How to Construct Random Unitaries
Abstract
The existence of pseudorandom unitaries (PRUs)—efficient quantum circuits that are computationally indistinguishable from Haar-random unitaries—has been a central open question, with significant implications for cryptography, complexity theory, and fundamental physics. In this work, we close this question by proving that PRUs exist, assuming that any quantum-secure one-way function exists. We establish this result for both (1) the standard notion of PRUs, which are secure against any efficient adversary that makes queries to the unitary , and (2) a stronger notion of PRUs, which are secure even against adversaries that can query both the unitary and its inverse . In the process, we prove that any algorithm that makes queries to a Haar-random unitary can be efficiently simulated on a quantum computer, up to inverse-exponential trace distance.
1 Introduction
This paper resolves the question: can efficient quantum circuits behave like truly random unitaries? Specifically, we prove that pseudorandom unitaries (PRUs) exist assuming the existence of any quantum-secure one-way function. First proposed by Ji, Liu, and Song in 2017 [ji2017pseudorandom], a PRU is the unitary analogue of a pseudorandom function (PRF) [goldreich1986construct]. A PRU consists of a family of efficiently computable quantum circuits with the guarantee that no polynomial-time quantum algorithm can distinguish between queries to a unitary sampled from the PRU family and a unitary sampled from the Haar measure.
Random unitaries play an essential role throughout quantum information science, arising in quantum algorithms, quantum supremacy experiments, quantum learning, cryptographic protocols, and much more [hayden2004randomizing, knill2008randomized, arute2019quantum, bouland2019complexity, huang2020predicting, ananth2022cryptography, huang2022provably, elben2022randomized, huang2022quantum, movassagh2023hardness, kretschmer2023quantum, lombardi2024one]. In physics, highly chaotic systems such as black holes are often modeled as Haar-random unitary transformations [cotler2017black, nahum2018operator, cotler2017chaos, kim2020ghost, choi2023preparing]. However, this approach has a fundamental problem: Haar-random unitaries are inherently unphysical, requiring exponential complexity to even specify. The notion of a PRU offers a tantalizing solution: efficient circuits that are as good as Haar-random. In fact, the idea that PRUs are a more accurate model of black hole dynamics is behind recent advances in fundamental physics [kim2020ghost, yang2023complexity, engelhardt2024cryptographic].
Despite considerable interest, the question of whether PRUs actually exist has remained open. In the past couple of years, a series of works has established that weaker notions are possible [lu2023quantum, brakerski2024real, haug2023pseudorandom, metger2024simple, ananth2024pseudorandom]. For example, [metger2024simple, chen2024efficient] constructed non-adaptive PRUs, which are secure against restricted adversaries that makes all of their queries at once in parallel. While these works represent important progress, the broader goal remains elusive, and constructing a PRU remains one of the central challenges in quantum cryptography.
1.1 Our results
In this work, we give the first proof that PRUs exist.
Theorem 1.
PRUs exist assuming the existence of any quantum-secure one-way function.
In fact, we go one step further. Theorem 1 is about PRUs that satisfy the original definition of [ji2018pseudorandom], which are secure against adversaries that can query an oracle for , but not the inverse unitary . We therefore define strong PRUs, which are indistinguishable from Haar-random even to adverasaries that can query both and . Our second main result builds strong PRUs from one-way functions.111The notion of strong PRUs is also discussed in [metger2024simple] as an open question.
Theorem 2.
Strong PRUs exist assuming the existence of any quantum-secure one-way function.
While Theorem 2 technically subsumes Theorem 1, the proof of Theorem 2 is significantly more involved. Since Theorem 1 may suffice for many applications, we present them separately. By establishing the existence of PRUs, our work provides the foundation for new avenues of research in quantum computation, cryptography, and fundamental physics.
1.2 Our techniques
We achieve our results on PRUs by proving that any quantum oracle algorithm that queries an -qubit Haar-random unitary can be efficiently simulated with a remarkably simple procedure:
-
1.
Initialize an external register to the state , where denotes the empty set. (Aside: When we write a set inside a ket, e.g., , we are simply using the set as a label for a unit vector. The inner product equals if and otherwise.)
-
2.
Run the oracle algorithm , replacing each query to with the following linear map:
(1.1) where denotes the set of all such that for some . In words, maps to a uniform superposition over , except those that already appear in , and simultaneously “records” by inserting it into . We refer to as the path-recording oracle.
We prove that the following mixed states have trace distance :
-
•
, the state of after queries to a Haar-random unitary , where denotes the state of the algorithm after queries to , and denotes an arbitrary initial state.
-
•
, where denotes the global state of the algorithm and the external register after queries to .
Despite the extensive literature on Haar-random unitaries, to the best of our knowledge, this “path-recording” characterization was not known before.222We note that [alagic2020efficient] proves that there exists a space-efficient (but otherwise inefficient) way to exactly simulate Haar-random unitaries. Moreover, their proof is non-constructive, i.e., they do not give a simulator.333This can also be viewed as an analog of Zhandry’s compressed oracles for Haar-random unitaries [zhandry2019record]. Furthermore, it is easy to show that can be efficiently implemented on a quantum computer; see LABEL:sec:efficient-implementation-pro. This establishes the following fact:
Any algorithm that queries a Haar-random unitary can be efficiently simulated
on a quantum computer up to inverse-exponential trace distance.
As we now explain, this new path-recording perspective is the key to our PRU proof.
How to construct PRUs.
The main technical step in our PRU proof is to show that a -query oracle algorithm can only distinguish between
-
•
, where for a random permutation , for a random function , and is a random -qubit Clifford.444This construction was introduced by [metger2024simple], who proved security against non-adaptive adversaries, i.e., adversaries that make all of their oracle queries at once, in parallel.
-
•
a Haar-random -qubit unitary ,
with probability .
Our proof works by purifying the randomness of the PRU. Ignoring for now, suppose we initialize an external register to the uniform superposition over all permutations and functions . In this view, a query to a random is equivalent to a query to a fixed unitary that applies controlled on , i.e., the map
| (1.2) |
Equivalently, we can view this map as sending to a superposition over all , while simultaneously multiplying the purifying register by the coefficient :
| (1.3) |
After queries to the purified , the global state including the purifying registers is (proportional to) a sum of terms
| (1.4) |
over all possible , i.e., over all Feynman paths.
Crucially, when all the are distinct, these states are orthogonal and is isometric to . Since the algorithm is not given the purifying registers, a query to a random is identical to a query to the path-recording oracle described earlier—except on paths where there is a collision among the inputs .
This is where comes in. We prove that satisfies a key property: for any -qubit unitary ,
| (1.5) |
This says that applying to the adversary’s register before each query to is equivalent to applying to each in the purifying register . When is sampled from any -design, the randomness of ensures there are no collisions in the with overwhelming probability. Consequently, we show that queries to are indistinguishable from queries to , as long as is sampled from any -design. By instantiating the -design to be either (1) a random Clifford or (2) a Haar-random unitary, we show that both and Haar-random unitaries are indistinguishable from , and thus, from each other.
Strong PRUs and a symmetrized path-recording oracle .
To obtain strong PRUs, we use the construction: , where are both random -qubit Cliffords, is the same as before, and is a random -ary phase (for any ). By analyzing the purification of , we show that when makes forward and inverse queries, the purifying registers, viewed in the right basis, “record” information from two Feynman paths: one set consists of tuples corresponding to the forward queries, and another set of tuples corresponds to the inverse queries. Whereas each query in the standard PRU proof always inserts a tuple into the set , when both forward and inverse queries are allowed, the effect is more intricate:
-
•
A forward query will sometimes add a tuple to , but other times delete a tuple from .
-
•
An inverse query will sometimes add a tuple to , but other times delete a tuple from .
We prove that this behavior corresponds to a more general “symmetrized” path recording oracle . Moreover, as long as are sampled from any -design, the adversary cannot distinguish between queries to and queries to , and using similar reasoning as the standard PRU proof, conclude both of the following (1) strong PRUs exist and (2) is indistinguishable from Haar-random even under inverse queries. As we show in LABEL:sec:efficient-implementation-pro, can also be implemented efficiently, and consequently any algorithm that makes forward and inverse queries to a Haar-random unitary can also be simulated to inverse exponential error.
Our proof leverages the following property of -designs: if one samples from a -design and applies to any state (where denotes the complex conjugate), then with overwhelmingly high probability, the result is either (a) a pair of distinct elements, or (b) the maximally entangled state. At a very high level, the fact that there are two kinds of outcomes after twirling by is related to how the purification “decides” whether it should add or delete a tuple .
We remark that the strong PRU proof is significantly more involved than standard PRU proof, and the reader may find it beneficial to start with the standard PRU proof.
A new approach to random unitaries.
More broadly, the path-recording oracle unlocks a new way to proving theorems about random unitaries. Before this work, analyzing mixed states such as often necessitated the use of Weingarten calculus, involving intricate asymptotic bounds on Weingarten functions through sophisticated combinatorial and representation-theoretic calculations. Our approach circumvents this complexity entirely.555Alternatively, one can view our technique as deriving a simplified and approximate version of the Weingarten calculus from purely elementary arguments.
We demonstrate the power of this approach by giving an elementary proof of the “gluing lemma” recently proven by [schuster2024random]. This lemma states that if two Haar-random unitaries and overlap, with acting on systems and on (where has a super-logarithmic number of qubits), then queries to are indistinguishable from queries to a larger Haar-random unitary acting on . Using this lemma (and our Theorem 1), [schuster2024random] constructed low-depth PRUs secure against forward queries. However, their proof of the gluing lemma is highly technical, relying on careful representation-theoretic analysis and tight bounds on Weingarten functions.
The path-recording oracle yields an elementary proof of the gluing lemma (see LABEL:part:app). The key insight is to replace the Haar-random unitaries with path-recording oracles. This reduces to showing that the composition of two independent path-recording oracles , where acts on and acts on , approximates a single path-recording oracle acting on .
Given the central role of random unitaries in physics and quantum computing, we expect the path-recording framework to have broad applications in the future.
1.3 Acknowledgments
Special thanks to John Wright for many helpful suggestions and extensive discussions at every stage of this project, and to Ewin Tang for providing significant feedback on the manuscript. We also thank Thiago Bergamaschi, John Bostanci, Adam Bouland, Chi-Fang (Anthony) Chen, Lijie Chen, Tudor Giurgica-Tiron, Jeongwan Haah, Jonas Haferkamp, William Kretschmer, Alex Lombardi, Tony Metger, Thomas Schuster, Joseph Slote, Xinyu (Norah) Tan, Umesh Vazirani, Henry Yuen, and Mark Zhandry for valuable discussions and feedback.
Fermi Ma is supported by the U.S. Department of Energy, Office of Science, National Quantum Information Science Research Centers, Quantum Systems Accelerator. Hsin-Yuan Huang acknowledges the visiting position at Center for Theoretical Physics, MIT. This work was conducted while both authors were at the Simons Institute for the Theory of Computing, supported by DOE QSA grant FP00010905.
2 Preliminaries
This section establishes basic notation, definitions, and lemmas that we use throughout the paper.
Notation.
We write , where typically denotes the number of qubits. We write to denote the set of integers from to , and we will identify with by associating each integer with the string corresponding to the binary representation of . For any integer , let denote the set of length- sequences of distinct integers from to , i.e.,
| (2.1) |
For , we adopt the convention that is a set with a single element denoting a length- sequence. For any permutation , let be a unitary that acts on as follows:
| (2.2) |
Quantum registers.
We use capital sans-serif letters to label quantum registers. For a register , the associated Hilbert space is denoted . When a quantum state is supported on multiple registers, such as , this means that . To clarify which systems a state is defined on, we sometimes include the register labels as subscripts in dark gray sans-serif font, e.g., . If a linear operator acts only on subsystem , we may write this as . Such an operator can be extended to a larger system by acting trivially on other registers; for example, . To reduce notational clutter, we often omit the “” and simply write . Similarly, when summing operators that act on different registers, such as and , we write to mean .
Given a projector acting on register , we say that a state is in the image of if . For a state , we similarly say that is in the image of if .
Given a state on systems , we denote the partial trace over system as . Occasionally, we will write this as , where the minus sign indicates tracing out all systems except .
2.1 Relations and variable-length registers
Fix a choice of . A relation is defined as a multiset of ordered pairs . This definition deviates slightly from the standard notion of a relation, which is typically an ordinary set of ordered pairs without repeated elements. The size of the relation refers to the number of ordered pairs in the relation, including multiplicities. We denote this by , as the size corresponds to the cardinality of as a multiset.
Definition 1.
Let denote the infinite set of all relations . For any , let denote the set of all size- relations.
Definition 2.
For a relation , we use to denote the set
| (2.3) |
and to denote the set
| (2.4) |
Note that while may be a multi-set, and are ordinary sets, i.e., they will not have repeated elements.
Each relation is associated with a relation state , defined as follows.
Notation 1 (Relation states).
For a relation , define the corresponding relation state to be the state
| (2.5) |
where denotes the number of times the tuple appears in .
An elementary counting argument yields the following result.
Fact 1.
For any relation , the state is a unit vector.
The relation states for can also be viewed as the standard basis for the symmetric subspace of . Note that this is only true because we allow for multi-set relations. Specifically, if denotes the projector onto the symmetric subspace of , we have the equality
| (2.6) |
However, we will typically use the following notation to refer to this projector.
Notation 2.
For any integer , we define
| (2.7) |
Notation 3 (Restricted sets of relations).
Define the following restricted sets of relations:
-
•
Let be the set of all injective relations, i.e., relations of size , where . Let .
-
•
Let be the set of all bijective relations, i.e., relations of size , where and . Let .
If the tuples in a relation are distinct, i.e., for , the normalization factor simplifies to , i.e.,
| (2.8) |
Note that any relation or satisfies this condition.
In both Parts I and II, we will consider linear maps that send superpositions of for to superpositions of for . This motivates the definition of variable-length registers.
2.1.1 Variable-length registers
For every integer let be a register associated with the Hilbert space . Let be a register corresponding to the infinite dimensional Hilbert space
| (2.9) |
When , the space is a one-dimensional Hilbert space. Thus, is spanned by the states where . Note that the relation states for span the symmetric subspace of .
We will sometimes divide up the register into where refers to the registers containing and refers to the registers containing . We denote as the register containing and as the register containing . Following our convention for defining the length/size of a relation , we say that a state has length/size . Two states of different lengths are orthogonal by definition, since is a direct sum .
Notation 4 (Extending fixed-length operators to variable-length).
For any operator defined on the fixed-size Hilbert space , we abuse notation by using to also refer to its extension on all of . The extended operator is the direct sum of and the operator on for all .
Hence, if two operators and act on and , respectively, then is the sum of their extensions over all of . We can now define the projector that projects onto the span of all relation states.
Notation 5.
We define the projector
| (2.10) |
that projects onto the span of all relation states for all .
Finally, we introduce the notion of variable-length tensor powers, which will be useful to describe applying an operator to each in a state , in settings where is not explicitly known.
Notation 6 (Variable-length tensor powers).
For any unitary , let
| (2.11) |
be a unitary that acts on the Hilbert space .
2.1.2 Pairs of variable-length registers
In Part II, we will consider states of the form , where and are both relation states, and is another variable-length register defined analogously to . Throughout Part II, we will use the following definitions.
Notation 7 (Fixed-length projectors).
For any integers , let denote the projector acting on that projects onto the fixed-length Hilbert space .
Notation 8 (Maximum-length projectors).
For any integer , let denote the projector acting on onto the Hilbert space .
Notation 9 (Length-restricted operators).
For any operator that acts on the variable-length registers and , let denote the restriction of to input states where registers and have lengths and . Let denote the restriction of to inputs states where the combined length of and is at most .
Note that, with this notation, does not necessarily equal . We adopt the convention that refers to .
2.2 The Haar measure, unitary -designs, and twirling channels
Definition 3 (Haar measure).
The Haar measure over the -qubit unitary group is the unique probability measure on that is:
-
1.
Left-invariant: For any measurable set and any , .
-
2.
Right-invariant: For any measurable set and any , .
-
3.
Normalized: .
The Haar measure provides a notion of uniform distribution over the unitary group.
We will refer to the Haar measure as .
Definition 4 (Unitary -design).
A distribution on -qubit unitaries is a unitary -design if
| (2.12) |
where is the Haar measure over the unitary group .
Notation 10.
Define the equality projector
| (2.13) |
In the following, when we write and without any specified distribution, we always refer to the uniform distribution over pure states and the Haar measure over unitary groups, respectively. We will use the following standard fact about Haar-random states and the symmetric subspace.
Fact 2.
The expectation over Haar measure satisfies
| (2.14) |
where is the projector onto the symmetric subspace of .
Claim 1 (Standard twirling).
For any -qubit unitary -design ,
| (2.15) |
Proof.
| (definition of ) | ||||
| ( is a -design) | ||||
| ( is a Haar-random state) | ||||
| (2) |
∎
From the above claim, we immediately obtain the following lemma, which was also also used by [metger2024simple] to construct non-adaptive PRUs.
Lemma 2.1 (Twirling into the distinct subspace).
Given two integers . Define the distinct subspace projector acting on qubits as follows,
| (2.16) |
For any -qubit unitary -design and any state on at least qubits, we have
| (2.17) |
Proof.
From the definition of the distinct subspace projector, we have
| (2.18) |
Because for any , there exists , such that , we have
| (2.19) |
where here denotes the PSD order and is the equality projector in Eq. (2.13) on the -th and -th -qubit register . This implies the following:
| (2.20) | ||||
| (2.21) | ||||
| (2.22) | ||||
| (2.23) | ||||
| (where ) | ||||
| (2.24) |
This completes the proof. ∎
The following claim will only be used in Part II.
Notation 11.
Let
| (2.25) |
Claim 2 (Mixed twirling).
For any -qubit unitary -design ,
| (2.26) |
Proof.
Label the registers that and act on as and respectively. For any operator acting on , define the partial transpose as
| (2.27) |
We will use the identity
| (2.28) |
Since ,
| (2.29) | |||
| (2.30) | |||
| (by Claim 1) | |||
| (2.31) | |||
| (2.32) | |||
| (2.33) | |||
| (2.34) | |||
| (2.35) | |||
| (2.36) |
This completes the proof. ∎
2.3 Oracle adversaries
We first define oracle adversaries that make only forward queries to an -qubit unitary oracle . This definition will be used exclusively in Part I.
Definition 5 (Oracle adversaries with forward queries, used in Part I).
A -query oracle adversary that makes only forward queries is parameterized by a sequence of -qubit unitaries , which act on registers , where is the -qubit query register and is an -qubit ancilla. We assume without loss of generality that the adversary’s initial state is . The state of the algorithm after queries to is
| (2.37) |
We also define an oracle adversary that can make both forward and inverse queries to an -qubit unitary oracle . This definition will be used exclusively in Part II.
Definition 6 (Oracle adversaries with forward and inverse queries, used in Part II).
A -query oracle adversary that makes both forward and inverse queries is parameterized by
-
•
a sequence of -qubit unitaries , which act on registers , where is the -qubit query register and is an -qubit ancilla, and
-
•
a sequence of bits where means that the adversary’s th oracle query is to , and means that query is to .
We assume without loss of generality that the adversary’s initial state is . The state of the algorithm after queries to is
| (2.38) |
2.4 Pseudorandom unitaries
Definition 7 (pseudorandom unitaries).
We say is a secure PRU if, for all , is a set of -qubit unitaries where denotes the keyspace, satisfying the following:
-
•
Efficient computation: There exists a -time quantum algorithm that implements the -qubit unitary for all .
-
•
Indistinguishability from Haar: For any oracle adversary that runs in time (the runtime is the total number of gates that uses, counting oracle gates as ), and measures a two-outcome observable with eigenvalues after the queries, we have
(2.39) where is any function that is for all .
A standard PRU (i.e., the original [ji2018pseudorandom] notion) is one where indistinguishability holds against oracle adversaries that only make forward queries to . A strong PRU is one where indistinguishability holds against oracle adversaries that make both forward and inverse queries to .
2.5 Useful lemmas
The following lemma will be used in Part I to bound the distance between a pair of mixed states who purifications are related by a projection that acts only on the purifying register.
Lemma 2.2.
Let be a density matrix on registers and let be a projector that acts on register . Then
| (2.40) |
Proof.
We can decompose as follows:
| (2.41) | ||||
| (2.42) |
where the second equality uses the fact that , which allows us to invoke the cyclic property of . Using Eq. 2.42, we have
| (2.43) | |||
| (2.44) | |||
| (since for PSD ) | |||
| (2.45) | |||
| (2.46) |
∎
We will use the following “sequential” gentle measurement lemma in Part II.
Lemma 2.3 (sequential gentle measurement).
Let be a normalized state, be projectors, and be unitaries.
| (2.47) |
To prove this, we will need the following version of the standard gentle measurement lemma.
Lemma 2.4 (gentle measurement).
For any projector and sub-normalized state satisfying , we have
| (2.48) |
Proof of Lemma 2.4.
By direct expansion, we have
| (2.49) |
∎
Proof of Lemma 2.3.
We prove this lemma by induction. For , we have . So the base case holds. Suppose the inductive hypothesis holds for , i.e.,
| (2.50) | ||||
| (2.51) | ||||
| (2.52) |
The second line uses the unitary invariance of . The third line uses the fact that is a projector and hence cannot increase the norm. We can use the unitary invariance of to obtain
| (2.53) |
Next we use Lemma 2.4 to obtain
| (2.54) |
Together, we have
| (2.55) | |||
| (2.56) | |||
| (2.57) |
This concludes the proof. ∎
Part I Standard PRUs
The goal of Part I is to construct standard PRUs (i.e., the definition of [ji2018pseudorandom]), which are secure against adversaries that only make forward queries to the unitary oracle.
3 The purified permutation-function oracle
In this section, we analyze the view of an adversary that makes forward queries to an oracle for , for uniformly random and . These operators are defined as
| (3.1) |
Our first step will be to consider a purification of the adversary’s state where the randomness of and is replaced by the uniform superposition
| (3.2) |
and each query is implemented by the purified permutation-function oracle , which applies controlled on .
Definition 8 (purified permutation-function oracle).
The purified permutation-function oracle is a unitary acting on registers , where
-
•
is a register associated with the Hilbert space , defined to be the span of the orthonormal states for all .
-
•
is a register associated with the Hilbert space , defined to be the span of the orthonormal states for all .
The unitary is defined to act as follows:
| (3.3) |
for all and .
When and are initialized to the uniform superposition over permutations and functions respectively, the view of an adversary that queries the is equivalent to the view of an adversary that queries the standard oracle , for uniformly random and .
Claim 3 (Equivalence of the purified and standard oracles).
For any oracle adversary , the following oracle instantiations are perfectly indistinguishable:
-
•
(Queries to a random ) Sample a uniformly random . On each query, apply to register .
-
•
(Queries to ) Initialize registers to . At each query, apply to registers .
Proof.
Since the adversary’s view does not contain the registers, the adversary’s view in the second case is unchanged if the registers are measured at the end. Since is controlled on the registers, the queries to commute with the measurement of the registers. Hence, measuring the registers at the end produces the same view as measuring at the beginning, which is equivalent to the first case. ∎
The key to understanding the oracle is to consider how it acts on the following “-relation states”, defined below.
Definition 9 (-relation state).
For and , let
| (3.4) |
where is an indicator variable that equals if for all , and is otherwise.
Note that for and , the -relation state is the uniform superposition over all permutations and all functions ,
| (3.5) |
3.1 Orthonormality of the -relation states
Claim 4 (Orthonormality of the distinct sets of -relation states).
forms a set of orthonormal vectors.
Proof of Claim 4.
We first recall the definition of :
| (3.6) |
For , let denote the -dimensional vector that has a in the -th position, and is everywhere else. Then by writing as , we get
| (3.7) | ||||
| (3.8) |
When are distinct, is a vector in whose -th entry is if , and otherwise. Since this is simply the indicator vector for the set , there exists an isometry that maps
| (3.9) |
Applying this to the register of , this tells us there is an isometry such that for all ,
| (3.10) |
Consider , where and .
| (3.11) | ||||
| (3.12) |
This expression is equal to zero if due to the term. Thus, it remains to consider such that . This means that and thus Eq. 3.12 simplifies to
| (3.13) |
There are two cases to consider:
-
•
In the first case, . Then there exists such that , , and . But then the above expression will be , since there are no permutations satisfying both and .
-
•
In the other case, . Then the sum is over all permutations such that for all . There are such permutations, and so in this case the sum becomes .
This completes the proof. ∎
3.2 How acts on the -relation states
Claim 5 (Action of on -relation states).
For , and ,
| (3.14) |
4 The path-recording oracle
In this section, we define the path-recording oracle. The path-recording oracle acts on an -qubit query register held by the adversary, as well as a variable-length relation containing a relation state (see Section 2.1). In section Section 4.3, we connect the path-recording oracle to the oracle. In LABEL:subsec:imp-forward-q, we sketch how to implement efficiently.
4.1 Defining
Definition 10 (Path-recording oracle).
The path-recording oracle is a linear map defined as follows. For all and such that ,
| (4.1) |
Note that since .
Lemma 4.1 (Partial isometry).
The path-recording oracle is an isometry on the subspace of spanned by the states for and such that .
Proof of Lemma 4.1.
To prove that is an isometry on the specified subspace, it suffices to show that for all and with ,
| (4.2) |
We proceed by considering two cases:
-
•
Case 1: . and are orthogonal because, by the definition of , these two states are supported on relation states of different sizes. Therefore, the left-hand side of Eq. 4.2 is zero, which equals the right-hand side, since for .
-
•
Case 2: for some . In this case, we expand the left-hand side:
(4.3) (4.4) Now, we consider two sub-cases:
-
–
Case 2a: . For , the term is always zero because either or . Therefore, Eq. (4.4) is equal to zero, which matches the right-hand side of the original equation.
-
–
Case 2b: . In this case, we have:
(4.5) (4.6) which again matches the right-hand side of the original equation.
-
–
This shows that Eq. 4.2 holds in all cases, completing the proof. ∎
Next, we define the state to be the state of the state of the entire system after the adversary has made queries to the path recording oracle, with the register initialized to , the state associated with the empty set.
Definition 11.
Given a -query adversary specified by a -tuple of unitaries , define the state
| (4.7) |
In fact, it will be useful to define a version of this state in which an arbitrary -qubit unitary is applied to the adversary’s query register before each query to .
Definition 12.
Given an -qubit unitary and a -query adversary specified by a -tuple of unitaries , define the state
| (4.8) |
One consequence of Lemma 4.1 is that has unit norm as long as .
Lemma 4.2 ( has unit norm).
For any adversary making forward queries, and any -qubit unitary , has unit norm.
Proof of Lemma 4.2.
We say that a state on registers is supported on if the state is contained in the span of for and any . We will prove by induction on that for all , is a unit-norm state supported on .
Base case (): . This state clearly has unit norm, and , so the claim holds for .
Inductive step: Assume the claim is true for some , i.e., is a unit-norm state supported on . We will prove that it must hold for . By definition, we have:
| (4.9) |
This state is unit norm because:
-
1.
is a unitary that acts only on the and registers, and so is still a unit-norm state supported on .
-
2.
By Lemma 4.1, is an isometry on states supported on . Moreover, the definition of , ensures that it maps states supported on to states supported on for . Thus, is a unit-norm state supported on .
Hence, for all , is a unit-norm state supported on . ∎
4.2 Right unitary invariance
Our next step is to prove that satisfies right unitary invariance: for any unitary , queries to are perfectly indistinguishable from queries to , from the point of view of the adversary who cannot access the purifying register . This is captured by the following lemma.
Lemma 4.3 (Right unitary invariance).
For any -qubit unitary , we have
| (4.10) |
Note that
| (by Lemma 4.3) | |||
| (by the cyclic property of ) |
where the first line corresponds to the adversary’s view after making queries to , and the last line corresponds to its view after making queries to .
Fact 3 (Explicit form).
From the definition of and , we can expand out to obtain
| (4.11) | ||||
| (4.12) |
Proof of Lemma 4.3.
Our proof will use the following trivial identities for registers and :
| (4.13) | ||||
| (4.14) |
For any -qubit unitary and , we have
| (4.15) |
Therefore, we have
| (Using Eq. (4.13)) | ||||
| (Using Eq. (4.15)) | ||||
| (4.16) | ||||
| (Using Eq. (4.14)) | ||||
| (Relabeling with ) |
Applying the above identity to registers to 3 yields
| (4.17) | ||||
| (4.18) | ||||
| (4.19) | ||||
| (4.20) | ||||
| (4.21) |
The last line follows from the fact that acts identically on all registers, so
| (4.22) |
This concludes the proof. ∎
Corollary 4.1 (Trace distance between original state and the projected state).
| (4.23) |
4.3 Relating to
We now connect the path-recording oracle to the oracle defined previously. We begin by defining the analog of .
Definition 13.
Given an -qubit unitary and a -query adversary specified by a -tuple of unitaries , define
| (4.25) |
Recall that
| (4.26) |
We can expand the definition of to obtain the following.
Fact 4 (Explicit form of ).
| (4.27) |
While the state is supported on an exponential number of qubits, we can compress the environment using the following linear operator . By Claim 4, is a partial isometry. Intuitively, “compresses” the state , which requires an exponential number of qubits , to , which is only as big as the size of the relation.
Definition 14.
Define to be
| (4.28) |
Next, we will use to relate the path-recording oracle to the purified permutation-function oracle. To do so, we will need to define the following projectors.
Definition 15 (Distinct subspace projector).
Given . Let
| (4.29) |
Definition 16 (Distinct subspace projector for -relation states).
Let
| (4.30) |
Lemma 4.4 (Relating and states).
For all -qubit unitaries ,
| (4.31) |
Proof.
Corollary 4.2 (Trace distance between original state and the projected state).
| (4.37) |
Proof.
By Lemma 2.2, we have
| (4.38) |
Next, observe that since
| (4.39) | |||
| (4.40) | |||
| (4.41) |
By plugging this identity into (4.38), we get
| (4.42) | ||||
| (4.43) | ||||
| (By Lemma 4.4) | ||||
| (By Corollary 4.1) |
which completes the proof. ∎
5 The PRU proof
5.1 Setup
We define a distribution over -qubit unitaries parameterized by any -qubit unitary -design .
Definition 17 ( distribution).
Let be a distribution supported on . The distribution is defined as follows:
-
1.
Sample a uniformly random permutation , a uniformly random , and a uniformly random -qubit unitary .
-
2.
Output the unitary .
The goal of this section is to prove the following theorem.
Theorem 3 ( is indistinguishable from Haar-random).
Let be a -query oracle adversary that only makes forward queries, and let be an exact unitary -design. Then
| (5.1) |
Since quantum-secure pseudorandom permutations and pseudorandom functions exist assuming one-way functions [zhandry2016note, zhandry2021construct], the existence of computationally-secure PRU follows immediately from Theorem 3.
Theorem 4.
If quantum-secure one-way functions exist, then pseudorandom unitaries exist.
The main technical component of the proof of Theorem 3 is the following lemma.
Lemma 5.1 ( is indistinguishable from ).
Let be a -query oracle adversary and let be an exact unitary -design. Then
| (5.2) |
Lemma 5.1 implies Theorem 3.
Lemma 5.1 implies Theorem 3 by the following argument. We can instantiate , i.e., outputs a Haar-random -qubit unitary. Then the output of is for random and Haar-random . By invariance of the Haar measure, this is exactly the same as outputting a Haar-random unitary. Thus, we have the following corollary of Lemma 5.1.
Theorem 5 ( is indistinguishable from Haar random).
Let be a -query oracle adversary. Then
| (5.3) |
Theorem 3 follows from combining Lemmas 5.1 and 5 using the triangle inequality. It remains to prove Lemma 5.1.
5.2 Proof of Lemma 5.1
Proof of Lemma 5.1.
We will use a hybrid argument. Define the mixed states
| (5.4) | ||||
| (5.5) | ||||
| (5.6) | ||||
| (5.7) | ||||
| (5.8) | ||||
| (5.9) |
We argue indistinguishability between each consecutive pair of mixed states:
-
•
by Claim 3.
-
•
by Corollary 4.2.
-
•
, since by Lemma 4.4, these are two mixed states whose purifications are related by the isometry, which only acts on the purifying register.
-
•
by Corollary 4.1.
-
•
since
(5.10) where the second equality follows from Lemma 4.3, which states that for any , and are related by a unitary on the purifying register.
Using the triangle inequality, we obtain Eq. 5.2, which completes the proof. ∎
Part II Strong PRUs
The goal of Part II is to construct strong PRUs, which are secure against adversaries that make both forward and inverse queries to the unitary oracle. It is important to note that several operators that were defined in Part I, including and , will be have new definitions in Part II.
6 The purified permutation-function oracle
In this section, we analyze the view of an adversary that makes queries to an oracle , for uniformly random and a random ternary function . We will do this by analyzing the purified permutation-function permutation oracle, which uses a purification of and .
Definition 18 (Purified permutation-function oracle).
The purified permutation-function oracle is a unitary acting on registers , where
-
•
is a register associated with the Hilbert space , defined to be the span of the orthonormal states for all .
-
•
is a register associated with the Hilbert space , defined to be the span of the orthonormal states for all .
The unitary is defined to act as follows:
| (6.1) | ||||
| (6.2) |
for all and . Here, .
The action of is
| (6.3) |
The view of an adversary that queries the purified oracle is equivalent to the view of an adversary that queries the standard oracle , for uniformly random and .
Claim 6 (Equivalence of purified and standard oracles).
For any oracle adversary , the following oracle instantiations are perfectly indistinguishable:
-
•
(Queries to a random ) Sample a uniformly random . On each query, apply to register .
-
•
(Queries to ) Initialize registers to . At each query, apply to registers .
Next, we define the following states on the registers.
Definition 19 (-relation state).
For and , where and are non-negative integers such that , let
| (6.4) |
where is an indicator variable that equals if for all , and is otherwise.
Note that when , i.e., are both the empty relation, the -relation state is the uniform superposition over all permutations and all ternary functions ,
| (6.5) |
Recall that a relation is bijective if and only if . Equivalently, writing , is bijective if are all distinct, and are also all distinct.
Definition 20.
Let be the set of all ordered pairs of relations where is a bijective relation.
6.1 Orthonormality of the -relation states
Claim 7 (Orthonormality of -relation states).
is an orthonormal set of vectors.
Proof of Claim 7.
For , let denote the -dimensional vector that has a in the -th position, and is everywhere else. Then by writing as , we get
| (6.6) | |||
| (6.7) | |||
| (6.8) |
where denotes the -ary quantum Fourier transform. When are all distinct, there is a bijection between and the sets : the first set corresponds to the indices where the vector is , and the second set is the indices where the vector is . Thus, there is an isometry that maps
| (6.9) |
whenever are all distinct. Thus, for any , where is a bijective relation, applying this isometry to the register of yields
| (6.10) |
Next, we can apply an isometry that, controlled on , sends each to the tuple . The result is
| (6.11) |
Finally, controlled on the last two registers, we can uncompute the superposition on the register. The result is
| (6.12) |
This completes the proof. ∎
Definition 21.
Define the partial isometry to be
| (6.13) |
Here, and are variable-length registers as defined in Section 2.1. Note that is a partial isometry by Claim 7.
6.2 How acts on the -relation states
Claim 8 (Action of ).
For any and such that , we have
| (6.14) |
Similarly, for any and such that , we have
| (6.15) |
Proof of Claim 8.
Recall that
| (6.16) |
Let us write and . Then
| (6.17) |
Thus, we have
| (6.18) | |||
| (6.19) |
In this sum, has a coefficient of whenever , since in that case the constraints that and are impossible to satisfy since , and thus satisfying both constraints would require to have two different preimages under the permutation . We can therefore rewrite the above sum as
| (6.20) | |||
| (6.21) | |||
| (6.22) |
This completes the proof of Eq. 6.14. Since applies the map
| (6.23) |
the proof for Eq. 6.15 follows by a symmetric argument. ∎
7 The partial path-recording oracle
In the previous section, we proved Claim 8, which partially characterizes how the unitaries and act in terms of states . We also proved that there exists an isometry that maps to for all pairs of relations such that their union is a bijective relation. In this section, we will define a linear operator that we call the partial path recording oracle. This operator, up to isometry, implements a restricted version of the operator. In particular, we have the following.
-
•
On states of the form such that is a bijection and , the linear map performs exactly the same map as (up to isometry).
-
•
On states of the form such that is a bijection and , the linear map performs exactly the same map as (up to isometry).
In the above, “up to isometry” refers to the isometry that maps to . Formally, the registers and are both variable-length registers that store the two relations and . We refer the reader to Sections 2.1.1 and 2.1 in the Preliminaries section for our definitions of variable-length registers, relations, and relation states.
The role of the operator in our proof.
Looking ahead to our main proof, we will show that if are sampled from any -qubit -design, then an adversary (making both forward and inverse queries) cannot distinguish between an oracle that implements and an oracle that implements , except with negligible advantage. Thus, even though only behaves like (a compressed version of) on a restricted subspace, we will show that the twirling of prevents the adversary from detecting the difference.
In the next section, we will show that the operator can also be seen as a restricted version of another linear operator that we call the path-recording oracle. The connection between and plays a crucial role in our proof; see Section 8 for further discussion.
7.1 Defining and
Before we define , we will first define helper operators and . The operator is defined to capture the (partial) characterization of given in Eq. 6.14, while is defined to capture the (partial) characterization of given in Eq. 6.15.
Definition 22 ( and ).
Define to be the linear map such that for any and such that ,
| (7.1) |
Similarly, define be the linear map such that for any and such that ,
| (7.2) |
It is useful to define the following projectors to describe the actions of .
Definition 23 (Bijective-relation projectors).
By the definition of and , we have the following fact about the action of and on states with a bounded length.
Fact 5.
For any integer , map states in the subspace associated to the projector into the subspace associated with the projector .
The following property follows from the relation between and .
Claim 9.
and are both partial isometries.
Proof.
Since is a unitary operator, the operator obtained by restricting the domain of to the span of the states is a partial isometry. Up to relabeling as (i.e., applying the partial isometry ), this is . Similarly, is a unitary, and the operator obtained by restricting to the span of states is a partial isometry. Up to relabeling as , this is . ∎
Notation 12.
For a partial isometry , let and denote its domain and image. Let and denote the orthogonal projectors onto and .
Claim 10.
For all integers , commutes with , , , and .
Proof.
It will be useful to state the connection between the , and more formally.
Fact 6.
We have
| (7.4) | ||||
| (7.5) |
7.2 Defining
We now use and to define the partial path-recording oracle .
Definition 24.
The partial path-recording oracle is the operator defined as
| (7.6) |
From 5, we immediately obtain the following fact.
Fact 7.
, are subspaces of the image of . Moreover, for any integer , and map states in the subspace associated to the projector into the subspace associated with the projector .
Claim 11.
is a partial isometry.
Proof of Claim 11.
Since and (and hence ) are partial isometries, the operator is a partial isometry as long as both of the following are true:
-
•
The subspaces and are orthogonal, i.e., is a sum of two partial isometries with orthogonal domains.
-
•
The subspaces and are orthogonal, i.e., is a sum of two partial isometries with orthogonal images.
and are orthogonal because is only supported on states where , while is only supported on states where (this can be seen by inspecting the right-hand-side of Eq. 7.2). A symmetric argument shows that and are also orthogonal, which completes the proof. ∎
In fact, our proof of Claim 11 establishes the following relationship between the domain and image of and the domain and image of and .
Fact 8.
The domain and image of are given by
| (7.7) | ||||
| (7.8) |
Claim 12.
For all integers , commutes with and .
Proof.
This follows immediately from Claim 10, which states that the projector commutes with the projectors , , , . ∎
Corollary 7.1.
For all integers , the image of is a subspace of the image of . Similarly, the image of is a subspace of the image of .
Using 8, we can now establish the following relationship between and .
Claim 13 ( is a restriction of up to isometry).
We have
| (7.9) | ||||
| (7.10) |
In words, Claim 13 says that for any state in , the domain of , the action of is the same as up to isometry. Additionally, it says that for any state in the image in , the image of , the action of is the same as up to isometry.
8 The path-recording oracle
In the previous section, we defined a linear operator and showed that acts as a restricted version of , up to an application of the isometry. In this section, we will introduce a second linear operator , which will satisfy a number of key properties that will be crucial for our proof. We will show that satisfies the following properties:
-
•
is indistinguishable from under twirling, i.e., for sampled from any -qubit unitary -design , an adversary making forward and inverse queries cannot distinguish between queries to and queries to .
-
•
satisfies approximate unitary invariance, which we will use to conclude the following: an adversary making forward and inverse queries cannot distinguish between queries to for sampled from any -qubit unitary -design , and plain queries to .666For technical reasons, our main proof will handle both of these bullets in one argument.
We will refer to as the path-recording oracle. We remark that this definition of is different from the one given in Part I, as this will need to be designed to handle forward and inverse queries. In LABEL:subsec:imp-forward-inverse-q we describe how to implement efficiently.
8.1 Defining and
To define , we first introduce helper operators and .
Definition 25 (left and right partial isometries).
Let be the linear operator that acts as follows. For and ,
| (8.1) |
Define to be the linear operator such that for all and ,
| (8.2) |
By construction, and take states in to .
Why these definitions of and ?
On states of the form within the domain of , the operators and act in the same way. However, the domain of is limited to states where forms a bijection and (which also implies that ). On the other hand, the definition of extends so that it acts on all satisfying . In particular, we have dropped the requirement that is a bijection and that . An analogous relationship holds between and . We define these extended operators, and , to establish a property known as (approximate) unitary invariance (see Claim 23). Importantly, this property holds only for the extended operators and , and not for the original and operators.
Claim 14.
and are partial isometries.
Proof.
We will give the proof for ; the proof for follows by a symmetric argument. is a partial isometry if and only if is the orthogonal projector onto . From the definition of , we can see that its domain is
| (8.3) |
It suffices to show that for all , and and that
| (8.4) |
We can expand out the LHS as
| (8.5) |
The summand is zero unless , , and . Combining the first two constraints, we have . Since does not appear in either or , this implies and . This means that the sum is unless , and . When these constraints are satisfied, the sum becomes . This completes the proof that is a partial isometry. ∎
8.2 Defining
Definition 26.
The path-recording oracle is the operator defined as
| (8.6) |
By construction, and take states in to for any integer .
Why this definition of ?
Recall that since we defined , it might seem natural to define . However, if we defined this way, it would not be a partial isometry. As we showed in the proof of Claim 11, is a partial isometry because and do not “overlap”, i.e., they are partial isometries with orthogonal domains and orthogonal images . On the other hand, this is not true for and . Thus, in order to ensure that is a partial isometry, we need to “project out” the overlap between and .
Claim 15.
is a partial isometry.
Proof.
We will first show that is a partial isometry. This is true if and only if is a projector. To show that this operator is a projector, it suffices to show that and commute. From the definition of , its domain is the image of the projector . Since takes states in to (for ), it follows that takes states in to (for ). In particular, this means it commutes with . Using a symmetric argument, we can conclude that is also a partial isometry.
Now, we just need to show that the sum of these two partial isometries is a partial isometry. It suffices to show that their domains are orthogonal and their images are orthogonal. To see that their domains are orthogonal, note that the domain of is a subspace of , while the domain of is a subspace of , and hence they are orthogonal. A symmetric argument shows their images are orthogonal. This completes the proof. ∎
being a partial isometry implies that any state generated by an adversary that queries and will have a norm at most . This is an important property that will be central to our strong PRU proof. Recall that in the standard PRU proof of Part I, the path-recording oracle acts as an isometry on all states that can be generated by querying the path-recording oracle. This first property of being a partial isometry is a relaxation of the isometric property of the standard path-recording oracle. While is a partial isometry, we will later show that the state generated by an adversary that queries and will have a norm close to one for subexponential number of queries.
8.3 Two-sided unitary invariance
The path-recording oracle satisfies an (approximate) two-sided unitary invariance property, which we state below.
Definition 27.
For any -qubit unitary , define
| (8.7) |
Claim 16 (two-sided unitary invariance).
For any integer and any pair of -qubit unitaries ,
| (8.8) | ||||
| (8.9) |
Claim 16 is proven in Section 10. The two-sided unitary invariance of allows us to move the random unitaries and acting on system register to the purifying registers .
8.4 is a restriction of
We now show that is a restriction of . First, we need the following basic facts relating , and that follow immediately from the definitions of these operators.
Fact 9.
We have
-
•
is a restriction of and is a restriction of :
(8.10) (8.11) -
•
The image of is in the kernel of , and the image of is in the kernel of , i.e.,
(8.12)
Lemma 8.1.
If and are projectors, and then is a subspace of .
Proof.
Consider any normalized state , i.e., . We have the following identity,
| (8.13) |
Because is a projector and , we have . ∎
Lemma 8.2.
Consider any partial isometries . If , then is a subspace of . And if , then is a subspace of .
Proof.
Corollary 8.1.
is a subspace of . And is a subspace of .
Claim 17 ( is a restriction of ).
We have
| (8.16) | ||||
| (8.17) |
In words, Claim 17 says that for any state in , the domain of , the action of is the same as . Additionally, it says that for any state in the image in , the image of , the action of is the same as .
Proof of Claim 17.
To prove Eq. 8.16, it suffices to show that
| (8.18) | ||||
| (8.19) |
This is because summing these two equations gives
| (8.20) |
and plugging in from Eq. 7.7 and yields Eq. 8.16. It remains to prove Eqs. 8.18 and 8.19.
- •
-
•
Proof of Eq. 8.19. By the definition of ,
(8.23) Since is a subspace of by Corollary 8.1, we have . Next, we have by Eq. 8.11. Thus, we have
(8.24) (8.25) (8.26) where the last equality uses the fact that from Eq. 8.12.
This completes the proof of Eq. 8.16. The proof of Eq. 8.17 follows by a symmetric argument. ∎
Corollary 8.2.
is a subspace of . And is a subspace of .
Corollary 8.3.
We have
| (8.27) | ||||
| (8.28) |
Proof.
From , we can multiply on the left of both sides to obtain
| (8.29) |
Using , we have
| (8.30) |
since is a subspace of from Corollary 8.2. Taking dagger yields .
From , we can multiply on the left of both sides to obtain
| (8.31) |
Using , we have
| (8.32) |
since is a subspace of from Corollary 8.2. Taking dagger yields . ∎
9 The strong PRU proof
9.1 Setup
We define a distribution over -qubit unitaries parameterized by any -qubit unitary -design .
Definition 28 ( distribution).
For any distribution supported on , define the distribution as follows:
-
1.
Sample a uniformly random permutation , a uniformly random , and two independently sampled -qubit unitaries . Following the definitions in Section 6,
(9.1) -
2.
Output the -qubit unitary .
The goal of this section is to prove the following theorem.
Theorem 6 ( is a statistical strong PRU).
Let be a -query oracle adversary that can perform forward and inverse queries and let be an exact unitary -design. Then
| (9.2) |
Since quantum-secure pseudorandom permutations and pseudorandom functions exist assuming one-way functions by [zhandry2016note, zhandry2021construct], the existence of computationally-secure strong PRUs follows immediately from Theorem 6.
Theorem 7.
If quantum-secure one-way functions exist, then strong pseudorandom unitaries exist.
The main technical component of the proof of Theorem 6 is Lemma 9.1, which relates the PRU adversary to an adversary that queries the path-recording oracle , defined previously in Section 8. Recall that is a partial isometry that acts on registers , where and are variable-length registers. Initially, and are both initialized to the length- state . To state Lemma 9.1, we will need the following definition.
Definition 29 (the global state after queries to ).
For a -query oracle adversary that can perform forward and inverse queries and any , let
| (9.3) |
denote the global state on registers after makes queries to .
Lemma 9.1 ( is indistinguishable from ).
Let be any exact unitary -design. For any -query oracle adversary ,
| (9.4) |
Lemma 9.1 implies Theorem 6.
Lemma 9.1 implies Theorem 6 by the following argument. We can instantiate , i.e., outputs a Haar-random -qubit unitary. Then the output of is for random and Haar-random and . By invariance of the Haar measure, this is exactly the same as outputting a Haar-random unitary. Thus, we have the following corollary of Lemma 9.1.
Theorem 8 ( is indistinguishable from a Haar-random unitary).
Let be a -query oracle adversary that can perform forward and inverse queries. Then
| (9.5) |
Theorem 6 follows from combining Lemmas 9.1 and 8 using the triangle inequality. The remainder of this section is devoted to proving Lemma 9.1.
9.2 is indistinguishable from twirled
Our first step towards proving Lemma 9.1 is to prove that an oracle adversary that makes both forward and inverse queries cannot distinguish whether its query is implemented by the path-recording oracle (Definition 26), or as where are sampled from a -design, and is the partial path-recording oracle (Definition 24).
We will require the following definitions. Let and be a pair of registers that each contain the description of an -qubit unitary. These registers will be part of the purification and will not be in the adversary’s view.
Definition 30.
For any distribution over -qubit unitaries, define the state
| (9.6) |
where is the probability measure for which is sampled from .
Recall from Definition 27 that for any pair of -qubit unitaries , the operator is defined as
| (9.7) |
Definition 31 (Controlled and ).
Define the following operators
| (9.8) | |||
| (9.9) |
We now state a key lemma that we will need for our proof.
Lemma 9.2 (Twirling).
For any unitary -design , and any integer , we have
| (9.10) | ||||
| (9.11) |
Note that in the statement of Lemma 9.2, is shorthand for , and thus the operators inside the act on . We prove Lemma 9.2 in Section 11.
Next, we define the following adversary states.
Definition 32 (Twirled- purification).
Define the states as follows:
| (9.12) | ||||
| (9.13) |
For contrast, let us recall the definition of .
Definition 33 ( purification).
Define the states for as follows:
| (9.14) | ||||
| (9.15) |
Note that because , in the construction of these purified states, one either queries , for or , for . Because and are partial isometries from Claim 11 and Claim 15, are all equal to applying a projector followed by a unitary. Hence, , are both states with norm at most .
Fact 10 (Norm of the purified states).
For any , , both have norm at most .
Furthermore, from Definition 26, and take states in the subspace associated with the projector to the the subspace associated with the projector . Hence, after queries in total to and , we have is in the image of . Similarly, from 7, and map states in to . Hence, after queries to and , we have is in the image of . We collect these two basic properties in 11.
Fact 11 (Spaces that the purified states are in).
For any , we have the following guarantees:
-
•
is in the image of .
-
•
is in the image of .
The main technical claim of this subsection is the following.
Claim 18.
For any integer ,
| (9.16) |
Proof of Claim 18.
We prove this claim by induction. When , we have
| (9.17) | ||||
| (9.18) | ||||
| (9.19) |
where the first equality is by the definition of (Definition 33), the second is because acts as identity on , and the third equality is the definition of (Definition 32). This implies that
| (9.20) |
so the base case holds.
For the inductive step, assume that
| (9.21) |
for some integer . We will prove that the claim holds for . To simplify notation, let us assume that the adversary makes a forward query at step , i.e., ; this is without loss of generality because the argument is symmetric if the adversary makes an inverse query at step . We have
| (9.22) | ||||
| (9.23) |
and thus
| (9.24) | |||
| (9.25) |
By 11, the states and are both in the image of . Following 9, we write and . We can then rewrite (9.25) as
| (9.26) |
Next, we will write as
| (9.27) |
This allows us to rewrite (9.26) as
| (9.28) |
We can lower bound the second term in the sum as follows. We know that and have at most unit norm by 10 and the fact that all have operator norm at most (since and is a partial isometry by Claim 11). Then by Claim 16, the second term can be lower bounded by
| (9.29) | |||
| (9.30) | |||
| (9.31) | |||
| (by Claim 16) |
Combining this bound with the sequence of equalities , we get
| (9.32) | |||
| (9.33) |
Next we can use properties of the and operators to rewrite
| (9.34) | ||||
| (9.35) | ||||
| (by Corollary 8.3) | ||||
| (9.36) | ||||
| (Definition 23 and Claim 12) |
Plugging this into , we get
| (9.37) | ||||
| (9.38) |
Bounding .
Bounding .
We will lower bound by upper bounding :
| (9.41) | ||||
| (9.42) | ||||
| (9.43) | ||||
| (9.44) | ||||
| (9.45) |
where:
-
•
the first inequality uses the fact that ,
-
•
the second inequality holds because and both have at most unit norm,
-
•
the third line uses the fact that
(9.46) and the fact that , since is a projector.777By 7, is a projector. By Claim 12, commutes with and by Claim 12, commutes with by Definition 23. Recall the fact that if and are projectors such that , then is a projector. Thus, since , we have that is a projector.
-
•
the fourth line follows from the definitions of (Definitions 30 and 31),
-
•
and the last line follows from Lemma 9.2.
Note that in the fourth line, we can drop the register since the operator inside the acts as identity on . Putting everything together, we have
| (9.47) | ||||
| (9.48) | ||||
| (9.49) | ||||
| (9.50) | ||||
| (9.51) |
which establishes the claim for . This concludes the proof. ∎
Lemma 9.3.
For any and any unitary -design , we have
| (9.52) |
9.3 Twirled and twirled are indistinguishable
Let and denote the uniform superposition over all permutations and functions, respectively. We define the follow state obtained by querying twirled .
Definition 34 (Twirled purification).
Let
| (9.60) |
For , define
| (9.61) |
To connect twirled and twirled , we need to define the following projections.
Definition 35.
Define the projectors
| (9.62) | ||||
| (9.63) |
We define the following state obtained by querying twirled , but depending on whether forward or inverse query (determined by ) is made, we will add a projector.
Definition 36 (Twirled projected purification).
Let . For , define
| (9.64) |
Claim 19.
For all integers ,
| (9.65) |
Proof.
We prove this using induction. The base case follows from the fact that
| (9.66) |
If for , then we have
| (9.67) | |||
| (9.68) | |||
| (Using Claim 13) | |||
| (9.69) | |||
| (inductive hypothesis) | |||
| (9.70) |
This concludes the proof. ∎
Lemma 9.4 (Norm bound).
For any and any unitary -design , we have
| (9.71) |
Proof.
Lemma 9.5.
For all integers ,
| (9.75) |
Proof.
Because acts on registers and maps to , we have
| (9.76) |
Because is an isometry, has norm . Furthermore, from Claim 19, because is an isometry, we have
| (9.77) |
Together, we can obtain the following,
| (9.78) | |||
| (9.79) | |||
| (9.80) | |||
| ( if ) | |||
| (Lemma 2.3 on sequential gentle measurement) | |||
| (Claim 19) | |||
| (Lemma 9.4) |
This concludes the proof. ∎
9.4 Proof of Lemma 9.1
10 Proof of Claim 16
In this section, we prove Claim 16, which states that the symmetric path recording oracle is approximately unitary invariant. For convenience, we restate the lemma below:
Lemma 10.1 (Claim 16, restated).
For any , and any pair of -qubit unitaries , we have
| (10.1) | ||||
| (10.2) |
To prove this lemma, we will define a pair of operators and that satisfy exact unitary invariance. We will then prove that is close in operator norm to , and that is close in operator norm to . By combining these guarantees, we will show that and satisfy approximate unitary invariance, which we will use to prove that satisfies approximate unitary invariance.
10.1 Defining and
Definition 37.
Define the operator and that act on registers as follows:
| (10.3) | |||
| (10.4) |
We will show that and satisfies the following unitary invariance property. To state the property, recall that we define the operator as follows:
Definition 38 (Definition 27, restated).
For any pair of -qubit unitaries , define
| (10.5) |
Claim 20 (Exact unitary invariance of and ).
For any pair of qubit unitaries , we have
| (10.6) | ||||
| (10.7) |
To prove Claim 20, it will be useful to have the following alternative expressions for and .
Claim 21 (Alternative form of and ).
The operator can also be written as
| (10.8) | ||||
| (10.9) |
Here denotes the projector onto the span of length- states , and is the linear operator that maps
| (10.10) |
Proof.
We will prove the statement for , and the proof for will be symmetric. To establish , we need to prove that for all and ,
| (10.11) |
Since (5), we can write the right-hand side of Eq. 10.11 as
| (10.12) | |||
| (10.13) |
Therefore, we need to prove that for all and that
| (10.14) |
To see this, note that is a superposition over all permutations of the elements of , and thus when we right multiply by , the resulting state is proportional to . To compute the proportionality constant, note that a
| (10.15) |
fraction of the permutations of the elements of will have in the left-most slot. Thus,
| (10.16) |
which gives Eq. 10.14 when we multiply by . ∎
10.2 Approximate unitary invariance of and
We now prove approximate unitary invariance of the operators and . The key step is the following lemma, which relates these operators to and .
Recall that for an operator acting on registers , the notation refers to the restriction of the operator to states where the combined length of the and components is at most .
Claim 22.
For any positive integer ,
| (10.25) |
Proof.
We will only prove this for , as the proof for is analogous. Let be an arbitrary unit-norm state in the image of . In particular,
| (10.26) |
where is zero whenever . It suffices to show that for any such ,
| (10.27) |
Expanding out , we get
| (10.28) |
Expanding out , we get
| (10.29) |
Then we have
| (10.30) | |||
| (10.31) | |||
| (10.32) |
Note that and are orthogonal, since is a superposition of states where is in exactly once, while is a superposition of states where is in at least twice. Thus,
| (10.33) |
Bounding .
By changing the order of summation, we can rewrite as
| (10.34) |
and thus
| (10.35) | ||||
| (10.36) |
where the last inequality is by Cauchy-Schwarz. We can bound the summand by writing
| (10.37) | ||||
| (since when ) | ||||
| (10.38) | ||||
| (10.39) |
where the last inequality uses the fact that for any fixed , there are at most choices of that can satisfy . Thus,
| (10.40) | ||||
| (10.41) | ||||
| (10.42) |
Bounding .
By changing the order of summation, we can rewrite as
| (10.43) |
Thus,
| (10.44) | ||||
| (by Cauchy-Schwarz) | ||||
| (10.45) |
where we have used the fact that for any , we have the upper bound
| (10.46) |
since each tuple in increases the value of by for at most one . Thus,
| (10.47) | ||||
| (10.48) |
Putting everything together, we have that for all in the image of ,
| (10.49) |
since and . This completes the claim. ∎
Claim 23.
For any positive integer , and any pair of -qubit unitaries , we have
| (10.50) | ||||
| (10.51) |
Proof.
Note that with our convention that , the operator is not the same as . However, since our and operators map to , we have the following identities,
| (10.54) | ||||
| (10.55) |
As a consequence, Eq. 10.51 also holds for the “mis-parenthesized” version. In particular, for any positive integer and any , we have
| (10.56) |
To prove the approximate unitary invariance of , we need to utilize the following basic lemma.
Lemma 10.2.
Given any operators with operator norm bounded above by one, we have
| (10.57) |
Proof.
We can prove this lemma via triangle inequality,
| (10.58) | ||||
| (10.59) | ||||
| (10.60) |
This completes the proof. ∎
We start by proving the approximate unitary invariance for the projectors and .
Claim 24.
For any positive integer , and any pair of -qubit unitaries , we have
| (10.61) | ||||
| (10.62) |
Proof.
By the definition of , we have . We have
| (10.63) | |||
| (10.64) | |||
| (by Lemma 10.2) | |||
| (by Claim 23) |
The statement for can be proven similarly. This concludes the proof of this claim. ∎
We can now prove approximate invariance of (Claim 16). By unitary invariance of we can restate lemma Claim 16 as follows.
Lemma 10.3 (Claim 16, restated).
For any positive integer , and any pair of -qubit unitaries , we have
| (10.65) | ||||
| (10.66) |
Proof.
We will prove the first inequality, as the second follows from a symmetric argument. From the definition of , we have
| (10.67) |
From the definitions of , , and , we note that
| (10.68) | ||||
| (10.69) |
Using this fact and the definition of , we can apply the triangle inequality to obtain,
| (10.70) | |||
| (10.71) | |||
| (10.72) | |||
| (10.73) | |||
| (10.74) |
We now bound each of the four terms. The first term Eq. 10.71 is bounded above by from Eq. 10.50. The third term Eq. 10.73 is also bounded above by from Eq. 10.56. The second and fourth terms Eq. 10.72, Eq. 10.74 require the use of Lemma 10.2. Hence, we can bound the second term Eq. 10.72 as follows,
| (10.75) | |||
| (10.76) | |||
| (10.77) | |||
| (10.78) | |||
| (10.79) |
where we used the fact that Eq. 10.77 is bounded above by from Eq. 10.50 and Eq. 10.78 is bounded above by from Eq. 10.62. Similarly, we can bound the fourth term given Eq. 10.74 using the same argument to obtain
| (10.80) |
Combining the bounds on the four terms, we obtain
| (10.81) |
This completes the proof of the approximate unitary invariance of . ∎
11 Proof of Lemma 9.2
In this section, we prove Lemma 9.2. For convenience, we restate the lemma below.
Lemma 11.1 (Lemma 9.2, restated).
For any unitary -design and integer , we have
| (11.1) | ||||
| (11.2) |
In the above expressions, is shorthand for , and thus the operators inside the act on .
11.1 The domain and image of
In order to prove Lemma 11.1, we will first need to give an explicit characterization of the projectors and .
Definition 39.
Let
| (11.3) | ||||
| (11.4) |
Definition 40.
Let
| (11.5) |
Notation 13.
We use the notation for the projector on registers that applies to the registers , (where ), and acts as identity on the rest of . The same notation applies for .
Fact 12.
The projectors and commute, and moreover
| (11.6) |
Claim 25.
| (11.7) | ||||
| (11.8) |
Proof of Eq. 11.10.
From the definition of , its domain is the image of the projector
| (11.12) | ||||
| (11.13) | ||||
| (11.14) |
Proof of Eq. 11.11.
We can expand out
| (11.15) | ||||
| (11.16) |
where the second equality uses the fact that the domain of is contained in the image of the projector , i.e., is only defined on states where the and registers have sizes where . Thus, it suffices to prove that for all such that that
| (11.17) |
where we use our notational convention that for an operator acting on a variable-length registers , the operator is the restriction of to states where the register is length and