self-dual CSS codeC^{. Let}^W ∈ {^{X, Z}}ⁿand suppose that for eachj∈ {1, . . . , k}^{, the}j-th prover measures thei-qudit of its share of the state in the basis Wi, for eachi∈ {1, . . . , n}, to obtain an assignmentaj ∈^Fⁿq, and returns the valueyj = f(aj) ∈^F^ℓq. Then for any indext∈ {1, . . . , k}for the special prover, and vector v ∈ ^F^kqchosen as in item 2. in Definition 5.3, the special prover’s answeryt and the composite prover’s answery = −^∑j6=tvjyj are equal with certainty.

Before giving the proof, we note that the functions computed in the low-degree test, i.e. polynomialsga

as in (5), evaluated on points or restricted to subspaces, are linear functions ofa of the form considered in the lemma.

Proof. It follows from the definition ofv and the stabilizer property of the code that

∑

vjaj =0 .

9The specific way in which this summation is performed depends on the form of the queryQ. In general each A_iis expected to be either a low-degree polynomial, or of a pair of values in F_q. In both cases, there is a natural way to add up the answers in order to obtain an answerAthat is formatted as the prover’s answer in the low-degree test.

Write the linear function f as f(a) =Ka, for K∈^F^ℓq^×ⁿ. Then, a simple calculation shows that y= −

∑

j6=t

vj f(aj) = −

∑

j6=t

vj(Kaj) =K

−

∑

j6=t

vjaj

=Ka=y .

TestCODE-CHECK(C, n): Given is the generator matrixG for a[k, k^′]weakly self-dual linear codeC over F_q, as described in Section5.1, andn an integer. Let d= ⌈^{log n}⌉ · ⌈_{log log n}^{log n} ⌉^and^m= ⌈_{log log}^log⁽ⁿ₍⁾_n₎⌉^.

(a) The verifier selects one of thek provers at random and assigns it the label of “special prover”. All remaining provers are given the label of “composite prover”. (The provers are not told how they are labeled.) Lett∈ {1, . . . , k}be the index of the special prover.

(b) The verifier executes the verifier for the test Q-LOWDEG⁽²⁾(m, d, q) to generate a pair of queries (Q, Q^′)for the two provers in that test. The verifier sends the query Q to the special prover, and distributes the queryQ^′to the composite prover. He receives answers A andA^′respectively.

Figure 2: The procedureCODE-CHECK(C, n)verifies thatk provers share an entangled state which lies in then-fold tensor product of the codeC, defined overk qudits each of dimension q.

5.3 Analysis of theCODE-CHECK self-test We first show completeness of the testCODE-CHECK.

Lemma 5.5. LetC be a[k, k^′]weakly self-dual linear code over F_q, andn an integer. LetCbe the associated CSS code, as described in Section5.1. Then for any(nk)-qubit state|^Ψi ∈ C^⊗ⁿthere exists a strategy for the k provers based on sharing |^Ψi and measuring tensor products of Pauli observables, such that the strategy is accepted with probability1 in the test^CODE-CHECK(C, n).

Proof. Fix |^Ψi ∈ C^⊗ⁿ. The strategy for the provers is simple: each prover directly applies the honest strategy in the testQ-LOWDEG⁽²⁾, as described in Section3.2.

It remains to verify that the answers(A,A^′)computed by the verifier in step (c) of the testCODE-CHECK

are valid answers to(Q, Q^′)inQ-LOWDEG⁽²⁾. Fix a choice of codewordv as made by the verifier in the computation of the composite query Q^′ at step (b) of CODE-CHECK (see Definition 5.3). We make the following observations on the joint measurement performed by the provers that constitute the composite prover. Consider first queries of the form Q^′ = (W, s, s^′). Upon receipt of such a query, thei-th prover that constitutes the composite prover measures each of its n qudits using the projective measurement τW

to obtain outcomes a^′_i = (a^′_i,1, . . . , a^′_i,n), from which it computes a low-degree polynomial g_a^′_i as in (5).

Since a^′ 7→ ^ga^′ is a linear function, the answer A^′ computed by the verifier is the restriction to s^′ of the (suitably encoded) bivariate polynomial(g_a′)_|_s, wherea^′ = ∑_i₆₌_tv_ia^′_iis the outcome of an imaginary joint

measurement performed by the composite prover using the measurementτ^a_W^′ = ∑_a′

i:∑_i₆₌_tv_ia^′_i=a^′⊗i6=^tτ_W^a^′ⁱ. The situation in case the queryQ^′ is taken from the second part of the low-degree test is similar.

To conclude we show that for any choice of codeword v made by the verifier, the provers’ strategy, conditioned on v, is isometric to the honest strategy for the low-degree test, as defined in the proof of Lemma3.4.

To see this, observe that by definition, for a fixed v, the operators X⊗^X ^and ^Z⊗^Z stabilize each group ofk qudits of|^Ψi^{, where}^X =τ_X(1),X = ⊗i6=tτ_X(vi), and Z= τ_Z(2), Z = ⊗i6=tτ_Z(vi); indeed this is becausev defines both an X and a Z stabilizer forC. Moreover, X and Zsatisfy the same twisted commutation relation asτXand τZ; this is becausevt = 1 and v·^v =0 by weak self-duality. Thus there exists a local isometry acting jointly on all provers forming the composite prover, which mapsX 7→^τXand Z 7→ ^τZ. The image of|^Ψiunder this isometry is stabilized byτ_X⊗^τX andτ_Z⊗^τZ, hence must be the state|^EPR^qi^{. Lemma}^3.4then lets us conclude that the above-defined strategy succeeds with probability1 in the test.

The next theorem shows soundness of the testCODE-CHECK.

Theorem 5.6. Letn, k, k^′ be integer. Letq = p^t be a prime power such that F_q admits a self-dual basis over F_p. LetC be a[k, k^′]weakly self-dual linear code over F_q, andC the associated CSS code. Letm, d be as in Figure2. Suppose a strategy using state|^Ψi ∈ ⊗^ki=1Hi and projective measurements {^MW,w^a } for the special prover succeeds in testCODE-CHECK(C, n)with probability at least1−ε, for some ε≥ ^0.

Then there is a δC = max(poly(p) ·^poly(ε), poly(q⁻¹))and isometriesV_i : Hi → (^C^q)^⊗ⁿ⊗ H^′i for i∈ {1, . . . , t}, and states|^ψi ∈ C ^and|^AUXi ∈ ⊗iHi^′such that

(⊗iVi)|^Ψi − |^ψi|^AUXi² ≤ ^δC , and for allW ∈ {^{X, Z}}^,

w∈E^F^mq

∑

a∈^Fq

(⊗iVi)(M_W,wâ ⊗Îd)|^Ψi − (^τW,wâ ⊗Îd)|^ψi|ÂUXi² ≤ ^δC.

Proof. Fix a strategy for the k provers in the test that is accepted with probability at least 1−^{ε. Fix any} t ∈ {1, . . . , k}. By combining the (k−¹) strategies employed by provers {1, . . . , k}\{^t}, when they play the role of the composite prover, into a single strategy, we obtain a two-prover strategy for the test

Q-LOWDEG⁽²⁾(m, d, q)that has success probability at least1−ε. Applying Theorem 3.2shows the self-testing claim for the observables applied by prover t, when designated as the special prover. The same applies for allt ∈ {1, . . . , k}, proving the theorem.

Remark5.7. We record here the bit complexity of the protocol CODE-CHECK. The test invokes the com-posed quantum low-degree testQ-LOWDEG⁽²⁾(m, d, q)withm = ⌈log log n^{log n} ⌉^and^d = ^Θ(_{log log n}^log²ⁿ ). Hence, the number of bits in the verifier’s questions scales asO(_{log log n}^{log n} log q), and the number of bits in the provers’

responses scales asO((log log n)²log q), so the overall bit complexity isO(_{log log n}^{log n} log q).

In document Low-Degree Testing for Quantum States, and a Quantum Entangled Games PCP for QMA (Page 37-40)