Tight Query Lower Bounds for Quantum Sampling, with an Application to Certified Randomness

Tight Query Lower Bounds for Quantum Sampling, with an Application to Certified Randomness Keshav Bhateja∗, Mehdi Esmaili†, and Atul Mantri‡

arXiv:2610.06721v1 [quant-ph] 5 Oct 2026

Department of Computer Science, Virginia Tech, Blacksburg, VA 24061, USA

Abstract Random circuit sampling experiments, the leading demonstrations of quantum computational advantage, are tested with the linear cross-entropy benchmark (XEB), which scores the returned outcomes by their probabilities under the ideal output distribution. We study what a high XEB score certifies about an untrusted quantum device. In the quantum query model, we show that the score of an honest quantum sampler, the ideal score, plays the role of Tsirelson’s bound for this test, both as a limit for efficient devices and as a certificate of randomness. First, exceeding the ideal score by a constant requires Ω(N 1/3 ) queries for the Haar and Fourier oracle ensembles with N outcomes, and this bound is tight; this proves an earlier conjecture for Haar-random states and extends it to Fourier sampling. Second, for Fourier sampling and for Haar-random states accessed through the canonical state-preparation oracle, the n-bit output of a device that makes polynomially many queries and scores within o(1) of the ideal score has n − O(log n) bits of smooth min-entropy, even against an adversary who is entangled with the device and later learns the oracle; this is nearly optimal. As a corollary, sampling the collision distribution, which is proportional to the square of the ideal distribution, has query complexity Θ(N 1/3 ), and a coherent version of the same algorithm approximately prepares quantum Hadamard products of states with uniform amplitude magnitudes. Both lower bounds rest on progress measures that are zero for the honest sampler, bound the excess over the ideal score, and increase only slightly with each query. For Fourier sampling the measure is the norm of the coherent amplitudes for removing pairs in a purification of the random function, combining the polynomial method with the compressed oracle technique; for Haar-random states it is the square root of the average level in an expansion in Dirichlet orthogonal polynomials, controlled by an exact identity for the effect of one observation. We expect these measures to be useful for query lower bounds on other sampling problems.

Contents 1 Introduction 3 1.1 Our results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.2 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Acknowledgments and AI disclosure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 ∗

kbhateja@vt.edu mesmaili@vt.edu ‡ atulmantri@vt.edu †

1

2 Technical overview 2.1 Fourier sampling with one query . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 The Fourier lower bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Near-optimal randomness from Fourier sampling . . . . . . . . . . . . . . . . . . . . 2.4 The lower bound for Haar-random states . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Near-optimal randomness for Haar-random states . . . . . . . . . . . . . . . . . . . .

13 13 14 16 17 19

3 Preliminaries 3.1 Notation and query algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Min-entropy, fidelity, and purified distance . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Dirichlet distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20 20 25 27

4 The lower bound for Fourier sampling 4.1 The recording representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 The score bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Growth of the progress measure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 The lower bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 The exact identity for one phase query . . . . . . . . . . . . . . . . . . . . . . . . . .

28 28 31 33 34 35

5 The lower bound for Haar-random states 5.1 Polynomials, patterns, and the level . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Dirichlet energy and concentration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 The score in terms of the level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Projection estimates for Dirichlet polynomials . . . . . . . . . . . . . . . . . . . . . . 5.5 The effect of one query on the level . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 Haar-random unitary access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

36 37 41 43 44 47 50

6 The squaring algorithm 6.1 The three forms of access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 The algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Moments of the two ensembles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 The output distribution for a fixed stored set . . . . . . . . . . . . . . . . . . . . . . 6.5 The output distribution of the algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 6.6 The score of the output distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.7 Heavy outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

51 52 52 53 54 55 58 62

7 Certified randomness at the ideal score 7.1 Min-entropy from auxiliary vectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Fourier sampling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 Haar-random states . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.4 Tightness of the parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.5 Proof of Theorem 1.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

63 64 66 71 74 79

8 Quantum Hadamard products 80 8.1 Hadamard products of states with uniform magnitudes . . . . . . . . . . . . . . . . . 80 8.2 A lower bound for Hadamard squares of Haar-random states . . . . . . . . . . . . . . 83 A Deferred proofs A.1 Proofs for the Haar lower bound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2 Moments of the ideal distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.3 Heavy outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2

89 89 95 97

1

Introduction

Sampling experiments [AAB+ 19, ZWD+ 20, WBC+ 21, MLA+ 22, MVM+ 24] are the leading demonstrations of quantum computational advantage; surveys are given in [HM17, HE23, Han26]. In the random circuit sampling experiments [AAB+ 19, WBC+ 21, MVM+ 24], a device receives a random circuit C on n qubits and is asked to return strings z ∈ {0, 1}n distributed according to the output distribution p(z) = |⟨z|C|0n ⟩|2 of the circuit. The photonic experiments [ZWD+ 20, MLA+ 22] instead perform Gaussian boson sampling. Since it is infeasible to check directly whether a few samples follow a distribution over N = 2n outcomes, the random circuit samples are instead scored by the linear cross-entropy benchmark (XEB) [AAB+ 19, Supplementary Information, eq. (27)], a linear version of cross-entropy benchmarking [BIS+ 18]: a classical computer computes the ideal P probabilities of the returned strings z1 , . . . , zk and reports the average (N/k) i p(zi ). We use the unshifted convention B = 1 + FXEB , where FXEB is the experimental XEB fidelity. Uniformly P random strings have expected score 1, because z p(z) = 1, while an honest sampler has expected P score N z p(z)2 , the ideal score, which is about 2 for random circuits. The experiment of [AAB+ 19] reported a score of about 1.002, and there is complexity-theoretic evidence that efficient classical algorithms cannot score noticeably above 1 [AG20]. A high score, however, does not imply that the device sampled from p. A device that knew p and always returned the most likely string would score far more than an honest sampler (for a Haar-random state, about ln N ≈ 42 when n = 60, compared with about 2), even though its output would be completely predictable. This gap between scoring well and sampling correctly leads to the question that motivates this work: What does a high cross-entropy score certify about an untrusted quantum device? We study this question for the application that has motivated much of the theory, namely certified randomness. Generating random bits with quantum mechanics is straightforward, but convincing a skeptical user who does not trust the hardware is much harder. In Bell experiments, two devices receive independent uniform public inputs, chosen independently of their shared state with Eve, and cannot communicate during the round. If they win the CHSH game [CHSH69] with probability above the classical limit 3/4, one party’s output bit contains certified entropy [Col06, PAM+ 10], even conditioned on the inputs and an adversary who is entangled with the devices [VV12, MS16]. At Tsirelson’s bound cos2 (π/8) ≈ 0.854, which is the largest winning probability of any quantum strategy [Cir80], either party’s output bit has one bit of min-entropy, even conditioned on the public inputs and Eve’s quantum register. The drawback of this approach is that the two devices must not communicate, a condition that a user who simply receives the bits cannot verify. An alternative, proposed in [AH23], is to certify randomness with a single device by reusing the sampling experiment. In this protocol a verifier sends challenge circuits, the device must answer quickly with samples (too quickly for a classical simulation to keep up), and the verifier later checks their XEB score. The adversary, whom we call Eve, may have built the device, may share entanglement with it, and may learn the circuits afterward. Even an ideal sample is not perfectly unpredictable to Eve: since she knows the circuit, she can guess its most likely output, which an honest sampler returns with probability about (ln N )/N . Moreover, a device can fix its first O(log n) output bits by resampling until its output starts with that many zeros, which changes its score only slightly (Proposition 7.14 analyzes a variant that uses amplitude amplification). Consequently, the most that one can hope to certify from a single sample is n − O(log n) bits. The guarantees proved so far remain well short of this limit. In the random oracle model, Aaronson and Hung [AH23, Theorem 7.15 and Corollary 7.16] show that a device making polynomially many 3

queries with expected linear XEB score 1 + γ, for a constant γ > 0, has a single-round output state close to one with about γn bits of conditional von Neumann entropy, even against an entangled Eve. The same work asks whether, under a plausible hardness assumption, a single sample can be certified to carry the maximum of n − O(log n) bits. For a list of strings whose empirical Fourier score is high, n/40 bits of min-entropy for the whole list are certified in [BBF+ 26] against an adversary without quantum side information. Before one can ask how much randomness a near-ideal score certifies, one must first know whether an efficient device can exceed the ideal score at all. The reason is that the score is linear in the device’s output distribution. If some efficient device scored 2 + ε, then a new device could run it with probability 1/(1 + ε) and otherwise output a fixed string known to Eve. The fixed string has expected score 1, because its expected ideal probability is 1/N . This mixture has expected score exactly 2, essentially the ideal score, yet Eve guesses its output with probability at least ε/(1 + ε), which equals 1/6 when ε = 0.2. Hence, a near-ideal score can certify nearly all of the randomness only if no efficient device exceeds the ideal score by a constant. The question of how high an efficient quantum device can score was raised in [Aar20] and studied in [Kre21] under the name quantum supremacy Tsirelson inequality. In the analogy with the CHSH game, the conjectured classical limit 1 plays the role of 3/4, and the question is whether the ideal score plays the role of cos2 (π/8). The first answers were obtained in [Kre21], in the query model. For a Haar-random state, it was shown there that an expected score of 2 + ε requires Ω(ε5/4 N 1/4 / log N ) queries, so that efficient algorithms cannot exceed the ideal score by 1/poly(n). The same work gave an algorithm that scores 2 + Ω(1) with O(N 1/3 ) queries and conjectured that N 1/3 queries are necessary. For Fourier sampling, where the honest sampler scores about 3, it was shown that no algorithm making a single query does better. The corresponding question for many queries is Problem 12 in [Aar21], which asks how many queries are needed to produce a list of Fourier samples whose empirical score is about 4. The query model and the expected score. We work in the query model developed in [Kre21]. In this model the circuit is replaced by an oracle drawn once from a known ensemble. The algorithm may query the oracle in superposition, adaptively, and with controlled and inverse queries, and all other computation is free. Theorems in this model are unconditional. Honest sampling requires only one query, whereas exceeding its expected score may require many more. Our bounds quantify this separation. For an oracle with ideal distribution p, the expected score of an algorithm A that outputs a string Z is   B(A) = N E p(Z) , (1) where the expectation is over the oracle and the randomness of the algorithm. We consider the following two ensembles. Fourier sampling. Here the oracle is a uniformly random function f : {0, 1}n → {±1}, accessed through the value oracle |x, b⟩ 7→ |x, b ⊕ (1 − f (x))/2⟩. A single query suffices to sample from a distribution determined by f : apply Hadamard gates to |0n ⟩, query the oracle with the target qubit in the state |−⟩, which turns the bit flip into the sign f (x) and so multiplies each |x⟩ by f (x), apply Hadamard gates again, and measure [AC17]. The outcome is z with probability pf (z) = fb(z)2 ,

fb(z) =

1 X (−1)z·x f (x), N x∈{0,1}n

(2)

√ and these probabilities sum to 1 by Parseval’s identity. Each N fb(z) is a normalized sum of N independent random signs, and hence nearly a standard Gaussian, so the honest sampler scores its P fourth moment, N E z pf (z)2 = 3 − 2/N . 4

Haar-random states. Here the oracle hides a uniformly random unit vector |ϕ⟩ = z αz |z⟩ in N C , and pϕ (z) = |αz |2 . The canonical state-preparation oracle Oϕ [ARU14] swaps |ϕ⟩ with a fixed marker state |⊥⟩ that is orthogonal to all basis states |z⟩, and acts as the identity on the orthogonal complement of |ϕ⟩ and |⊥⟩. With Haar-random unitary access, the algorithm may instead apply, to any state, a Haar-random unitary U with U |0n ⟩ = |ϕ⟩, its inverse, and controlled versions of both, as it could if it held the circuit itself. This form of access is at least as strong, since Oϕ can be built from controlled applications of U and U † (Section 3.1), so lower bounds against it are more meaningful. The vector (pϕ (z))z is uniformly distributed on the probability simplex, so each N pϕ (z) is nearly an exponential random variable, and the honest sampler scores its second moment, P N E z pϕ (z)2 = 2N/(N + 1). P

1.1

Our results

expected score

Our results answer both questions in the query model, namely how high an efficient device can score and how much randomness a near-ideal score certifies, and the answers follow the CHSH analogy closely. For algorithms that make o(N 1/3 ) queries, the ideal score behaves like a Tsirelson bound: no such algorithm exceeds it by more than o(1), while O(N 1/3 ) queries suffice to exceed it by a constant. Moreover, for Fourier sampling and for Haar-random states accessed through Oϕ , a device that makes polynomially many queries and comes within o(1) of the ideal score has n − O(log n) bits of smooth min-entropy with smoothing o(1), in analogy with the perfectly random bit at Tsirelson’s bound. Figure 1 and Table 1 summarize the first result. squaring algorithm

3 upper bound of Theorem 1.1

2 honest sampler

1

open before this work

uniform output, no queries

1

N 1/4 N 1/3 number of queries q (logarithmic scale)

N 1/2

Figure 1: Expected scores for a Haar-random state as a function of the number of queries, drawn schematically on a logarithmic scale. The solid curve illustrates the scaling form of the upper bound of Theorem 1.1, and the dashed segments mark the scores of the honest sampler, 2N/(N + 1) ≈ 2 with one query, and of the squaring algorithm of part 3 of Theorem 1.1, 3 − o(1) with O(N 1/3 ) queries; these are lower bounds on the best score, which is not determined beyond N 1/3 queries. No algorithm exceeds 2 + o(1) with o(N 1/3 ) queries; at N 1/4 queries, where the previous lower bound stopped, the upper bound is within O(N −1/8 ) of the ideal score, and the shaded range between N 1/4 and N 1/3 was left open by the previous bounds. For Fourier sampling the bounds have the same form, with the scores 2 and 3 replaced by 3 and 5. The uniform output, which makes no query, is drawn just left of q = 1, since a logarithmic axis has no zero. The axis extends to N 1/2 queries, the number of measured copies at which a repeated outcome typically first appears. Theorem 1.1 (Query complexity of exceeding the ideal score; informal). Let A be a quantum algorithm that makes at most q queries. √ 1. For Fourier sampling, B(A) ≤ 3 + O(q 3/2 / N + q 3 /N ). In particular, an expected score of 3 + ε, for 0 < ε ≤ 4, requires q ≥ (3ε/16)2/3 N 1/3 . 5

Previous work [Kre21] Task Haar-random state, score 2 + ε Fourier sampling, score 3 + ε Collision distribution, error ν

This work

lower bound

upper bound

lower bound

upper bound

1/4 ) e Ω(N >1 —

O(N 1/3 ) — —

Ω(N 1/3 ) Ω(N 1/3 ) Ω(N 1/3 )

O(N 1/3 ) O(N 1/3 ) O(N 1/3 )

Table 1: The number of queries needed to reach an expected score of 2 + ε for a Haar-random state or 3 + ε for Fourier sampling, where ε > 0 is a fixed constant, and to sample the collision distribution within a fixed total variation error ν (Corollary 1.3), for distributions over N = 2n outcomes. The upper bounds of this work come from the squaring algorithm and need ε < 1 and ε < 2, respectively, while the previous Haar upper bound holds for the constant ε attained by the algorithm of [Kre21]. The lower bounds hold for all 0 < ε ≤ 1 and 0 < ε ≤ 4, respectively, and the admissible range of ν is stated in Corollary 1.3. The previous Fourier bound is that one query does not suffice [Kre21]. For Haar-random states, every bound holds both for the canonical oracle Oϕ and for Haar-random unitary access, the lower bound in the latter case once N is large enough in terms of ε (Theorem 5.25). √ 2. For a Haar-random state, B(A) ≤ 2N/(N + 1) + O(q 3/2 / N + q 3 /N ) with the canonical oracle Oϕ , and under Haar-random unitary access the same bound holds with an additional √ term O(q log N/ N ). Hence an expected score of 2 + ε with 0 < ε ≤ 1 requires Ω(ε2/3 N 1/3 ) queries with the canonical oracle, and also with Haar-random unitary access once N is large enough in terms of ε. 3. A variant of the O(N 1/3 )-query algorithm of [Kre21], which we call the squaring algorithm, makes O(N 1/3 ) queries and has expected score at least 5 − o(1) for Fourier sampling and at least 3 − o(1) for either form of Haar access. Consequently, for every fixed b ∈ (3, 5) for Fourier sampling, and every fixed b ∈ (2, 3) for either form of Haar access, the query complexity of achieving B(A) ≥ b is Θ(N 1/3 ), where the constant in the lower bound depends on b. Thus the honest sampler, which makes a single query, remains optimal up to o(1) until an algorithm makes about N 1/3 queries. For example, at N 1/4 queries, a number for which the previous lower bound still allows a constant advantage, the score stays within O(N −1/8 ) of the ideal score, and an expected Fourier score of 4 requires more than 0.32 N 1/3 queries, which is more than 3 × 105 for n = 60. For Haar-random states, the theorem confirms the conjecture of [Kre21], as well as the expectation stated there that the O(N 1/3 )-query algorithm of that work can be made to score 3 − o(1); we prove this for the variant described below. For Fourier sampling, it settles the expected-score version of Problem 12 mentioned in [Aar21]. Outputting a uniformly random entry of a list uses no further queries, and the expected score of that entry is the expected empirical score of the list. If the empirical score is at least 3.9 with probability 0.9, then, since rewards are nonnegative, this expected score is at least 0.9 · 3.9 > 3.5, so producing such a list takes more than 0.2 N 1/3 queries. In the other direction, the empirical score of independent runs of the squaring algorithm exceeds any fixed score below 5, or below 3 for Haar-random states, with high probability (Corollary 6.11). The squaring algorithm explains where the exponent 1/3 comes from. It draws m ideal samples and stores the outcomes. The stored set has total probability of order m/N , and amplitude 6

amplification [BHMT02] raises to nearly one the probability that one more ideal sample lies in it. p This costs m + O( N/m) queries, which is O(N 1/3 ) for m = N 1/3 . Likely outcomes are stored more often, and the amplified sample, which is distributed according to p conditioned on lying in the stored set, favors them again. As a result, the output z has probability nearly proportional to p(z)2 , which explains the name. A sampler whose output distribution is proportional to p(z)2 scores P P N z p(z)3 / z p(z)2 , a ratio of consecutive moments, which is 15/3 = 5 for the nearly Gaussian Fourier coefficients and 6/2 = 3 for the nearly exponential Haar probabilities. To reach these scores, our variant runs a fixed number of amplification steps, tuned to the typical probability of the stored set, as suggested in [Kre21]. The algorithm has the same structure as the quantum algorithm for finding collisions [BHT98], whose query complexity is also N 1/3 [AS04], but we do not know of a reduction between the two problems. Moreover, the gain in score does not come from a repeated outcome among the stored samples, which for m = N 1/3 are distinct with high probability, but from the coincidence of the amplified sample with one of them. The lower-bound framework. For Haar-random states, we first explain why earlier methods stopped at N 1/4 . The argument of [Kre21] first uses the simulation of [ARU14] to replace queries by resource states of the form a|ϕ⟩ + b|⊥⟩. Haar phase averaging then reduces the score analysis to ordinary copies of |ϕ⟩, with a copy count quadratic in q, up to accuracy-dependent and logarithmic factors. A constant advantage over the ideal score requires collisions among the measured copies, √ which occur at about N copies. This yields the earlier N 1/4 query lower bound, up to logarithmic factors. The reduction thus incurs a quadratic cost before any collision is counted. Avoiding this loss requires an argument about the queries themselves, whose effect on the state is coherent and leaves no classical record of what the algorithm has learned. Instead of simulating queries by copies, we therefore ask what the state of an algorithm must look like if it is to score above the honest sampler, and we track p a progress measure that is zero for the honest sampler and grows, after t queries, by only O( (t + 1)/N ) at the next query. For Fourier sampling, we purify the random choice of function, as in the compressed oracle technique [Zha19]. In this representation, the basis states of the purifying register are indexed by subsets of {0, 1}n , which we call recorded sets. Each query changes a recorded set by at most one point. The number of recorded points is not itself a useful measure, since an algorithm can record many points without scoring above the honest sampler; what matters is how the points are arranged. In the honest sampler, the part of the state with output z records exactly one point in P the Hadamard basis state |χz ⟩ = H ⊗n |z⟩ = N −1/2 x (−1)z·x |x⟩. To score more, an output branch must have a nonzero amplitude for removing a pair with the coefficients of its Hadamard basis state. Our measure is the norm of the coherent amplitudes for removing such pairs. Comparing pair removal before and after a query leaves one other recorded point to remove, with coefficient √ O(1/ N ) (Section 2.2). For Haar-random states, the natural analogue would count repeated amplitudes such as αz2 P or |αz |2 . However, every term of the normalization z |αz |2 = 1 repeats an amplitude, although the sum is a constant. We instead expand the state in orthogonal polynomials on the probability simplex, an expansion in which the normalization has degree zero. Each term has a nonnegative integer level that counts repeated amplitudes after this expansion. The progress measure λ is the square root of the average level, so it need not be an integer. To show that a query increases λ only slightly, we prove an exact identity for the orthogonal polynomials of the Dirichlet distribution, which describes how their degree changes when one more outcome is observed (Section 2.4).

7

Certified randomness at the ideal score. We now turn to the randomness that a near-ideal score certifies. Since the answer depends on what Eve may know and do, we first describe the experiment precisely. It models one sample from a round of the protocol of [AH23], with the oracle in place of the challenge circuit. 1. The device and Eve share an arbitrary entangled state, of arbitrary finite dimension, independent of the freshly sampled oracle. 2. The oracle is drawn: a random function f , or a Haar-random state |ϕ⟩ accessed through Oϕ . From this point on, the device and Eve do not communicate. 3. The device makes q queries, acting arbitrarily on its own registers and on its half of the shared state, and outputs a string Z. 4. Eve receives the complete classical description R of the oracle (the truth table of f , or the vector ϕ) and measures her register E, in a way that may depend on R, in order to guess Z. No assumption is made about how the device works. The restriction on communication cannot be removed, since a device that sends Z to Eve certifies nothing, and step 4 gives Eve all the information that the device could have obtained from its queries. Without smoothing, the conditional minentropy Hmin (Z | RE) equals − log2 of the best probability with which Eve can guess Z [KRS09]. η Its smooth version Hmin (Z | RE) is at least h if some normalized state within purified distance η of the actual joint state of R, Z, and E has conditional min-entropy at least h [TCR10]. The purified distance is a fidelity-based distance that lies between the trace distance and the square root of twice the trace distance.1 Smooth min-entropy is the quantity needed for randomness extraction, since a seeded extractor that is secure against quantum side information turns such a Z into nearly h bits that are close to uniform even given Eve’s register [TSSR11]. Theorem 1.2 (Certified randomness at the ideal score; informal). Let δ ≥ 0. Consider a device in this experiment that makes q ≥ 1 queries, and suppose that its expected score is at least 3 − 2/N − δ for Fourier sampling, or at least 2N/(N + 1) − δ for √ a Haar-random state accessed through Oϕ ; we call δ the allowed deficit. Then there is an η = O( δ + q 3/4 N −1/4 ) such that, if η ≤ 1/2, η Hmin (Z | RE) ≥ n − 4 log2 q − log2 n − O(1)

for Fourier sampling,

η Hmin (Z | RE) ≥ n − 2 log2 q − log2 n − O(1)

for Haar-random states.

The constants do not depend on the dimension of the state shared with Eve. In particular, if q ≤ nO(1) and δ = o(1), the output has n − O(log n) bits of smooth min-entropy with smoothing o(1), and the smoothing is negligible if δ is negligible. In a state within purified distance η of the actual one, Eve guesses Z with probability at most 2−n+O(log n) , even though she knows the entire oracle and may hold an arbitrarily large quantum η memory entangled with the device. More generally, a bound Hmin (Z | RE) ≥ h implies that her −h guessing probability in the actual state is at most 2 + η, since trace distance is at most purified distance. For n = 60, q = 100, and δ = 0, the explicit bounds of Theorems 7.2 and 7.9 give at least 24 bits for Fourier sampling with η ≈ 0.00112 and at least 39 bits for Haar-random states with η ≈ 0.0201, while an ideal Haar sample carries about 54.6 bits without smoothing. The proof shows that, up to a total error η, the part of the device’s state with output z is Kz ψ0 , where ψ0 is the initial shared state and Kz is an operator that acts on the device alone and has norm 1

For Haar-random states, R is a continuous classical register; both quantities extend to this case in the standard way, by conditioning on each value of R, and the bound then holds for every finite discretization of ϕ.

8

p

at most poly(q) p(z) for every fixed oracle (Sections 2.3 and 2.5). No new progress measure is needed for this step: the structure comes from the terms that the proof of the score bound discards, and the remaining argument uses only the fact that a device with few queries changes slowly as the oracle changes. Since such operators do not act on Eve’s register, in this nearby state she guesses Z at most poly(q) times as often as she could guess an ideal sample. The theorem is not restricted to deficits that tend to zero: for a constant deficit below √ a threshold it certifies the same number of bits, with a constant smoothing parameter of order δ. Three terms in Theorem 1.2 cannot be removed. First, consider a device that outputs a fixed string known to Eve with probability µ and otherwise runs the honest sampler (Proposition 7.13). For Fourier sampling its deficit is δ = 2(1 − 1/N )µ, but Eve guesses its output with probability at least µ, and every state in which her guessing probability is small is at purified distance at least √ √ about µ from the actual one. Hence the term δ in η has the right order. Second, some bound on the number of queries is necessary, as the squaring algorithm of part 3 of Theorem 1.1 shows. Running it with probability about 1/2, and otherwise outputting a fixed string, uses O(N 1/3 ) queries and attains the ideal score, yet Eve guesses the output with probability about 1/2. Correspondingly, the term q 3/4 N −1/4 in η becomes a constant when q reaches about N 1/3 . In Figure 2(b), the first of these devices lies on the upper edge of the darker region, and the second is the cross on the ideal-score line; part (a) of the figure shows the corresponding picture for the CHSH game, in which the PR box plays the role of the squaring algorithm. Third, neither loss, 2 log2 q for Haar-random states or 4 log2 q for Fourier sampling, can be reduced below 2 log2 q − O(1). Consider the device that makes q queries and uses amplitude amplification to raise the probability that one ideal sample lies in a fixed set of about N/q 2 strings (Proposition 7.14). It loses only O(q −2 + q 4 N −1/2 ) in score, but its output lies in this known set with probability at least 3/4, so its smooth min-entropy is at most n − 2 log2 q + O(1) for every smoothing parameter η ≤ 1/2. Thus the coefficient 2 of log2 q in the Haar bound cannot be lowered, the Haar bound is within log2 n + O(1) bits of this upper bound, and the correct coefficient of log2 q for Fourier sampling lies between 2 and 4. At near-ideal scores, Theorem 1.2 answers the oracle version of the question raised in [AH23], unconditionally and with n − O(log n) bits, the most that can be certified. It goes beyond earlier results in three respects. First, it certifies smooth min-entropy for a single sample, which an extractor can use directly. Against an entangled Eve, the earlier single-round guarantee is about γn bits of von Neumann entropy in a nearby state [AH23, Theorem 7.15 and Corollary 7.16]; the multi-round guarantee uses entropy accumulation [DFR20]. For lists of Fourier samples without quantum side information, the earlier guarantee is n/40 bits for the whole list [BBF+ 26]. Second, in our setting Eve learns the oracle itself. In the earlier model, the device queries C ′ = V CW , where V applies independent random phases and W is Haar-random on the subspace orthogonal to |0n ⟩ and fixes |0n ⟩. These transformations preserve the output distribution of C. Eve learns C, while V and W remain secret; after this averaging, conditioning on C is equivalent to conditioning on its output distribution [AH23, Theorem 7.1]. We have no corresponding result for an Eve who learns a full Haar-random unitary. Third, it covers Fourier sampling against an entangled Eve, which was previously analyzed only for devices that behave as the honest sampler [AH23]. In the other direction, the earlier results apply to any constant advantage over the score 1 of a uniformly random output and to full unitary access, and they include multi-round protocols with finite tests and, under computational assumptions, randomness expansion. The two sets of results are therefore complementary: the earlier ones certify a constant fraction of the randomness from any violation of the classical bound, and ours certify all but O(log n) bits of it within o(1) of the ideal score.

9

(b) The XEB test

1

deterministic Tsirelson’s bound quantum no-signaling

PR box optimal strategy

1/2 3/4

cos2 (π/8)

Eve’s guessing probability

Eve’s guessing probability

(a) The CHSH game

1

ideal score 1

poly(n) queries O(N 1/3 ) queries

known output

1/2

honest sampler

uniform

0 1

2

squaring algorithm 3

expected score

winning probability

Figure 2: Two certification pictures, drawn schematically. (a) In the CHSH game, quantum strategies win with probability at most cos2 (π/8) [Cir80], and for each winning probability Eve’s probability of guessing one party’s output bit, conditioned on the public inputs and her quantum register, is at most the curve shown, which reaches 1/2 at Tsirelson’s bound. This follows from the local-output bound of [PAM+ 10, eq. (6)] by conditioning on Eve’s measurement outcome and using concavity. Mixing a deterministic strategy with the PR box [PR94], a hypothetical device that respects no-signaling and wins with certainty, gives the dashed segment, which meets Tsirelson’s bound at a guessing probability of about 0.79. (b) The analogous picture for the XEB test with a Haar-random state accessed through Oϕ ; Eve’s guessing probability for the honest sampler, about (ln N )/N , is drawn as 0. Mixtures of the uniform output, the honest sampler, and an output known to Eve make at most one query and fill the darker triangle; away from the ideal score, the exact region for polynomially many queries is not determined. With polynomially many queries no device scores more than o(1) above the ideal score (Theorem 1.1), and within o(1) of the ideal score the output has n − O(log n) bits of smooth min-entropy with smoothing η = o(1) (Theorem 1.2). Her actual guessing probability is then at most 2−n+O(log n) + η = o(1), so the region narrows to 0 at the ideal score as n grows. With O(N 1/3 ) queries the squaring algorithm plays the role of the PR box: mixing it with an output known to Eve attains the ideal score while Eve guesses with probability about 1/2, which is the cross. For Fourier sampling the scores 2 and 3 become 3 and 5.

10

Limitations of the randomness result. Theorem 1.2 concerns a single oracle experiment at nearly the ideal score, and several steps separate it from a deployed protocol. Current devices operate far from this regime: the experiment of [AAB+ 19] scored about 1.002, against an ideal score of about 2, whereas Theorem 1.2 needs a deficit small enough that η ≤ 1/2. For such devices, the guarantees of [AH23] are the relevant ones. All of our results are in the oracle model, which is the price of being unconditional. The theorem also assumes a bound on the expected score of the run whose output is certified, whereas a protocol observes the empirical score of finitely many samples, conditions on passing a test, and runs many rounds. In addition, the challenge comes from a truly random oracle rather than from a short seed, so we claim no randomness expansion. Finally, for Haar-random states we need the canonical oracle Oϕ rather than unitary access (Section 2.5). The collision distribution, heavy outputs, and Hadamard products. The output disP tribution of the squaring algorithm is close to the collision distribution rp (z) = p(z)2 / y p(y)2 , that is, the distribution of the common value of two independent samples from p, conditioned on their being equal. The squaring algorithm samples it to within average total variation distance O(N −1/3 ) (Theorem 6.6), where the total variation distance of two distributions a and b is P TV(a, b) = (1/2) z |a(z) − b(z)|. A small error in total variation causes only a small loss in score, although the reward N p(z) of a single outcome can be as large as N . Indeed, the score that a sampler with output distribution a loses relative to rp comes from the outcomes to which a assigns less probability than rp . This missing probability has total mass TV(a, rp ) and is at most rp (z) at each outcome z, so by the √ Cauchy–Schwarz inequality a sampler with√E TV(a, rp ) ≤ ν loses only O( ν) on average over the √ oracle. More precisely, it scores at least 5 − 35ν − o(1) for Fourier sampling and 3 − 12ν − o(1) for Haar-random states, where 5 and 3 are the scores of rp , and Theorem 1.1 then gives the following. Corollary 1.3 (Sampling the collision distribution). For every fixed 0 < ν < 4/35 for Fourier sampling, and every fixed 0 < ν < 1/12 for either form of Haar access, every algorithm with no supplied copies whose output distribution a satisfies E TV(a, rp ) ≤ ν makes Ω(N 1/3 ) queries, while the squaring algorithm makes O(N 1/3 ) queries and has E TV(a, rp ) = O(N −1/3 ). The collision distribution also gives a tight bound for heavy output generation [AC17]. For Haar-random states, honest sampling produces outcomes above the median with limiting probability (1 + ln 2)/2, while the squaring algorithm attains (2 + 2 ln 2 + (ln 2)2 )/4. Every fixed target strictly between these values has query complexity Θ(N 1/3 ) under either form of Haar access without supplied copies (Section 6.7 and Theorem 6.12). This holds for both the empirical median and the fixed median of the marginal probability law, with probability averaged over the oracle and the algorithm’s randomness. Honest sampling already exceeds the original 2/3 heavy-output threshold; the result concerns a fixed improvement over its heavy probability. If the m samples are kept coherent rather than measured, the same idea can be used to prepare the P P quantum Hadamard product of two unknown states z αz |z⟩ and z βz |z⟩, that is, the normalized state with amplitudes proportional to αz βz [HCSS23, HNZM26]. We analyze it when all amplitudes have magnitude N −1/2 . In that case the algorithm keeps its m stored samples of the first state in superposition, amplifies the component in which a fresh sample of the second state agrees with one of them, and then erases the agreeing stored register by a reversible computation instead of measuring 1/3 ) queries it. The result is within trace distance O(N −1/6 ) of the Hadamard product after O(N√ (Theorem 8.1), whereas amplifying the agreement of one copy of each state uses about N queries. For Haar-random inputs we have only a lower bound: since measuring the Hadamard product of |ϕ⟩ with itself samples rp , preparing it to within average trace distance below 1/12 requires Ω(N 1/3 ) queries (Proposition 8.2). 11

1.2

Related work

The complexity-theoretic case for quantum sampling advantage was made in [AA13, BJS11, BMS16, BFNV19, Mov23], and foundations for heavy-output tasks related to XEB, including Fourier sampling as a black-box problem, were developed in [AC17]. Fourier sampling with a function of the form (−1)g(x) , where g is a polynomial of degree 3 over F2 , is the sampling task of a class of instantaneous quantum polynomial-time (IQP) circuits [BJS11, BMS16]; our results concern a uniformly random function and do not address this structured case. Classical algorithms are known to reach nontrivial XEB scores on shallow or noisy circuits [BCG21, GKC+ 24], noisy random circuit sampling admits a polynomial-time classical algorithm in the asymptotic regime [AGL+ 23], and tensor-network methods have produced samples for the circuits of [AAB+ 19] with a comparable score [PCZ22]. Besides protocols based on Bell tests and on sampling, certified randomness can also be obtained from cryptographic single-device protocols [BCM+ 18, MVV22], which are efficiently verifiable but require the device to maintain a superposition while it interacts with the verifier. There are also protocols in the random oracle model based on the proof of quantumness of [YZ24], such as [KRT26, CKM+ 26], whose min-entropy is conditioned on the oracle but not on quantum side information. Independent and concurrent work [JMR26] certifies randomness at the optimal rate in the quantum random oracle model. On the experimental side, a sampling-based protocol was run on a 56-qubit trapped-ion processor, certifying 71,313 bits of smooth min-entropy against a restricted class of adversaries and under the additional assumptions of that experiment [LSN+ 25], and a subsequent experiment demonstrated randomness amplification [LND+ 25]. On the technical side, our Fourier analysis combines the polynomial method [BBC+ 01] with the purified random function of the compressed oracle technique [Zha19]. The generic bound on the size of the recorded set does not by itself control the score; we instead track coherent pair removal in the Fourier basis, as explained in Section 2.2. Path recording [MH25] plays a similar role for Haar-random unitaries, and a polynomial method for unitary oracles was developed in [SY23]. Organization of the paper. Section 2 explains the main arguments, starting with the simplest case, and Section 3 fixes the model and the notation. Section 4 proves the Fourier lower bound and the exact one-query identity, and Section 5 proves the Haar lower bound, including the extension to Haar-random unitary access. Section 6 analyzes the squaring algorithm for both ensembles; it proves part 3 of Theorem 1.1 and Corollary 1.3, and it shows that the empirical score of independent runs rarely falls below any fixed value smaller than its limit (Corollary 6.11). Section 7 proves Theorem 1.2, gives a robust form of the exact privacy statement for one phase query (Proposition 7.8), and constructs the two devices that show which terms of the theorem are necessary (Propositions 7.13 and 7.14). Section 8 treats Hadamard products. Appendix A collects the supporting Haar proofs, the moment calculations, and the proofs for supplied copies. Acknowledgments and AI disclosure. This work was supported by the faculty startup grant of AM at Virginia Tech. The authors conceived the high-level idea of the framework and developed it to obtain the result for Haar-random states, using Claude Opus 5 to discuss ideas, to create early drafts, and to write earlier versions of some sections. When prompted with these ideas, ChatGPT Astra 6.1 produced the main results for Fourier sampling and suggested certified randomness as an extension of the approach. All sections and results were subsequently revised with the help of both Claude Opus 5.5 and ChatGPT Sol 6.1, and the authors take full responsibility for the correctness of the results.

12

2

Technical overview

In this section we explain the main arguments behind our results and defer complete proofs to later sections. All of our lower bounds follow the same plan. We define a progress measure λ that is zero for the honest sampler, show that the score can exceed the ideal p score by at most O(λ + λ2 ), and show that after t queries the next query increases λ by only O( (t + 1)/N ), so that √ 3/2 λ = O(q / N ) after q queries. The randomness theorems are then obtained from the terms that the proof of the score bound discards. Both ensembles follow this plan and differ only in how each step is carried out (Figure 3). We begin with a single query to a random Boolean function, for which both the score and the privacy of an optimal device are given by exact identities, and then treat many queries, first for Fourier sampling and then for Haar-random states. The upper bound, the squaring algorithm, was described in Section 1.1; its analysis in Section 6 uses only amplitude amplification and moment estimates for the two ensembles. The body is organized by result rather than by ensemble: Sections 4 and 5 prove the two lower bounds, Section 6 analyzes the algorithm, and Section 7 proves both randomness theorems.

2.1

Fourier sampling with one query

Consider first an algorithm that makes a single phase query |x⟩ 7→ f (x)|x⟩ to an n-qubit address P register, without control. Its final state is then linear in f , of the form Ψ(f ) = x f (x) vx for fixed vectors vx , and the algorithm outputs z when a final measurement {Πz } gives the outcome z. Since P every f is a linear combination w fb(w)χw of the characters χw (x) = (−1)w·x , such an algorithm is determined by its behavior on single characters. On the input χw , the honest sampler outputs w with certainty, which is the Bernstein–Vazirani algorithm [BV97]. For an arbitrary algorithm of this kind, let σ denote its probability of identifying a uniformly random w from one query to χw . Its score on a random f is then given exactly by B(A) = 1 −

2 + 2σ. N

(3)

For example, an algorithm that ignores the oracle has σ = 1/N and scores 1, while the honest   P sampler has σ = 1. The proof of (3) is elementary. The score is z Ef N pf (z) ∥Πz Ψ(f )∥2 , and both factors are quadratic in f : the reward and the probability of the output z are N pf (z) = N fb(z)2 = ∥Πz Ψ(f )∥2 =

X

1 X χz (x)χz (y)f (x)f (y), N x,y

f (x′ )f (y ′ )⟨vx′ , Πz vy′ ⟩.

x′ ,y ′

Each summand is therefore an average of a product of four values of f , which vanishes unless the four P points match in pairs. Matching x = y and x′ = y ′ contributes z Ef ∥Πz Ψ(f )∥2 = 1; each of the two P ways of matching across the factors, such as x = x′ and y = y ′ , contributes N −1 z ∥Πz Ψ(χz )∥2 = σ; and the case in which all four points coincide, which the three matchings count three times instead of once, contributes −2/N . Since σ ≤ 1, an algorithm that makes one phase query scores at most 3 − 2/N , with equality exactly when it identifies every character. This is the phase-query case of the one-query theorem of [Kre21]. The identity does not hold for a general value query; for example, for n = 1 an algorithm that reads f (1) by a value query with the target qubit in |0⟩ identifies every character but scores only 1. The identity also shows what an optimal device looks like. Suppose that the device shares an arbitrary entangled state |ψ0 ⟩ with Eve, as in Theorem 1.2. If B(A) = 3 − 2/N , then σ = 1, 13

progress measure λ, zero for the honest sampler

score at most the ideal score + O(λ + λ2 )

Fourier: pairs of recorded points Haar: square root of average level

each p query adds O( (t + 1)/N ) to λ

Theorem 1.1: Ω(N 1/3 ) queries

Fourier: a new pair needs an old point Haar: a Dirichlet identity

discarded terms

near-ideal score: branches close to vectors Gz

a q-query device changes slowly with the oracle

Fourier: one point in |χz ⟩ Haar: dependence on the phase of αz

Fourier: Markov’s inequality for polynomials Haar: a hybrid argument

Theorem 1.2: n − O(log n) bits

Figure 3: The structure of the arguments of Section 2. Both lower bounds follow the top row, and both randomness theorems follow the bottom row, which starts from the terms that the proof of the score bound discards. The notes below the boxes indicate how each step is carried out for Fourier sampling and for Haar-random states. and by linearity the part of the state with output z is Πz Ψ(f ) = fb(z) Ψ(χz ). On the fixed input χz the device applies a fixed unitary to its own registers, which leaves the reduced state ρE of Eve unchanged. Hence, if ρfz denotes Eve’s subnormalized reduced state on the output-z branch Πz Ψ(f ), whose trace is the probability of the output z, then ρfz = pf (z) ρE

for every f and z.

(4)

Thus the output is an exact sample from pf and is independent of Eve’s register, even given f . Our main theorems are robust versions of (3) and (4) for algorithms that make many queries; for a single phase query, a robust form of (4) itself is given in Proposition 7.8.

2.2

The Fourier lower bound

With many queries there is no classical record of what the algorithm has learned, since it queries in superposition and a later query can undo an earlier one. We therefore purify the random function, as in the compressed oracle technique [Zha19]. This makes the pairing argument of Section 2.1 systematic: a product of values of f has nonzero mean only if every point occurs in it an even number of times, and the purifying register records, in superposition, the set of points that occur an odd number of times. This purifying register, from which each query reads the value f (x), starts in the uniform superposition over all functions f . Its Fourier basis consists of the vectors
P Q |S⟩ = 2−N/2 f x∈S f (x) |f ⟩, indexed by the sets S ⊆ {0, 1}n , and multiplying by f (x) maps |S⟩ to |S△{x}⟩. A query to the address x (on the part of the state where the target qubit is |−⟩) therefore adds x to the recorded set S if it is absent and removes it if it is present. Consequently, P after t queries the joint state has the form |S|≤t |S⟩ ⊗ |ΨS ⟩, where the vectors |ΨS ⟩ are the Fourier coefficients of the state of the algorithm, viewed as a polynomial in f as in the polynomial method [BBC+ 01]. We write Ψ for the final joint state and Ψz = Πz Ψ for its output-z branch. The score in terms of recorded points. Let ax be the operator that removes the point x from the recorded set, and maps to zero the states in which x is not recorded, so that multiplication by f (x) acts on the register as ax + a†x . The reward of the output z is N fb(z)2 , and the √ P normalized Fourier coefficient N fb(z) = N −1/2 x χz (x)f (x) acts as bz + b†z , where the operator 14

bz = N −1/2 x χz (x) ax removes one recorded point with the amplitudes of the Hadamard basis state P |χz ⟩ = H ⊗n |z⟩ = N −1/2 x χz (x)|x⟩. Since the squared norm of √ a joint state is the average over f of the squared norm of the algorithm’s state, the squared norm of N fb(z)Ψz is Ef N fb(z)2 ∥Ψz (f )∥2 , P the contribution of the output z to the score. Hence B(A) = z ∥(bz + b†z )Ψz ∥2 , and expanding the square gives X X 2 B(A) = 1 − E|S| + 2 ∥bz Ψz ∥2 + 2 Re ⟨Ψz , b2z Ψz ⟩, (5) N z z P

where E|S| is the expected number of recorded points in the final state; the small correction −(2/N )E|S| appears because a point cannot be recorded twice. For one phase query, exactly one P point is recorded, so the interference term vanishes, the quantity z ∥bz Ψz ∥2 equals σ, and (5) reduces to (3). The honest sampler makes one query and then applies Hadamard gates, so each of its output-z branches holds exactly one recorded point, in the state |χz ⟩, which gives the score 1 + 2 − 2/N . Pairs of recorded points as the progress measure. The recorded set has size at most the number of queries, but a query can either add or remove a point, and the size alone does not control the score. We instead track the amplitudes with which b2z removes two recorded points. The score bound below will show that exceeding the ideal score requires b2z Ψz ̸= 0 for some branch. The relevant exact inequality is ∥bz g∥2 ≤ ∥g∥2 + ∥b2z g∥2

for every vector g,

(6)

since the difference between the two sides equals ∥(b†z bz − I)g∥2 plus a nonnegative correction. In P particular, ∥bz g∥2 > ∥g∥2 implies b2z g ̸= 0. Since z ∥bz Ψz ∥2 ≤ E|S| by the orthogonality of the P characters, the negative term −(2/N )E|S| in (5) is at most −(2/N ) z ∥bz Ψz ∥2 , which turns the factor 2 in front of that sum into 2(1 − 1/N ). Applying (6) to each branch and bounding the interference term by the Cauchy–Schwarz inequality, we obtain B(A) ≤ 3 −

 2 1 2 + 2λ + 2 1 − λ , N N

λ=

X

∥b2z Ψ∥2

1/2

.

(7)

z

Our progress measure λ is the norm of the family (b2z Ψ)z , whose members coherently remove pairs of recorded points with amplitudes determined by χz . It is evaluated on the whole final state rather than branch by branch, because the projections Πz belong to the final measurement, whereas λ has to be tracked after every query. Because λ vanishes as long as at most one point is recorded, every algorithm that makes one query, of any kind, scores at most 3 − 2/N ; this recovers the one-query bound mentioned in Section 2.1 in full generality. Growth of the progress measure. It remains to show that pairs form slowly. Unitaries applied between queries do not act on the recording register, so only queries change λ. The difference 2 before and after a query that toggles x removes one other recorded point, with between applying b√ z coefficient 2χz (x)/ N and a sign determined by whether x is recorded. The factor 2 counts the two orders of removal. By Parseval’s identity, the squared norms after removing this other point sum to at most t over all Hadamard basis states. The address components of a query are orthogonal, so the total squared norm of this difference is at most 4t/N , summed over z and the addresses. The query itself preserves the norm of the existing family (b2z Ψ)z , so the triangle inequality gives q

λt+1 ≤ λt + 2 t/N ,

q−1

hence

15

2 X√ 4 q 3/2 λ≤ √ t≤ ·√ , 3 N t=0 N

(8)

where λt denotes the progress after t queries. Together with (7), this proves part 1 of Theorem 1.1: a score of 3 + ε with 0 < ε ≤ 4 forces λ ≥ ε/4, and hence q ≥ (3ε/16)2/3 N 1/3 . The squaring algorithm shows that √ the order of the growth bound is tight up to a constant factor: its score of nearly 5 forces λ ≥ ( 5 − 1)/2 − o(1) by (7), while it uses O(N 1/3 ) queries.

2.3

Near-optimal randomness from Fourier sampling

We now explain why a near-ideal score makes the output unpredictable. In the warm-up, the ideal score forced each branch to be fb(z) times the state of the device on the fixed input χz , and on a fixed input the device leaves Eve’s state unchanged. With many queries this holds only approximately, and we use two tools to make the argument robust. The first is the term ∥(b†z bz − I)g∥2 in the gap between the two sides of (6), which the proof of the score bound discarded. The second is Markov’s inequality for polynomials [BE95], which states that a polynomial of degree d that is bounded by 1 on [−1, 1] has derivative at most d2 there. We need only the case of the endpoint 1, and its proof extends without change to operator-valued polynomials (Lemma 7.5). Let the device and Eve share a pure state |ψ0 ⟩ on registers A and E, let ρE be the reduced state of Eve, and let the device apply a unitary Vf to A, which is the form of every device after the purification of Lemma 3.2. Suppose that B(A) ≥ 3 − 2/N − δ. The structure of the branches at a near-ideal score. The quantity ∥(b†z bz − I)Ψz ∥2 measures how far a branch is from satisfying b†z bz Ψz = Ψz , the equation that holds for a branch with exactly one recorded point in the state |χz ⟩, as for the honest sampler. If we keep this quantity in the proof of (7), a score deficit δ and a small progress measure force X

∥(b†z bz − I)Ψz ∥2 ≤

z

δ + O(λ + λ2 ). 2 − 2/N

Consequently, the branches are close to the vectors Gz = (bz + b†z ) bz Ψz , obtained √ from Ψz by removing one recorded point with the amplitudes of |χz ⟩ and multiplying by N fb(z); indeed, Ψz − Gz = (I − b†z bz )Ψz − b2z Ψz , and both terms are small. In total, X

∥Ψz − Gz ∥2

1/2

≤ η,

√ η=

δ + O q 3/4 N −1/4

for q ≤ N 1/3 .

(9)

z

The rate of change of a q-query device. For a fixed f , removing a recorded point with the amplitudes of |χz ⟩ corresponds to differentiating the unique multilinear extension of the state in the √ normalized direction χz / N . All derivatives below are taken in the unique multilinear extension of f 7→ Vf . Since |ψ0 ⟩ does not depend on f , the vector Gz is therefore the initial state acted on by the operator √ X ∂Vf Kz = N fb(z) Πz ∂χz Vf , ∂χz Vf = N −1/2 χz (x) , ∂f (x) x √ on the device alone, where ∂χz Vf denotes the derivative at f in the direction χz / N . Because Eve knows f , we need a bound on Kz for every f , not only on average. The unitary Vf is a polynomial of degree at most q in the values f (x), and its multilinear extension to the cube [−1, 1]N takes values √ that are averages of unitaries, so it has norm at most 1 on the cube. The normalized direction χz / N has an entry of magnitude N −1/2 at each address. Let I+ and I− be the sets of addresses at which χz agrees or disagrees with f . Multiplying the values of f on I+ , or on I− , by a factor t ∈ [−1, 1] keeps the point in the cube, and ∂χz Vf is N −1/2 16

times the difference of the derivatives at t = 1 of the two resulting polynomials of degree at most √ q. 2 2 Markov’s inequality for polynomials bounds each of these derivatives by q , so ∥∂χz Vf ∥ ≤ 2q / N , and hence ∥Kz ∥2 ≤ 4q 4 pf (z). Apart from the score bound and the growth estimate, this is the only step that uses the assumption that the device makes few queries. Bounding the knowledge of Eve. An operator that acts on the device alone cannot make any measurement outcome of Eve more likely than ∥Kz ∥2 times its probability on her initial state. Hence, for any initial entanglement and any measurement that Eve performs, PrGz [m] ≤ 4q 4 pf (z) PrρE [m]

for every outcome m and all f and z,

(10)

where PrGz [m] denotes the unnormalized weight of outcome m on the vector Gz , and PrρE [m] is its probability on Eve’s initial state; this is the robust form of (4). The actual branches need not satisfy such a bound, because a device may output a fixed string P with small probability, and so we pass to a nearby state. We normalize the vector z |z⟩ ⊗ Gz , in which the first register holds z, measure the purifying register of f in the basis {|f ⟩}, which gives Eve the function f , and discard the device. The resulting state of f , z, and Eve’s register is within P purified distance η of the actual one. Indeed, the unit vector z |z⟩ ⊗ Ψz is within distance η of P z |z⟩ ⊗ Gz , so the sine of its angle with the normalized vector is at most η (Proposition 7.1), and measuring or discarding registers does not increase the purified distance [TCR10]. In this state, if P η ≤ 1/2, so that the normalizing factor z ∥Gz ∥2 is at least 1/4, then (10) implies that Eve guesses Z with probability at most O(q 4 ) Ef max pf (z) = O(q 4 n/N ), z

which is O(q 4 ) times her probability of guessing an ideal sample. Taking logarithms gives the Fourier case of Theorem 1.2.

2.4

The lower bound for Haar-random states

For a Haar-random state |ϕ⟩ = x αx |x⟩, we write px = |αx |2 . We first consider algorithms with no supplied copies of |ϕ⟩. After t queries to Oϕ , the state is a polynomial of total degree at most 2t in the amplitudes and their conjugates. More generally, with s supplied copies, its degree is at most s + 2t (Lemma 5.1). The plan of Section 2.2 carries over; the main difference lies in the choice of the progress measure. P

The normalization obstacle. For Fourier sampling, progress was measured by pairs of recorded points. The natural analogue for Haar-random states is a repeated amplitude, as in αz2 or αz αz = pz , which is the coherent counterpart of seeing the outcome z twice. However, every term of the P normalization x px = 1 repeats an amplitude, although the sum itself is a constant, and the oracle produces such sums at every query. For example, two queries applied to |⊥⟩ return |⊥⟩, P P yet the second query, expanded in the amplitudes, gives Oϕ |ϕ⟩ = ( x px )|⊥⟩ + (1 − x px )|ϕ⟩. We therefore measure the dependence on the probabilities px by the degree in an expansion in orthogonal polynomials. Like the Fourier degree of a Boolean function, this degree depends only on the function and not on the way in which it is written, so the normalization has degree zero. The level and the progress measure. Two properties of the Haar measure make this approach √ work. Write αx = px eiθx . The phases θx are independent and uniform, so two terms are orthogonal unless, at every x, the number of factors αx minus the number of factors αx is the same in both

17

terms. Moreover, independently of the phases, the vector p is uniform on the probability simplex, that is, it has the Dirichlet distribution with all parameters equal to 1. In a term with k unpaired factors αx (or αx ), these factors contribute pkx to the squared magnitude of the term, which reweights the distribution of p exactly as if x had been observed k times, and the result is again a Dirichlet distribution. We expand the rest of the term in orthogonal polynomials for that distribution, and we define the level of the term as its degree in this expansion plus, for each outcome, the number of unpaired factors at that outcome beyond the first. The first unpaired factor at an outcome is not counted, because every branch αz |z⟩ of the honest sampler has one. Thus αx αy with x ̸= y, and the normalization, have level zero, while αx2 and px − 1/N have level one. Our progress measure is the square root of the average level, λ=

X

k ∥Pk Ψ∥2

1/2

,

k

where Pk denotes the projection onto the part of the state of level k. For s copies of |ϕ⟩, the quantity λ2 is exactly the expected number of measured copies that repeat an earlier outcome, namely s(s − 1)/(N + s − 1) (Lemma 5.5). The argument therefore also applies to algorithms that receive s copies in addition to making√q queries, and shows that exceeding the ideal score by a √ constant requires s + q s + q + 1 = Ω( N ) (Corollary 5.7). With s = 0, the query contribution is of order q 3/2 , which explains the N 1/3 lower bound. The score in terms of the level. A state of level zero scores at most the ideal score 2N/(N + 1). Its terms contain each outcome at most once. Since the reward N pz does not depend on the phases, different terms do not interfere, and each term is correlated with N pz only through a single factor αz or αz . This factor shifts the distribution of pz as one observed sample would, which raises the mean of N pz to at most 2N/(N + 1). A term of positive level can score more, but only by an amount proportional to its level, because a polynomial of low degree cannot concentrate its weight where pz is large. Finally, the interference between the part of level zero and the rest involves only the fluctuation of N pz around its mean, which has variance at most 2, so by the Cauchy–Schwarz inequality it contributes O(λ). Altogether, B(A) ≤

2N + O λ + λ2 . N +1

(11)

√ The effect of one query on the level. Write Oϕ = I − 2|ηϕ ⟩⟨ηϕ | with |ηϕ ⟩ = (|⊥⟩ − |ϕ⟩)/ 2. Returning to the no-copy case, consider a term of total degree d in the amplitudes and their conjugates, so that d ≤ 2t after t queries. Each new factor raises the level by at most one, and it can do so only when it falls on an outcome that already appears in the term; a factor at a fresh outcome does not raise the level. When the new factor does fall on an occupied outcome, either it repeats an unpaired factor of the same kind or it pairs with a conjugate factor, and the two cases need different arguments. In the first case, only an O((d + 1)/N ) fraction of the weight moves up a level. Indeed, a term of degree d has unpaired factors on at most d outcomes, and a polynomial of degree at most d in p cannot concentrate on a few outcomes, so these outcomes carry only an O(d/N ) fraction of its weight (Lemma 5.8). If instead the new factor pairs up with a conjugate factor, it creates px , and in the step that applies ⟨ϕ| the resulting terms are summed over x, which can bring back the normalization. These terms must therefore be bounded together, and for this purpose we prove an identity that concerns only the Dirichlet distribution and its orthogonal polynomials.

18

Observing one more sample x from p turns a Dirichlet prior into a Dirichlet posterior, and this is how a new factor at x reweights a term. Let |a| ≥ N be the sum of the parameters of the prior. We show that, on average over x with probability ax /|a|, an orthogonal polynomial of exact degree r ≥ 1 for the prior has a fraction r/(|a| + 2r − 1) ≤ r/N of its prior squared norm in degree r − 1 for the posterior, and none in lower degrees. The identity follows from integration by parts on the simplex. For background on orthogonal polynomials for Dirichlet distributions, see [DX14, GS11]. P By duality, it shows that when ⟨ϕ| is applied to x αx hx |x⟩, where each hx has degree at most P r, the part of the result x px hx of degree r + 1 carries at most a fraction (r + 1)/N of the√weight of √ Since λ is the norm of the state in which the part of level k is multiplied by k, and √ the input. k + 1 − k ≤ 1, each of the two steps changes λ by at most the norm of the part of the state that it moves up a level plus the norm of the part that it moves down a level, and the second part is bounded by applying the same estimates to the adjoint p step (Lemma 5.19). p Together, the two cases show that a query, √ controlled or not, raises λ by O( (d + 1)/N ) = O( (t + 1)/N ) after t queries. Hence λ = O(q 3/2 / N ) after q queries, and (11) gives part 2 of Theorem 1.1. Extension to Haar-random unitary access. For each fixed ϕ, q queries to a random unitary √ n U with U |0 ⟩ = |ϕ⟩ can be simulated by 2q queries to Oϕ with error O(q/ N ) [Kre21, Theorem 19]. This changes the score by at most the error times the largest reward N maxz pz , whose average is ln N + O(1). The squaring algorithm only prepares |ϕ⟩ and reflects about it, so it runs unchanged with U .

2.5

Near-optimal randomness for Haar-random states

The three steps of Section 2.3 carry over to this setting, with the phase θz of αz in place of the Fourier coefficient, and the main change is in the second step. First, the part of the output-z branch that does not depend on θz consists of the terms with no unpaired factor at z. At level zero these terms score at most 1, well below the ideal score, because without a factor at z the reweighting does not favor z. The part of positive level has weight at most λ2 , so a near-ideal score forces the √ branches to equal their θz -dependent parts Gz up to a total error η = O( δ + q 3/4 N −1/4 ). Second, unlike a Fourier coefficient, the phase θz can be changed without leaving the ensemble. √ Rotating it moves |ϕ⟩ by at most 2 pz , so, when the oracle is replaced one query at a time, the √ unitary of the device changes by O(q pz ). Hence Gz , which is the branch minus the average of its copies with the phase θz rotated, is the initial state acted on by an operator on the device of norm √ O(q pz ); this hybrid argument takes the place of Markov’s inequality for polynomials. Third, as in (10), the unnormalized weight of every outcome of a measurement of Eve on Gz is at most O(q 2 ) pz times its probability on her initial state. Since E maxz pz = (ln N + O(1))/N , we obtain the Haar case of Theorem 1.2. The factor q 2 , instead of the factor q 4 that Markov’s inequality gives, is the reason why the bound loses 2 log2 q bits here but 4 log2 q bits for Fourier sampling. The argument does not extend to an Eve who learns a full Haar-random unitary U . Our score bound for unitary access averages over the columns of U other than ϕ, which such an Eve knows, and a device can correlate its output with these columns. For instance, a device that applies U to its half of a maximally entangled state shared with Eve produces a uniform output that Eve, knowing U , recovers exactly. That device scores only 1, but a proof for this setting would have to rule out such correlations at the ideal score.

19

3

Preliminaries

3.1

Notation and query algorithms

Throughout, n ≥ 1 and N = 2n . We identify {0, 1}n with [N ] = {1, . . . , N } when convenient, and we write z · x for the inner product of z, x ∈ {0, 1}n modulo 2. Logarithms are to base 2 unless written ln. Inner products ⟨u, v⟩ are conjugate-linear in the first argument, ∥v∥ is the norm of a vector, and ∥T ∥ is the operator norm of an operator T . For a positive semidefinite operator M , we write Tr M for its trace. All Hilbert spaces are finite-dimensional, except for the spaces of square-integrable functions on the simplex that are defined in Section 3.3 and used in Section 5. The oracle of an experiment is denoted ω when we do not need to specify the ensemble; it is a function f in the Fourier ensemble and a state ϕ in the Haar ensemble. We write pω for the ideal distribution on {0, 1}n that the oracle determines, and Oω for the unitary through which it is accessed, namely Of of (14) or Oϕ of (16). The Fourier ensemble. The oracle is a uniformly random function f : {0, 1}n → {−1, 1}, so that the N values f (x) are independent uniformly random signs. For z ∈ {0, 1}n , let χz (x) = (−1)z·x denote the characters, which satisfy χz (x)χz (y) = χz (x ⊕ y) and the orthogonality relations X

X

χz (x)χz (y) = N 1[x = y],

z

χz (x)χw (x) = N 1[z = w].

(12)

x

The Fourier coefficients and the ideal distribution are fb(z) =

1 X χz (x)f (x), N x

pf (z) = fb(z)2 ,

(13)

P

and z pf (z) = 1 for every f by Parseval’s identity, which follows from (12). The algorithm accesses f through the value oracle Of |x, b⟩ = |x, b ⊕ (1 − f (x))/2⟩,

x ∈ {0, 1}n , b ∈ {0, 1},

(14) √ which acts on an address register of n qubits and a target qubit. In the basis |+⟩ = (|0⟩ + |1⟩)/ 2, √ |−⟩ = (|0⟩ − |1⟩)/ 2 of the target qubit, the oracle acts as Of |x⟩|+⟩ = |x⟩|+⟩,

Of |x⟩|−⟩ = f (x)|x⟩|−⟩,

(15)

because flipping the target qubit leaves |+⟩ unchanged and multiplies |−⟩ by −1. We call a query in which the target qubit is in the state |−⟩ a phase query. The operator Of is a permutation of the computational basis with Of2 = I, so it is unitary, Hermitian, and its own inverse. The Haar ensemble. The oracle hides a uniformly random unit vector |ϕ⟩ = x∈[N ] αx |x⟩ in CN , and the ideal distribution is pϕ (x) = |αx |2 . The ensemble is a distribution on unit vectors rather than on rays: the global phase of |ϕ⟩ matters, because the oracle below swaps |ϕ⟩ with a fixed vector, so that |ϕ⟩ and eiθ |ϕ⟩ give different oracles. The query register is Q = C|⊥⟩ ⊕ CN , where |⊥⟩ is a fixed unit vector orthogonal to CN . The canonical state-preparation oracle is P

Oϕ = I − 2|ηϕ ⟩⟨ηϕ |,

|ηϕ ⟩ =

20

|⊥⟩ − |ϕ⟩ √ , 2

(16)

which is the reflection about the hyperplane orthogonal to |ηϕ ⟩. Expanding the projection gives Oϕ = I − |⊥⟩⟨⊥| + |⊥⟩⟨ϕ| + |ϕ⟩⟨⊥| − |ϕ⟩⟨ϕ|,

(17)

so Oϕ swaps |⊥⟩ and |ϕ⟩ and acts as the identity on the vectors orthogonal to both |⊥⟩ and |ϕ⟩. Like Of , it is unitary, Hermitian, and its own inverse. The expansion (17) also shows how the hidden amplitudes enter: in the basis {|⊥⟩, |1⟩, . . . , |N ⟩} of Q, every matrix entry of Oϕ is a polynomial of degree at most two in the amplitudes αx and their conjugates αx , each factor |ϕ⟩ contributing one αx and each factor ⟨ϕ| one αx . With Haar-random unitary access, the algorithm may instead apply a Haar-random unitary U on CN , its inverse U † , and controlled versions of both, and the state scored is |ϕ⟩ = U |0n ⟩. Both forms of access are the models of [Kre21], and the second is at least as strong as the first, since Oϕ can be built from one controlled application of U † and one of U with the help of one ancilla qubit. To build Oϕ in this way, identify |⊥⟩ with |0⟩|0n ⟩ and |x⟩ with |1⟩|x⟩, and let cU = |0⟩⟨0| ⊗ I + |1⟩⟨1| ⊗ U be U controlled by the ancilla. Then cU † |ηϕ ⟩ = |−⟩|0n ⟩ for the vector |ηϕ ⟩ of (16), so I − 2|ηϕ ⟩⟨ηϕ | = cU I − 2|−⟩⟨−| ⊗ |0n ⟩⟨0n | cU †

on all of C2 ⊗ CN . This operator is Oϕ on the embedded register. The middle factor swaps |0⟩|0n ⟩ with |1⟩|0n ⟩ and fixes every |1⟩|x⟩ with x ̸= 0n , and it uses no query. The expected score. For an oracle ω with ideal distribution pω , the expected score of an algorithm A that outputs Z ∈ {0, 1}n is B(A) = Eω

X

Pr[Z = z | ω] N pω (z),

(18)

z

which is (1). We call N pω (z) the reward of the outcome z, so that the score is the expected reward of the output. Outputting a uniformly random string, or a fixed string, gives B(A) = 1, because P z pω (z) = 1 and Eω pω (z) = 1/N for every z. The honest sampler is the one-query algorithm that prepares a state whose measurement in the computational basis has the distribution pω and measures it. In the Fourier ensemble it applies Hadamard gates, a phase query, and Hadamard gates to |0n ⟩, as in Section 1, and in the Haar ensemble it applies Oϕ to |⊥⟩. It outputs z with probability pω (z), and its expected score, the ideal score, is ( X 3 − 2/N in the Fourier ensemble, 2 Eω N pω (z) = (19) 2N/(N + 1) in the Haar ensemble; z these values are computed in Lemma 6.2, and from Section 5 on we write βN = 2N/(N + 1) for the ideal Haar score. No algorithm scores more than Eω N maxz pω (z), a value that is approached by algorithms that learn the oracle; it is ln N + O(1) in the Haar ensemble (Lemma 5.24) and at most 2(n + 2) in the Fourier ensemble (Lemma 7.7). 3.1.1

Query algorithms and a reduction to controlled queries

We now describe the most general experiment that our theorems concern. It includes an adversary, Eve, who may share an entangled state with the device; the theorems about the score alone are the special case in which Eve’s register is trivial. Throughout, device and algorithm refer to the same party, the one that makes the queries; we denote it by A, so that B(A) in (18) is the expected score of the device in the experiment. 21

Definition 3.1 (The experiment). Fix q ≥ 0 and one of the two ensembles. 1. The device holds a register A and Eve holds a register E, both of finite dimension, and they start in a joint state ρAE that does not depend on the oracle. The oracle ω is then drawn. 2. The device applies oracle-independent operations to A and makes at most q queries along every path of its computation, which consists of finitely many steps. An operation may adjoin ancillas in fixed states, apply unitaries, and perform measurements whose outcomes are appended to a classical record kept in A, and every operation and every query may depend on the record produced before it. 3. A query applies Oω to a register of A of the appropriate type, chosen according to the record, possibly controlled by a qubit of A. Since Oω is its own inverse, inverse queries are the same operation. 4. The output Z ∈ {0, 1}n is a function of the final record. No operation acts on E, and nothing is sent from A to E. After Z has been produced, Eve receives a complete classical description of ω in a register R: the truth table of f , or the vector ϕ. Classical randomness of the device is included in ρAE , and so is any randomness shared with Eve. Haar-random unitary access, in which U and U † are distinct operations, is not covered by this definition and is reduced to the canonical oracle in Section 5.6. For each oracle ω and each z, the experiment determines the subnormalized state ρωz of Eve’s register on the event Z = z, whose trace is Pr[Z = z | ω]. Since nothing acts on E, we have P ω z ρz = ρE for every ω, where ρE is the reduced state of E in ρAE , although Z may be correlated with E. The next lemma puts every such experiment into a form with a fixed sequence of controlled queries, which is the form used in the proofs. Lemma 3.2 (Reduction to a fixed sequence of controlled queries). Consider an experiment as in Definition 3.1. There are (a) a finite-dimensional register A′ , which contains a query register Q of the type on which Oω acts and a control qubit C, (b) a unit vector ψ0 ∈ A′ ⊗ E whose reduced state on E is ρE , (c) oracle-independent unitaries U0 , . . . , Uq on A′ , and (d) orthogonal projections {Πz }z∈{0,1}n on A′ with

P

z Πz = I,

with the following property. Let Oωc = |0⟩⟨0|C ⊗ I + |1⟩⟨1|C ⊗ Oω

(20)

act on C and Q and trivially on the rest of A′ , and put Vω = Uq Oωc Uq−1 Oωc · · · U1 Oωc U0 .

(21)

Then, for every oracle ω and every z, h

i

ρωz = TrA′ (Πz Vω ⊗ IE )|ψ0 ⟩⟨ψ0 |(Πz Vω ⊗ IE )† ,

22

2

Pr[Z = z | ω] = (Πz Vω ⊗ IE )ψ0 .

(22)

Proof. We modify the experiment in four steps, none of which changes the subnormalized state of E on the event Z = z, for any ω and z. Step 1: the record as a register and the query rounds. Regard the classical record as a register K of A with an orthonormal basis {|r⟩} indexed by the possible records, which are finitely many because the computation has finitely many steps and every measurement has finitely many outcomes, and let the record include the number of queries made so far along its path. At every stage, the state of AE is block diagonal, of the form X

|r⟩⟨r|K ⊗ σr .

r

We group the computation into q query rounds and a final round. Along a path, the rounds are as follows. (i) For 1 ≤ k ≤ q, the k-th round consists of everything the device does after its (k − 1)-st query, up to and including its k-th query, and the final round consists of what remains after the q-th query. (ii) If the path makes exactly j < q queries, then the (j + 1)-st round consists instead of everything after its j-th query up to the end of the computation, and the rounds after the (j + 1)-st, including the final round, are empty. Within a round, the operations other than the query, together with the recording of their outcomes, compose into a single oracle-independent completely positive trace-preserving map on A, possibly on an enlarged A, because every operation is selected by the record and the record grows with every outcome. The query of the k-th round is the unitary X

|r⟩⟨r|K ⊗ Qrω ,

r

where Qrω is the identity if the path r makes fewer than k queries, and otherwise Oω acting on the registers selected by r, possibly controlled by the qubit selected by r. On block-diagonal states these maps act exactly as the record-dependent operations of the experiment, and they are oracle-independent except for the queries. Step 2: a fixed query register. Adjoin a register Q of the type on which Oω acts and a qubit C, both in fixed states. Let S r be the oracle-independent unitary that swaps the registers selected by r into Q and acts on C as follows. (i) If the query of the path r is controlled, then S r swaps the control qubit selected by r into C. (ii) Otherwise, since C starts in the fixed state |0⟩, the unitary S r flips it to |1⟩ if the path makes a query and leaves it in |0⟩ if it does not. Then the operator W =

r |r⟩⟨r|K ⊗ S

P

r is an oracle-independent unitary, and

W † Oωc W =

X

|r⟩⟨r|K ⊗ Qrω

r

on every state that is block diagonal in K and has Q and C in their fixed states, which includes every state that occurs in the computation. The identity holds because, on each block r, the factor W , which acts first, moves the relevant registers into position, the controlled query acts on them exactly as Qrω does, and W † moves them back. 23

Since Oωc does not act on K, both applications of W are controlled by the same value of the record. Thus every query step is Oωc conjugated by oracle-independent unitaries, and these unitaries are absorbed into the operations before and after the query. Step 3: dilation and purification. Replace each oracle-independent completely positive tracepreserving map by a Stinespring isometry whose environment register is kept by the device and never acted on again. This does not change the reduced state of the other registers at any later time, because all later operations act trivially on the environment. Purify ρAE with a register that is kept by the device and never acted on. Include every register that is adjoined during the experiment in the initial state, each in its fixed state. The result is a register A′ and a unit vector ψ0 ∈ A′ ⊗ E whose reduced state on E is ρE , and the device now applies, alternately, oracle-independent unitaries on A′ and the controlled query Oωc on CQ, that is, it applies Vω of (21). A path that makes fewer than q queries has C in the state |0⟩ at the remaining query rounds. Step 4: the output. Extend the output function Z arbitrarily to the records that cannot occur at the end of the computation, and let Πz be the projection onto the records r with Z(r) = z, tensored P with the identity on the other registers of A′ , so that z Πz = I. After Step 3, the reduced state of K, the original registers of A, and E at the end of the computation equals the final state of the original experiment, and it is block diagonal in K. Therefore the partial trace in (22) is the sum of the E-parts of the blocks with Z(r) = z, which is ρωz . Its trace is Pr[Z = z | ω]. From now on we write A for the register A′ of Lemma 3.2. We refer to Ψ(ω) = (Vω ⊗ IE )ψ0 as the final state of the device for the oracle ω, and to Ψz (ω) = (Πz ⊗ IE )Ψ(ω) as its output-z branch. In this notation the expected score (18) reads B(A) = Eω

X

N pω (z) ∥Ψz (ω)∥2 .

(23)

z

A query that is controlled by C in the state |1⟩ is an ordinary query, so the lemma also covers algorithms that query without control, and in particular the honest samplers of both ensembles. 3.1.2

Amplitude amplification

The squaring algorithm of Section 6 and the state-preparation algorithm of Section 8 use amplitude amplification in the following standard form [BHMT02]. Lemma 3.3 (Amplitude amplification). Let ψ be a unit vector in a Hilbert space, let Π be an orthogonal projection, and let P = ∥Πψ∥2 > 0. (i) If P = 1, then
ℓ

(2|ψ⟩⟨ψ| − I)(I − 2Π) ψ = (−1)ℓ ψ for every integer ℓ ≥ 0. (ii) If P < 1, put √ ϑ = arcsin

(I − Π)ψ u⊥ = √ , 1−P

Πψ u= √ , P

P ∈ (0, π/2),

so that ψ = sin ϑ u + cos ϑ u⊥ ; then, for every integer ℓ ≥ 0,
ℓ

(2|ψ⟩⟨ψ| − I)(I − 2Π) ψ = sin (2ℓ + 1)ϑ u + cos (2ℓ + 1)ϑ u⊥ .

24

Proof. If P = 1, then Πψ = ψ, so (I − 2Π)ψ = −ψ and (2|ψ⟩⟨ψ| − I)(−ψ) = −ψ. For (ii), let 0 < P < 1. The vectors u and u⊥ are orthonormal, and the plane they span contains ψ and is invariant under both reflections. Indeed, I − 2Π fixes u⊥ and negates u, while 2|ψ⟩⟨ψ| − I fixes ψ and negates the vector cos ϑ u − sin ϑ u⊥ orthogonal to it. On this plane, in the basis (u, u⊥ ), the product of the two reflections has the matrix !

cos 2ϑ sin 2ϑ , − sin 2ϑ cos 2ϑ which is the rotation by the angle 2ϑ that takes u⊥ toward u; here xu + yu⊥ is written (x, y), and the first column is the image of u. By the addition formulas the matrix maps (sin α, cos α) to (sin(α + 2ϑ), cos(α + 2ϑ)) for every α; in particular it maps ψ = (sin ϑ, cos ϑ) to (sin 3ϑ, cos 3ϑ), and induction on ℓ gives the claim.

3.2

Min-entropy, fidelity, and purified distance

The oracle register R is finite in the Fourier ensemble and continuous in the Haar ensemble. To treat both cases at once, we describe the joint state of R, Z, and E by the family of Eve’s conditional states. Definition 3.4 (Families of positive operators and entropies). A family of positive operators is a map, measurable with respect to the distribution of the oracle, ω 7→ (τzω )z∈{0,1}n from oracles to tuples of P positive semidefinite operators on E. It is normalized if Eω z Tr τzω = 1. This normalization is joint over the oracle and output; the total trace for each fixed oracle need not be 1. For normalized families ρ and τ define pguess (Z | RE)τ = Eω sup M

X

Tr(Mz τzω ),

z

Hmin (Z | RE)τ = − log pguess (Z | RE)τ , F (ρ, τ ) = Eω

X p z

P (ρ, τ ) =

p

ρωz τzω 1 ,

q

1 − F (ρ, τ )2 ,

where the supremum is over all measurements M = (Mz )z on E,√that is, over all tuples of positive P semidefinite operators with z Mz = IE , and where ∥T ∥1 = Tr T † T is the trace norm. For 0 ≤ η ≤ 1, the smooth min-entropy is η Hmin (Z | RE)ρ = sup Hmin (Z | RE)τ : τ a normalized family with P (ρ, τ ) ≤ η .



Here F (ρ, τ ) ≤ 1, because p

ρωz τzω 1 ≤ Tr ρωz Tr τzω p

1/2

,

and the Cauchy–Schwarz inequality over ω and z, together with the normalization of both families, bounds the sum by 1. The family that describes an experiment consists of the states ρωz of Definition 3.1, and it is P normalized since z Tr ρωz = 1 for every ω. In this family, pguess (Z | RE)ρ is the largest probability with which Eve, who knows ω and holds E, guesses Z, since she may choose her measurement as a function of ω. The integrands in Definition 3.4 are measurable functions of ω, because the supremum may be taken over a countable dense set of measurements, and the trace norm is continuous. 25

Remark 3.5 (Relation to the standard definitions). When the set of oracles is finite, as in the Fourier ensemble, a normalized family is the same thing as a density operator τRZE =

X

µ(ω)|ω⟩⟨ω|R ⊗ |z⟩⟨z|Z ⊗ τzω

ω,z

that is classical on R and Z, where µ(ω) is the probability of the oracle ω. In this case, the quantities above are the standard ones: Hmin (Z | RE)τ is the conditional min-entropy, by its characterization as a guessing probability [KRS09], and F and P are the fidelity and the purified distance of the two block-diagonal operators [TCR10]. Our smoothing takes the supremum over states that are classical on R and Z and normalized, whereas the standard definition also allows subnormalized states that are not classical on RZ. The supremum here is therefore over a smaller set, and every lower bound proved below also holds for the standard quantity, which is the one used in randomness extraction against quantum side information [TSSR11]. In the Haar ensemble, where R is continuous, we take Definition 3.4 as the definition. If Eve receives a function g(ϕ) with finitely many values instead of ϕ, then the family is replaced by the averages of ρϕz over the fibers of g. The guessing probability can only decrease under this averaging, and the fidelity can only √ √ increase, because the map (a, b) 7→ a b 1 is jointly concave on pairs of positive semidefinite operators. This concavity follows from concavity of the fidelity [NC10, Theorem 9.7] √ √ the√strong √ √ η and the homogeneity sa tb 1 = st a b 1 . Hence every lower bound on Hmin (Z | RE) proved for the continuous register also holds, in the standard sense, when ϕ is disclosed to any finite precision. We use two standard facts. First, for unit vectors u and v in A ⊗ E whose reduced states on E are ρ and τ , √ √ ρ τ 1 ≥ |⟨u, v⟩|, (24) which is the elementary half of Uhlmann’s theorem [NC10, Section 9.2.2]. By homogeneity, it also holds for vectors that are not normalized, with ρ and τ the corresponding positive semidefinite operators of trace ∥u∥2 and ∥v∥2 . Second, the following lemma shows that an operator acting on the device alone cannot raise the probability of any outcome of a measurement on E by more than a factor of its squared norm. Lemma 3.6 (Operators on the device alone). Let K : A → A1 be a linear map between finitedimensional spaces, let ψ ∈ A ⊗ E, and let ρ = TrA |ψ⟩⟨ψ|

and

ρK = TrA1 (K ⊗ IE )|ψ⟩⟨ψ|(K ⊗ IE )† . 



Then Tr(M ρK ) ≤ ∥K∥2 Tr(M ρ) for every positive semidefinite operator M on E. Proof. We have Tr(M ρK ) = ⟨ψ, (K † K ⊗ M )ψ⟩

and

Tr(M ρ) = ⟨ψ, (I ⊗ M )ψ⟩.

The operator (∥K∥2 I − K † K) ⊗ M is a tensor product of two positive semidefinite operators, hence positive semidefinite, so ⟨ψ, (K † K ⊗ M )ψ⟩ ≤ ∥K∥2 ⟨ψ, (I ⊗ M )ψ⟩.

26

3.3

Dirichlet distributions

For a = (a1 , . . . , aN ) with all ai ≥ 1, write |a| = a1 + · · · + aN . The Dirichlet distribution Dir(a) is P the probability distribution on the simplex {p ∈ RN : pi ≥ 0, i pi = 1} with density proportional Q ai −1 to i pi with respect to the uniform measure on the simplex, and Dir(1, . . . , 1) is the uniform distribution. We write Ea for the expectation under Dir(a), and ⟨g, h⟩a = Ea [ḡh] and ∥h∥a for the inner product and norm of the space of square-integrable functions on the simplex under Dir(a). We also write (x)k = x(x + 1) · · · (x + k − 1) for the rising factorial. The following facts are classical [NTT11, Chapter 2]; we include the short proofs. Lemma 3.7 (Dirichlet facts). Let p ∼ Dir(a). (i) For nonnegative integers b1 , . . . , bN , Q

i (ai )bi

Y b Ea pi i =

(|a|)|b|

i

where |b| =

,

X

bi .

i

In particular, Ea pi =

ai |a|

and

Vara (pi ) =

ai (|a| − ai ) . |a|2 (|a| + 1)

(ii) As measures on the simplex, ai dDir(a + ei ), |a|

pi dDir(a) =

where ei is the i-th unit vector. Equivalently, Ea [pi h] = (ai /|a|)Ea+ei [h] for every integrable h. (iii) For S ⊆ [N ], we write a(S) = i∈S ai and p(S) = i∈S pi . If ∅ = ̸ S ⊊ [N ], the mass p(S) has the Beta distribution with parameters (a(S), |a| − a(S)), whose density on [0, 1] is proportional to ta(S)−1 (1 − t)|a|−a(S)−1 , and the vector (pi /p(S))i∈S is independent of p(S) and has the distribution Dir((ai )i∈S ). P

P

Proof. With respect to Lebesgue measure in the coordinates p1 , . . . , pN −1 , the density of Dir(a) is Γ(|a|)

ai −1 i pi

Q

Q

i Γ(ai )

.

For (i), multiplying this density by i pbi i gives a multiple of the density of Dir(a + b), so the expectation is the ratio of the two normalizing constants, Q

Q

Γ(|a|) i Γ(ai + bi ) Q , Γ(|a| + |b|) i Γ(ai ) which is the stated product of rising factorials. Part (ii) is the case b = ei of (i), read as an identity between densities. For (iii), write t = p(S),

pi = tui

for i ∈ S,

27

pj = (1 − t)vj

for j ∈ / S,

where u and v range over the simplices of dimensions |S| − 1 and N − |S| − 1. In the coordinates consisting of t and all but one coordinate of each of u and v, the Jacobian of this change of variables is proportional to t|S|−1 (1 − t)N −|S|−1 , and Y a −1 Y a −1 Y aj −1 p i = ta(S)−|S| (1 − t)|a|−a(S)−N +|S| u i v . i

i

i

i∈S

j

j ∈S /

Hence the joint density of (t, u, v) is proportional to ta(S)−1 (1 − t)|a|−a(S)−1 times a function of u times a function of v. Since (t, u, v) ranges over a product of three sets, t, u, and v are independent, t has the stated Beta distribution, and u = (pi /p(S))i∈S has the distribution Dir((ai )i∈S ). Part (ii) says that multiplying the density by pi is the same as observing the outcome i once: the prior Dir(a) becomes the posterior Dir(a + ei ), and the normalizing factor ai /|a| is the prior probability of that observation. This interpretation is used throughout Section 5. √ The Haar measure in these terms. Write αx = px eiθx for the amplitudes of a Haar-random state. Under the Haar measure, the phases θ1 , . . . , θN are independent and uniform on [0, 2π), they are independent of p = (p1 , . . . , pN ), and p is uniform on the simplex, that is, p ∼ Dir(1, . . . , 1). This is the standard description of the Haar measure on the sphere in terms of its moduli and phases; for example, it follows by writing a vector of independent standard complex Gaussians in polar coordinates and normalizing it.

4

The lower bound for Fourier sampling

In this section we prove part 1 of Theorem 1.1. We fix an experiment in the Fourier ensemble, which by Lemma 3.2 we may assume makes a fixed sequence of q controlled queries. The experiment has device register A, Eve’s register E (which may be trivial), initial state ψ0 ∈ A ⊗ E, unitaries U0 , . . . , Uq , projections {Πz }, and final state Ψ(f ) = (Vf ⊗ IE )ψ0 ,

Vf = Uq Ofc Uq−1 · · · Ofc U0 .

The query register Q of Lemma 3.2 consists of an address register X of n qubits and a target qubit T, so the query acts on the control qubit C, on X, and on T.

4.1

The recording representation n

Let H = A ⊗ E. The final state is a function f 7→ Ψ(f ) from {−1, 1}{0,1} to H. We work in the space F of all such functions, equipped with the inner product ⟨Φ, Φ′ ⟩ = Ef ⟨Φ(f ), Φ′ (f )⟩, so that ∥Φ∥2 = Ef ∥Φ(f )∥2 and ∥Ψ∥ = 1. Q For a set S ⊆ {0, 1}n , let χS (f ) = y∈S f (y), with χ∅ = 1. These are the characters of the group n {−1, 1}{0,1} , indexed by sets. They should not be confused with the characters χz of (12), which are indexed by strings. Since the values of f are independent uniform signs, Ef χS (f )χS ′ (f ) = 1[S = S ′ ], n and the 2N functions χS form an orthonormal basis of the scalar functions on {−1, 1}{0,1} . Every Φ ∈ F therefore has the expansion Φ=

X

χS ΦS ,





ΦS = Ef χS (f )Φ(f ) ∈ H,

S

∥Φ∥2 =

X

∥ΦS ∥2 .

(25)

S

We call S the recorded set of the term χS ΦS and its elements the recorded points. This is the representation used in the compressed oracle technique [Zha19]. If the random function is purified by 28

a register in the uniform superposition 2−N/2 f |f ⟩, then χS ΦS corresponds to the vector |S⟩ ⊗ ΦS , P where the vectors |S⟩ = 2−N/2 f χS (f )|f ⟩ form the Fourier basis of that register. We shall not need the register itself, only the expansion (25). P

Operators on F. An operator T on H acts on F pointwise, by (T Φ)(f ) = T Φ(f ). This action preserves each coefficient space: (T Φ)S = T ΦS . Multiplication by a scalar function m(f ) also acts on F. In particular, Xx denotes multiplication by f (x). Since f (x)χS (f ) = χS△{x} (f ), where △ is the symmetric difference, we have Xx (χS h) = χS△{x} h

(h ∈ H).

(26)

That is, multiplying by f (x) records the point x if it is absent and removes it if it is present. We split this operation into its two halves. Let ax and a†x be the operators on F defined on the basis by ax (χS h) = 1[x ∈ S] χS\{x} h, a†x (χS h) = 1[x ∈ / S] χS∪{x} h. (27) Thus ax removes the point x and a†x records it, and each gives zero when it cannot do so. The two operators are adjoint to each other, since the inner products ⟨χS ′ h′ , ax χS h⟩ and ⟨a†x χS ′ h′ , χS h⟩ both equal ⟨h′ , h⟩ when S ′ = S \ {x} with x ∈ S, and both vanish otherwise. In the language of qubits, if the set S is encoded by N membership qubits, one for each address, then ax , a†x , and a†x ax are the lowering, raising, and number operators of the x-th qubit, and Xx is its Pauli X operator. These qubits represent the dependence on f and are not a register that the algorithm can act on. Directly from (26) and (27), Xx = ax + a†x ,

ax a†x + a†x ax = I,

a2x = 0,

ax a†x − a†x ax = I − 2nx ,

(28)

where the operator nx = a†x ax is the orthogonal projection onto the terms in which x is recorded. Operators attached to distinct points x = ̸ y commute, because they act on the membership of P different points. The operator D = x nx , with D(χS h) = |S| χS h, counts the recorded points. Finally, for z ∈ {0, 1}n we define 1 X bz = √ χz (x) ax . N x

(29)

This operator removes one recorded point with the amplitudes of the Hadamard basis state P |χz ⟩ = H ⊗n |z⟩ = N −1/2 x χz (x)|x⟩: the amplitude with which it removes x is the amplitude of |x⟩ in |χz ⟩. These operators also have a description in terms of the function Φ itself. The operator ax is the discrete derivative
1 (ax Φ)(f ) = Φ(f x,+ ) − Φ(f x,− ) , 2 x,± where f agrees with f outside x and takes the value ±1 at x. This holds because (

χS (f x,± ) =

±χS\{x} (f ) if x ∈ S, χS (f ) otherwise.

This description is used in Section 7. Lemma 4.1 (Identities for the Fourier operators). For all z, x ∈ {0, 1}n and all Φ ∈ F, the following hold. 29

(i) The operators bw satisfy X

b†w bw = D.

w

(ii) The operators bz and b†z satisfy bz b†z − b†z bz = I −

2 D. N

(iii) The vector Φ satisfies X

(b2w Xx − Xx b2w )Φ

2

=

w

4 ⟨Φ, (D − nx )Φ⟩. N

Proof. Part (i). By (29) and the first relation in (12), X

b†w bw =

w

=

 1 X X χw (x)χw (y) a†x ay N x,y w X

a†x ax = D.

x

Part (ii). Expanding the products gives bz b†z − b†z bz =

1 X χz (x)χz (y)(ax a†y − a†y ax ). N x,y

For x = ̸ y the operators ax and a†y commute, so only the terms with x = y remain. By (28), these terms give 1 X 2 (I − 2nx ) = I − D. N x N Part (iii). Fix x and write bw = N −1/2 χw (x)ax + cw ,

cw = N −1/2

X

χw (y)ay ,

y̸=x

where cw is an operator that commutes with ax , a†x , and nx . Since a2x = 0 and χw (x)2 = 1, 2 b2w = √ χw (x) ax cw + c2w . N The term c2w commutes with Xx = ax + a†x . Moreover, by (28), ax Xx − Xx ax = ax a†x − a†x ax = I − 2nx , so that 2 b2w Xx − Xx b2w = √ χw (x) (I − 2nx ) cw . N The operator I − 2nx multiplies each basis term by ±1, so it preserves norms. Therefore X 4 X 2 (b2w Xx − Xx b2w )Φ = ∥cw Φ∥2 N w w E 4D X † = Φ, cw cw Φ . N w As in (i), the orthogonality relation (12) gives X w

c†w cw =

X

a†y ay = D − nx .

y̸=x

30

By (15), the value oracle decomposes as

The query in the recording representation. Of = P+ +

X

P+ = IX ⊗ |+⟩⟨+|T ,

f (x)Px ,

Px = |x⟩⟨x|X ⊗ |−⟩⟨−|T ,

x

where P+ and the Px are mutually orthogonal projections on XT that sum to the identity. Hence the controlled query (20) acts on F as Q = P∅ +

X

Xx Pxc ,

P∅ = |0⟩⟨0|C ⊗ I + |1⟩⟨1|C ⊗ P+ ,

Pxc = |1⟩⟨1|C ⊗ Px ,

(30)

x

where P∅ and the Pxc are mutually orthogonal projections on A summing to the identity. These projections act pointwise on F , and Xx commutes with all of them. The final state is Ψ = Uq QUq−1 Q · · · U1 QU0 ψ0 , where ψ0 is regarded as a constant function and the Ut act pointwise. We write Ψt for the state after t queries and the unitary Ut that follows them, so that Ψ0 = U0 ψ0 and Ψq = Ψ. Three facts control the recorded sets that occur in Ψt . 1. The constant function ψ0 has the single recorded set S = ∅. 2. A pointwise unitary does not change the sets S that occur. 3. By (26), the query changes each set by at most one point. By induction on t, whenever |S| > t,

(Ψt )S = 0

⟨Φ, DΦ⟩ ≤ t ∥Φ∥2

hence

(31)

for every Φ that is obtained from Ψt by applying operators that act pointwise, such as Pxc or Πz . The first part of (31) is the statement that the final state is a polynomial of degree at most q in the values of f , as in the polynomial method [BBC+ 01].

4.2

The score bound

√ P Let Ψz = Πz Ψ be√the output-z branch of the final state. Since N fb(z) = N −1/2 x χz (x)f (x), P multiplication by N fb(z) is the operator N −1/2 x χz (x)Xx = bz + b†z . By (23) and this identity, B(A) =

X

X

Ef N fb(z)2 ∥Ψz (f )∥2 = 



z

(bz + b†z )Ψz

2

.

(32)

z

We write Dz = b†z bz , so that, by Lemma 4.1(i), D = in terms of the progress measure λ(Φ) =

X

P

∥b2z Φ∥2

w Dw . The next lemma bounds the score

1/2

.

(33)

z

The lemma retains one nonpositive term, which the proof of the lower bound discards and which Section 7 uses. Lemma 4.2 (Score bound). For the final state Ψ of the experiment, with λ = λ(Ψ) and Ψz = Πz Ψ, B(A) ≤ 3 −

  2 1 2 1 X 2 + 2λ + 2 1 − λ −2 1− (Dz − I)Ψz . N N N z

31

(34)

Proof. Step 1: the branch quantity e. Let e=

X

∥b2z Ψz ∥2

1/2

z

be the progress measure evaluated branch by branch. Since Πz acts on A and bz acts on the dependence on f , the two commute, so e2 =

X

≤

X

∥Πz b2z Ψ∥2

z

∥b2z Ψ∥2 = λ2 ,

z

where the inequality holds because each Πz is a projection. We prove (34) with e in place of λ. Since the right side of that bound is increasing in e ≥ 0, and e ≤ λ, the lemma follows. Step 2: the expansion of the square. For the bound, fix z and write g = Ψz . Expanding the square and using Lemma 4.1(ii), † † 2 †2 (bz + b†z )2 = b2z + b†2 z + bz bz + bz bz = bz + bz + I −

2 D + 2Dz . N

(35)

Step 3: the first bound on the quadratic form. We bound the quadratic form on g of the operator I − (2/N )D + 2Dz in two steps, Steps 3 and 4. First, ⟨g, Dz g⟩ ≤ ⟨g, Dg⟩, because D is the sum of the operators Dw and each Dw = b†w bw has a nonnegative quadratic form. Hence D



g, I −

 E  2 1 D + 2Dz g ≤ ∥g∥2 + 2 1 − ⟨g, Dz g⟩. N N

(36)

Step 4: the key identity and the second bound. Second, applying Lemma 4.1(ii) once more, 

Dz2 = b†z (bz b†z )bz = b†z Dz + I − 2 = b†2 z bz + Dz −

2  D bz N

2 † b Dbz , N z

and rearranging gives the identity 2 2 I + b†2 z bz − Dz = (Dz − I) +

2 † b Dbz . N z

(37)

Taking the quadratic form on g and using ⟨bz g, Dbz g⟩ ≥ 0, we obtain ⟨g, Dz g⟩ ≤ ∥g∥2 + ∥b2z g∥2 − ∥(Dz − I)g∥2 .

(38)

Dropping its last term gives the inequality (6) of the overview. Step 5: summation over z. Combining (36) and (38), D



g, I −

 E   1 2 2 2 2 D + 2Dz g ≤ 3 − ∥g∥2 + 2 1 − ∥bz g∥ N N N   1 −2 1− ∥(Dz − I)g∥2 . N

We sum over z, using that the squared norms ∥Ψz ∥2 sum to 1 and the definition of e. We find that the contribution of the terms I − (2/N )D + 2Dz in (35) to (32) is at most 3−

  2 1 2 1 X +2 1− e −2 1− ∥(Dz − I)Ψz ∥2 . N N N z

32

Step 6: the interference term. The remaining terms contribute X

⟨Ψz , (b2z + b†2 z )Ψz ⟩ = 2 Re

X

⟨Ψz , b2z Ψz ⟩

z

z

X

≤2

∥Ψz ∥2

1/2 X

z

∥b2z Ψz ∥2

1/2

= 2e.

z

2 Here the first equality holds because b†2 z is the adjoint of bz , and the inequality is the Cauchy–Schwarz inequality. Adding this to the bound of Step 5 proves the bound with e in place of λ.

4.3

Growth of the progress measure

Lemma 4.3 (Growth). For 0 ≤ t < q, q

λ(Ψt+1 ) ≤ λ(Ψt ) + 2 t/N . Consequently, q−1

2 X√ λ(Ψ) ≤ λ̄q := √ t N t=0

(39)

4 q 3/2 ≤ ·√ . 3 N Proof. Step 1: the vector LΦ. It is convenient to regard the family (b2z Φ)z as the single vector P LΦ = z |z⟩ ⊗ b2z Φ in CN ⊗ F, so that λ(Φ) = ∥LΦ∥. An operator T on H, acting pointwise, commutes with every bz , so L(T Φ) = (I ⊗ T )LΦ. In particular, the unitaries Ut do not change λ, and it suffices to bound the effect of one query Q on Ψt . Step 2: moving L past one query. By (30), and because b2z commutes with the pointwise projections P∅ and Pxc , LQΨt − (I ⊗ Q)LΨt =

X

X

z

x

|z⟩ ⊗

(b2z Xx − Xx b2z )Pxc Ψt .

Moreover, for fixed z, the vectors (b2z Xx − Xx b2z )Pxc Ψt for distinct x are orthogonal, because the operator b2z Xx − Xx b2z acts only on the dependence on f while Pxc projects onto mutually orthogonal subspaces of A. Step 3: the degree bound. Therefore, by Step 2 and Lemma 4.1(iii), LQΨt − (I ⊗ Q)LΨt

2

=

XX x

(b2z Xx − Xx b2z )Pxc Ψt

2

z

4 X c = ⟨P Ψt , (D − nx )Pxc Ψt ⟩, N x x and, by (31) applied to Pxc Ψt after dropping the nonpositive contribution of −nx , the last expression P is at most (4t/N ) x ∥Pxc Ψt ∥2 ≤ 4t/N . The last inequality holds because the Pxc are mutually orthogonal projections and ∥Ψt ∥ = 1. Step 4: the triangle inequality. Since Q is unitary, ∥(I ⊗ Q)LΨt ∥ = ∥LΨt ∥, and the triangle inequality, together with the bound of Step 3, gives q

λ(QΨt ) ≤ λ(Ψt ) + 2 t/N . 33

This is the first claim, because λ(Ψt+1 ) = λ(Ut+1 QΨt ) = λ(QΨt ), where the second equality holds by Step 1. Step 5: the sum of the increments. Initially, Ψ0 = U0 ψ0 is a constant function, so every ax maps it to zero and 0 ) = 0. Summing the increments gives the middle expression in (39). Finally, the √ λ(Ψ R t+1 √ inequality t ≤ t s ds gives q−1 X√ t=0

4.4

t≤

Z q 0

√

2 s ds = q 3/2 . 3

The lower bound

Theorem 4.4 (Fourier lower bound). Every algorithm that makes at most q queries in the Fourier ensemble satisfies 32  2 1  q3 8 q 3/2 B(A) ≤ 3 − 1− + ·√ + . (40) N 3 9 N N N Consequently, if B(A) ≥ 3 + ε for some 0 < ε ≤ 4, then q ≥ (3ε/16)2/3 N 1/3 . Proof. Step 1: the explicit bound. By Lemma 4.2, dropping its last term,  1 2 4 2 + 2λ + 2 1 − λ , λ = λ(Ψ) ≤ q 3/2 N −1/2 , N N 3 where the bound on λ holds by Lemma 4.3. The right side of the first inequality is increasing in λ ≥ 0, so substituting the bound on λ gives (40). Step 2: a lower bound on λ. If B(A) ≥ 3 + ε, then, after dropping −2/N and bounding 1 − 1/N by 1, the first inequality of Step 1 gives ε ≤ 2λ + 2λ2 . Solving the quadratic inequality gives √ 1 + 2ε − 1 ε λ≥ =√ 2 1 + 2ε + 1 ε ≥ , 4 where the last step uses ε ≤ 4. Hence, by the bound on λ in Step 1, ε 4 3ε √ ≤ q 3/2 N −1/2 , that is, q 3/2 ≥ N, 4 3 16 which is the claim.

B(A) ≤ 3 −

The restriction ε ≤ 4 costs nothing, since a score of 3 + ε with ε > 4 is in particular a score of at least 7, so that q ≥ (3/4)2/3 N 1/3 by the case ε = 4. The proof also recovers, in full generality, the one-query bound of [Kre21]. Indeed, an algorithm that makes one query of any kind, controlled or not, has λ(Ψ) = 0, because at most one point is ever recorded and b2z removes two. Hence B(A) ≤ 3 − 2/N by Lemma 4.2. Remark 4.5 (Limited independence). For a fixed algorithm, the score is the expectation over f of P 2 z N pf (z) ∥Ψz (f )∥ , which is a polynomial of degree at most 2q + 2 in the values f (x), because Vf has degree at most q and N pf (z) has degree 2. Since f (x)2 = 1, such a polynomial is a linear combination of the characters χS with |S| ≤ 2q + 2, and the expectation of χS with S ̸= ∅ is 0 under every random function whose values are (2q + 2)-wise independent and uniform. The score of A, and hence Theorem 4.4, is therefore unchanged when the uniformly random function is replaced by such a function. 34

4.5

The exact identity for one phase query

For algorithms that make a single phase query, the score is given by an exact formula, which we stated in Section 2.1. An algorithm makes a single phase query if q = 1 and the state U0 ψ0 has the control qubit C in the state |1⟩ and the target qubit T in the state |−⟩. For such a state, P∅ U0 ψ0 = 0, so by (30) the final state is Ψ(f ) =

X

f (x) vx ,

vx = (U1 Pxc U0 ⊗ IE )ψ0 ,

(41)

x

which is linear in f . In particular, the final state when the oracle is the character χw is Ψ(χw ) = P x χw (x)vx , and, for every f , Ψ(f ) =

X

fb(w)Ψ(χw )

because

f=

w

X

fb(w)χw .

w

Proposition 4.6 (One phase query). Let A make a single phase query, and let σ=

1 X Pr[Z = z | f = χz ] N z

be the probability with which it identifies a uniformly random character. Then the following hold. (i) The score of A is B(A) = 1 −

2 + 2σ. N

(42)

(ii) In particular, B(A) ≤ 3 − 2/N , and equality holds if and only if A outputs w with certainty whenever the oracle is χw . (iii) In the case of equality, Ψz (f ) = fb(z)Ψ(χz ) for all f and z, and Eve’s conditional states are ρfz = pf (z) ρE . That is, the output is an exact sample from pf and is independent of Eve’s register, even given f . Proof. Step 1: every term of Ψ has one recorded point. By (41), Ψ = has exactly one recorded point. Hence DΨ = Ψ, b2z Ψ = 0, and

P

x χ{x} vx , so every term of Ψ

1 X 1 bz Ψ = √ χz (x) χ∅ vx = √ Ψ(χz ), N x N which is a constant function. Consequently, applying Πz , which commutes with bz and D, gives DΨz = Ψz , b2z Ψz = 0, and ∥bz Ψz ∥2 =

1 1 ∥Πz Ψ(χz )∥2 = Pr[Z = z | f = χz ]. N N

Step 2: the exact score. We now evaluate (32) exactly, using the expansion (35). For each z, the terms of that expansion contribute as follows. 2 2 1. The terms b2z and b†2 z contribute ⟨Ψz , bz Ψz ⟩ + ⟨bz Ψz , Ψz ⟩ = 0.

2. The term I − (2/N )D contributes (1 − 2/N )∥Ψz ∥2 . 3. The term 2Dz contributes 2∥bz Ψz ∥2 .

35

Summing over z gives (42). Step 3: the case of equality. Since σ ≤ 1, the score is at most 3 − 2/N , with equality if and only if Pr[Z = w | f = χw ] = 1 for every w. In that case, Πz Ψ(χw ) = 0 for z ̸= w, so by linearity Ψz (f ) =

X

fb(w)Πz Ψ(χw ) = fb(z)Ψ(χz ).

w

Finally, Ψ(χz ) = (Vχz ⊗ IE )ψ0 with Vχz unitary on A, so its reduced state on E is ρE , and, by (22), Eve’s conditional states are ρfz = fb(z)2 ρE = pf (z)ρE . The identity (42) is specific to phase queries. For a query whose target qubit is in a general state, the state after the query also has terms with no recorded point, and the score can be smaller than 1 − 2/N + 2σ. The example in Section 2.1 has σ = 1 and score 1.

5

The lower bound for Haar-random states

In this section we prove the lower bound for Haar-random states. As in the Fourier case, we bound the score in terms of a progress measure and then bound its change under a query. The identity P x αx αx = 1 shows that counting repeated factors depends on how the polynomial is written. We use unpaired amplitudes and degrees for the corresponding Dirichlet measures, and write λt for the progress measure after t queries. For an algorithm given s copies and making q queries to Oϕ , we prove √ B(A) ≤ βN + 2 2 λq + 72λ2q , r

λt+1 ≤ λt + c0

s + 2t + 1 N

(0 ≤ t < q),

where c0 is absolute √ and βN is the ideal score defined below. With no copies, λ0 = 0, so summing gives λq = O(q 3/2 / N ). Exceeding the ideal score by a constant therefore requires Ω(N 1/3 ) queries. The score bound uses Lemma 5.8, and the query bound uses both Lemmas 5.8 and 5.17. We give their statements and the resulting score and query arguments here; supporting calculations and longer block estimates are in Appendix A.1. The extension to unitary access is in Section 5.6. Throughout, |ϕ⟩ is Haar-random, and we write X √ |ϕ⟩ = αx |x⟩, px = |αx |2 , αx = px eiθx , x∈[N ]

so that the phases are independent and uniform and p is uniform on the simplex (Section 3.3). We write βN = 2N/(N + 1) for the ideal score, ei for the i-th unit vector of ZN , and, as in Section 3.3, |a| for the total parameter of a Dirichlet distribution Dir(a). For a vector γ ∈ ZN we P write |γ|1 = i |γi |. Fix an experiment, which by Lemma 3.2 we may assume makes a fixed sequence of q controlled queries. The device register A contains the control qubit C and the query register Q = C|⊥⟩ ⊕ CN . Eve’s register E may be trivial. The final state is Ψ(ϕ) = (Vϕ ⊗ IE )ψ0 , where Vϕ = Uq Oϕc Uq−1 · · · Oϕc U0 . If the algorithm receives s copies of |ϕ⟩, then the initial vector is |ϕ⟩⊗s ⊗ ψ0 instead, with the copies in s further registers of A. The proof of Lemma 3.2 applies to this initial state without change. As in Section 4, we write H = A ⊗ E for the space in which the final state takes its values. 36

5.1

Polynomials, patterns, and the level

Polynomials. For a finite-dimensional space V, which will be H or a tensor factor of it, let P≤d (V) be the space of functions F from the unit sphere of CN to V that are polynomials of total degree at most d in the 2N variables αx , αx , with the inner product and norm ∥F ∥2 = Eϕ ∥F (ϕ)∥2V .

⟨F, G⟩ = Eϕ ⟨F (ϕ), G(ϕ)⟩V ,

Two polynomials are identified when they agree on the sphere. We regard the elements of P≤d (V) as vector-valued polynomials; they need not be normalized for each ϕ. A final state is a unit vector in this space, because ∥Ψ(ϕ)∥ = 1 for every ϕ. Lemma 5.1 (Degree growth). After t queries, the state of an algorithm that received s copies lies in P≤s+2t (H). Proof. The initial vector |ϕ⟩⊗s ⊗ ψ0 =

X

αx1 · · · αxs |x1 , . . . , xs ⟩ ⊗ ψ0

x∈[N ]s

has degree s. A fixed unitary maps each coordinate of the state to a fixed linear combination of coordinates and does not raise the degree. By (17), every matrix entry of Oϕ , and hence of Oϕc , is a polynomial of degree at most two, so a query raises the degree by at most two. Patterns and sectors. We first group monomials by their unpaired amplitudes, then expand their remaining factors in p in orthogonal polynomials. The unpaired factors determine the Dirichlet distribution used for the inner product. A pattern is a vector γ ∈ ZN , and its phase monomial is uγ (ϕ) =

Y

=

Y

αiγi

i:γi >0

αi −γi

Y i:γi <0

|γ |/2 pi i

 P

ei

i

γi θi

.

i

A positive entry γi stands for γi unpaired factors αi , and a negative entry for |γi | factors αi . Q i Every monomial in the variables α, α factors uniquely as uγ i pm i with mi ≥ 0.PExplicitly, if it contains αibi αi ci , then γi = bi − ci and mi = min(bi , ci ). Its total degree is |γ|1 + 2 i mi . The sector of γ is the set of functions uγ h(p), so that h depends on ϕ only through the probabilities p1 , . . . , pN . To each pattern we attach the Dirichlet parameters a(γ) = (1 + |γ1 |, . . . , 1 + |γN |),

|a(γ)| = N + |γ|1 ,

and the weight 2

Mγ = Eϕ |uγ | =

Q

i |γi |!

(N )|γ|1

,

|γ |

where the value of Mγ follows from the identity |uγ |2 = i pi i and Lemma 3.7(i). Within the sector of γ, we use the inner product of square-integrable functions under Dir(a(γ)). We write Rar for the space of polynomials in p of degree at most r that are orthogonal, under Dir(a), to all polynomials in p of degree at most r − 1, with the convention Ra−1 = {0}; its elements have exact degree r for Dir(a). We write Πa≤r and Πar for the orthogonal projections onto the polynomials Q

37

of degree at most r and onto Rar in that space. These notions depend on a only through the inner product ⟨·, ·⟩a . A polynomial in p with values in V is treated coefficientwise with respect to a fixed orthonormal basis of V, and all statements about polynomials in p below extend to V-valued ones in this way. Lemma 5.2 (Blocks). The following hold. (i) For every d ≥ 0, M

P≤d (V) =

uγ Ra(γ) ⊗ V, r

(43)

|γ|1 +2r≤d

where the summands, which we call blocks, are pairwise orthogonal. (ii) For every pattern γ and every function h of p with ∥h∥a(γ) < ∞, in particular for every polynomial in p, ∥uγ h∥2 = Mγ ∥h∥2a(γ) . (44) Proof. Step 1: decomposition into orthogonal sectors. By the factorization of monomials, every element of P≤d (V) is a sum of terms uγ h with h a polynomial in p of degree at most (d − |γ|1 )/2. We treat scalar coefficients; the V-valued case follows coefficientwise. Terms with distinct patterns are orthogonal. Indeed, for γ = ̸ γ ′ and functions h, h′ of p, conditioning on p and averaging over the phases gives h

⟨uγ h, uγ ′ h′ ⟩ = Ep h(p)h′ (p)

Y (|γi |+|γ ′ |)/2 i

pi

Eθ ei

P i

(γi′ −γi )θi

i

= 0,

i

because the phases are independent and uniform and some γi′ − γi is nonzero. Step 2: the norm conversion. For (44), averaging over the phases gives ∥uγ h∥2 = EDir(1,...,1)

hY |γi |

i

pi |h|2 .

i

Applying Lemma 3.7(ii) once for each of the |γ|1 factors pi raises the parameter from (1, . . . , 1) to a(γ), and each application contributes the factor ai /|a| for the parameters current at that moment. For the outcome i these numerators are 1, 2, . . . , |γi |, and, in some order, the denominators are N, N + 1, . . . , N + |γ|1 − 1, so the product of all the factors is Mγ . P Step 3: orthogonality within a sector. Finally, within a sector, decompose h = r hr with a(γ) hr ∈ Rr . The same computation gives ⟨uγ hr , uγ ht ⟩ = Mγ ⟨hr , ht ⟩a(γ) = 0

for r ̸= t,

and hr is represented by a polynomial of degree at most r, so the degree count of Step 1 gives the decomposition (43). When a query changes one entry of the pattern by one unit, we shall use (44) together with Lemma 3.7(ii) in the following form: for every pattern γ and outcome i with |γi ± 1| = |γi | + 1, Mγ pi dDir(a(γ)) = Mγ±ei dDir(a(γ ± ei )),

(45)

and symmetrically with p−1 when the magnitude of the entry decreases; both sides are |uγ±ei |2 i times the distribution of p under the Haar measure.

38

The level. The level adds the degree under the Dirichlet measure to the number of unpaired factors beyond the first at each outcome. The first factor is not counted, because the honest sampler has one unpaired factor in each output branch. A block in P≤d satisfies |γ|1 + 2r ≤ d, while its level is rep(γ) + r. Definition 5.3 (Level). For a pattern γ let rep(γ) =

X

max(|γi | − 1, 0)

i

count the occurrences beyond the first at each outcome. The level of the block indexed by (γ, r) in (43) is rep(γ) + r. Let Pk be the orthogonal projection onto the sum of the blocks of level k, and let P C = k kPk be the level operator. The progress measure of a polynomial F is λ(F ) = ∥C 1/2 F ∥ =

X

k ∥Pk F ∥2

1/2

.

k

A block has level zero when its pattern is square-free (|γi | ≤ 1 for all i) and its polynomial factor is constant. For example, pz = 1/N + (pz − 1/N ) splits into levels zero and one. In the sector of αz , the Dirichlet measure is Dir(a(ez )), under which pz has mean 2/(N + 1). Hence 2 2 αz + α z p z − . N +1 N +1 

αz pz =



The two summands again have levels zero and one. These are decompositions of vector-valued P polynomials. The normalization z pz = 1 has level zero, while αz2 has level one. Three facts about these projections are used repeatedly. 1. Each Pk acts on P≤d (V) as the sum of the projections onto the blocks of (43) of level k, so it maps P≤d (V) to itself. 2. A ϕ-independent operator on V acts on the coefficients only, hence maps each block to itself and commutes with every Pk and with C. 3. Adjoining or removing a register in a fixed state, such as the query register in the state |⊥⟩, changes neither the pattern nor the polynomial factor of any block, so the map J : G 7→ G⊗|⊥⟩ and its adjoint also commute with every Pk . Level zero and the ideal score. The score is the quadratic form, on P≤d (H), of the multiplication P operator X = z N pz Πz , defined on all square-integrable H-valued functions of ϕ by (XF )(ϕ) =

X

N pz (ϕ)Πz F (ϕ).

z

It raises the degree of a polynomial by two, and only its quadratic form is used. Indeed, ⟨F, XF ⟩ = N

X

Eϕ pz ∥Πz F (ϕ)∥2 , 



(46)

z

which is the expected score (23) when F is a final state. Since X multiplies by a function of p and by projections on H, it preserves the pattern of every block and its branch, and it can change only the degree under the Dirichlet measure.

39

Proposition 5.4 (Level zero and the ideal score). If F0 = P0 F0 , then ⟨F0 , XF0 ⟩ ≤ βN ∥F0 ∥2 , with equality for the honest sampler. More precisely, for a square-free pattern γ, an output z, and a constant v ∈ H, ⟨uγ Πz v, X uγ Πz v⟩ =

N (1 + |γz |) ∥uγ Πz v∥2 N + |γ|1 (

≤

∥uγ Πz v∥2 βN ∥uγ Πz v∥2

if γz = 0, if |γz | = 1.

Proof. Step 1: reduction to single terms. A polynomial of level zero is a sum of terms uγ Πz v with γ square-free and v ∈ H constant, and we may take the v from a fixed orthonormal basis of H L adapted to the decomposition H = z Πz H. Distinct triples (z, γ, v) give orthogonal terms, and X preserves all three data, so the quadratic form is a sum over the terms. For one term, by (44) and the mean Ea(γ) pz = (1 + |γz |)/|a(γ)| from Lemma 3.7(i), we have ⟨uγ Πz v, X uγ Πz v⟩ = N Mγ Ea(γ) [pz ] ∥Πz v∥2 =

N (1 + |γz |) ∥uγ Πz v∥2 . N + |γ|1

Step 2: the two bounds. If γz = 0, then the ratio is N/(N + |γ|1 ) ≤ 1 ≤ βN . If |γz | = 1, then |γ|1 ≥ 1 and the ratio is at most 2N/(N + 1) = βN . Finally, the honest sampler prepares |ϕ⟩ = Oϕ |⊥⟩ with its single query and measures it, so its output-z branch is αz |z⟩, of pattern ez with constant polynomial factor, for which the ratio equals βN . Lemma 5.5 (The level of the copies). For every s ≥ 0, λ(|ϕ⟩⊗s )2 =

s(s − 1) . N +s−1

The proof is in Appendix A.1.1. The identity follows by expanding in the basis of the copy registers. Conditional on p, the squared amplitudes give s independent samples, so the squared progress measure of the copies is the expected number of samples that repeat an earlier outcome. The main theorem. Combining the score and growth estimates with Lemma 5.5 gives us the following theorem. Theorem 5.6 (Haar lower bound for the canonical oracle). Let an algorithm receive s copies of |ϕ⟩ and make at most q queries to Oϕ . Then √ λ(Ψ) ≤ Λs,q and B(A) ≤ βN + 2 2 Λs,q + 72 Λ2s,q , where

s

Λs,q =

q−1

s(s − 1) c0 X √ +√ s + 2t + 1. N +s−1 N t=0

40

Proof. Step 1: the initial level. Let Ψt be the state after t queries and the fixed unitary that follows them, as in Section 4.1, so that Ψ0 = U0 (|ϕ⟩⊗s ⊗ ψ0 ) and Ψq = Ψ. Each Ψt is a unit vector in P≤s+2t (H) by Lemma 5.1. The fixed unitaries commute with C and preserve the norm, and adjoining the ϕ-independent vector ψ0 does not change the level, so, by Lemma 5.5, s(s − 1) . N +s−1 Step 2: the effect of the queries. By the growth estimate at degree s + 2t, λ(Ψ0 )2 =

r

s + 2t + 1 . N Summing over t gives λ(Ψ) ≤ Λs,q , which is the first claim. Finally, the score estimate applies to Ψ, and its right side is increasing in λ(Ψ). λ(Ψt+1 ) ≤ λ(Ψt ) + c0

Corollary 5.7 (Query and copy bounds). Let 0 < ε ≤ 1, and let an algorithm as in Theorem 5.6 have B(A) ≥ 2 + ε. Then √ p s + q s + q + 1 ≥ c1 ε N for an absolute constant c1 > 0. In particular, the following hold. (i) With no copies, q ≥ c2 ε2/3 N 1/3 for an absolute constant c2 > 0. √ (ii) With no queries, s ≥ c1 ε N . Proof. Step 1: a lower and an upper bound on Λ. Since βN ≤ 2, the theorem gives √ ε ≤ 2 2Λ + 72Λ2 , where Λ = Λs,q . If Λ ≤ 1, then this gives ε ≤ 75Λ. If Λ > 1, then Λ > ε. In both cases Λ ≥ ε/75. √ On the other hand, each summand is at most s + 2q + 1, and the empty sum is zero when q = 0. Bounding s(s − 1)/(N + s − 1) by s2 /N and using s + 2q + 1 ≤ 2(s + q + 1), we obtain √ s c0 q s + 2q + 1 √ Λ≤ √ + N N √
√ (1 + 2c0 ) s + q s + q + 1 √ ≤ . N √ Step 2: the three claims. The two bounds c = 1/(75(1 √ give the first claim with √ 3/2+ 2c0 )). With √ √ 1 s = 0, the first claim reads q q + 1 ≥ c1 ε N , and the bound q q + 1 ≤ 2 q gives item (i). With q = 0, the first claim is item (ii). √ Both extremes of the corollary have the right exponent of N : O( N ) measured copies suffice to exceed the ideal score by a constant, since a repeated outcome identifies an outcome of large probability [Kre21], and O(N 1/3 ) queries suffice by Theorem 6.9 in Section 6. The exponent of ε is not known to be sharp.

5.2

Dirichlet energy and concentration

To bound the score, we first bound the mass of a set of outcomes weighted by a polynomial in p. Throughout this subsection, ai ≥ 1. We prove the following lemma using integration by parts. Lemma 5.8 (The mass of a set of outcomes). Let S ⊆ [N ], and write p(S) = P a(S) = i∈S ai . For every polynomial h in p of degree at most r, Ea p(S)|h|2 ≤ 8 



41

a(S) + r ∥h∥2a . |a|

P

i∈S pi

and

Tangent derivatives. The partial derivatives ∂i = ∂/∂pi of a polynomial can depend on how it is represented away from the simplex. We instead differentiate along ei − p, which points from p toward vertex i, and define N X

Ti g = ∂i g −

pj ∂j g.

(47)

j=1

For 0 ≤ t ≤ 1, the point (1 − t)p + tei lies in the simplex. Since Ti g(p) is the derivative at t = 0 of the polynomial g((1 − t)p + tei ), it depends only on the restriction of g to the simplex. The P operators satisfy i pi Ti = 0. Lemma 5.9 (Integration by parts). For all polynomials g, v and all i ∈ [N ], 







Ea pi (Ti g) v = Ea g (|a|pi − ai )v − pi Ti v .

(48)

We verify the identity on monomials using the Dirichlet moment formula, which avoids boundary terms. It is bilinear, with no conjugation, and applies to conjugates by substituting v̄ for v. The proof is in Appendix A.1.2. The form Γ and the operator La . For polynomials f, g, define the form Γ and the operator La by X Γ(f, g) = pi (δij − pj ) ∂i f ∂j g, i,j

La g =

X

pi (δij − pj ) ∂i ∂j g +

i,j

X

(49)

(ai − |a|pi ) ∂i g.

i

Expanding the square shows that on the simplex Γ(g, g) =

X

=

X

pi |∂i g|2 −

X

2

pj ∂j g

j

i 2

pi |Ti g| ≥ 0,

i

and more generally

Γ(f, g) =

X

pi Ti f Ti g.

i

On the simplex the operator La can be written with the tangent derivatives alone, La g =

X

pi Ti2 g + ai Ti g ,

(50)

i

so it is well defined on functions on the simplex, since each Ti is. The calculation is in Appendix A.1.3. Since La pi = ai − |a|pi , summing over i ∈ S gives La p(S) = a(S) − |a|p(S). Lemma 5.10 (Symmetry and eigenvalues). For all polynomials f, g: (i) the identity Ea Γ(f, g) = −⟨f, La g⟩a holds; in particular, the operator La is symmetric for ⟨·, ·⟩a and ⟨g, La g⟩a ≤ 0; (ii) the operator La maps polynomials of degree at most m to polynomials of degree at most m, and La g = −r(|a| + r − 1)g for g ∈ Rar ; (iii) for every polynomial h of degree at most r, Ea Γ(h, h) ≤ r(|a| + r − 1) ∥h∥2a . The proof is in Appendix A.1.4. The proof of Lemma 5.8 is in Appendix A.1.5. 42

5.3

The score in terms of the level

For a unit polynomial F , write F0 = P0 F and F+ = F − F0 . Expanding along this decomposition gives ⟨F, XF ⟩ = ⟨F0 , XF0 ⟩ + 2 Re⟨F0 , XF+ ⟩ + ⟨F+ , XF+ ⟩. (51) The first term is at most the ideal score by Proposition 5.4. We bound the cross term by O(λ(F )) and the last term by O(λ(F )2 ), using Lemma 5.8 for the latter. Lemma 5.11 (The cross term). For every F ∈ P≤d (H) with F0 = P0 F and F+ = F − F0 , √ |⟨F0 , XF+ ⟩| ≤ 2 ∥F0 ∥ ∥F+ ∥ and ∥F+ ∥ ≤ λ(F ). Proof. Step 1: reduction to one sector. Since X preserves branches and patterns and F0 lies in sectors with square-free patterns and constant polynomial factors, the pairing is a sum over such sectors. In one such sector, write a = a(γ). Let v be the constant coefficient of Πz F0 and g the polynomial factor of Πz F+ , with Ea g = 0 coefficientwise. Then Ea ⟨v, g⟩ = 0, so only the centered part of pz contributes: N Ea [pz ⟨v, g⟩] = N Ea [(pz − Ea pz )⟨v, g⟩] q

≤N

Vara (pz ) ∥v∥ ∥g∥a .

Step 2: the variance and the first claim. By Lemma 3.7(i), with az ≤ 2 and |a| ≥ N , N 2 az (|a| − az ) |a|2 (|a| + 1) 2N 2 ≤ ≤ 2. |a|(|a| + 1)

N 2 Vara (pz ) =

Multiplying by Mγ and applying the Cauchy–Schwarz inequality over the sectors gives the first claim. For the second claim, we have ∥F+ ∥2 =

X

∥Pk F ∥2

k≥1

≤

X

k∥Pk F ∥2 = λ(F )2 .

k≥1

Lemma 5.12 (The positive-level piece). For every F ∈ P≤d (H) with F+ = F − P0 F , ⟨F+ , XF+ ⟩ ≤ 72 λ(F )2 . Proof. Step 1: reduction to one sector. Fix a branch z and a pattern γ, and write a = a(γ). Let the component of Πz F+ in this sector be uγ

X

hr ∈ Rar ,

hr ,

r

with H-valued coefficients treated coefficientwise. Since X preserves branches and patterns, the quadratic form is a sum over sectors, and within a sector it is, by (44), h

N Mγ Ea pz

X r

43

hr

2i

.

Step 2: multiplication by pz . Multiplication by pz connects only equal or adjacent degrees under the Dirichlet measure. Indeed, pz ht has degree at most t + 1, so ⟨hr , pz ht ⟩a = 0 for r > t + 1, and symmetry gives the same conclusion for t > r + 1. Write wr = Ea [pz ∥hr ∥2 ]. Applying √ √ √ the Cauchy–Schwarz inequality to pz hr and pz hr±1 gives |⟨hr , pz hr±1 ⟩a | ≤ wr wr±1 . Since √ 2 wr wr+1 ≤ wr + wr+1 , we obtain h

Ea pz

X

hr

2i

≤

X

wr + 2

X√

r

r

≤3

wr wr+1

r

X

wr .

r

Step 3: comparison with the level. Each wr is the quantity bounded in Lemma 5.8 for the set S = {z}, whose parameter is az = 1 + |γz |, so that lemma and |a| ≥ N give N wr ≤ 8(1 + |γz | + r)∥hr ∥2a . Now compare with the level k = rep(γ) + r of the block (γ, r), which is at least 1 for every block of F+ . Since |γz | ≤ 1 + max(|γz | − 1, 0) ≤ 1 + rep(γ), we have 1 + |γz | + r ≤ 2 + k ≤ 3k. Here the level does not count the first occurrence of z in the pattern, as in Proposition 5.4, but it counts every further occurrence. Finally, summing over the sectors, which are orthogonal, converting back by Mγ , and using that Πz commutes with every Pk , we obtain ⟨F+ , XF+ ⟩ ≤ 24

X

3k ∥Pk F ∥2 = 72 λ(F )2 .

k≥1

Theorem 5.13 (Score bound). For every unit vector F ∈ P≤d (H), √ ⟨F, XF ⟩ ≤ βN + 2 2 λ(F ) + 72 λ(F )2 . Proof. We bound the three terms in (51) as follows. 1. The first term is at most βN ∥F0 ∥2 ≤ βN by Proposition 5.4. √ √ 2. The second term is at most 2 2 ∥F0 ∥ ∥F+ ∥ ≤ 2 2λ(F ) by Lemma 5.11. 3. The third term is at most 72λ(F )2 by Lemma 5.12.

5.4

Projection estimates for Dirichlet polynomials

We next prove the estimates needed to bound the effect of a query on the level. Multiplying by an amplitude changes the pattern and therefore the Dirichlet inner product. Fix ai ≥ 1. Weighting Dir(a) by pi and normalizing gives Dir(a + ei ). For g ∈ Rar with r ≥ 1, the posterior decomposition has only degrees r and r − 1. With weights ai /|a|, the sum of the lower-degree squared norms equals r/(|a| + 2r − 1) times ∥g∥2a , and r/(|a| + 2r − 1) ≤ r/N when |a| ≥ N . We then use this identity to P bound the degree-r + 1 part of i pi hi for polynomials hi of degree at most r. Lemma 5.14 (Two adjacent degrees). Let i ∈ [N ]. i ⊕ Ra+ei . (i) If g ∈ Rar , then g ∈ Ra+e r r−1

(ii) Conversely, if h ∈ Rra+ei , then pi h ∈ Rar+1 ⊕ Rar . 44

Proof. For the first claim, g has degree at most r, so it suffices to show that g is orthogonal under Dir(a + ei ) to every polynomial v of degree at most r − 2. By Lemma 3.7(ii), ⟨v, g⟩a+ei =

|a| Ea [pi v̄g] = 0, ai

because pi v̄ has degree at most r − 1 and g ∈ Rar . For the second claim, pi h has degree at most r + 1, and for v of degree at most r − 1, ⟨v, pi h⟩a =

ai ⟨v, h⟩a+ei = 0 |a|

i. because h ∈ Ra+e r

Theorem 5.15 (The projection onto the lower degree). Let g ∈ Rar with r ≥ 1 and let i ∈ [N ]. Then Ti g + rg i i Πa+e ∈ Ra+e r−1 . ≤r−1 g = |a| + 2r − 1 Proof. Step 1: the degree. Choose a representative of g of degree at most r and split off its P homogeneous part gr of degree r, writing g = gr + g<r . Euler’s identity j pj ∂j gr = rgr shows that the top parts cancel in   X Ti g + rg = ∂i g + rg<r − pj ∂j g<r , j

which therefore has degree at most r − 1. Step 2: the pairing with polynomials of lower degree. We next show that for every polynomial v of degree at most r − 1, 



Ea pi (Ti g + rg)v = (|a| + 2r − 1) Ea [pi gv].

(52)

By (48), Ea [pi (Ti g)v] = |a| Ea [pi gv] − ai Ea [gv] h

− Ea [g pi ∂i v] + Ea g pi

X

i

p j ∂j v .

j

The second and third terms vanish, because v and pi ∂i v have degree at most r − 1 and g ∈ Rar . P In the last term, write w = j pj ∂j v − (r − 1)v. If v is split into its homogeneous part of degree r − 1 and the rest, then Euler’s identity shows that w has degree at most r − 2. Hence pi w has degree at most r − 1 and is orthogonal to g, and the last term equals (r − 1)Ea [pi gv]. Adding rEa [pi gv] to both sides gives (52). Step 3: the projection. Finally, by Lemma 3.7(ii), Ea [pi · ] is ai /|a| times the expectation under Dir(a + ei ), so (52) with v̄ in place of v states that g−

Ti g + rg |a| + 2r − 1

is orthogonal under Dir(a + ei ) to every polynomial of degree at most r − 1. Since this quotient has degree at most r − 1, it is the orthogonal projection of g onto that space. i Moreover, the projection lies in Ra+e r−1 , and not only among the polynomials of degree at most r − 1, because, by Lemma 5.14, the polynomial g has no posterior components of degree r − 2 or lower. 45

Theorem 5.16 (Average squared norm of the lower-degree projection). For every r ≥ 1 and g ∈ Rar , N X ai

2

a+ei Π≤r−1 g a+e =

|a| i=1

i

r ∥g∥2a . |a| + 2r − 1

Proof. Step 1: reduction to a prior expectation. Write b = |a| + 2r − 1. If we substitute Theorem 5.15 and convert each posterior norm to a prior expectation by Lemma 3.7(ii), then the weight ai /|a| cancels against the conversion factor |a|/ai : X ai i

|a|

2

i Πa+e ≤r−1 g a+e = i

hX i 1 2 . E p |T g + rg| a i i b2 i

On the simplex, expanding the square gives X

 X

pi |Ti g + rg|2 = Γ(g, g) + 2r Re ḡ

i



pi Ti g + r2 |g|2

i 2

2

= Γ(g, g) + r |g| , P

P

because i pi Ti g = 0 and i pi = 1. Step 2: the expectation. By Lemma 5.10(i) and (ii), Ea Γ(g, g) = r(|a| + r − 1)∥g∥2a , and r(|a| + r − 1) + r2 = rb. Dividing by b2 gives the theorem. P

At r = 1 the identity can be verified directly. A centered linear statistic g = j cj pj with a a j j cj = 0 lies in R1 , its projection onto the constants under the posterior Dir(a + ei ) is its posterior mean ci /(|a| + 1), and Lemma 3.7(i) gives P

ci 2 1 = ∥g∥2a . |a| |a| + 1 |a| + 1

X ai i

Lemma 5.17 (Sums over outcomes). Let h1 , . . . , hN be polynomials in p of degree at most r, and P let Y = N i=1 pi hi . Then N X   r+1 2 Πar+1 Y a ≤ Ea pi |hi |2 . |a| + 2r + 1 i=1 Proof. Step 1: the pairing in the posterior spaces. Since Πar+1 Y

a

=

sup g∈Ra r+1 , ∥g∥a =1

|⟨g, Y ⟩a |,

we fix such a g. Converting each term to the posterior by Lemma 3.7(ii), and inserting the projection i Πa+e ≤r , which is allowed because hi has degree at most r, we obtain ⟨g, Y ⟩a =

X

Ea [pi ḡhi ]

i

X ai

⟨g, hi ⟩a+ei |a| X ai i = Πa+e ≤r g, hi a+ei . |a| i =

i

46

Step 2: the two factors. By the Cauchy–Schwarz inequality in the weighted direct sum of the posterior spaces, X a X a  2 i i i |⟨g, Y ⟩a |2 ≤ Πa+e ∥hi ∥2a+ei . ≤r g a+ei |a| |a| i i The first factor equals (r + 1)/(|a| + 2r + 1) by Theorem 5.16 with r + 1 in place of r. The P second factor equals i Ea [pi |hi |2 ] by Lemma 3.7(ii).

5.5

The effect of one query on the level

We now use Lemmas 5.8 and 5.17 to bound the effects of appending |ϕ⟩ and applying ⟨ϕ|. Each map changes the level by at most one. Bounds on the components that move between levels then bound the commutator with C 1/2 , and hence the change in progress. The oracle in terms of two maps. Let W be the space of all registers other than the query register Q, so that V = W ⊗ Q after reordering. Define, pointwise in ϕ, the maps L+ : W → W ⊗ Q and L− : W ⊗ Q → W by L+ G = G ⊗ |ϕ⟩ =

X

αi G ⊗ |i⟩,

i

L− F =

X

for F = F⊥ ⊗ |⊥⟩ +

αi Fi

i

X

Fi ⊗ |i⟩,

i

together with JG = G ⊗ |⊥⟩ and its adjoint J † F = F⊥ . The maps L+ and J are isometries pointwise in ϕ, and L− = L†+ both pointwise and for the inner product of vector-valued polynomials. For N = 2, consider G± = α1 |1⟩ ± α2 |2⟩. Both are normalized and have level zero, but L− G+ = p1 + p2 = 1,

L− G− = p1 − p2 = 2p1 − 1.

Since Rp1 is uniform on [0, 1], the first output has level zero and the second has squared level-one norm 01 (2p − 1)2 dp = 1/3, attaining Lemma 5.17 at r = 0. The input components are orthogonal in the query register, but their images under L− are added in the same space. We must therefore bound their sum before taking its norm. We use L− to analyze the oracle; the full query remains unitary. We write J − L+ J † − L− √ , Kϕ† = . Kϕ = √ 2 2 √ The map Kϕ appends |ηϕ ⟩ = (|⊥⟩ − |ϕ⟩)/ 2 from (16), and its adjoint applies ⟨ηϕ |. Thus Kϕ Kϕ† is the projection onto |ηϕ ⟩ in the query register, and Oϕ = I − 2Kϕ Kϕ† .

(53)

The maps J and J † commute with every Pk , by the third fact after Definition 5.3, so the analysis of a query reduces to that of L+ and L− . The effect of one factor on a block. Fix a block uγ h with h ∈ Rar , where a = a(γ) and k = rep(γ) + r. The map L− multiplies by αi at outcome i. This changes γi to γi − 1 and the polynomial factor as in Lemma 5.14. The table lists the resulting degrees under the Dirichlet measure and levels. 47

input entry γi

new entry

change of rep

measure

degrees

levels

γi ≤ −1 γi = 0 γi = 1 γi ≥ 2

γi − 1 −1 0 γi − 1

+1 0 0 −1

a → a + ei a → a + ei a → a − ei a → a − ei

r, r − 1 r, r − 1 r, r + 1 r, r + 1

k + 1, k k, k − 1 k, k + 1 k − 1, k

In the first two rows the magnitude |γi | grows, the new Dirichlet measure is the posterior Dir(a + ei ), and part (i) of Lemma 5.14 splits h into degrees r and r − 1. In the last two rows the magnitude shrinks, the factor αi αi = pi appears, and part (ii) of the lemma splits pi h into degrees r and r + 1 for Dir(a − ei ). Multiplication by αi , which is what L+ does, obeys the same table with the signs of the entries reversed. Two consequences of the table are used repeatedly. First, a single factor changes the level by at most one. Second, the level increases only in the first and third rows, that is, only when the new factor falls on an outcome that already appears in the pattern. Combined with Lemma 5.8, which bounds the weight that a polynomial of degree d places on the occupied outcomes, this gives the p rate (d + 1)/N in Lemma 5.18, and hence the rate (d + 1)/N in Theorem 5.21. For L+ , we use Lemma 5.8. For L− , repeated unpaired factors use the same estimate, while paired conjugate factors require Lemma 5.17. As the G± example shows, terms contributing to the same output block must be added before taking norms. Lemma 5.18 (Raising the level by one). For L ∈ {L+ , L− } and every polynomial F ∈ P≤d in the domain of L, X d+1 2 Pk+1 LPk F ≤ 36 ∥F ∥2 . N k≥0 The proof is in Appendix A.1.6. For L+ , only occupied outcomes can raise the level, so Lemma 5.8 bounds their total squared norm by 16d/N times the input norm squared. For L− , repeated unpaired factors use the same estimate in the measure Dir(a−ei ), while paired conjugate factors use Lemma 5.17. Their bounds are 16(d + 1)/N and (d + 1)/(2N ), respectively. Within an output block we add these two contributions before taking the norm; distinct output blocks are orthogonal. The appendix verifies that every input component is counted at most once, giving the stated constant 36. Lemma 5.19 (Lowering the level by one). For L ∈ {L+ , L− } and every polynomial F ∈ P≤d in the domain of L, X d+2 2 Pk−1 LPk F ≤ 36 ∥F ∥2 . N k≥1 The proof is in Appendix A.1.7. This follows by duality from Lemma 5.18, since L†+ = L− and the output has degree at most d + 1. Applying the raising estimate at that degree gives d + 2 in the numerator. Lemma 5.20 (One map and the level). For L ∈ {L+ , L− , J, J † } and every polynomial F ∈ P≤d in the domain of L, s d+2 C 1/2 LF − LC 1/2 F ≤ 12 ∥F ∥. N Proof. For J and J † the left side is zero. Let L ∈ {L+ , L− }.

48

Since L maps each block to adjacent levels only, inserting the level decomposition on both sides of L gives √
X √ k + 1 − k Pk+1 LPk C 1/2 L − LC 1/2 = k≥0

+

X √

k−

√

k + 1 Pk LPk+1 ,

k≥0

and every scalar factor has absolute value at most one. The terms of the first sum lie at distinct levels, so its norm on F is at most X

∥Pk+1 LPk F ∥2

s

1/2

≤6

k

d+1 ∥F ∥ N

p

by Lemma 5.18. Likewise, the second sum is at most 6 (d + 2)/N ∥F ∥ by Lemma 5.19. The triangle inequality gives the claim. Theorem 5.21 (One-query growth). There is an absolute constant c0 such that for all F ∈ P≤d (V), s

λ(Oϕ F ) ≤ λ(F ) + c0

d+1 ∥F ∥, N

and the same holds for the controlled query Oϕc . Proof. By (53), 

C 1/2 Oϕ − Oϕ C 1/2 = −2 (C 1/2 Kϕ − Kϕ C 1/2 )Kϕ† 

+ Kϕ (C 1/2 Kϕ† − Kϕ† C 1/2 ) , and we bound the two terms on F ∈ P≤d (V) separately. Step 1: the two terms. For the first term, we have Kϕ† F ∈ P≤d+1 and ∥Kϕ† F ∥ ≤ ∥F ∥, because √ Kϕ† is a contraction pointwise in ϕ. Moreover, Kϕ = (J − L+ )/ 2 with J commuting with C 1/2 , so Lemma 5.20 for L+ at degree d + 1 gives 12 (C 1/2 Kϕ − Kϕ C 1/2 )Kϕ† F ≤ √ 2

s

d+3 ∥F ∥. N

√ For the second term, the map Kϕ is an isometry pointwise and Kϕ† = (J † − L− )/ 2, so the lemma for L− at degree d gives 12 Kϕ (C 1/2 Kϕ† − Kϕ† C 1/2 )F ≤ √ 2

s

d+2 ∥F ∥. N

Step 2: the level after the query. Using d + 3 ≤ 3(d + 1) and d + 2 ≤ 2(d + 1), the two terms together give s

C

1/2

Oϕ F − O ϕ C

1/2

√ √ √ F ≤ 12 2 ( 3 + 2) s

≤ 54

49

d+1 ∥F ∥. N

d+1 ∥F ∥ N

Since Oϕ preserves norms for every ϕ, it also preserves the norm of a polynomial. Hence λ(Oϕ F ) = ∥C 1/2 Oϕ F ∥ ≤ ∥Oϕ C 1/2 F ∥ + ∥C 1/2 Oϕ F − Oϕ C 1/2 F ∥ = λ(F ) + ∥C 1/2 Oϕ F − Oϕ C 1/2 F ∥. Step 3: the controlled query. The control projections are ϕ-independent and commute with C 1/2 , so C 1/2 Oϕc − Oϕc C 1/2 = |1⟩⟨1| ⊗ (C 1/2 Oϕ − Oϕ C 1/2 ). Applying the bound just proved to (|1⟩⟨1| ⊗ I)F ∈ P≤d (V), whose norm is at most ∥F ∥, gives the same estimate, and Oϕc is again unitary pointwise. The proof gives c0 = 54 and completes Theorem 5.6. Only the rank-one part enters the commutator, since the identity commutes with C 1/2 . Inverse queries are also covered because Oϕ−1 = Oϕ . Remark 5.22 (State designs). For a fixed algorithm given s copies and making q queries to the canonP ical oracle, Ψ(ϕ) has degree at most s + 2q (Lemma 5.1). The score integrand z N pϕ (z)∥Ψz (ϕ)∥2 therefore has degree at most 2s + 4q + 2, since N pϕ (z) = N αz αz has degree two. Averaging over a uniform global phase eliminates monomials with unequal numbers of amplitudes and conjugates. Every remaining monomial has degree at most s + 2q + 1 in each, so an exact (s + 2q + 1)-design preserves its Haar expectation. The score, and hence the bound of Theorem 5.6 for the supplied s copies, is unchanged when the state is drawn from such a design and multiplied by an independent uniform global phase.

5.6

Haar-random unitary access

With Haar-random unitary access the algorithm applies a Haar-random U , its inverse, and controlled versions of both, and the state scored is |ϕ⟩ = U |0n ⟩. The following simulation result reduces this model to the canonical oracle. The conditional distribution below is the random state-preparation oracle of [Kre21, Definition 8]. Fix any unitary V with V |0n ⟩ = |ϕ⟩, and let W fix |0n ⟩ and be Haar-random on its orthogonal complement. Then Uϕ = V W , and Haar invariance makes its distribution independent of the choice of V . Theorem 5.23 ([Kre21, Definition 8 and Theorem 19]). For a unit vector |ϕ⟩ ∈ CN , let Uϕ be a random unitary with Uϕ |0n ⟩ = |ϕ⟩, distributed according to the Haar measure on the set of such unitaries. 1. For every algorithm A that makes q queries to Uϕ , including inverse and controlled queries, there is an algorithm B that makes 2q queries to Oϕ such that, for every |ϕ⟩, the channel from the input to the premeasurement state of A, √ averaged over Uϕ , and the corresponding channel of B are within diamond distance (10q + 4)/ N . Here the diamond distance is the completely bounded trace norm of the difference, without a factor 1/2. 2. If |ϕ⟩ is Haar-random, then Uϕ is a Haar-random unitary. Converting a distance between channels into a difference of scores requires a bound on the largest possible reward, which is N times the probability of the heaviest outcome.

50

Lemma 5.24 (The heaviest outcome). Let HN = 

PN

j=1 1/j. For a Haar-random state,



Eϕ N max pz = HN ≤ ln N + 1. z

The proof is in Appendix A.1.8. Theorem 5.25 (Haar lower bound for unitary access). Every algorithm that makes q queries to a Haar-random unitary, with inverse and controlled access, satisfies √ (5q + 2)HN √ . B(A) ≤ βN + 2 2 Λ0,2q + 72 Λ20,2q + N Consequently, there is an absolute constant c3 > 0 such that, for every 0 < ε ≤ 1 and every N with √ (5N 1/3 + 2)(ln N + 1) ≤ ε N /2, a score of 2 + ε requires at least c3 ε2/3 N 1/3 queries. Proof. Step 1: a fixed state. Fix ϕ and let Z and Z ′ be the outputs of A, averaged over Uϕ , and of the simulator B of Theorem 5.23. The diamond distance bounds the trace norm of the difference of the premeasurement states, and the total variation distance of the output distributions is at most half of that trace norm. Since the reward z 7→ N pz is nonnegative and at most N maxz pz , the two scores differ by at most the total variation distance times N maxz pz , that is, 5q + 2 N E[pZ | ϕ] ≤ N E[pZ ′ | ϕ] + √ N max pz . z N Step 2: averaging over the state. We now average over the Haar-random ϕ, under which Uϕ is Haar-random. The simulator B is a mixture of algorithms of the form of Definition 3.1, each making 2q queries to Oϕ , and the expected score is linear in the mixture. Hence Theorem 5.6 with s = 0 and 2q queries bounds the first term on the right; Lemma 5.24 bounds the second, which gives the display in the statement. Step 3: the consequence. We may assume q ≤ N 1/3 , because for q > N 1/3 the claim holds for every c3 ≤ 1. Then, by the √ hypothesis on N , the last term of the statement is at √ display in the 2 1/3 most (5N + 2)(ln N + 1)/ N ≤ ε/2, and βN ≤ 2 gives ε/2 ≤ 2 2 Λ0,2q + 72 Λ0,2q . The proof of Corollary 5.7, with ε/2 in place of ε and 2q in place of q, gives 2q ≥ c2 (ε/2)2/3 N 1/3 , so the claim holds with c3 = min{1, c2 /25/3 }. Together with Theorem 6.9 in Section 6, which applies to unitary access without change because the squaring algorithm uses U only to prepare |ϕ⟩ and to reflect about it, this proves part 2 of Theorem 1.1 and the Haar case of the final statement of that theorem. The quantity HN = Θ(log N ) is also the supremum of the expected scores of all algorithms: by (18) no algorithm scores more than Eϕ N maxz pz = HN , and an algorithm with enough queries can identify the heaviest outcome with probability close to one.

6

The squaring algorithm

In this section we prove part 3 of Theorem 1.1 and the formal version of Corollary 1.3. The algorithm and its analysis are the same for the Fourier ensemble, for the canonical oracle, and for Haar-random unitary access, because the algorithm uses the oracle only to prepare a state whose measurement gives the ideal distribution, and to reflect about it. We treat the three forms of access together and

51

write ω for the oracle, p = pω for the ideal distribution, and pz = p(z). The normalized moments of p and the collision distribution are Mj = N j−1

X

pjz

p2 N p2z rp (z) = P z 2 = , M2 y py

(j ≥ 1),

z

(54)

where rp is the distribution of the common value of two independent samples from p conditioned on their being equal. The ideal score (19) is Eω M2 , and M2 ≥ 1 for every distribution by the Cauchy–Schwarz inequality 1=

X

pz

2

≤N

z

6.1

X

p2z .

z

The three forms of access

In each case the oracle provides access for state preparation and reflection: there is a unit vector |ψω ⟩ ∈ CN whose computational-basis measurement has distribution pω , one query prepares |ψω ⟩, and two queries implement the reflection 2|ψω ⟩⟨ψω | − I. Fourier ensemble. Let ∆f |x⟩ = f (x)|x⟩ be the phase query, which is one query to the value oracle with the target qubit in |−⟩ by (15), and let Uf = H ⊗n ∆f H ⊗n , a unitary with Uf† = Uf . Then X |ψf ⟩ = Uf |0n ⟩ = fb(z)|z⟩, z

P P because H ⊗n |0n ⟩ = N −1/2 x |x⟩ and H ⊗n |x⟩ = N −1/2 z χz (x)|z⟩.

Canonical oracle. Here |ψϕ ⟩ = |ϕ⟩ = Oϕ |⊥⟩. The reflection about |ϕ⟩ acts on the query register Q = C|⊥⟩ ⊕ CN , but the algorithm below never leaves CN once |ϕ⟩ has been prepared, because |ϕ⟩ ∈ CN and both reflections it uses map CN to itself. Haar-random unitary access. Here |ψU ⟩ = U |0n ⟩. The reflections in the three cases are 2|ψf ⟩⟨ψf | − I = Uf (2|0n ⟩⟨0n | − I)Uf ,

(Fourier ensemble)

2|ϕ⟩⟨ϕ| − IQ = Oϕ (2|⊥⟩⟨⊥| − IQ )Oϕ ,

(canonical oracle)

n

n

†

2|ψU ⟩⟨ψU | − I = U (2|0 ⟩⟨0 | − I)U ,

(unitary access)

where the second identity holds by (17). For j ≥ 1 let κj = j! in the two Haar cases, where p is uniform on the simplex, and, in the Fourier ensemble, κj = (2j − 1)!! = 1 · 3 · · · (2j − 1). These are the limits of EMj as N → ∞, and Lemma 6.2 gives EMj ≤ κj for every j together with the exact values of EM2 and EM3 . In particular, κ2 , which is 2 for Haar access and 3 for the Fourier ensemble, is the limit of the ideal score.

6.2

The algorithm

The algorithm stores the outcomes of m measured samples and amplifies the component of one more sample that lies in the stored set. The probability of the stored set is a random variable whose mean is about κ2 m/N (Lemma 6.5), and the algorithm chooses its number of amplification steps as if this probability were exactly P⋆ = κ2 m/N ; it never estimates the actual probability. Definition √6.1 (The squaring algorithm Sqm ). Let m ≥ 1 be such that P⋆ = κ2 m/N ≤ 1/4, let ϑ0 = arcsin P⋆ , let ℓ be a nonnegative integer nearest to π/(4ϑ0 ) − 1/2, and put L = 2ℓ + 1, so that |Lϑ0 − π/2| ≤ ϑ0 . The algorithm proceeds as follows. 52

1. Prepare and measure m copies of |ψω ⟩, obtaining outcomes Y1 , . . . , Ym , and store the set S = {Y1 , . . . , Ym }. 2. Prepare one more copy of |ψω ⟩. 3. Apply ℓ times the operator (2|ψω ⟩⟨ψω | − I)(I − 2ΠS ),

where ΠS =

X

|z⟩⟨z|.

z∈S

4. Measure in the computational basis and output the outcome Z. The reflection I − 2ΠS uses only the stored set, so the number√of queries is m + 1 + 2ℓ. Since |Lϑ0 − π/2| ≤ ϑ0 gives 2ℓ ≤ π/(2ϑ0 ), and arcsin u ≥ u gives ϑ0 ≥ P⋆ , the number of queries is at most s N π π m+1+ ≤m+1+ . (55) 2ϑ0 2 κ2 m The number of amplification steps depends only on N , m, and the ensemble, through P⋆ = κ2 m/N ; it does not depend on the oracle or on the stored outcomes. The rest of the section proves that the resulting output distribution is close to the collision distribution, which is proportional to p2z .

6.3

Moments of the two ensembles

Lemma 6.2 (Moments). The following hold. (i) In the Haar ensemble, for all j ≥ 1, N j−1 j! ≤ j!, (N + 1)(N + 2) · · · (N + j − 1) (2j)! + j 2 (j!)2 Var Mj ≤ , and in particular N 2N 6N 2 EM2 = , EM3 = , N +1 (N + 1)(N + 2) 4N 2 − 4N + 24 4 ≤ . E(M2 − 2)2 = (N + 1)(N + 2)(N + 3) N EMj =

EMj2 ≤ (j!)2 +

EM4 ≤ 24,

(2j)! , N

together with

and

 √  (ii) In the Fourier ensemble, E ( N fb(z))2j ≤ κj for every z and j ≥ 1, hence EMj ≤ κj and EMj2 ≤ κ2j , and 2 30 16 EM2 = 3 − , EM3 = 15 − + 2, N N N

Var M2 ≤

24 , N

E(M2 − 3)2 ≤

28 , N

Var M3 ≤

104 . N

The proof is in Appendix A.2. The two limiting distributions are visible in these √ values: N pz is nearly an exponential random variable in the Haar ensemble, with moments j!, and N fb(z) is nearly a standard Gaussian in the Fourier ensemble, with even moments (2j − 1)!!.

53

6.4

The output distribution for a fixed stored set P

Fix the oracle and the outcomes Y1 , . . . , Ym , and let PS = p(S) = z∈S pz be the mass of the stored set, in the notation of Lemma 3.7(iii); it is positive because every stored outcome has positive probability. For a set T with p(T ) > 0 let µT (z) =

pz 1[z ∈ T ] p(T )

be p conditioned on T use µS and, when PS < 1, µS c , where S c is the complement of S. Put √. We
2 g(P ) = sin L arcsin P . Lemma 6.3 (Output distribution for a fixed stored set). Conditioned on the oracle and on S, the output of Sqm has the distribution g(PS ) µS + (1 − g(PS )) µS c , where the second term is absent if PS = 1. Proof. Apply Lemma 3.3 with ψ = |ψω ⟩ and Π = ΠS , so that P = ∥ΠS ψω ∥2 = PS . If PS = 1, the state after step 3 of Definition 6.1 is ±|ψω ⟩ and the output has distribution p = µS . Otherwise the state is sin(Lϑ)u + cos(Lϑ)u⊥ , where ϑ = arcsin

p

ΠS ψω , u= √ PS

PS ,

u⊥ =

(I − ΠS )ψω √ . 1 − PS

When PS < 1, measuring this state gives z ∈ S with probability sin2 (Lϑ) pz /PS and z ∈ / S with probability cos2 (Lϑ) pz /(1 − PS ), because u and u⊥ are supported on S and on its complement. Lemma 6.4 (Amplification error). Let 0 < P⋆ ≤ 1/4 and let L be as in Definition 6.1. Then, for every P ∈ (0, 1], 1 − g(P ) ≤ 18 (P/P⋆ − 1)2 + 3P⋆ . The two terms have different origins: the first is the change of the amplification angle when the actual probability P differs from the design value P⋆ , and the second is the rounding of the number of steps to an integer. √ Proof. Step 1: reduction to the error in the angle. Let ϑ = arcsin P ∈ (0, π/2]. Then 1 − g(P ) = cos2 (Lϑ) = sin2 (Lϑ − π/2) ≤ (Lϑ − π/2)2 , and, by the triangle inequality and the property |Lϑ0 − π/2| ≤ ϑ0 of Definition 6.1, |Lϑ − π/2| ≤ L|ϑ − ϑ0 | + |Lϑ0 − π/2| ≤ L|ϑ − ϑ0 | + ϑ0 , 2

1 − g(P ) ≤ 2L (ϑ − ϑ0 )

2

and therefore

+ 2ϑ20 .

Step 2: bounds on ϑ0 and on L. Since arcsin is convex on [0, 1] with arcsin(1/2) = π/6, we have arcsin u ≤ (π/3)u for 0 ≤ u ≤ 1/2. Hence p

ϑ0 ≤ (π/3) P⋆ ,

2ϑ20 ≤ (2π 2 /9)P⋆ ≤ 3P⋆ . 54

√ √ Moreover, |Lϑ − π/2| ≤ ϑ gives L ≤ π/(2ϑ ) + 1, and with P ≤ ϑ and P⋆ ≤ 1/2 this gives 0 0 0 ⋆ 0 √ L P⋆ ≤ π/2 + 1/2. √ √ √ Step 3: the cases P ≤ 1/2 and √ P > 1/2. If P ≤ 1/2, then P and P⋆ lie in [0, 1/ 2], where the derivative of arcsin is at most 2, so |ϑ − ϑ0 | ≤ ≤

q p p √ √ 2 P − P⋆ = 2P⋆ P/P⋆ − 1 p

2P⋆ |P/P⋆ − 1|,

√ √ using | y − 1| ≤ |y − 1| for y ≥ 0. Therefore, by the bound on L P⋆ in Step 2, 2L2 (ϑ − ϑ0 )2 ≤ 4(L P⋆ )2 (P/P⋆ − 1)2 p

≤ 4(π/2 + 1/2)2 (P/P⋆ − 1)2 ≤ 18 (P/P⋆ − 1)2 . If instead P > 1/2, then P/P⋆ > 2, so 1 − g(P ) ≤ 1 ≤ (P/P⋆ − 1)2 , and the claim follows in both cases.

6.5

The output distribution of the algorithm

We now average over the stored outcomes. Fix the oracle, let Y1 , . . . , Ym be independent with distribution p, and put m 1 X Wi . Wi = N pYi , W = m i=1 Let D be the event that Y1 , . . . , Ym are distinct, and let P eY (z) = µ

i Wi 1[Yi = z]

mW

be the probability distribution that gives each stored outcome a weight proportional to its reward; it eY equals µS , the output distribution is well defined because every Wi is positive. On the event D, µ of the algorithm conditioned on the amplified sample lying in S (Lemma 6.3). For a single stored set the normalization W has fluctuations of order m−1/2 , but the average of eY over the stored outcomes is within O(1/m) of the collision distribution. The reason, made precise µ in the proof of the next lemma, is that conditioned on one stored outcome z, the normalization mW is N pz plus the sum of the rewards of the other m − 1 outcomes, which is independent of z, so Jensen’s inequality bounds the average from below in terms of the mean (m − 1)M2 of that sum. Lemma 6.5 (Identities for the stored set). For every distribution p: (i) EY W = M2 and VarY (W ) ≤ M3 /m; eY = µS and PS = mW /N ; (ii) on D, µ

(iii) PrY [Dc ] ≤ m(m − 1)M2 /(2N ); eY satisfies (iv) the average EY µ

e Y , rp ≤ TV EY µ

M3 , mM22

where TV(a, b) =

55

1X |a(z) − b(z)|. 2 z

Proof. Part (i) holds because EW1 = the Wi are independent. On D, X

P 2 2 2 z pz · N pz = M2 , Var W1 ≤ EW1 = z pz N pz = M3 , and

P

Wi 1[Yi = z] = N pz 1[z ∈ S],

mW = N

i

X

pz = N PS ,

z∈S

eY (z) = pz 1[z ∈ S]/PS = µS (z), which proves (ii). Part (iii) follows from the union bound over so µ P pairs, since Pr[Yi = Yj ] = z p2z = M2 /N . eY , which is a probability distribution. Since the Yi For part (iv), write wz = N pz and µ̄ = EY µ are exchangeable,

µ̄(z) = m EY

h W 1[Y = z] i 1 1

W1 + W ′ h i 1 = m p z wz E , ′ wz + W

W′ =

m X

Wi ,

i=2

where W ′ is independent of Y1 and has mean (m − 1)M2 by (i). This holds for every z with pz > 0; if pz = 0, then µ̄(z) = rp (z) = 0. Since t 7→ 1/t is convex on t > 0, Jensen’s inequality gives h

E

i 1 1 ≥ . ′ wz + W wz + (m − 1)M2

Substituting this into the display above for µ̄(z) and using rp (z) = pz wz /M2 , we obtain m pz wz wz + (m − 1)M2 mM2 = rp (z) . wz + (m − 1)M2

µ̄(z) ≥

We distinguish two cases. 1. If wz ≤ M2 , the fraction is at least 1 and µ̄(z) ≥ rp (z). 2. If wz > M2 , then wz − M 2 wz + (m − 1)M2 wz − M 2 , ≤ rp (z) mM2

rp (z) − µ̄(z) ≤ rp (z)

where the second inequality holds because wz + (m − 1)M2 > mM2 . Since µ̄ and rp are probability distributions, TV(µ̄, rp ) is the sum over z of the positive parts of rp (z) − µ̄(z). Moreover, P X N 2 z p3z M3 P 2 = rp (z)wz = , (56) N z pz M2 z so TV(µ̄, rp ) ≤

1 X M3 rp (z) wz = . mM2 z mM22

56

Theorem 6.6 (Output distribution of the squaring algorithm). For each oracle ω let aω (z) = Pr[Z = z | ω] be the output distribution of Sqm , where m ≥ 1 satisfies κ2 m/N ≤ 1/4. Then !

hM i  3κ m 1 m EM2 18  EM3 3 2 2 + Eω TV(aω , rpω ) ≤ Eω + + + E(M − κ ) . 2 2 2 2 m N N 2 M2 κ2 m

(57)

In particular, if N ≥ 64 and m = ⌈N 1/3 ⌉, then Sqm makes at most 3N 1/3 queries and (

Eω TV(aω , rpω ) ≤

40 N −1/3 60 N −1/3

in the Haar ensemble, in the Fourier ensemble.

(58)

Proof. Step 1: the triangle inequality. Fix ω, write p = pω , let aω,S be the output distribution eY . Since aω = EY aω,S and the total conditioned on S, which Lemma 6.3 describes, and let µ̄ = EY µ variation distance is convex, the triangle inequality and Lemma 6.5(iv) give TV(aω , rp ) ≤ TV(aω , µ̄) + TV(µ̄, rp ) M3 eY ) + . ≤ EY TV(aω,S , µ mM22 eY ) separately on D and on Dc . Step 2: the two events. We bound TV(aω,S , µ eY = µS by Lemma 6.5(ii), and 1. On D we have µ

aω,S − µS = (1 − g(PS ))(µS c − µS ), where µS and µS c are distributions with disjoint supports when PS < 1, and therefore eY ) = 1 − g(PS ). When PS = 1, both sides are 0, because then aω,S = p = µS by TV(aω,S , µ Lemma 6.3 and g(1) = sin2 (Lπ/2) = 1 since L is odd. 2. On Dc , the total variation distance is at most 1. Therefore TV(aω , rp ) ≤ EY 1D (1 − g(PS )) + PrY [Dc ] + 



M3 . mM22

Step 3: the amplification bound and averaging over the oracle. On D we have PS /P⋆ = W /κ2 by Lemma 6.5(ii), so Lemma 6.4 gives 1 − g(PS ) ≤

18 (W − κ2 )2 + 3P⋆ , κ22

and EY (W − κ2 )2 = VarY (W ) + (M2 − κ2 )2 ≤ M3 /m + (M2 − κ2 )2 by Lemma 6.5(i). With part (iii) of the same lemma, the bounds of Step 2 and the two bounds above give !

 3κ m m M2 18  M3 M3 2 2 TV(aω , rp ) ≤ + + + (M − κ ) , + 2 2 2 N N mM22 κ22 m

57

and averaging over ω proves (57). Step 4: the parameters of the second statement. Let N ≥ 64 and m = ⌈N 1/3 ⌉, so m ≥ N 1/3 and 5 m ≤ N 1/3 + 1 ≤ N 1/3 , 4 15 −2/3 κ2 m/N ≤ N ≤ 1/4. 4 By (55) the number of queries is at most m+1+

5 πq π  N/(κ2 m) ≤ + √ N 1/3 + 1 2 4 2 2

≤ 3N 1/3 , since N 1/3 ≥ 4. In (57) we use M2 ≥ 1, the moments of Lemma 6.2, and the bounds 25 2/3 N , 16 1 N −1 ≤ N −1/3 . 16

m ≥ N 1/3 ,

m(m − 1) ≤

5 5 m/N ≤ N −2/3 ≤ N −1/3 , 4 16

Step 5: the Haar and Fourier ensembles. The four terms of (57) are at most the four summands on the left, in the Haar ensemble (first row) and in the Fourier ensemble (second row): 6 m(m − 1)  27 18  6m  25 18 30  −1/3 + + + + ≤ 6+ + 27 + + N ≤ 40N −1/3 , m N m N N 16 16 16 15 3m(m − 1)  30 56  9m  75 56 45  −1/3 + + + + ≤ 15 + + 30 + + N ≤ 60N −1/3 . m 2N m N N 32 16 16 For m of order N 1/3 the first three terms of (57) are of order N −1/3 and the fourth is of order N −2/3 : the first is the bias of the averaged stored-set distribution, the second the probability of a repeated stored outcome, the third the failure of the amplification caused by the deviation of PS from P⋆ , and the fourth the rounding of the number of amplification steps.

6.6

The score of the output distribution

A small error in total variation does not by itself control the score, since the reward N pz of a single outcome may be as large as N . The score that an output distribution a loses relative to rp comes from the outcomes to which a assigns less probability than rp , and the next lemma makes use of this fact. Lemma 6.7 (Total variation and the score). For all distributions p and a on {0, 1}n , M3 a(z) N pz ≥ − M 2 z

X

s

M4 TV(a, rp ). M2

Consequently, an algorithm whose output distribution for the oracle ω is aω has B(A) ≥ Eω

hM i 3

M2

s

−

hM i

Eω

58

4

M2

Eω TV(aω , rpω ).

Proof. The score of the collision distribution is M3 /M2 by (56). Step 1: the shortfall of a relative to rp . Let dz = max{rp (z) − a(z), 0}, so that X

0 ≤ dz ≤ rp (z),

a(z) ≥ rp (z) − dz .

dz = TV(a, rp ),

z

Then, since the score of rp is M3 /M2 , X

M3 X − N pz dz . M2 z

a(z)N pz ≥

z

Step 2: the Cauchy–Schwarz bound. By the Cauchy–Schwarz inequality, and then by the properties of dz in Step 1, X

1/2 X

N pz dz ≤

X z

z

≤

X

1/2

z

N 2 p2z dz

N 2 p2z rp (z)

dz

1/2

TV(a, rp )1/2 ,

z

and

P N 3 z p4z M4 2 2 P N pz rp (z) = = . 2 N p M2 z z z

X

With Step 1, this proves the first claim.   For the second claim, average over ω and then bound Eω (M4 /M2 )1/2 TV(aω , rpω )1/2 by the Cauchy–Schwarz inequality. Lemma 6.8 (The limiting scores). Recall that (κ3 , κ4 ) = (6, 24) in the Haar ensemble and (15, 105) in the Fourier ensemble, so that κ3 /κ2 equals 3 and 5, and κ4 /κ2 equals 12 and 35. Then hM i

E

3

M2

≥

κ3 Clim −√ , κ2 N

hM i

E

4

M2

≤

κ4 Clim +√ κ2 N

for an absolute constant Clim . Proof. Step 1: comparison with EMj /κ2 . Let j ∈ {3, 4}. Since M2 ≥ 1, Mj Mj |M2 − κ2 | Mj |M2 − κ2 | Mj − = ≤ , M2 κ2 κ2 M2 κ2 so, by the Cauchy–Schwarz inequality, hM i

E

j

M2

EMj2 E(M2 − κ2 )2 EMj − ≤ κ2 κ2

1/2

.

Step 2: the moment bounds. By Lemma 6.2, EM3 ≥ κ3 − 30/N,

EM4 ≤ κ4 ,

E(M2 − κ2 )2 ≤ 28/N,

and EM32 and EM42 are bounded by absolute constants, in both ensembles; in the Haar ensemble the first bound holds because κ3 − EM3 = 6(3N + 2)/((N + 1)(N + 2)) ≤ 18/N . With Step 1, this gives both bounds.

59

Theorem 6.9 (Scores of the squaring algorithm). Let N ≥ 64 and m = ⌈N 1/3 ⌉. Then the squaring algorithm has the following properties. (i) It makes O(N 1/3 ) queries. (ii) Its output distribution satisfies Eω TV(aω , rpω ) = O(N −1/3 ). (iii) Its expected score is at least 5 − O(N −1/6 ) in the Fourier ensemble and at least 3 − O(N −1/6 ) for either form of Haar access. Proof. Combine Theorem 6.6 with Lemmas 6.7 and 6.8. The score is then at least  1/2
κ3 − O(N −1/2 ) − κ4 /κ2 + O(N −1/2 ) O(N −1/3 ) . κ2

This proves part 3 of Theorem 1.1. The algorithm reaches every fixed score below 5 in the Fourier ensemble and below 3 in the Haar ensemble, which are the limiting scores of the collision distribution. Together with Theorem 4.4 and, for the Haar ensemble, Theorem 5.6, its Corollary 5.7, and Theorem 5.25, it also gives the formal version of Corollary 1.3. Corollary 6.10 (Sampling the collision distribution). Fix 0 < ν < 4/35 in the Fourier ensemble, or 0 < ν < 1/12 for either form of Haar access. (i) Every algorithm with no supplied copies whose output distribution satisfies Eω TV(aω , rpω ) ≤ ν has expected score at least κ3 q − (κ4 /κ2 ) ν − O(N −1/2 ), κ2 which exceeds the ideal score by a positive constant for all large N , and therefore makes Ω(N 1/3 ) queries. (ii) For N ≥ 64, the squaring algorithm with m = ⌈N 1/3 ⌉ makes O(N 1/3 ) queries and has Eω TV(aω , rpω ) = O(N −1/3 ). Proof. The score bound follows from Lemmas 6.7 and 6.8, using √ √ q √ t ν t ν √ (c + t)ν − cν = √ ≤ √ 2 c c+t+ c √ with c = κ4 /κ2 and t = Clim / N . The thresholds are where the bound meets the ideal score: √ 5 − 35ν > 3 if and only if ν < 4/35, √ 3 − 12ν > 2 if and only if ν < 1/12. The query lower bound then follows from Theorem 4.4 in the Fourier ensemble and from Corollary 5.7, with no copies, and Theorem 5.25 in the Haar ensemble. Part (ii) restates parts (i) and (ii) of Theorem 6.9. The lower bounds of this paper concern the expected score, and Section 1.1 explains how they apply to the empirical score of a list of samples. In the other direction, the empirical score of independent runs of the squaring algorithm is, with high probability, at least any fixed value below its limiting score. 60

Corollary 6.11 (Empirical scores). Let N ≥ 64 and m = ⌈N 1/3 ⌉, let Z1 , . . . , Zk be the outputs of k independent runs of Sqm on the same oracle ω, each with a fresh stored set, and let bk = B

k 1X N pω (Zi ) k i=1

be their empirical score. Then, for 0 < t ≤ 1, h

bk ≤ Pr B

i  κ3 C 1 −t ≤ 2 + N −1/6 κ2 t k

for an absolute constant C, where the probability is over the oracle and the k runs, and κ3 /κ2 is 5 in the Fourier ensemble and 3 for either form of Haar access. In particular, for every fixed b < κ3 /κ2 and ζ > 0, k = O(1/ζ) runs suffice for the empirical score to be at least b with probability at least 1 − ζ, for all large N . Proof. Step 1: reduction by Chebyshev’s inequality. Let Bω =

X

aω (z)N pω (z),

Qω =

z

X

aω (z)N 2 pω (z)2

z

be the mean and the second moment of the reward of one run conditioned on ω. Conditioned on ω, the rewards N pω (Zi ) are independent with mean Bω and variance at most Qω , so Chebyshev’s inequality gives bk ≤ Bω − t/2 | ω] ≤ 4Qω , Pr[B kt2 and therefore i h i h bk ≤ κ3 − t ≤ Pr Bω ≤ κ3 − t + 4 Eω Qω . Pr B κ2 κ2 2 kt2 Step 2: the second moment. Write Xω∗ = N maxz pω (z). Since z rp (z)N 2 p2z = M4 /M2 ≤ M4 , P as in the proof of Lemma 6.7, and z |aω (z) − rp (z)| = 2 TV(aω , rp ), we have P

Qω ≤ M4 + 2 TV(aω , rp )(Xω∗ )2 . Since TV(aω , rp ) ≤ 1, the Cauchy–Schwarz inequality gives q

Eω Qω ≤ κ4 + 2 Eω TV(aω , rp )

q

Eω (Xω∗ )4 .

In both ensembles, Pr[Xω∗ ≥ u] ≤ 2N e−u/2 for u ≥ 0. For Fourier sampling this is part of Lemma 7.7. For a Haar-random state, Lemma 3.7(iii) with S = {z} shows that pz has the density (N − 1)(1 − s)N −2 on [0, 1], so, for 0 ≤ u ≤ N , Pr[N pz ≥ u] = (1 − u/N )N −1 ≤ e−u(N −1)/N ≤ e−u/2

since N − 1 ≥ N/2,

and Pr[N pz ≥ u] = 0 for u > N ; the union bound over z then applies. Hence, with u0 = 2 ln(2N ) ≤ 2(n + 1), the tail bound gives E(Xω∗ )4 ≤ u40 + = u40 +

Z ∞ u0 Z ∞

4u3 · 2N e−u/2 du 4(v + u0 )3 e−v/2 dv

0

≤ u40 + 32u30 + 1536, 61

using (v + u0 )3 ≤ 4(v 3 + u30 ) in the last step. With Eω TV(aω , rp ) = O(N −1/3 ) from Theorem 6.6, this gives Eω Qω ≤ κ4 + O(n2 N −1/6 ), which is bounded by an absolute constant. Step 3: the conditional mean. By Lemma 6.7 and M2 ≥ 1, M3 q Bω ≥ − M4 TV(aω , rp ). M2 Let E1 be the event |M3 /M2 − κ3 /κ2 | ≥ t/4, and let E2 be the event M4 TV(aω , rp ) ≥ t2 /16. By this bound on Bω and the union bound, h

Pr Bω ≤

κ3 ti − ≤ Pr[E1 ] + Pr[E2 ], κ2 2

and, by Markov’s inequality for nonnegative random variables, 4 M3 κ3 − , E t M2 κ2  16  Pr[E2 ] ≤ 2 E M4 TV(aω , rp ) . t Pr[E1 ] ≤

Since M2 ≥ 1,

M3 κ3 κ3 |M2 − κ2 | ≤ |M3 − κ3 | + − , M2 κ2 κ2

whose expectation is O(N −1/2 ), because E|M3 − κ3 | ≤ (Var M3 +(EM3 −κ3 )2 )1/2 and E|M2 − κ2 | ≤ (E(M2 − κ2 )2 )1/2 , while Lemma 6.2 gives Var M3 ≤ 104 /N , |EM3 − κ3 | ≤ 30/N , and E(M2 − κ2 )2 ≤ 28/N in both ensembles. Moreover, using TV(aω , rp ) ≤ 1, E[M4 TV(aω , rp )] ≤

q

EM42 E TV(aω , rp ) = O(N −1/6 ).

Step 4: conclusion. Collecting the bounds and using t ≤ 1 proves the first claim. The second follows by taking t = min{1, κ3 /κ2 − b} and k ≥ 2C/(ζt2 ), for N with CN −1/6 /t2 ≤ ζ/2.

6.7

Heavy outputs

The collision distribution also determines the probability of producing a heavy output. The original heavy output generation (HOG) task asks for a list with at least 2/3 of its outputs above the median ideal probability [AC17, Problem 1]. Here we study the expected heavy probability for the Haar ensemble. This differs from linear XEB, which weights an output by its ideal probability [AG20, Kre21]. Honest sampling already exceeds 2/3 in the limit; our question is how many queries are needed to improve on its heavy probability by a fixed amount. Let N = 2n ≥ 2 and pz = |⟨z|ϕ⟩|2 , where |ϕ⟩ is Haar-random, or |ϕ⟩ = U |0n ⟩ for Haar-random U . Queries may be controlled, and unitary queries may also be inverse queries. The other initial registers have a joint state independent of ϕ or U ; supplied copies, when allowed, are |ϕ⟩⊗s in the device registers, tensored with that state. Define θN = 1 − 2−1/(N −1) ,

Bτhog (A) = Pr[pZ > τ ].

(59)

The probability averages over the oracle and the algorithm’s randomness. The fixed threshold θN is the median of the marginal law Beta(1, N − 1). For comparison, let θbN = (p(N/2) + p(N/2+1) )/2 be the empirical median, where the probabilities are sorted in increasing order. Honest sampling at the fixed threshold has probability hog βN =

1 + (N − 1)θN 1 + ln 2 ≤ hhon := = 0.84657 . . . , 2 2 62

hog βN −→ hhon .

(60)

Theorem 6.12 (Heavy-output query bounds). With Λs,q as in Theorem 5.6, an algorithm given s copies and making at most q canonical queries satisfies the first bound below; an algorithm making at most q unitary queries, without supplied copies, satisfies the second: hog Bθhog (A) ≤ βN + Λs,q , N

(61)

5q + 2 hog Bθhog (A) ≤ βN + Λ0,2q + √ . N N

(62)

Set h⋆ =

2 + 2 ln 2 + (ln 2)2 = 0.96669 . . . . 4

(63)

For either threshold τ = θN or τ = θbN , and every fixed h ∈ (hhon , h⋆ ), achieving Bτhog (A) ≥ h without supplied copies has query complexity Θh (N 1/3 ) in either Haar access model. For N ≥ 64, Sqm with m = ⌈N 1/3 ⌉ makes at most 3N 1/3 queries and its heavy probability tends to h⋆ under both threshold conventions. The proof is in Appendix A.3. The lower bound uses the same progress measure as Section 5, but the heavy-output reward is bounded by one. Its expectation is therefore controlled by the distance from the normalized level-zero part. The upper bound follows from the collision distribution approximation in Theorem 6.6. The appendix also gives a sharper bound for arbitrary joint processing of supplied copies with no queries.

7

Certified randomness at the ideal score

In this section we prove Theorem 1.2. We consider the experiment of Definition 3.1 as a sequence of controlled queries and oracle-independent unitaries, as supplied by Lemma 3.2, with device register A, Eve’s register E, and initial state ψ0 ∈ A ⊗ E, whose reduced state on E is ρE . The final state and its branches are Ψ(ω) = (Vω ⊗ IE )ψ0 ,

Ψz (ω) = (Πz ⊗ IE )Ψ(ω),

and the reduced states of the branches on E are Eve’s conditional states ρωz . The device makes at most q queries, and its expected score is at least the ideal score minus δ. Both ensembles are treated by the same three steps. 1. The score bound of the corresponding lower-bound section, with the terms that its proof discards now retained, shows that the branches Ψz are close to auxiliary vectors Gz . 2. For every fixed oracle, the auxiliary vector is the image of ψ0 under an operator on the device p alone whose norm is at most poly(q) pω (z). 3. The family of auxiliary vectors, normalized, is a state within purified distance η of the actual one, and in this state Eve’s guessing probability is at most poly(q) times her probability of guessing an ideal sample, provided η ≤ 1/2. The third step is common to both ensembles, and we present it first.

63

7.1

Min-entropy from auxiliary vectors

Proposition 7.1 (Min-entropy from auxiliary vectors). Suppose that for every oracle ω and every z there is a linear operator Kz (ω) on A, depending measurably on ω, such that the vectors Gz (ω) = (Kz (ω) ⊗ IE )ψ0 satisfy ∥Kz (ω)∥2 ≤ κ pω (z)

for all ω and z,

Eω

X

∥Ψz (ω) − Gz (ω)∥2 ≤ η02

(64)

z

for some κ > 0 and 0 ≤ η0 < 1. Let ξ = Eω z ∥Gz (ω)∥2 , which is finite, because z ∥Gz (ω)∥2 ≤ P κ z pω (z) = κ, and at least (1 − η0 )2 > 0 by the second hypothesis in (64), and let τzω be the reduced state of Gz (ω) on E divided by ξ. Then the following hold. P

P

(i) The family τ is a normalized family of conditional states with P (ρ, τ ) ≤ η0 . (ii) The family τ satisfies τzω ⪯

κ pω (z) ρE ξ

for all ω and z,

(65)

so that for every ω and every measurement (Mz )z on E, X

Tr(Mz τzω ) ≤

z

κ max pω (z). ξ z

(66)

(iii) Consequently, 



η (Z | RE)ρ ≥ n − log κ − log N Eω max pω (z) − log Hmin z

1 ξ

for every η ∈ [η0 , 1].

(67)

(iv) If Eω z ⟨Ψz (ω), Gz (ω)⟩ = ξ, as when, for each z, the function ω 7→ Gz (ω) is the image of ω 7→ Ψz (ω) under an orthogonal projection of the space of square-integrable functions of ω, then X ξ = 1 − Eω ∥Ψz (ω) − Gz (ω)∥2 ≥ 1 − η02 . P

z

The family τ is normalized by the total weight ξ rather than oracle by oracle. This is what makes it a normalized family in the sense of Definition 3.4, and it allows the fidelity of ρ and τ to be bounded from below by a single inner product. It is a comparison family for the smoothing in P Definition 3.4 and not the state of another experiment: for a fixed ω, the weight z Tr τzω need not be 1. Proof. Step 1: the scalar ξ. We have Eω

X

∥Ψz (ω)∥2 = 1,

Eω

X

z

∥Ψz (ω) − Gz (ω)∥2 ≤ η02 ,

z

where the second bound is the second hypothesis in (64), and by definition ξ = Eω Hence, by the triangle inequality in the direct sum over z and the average over ω, p



ξ ≥ Eω

X

∥Ψz (ω)∥2

1/2



− Eω

z

X

∥Ψz (ω) − Gz (ω)∥2

2 z ∥Gz (ω)∥ .

P

1/2

z

≥ 1 − η0 > 0. √ √ 2 P Thus ξ ≥ (1−η0 )2 > 0, as stated, and the rescaled vectors Gz (ω)/ ξ satisfy Eω z Gz (ω)/ ξ = 1. 64

Step 2: the overlap c. Let c = ξ −1/2 Eω z ⟨Gz (ω), Ψz (ω)⟩ be the overlap of the branches with the rescaled vectors. For every scalar t, expanding the square and using the two normalizations of Step 1 and the definition of c, we obtain P

Eω

X

p

Ψz (ω) − tGz (ω)/ ξ

2

= 1 − 2 Re(t̄c) + |t|2

z

= |c − t|2 + 1 − |c|2 . The squared distance on the left is√therefore minimized over t at t = c, where it equals 1 − |c|2 , so 1 − |c|2 is at most its value at t = ξ. That value is the left side of the second hypothesis in (64), and hence X 1 − |c|2 ≤ Eω ∥Ψz (ω) − Gz (ω)∥2 ≤ η02 . (68) z

Step 3: the bound on P (ρ, τ ). The family τ is normalized by construction, since Eω

X

Tr τzω = Eω

z

X

∥Gz (ω)∥2 /ξ = 1.

z

√

For each ω and z, the vectors Ψz (ω) and Gz (ω)/ ξ in A ⊗ E have reduced states ρωz and τzω on E, so (24) gives p p |⟨Ψz (ω), Gz (ω)⟩| √ . ∥ ρωz τzω ∥1 ≥ ξ Summing over z, averaging over ω, applying the triangle inequality to the sum and the average, and using (68), we obtain X 1 ⟨Ψz (ω), Gz (ω)⟩ = |c| F (ρ, τ ) ≥ √ Eω ξ z ≥

q

1 − η02 ,

hence P (ρ, τ ) ≤ η0 . Step 4: the domination bound and the entropy bound. For (65), fix ω and z. By Lemma 3.6 applied to Kz (ω) and the first hypothesis in (64), the reduced state ρ̃ωz of Gz (ω) on E satisfies Tr(M ρ̃ωz ) ≤ κ pω (z) Tr(M ρE )

for every positive semidefinite M ,

which is the operator inequality ρ̃ωz ⪯ κ pω (z)ρE .

Dividing by ξ gives (65). For a measurement

(Mz )z , it follows that X

Tr(Mz τzω ) ≤

z

κX κ pω (z) Tr(Mz ρE ) ≤ max pω (z), ξ z ξ z

P

because z Tr(Mz ρE ) = Tr ρE = 1. Taking the supremum over measurements and averaging over ω gives pguess (Z | RE)τ ≤ (κ/ξ) Eω max pω (z), z

and (67) follows from Definition 3.4, since P (ρ, τ ) ≤ η0 ≤ η and log N = n. P Step 5: part (iv). Finally, assume the hypothesis of (iv), so that Eω z ⟨Ψz (ω), Gz (ω)⟩ = ξ. P Expanding the squares and using Eω z ∥Ψz (ω)∥2 = 1 gives Eω

X

∥Ψz (ω) − Gz (ω)∥2 = 1 − 2ξ + ξ = 1 − ξ.

z

Nothing in the proposition or its proof depends on the dimensions of A and E. The proposition also explains why smoothing is needed: the actual branches need not satisfy a bound like (66), because a device may output a string known to Eve with a small probability, which changes its score only slightly but makes that branch fully predictable, and the nearby state removes such branches. 65

7.2

Fourier sampling

We use the notation of Section 4: the space F of functions of f with values in A ⊗ E, the expansion (25) in recorded sets, the operators ax , bz , and Dz = b†z bz , the final state Ψ with branches Ψz , the progress measure λ, and the bound λ̄q of Lemma 4.3. Theorem 7.2 (Certified randomness from Fourier sampling). Let q ≥ 1 and δ ≥ 0, and consider an experiment in the Fourier ensemble in which the device makes at most q queries and has score B(A) ≥ 3 − 2/N − δ. Let η0 and λ̄q be given by 

η0 = λ̄q +

δ λ̄q + + λ̄2q 2(1 − 1/N ) 1 − 1/N

1/2

, (69)

q−1

2 X√ λ̄q = √ t. N t=0 If η0 < 1, then for every η ∈ [η0 , 1], η (Z | RE)ρ ≥ n − 4 log q − log(n + 2) − 3 − 2 log Hmin

Moreover, λ̄1 = 0, and η0 ≤

√

1 . 1 − η0

(70)

δ + 2 q 3/4 N −1/4 + 3 q 3/2 N −1/2 .

(71)

The proof occupies this subsection up to Lemma 7.7. We first identify the auxiliary vectors, then bound the operators that produce them, and finally apply Proposition 7.1. To identify the auxiliary vectors, we show that a near-ideal score forces each branch to√be close to the vector obtained by removing one recorded point in the state |χz ⟩ and multiplying by N fb(z), which is the structure described in Section 2.3. Lemma 7.3 (Auxiliary vectors). Assume B(A) ≥ 3 − 2/N − δ, let η0 be as in (69), and put Gz = (bz + b†z ) bz Ψz = b2z Ψz + Dz Ψz . Then X

∥(Dz − I)Ψz ∥2 ≤

z

X

∥Ψz − Gz ∥2

1/2

δ λ̄q + + λ̄2q , 2(1 − 1/N ) 1 − 1/N

≤ η0 .

z

Proof. Step 1: the first bound. The hypothesis and (34) give 

2 1−

 1 X 1 2 ∥(Dz − I)Ψz ∥2 ≤ δ + 2λ + 2 1 − λ , N z N

where λ = λ(Ψ) satisfies λ ≤ λ̄q by Lemma 4.3. Dividing by 2(1 − 1/N ) gives the first bound. Step 2: the second bound. Since Gz = b2z Ψz + Dz Ψz , we have Ψz − Gz = −(Dz − I)Ψz − b2z Ψz , and the triangle inequality in the direct sum over z gives X z

∥Ψz − Gz ∥2

1/2

≤

X

∥(Dz − I)Ψz ∥2

z

1/2

+

X z

66

∥b2z Ψz ∥2

1/2

.

The last sum is at most λ2 , because Πz commutes with b2z , so that X

∥b2z Ψz ∥2 =

X

z

∥Πz b2z Ψ∥2 ≤

z

X

∥b2z Ψ∥2 ,

z

and the right side is λ2 by the definition of λ. Hence, by the first bound and λ ≤ λ̄q , the left side of the triangle inequality is at most η0 . The device as a bounded polynomial. For a fixed f , the vector
Gz (f ) can be written in terms of the unitary Vf of the device. Let (∂x Φ)(f ) = Φ(f x,+ ) − Φ(f x,− ) /2 be the discrete derivative of P Section 4.1, which is the operator ax , and let ∂χz = N −1/2 x χz (x) ∂x be the derivative along the character χz , which is the operator bz . Both act on functions of f with values in any vector space, and they commute with the pointwise application of any linear map. The final state is the pointwise image of the operator-valued function f 7→ Vf under the linear map T 7→ (T ⊗ IE )ψ0 , and Πz commutes with bz , so (bz Ψz )(f ) = (Πz (∂χz V )(f ) ⊗ IE )ψ0 . Multiplying by

√

N fb(z), which is the operator bz + b†z , gives √
Gz (f ) = N fb(z) Πz (∂χz V )(f ) ⊗ IE ψ0 = (Kz (f ) ⊗ IE )ψ0 , √ Kz (f ) = N fb(z) Πz (∂χz V )(f ),

(72)

where (∂χz V )(f ) is an operator on A. We now bound its norm, for every f , by Markov’s inequality for polynomials. P

Lemma 7.4 (The multilinear extension). Write Vf = |S|≤q VbS χS (f ) for the expansion (25) of the operator-valued function f 7→ Vf . The coefficients VbS vanish for |S| > q because Vf is a product of P fixed unitaries and of q factors P∅ + x f (x)Pxc , each affine in the values of f . Define Ve (u) =

X

Y

VbS

uy

n

for u ∈ R{0,1} .

y∈S

|S|≤q

Then: (i) Ve (f ) = Vf for every f ; n

(ii) ∥Ve (u)∥ ≤ 1 for every u ∈ [−1, 1]{0,1} ; (iii) (∂ Ve /∂ux )(f ) = (∂x V )(f ) for every f and x. Proof. Part (i) is the expansion. For (ii), let f˜ be a random function whose values are independent signs with Ef˜(y) = uy . Then Q EχS (f˜) = y∈S uy , so Ve (u) = EVf˜ is an average of unitaries and has norm at most 1. For (iii), Ve is affine in each coordinate: Ve (u) = Ve0 (u) + ux Ve1 (u) with Ve0 , Ve1 independent of ux , so ∂ Ve /∂ux = Ve1 , while, by (i), (∂x V )(f ) =

1 e x,+ V (f ) − Ve (f x,− ) = Ve1 (f ). 2

The extension must be the multilinear one: another polynomial that agrees with V on the signs, P such as the product of the operators P∅ + x ux Pxc , is also bounded on the cube, but its partial derivatives at the signs need not equal ∂x V . 67

Lemma 7.5 (Markov’s inequality at an endpoint). Let Y be a finite-dimensional normed space, P and let g(t) = dk=0 yk tk with yk ∈ Y. Then ∥g ′ (1)∥ ≤ d2 max ∥g(t)∥. −1≤t≤1

Proof. For d = 0 there is nothing to prove, so we let d ≥ 1. Step 1: interpolation at the Chebyshev nodes. Let tj = cos(jπ/d) for j = 0, . . . , d, so that 1 = t0 > t1 > · · · > td = −1, and let Y t − tk

ℓj (t) =

t − tk k̸=j j

be the Lagrange polynomials for these nodes. Interpolation at d + 1 nodes is exact for polynomials of degree at most d, coordinate by coordinate, so g=

X

ℓj g(tj )

∥g ′ (1)∥ ≤

and

X

j



|ℓ′j (1)| max ∥g(tj )∥. j

j

Step 2: the signs of the derivatives ℓ′j (1). We claim that (−1)j ℓ′j (1) > 0 for every j. 1. For j = 0, we have ℓ0 (1) = 1 and ℓ′0 (1) =

k≥1 (1 − tk )

P

−1 > 0.

2. For j ≥ 1, ℓj vanishes at t0 = 1, so (1 − tk ) k∈{0,j} /

Q

ℓ′j (1) =

Q

k̸=j (tj − tk )

,

whose numerator is positive and whose denominator has exactly j negative factors, namely those with k < j. Hence j |ℓ′j (1)| = j (−1)j ℓ′j (1). Step 3: the value of this sum. The Chebyshev polynomial Td , defined by Td (cos ϑ) = cos(dϑ), has degree d and satisfies Td (tj ) = (−1)j , so interpolation gives P

P

Td =

X

(−1)j ℓj

X

and

j

(−1)j ℓ′j (1) = Td′ (1).

j

Differentiating Td (cos ϑ) = cos(dϑ) gives Td′ (cos ϑ) = d sin(dϑ)/ sin ϑ for 0 < ϑ < π, and letting ϑ → 0 gives Td′ (1) = d2 . Lemma 7.6 (Derivative bound). For every f and z, √ ∥(∂χz V )(f )∥ ≤ 2q 2 / N . Consequently, ∥Kz (f )∥2 ≤ 4q 4 pf (z). Proof. Step 1: two polynomials in one variable. Fix f and z, and split the addresses into I+ = {x : χz (x) = f (x)},

I− = {x : χz (x) = −f (x)}.

n

For real t, let u± (t) be the point of R{0,1} with coordinates tf (x) for x ∈ I± and f (x) otherwise, Q and let g± (t) = Ve (u± (t)). Each monomial y∈S uy with |S| ≤ q becomes a constant multiple 68

of t|S∩I± | , so g± is a polynomial in t of degree at most q with operator coefficients. Moreover, ∥g± (t)∥ ≤ 1 for |t| ≤ 1 by Lemma 7.4(ii), because u± (t) then lies in the cube. Step 2: the derivative along χz . By the chain rule and Lemma 7.4(iii), ′ g± (1) =

X

f (x)

x∈I±

X ∂ Ve (f ) = f (x) (∂x V )(f ). ∂ux x∈I ±

Since f (x) = χz (x) on I+ and f (x) = −χz (x) on I− , we obtain √ X ′ ′ χz (x)(∂x V )(f ) = g+ (1) − g− (1). N (∂χz V )(f ) = x

Step 3: Markov’s inequality. By Lemma 7.5, applied in the space of operators on A with ′ (1)∥ ≤ q 2 . The second claim follows from (72), ∥Π ∥ ≤ 1, and the operator norm, we have ∥g± z 2 b N f (z) = N pf (z). √ The splitting into two directions is needed because the normalized character direction χz / N , whose coordinates are ±N −1/2 , does not stay inside the cube when followed from f , whereas each of u± (t) does for |t| ≤ 1. Apart from the score bound and the growth bound of Lemma 4.3, the bound on the number of queries enters the proof only here. Finally, we bound Ef maxz pf (z), the expected probability of the most likely outcome, which is Eve’s probability of guessing an ideal sample. Lemma 7.7 (Maximal Fourier weight). For a uniformly random f ,

Ef max pf (z) ≤ 2 ln(2N ) + 2 /N ≤ 2(n + 2)/N. z

Moreover, for every u ≥ 0, Pr max N pf (z) ≥ u ≤ 2N e−u/2 . 



z

Proof. Fix z. The signs rx = χz (x)f (x) are independent and uniform, and N pf (z) = N −1

X

rx

2

.

x

For ϑ ≥ 0, Eeϑ

P

2

r x x

= (cosh ϑ)N ≤ eN ϑ /2 ,

2

because cosh ϑ ≤ eϑ /2 , since (2k)! ≥ 2k k!. By Markov’s inequality with ϑ = s/N , Pr

hX

i

2

rx ≥ s ≤ e−ϑs (cosh ϑ)N ≤ e−s /(2N ) ,

x

Pr

hX

i

2

rx ≥ s ≤ 2e−s /(2N )

by symmetry.

x

√ With s = uN , where u ≥ 0, this reads Pr[N pf (z) ≥ u] ≤ 2e−u/2 , and the union bound over z gives the second assertion. The first assertion follows by integrating this tail bound. For every u0 ≥ 0, Z ∞

E max N pf (z) = z





Pr max N pf (z) ≥ u du

0

≤ u0 +

z

Z ∞

2N e−u/2 du = u0 + 4N e−u0 /2 ,

u0

and u0 = 2 ln(2N ) gives 2 ln(2N ) + 2 = 2(n + 1) ln 2 + 2 ≤ 2(n + 2). 69

Proof of Theorem 7.2. Step 1: the hypotheses and the entropy bound. By Lemma 7.3, the hypotheses (64) of Proposition 7.1 hold with Gz (f ) given by (72), with κ = 4q 4 by Lemma 7.6, and with the P P stated η0 . Here Ef z ∥Ψz (f ) − Gz (f )∥2 = z ∥Ψz − Gz ∥2 , with the norm of F on the right. The proposition, with its divisor ξ ≥ (1 − η0 )2 , and Lemma 7.7 give (70), since log(4q 4 ) = 2 + 4 log q,

log N Ef max pf (z) ≤ 1 + log(n + 2). z

√ λ̄ Step 2: the parameters. The only term of the sum defining is 0 = 0, and, by Lemma 4.3, 1 √ √ √ √ λ̄q ≤ (4/3)q 3/2 N −1/2 . Using a + b + c ≤ a + b + c and 1/(1 − 1/N ) ≤ 2, we obtain η0 ≤ ≤ and

p

√ δ+ √

q

2λ̄q + 2λ̄q

r

δ+

8 3/4 −1/4 8 3/2 −1/2 q N + q N , 3 3

8/3 ≤ 2 and 8/3 ≤ 3 give (71).

For q = 1 the polynomial Ve is affine, so the operator (∂χz V )(f ) = N −1/2 U1

X



χz (x)Pxc U0

x

has norm at most N −1/2 because the Pxc are mutually orthogonal projections, and the factor 4q 4 may be replaced by 1. If moreover δ = 0, then η0 = 0, the branches equal the auxiliary vectors, and the conditional states satisfy Tr(M ρfz ) ≤ pf (z) Tr(M ρE )

for all positive semidefinite M .

Since z ρfz = ρE = z pf (z)ρE , all these inequalities are equalities. This recovers the exact privacy statement of Proposition 4.6 for arbitrary one-query devices, not only for phase queries. For one phase query, a near-ideal score forces the actual family of conditional states to be close to the ideal family ρ◦ with (ρ◦ )fz = pf (z)ρE , in which the output is an exact sample from pf and is independent of Eve’s register. This is the robust form of Proposition 4.6, and it does not pass through a comparison family. P

P

Proposition 7.8 (Closeness to the ideal family). Let the device make a single phase query, as defined in Section 4.5, with Eve’s register arbitrary, and let δ = 3 − 2/N − B(A) be its deficit, so p that 0 ≤ δ ≤ 2 by Proposition 4.6. Write ηδ = δ − δ 2 /4. Then P (ρ, ρ◦ ) ≤ ηδ ,

ηδ Hmin (Z | RE)ρ ≥ n − log(2(n + 2)).

and consequently

Proof. Step 1: the score. By (41), Ψ(f ) = B(A) = 1 − 2/N + 2σ

P

w f (w)Ψ(χw ), and by Proposition 4.6,

b

with

σ=

1 X ∥Πw Ψ(χw )∥2 , N w

so δ = 2(1 − σ). Put gw = Πw Ψ(χw ) and G◦z (f ) = fb(z) gz . Step 2: the fidelity with the ideal family. The vector fb(z)Ψ(χz ) has reduced state pf (z)ρE = (ρ◦ )fz on E, because Ψ(χz ) = (Vχz ⊗ IE )ψ0 with Vχz unitary on A. Hence (24) gives, for every f and z, q

ρfz

q

(ρ◦ )fz 1 ≥ ⟨Ψz (f ), fb(z)Ψ(χz )⟩ = ⟨Ψz (f ), G◦z (f )⟩ , 70

where the equality holds because Πz is an orthogonal projection and Ψz (f ) = Πz Ψ(f ). Since Ψz (f ) =

X

fb(w)Πz Ψ(χw )

Ef fb(w)fb(z) = 1[w = z]/N,

and

w

we have Ef

⟨Ψz (f ), G◦z (f )⟩ =

X z

1 X ∥gz ∥2 = σ, N z

F (ρ, ρ◦ ) ≥ Ef

X

|⟨Ψz (f ), G◦z (f )⟩|

z

≥ σ = 1 − δ/2, P (ρ, ρ◦ ) ≤

q

1 − (1 − δ/2)2 = ηδ ,

where the second line follows by summing the first display of this step over z and averaging over f , the third uses the first line, the triangle inequality, and Step 1, and the last uses the definition of P . Step 3: the min-entropy of the ideal family. In the family ρ◦ , Eve’s state does not depend on z, so for every measurement X Tr(Mz pf (z)ρE ) ≤ max pf (z), z

z

with equality for the measurement that always outputs a heaviest z. Hence, by Lemma 7.7, pguess (Z | RE)ρ◦ = Ef max pf (z) ≤ 2(n + 2)/N, z

and Hmin (Z | RE)ρ◦ ≥ n − log(2(n + 2)). The claim follows from Definition 3.4, since ρ◦ is a normalized family. p

The case q = 1 of Theorem 7.2, specialized as above, gives δ/(2(1 − 1/N )) as the smoothing parameter. For large N √ and small positive deficit δ, this is smaller than the ideal-family parameter by a factor approaching 2. The exact ratio is [2(1 − 1/N )(1 − δ/4)]−1/2 . It certifies closeness to a comparison family rather than to the ideal family itself.

7.3

Haar-random states

We use the notation of Section 5: vector-valued polynomials, patterns, the level operator C, the progress measure λ, the operator X of the score, and the bound λ(Ψ) ≤ Λq of Theorem 5.6, where Λq := Λ0,q . The oracle is Oϕ , the device may make controlled queries, and Eve learns ϕ. Theorem 7.9 (Certified randomness from Haar-random states). Let q ≥ 1 and δ ≥ 0, and consider an experiment with the canonical oracle in which the device makes at most q queries and has score B(A) ≥ βN − δ. Let η0 and Λq be given by √
1/2 , η0 = 3(δ + 2 2 Λq + 72 Λ2q ) + Λ2q q−1

(73)

√ c0 X √ q 3/2 Λq = √ 2t + 1 ≤ 3 c0 √ . N t=0 N If η0 < 1, then for every η ∈ [η0 , 1], η Hmin (Z | RE)ρ ≥ n − 2 log q − log HN − 2 − log

1 , 1 − η02

where HN ≤ ln N + 1 is the harmonic number of Lemma 5.24. Moreover, for every q, √ √ η0 ≤ 3δ + 4 c0 q 3/4 N −1/4 + 26 c0 q 3/2 N −1/2 . 71

(74)

(75)

The three steps are as in the Fourier case, with the phase θz of the amplitude αz in the role of the Fourier coefficient. For z ∈ [N ] and real t, let Θz,t be the map on the sphere that multiplies the z-th coordinate by eit , and for a vector-valued polynomial F define the phase average (Qz F )(ϕ) =

1 2π

Z 2π

F (Θz,t ϕ) dt. 0

Lemma 7.10 (Phase averaging). The operator Qz is the orthogonal projection onto the sum of the blocks whose pattern satisfies γz = 0. It commutes with every Pk , with C, with every ϕ-independent operator on V, and with Qz ′ for every z ′ . Proof. Since Θz,t replaces αz by eit αz and leaves p unchanged, we have uγ (Θz,t ϕ) = eiγz t uγ (ϕ), so Qz (uγ h ⊗ v) = 1[γz = 0] uγ h ⊗ v

for polynomials h(p) and v ∈ V.

By Lemma 5.2, Qz acts on each block as 0 or 1, which proves the first claim, and the operators in the second claim all map each block to itself. Lemma 7.11 (The phase-independent part of the branches). Let F ∈ P≤d (H) be a unit vector with ⟨F, XF ⟩ ≥ βN − δ, and let Fz = Πz F . Then √ X δ + 2 2λ(F ) + 72λ(F )2 2 ∥Qz Fz ∥ ≤ + λ(F )2 β − 1 N z √
≤ 3 δ + 2 2λ(F ) + 72λ(F )2 + λ(F )2 . Proof. Step 1: the positive-level part. Write F = F0 + F+ with F0 = P0 F . Since Qz Πz commutes with P0 (Lemma 7.10), we have Qz Fz = Qz Πz F0 + Qz Πz F+ with orthogonal summands, and, by Lemma 5.11, X

∥Qz Πz F+ ∥2 ≤

z

X

∥Πz F+ ∥2 = ∥F+ ∥2

z

≤ λ(F )2 . Step 2: the level-zero part. Let w0 = z ∥Qz Πz F0 ∥2 be the weight of the level-zero terms whose pattern has γz = 0 at their own output z. By the exact ratio computed in Proposition 5.4, a level-zero term with γz = 0 has ratio N/(N + |γ|1 ) ≤ 1 on its own branch, and a term with |γz | = 1 has ratio at most βN , so P

⟨F0 , XF0 ⟩ ≤ w0 + βN ∥F0 ∥2 − w0

= βN ∥F0 ∥2 − (βN − 1)w0 . Step 3: solving for w0 . By Lemmas 5.11 and 5.12, using ∥F0 ∥ ≤ 1, βN − δ ≤ ⟨F, XF ⟩

√ ≤ βN − (βN − 1)w0 + 2 2λ(F ) + 72λ(F )2 .

Solving for w0 and adding the positive-level part gives the first inequality, and the second follows from βN − 1 = (N − 1)/(N + 1) ≥ 1/3 for N ≥ 2. Thus a level-zero term that does not depend on the phase of αz scores at most 1 on the branch z, which is less than the ideal score by a constant, so a near-ideal score forces the branches to be almost entirely phase-dependent. 72

Lemma 7.12 (Changing one phase of the oracle). For every ϕ, z, and t, q √ √ ∥Oϕ − OΘz,t ϕ ∥ = 2|sin(t/2)| pz (2 − pz ) ≤ 2 2 |sin(t/2)| pz ,

and the same holds for the controlled queries. Proof. For unit vectors u, v, the operator |u⟩⟨u| − |v⟩⟨v| vanishes on the orthogonal complement 2 of p their span, and on the span it has trace 0 and determinant −(1 − |⟨u, v⟩| ), so its norm is 1 − |⟨u, v⟩|2 . Step 1: the overlap of the two oracle vectors. Let ϕ′ = Θ ϕ, and write u = ηϕ and v = ηϕ′ for
z,t the vectors of (16), so that Oϕ − Oϕ′ = −2 |u⟩⟨u| − |v⟩⟨v| . Since ϕ′ differs from ϕ only in the phase of the z-th coordinate, we have, with w = (pz /2)(1 − eit ), ⟨ϕ, ϕ′ ⟩ = 1 − pz + pz eit ,
1 ⟨u, v⟩ = 1 + ⟨ϕ, ϕ′ ⟩ = 1 − w, 2 and therefore 1 − |⟨u, v⟩|2 = 2 Re w − |w|2 = pz (1 − cos t) −

p2z (1 − cos t) 2

= sin2 (t/2) pz (2 − pz ). Step 2: the norm and the controlled queries. Taking the square root and multiplying by 2 gives the norm of Oϕ − Oϕ′ . For the controlled queries, Oϕc − Oϕc ′ = |1⟩⟨1| ⊗ (Oϕ − Oϕ′ ). Proof of Theorem 7.9. Step 1: the auxiliary vectors. By Lemma 5.1, the final state Ψ is a unit vector in P≤2q (H), its score is B(A) = ⟨Ψ, XΨ⟩ by (46), and λ(Ψ) ≤ Λq by Theorem 5.6 with s = 0. As auxiliary vectors we take Gz = (I − Qz )Ψz , where Ψz = Πz Ψ. Since the right side of Lemma 7.11 increases with λ(F ), X

X

∥Ψz − Gz ∥2 =

z

∥Qz Ψz ∥2

z

√ ≤ 3(δ + 2 2Λq + 72Λ2q ) + Λ2q = η02 .

Step 2: the operators Kz and their norms. Pointwise, since Πz does not depend on ϕ, 1 2π Gz (ϕ) = Πz Ψ(ϕ) − Πz Ψ(Θz,t ϕ) dt = (Kz (ϕ) ⊗ IE )ψ0 , 2π 0 Z
Πz 2π Kz (ϕ) = Vϕ − VΘz,t ϕ dt. 2π 0 Z

For products of unitaries, Wq · · · W1 − Wq′ · · · W1′ =

X

′ Wq · · · Wj+1 (Wj − Wj′ )Wj−1 · · · W1′ ,

j

and the unitaries Uj do not depend on ϕ, so Lemma 7.12 gives q

∥Vϕ − VΘz,t ϕ ∥ ≤ 2q|sin(t/2)| pz (2 − pz ). 73

Averaging over t, with (2π)−1 02π 2|sin(t/2)| dt = 4/π, we obtain √ 4 q 4 2 √ ∥Kz (ϕ)∥ ≤ q pz (2 − pz ) ≤ q pz , π π R

and hence ∥Kz (ϕ)∥2 ≤ (32/π 2 ) q 2 pz . This hybrid argument plays the role that Markov’s inequality for polynomials played in Lemma 7.6, as explained in Section 2.5. Step 3: the entropy bound. The hypotheses (64) therefore hold with κ = 32q 2 /π 2 ≤ 4q 2 , and Kz depends continuously on ϕ. By Lemma 7.10, I − Qz is an orthogonal projection of the space of vector-valued polynomials, so Eϕ ⟨Ψz (ϕ), Gz (ϕ)⟩ = Eϕ ∥Gz (ϕ)∥2 for every z. This identity holds on average over ϕ and not pointwise, because Qz averages over the phase of αz , but the average is what part (iv) of Proposition 7.1 requires, so that part applies with ξ ≥ 1 − η02 , and together with Lemma 5.24 it gives (74). √ Step 4: the parameters. Since x 7→ 2x + 1 is increasing, q−1 X

√

2t + 1 ≤

Z q√ 0

t=0

≤

√

1 2x + 1 dx ≤ (2q + 1)3/2 3

3q 3/2

√ for q ≥ 1, which gives the bound on Λq . Hence η02 = 3δ + 6 2Λq + 217Λ2q with √ √ 6 2Λq ≤ 6 6 c0 q 3/2 N −1/2 ≤ 16c0 q 3/2 N −1/2 , 217Λ2q ≤ 651c20 q 3 /N ≤ (26c0 )2 q 3 /N, and

7.4

√

x+y+z ≤

√

x+

√

y+

√ z gives (75).

Tightness of the parameters p

The first device shows that the term δ/(2(1 − 1/N )) in (69) is of the right order, including its constant, whenever many bits are to be certified. The second shows that the losses 4 log q in Theorem 7.2 and 2 log q in Theorem 7.9 cannot be brought below 2 log q − O(1): it uses amplitude amplification to raise the probability that one ideal sample lies in a fixed set of about N/q 2 strings, which costs q queries and only O(q −2 + q 4 N −1/2 ) in score. Proposition 7.13 (Mixing a fixed output with honest sampling). Let 0 < µ < 1 and z0 ∈ {0, 1}n , and consider the one-query device in the Fourier ensemble that, using a private coin, outputs z0 with probability µ and otherwise runs the honest sampler, with Eve’s register trivial. Then the following hold. (i) The score of the device is B(A) = 3 − 2/N − 2(1 − 1/N )µ, so Theorem 7.2 applies with q = 1, √ δ = 2(1 − 1/N )µ, and η0 = µ. (ii) The conditional min-entropy satisfies Hmin (Z | R)ρ ≤ log(1/µ). (iii) Every normalized family τ with Hmin (Z | R)τ ≥ h satisfies 



P (ρ, τ ) ≥ 1 − min 1, which tends to

√

µ = η0 as h → ∞. 74

p

1 − µ + 2−h/2

 2 1/2

,

Proof. Step 1: the score and η0 . For a fixed z0 , we have Ef N pf (z0 ) = 1, and the honest sampler scores 3 − 2/N , so B(A) = (1 − µ)(3 − 2/N ) + µ, which is the stated value. With q = 1 we have λ̄1 = 0, and (69) gives q √ η0 = δ/(2(1 − 1/N )) = µ. Step 2: the min-entropy of ρ. Since E is trivial, a family of conditional states is a function P τ (f, z) ≥ 0 with Ef z τ (f, z) = 1, the guessing probability is Ef maxz τ (f, z), and F (ρ, τ ) = Ef

Xq

ρ(f, z)τ (f, z).

z

The actual family is ρ(f, z) = (1 − µ)pf (z) + µ1[z = z0 ], whose guessing probability is at least µ; hence Hmin (Z | R)ρ ≤ log(1/µ). Step 3: the bound on P (ρ, τ ). Now let Ef maxz τ (f, z) ≤ 2−h . We split the sum over z according to whether z = z0 and apply the Cauchy–Schwarz inequality to each part, with Ef ρ(f, z0 ) ≤ 1 and P Ef z τ (f, z) = 1. This gives q

Ef

ρ(f, z0 )τ (f, z0 ) ≤ Ef τ (f, z0 )

1/2

1/2

≤ Ef max τ (f, z) z

−h/2

≤2 and Ef

X q

1/2

ρ(f, z)τ (f, z) ≤ 1 − Ef ρ(f, z0 )

.

z̸=z0

Finally, Ef ρ(f, z0 ) = µ + (1 − µ)/N ≥ µ, so 

F (ρ, τ ) ≤ min 1,

1 − µ + 2−h/2 ,

p

which gives the stated bound on P (ρ, τ ). The second device uses amplitude amplification to raise the probability that one ideal sample lies in a fixed set of outcomes, as the squaring algorithm does for its stored set. Let T be the set of P strings whose first k bits are zero, so that |T | = N ′ with N ′ = N/2k , and let ΠT = z∈T |z⟩⟨z|. For P an oracle ω, write pω (T ) = z∈T pω (z) and P⋆ = N ′ /N = 2−k , where P⋆ is the mean of pω (T ) in both ensembles. Proposition 7.14 (Amplitude amplification onto a fixed set of outputs). Let k ≥ 4 be an integer with 2k+10 ≤ N , and consider the device that prepares the state |ψω ⟩ of Section 6.1 with one query, applies ℓ times the operator (2|ψω ⟩⟨ψω | − I)(I − 2ΠT ), where ℓ is chosen as in Definition 6.1 for the value P⋆ = 2−k , and measures; Eve’s register is trivial. Then the following hold. (i) The device makes q = L = 2ℓ + 1 queries, where 2k/2 ≤ q ≤ 2k/2+1 . (ii) Its output lies in T with probability at least 3/4, so that η Hmin (Z | R)ρ ≤ n − k + 3 ≤ n − 2 log q + 5

for every 0 ≤ η ≤ 1/2.

(iii) Its expected score is at least the ideal score minus Camp (q −2 + q 4 N −1/2 ), in both ensembles, for an absolute constant Camp . (iv) In particular, for q → ∞ with q ≤ N 1/9 and N large, the device scores within o(1) of the ideal score and its output has at most n − 2 log q + 5 bits of smooth min-entropy for every smoothing parameter 0 ≤ η ≤ 1/2. 75

Proof. Step 1: the number of queries and the output distribution. Fix ω, write p = pω and P = p(T ), and put Y = P/P√ ⋆ , so that Eω Y = 1. By Definition 6.1, L = 2ℓ + 1 satisfies |Lϑ0 − π/2| ≤ ϑ0 , where ϑ0 = arcsin P⋆ = arcsin 2−k/2 , and, as in the proof of Lemma 6.4, 2−k/2 ≤ ϑ0 ≤ (π/3)2−k/2 . Hence 3 k/2 π 2 − 1 ≤ q ≤ 1 + 2k/2 , 2 2 and both stated bounds on q follow for k ≥ 4. If P = 0, the marked projection annihilates |ψω ⟩, every amplification step fixes this state, and g(0) = 0. For P > 0, by Lemma 3.3 with Π = ΠT , as in the proof of Lemma 6.3, the output has the distribution √ g(P ) µT + (1 − g(P )) µT c with g(P ) = sin2 (L arcsin P ), where the first term is absent if P = 0 and the second if P = 1. In particular, Pr[Z ∈ T | ω] = g(P ), and Lemma 6.4, which applies because P⋆ ≤ 1/4, gives 1 − g(P ) ≤ 18 (Y − 1)2 + 3P⋆ ,

(76)

also when P = 0, where the left side is 1. Step 2: the moments of Y . In the Haar ensemble, P has the Beta distribution with parameters ′ (N , N − N ′ ) by Lemma 3.7(iii), so Var(P ) = N ′ (N − N ′ )/(N 2 (N + 1)) ≤ N ′ /N 2 by Lemma 3.7(i) applied to the two-component vector (P, 1 − P ), and Var(Y ) ≤ 1/N ′ = 2k /N . In the Fourier ensemble, let T ⊥ be the set of the 2k strings √ whose last n − k bits are zero, and ′ ⊥ n let C run over the N cosets of T in {0, 1} . With Xz = N fb(z) as in the proof of Lemma 6.2, Y = =

2 1 X 2 1 X X f (x) X = N ′ z∈T z N C x∈C

1 X YC , N′ C

YC =

2 1 X , f (x) 2k x∈C

(77)

where the second equality follows from Xz2 = X

1 X χz (x ⊕ y)f (x)f (y), N x,y

χz (x ⊕ y) = N ′ 1[x ⊕ y ∈ T ⊥ ],

z∈T

since x ⊕ y ∈ T ⊥ exactly when x and y lie in the same coset. The YC are independent, because distinct cosets use disjoint sets of values of f , and each is the normalized square of a sum of 2k independent uniform signs, so EYC = 1, EYC2 = 3 − 2/2k ≤ 3, and EYC4 ≤ 105 by the pairing bound in the proof of Lemma 6.2(ii). Hence Var(Y ) =

1 X Var(YC ) ≤ 2/N ′ N ′2 C

= 2 · 2k /N,

76

and, since the summands YC − 1 are independent with mean zero, E(Y − 1)4 =

 X 1 X 4 ′ E(Y − 1) + 3 Var(Y ) Var(Y ) C C C N ′4 C C̸=C ′

12 900 8 · 106 + ′2 ≤ ′2 N ′3 N N 900 · 22k = , N2 ≤

using (y − 1)4 ≤ 8(y 4 + 1). In both ensembles, therefore, Var(Y ) ≤ 2 · 2k /N . Step 3: the min-entropy. By (76) and the variance bound, εT := Pr[Z ∈ / T ] = Eω [1 − g(P )] ≤ 18 Var(Y ) + 3P⋆ 36 · 2k 3 1 + k ≤ , N 2 4

≤

using 2k+10 ≤ N and k ≥ 4. Let τ be a normalized family within purified distance η of ρ, where η ≤ 1/2, and write mT for P the weight Eω z∈T τ (ω, z) of τ on T . Since E is trivial, F (ρ, τ ) = Eω

Xq

ρ(ω, z)τ (ω, z),

z

and the Cauchy–Schwarz inequality, applied separately to the pairs (ω, z) with z ∈ T and with z∈ / T , gives √ √ 1 − η 2 ≤ F (ρ, τ ) ≤ mT + εT √ 1 ≤ mT + , 2

q

√ so mT ≥ ( 3/2 − 1/2)2 ≥ 1/8. Since max τ (ω, z) ≥ z

1 X τ (ω, z) N ′ z∈T

for every ω,

the guessing probability of τ is at least mT /N ′ ≥ 1/(8N ′ ), so Hmin (Z | R)τ ≤ n − k + 3, and n − k + 3 ≤ n − 2 log q + 5 because k ≥ 2 log q − 2. Step 4: the score in the Haar ensemble. By Lemma 3.7(iii), the vector p̃ = (pz /P )z∈T is P independent of P and uniform on the simplex of dimension N ′ − 1, so E z∈T p̃2z = 2/(N ′ + 1) by Lemma 3.7(i). The score of the device is at least the contribution of the outputs in T , which is h

Eϕ g(P ) N

X p2 i z

z∈T

P



 h X 2i p̃

= N Eϕ g(P )P E

z

z∈T

  2N E g(P )P ϕ N′ + 1   2N ′  = ′ 1 − Eϕ (1 − g(P ))Y , N +1

=

where we used P = P⋆ Y , N P⋆ = N ′ , and EY = 1. 77

By (76), the bound Y ≤ 1/P⋆ = 2k , and Var(Y ) ≤ 2k /N , we obtain Eϕ (1 − g(P ))Y ≤ 18 Eϕ (Y − 1)2 Y + 3P⋆ Eϕ Y 







≤ 18 · 2k Var(Y ) +

18 · 22k 3 3 ≤ + k. 2k N 2

Since 2N ′ /(N ′ + 1) ≤ 2 and 2N ′ /(N ′ + 1) = βN − 2/(N ′ + 1) + 2/(N + 1) ≥ βN − 2 · 2k /N, the score is at least βN − 2 · 2k /N − 36 · 22k /N − 6 · 2−k ≥ βN − 38 q 4 /N − 24 q −2 , using 2k ≤ q 2 and 2−k ≤ 4q −2 . Step 5: the score in the Fourier ensemble. Write X̄4 =

1 X 4 X , N ′ z∈T z

so that

N

X

p2z /P = X̄4 /Y,

z∈T

with the value 0 when Y = 0. Since 1/y ≥ 2 − y for y > 0, we have X̄4 /Y ≥ X̄4 (2 − Y ), also when Y = 0, where both sides vanish. The score is therefore at least 











Ef g(P ) X̄4 (2 − Y ) ≥ Ef X̄4 (2 − Y ) − 2 Ef (1 − g(P ))X̄4 , because (1 − g(P ))X̄4 (2 − Y ) ≤ 2(1 − g(P ))X̄4 . Here Ef X̄4 = 3 − 2/N , and Ef X̄42 ≤

1 X Ef Xz8 ≤ 105 N ′ z∈T

by Lemma 6.2(ii), so, using Ef Y = 1, 



Ef X̄4 (2 − Y ) = Ef X̄4 − Cov(X̄4 , Y ) ≥3−

q 2 2 2k/2 − 105 Var(Y ) ≥ 3 − − 15 √ , N N N

and by (76) and the Cauchy–Schwarz inequality, q

Ef (1 − g(P ))X̄4 ≤ 18 Ef (Y − 1)4 Ef X̄42 + 3P⋆ Ef X̄4 √ 2k 9 5600 · 2k 9 ≤ 18 · 30 105 + k ≤ + k. N 2 N 2 



Hence the score is at least 3 − 2/N − 15 · 2k/2 N −1/2 − 11200 · 2k N −1 − 18 · 2−k , which, with 2k/2 ≤ q, 2k ≤ q 2 , and 2−k ≤ 4q −2 , is at least 3 − 2/N − 15qN −1/2 − 11200q 2 N −1 − 72q −2 .

78

Step 6: the deficit in both ensembles, and part (iv). In both ensembles the deficit is at most Camp (q −2 + q 4 N −1/2 ) for an absolute constant Camp , because √ q 2 N −1 ≤ qN −1/2 ≤ q 4 N −1/2 for q ≤ N , √ √ where q ≤ N holds because q ≤ 2k/2+1 ≤ N /16. For q → ∞ with q ≤ N 1/9 , this deficit tends to zero. The upper score bounds of Theorems 4.4 and 5.6, with s = 0 in the Haar case, also give an excess above the ideal score of at most O(q 3/2 N −1/2 + q 3 /N ) = o(1). Thus the score is within o(1) of the ideal score on both sides. Part (iv) follows, since 2k+10 ≤ N holds for q ≤ N 1/9 and N large, as 2k ≤ q 2 . Remark 7.15 (Standard smooth min-entropy). Propositions 7.13 and 7.14 also bound the standard smooth min-entropy of Remark 3.5, in the Haar ensemble for every finite discretization of ϕ, since the arguments do not use the value of R. The pinching map that measures R and Z in their bases leaves ρ fixed and does not increase the purified distance. It also does not decrease Hmin (Z | R), because it is unital on Z and a channel on R: if τZR ≤ IZ ⊗ σR , then the pinched state satisfies the same inequality with the pinched σR , which has the same trace. Hence the standard smoothing may be restricted to families that are classical on RZ and have total mass at most 1. Since ρ is normalized, the generalized fidelity of ρ and such a family τ equals F (ρ, τ ). The proofs P of both propositions use only F (ρ, τ ) together with the bound Eω z τ (ω, z) ≤ 1, so they apply to these families without change.

7.5

Proof of Theorem 1.2

Proof of Theorem 1.2. Let η0 be as in Theorem 7.2 for Fourier sampling and as in Theorem 7.9 for Haar-random states, and put η = min{1, η0 } if q 3 ≤ N and η = 1 otherwise. Step 1: the bound on η. If q 3 ≤ N , then q 3/2 N −1/2 ≤ q 3/4 N −1/4 , so (71) gives √ η0 ≤ δ + 5q 3/4 N −1/4 and (75) gives

√

√ 3δ + (4 c0 + 26c0 )q 3/4 N −1/4 , √ while if q 3 > N , then q 3/4 N −1/4 > 1 = η. In both cases η = O( δ + q 3/4 N −1/4 ), as stated. Step 2: the two entropy bounds. The hypothesis η ≤ 1/2 forces q 3 ≤ N and η = η0 ≤ 1/2, so that 2 log(1/(1 − η0 )) ≤ 2 and log(1/(1 − η02 )) ≤ 1. Then (70) gives η0 ≤

η0 Hmin (Z | RE)ρ ≥ n − 4 log q − log(n + 2) − 5

for Fourier sampling,

and (74) with log HN ≤ log(n + 1) gives η0 Hmin (Z | RE)ρ ≥ n − 2 log q − log(n + 1) − 3

for Haar-random states.

Finally, if q ≤ nO(1) and δ = o(1), then η0 = o(1) in both cases, and η0 is negligible when δ is. Remark 7.16 (Scope of the theorems). The hypotheses of Theorems 7.2 and 7.9 concern the expected score of the experiment; estimating this score from finitely many runs, and conditioning on the acceptance of such a test, are not addressed here.

79

The theorems do not require δ → 0: they give n − O(log n) bits whenever q ≤ nO(1) and 1 − η0 ≥ n−O(1) , and (1 − o(1))n bits for q = 2o(n) when 1 − η0 ≥ 2−o(n) . They are vacuous when η0 ≥ 1, in particular when q ≥ N 1/3 + 1 in the Fourier case, because then 4 4 λ̄q ≥ (q − 1)3/2 N −1/2 ≥ 3 3 and η0 ≥ 2λ̄q ; accordingly, the proof of Theorem 1.2 sets η = 1 when q 3 > N . The losses 4 log q and 2 log q come only from Lemma 7.6 and from the hybrid argument in the proof of Theorem 7.9; by Proposition 7.14 neither loss can be brought below 2 log q − O(1), so the coefficient 2 in the Haar case is optimal and the correct coefficient for Fourier sampling lies between 2 and 4. By Proposition 7.13 the leading term of η0 in the Fourier case cannot be improved by a constant factor if ω(1) bits are to be certified; we do not claim that the terms involving λ̄q or Λq are optimal. Finally, for Haar-random states the result is for the canonical oracle; the obstacle for an Eve who learns a Haar-random unitary is explained at the end of Section 2.5.

8

Quantum Hadamard products

The squaring algorithm measures its stored samples. Keeping them coherent and retaining the match index in the reversible computation gives a related algorithm that preserves the phases needed P P to prepare a quantum Hadamard product. For two unit vectors |α⟩ = z αz |z⟩ and |β⟩ = z βz |z⟩ in CN whose coordinatewise product is not zero, the quantum Hadamard product is the normalized state P αz βz |z⟩ |α ◦ β⟩ = P z
, 2 1/2 y |αy βy | and preparing it is a task studied in [HCSS23, HNZM26]. We assume oracle access for state preparation and reflection, as in Section 6.1: one query prepares each input state, and two queries reflect about it. This is the case for the canonical oracles Oα and Oβ , and for unitaries that prepare the two states from |0n ⟩, when their inverses may also be applied. The direct approach prepares |α⟩|β⟩ and amplifies the component in which the two registers P agree. When all amplitudes have √ magnitude N −1/2 , that component has weight z |αz βz |2 = 1/N , so the amplification takes about N reflections, each of which costs queries to both oracles. Our algorithm instead prepares p m coherent copies of |α⟩ and amplifies a copy of |β⟩ onto their stored labels. It uses m + 1 + O( N/m) queries, and reversible deletion retains the product phases. Taking m = ⌈N 1/3 ⌉ gives O(N 1/3 ) queries and trace-distance error O(N −1/6 ), as proved below.

8.1

Hadamard products of states with uniform magnitudes

Theorem 8.1 (Hadamard products of states with magnitudes). Let |α⟩, |β⟩ ∈ CN satisfy √ uniform P −1/2 |αz | = |βz | = N for all z, so that |α ◦ β⟩ = N z αz βz |z⟩, and let 1 ≤ m ≤ N/4. There is an algorithm with oracle access for state preparation andpreflection to |α⟩ and |β⟩ that makes m preparations of |α⟩, one preparation of |β⟩, and at most π N/m/2 further queries, and outputs a state ρ on CN with √ m 1 πq ρ − |α ◦ β⟩⟨α ◦ β| 1 ≤ m/N + 2 √ . 2 3 N For N ≥ 8 and m = ⌈N 1/3 ⌉, the algorithm makes O(N 1/3 ) queries and the error is O(N −1/6 ). 80

Proof. The algorithm. Let S1 , . . . , Sm and Y be registers of the type on which the oracles act,√and let J be a register with basis |0⟩, |1⟩, . . . , |m⟩, initially in |0⟩. Write P⋆ = m/N and ϑ0 = arcsin P⋆ , let ℓ be a nonnegative integer nearest to π/(4ϑ0 ) − 1/2 and L = 2ℓ + 1, as in Definition 6.1, so that |Lϑ0 − π/2| ≤ ϑ0 , q

2ℓ ≤ π/(2ϑ0 ) ≤ π N/m/2, √ where the second line follows from the first and from ϑ0 ≥ P⋆ . The algorithm consists of the following four steps. 1. Prepare |α⟩ in each of S1 , . . . , Sm and |β⟩ in Y. 2. Let Π be the projection onto the span of the basis states |x1 , . . . , xm ⟩|y⟩ with y ∈ {x1 , . . . , xm }, which is implemented by a reversible comparison of Y with each Si and uses no query. Apply ℓ times the operator (2|β⟩⟨β|Y − I)(I − 2Π). 3. Compute into J the smallest index j with xj = y, or 0 if there is none. For j ≥ 1, swap Sj with Sm , controlled by J; for j = 0, perform no swap. Then add the contents of Y bitwise into Sm , so that |y⟩Sm |y⟩Y becomes |0n ⟩Sm |y⟩Y . All of this is a fixed reversible computation on the basis states and uses no query. 4. Output the register Y. The query count is m + 1 + 2ℓ, which is as claimed. The state after amplification. Write x = (x1 , . . . , xm ), αx = αx1 · · · αxm , and let S(x) be the set P {x1 , . . . , xm } of entries of x. After step 1, the state is x αx |x⟩ ⊗ |β⟩. The projection Π and the reflection about |β⟩ are both block diagonal with respect to the basis of S1 · · · Sm . Indeed, Π=

X

|x⟩⟨x| ⊗ ΠS(x)

with

ΠS =

x

X

|z⟩⟨z|,

z∈S

and the reflection acts on Y alone. Hence, after step 2, the state is X

αx |x⟩ ⊗ Gℓx |β⟩

Gx = (2|β⟩⟨β| − I)(I − 2ΠS(x) ).

with

x

Call x distinct if its entries are distinct. For distinct x, X

∥ΠS(x) β∥2 =

|βz |2

z∈S(x)

= m/N = P⋆ holds exactly, because S(x) has m elements and |βz |2 = 1/N for every z. Therefore Lemma 3.3 gives Gℓx |β⟩ = sin(Lϑ0 )|ux ⟩ + cos(Lϑ0 )|u⊥ x ⟩, ΠS(x) |β⟩ |ux ⟩ = √ = P⋆

s

m NX βx |xj ⟩, m j=1 j

where |u⊥ x ⟩ is a unit vector supported outside S(x). The terms with x not distinct have total squared norm prep =

X

|αx |2 ,

x not distinct

81

which is the probability that m independent uniformly random outcomes are not all distinct. Hence, by the union bound, prep ≤ m(m − 1)/(2N ) ≤ m2 /(2N ). Let Φgood =

X

αx |x⟩ ⊗ |ux ⟩,

∥Φgood ∥2 = 1 − prep .

x distinct

Put a = sin(Lϑ0 ), b = cos(Lϑ0 ), and let Φout =

X

αx |x⟩ ⊗ |u⊥ x ⟩.

x distinct

Let Φrep be the terms of the amplified state Φ with repeated table entries. The vectors Φgood , Φout , and Φrep are mutually orthogonal: the first two have disjoint marked and unmarked support for each distinct x, and the last has disjoint table support. Their squared norms are respectively 1 − prep , 1 − prep , and prep . Thus ∥Φ − Φgood ∥2 = (a − 1)2 + b2 (1 − prep ) + prep = 2(1 − a)(1 − prep ) + prep .

Writing ∆ = Lϑ0 − π/2, we have a = cos ∆ and |∆| ≤ ϑ0 , so 2(1 − a) = 4 sin2 (∆/2) ≤ ϑ20 . Consequently, ∥Φ − Φgood ∥ ≤

q

π √ ϑ20 (1 − prep ) + prep ≤ ϑ0 + prep ≤ 3

q

m/N +

√

prep .

The last inequality follows from m/N ≤ 1/4 and the convexity bound for arcsin used in Lemma 6.4. Deletion. The operation of step 3 is a unitary Udel . For m = 2 and distinct x1 ̸= x2 , the vector Φgood contains the terms q

N/2 αx1 αx2 |x1 , x2 ⟩ βx1 |x1 ⟩ + βx2 |x2 ⟩ |0⟩J .

The first term has index j = 1 in J, so the swap moves x2 into S1 and the bitwise addition clears S2 . The second term has index j = 2. Writing w for the remaining entry and z for the output, both terms become q N/2 αw αz βz |w⟩|0n ⟩|z⟩|j⟩J with j ∈ {1, 2}, and summing over w ̸= z gives the projection of 1 |α⟩ ⊗ |0n ⟩ ⊗ |α ◦ β⟩ ⊗ √ (|1⟩ + |2⟩) 2 onto the basis states with w ̸= z. The general case is the same computation: on a basis state |x⟩|xj ⟩|0⟩J with x distinct, the index computed into J is j, and Udel maps the state to |x(j) ⟩|0n ⟩Sm |xj ⟩Y |j⟩J , where x(j) ∈ [N ]m−1 lists the entries of x other than xj in the order in which they appear in S1 , . . . , Sm−1 after the swap. For fixed j, the map [N ]m → [N ]m−1 × [N ], x 7→ (x(j) , xj ), is a bijection, and αx = αx(j) αxj , with αx(j) the product of the amplitudes of the entries of x(j) . Therefore s

Udel Φgood =

m X NX α (j) αxj βxj |x(j) ⟩|0n ⟩|xj ⟩|j⟩ m j=1x distinctx

= Πdist Φ◦ , 82

where

m 1 X Φ◦ = |α⟩⊗(m−1) ⊗ |0n ⟩Sm ⊗ |α ◦ β⟩Y ⊗ √ |j⟩J m j=1

and Πdist is the projection onto the basis states |w⟩|0n ⟩|y⟩|j⟩ in which the m entries of √(w, y) ∈ [N ]m−1 × [N ] are distinct. Indeed, expanding Φ◦ in the basis gives the amplitude m−1/2 αw N αy βy at |w⟩|0n ⟩|y⟩|j⟩, and the terms of Udel Φgood are exactly those in which (w, y) comes from a distinct x, with the same amplitude. The squared norm of Φ◦ − Πdist Φ◦√is the total weight of the basis states in which the entries of (w, y) are not distinct. Since |αw |2 | N αy βy |2 /m = N −m /m for every basis state, this weight is again the probability that m uniformly random outcomes are not distinct, which is prep . Hence √ ∥Udel Φ − Φ◦ ∥ ≤ ∥Φ − Φgood ∥ + prep πq √ ≤ m/N + 2 prep , 3 where the first step uses the triangle inequality and the unitarity of Udel , and the second uses the improved orthogonality bound on ∥Φ − Φgood ∥ proved above. The output. For unit vectors u, v, the trace distance satisfies q 1 |u⟩⟨u| − |v⟩⟨v| 1 = 1 − |⟨u, v⟩|2 ≤ ∥u − v∥, 2

where the inequality holds because 1 − |⟨u, v⟩|2 ≤ (1 − Re⟨u, v⟩)(1 + Re⟨u, v⟩) ≤ 2(1 − Re⟨u, v⟩) = ∥u − v∥2 . The partial trace does not increase the trace distance, and the reduced state of Y in Φ◦ is |α◦β⟩⟨α◦β|. Therefore the output ρ satisfies πq 1 √ ρ − |α ◦ β⟩⟨α ◦ β| 1 ≤ m/N + 2 prep , 2 3 √ √ √ and 2 prep ≤ 2 m/ N because prep ≤ m2 /(2N ). The theorem holds for every fixed pair of input states with uniform magnitudes, not only on average over an ensemble, and the algorithm does not need to know the phases. With the canonical oracles, the registers are copies of Q = C|⊥⟩ ⊕ CN , the prepared states lie in CN , and the reflection about |β⟩ maps CN to itself, so the component along |⊥⟩ is never populated and the computation above applies without change.

8.2

A lower bound for Hadamard squares of Haar-random states

When both inputs are the same Haar-random state, we call their normalized coordinatewise product its Hadamard square. We have only a lower bound for this case, which follows from Corollary 6.10 by measuring the output. Proposition 8.2 (Hadamard squares of Haar-random states). Fix 0 < ν < 1/12. Let ω be either a Haar-random state ϕ, accessed through Oϕ , or a Haar-random unitary U , accessed through U and

83

U † . Write ϕω = ϕ in the first case and ϕω = U |0n ⟩ in the second. Suppose an algorithm with no supplied copies of |ϕω ⟩ outputs a state ρω on CN with Eω where, writing |ϕω ⟩ =

1 ρω − |ϕω ◦ ϕω ⟩⟨ϕω ◦ ϕω | 1 ≤ ν, 2

2 z αz |z⟩ and pz = |αz | ,

P

P

|ϕω ◦ ϕω ⟩ = Pz

αz2 |z⟩

2 1/2 y py

.

Then the algorithm makes Ω(N 1/3 ) queries, with a constant that depends on ν. Proof. For either oracle model, measuring |ϕω ◦ϕω ⟩ in the computational basis gives z with probability |αz |4 = rpω (z), 2 y py

P

where rpω is the collision distribution. Measuring ρω instead gives a distribution aω with TV(aω , rpω ) ≤

1 ρω − |ϕω ◦ ϕω ⟩⟨ϕω ◦ ϕω | 1 , 2

because a measurement does not increase the trace distance. Hence Eω TV(aω , rpω ) ≤ ν, and Corollary 6.10 gives the claim in the corresponding oracle model.

References [AA13]

Scott Aaronson and Alex Arkhipov. The computational complexity of linear optics. Theory of Computing, 9:143–252, 2013. https://arxiv.org/abs/1011.3245.

[AAB+ 19] Frank Arute, Kunal Arya, Ryan Babbush, et al. Quantum supremacy using a programmable superconducting processor. Nature, 574:505–510, 2019. Supplementary information: https://arxiv.org/abs/1910.11333. [Aar20]

Scott Aaronson. Random circuit sampling: Thoughts and open problems. Talk at The Quantum Wave in Computing, Simons Institute, 2020. https://simons.berkeley. edu/talks/random-circuit-sampling-thoughts-open-problems.

[Aar21]

Scott Aaronson. Open problems related to quantum query complexity. ACM Transactions on Quantum Computing, 2(4):14:1–14:9, 2021. https://arxiv.org/abs/2109. 06917.

[AC17]

Scott Aaronson and Lijie Chen. Complexity-theoretic foundations of quantum supremacy experiments. In Proceedings of the 32nd Computational Complexity Conference (CCC), pages 22:1–22:67, 2017. https://arxiv.org/abs/1612.05903.

[AG20]

Scott Aaronson and Sam Gunn. On the classical hardness of spoofing linear crossentropy benchmarking. Theory of Computing, 16(11):1–8, 2020. https://arxiv.org/ abs/1910.12085.

84

[AGL+ 23] Dorit Aharonov, Xun Gao, Zeph Landau, Yunchao Liu, and Umesh Vazirani. A polynomial-time classical algorithm for noisy random circuit sampling. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing (STOC), pages 945–957, 2023. https://arxiv.org/abs/2211.03999. [AH23]

Scott Aaronson and Shih-Han Hung. Certified randomness from quantum supremacy. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing (STOC), pages 933–944, 2023. https://arxiv.org/abs/2303.01625.

[ARU14]

Andris Ambainis, Ansis Rosmanis, and Dominique Unruh. Quantum attacks on classical proof systems: The hardness of quantum rewinding. In Proceedings of the 55th Annual IEEE Symposium on Foundations of Computer Science (FOCS), pages 474–483, 2014. https://arxiv.org/abs/1404.6898.

[AS04]

Scott Aaronson and Yaoyun Shi. Quantum lower bounds for the collision and the element distinctness problems. Journal of the ACM, 51(4):595–605, 2004.

[BBC+ 01] Robert Beals, Harry Buhrman, Richard Cleve, Michele Mosca, and Ronald de Wolf. Quantum lower bounds by polynomials. Journal of the ACM, 48(4):778–797, 2001. https://arxiv.org/abs/quant-ph/9802049. [BBF+ 26]

Roozbeh Bassirian, Adam Bouland, Bill Fefferman, Sam Gunn, and Avishay Tal. On certified randomness from Fourier sampling or random circuit sampling. Quantum, 10:2002, 2026. https://arxiv.org/abs/2111.14846.

[BCG21]

Boaz Barak, Chi-Ning Chou, and Xun Gao. Spoofing linear cross-entropy benchmarking in shallow quantum circuits. In Proceedings of the 12th Innovations in Theoretical Computer Science Conference (ITCS), volume 185 of LIPIcs, pages 30:1–30:20, 2021. https://arxiv.org/abs/2005.02421.

[BCM+ 18] Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh Vazirani, and Thomas Vidick. A cryptographic test of quantumness and certifiable randomness from a single quantum device. In Proceedings of the 59th Annual IEEE Symposium on Foundations of Computer Science (FOCS), pages 320–331, 2018. https://arxiv.org/abs/1804.00640. [BE95]

Peter Borwein and Tamás Erdélyi. Polynomials and Polynomial Inequalities, volume 161 of Graduate Texts in Mathematics. Springer, 1995.

[BFNV19] Adam Bouland, Bill Fefferman, Chinmay Nirkhe, and Umesh Vazirani. On the complexity and verification of quantum random circuit sampling. Nature Physics, 15:159–163, 2019. https://arxiv.org/abs/1803.04402. [BHMT02] Gilles Brassard, Peter Høyer, Michele Mosca, and Alain Tapp. Quantum amplitude amplification and estimation. In Samuel J. Lomonaco, Jr. and Howard E. Brandt, editors, Quantum Computation and Information, volume 305 of Contemporary Mathematics, pages 53–74. American Mathematical Society, 2002. https: //arxiv.org/abs/quant-ph/0005055. [BHT98]

Gilles Brassard, Peter Høyer, and Alain Tapp. Quantum cryptanalysis of hash and claw-free functions. In LATIN’98: Theoretical Informatics, volume 1380 of Lecture Notes in Computer Science, pages 163–169. Springer, 1998. Preprint titled “Quantum Algorithm for the Collision Problem.” https://arxiv.org/abs/quant-ph/9705002. 85

[BIS+ 18]

Sergio Boixo, Sergei V. Isakov, Vadim N. Smelyanskiy, Ryan Babbush, Nan Ding, Zhang Jiang, Michael J. Bremner, John M. Martinis, and Hartmut Neven. Characterizing quantum supremacy in near-term devices. Nature Physics, 14:595–600, 2018. https: //arxiv.org/abs/1608.00263.

[BJS11]

Michael J. Bremner, Richard Jozsa, and Dan J. Shepherd. Classical simulation of commuting quantum computations implies collapse of the polynomial hierarchy. Proceedings of the Royal Society A, 467:459–472, 2011. https://arxiv.org/abs/1005.1407.

[BMS16]

Michael J. Bremner, Ashley Montanaro, and Dan J. Shepherd. Average-case complexity versus approximate simulation of commuting quantum computations. Physical Review Letters, 117:080501, 2016. https://arxiv.org/abs/1504.07999.

[BV97]

Ethan Bernstein and Umesh Vazirani. Quantum complexity theory. SIAM Journal on Computing, 26(5):1411–1473, 1997.

[CHSH69] John F. Clauser, Michael A. Horne, Abner Shimony, and Richard A. Holt. Proposed experiment to test local hidden-variable theories. Physical Review Letters, 23:880–884, 1969. [Cir80]

Boris S. Cirel’son. Quantum generalizations of Bell’s inequality. Letters in Mathematical Physics, 4(2):93–100, 1980.

[CKM+ 26] Andrea Coladangelo, Dakshita Khurana, Saachi Mutreja, Bhaskar Roberts, Joseph Slote, and Avishay Tal. Unconditional certified randomness without structure, 2026. https://arxiv.org/abs/2608.31112. [Col06]

Roger Colbeck. Quantum and Relativistic Protocols for Secure Multi-Party Computation. PhD thesis, University of Cambridge, 2006. https://arxiv.org/abs/0911.3814.

[DFR20]

Frédéric Dupuis, Omar Fawzi, and Renato Renner. Entropy accumulation. Communications in Mathematical Physics, 379(3):867–913, 2020. https://arxiv.org/abs/1607. 01796.

[DX14]

Charles F. Dunkl and Yuan Xu. Orthogonal Polynomials of Several Variables, volume 155 of Encyclopedia of Mathematics and its Applications. Cambridge University Press, second edition, 2014.

[GKC+ 24] Xun Gao, Marcin Kalinowski, Chi-Ning Chou, Mikhail D. Lukin, Boaz Barak, and Soonwon Choi. Limitations of linear cross-entropy as a measure for quantum advantage. PRX Quantum, 5:010334, 2024. https://arxiv.org/abs/2112.01657. [GS11]

Robert C. Griffiths and Dario Spanò. Multivariate Jacobi and Laguerre polynomials, infinite-dimensional extensions, and their probabilistic connections with multivariate Hahn and Meixner polynomials. Bernoulli, 17(3):1095–1125, 2011.

[Han26]

Dominik Hangleiter. Has quantum advantage been achieved?, 2026. https://arxiv. org/abs/2603.09901.

[HCSS23]

Zoë Holmes, Nolan J. Coble, Andrew T. Sornborger, and Yiğit Subaşı. Nonlinear transformations in quantum computation. Physical Review Research, 5:013105, 2023. https://arxiv.org/abs/2112.12307. 86

[HE23]

Dominik Hangleiter and Jens Eisert. Computational advantage of quantum random sampling. Reviews of Modern Physics, 95:035001, 2023. https://arxiv.org/abs/ 2206.04079.

[HM17]

Aram W. Harrow and Ashley Montanaro. Quantum computational supremacy. Nature, 549:203–209, 2017. https://arxiv.org/abs/1809.07442.

[HNZM26] Xinchi Huang, Hirofumi Nishi, Tomofumi Zushi, and Yu-ichiro Matsushita. An efficient quantum Hadamard product algorithm for functions, 2026. https://arxiv.org/abs/ 2606.03612. [JMR26]

Siddhartha Jain, Saachi Mutreja, and Bhaskar Roberts. Certified randomness with optimal rate, 2026. https://arxiv.org/abs/2609.38945.

[Kre21]

William Kretschmer. The quantum supremacy Tsirelson inequality. Quantum, 5:560, 2021. https://arxiv.org/abs/2008.08721.

[KRS09]

Robert König, Renato Renner, and Christian Schaffner. The operational meaning of min- and max-entropy. IEEE Transactions on Information Theory, 55(9):4337–4347, 2009. https://arxiv.org/abs/0807.1338.

[KRT26]

Dakshita Khurana, Bhaskar Roberts, and Avishay Tal. Certified randomness without structure against shallow-query adversaries, 2026. To appear in FOCS 2026. https: //arxiv.org/abs/2608.24832.

[LND+ 25] Minzhao Liu, Pradeep Niroula, Matthew DeCross, et al. Certified randomness amplification by dynamically probing remote random quantum states, 2025. https: //arxiv.org/abs/2511.03686. [LSN+ 25]

Minzhao Liu, Ruslan Shaydulin, Pradeep Niroula, et al. Certified randomness using a trapped-ion quantum processor. Nature, 640:343–348, 2025. https://arxiv.org/abs/ 2503.20498.

[MH25]

Fermi Ma and Hsin-Yuan Huang. How to construct random unitaries. In Proceedings of the 57th Annual ACM Symposium on Theory of Computing (STOC), 2025. https: //arxiv.org/abs/2410.10116.

[MLA+ 22] Lars S. Madsen, Fabian Laudenbach, Mohsen Falamarzi Askarani, et al. Quantum computational advantage with a programmable photonic processor. Nature, 606:75–81, 2022. [Mov23]

Ramis Movassagh. The hardness of random quantum circuits. Nature Physics, 19:1719– 1724, 2023. https://arxiv.org/abs/1909.06210.

[MS16]

Carl A. Miller and Yaoyun Shi. Robust protocols for securely expanding randomness and distributing keys using untrusted quantum devices. Journal of the ACM, 63(4):33:1– 33:63, 2016. https://arxiv.org/abs/1402.0489.

[MVM+ 24] Alexis Morvan, Benjamin Villalonga, Xiao Mi, et al. Phase transitions in random circuit sampling. Nature, 634:328–333, 2024. https://arxiv.org/abs/2304.11119. [MVV22]

Urmila Mahadev, Umesh Vazirani, and Thomas Vidick. Efficient certifiable randomness from a single quantum device, 2022. https://arxiv.org/abs/2204.11353. 87

[NC10]

Michael A. Nielsen and Isaac L. Chuang. Quantum Computation and Quantum Information. Cambridge University Press, 10th anniversary edition, 2010.

[NTT11]

Kai Wang Ng, Guo-Liang Tian, and Man-Lai Tang. Dirichlet and Related Distributions: Theory, Methods and Applications. Wiley, 2011.

[PAM+ 10] Stefano Pironio, Antonio Acín, Serge Massar, A. Boyer de la Giroday, Dzmitry N. Matsukevich, Peter Maunz, Steven Olmschenk, David Hayes, Le Luo, T. Andrew Manning, and Christopher Monroe. Random numbers certified by Bell’s theorem. Nature, 464:1021–1024, 2010. https://arxiv.org/abs/0911.3427. [PCZ22]

Feng Pan, Keyang Chen, and Pan Zhang. Solving the sampling problem of the Sycamore quantum circuits. Physical Review Letters, 129:090502, 2022. https://arxiv.org/ abs/2111.03011.

[PR94]

Sandu Popescu and Daniel Rohrlich. Quantum nonlocality as an axiom. Foundations of Physics, 24(3):379–385, 1994.

[SY23]

Adrian She and Henry Yuen. Unitary property testing lower bounds by polynomials. In Proceedings of the 14th Innovations in Theoretical Computer Science Conference (ITCS), volume 251 of LIPIcs, pages 96:1–96:17, 2023. https://arxiv.org/abs/2210.05885.

[TCR10]

Marco Tomamichel, Roger Colbeck, and Renato Renner. Duality between smooth minand max-entropies. IEEE Transactions on Information Theory, 56(9):4674–4681, 2010. https://arxiv.org/abs/0907.5238.

[TSSR11]

Marco Tomamichel, Christian Schaffner, Adam Smith, and Renato Renner. Leftover hashing against quantum side information. IEEE Transactions on Information Theory, 57(8):5524–5535, 2011. https://arxiv.org/abs/1002.2436.

[VV12]

Umesh Vazirani and Thomas Vidick. Certifiable quantum dice: Or, true random number generation secure against quantum adversaries. In Proceedings of the 44th Annual ACM Symposium on Theory of Computing (STOC), pages 61–76, 2012. https: //arxiv.org/abs/1111.6054.

[WBC+ 21] Yulin Wu, Wan-Su Bao, Sirui Cao, et al. Strong quantum computational advantage using a superconducting quantum processor. Physical Review Letters, 127:180501, 2021. https://arxiv.org/abs/2106.14734. [YZ24]

Takashi Yamakawa and Mark Zhandry. Verifiable quantum advantage without structure. Journal of the ACM, 71(3):20:1–20:50, 2024. Preliminary version in FOCS 2022. https: //arxiv.org/abs/2204.02063.

[Zha19]

Mark Zhandry. How to record quantum queries, and applications to quantum indifferentiability. In Advances in Cryptology – CRYPTO 2019, Part II, volume 11693 of Lecture Notes in Computer Science, pages 239–268. Springer, 2019. https: //eprint.iacr.org/2018/276.

[ZWD+ 20] Han-Sen Zhong, Hui Wang, Yu-Hao Deng, et al. Quantum computational advantage using photons. Science, 370:1460–1463, 2020. https://arxiv.org/abs/2012.01625.

88

A

Deferred proofs

A.1

Proofs for the Haar lower bound

We give the proofs deferred from Section 5. We use its notation throughout. In the Dirichlet P calculations, ai ≥ 1, |a| = i ai , and the derivatives act on polynomial expressions in p1 , . . . , pN before restriction to the simplex. The tangent derivatives Ti are defined in (47). A.1.1

The level of the supplied copies

Proof of Lemma 5.5. Step 1: the level of one string. Expand |ϕ⟩⊗s =

X

αx1 · · · αxs |x1 , . . . , xs ⟩.

x∈[N ]s

The monomial of the string x contains no conjugates, so its pattern is (nj )j , where nj is the number of occurrences of j in x, and its polynomial factor is constant. Its level is X

max(nj − 1, 0) = s − dist(x),

j

where dist(x) is the number of distinct entries of x. Step 2: the expected number of distinct samples. Distinct strings are orthogonal in the register basis and the squared amplitude of x is px1 · · · pxs , so λ(|ϕ⟩⊗s )2 = Eϕ

X

px1 · · · pxs s − dist(x)

x

= s − E[dist], where in the last expression p is uniform on the simplex and, conditional on p, the entries of x are independent samples from p. By linearity, E[dist] =

X

Pr[i appears]

i

= N 1 − Eϕ (1 − pi )s .

By Lemma 3.7(iii), 1 − pi has the Beta distribution with parameters (N − 1, 1), so s

E(1 − pi ) = (N − 1) = Hence E[dist] = A.1.2

Ns N +s−1

Z 1

tN −2+s dt

0

N −1 . N +s−1 s − E[dist] =

and

s(s − 1) . N +s−1

Integration by parts

Proof of Lemma 5.9. Step 1: reduction to monomials. Both sides of (48) are bilinear in (g, v), so it Q b suffices to take g = pb and v = pc for vectors b, c of nonnegative integers, where pb = j pjj . Put ν = Ea [pb+c ],

νi = Ea [pb+c+ei ]. 89

Step 2: the two sides. The partial derivatives of pb are ∂i pb = bi pb−ei , read as 0 when bi = 0. P Since moreover j pj ∂j pb = |b|pb by Euler’s identity, and in the same way for pc , we have pi Ti pb = bi pb − |b|pb+ei

pi Ti pc = ci pc − |c|pc+ei ,

and

so the left side of (48) equals bi ν − |b|νi , and the right side equals (|a| + |c|)νi − (ai + ci )ν. Step 3: comparison of the two sides. After rearrangement, the two agree because (|a| + |b| + |c|) νi = (ai + bi + ci ) ν, which is Lemma 3.7(i). Indeed, the formulas for the two moments differ only by the factors (ai )bi +ci +1 = ai + bi + ci (ai )bi +ci

(|a|)|b|+|c|+1 = |a| + |b| + |c| (|a|)|b|+|c|

and

in the numerator and in the denominator, respectively. A.1.3

The expression for the operator P

Verification of (50). Indeed, the terms involving a agree, since P the others, write E = j pj ∂j , so that Ti = ∂i − E by (47). Then

i ai Ti g =

i (ai − |a|pi )∂i g. For

P

Ti2 g = ∂i2 g − ∂i (Eg) − E(∂i g) + E(Eg), ∂i (Eg) = ∂i g + E(∂i g), E(Eg) = Eg +

X

pj pk ∂j ∂k g,

j,k

and therefore X

pi Ti2 g =

i

X

pi ∂i2 g − 2

X

i

+

pi pj ∂i ∂j g − Eg

i,j

X

pi



Eg +

X

i

=

X

pj pk ∂j ∂k g



j,k

pi (δij − pj )∂i ∂j g

on the simplex.

i,j

A.1.4

Symmetry and eigenvalues

Proof of Lemma 5.10. Part (i). Apply Lemma 5.9 with f¯ in place of g and Ti g in place of v. Since Ti has real coefficients, Ti f¯ = Ti f , and the identity reads   
 Ea pi Ti f Ti g = Ea f¯ (|a|pi − ai )Ti g − pi Ti2 g .

Summing over i, using the identity

P

i pi Ti g = 0 on the simplex, and comparing with (50) gives

h X

Ea Γ(f, g) = −Ea f¯

i

= −⟨f, La g⟩a . 90

i

(ai Ti g + pi Ti2 g)

Since Γ(f, g) = Γ(g, f ), the operator La is symmetric, and ⟨g, La g⟩a = −Ea Γ(g, g) ≤ 0. Part (ii). Each term of La maps polynomials of degree at most m to such polynomials. Let g ∈ Rar , choose a representative of degree at most r, and let gr be its homogeneous part of degree r. P P The terms of La that do not lower the degree are − i,j pi pj ∂i ∂j − |a| i pi ∂i , and two applications of Euler’s identity evaluate them on gr to −r(r − 1)gr − |a|rgr . Hence ∆ = La g + r(|a| + r − 1)g has degree at most r − 1. For every v of degree at most r − 1, we have ⟨v, g⟩a = 0 and, by the symmetry in (i), ⟨v, La g⟩a = ⟨La v, g⟩a = 0 because La v has degree at most r − 1. Hence ⟨v, ∆⟩a = 0, and taking v = ∆ gives ∆ = 0. P Part (iii). Decompose h = j≤r hj with hj ∈ Raj . By (i) and (ii), Ea Γ(h, h) = −⟨h, La h⟩a =

X

j(|a| + j − 1)∥hj ∥2a ,

j

because the hj are orthogonal and La maps each Raj to itself, and the coefficient j(|a| + j − 1) is at most r(|a| + r − 1). A.1.5

The mass of a set of outcomes

Proof of Lemma 5.8. Step 1: reductions. Since |h|2 = (Re h)2 + (Im h)2 and both parts have degree at most r, it suffices to treat real h. Write y 2 = Ea [p(S)h2 ] and b = a(S). If r > |a|, then the claim holds because y 2 ≤ ∥h∥2a and (b + r)/|a| > 1. We may therefore assume r ≤ |a|, whence r(|a| + r − 1) ≤ 2r|a|. Step 2: an identity for y 2 . We combine three facts: 1. the formula La p(S) = b − |a|p(S); 2. the identity Ea Γ(f, g) = −⟨f, La g⟩a of Lemma 5.10(i), with f = h2 and g = p(S); 3. the product rule Γ(h2 , p(S)) = 2h Γ(h, p(S)), which holds because the form Γ is built from first derivatives. Together they give |a|y 2 − b∥h∥2a = −Ea [h2 La p(S)] = Ea Γ(h2 , p(S)) = 2 Ea [h Γ(h, p(S))]. Step 3: a bound on the right side of Step 2. At every point of the simplex, Γ is a positive semidefinite form, so |Γ(h, p(S))| ≤

q

q

Γ(p(S), p(S)) =

X

pi (δij − pj )

Γ(h, h) Γ(p(S), p(S)),

i,j∈S

= p(S) 1 − p(S) ≤ p(S).

91

Taking expectations, applying the Cauchy–Schwarz inequality, and using Lemma 5.10(iii) together with the bound r(|a| + r − 1) ≤ 2r|a| of Step 1, we obtain 2 Ea [h Γ(h, p(S))] ≤ 2 Ea

q

q



p(S)|h| Γ(h, h)

q

q

≤ 2y Ea Γ(h, h) ≤ 2y 2r|a| ∥h∥a . Finally, by Steps 2 and 3 for the first inequality and by the arithmetic–geometric mean inequality for the second, q

|a|y 2 − b∥h∥2a ≤ 2y 2r|a| ∥h∥a ≤

|a| 2 y + 4r∥h∥2a , 2

that is, y2 ≤ A.1.6

(2b + 8r)∥h∥2a 8(b + r)∥h∥2a ≤ . |a| |a|

Raising the level by one

Proof of Lemma 5.18. Write G for the input of L+ and F = F⊥ ⊗ |⊥⟩ + i Fi ⊗ |i⟩ for the input of L− . Norms without subscripts are norms of vector-valued polynomials; (44) and (45) convert them to Dirichlet norms. For L+ we consider pairs consisting of a block of G and an outcome i. For L− we consider pairs consisting of an outcome i and a block of Fi . We first identify the output blocks and then bound their contributions. Step 1: the output blocks. By the table, the part of each pair that raises the level lies in at most one output block. For L+ , the output records i in the appended register, and the output pattern is the input pattern plus ei . The upward cases are the following two, which are rows one and three of the table with the signs of the entries reversed: P

1. the case γi ≥ 1, in which the degree under the Dirichlet measure is unchanged; 2. the case γi = −1, in which the degree under the Dirichlet measure rises by one. The two are distinguished by the value of the output pattern at i. Hence the output block and the outcome determine the input block, so the contributions of distinct pairs for L+ are pairwise orthogonal. Step 2: the map L+ . Let uγ h, with h ∈ Rar , a = a(γ), and |γ|1 + 2r ≤ d, be a block of G. Only the outcomes i in the occupied set S = {i : γi ̸= 0} receive a contribution one level up from it, and projecting onto that level does not increase norms, so its contribution is at most X

∥αi uγ h∥2 = Mγ Ea [p(S)|h|2 ]

i∈S

≤8

a(S) + r d Mγ ∥h∥2a ≤ 16 ∥uγ h∥2 , |a| N

by (44) and Lemma 5.8, where the last step uses a(S) = |S| + |γ|1 ≤ 2|γ|1 , hence

a(S) + r ≤ 2(|γ|1 + 2r) ≤ 2d, 92

and |a| ≥ N . Summing over the blocks of G, whose contributions are orthogonal, gives the bound 16d/N ≤ 36(d + 1)/N for L+ . For L− , fix an output block (γ, r). The contributions to it from one level below come from pairs of two types, which can be read off the output pattern. 1. In type I, γi ≤ −2 and the input block is (γ + ei , r), which is the first row of the table. 2. In type II, γi = 0 and the input block is (γ + ei , r − 1), which is the third row. Each pair for L− belongs to at most one type and contributes to at most one output block. For output block (γ, r) = (0, 1), the inputs αi vi ⊗ |i⟩, with vi constant, contribute (pi − 1/N )vi . We bound their sum in each output block, then add the squared norms of the orthogonal output blocks. Each pair contributes to at most one such block. Step 3: repeated unpaired factors in L− . Fix an output block (γ, r) with a = a(γ), and let i . Multiplication S = {i : γi ≤ −2}. For i ∈ S, the relevant block of Fi is uγ+ei hi , with hi ∈ Ra−e P r a by αi gives uγ hi . Before projection onto Rr , these contributions add to uγ i∈S hi . The projection does not increase norms. By the Cauchy–Schwarz inequality, pointwise, X

2

hi

≤ p(S)

i∈S

X |hi |2 i∈S

pi

,

so by (45) in the direction of decreasing magnitude, uγ

X

2

hi

h

≤ Mγ Ea p(S)

i∈S

X |hi |2 i

pi

i∈S

=

X

Mγ+ei Ea−ei p(S)|hi |2 . 



i∈S

Each input block lies in P≤d , and therefore |γ|1 − 1 + 2r ≤ d. In the measure a − ei , whose total is |a| − 1 ≥ N , we have (a − ei )(S) + r ≤ a(S) + r ≤ 2(|γ|1 + 2r) ≤ 2(d + 1). Lemma 5.8 therefore gives Ea−ei p(S)|hi |2 ≤ 16 



d+1 ∥hi ∥2a−ei , N

and the type I contribution has squared norm at most (16(d + 1)/N ) i∈S ∥uγ+ei hi ∥2 . Step 4: paired conjugate factors in L− . For r = 0 there is no contribution of this type, so assume i r ≥ 1. For each i with γi = 0, the relevant block of Fi is uγ+ei hi , with hi ∈ Ra+e r−1 . Set hi = 0 for the other outcomes. Multiplication by αi gives uγ pi hi . After summation and projection onto Rar , P the contribution is uγ Πar i pi hi . This is the situation of Lemma 5.17 with r − 1 in place of r, which gives P

Πar

X i

2

pi hi

a

≤

X r Ea [pi |hi |2 ] |a| + 2r − 1 i

≤

d+1X Ea [pi |hi |2 ], 2N i 93

using |a| ≥ N and r ≤ (d + 1)/2, the latter from the degree constraint |γ|1 + 1 + 2(r − 1) ≤ d of the input blocks. By (45) in the direction of increasing magnitude, Mγ Ea [pi |hi |2 ] = ∥uγ+ei hi ∥2 , so multiplying by P Mγ shows that the type II contribution has squared norm at most ((d + 1)/(2N )) i ∥uγ+ei hi ∥2 . Step 5: adding the contributions. Within one output block, add the contributions of the two types and apply ∥x+y∥2 ≤ 2∥x∥2 +2∥y∥2 . Its squared norm is at most 2(16+1/2)(d+1)/N ≤ 36(d+1)/N times the sum of the squared norms of its input components. We then sum over the orthogonal output blocks. Each pair contributes to at most one block and one type, so each input component P is counted at most once. Their total squared norm is at most i ∥Fi ∥2 ≤ ∥F ∥2 , proving the bound for L− . A.1.7

Lowering the level by one

Proof of Lemma 5.19. Step 1: reformulation. Let L↓ =

X

Pk LPk+1

k≥0

be the part of L that lowers the level. Since its terms lie at distinct levels, the claim is ∥L↓ F ∥2 ≤ 36

d+2 ∥F ∥2 . N

Step 2: duality. The state L↓ F lies in P≤d+1 , because L raises the degree by at most one, so ∥L↓ F ∥ =

|⟨G, L↓ F ⟩|.

sup G∈P≤d+1 , ∥G∥=1

Since the Pk are self-adjoint, ⟨Pk+1 L† Pk G, F ⟩ = ⟨(L† )↑ G, F ⟩,

⟨G, L↓ F ⟩ =

X

†

X

k

(L )↑ =

Pk+1 L† Pk .

k

Step 3: the bound. Since L†+ = L− and L†− = L+ , we can apply Lemma 5.18 to L† at degree d + 1. This gives ∥(L† )↑ G∥2 ≤ 36(d + 2)/N . The Cauchy–Schwarz inequality bounds the pairing: |⟨(L† )↑ G, F ⟩| ≤ ∥(L† )↑ G∥ ∥F ∥. A.1.8

The heaviest outcome

Proof of Lemma 5.24. For p uniform on the simplex and 0 < t < 1, the joint tail satisfies −1 Pr[pi1 > t, . . . , pik > t] = (1 − kt)N , +

since the set in question is a copy of the simplex scaled by 1 − kt. Inclusion–exclusion therefore gives !

Pr[max pz > t] = z

X

(−1)

k≥1

94

k+1

N −1 (1 − kt)N . + k

Integrating over t ∈ (0, 1) gives E max pz = z

N X

!

(−1)

k+1

k=1

= =

1 − (1 − x)N dx x

1 N

Z 1

1 N

Z 1 NX −1

0

N 1 k kN

(1 − x)j dx =

0

j=0

HN , N

where the second equality expands (1 − (1 − x)N )/x by the binomial theorem and integrates term by term.

A.2

Moments of the ideal distribution

Proof of Lemma 6.2. Steps 1–3 prove part (i), and Steps 4–7 prove part (ii). Step 1: the mean and the second moment in the Haar ensemble. By Lemma 3.7(i) with all parameters equal to 1, Epkx =

k! , (N )k

Epkx ply =

k! l! (N )k+l

for x ̸= y.

Hence EMj = N j j!/(N )j , which is the stated value, and it is at most j! because (N )j ≥ N j . For the second moment, the two expectations above give 

j j EMj2 = N 2j−2 N Ep2j x + N (N − 1) Epx py



(2j)! + (N − 1)(j!)2 (N )2j (2j)! , ≤ (j!)2 + N

= N 2j−1

where the last step holds again because (N )2j ≥ N 2j . Step 2: the variance of Mj in the Haar ensemble. We have 

EMj ≥ j! 1 −

j(j − 1)  , 2N

because

Y

1+

i<j

X i i −1 ≥1− , N N i<j

so that (EMj )2 ≥ (j!)2 (1 − j 2 /N ), which holds trivially when j 2 ≥ N . With Step 1, the bound on Var Mj = EMj2 − (EMj )2 follows. Step 3: the value of E(M2 − 2)2 . We have E(M2 − 2)2 = EM22 − 4EM2 + 4, and its value follows from N 2 (4N + 20) EM22 = , (N + 1)(N + 2)(N + 3) which is the case j = 2 of Step 1 before the last inequality. The bound 4/N follows from N (4N 2 − 4N + 24) ≤ 4(N + 1)(N + 2)(N + 3). Step 4: the pairing bound in the Fourier ensemble. Let Xz =

√ X N fb(z) = N −1/2 χz (x)f (x), x

95

so that

Mj =

1 X 2j X , N z z

and write rx = χz (x)f (x). The rx are independent uniform signs. In the expansion Xz2j = N −j

X

rx1 · · · rx2j ,

x1 ,...,x2j

the expectation of a term is 1 if every address occurs an even number of times in the tuple (x1 , . . . , x2j ) and 0 otherwise. Every tuple of the first kind is constant on the pairs of at least one partition of its 2j positions into j pairs, obtained by pairing up the positions of each address. There are (2j − 1)!! partitions of the 2j positions into j pairs, and each is compatible with exactly N j tuples, namely those constant on each of its pairs, so there are at most (2j − 1)!! N j tuples of the first kind, and EXz2j ≤ (2j − 1)!! = κj . Hence EMj ≤ κj . By the Cauchy–Schwarz inequality, E[Xz2j Xw2j ] ≤ (EXz4j EXw4j )1/2 ≤ κ2j , hence EMj2 ≤ κ2j . For N ≥ j, the tuples with exactly j distinct addresses, each occurring twice, number κj N (N − 1) · · · (N − j + 1): their pairs of equal positions determine a unique pairing. Thus κj

N (N − 1) · · · (N − j + 1) ≤ EMj ≤ κj , Nj

which proves EMj → κj as N → ∞ for every fixed j. Step 5: the exact fourth and sixth moments. The exact values are obtained by counting the tuples of the first kind exactly. For 2j = 4, they are the 3N (N − 1) tuples that consist of two distinct addresses, each twice, and the N constant tuples, so EXz4 =

3N 2 − 2N 2 =3− . N2 N

For 2j = 6, the tuples of the first kind are the 15N (N − 1)(N − 2) tuples with three distinct addresses, each twice; the 15N (N − 1) tuples with one address four times and another twice; and the N constant tuples. Hence 15N 2 − 30N + 16 EXz6 = . N2 Step 6: the variance of M2 in the Fourier ensemble. Summing over z first and using (12), we obtain M2 = =

1 X X χz (x ⊕ y ⊕ u ⊕ v)f (x)f (y)f (u)f (v) N 3 z x,y,u,v 1 X f (x)f (y)f (u)f (x ⊕ y ⊕ u). N 2 x,y,u

The triples (x, y, u) in the last sum are of two kinds. 1. If two of x, y, u coincide, the summand equals 1, and there are 3N 2 − 2N such triples. 2. Otherwise x, y, u and v = x ⊕ y ⊕ u are four distinct points, and the summand is a product of four independent signs with mean zero. There are N (N − 1)(N − 2) such triples. The product of two summands of the second kind has mean 1 if their four-element sets coincide and mean 0 otherwise, since otherwise some sign occurs an odd number of times. Each four-element set {a, b, c, d} with a ⊕ b ⊕ c ⊕ d = 0 arises from exactly 4! = 24 ordered triples (x, y, u), one for 96

each ordering of its elements. Hence each of the N (N − 1)(N − 2) triples of the second kind has a product of mean 1 with exactly 24 triples, itself included, and Var M2 = N −4 · 24 · N (N − 1)(N − 2) ≤

24 . N

Since EM2 = 3 − 2/N , this gives E(M2 − 3)2 = Var M2 + (2/N )2 ≤ 28/N . Step 7: the variance of M3 in the Fourier ensemble. The variance of M3 is bounded in the same way. Summing over z first gives M3 = N −3

X

f (x1 ) · · · f (x6 ),

the sum running over the 6-tuples with x1 ⊕ · · · ⊕ x6 = 0. For such a tuple, let Y be the set of Q addresses that occur an odd number of times in it. The product then equals y∈Y f (y), and the set L Y satisfies y∈Y y = 0. Moreover, |Y| ∈ {0, 4, 6}, because |Y| has the parity of the total multiplicity 6, and the sum of two distinct addresses is not 0. We use three facts: 1. the tuples with Y = ∅ contribute EM3 ; 2. a product with Y ̸= ∅ has mean zero; 3. two products with distinct sets Y are uncorrelated. Hence Var M3 = N −6

X

c2Y ,

Y̸=∅

where cY is the number of tuples with odd set Y. We count these tuples for |Y| = 6 and |Y| = 4. 1. A set of size 6 arises from its 720 orderings, so cY = 720, and there are at most N 5 /720 such sets, because an ordering of such a set is determined by its first five entries. 2. A set of size 4 arises from the 480 tuples in which one of its elements occurs three times and from the 360(N − 4) tuples that contain one further address twice, so cY ≤ 400N , and there are at most N 3 /24 such sets, because an ordering is determined by its first three entries. Hence 

Var M3 ≤ N −6 720N 5 +

A.3

 N3 104 (400N )2 ≤ . 24 N

Heavy outputs

We use the Haar L2 inner product, the patterns, and the projections Pk of Section 5.1. All auxiliary initial registers are independent of the oracle, and any mixed state or measurement can be purified as in Lemma 3.2. For a measurable w : [0, 1] → [0, 1], define the multiplication operator (Xw F )(ϕ) =

X

w(pz )Πz F (ϕ).

z

It is a positive contraction on the space of all square-integrable vector-valued functions. Its expectation in a final state is the expected payoff w(pZ ).

97

Lemma A.1 (Bounded output rewards). Let N ≥ 2 and define 
  max E w Beta(1, A − 1) ,  N ≤A≤2N  −1 κw = max
,  max E w Beta(2, A − 2)   

(78)

N +1≤A≤2N

where A ranges over integers. This is the largest value of ⟨G, Xw G⟩ over unit vectors G of level zero. Every unit vector-valued polynomial F satisfies ⟨F, Xw F ⟩ ≤ κw + λ(F ).

(79)

For w(x) = 1{x>θ} , 0 < θ < 1, κw = (1 − θ)N −1 1 + (N − 1)θ .

(80)

Proof. Step 1: level zero. A level-zero block has a square-free pattern γ and a constant polynomial factor. By (44), its normalized inner product uses Dir(a(γ)), where ai = 1 + |γi | and A = N + |γ|1 . On output branch z, pz has law Beta(1, A − 1) if γz = 0, and Beta(2, A − 2) if |γz | = 1. In the first case 0 ≤ |γ|1 ≤ N − 1; in the second 1 ≤ |γ|1 ≤ N . Multiplication by w(pz ) preserves the pattern and the output branch, so cross terms between distinct patterns or branches vanish. Thus ⟨G, Xw G⟩ ≤ κw ∥G∥2 for every level-zero G. Every integer A in either range is realized by a squarefree pattern and a constant vector supported on the specified output branch. After normalization, this vector attains the corresponding expectation. Hence the finite maximum in (78) is exact. Step 2: the other levels. Write F0 = P0 F and F+ = F − F0 . If F0 = ̸ 0, put G = F0 /∥F0 ∥. Orthogonality and ∥F ∥ = 1 give q 1 |F ⟩⟨F | − |G⟩⟨G| 1 = 1 − |⟨F, G⟩|2 = ∥F+ ∥ ≤ λ(F ). 2

These are rank-one operators on the Haar L2 Hilbert space. In particular, G need not be normalized for each ϕ or be an algorithm state. Since 0 ≤ Xw ≤ I, its expectations differ by at most this trace distance. Together with Step 1, this proves (79), including all cross terms. If F0 = 0, then λ(F ) ≥ 1 and the bound follows from ⟨F, Xw F ⟩ ≤ 1. Step 3: indicator rewards. Write v = 1 − θ. The Beta(1, A − 1) tail is v A−1 , whose maximum is v N −1 . For b ≥ 1, integrating the density b(b + 1)x(1 − x)b−1 gives Pr[Beta(2, b) > θ] = v b (1 + bθ).

(81)

For S(A) = v A−2 (1 + (A − 2)θ), S(A + 1) (A − 1)θ2 =1− < 1. S(A) 1 + (A − 2)θ The second maximum in (78) is therefore attained at A = N + 1 and dominates the first. This proves (80). Proof of Theorem 6.12. Step 1: the calibration and finite bounds. Under Haar measure, pz ∼ Beta(1, N − 1) and Pr[pz > θ] = (1 − θ)N −1 . Thus θN in (59) is its median, and an output independent of ϕ has heavy probability 1/2. Honest sampling weights this marginal by N pz , giving Beta(2, N − 1). Equation (81) and (1 − θN )N −1 = 1/2 give (60). Writing a = ln 2, (N − 1)θN = (N − 1)(1 − e−a/(N −1) ) ≤ a, 98

(N − 1)θN −→ a,

which proves the stated inequality and limit. For canonical access with s supplied copies, Theorem 5.6 gives λ(Ψ) ≤ Λs,q . Apply Lemma A.1 to the unit vector Ψ with w(x) = 1{x>θN } to obtain (61). For unitary access, Theorem 5.23 gives a single oracle-independent simulator using 2q canonical queries. For each fixed ϕ, its output law and the output law of the unitary algorithm, averaged over Uϕ , differ in total variation by at most √ (5q + 2)/ N . A reward in [0, 1] changes by at most that distance. Averaging over ϕ and applying the canonical bound with s = 0 proves (62). The same argument holds for every deterministic threshold 0 < θ < 1, with baseline (80). Step 2: the lower bound at the fixed threshold. If Bθhog (A) ≥ hhon + ε for ε > 0, canonical access N requires Λs,q ≥ ε. The budget obeys √ s + c0 q s + 2q + 1 √ Λs,q ≤ N √
√ (1 + 2c0 ) s + q s + q + 1 √ ≤ . (82) N √ √ √ Consequently s + q s + q + 1 ≥ ε N /(1 + 2c0 ). With s = 0, q = 0 cannot achieve the target; for q ≥ 1, √  2/3 2c0 q 3/2 ε Λ0,q ≤ √ , q≥ √ N 1/3 . 2c0 N For unitary access without supplied copies, we may assume q ≤ N 1/3 , since otherwise the desired √ lower bound already holds. The simulation error is then at most (5N 1/3 + 2)/ N =√o(1). For all sufficiently large N it is at most ε/2, so (62) gives Λ0,2q ≥ ε/2. Since Λ0,2q ≤ 4c0 q 3/2 / N , this also forces Ωε (N 1/3 ) queries. Step 3: the squaring algorithm. Let aω be the output distribution of Sqm , where ω is either form P of Haar oracle, and let rp (z) = p2z / y p2y . For N ≥ 64 and m = ⌈N 1/3 ⌉, Theorem 6.6 gives at most 3N 1/3 queries and Eω TV(aω , rp ) ≤ 40N −1/3 . For any threshold τϕ , including one depending on the state, this implies P 2 z pz 1{pz >τϕ } hog P 2 Bτϕ (Sqm ) − Eϕ ≤ 40N −1/3 . (83) p z z No independence between the threshold and the state is needed here: for each fixed oracle, the heavy outcomes form a subset of the output space. Use the exponential representation pz = Gz /S, where the Gz are independent exponential P random variables of mean one and S = z Gz . If Sτϕ → t > 0 in probability, the ratio in (83) is N −1

2 z Gz 1{Gz >Sτϕ } P . N −1 z G2z

P

The denominator tends toR 2 by the law of large numbers. For each fixed u > 0, the numerator with threshold u tends to u∞ x2 e−x dx. On the event |Sτϕ − t| < δ, the numerator at the random threshold lies between those at t + δ and t − δ, for 0 < δ < t. Letting δ ↓ 0 proves convergence in probability of the ratio to ! Z t2 1 ∞ 2 −x −t x e dx = e 1+t+ . (84) 2 t 2 The ratio lies in [0, 1], so its expectation converges as well. Since S/N → 1 and N θN → ln 2, taking τϕ = θN proves the fixed-threshold limit h⋆ . 99

For the empirical median, write G(j) for the increasing order statistics. At every fixed u, the fraction of samples at most u tends to 1 − e−u . For u < ln 2 this limit is below 1/2, and for u > ln 2 it is above 1/2. It follows that both G(N/2) and G(N/2+1) tend to ln 2 in probability. Scaling preserves their order, and hence S θbN =

G(N/2) + G(N/2+1) −→ ln 2, 2

N θbN −→ ln 2.

Equation (84) therefore gives the same limit h⋆ for the empirical median. Applying the same sandwich argument with Gz in place of G2z , and denominator S/N → 1, shows that honest sampling R∞ −x has limiting empirical-median heavy probability ln 2 xe dx = hhon . Step 4: the lower bound for the empirical median. Fix a target h > hhon . Choose 0 < δ < ln 2 small enough that e−(ln 2−δ) (1 + ln 2 − δ) < h, and set τN = (ln 2 − δ)/N . For every algorithm, Bbhog (A) ≤ Bτhog (A) + Pr[θbN < τN ]. N

(85)

θN

The last probability is o(1) by Step 3 and is independent of the algorithm. The deterministicthreshold version of Step 1 bounds the first term with baseline (1 − τN )N −1 (1 + (N − 1)τN ) −→ e−(ln 2−δ) (1 + ln 2 − δ). This leaves a fixed positive gap below h. The no-copy query estimates of Step 2 therefore give Ωh (N 1/3 ) in both access models, uniformly over algorithms. Step 3 supplies the matching upper bound whenever h < h⋆ . These arguments concern fixed targets and ensemble-averaged heavy probabilities; they assert no rate for a target approaching hhon with N . Proposition A.2 (Heavy outputs from copies without queries). Let an algorithm receive |ϕ⟩⊗s , tensored with an oracle-independent joint state of its other registers, and make no oracle queries. It may apply arbitrary joint operations on its copies and device registers. Put

Rs =

   

1−

  

1,

s−1 Y

N −j , N +j j=0

0 ≤ s ≤ N,



Rs ≤ min 1,

s(s − 1) , N +s−1 

(86)

s > N,

where the empty product is one. For every w as in Lemma A.1, E w(pZ ) ≤ κw + (1 − κw )Rs .

(87)

In particular, hog hog Bθhog (A) ≤ βN + (1 − βN )Rs . N hog For s = 0, the heavy probability is exactly 1/2. A heavy probability of at least βN + ε, for ε > 0, requires ε(N + s − 1) s(s − 1) ≥ , (88) hog 1 − βN √ and in particular s = Ω( εN ).

100

Proof. Purify the initial state and defer measurements. With no queries, every operation is ϕindependent. Before these operations the state is Φs (ϕ) =

X

αx1 · · · αxs |x⟩ ⊗ ψ0 .

x∈[N ]s

Every monomial has a nonnegative pattern γ with |γ|1 = s and a constant polynomial factor. Its level is zero precisely when all entries of the tuple are distinct. Fixed operations preserve the pattern and the constant polynomial factor. Consequently the final state’s parts F0 = P0 F and F+ = F − F0 have disjoint patterns. Because Xw preserves patterns, ⟨F0 , Xw F+ ⟩ = 0. This is an orthogonality statement in the Haar L2 space and requires no measurement of, or access to, the pattern. The copy-register basis vectors are orthogonal. For a distinct tuple, Lemma 3.7(i) gives Eϕ px1 · · · pxs = 1/(N )s , where (N )s = N (N + 1) · · · (N + s − 1). There are N (N − 1) · · · (N − s + 1) such tuples when s ≤ N , and none when s > N . Thus ∥F+ ∥2 = Rs in (86); a fixed isometry preserves this norm. Equivalently, Rs is the Haar-averaged probability of a repeat among s independent samples conditional on p. Every positive level is at least one, so Lemma 5.5 gives Rs = ∥F+ ∥2 ≤ λ(F )2 =

s(s − 1) . N +s−1

Together with Rs ≤ 1, this proves the displayed bound. The level-zero calibration in Lemma A.1, the vanishing cross term, and 0 ≤ Xw ≤ I now give ⟨F, Xw F ⟩ ≤ κw ∥F0 ∥2 + ∥F+ ∥2 = κw + (1 − κw )Rs . The indicator calibration gives the HOG bound, and rearranging √ it gives (88). A positive advantage hog forces s ≥ 2, so N + s − 1 ≥ N and 1 − βN ≤ 1 imply s ≥ εN . For s = 0, the final output is independent of ϕ, giving heavy probability 1/2 by the marginal median calculation above.

101

Related documents

• Tight Query Lower Bounds for Quantum Sampling, with an Application to Certified Randomness#1215808
• Random Quantum Circuits Beyond Moment Matching#1157483
• Noisy Quantum Query Complexity via Fractional Block Sensitivity#1155441
• Learning Random Quantum Circuits and the Emergence of Pseudorandomness#1144988
• On Quantum Randomness and Determinism#96483