On the Power of Quantum Distributed Proofs

Quantum distributed computing is the quantum analog of distributed computing where parties are quantum computers and communication in a network is done via qubits. A few early works initiated the study of quantum distributed computing [BOH05, TKM12, GKM09, EKNP14]. See also [BT08, DP08, AF14] for general discussions.

Recently, the quantum distributed computing model has been intensively studied to identify quantum advantages in the number of rounds and the amount of communication in distributed computing. The major models in classical distributed computing have been explored since the seminal work by Le Gall and Magniez [GM18]; $\mathsf{CONGEST}$ model [GM18, IGM20, MN22, CHFG⁺22, vAdV22, WY22], $\mathsf{CONGEST}$-$\mathsf{CLIQUE}$ model [IG19] and $\mathsf{LOCAL}$ model [GNR19, GR22, CRdG⁺23].

For both theoretical and application reasons, on distributed networks, it is quite important to efficiently verify some global properties of the network with local (i.e., constant-round) communication. The most widely accepted and studied criteria for distributed verification is as follows [Fra10]:

• •

  (completeness) For a yes-instance, all the nodes must accept.

• •

  (soundness) For a no-instance, at least one node must reject.

Intuitively, if the global property of the graph is appropriate, all the nodes are satisfied, and otherwise, at least one node raises an alarm to all the other nodes.

On the other hand, many properties cannot be checked with such local communication, and usually require many rounds on the networks. A possible extension is to give information to the nodes on the network. Such a scheme was introduced as proof-labelling schemes [KKP10] and locally checkable proofs [GS16], which are considered distributed $\mathsf{NP}$ protocols. More recently, randomized proof-labeling schemes were introduced [FPSP19], and these protocols are considered as distributed Merlin-Arthur ($\mathsf{dMA}$) protocols. In a $\mathsf{dMA}$ protocol, an untrusted prover sends a classical proof to all the nodes on a network. Based on their part of the proof, each node, who can use a randomized algorithm, on the network simultaneously sends messages to its neighbors and receives messages from its neighbors in constantly many rounds. Finally each node outputs accept or reject in a probabilistic manner so that completeness is high, i.e., the completeness condition holds with probability at least, say, $\frac{2}{3}$ (completeness $\frac{2}{3}$) and soundness error is low, i.e., the soundness condition does not hold with probability at most, say, $\frac{1}{3}$ (soundness $\frac{1}{3}$).

While a $\mathsf{dMA}$ protocol is more powerful than usual deterministic distributed computing, unfortunately, there are still limits on this model for some predicates [FGNP21].

Fraigniaud, Le Gall, Nishimura, and Paz [FGNP21] introduced the setting where a prover and nodes are quantum computers and communicate with quantum messages, and named such the protocols distributed quantum Merlin-Arthur ($\mathsf{dQMA}$) protocols.

The global property they considered was the problem $\mathsf{EQ}$ of deciding whether all the distributed data ($n$-bit binary strings) on the network are the same or not. The basic idea behind their $\mathsf{dQMA}$ protocol is to make the prover send quantum fingerprints for the input data [BCWdW01] to all the nodes; subsequently, each node sends the fingerprint it receives to its neighbor, and they do the SWAP test [BCWdW01], a quantum procedure for checking whether two quantum fingerprints are the same or not. Their $\mathsf{dQMA}$ protocol needs local proof size $O(tr^{2}\log n)$, namely, each node receives an $O(tr^{2}\log n)$-qubit proof, where $r$ is the radius of the network and $t$ is the number of distributed inputs. As a complementary result to their $\mathsf{dQMA}$ upper bound, they showed that any $\mathsf{dMA}$ protocol with high completeness and low soundness error requires an $\Omega(n)$ size classical proof for at least one node. As a consequence, they gave an exponential gap in the proof size between $\mathsf{dMA}$ protocols and $\mathsf{dQMA}$ protocols for the equality problem.

They also derive an efficient $\mathsf{dQMA}$ protocol on a path, for any function that has an efficient quantum one-way communication protocol with bounded error in the communication complexity setting. As a corollary, they have an efficient $\mathsf{dQMA}$ protocol on a path for the Hamming distance problem since it has an efficient quantum one-way communication protocol [Yao03].

The results of [FGNP21] are summarized in Table 1, where $\#$Terminals represents the number of terminals, the nodes that have distributed inputs. For a function $f:(\{0,1\}^{n})^{2}\to\{0,1\}$, let us denote by $\mathsf{BQP}^{1}(f)$ the quantum one-way communication complexity of $f$.

We derive a more efficient $\mathsf{dQMA}$ protocol for $\mathsf{EQ}$ on a general graph with multiple input terminals, by a simpler analysis of soundness. Our protocol and analysis are simpler than the ones in [FGNP21] and the proof size of our $\mathsf{dQMA}$ protocol does not depend on the number of the terminals and matches the size of the path case with two terminals.

The result of [FGNP21] implies that there is an exponential difference in proof size between $\mathsf{dMA}$ and $\mathsf{dQMA}$ for $\mathsf{EQ}$ on a path. However, such a big difference holds only when the network size is much smaller than the input size, i.e., $r\ll n$. Since there exists a trivial classical protocol with $n$-bit proofs (the prover sends the whole $n$-bit string to all the nodes, and each node checks if the proofs of its neighbors are identical to its own or not), the quantum strategy can be even worse than the trivial classical strategy when the network size is not so small.

In this paper, we show that even when the network size is not so small, a provable quantum advantage still persists. To claim the quantum advantage, we consider the complexity measure of the total size of proofs to all the nodes rather than the size of respective proofs to each node.

Checking how large an input is among all inputs held by the terminals in a network is a fundamental problem. We name this problem the ranking verification ($\mathsf{RV}$) problem, and show that there exists an efficient $\mathsf{dQMA}$ protocol for it.

To prove this statement, we derive an efficient $\mathsf{dQMA}$ protocol on a path to solve the greater-than function. The greater-than function ($\mathsf{GT}$) is defined as $\mathsf{GT}(x,y)=1$ if and only if $x>y$, where $x$ and $y$ are $n$-bit integers.

We can show that any $\mathsf{dMA}$ protocol for $\mathsf{GT}$ with high completeness and low soundness error requires $\Omega(nr)$ size classical proofs in total. Thus, this provides us another fundamental problem that exhibits an exponential quantum advantage in distributed verification.

The result of [FGNP21] on converting a quantum one-way communication protocol to a $\mathsf{dQMA}$ protocol only works on a path with two inputs, and no efficient $\mathsf{dQMA}$ protocol was known for three or more inputs over general networks. We construct an efficient $\mathsf{dQMA}$ protocol on a general graph with multiple terminals, for any function which has an efficient quantum one-way communication protocol with bounded error. For a function $f:(\{0,1\}^{n})^{2}\to\{0,1\}$, we define the multi-input function $\forall_{t}f:(\{0,1\}^{n})^{t}\to\{0,1\}$ where $\forall_{t}f(x_{1},\ldots,x_{t})=1$ iff $f(x_{i},x_{j})=1$ for any $i,j\in[1,t]$.

We also construct an efficient $\mathsf{dQMA}$ protocol for a function which has an efficient $\mathsf{QMA}$ communication protocol (introduced by Raz and Shpilka [RS04]) rather than an efficient quantum one-way communication protocol. Let us denote by $\mathsf{QMAcc}(f)$ the sum of the proof and communication amount of $\mathsf{QMA}$ communication protocols for $f$.

In addition, we show that any $\mathsf{dQMA}$ protocol in which entangled proofs are given to the nodes can be simulated with a $\mathsf{dQMA}$ protocol with “separable” proofs, in which the local part of the proof at each node is not entangled with the other nodes, with some overheads. A $\mathsf{dQMA}^{\mathsf{sep}}$ protocol is a $\mathsf{dQMA}$ protocol whose completeness holds with a proof that is separable between nodes.

Our results on quantum upper bounds and classical lower bounds are summarized in Table 2. As seen in the table, all the $\mathsf{dQMA}$ protocols constructed in this paper are actually $\mathsf{dQMA}^{\mathsf{sep}}$ ones. Let $\mathsf{dQMA}(f)$ denote the sum of the total proof size and the communication size of a $\mathsf{dQMA}$ protocol for $f$.

In this paper, we derive the first lower bounds on the proof and communication cost of $\mathsf{dQMA}$ protocols. We introduce a $\mathsf{dQMA}^{\mathsf{sep},\mathsf{sep}}$ protocol as another variant of $\mathsf{dQMA}$ protocols where a prover can only send separable proofs between nodes (and thus soundness holds only with respect to separable proofs). When we restrict the power of the prover, we obtain the following strong lower bound (note that it implies the matching lower bounds for $\mathsf{EQ}$ and $\mathsf{GT}$ with respect to the order of the input size $n$ as their sizes of $1$-fooling sets are $2^{n}$).

It is notoriously hard to prove lower bounds when dealing with entanglement between parties, and the seminal example is the case of $\mathsf{MIP^{*}}$ [CHTW04, IV12, NW19, JNV⁺21]. In $\mathsf{dQMA}$ protocols, nodes on a network might exploit the power of entangled proofs from a prover by clever local communication and computations. Despite this difficulty, we prove several lower bounds of $\mathsf{dQMA}$ protocols. The main result is as follows.

Additionally, we prove a $\mathsf{dQMA}$ lower bound for functions which are hard for $\mathsf{QMA}$ communication protocols, in terms of the one-sided smooth discrepancy [Kla11]. Let us denote by $\mathsf{sdisc}^{1}(f)$ the one-sided smooth discrepancy of a function $f$; it was shown in [Kla11] that $\mathsf{sdisc}^{1}$ is a lower bound on $\mathsf{QMA}$ communication complexity.

Note that the above theorem does not give a nontrivial lower bound for the equality function, since this function has a constant-cost classical randomized communication protocol, and therefore $\mathsf{sdisc}^{1}(\mathsf{EQ})$ is at most constant. Theorem 9 thus outperforms Theorem 10 for the $\mathsf{EQ}$ function.

Our results on lower bounds (including other ones than the above three theorems) are summarized in the following Table 3. In the table, $\epsilon>0$ is any small constant and $f^{+}$ is any non-constant Boolean function $f$. As functions which are hard for $\mathsf{QMA}$ communication protocols [Kla11], let us denote by $\mathsf{DISJ}$ the disjointness function, by $\mathsf{IP}$ the inner product function, by $P_{\mathsf{AND}}$ the pattern matrix [She11] of the AND function. These lower bounds will be formally stated and proved in Section 8.

In [FGNP21], they designed a protocol on a path where each node sends the received proof (quantum fingerprint) to its left neighbor with probability $\frac{1}{2}$, and thus the conditional probability that the SWAP test occurs is needed to analyze. To simplify the analysis of the soundness of the protocol, we add an extra step called the symmetrization step for each node. With this step, we can avoid using conditional probability because each node conducts the SWAP test with certainty.

In the [FGNP21] protocol for $\mathsf{EQ}$ with three or more terminals, every non-terminal node performs the SWAP test on the state that consists of the state received from the prover and a state randomly chosen from states received from the children. Every node discards the other states received from the children and are not used for the SWAP test. To improve the proof size of the protocol for general graphs from $O(tr^{2}\log n)$ to $O(r^{2}\log n)$, we make each node perform the permutation test [BBD⁺97, BCWdW01, KNY08] on all the states from its children.

The permutation test is a generalization of the SWAP test from 2-partite systems to $k$-partite systems for any integer $k\geq 2$. We identify the permutation test with a projector to the symmetric subspace of multiple systems as a special case of weak Schur Sampling [BCH06]. Using properties of Schur sampling, we show that, by using the permutation test, we can test how close the subspace is to given states.

To prove a universal quantum advantage for $\mathsf{EQ}$, we consider inserting multiple “relay points” per $O(n^{\frac{1}{3}})$ nodes between extreme nodes that receive $n$-qubit proofs. Based on the $n$-bit measurement results, nodes between relay points conduct the SWAP test-based quantum strategy. This makes for a $\mathsf{dQMA}$ protocol in which all the nodes receive $\tilde{O}(rn^{\frac{2}{3}})$ qubits in total and has high completeness and low soundness error.

To complement this result, we claim any $\mathsf{dMA}$ protocol for $\mathsf{EQ}$ with high completeness and low soundness error has to receive $\Omega(rn)$ bits in total by a finer observation of the classical lower bound in [FGNP21].

It was shown that the quantum one-way communication complexity of $\mathsf{GT}$ is maximal, i.e., $\mathsf{BQP}^{1}(\mathsf{GT})=\Theta(n)$ by Zhang [Appendix B in [Zha11]]. Therefore, one cannot apply the technique from [FGNP21], and no efficient $\mathsf{dQMA}$ protocol for $\mathsf{GT}$ was previously known. In this paper, we derive a new way to use quantum fingerprints with classical indexes, and construct an efficient $\mathsf{dQMA}$ protocol for $\mathsf{GT}$.

To construct a $\mathsf{dQMA}$ protocol for the greater-than ($\mathsf{GT}$) problem, we first observe that for $x,y\in\{0,1\}^{n}$, $\mathsf{GT}(x,y)=1$ if and only if there exists an index $i$ such that a part of $x$ and $y$ from the $1$st bit to the $(i-1)$th bit are the same and the $i$th bit of $x$ is $1$ and the $i$th bit of $y$ is 0. Therefore, we can run the protocol for the equality problem for a part of the inputs, and make the prover send the classical index $i$.

To prove the soundness for the ranking verification problem, we consider to make the prover send a direction bit indicating which input is larger and add a step for a root node to count the directions. We then have an efficient protocol for the ranking verification problem by running the protocol for $\mathsf{GT}$ between multiple terminals in parallel.

To derive a $\mathsf{dQMA}$ protocol for a function that has an efficient quantum one-way communication protocol with multiple terminals, one difficulty is that we need to run the operation of Bob, a party that receives a message from the other party Alice, in the one-way protocol for the function on every leaf. Therefore, we consider a protocol from root to leaves, which is the reverse of the direction of messages in the protocol for $\mathsf{EQ}$.

The other caveat is that a protocol on one tree is not enough to prove soundness. This is because even if $f(x_{i},x_{i+1})=1$ and $f(x_{i},x_{i+2})=1$, the value of $f(x_{i+1},x_{i+2})$ can be $0$. To overcome this, we consider running the protocols in parallel for all the $t$ spanning trees whose roots are the $t$ terminals.

To construct a $\mathsf{dQMA}$ protocol with separable proofs from any $\mathsf{dQMA}$ protocol, we use a $\mathsf{QMA}$ communication complete problem introduced by Raz and Shpilka [RS04].

$\mathsf{QMA}$ communication protocols are two-party communication protocols with a prover who can send a proof to one party Alice. Raz and Shpilka [RS04] defined the Linear Subspace Distance (LSD) problem as a $\mathsf{QMA}$ communication complete problem, i.e., any $\mathsf{QMA}$ communication protocol can be reduced to the LSD problem. The LSD problem is a problem to decide whether two subspaces held respectively by the two parties Alice and Bob are close or not.

A useful property of the LSD problem is that it can be solved with a $\mathsf{QMA}$ one-way communication protocol with a proof to Alice. Exploiting this property and the SWAP test strategy [FGNP21], we construct a $\mathsf{dQMA}^{\mathsf{sep}}$ protocol for any function that has a $\mathsf{QMA}$ communication protocol.

In addition, we observe that any $\mathsf{dQMA}$ protocol can be viewed as a $\mathsf{QMA}$ communication protocol when we split the total nodes into two groups of nodes and consider Alice and Bob to simulate the protocol of the nodes. This leads us to get a $\mathsf{dQMA}^{\mathsf{sep}}$ protocol from any $\mathsf{dQMA}$ protocol.

We obtain some lower bounds by counting arguments over quantum states for fooling inputs. To prove our bounds, we use a result from [BCWdW01, dW01], which states that in order to keep non-trivial distances between each pair of a set of $2^{n}$ states, at least $\Omega(\log n)$ qubits are required. From this we can prove that, to answer correctly on $2^{n}$ fooling inputs for $\mathsf{EQ}$ and $\mathsf{GT}$, local nodes in a $\mathsf{dQMA}$ protocol must receive at least $\Omega(\log n)$ qubits. Then, by the pigeonhole principle, we show that at least $\Omega(r\log n)$ qubits are required as a quantum proof in total. This lower bound and proof strategy can be regarded as a quantum analog of the classical lower bound in [FGNP21].

In order for the above proof strategy to be applicable, proofs between nodes are required to be separable, since entanglement between nodes might fool the verifiers. However, by combining our result on the simulation of any $\mathsf{dQMA}$ protocol with a $\mathsf{dQMA}^{\mathsf{sep}}$ protocol, we show a lower bound even for entangled proofs and communications, where the order of the bound is an inverse of a polynomial in $r$, due to the overhead of the simulation.

For entangled proofs, we can also show a simpler lower bound. Let us suppose that there are consecutive nodes which receive no proof from a prover. Then, even for a function that has only two fooling inputs, the verifiers are easily fooled by the two inputs, because the information the nodes have is separated between the two parts. To deliver quantum proofs to each local node, it can be shown that $\Omega(r)$ qubits are required as a quantum proof in total. By combining the two lower bounds for entangled proofs, for $\mathsf{EQ}$ and $\mathsf{GT}$ we can obtain a lower bound which does not depend on $r$ which is the main result of our lower bounds.

We obtain other lower bounds by a reduction to $\mathsf{QMA}$ communication lower bounds by Klauck [Kla11]. To make a reduction, we first introduce $\mathsf{QMA}^{*}$ communication protocols where proofs are sent to the two parties and they might be entangled. Then, we observe that a $\mathsf{dQMA}$ protocol can be used to give a $\mathsf{QMA}^{*}$ communication protocol, and then the results of [Kla11] can be applied.

As standard references, we refer to [KN96, RY20] for classical communication complexity and [dW02, BCMdW10] for quantum communication complexity and the simultaneous message passing (SMP) model.

The goal in communication complexity is for Alice and Bob to compute a function $F:\mathcal{X}\times\mathcal{Y}\to\{0,1,\perp\}$. We interpret $1$ as “accept” and $0$ as “reject” and we mostly consider $\mathcal{X}=\mathcal{Y}=\{0,1\}^{n}$. In the computational model, Alice receives an input $x\in\mathcal{X}$ (unknown to Bob) and Bob receives an input $y\in\mathcal{Y}$ (unknown to Alice) promised that $(x,y)\in\mathsf{dom}(F)=F^{-1}(\{0,1\})$. In a one-way communication protocol, Alice sends a single message to Bob, and he is required to output $F(x,y)$. In a two-way communication protocol, Alice and Bob can exchange messages with multiple rounds. The cost of a classical (resp. quantum) communication protocol is the number of bits (resp. qubits) communicated. The (bounded-error) communication complexity (resp. one-way communication complexity) of $F$ is defined as the minimum cost of two-way (resp. one-way) classical or quantum communication protocols to compute $F(x,y)$ with high probability, say $\frac{2}{3}$.

The simultaneous message passing (SMP) model is a specific model of communication protocols. In this model, Alice and Bob each send a single (possibly quantum or randomized) message to a referee Charlie. The goal for Charlie is to output $F(x,y)$ with high probability, say at least $\frac{2}{3}$. The complexity measure of the protocol is the total amount of messages Charlie receives from Alice and Bob.

In this paper, $\mathsf{BQP}^{1}(f)$ and $\mathsf{BQP}^{||}(f)$ denote the quantum one-way and SMP communication complexity of $f$, respectively. Note that $\mathsf{BQP}^{1}(f)\leq\mathsf{BQP}^{||}(f)$ for any $f$ since any SMP protocol can be efficiently simulated by a one-way communication protocol where Charlie is simulated by Bob.

A basic function considered in communication complexity is the equality function $\mathsf{EQ}_{n}:~{}\{0,1\}^{n}\times\{0,1\}^{n}\rightarrow\{0,1\}$, which is defined as $\mathsf{EQ}_{n}(x,y)=1$ if $x=y$ and $0$ otherwise. This paper frequently uses the fact that $\mathsf{EQ}_{n}$ can be solved by a one-way quantum protocol of cost $c\log n$ with one-sided error for some constant $c>0$; the protocol outputs $1$ if $x=y$ with probability $1$, and outputs $0$ with probability $2/3$. In what follows, such the protocol is called $\pi$, let $|h_{x}\rangle$ be the $c\log n$-qubit state from Alice to Bob (fingerprint of $x$), and let $\{M_{y,1},M_{y,0}\}$ be the POVM measurement performed by Bob on $\ket{h_{x}}$, where $M_{y,1}$ corresponds to the measurement result $1$ (accept) and $M_{y,0}$ to the measurement result $0$ (reject).

For any Boolean function $f:\{0,1\}^{n}\times\{0,1\}^{n}\to\{0,1\}$, a set $S\subseteq\{0,1\}^{n}\times\{0,1\}^{n}$ is a 1-fooling set for $f$ if $f(x,y)=1$ for any $(x,y)\in S$ ,and $f(x_{1},y_{2})=0$ or $f(x_{2},y_{1})=0$ for any two pairs $(x_{1},y_{1})\neq(x_{2},y_{2})\in S\times S$.

Let us recall the definition of $\mathsf{QMA}$ communication protocols.

We say for a function $f$, $\mathsf{QMAcc}(f)=\gamma+\mu$ if there exists a $\mathsf{QMA}$ communication protocol whose proof size is $\gamma$ and communication amount is $\mu$.

Next, let us define a $\mathsf{QMA}$ one-way communication protocol and a $\mathsf{QMA}^{*}$ communication protocol as two variants of the $\mathsf{QMA}$ communication protocol. In the $\mathsf{QMA}$ one-way communication protocol, Alice can send a message once to Bob and no more communication is prohibited.

In the $\mathsf{QMA}^{*}$ communication protocol, Alice and Bob can receive proofs respectively from Merlin and the proofs might be entangled.

We say for a function $f$, $\mathsf{QMAcc}^{1}(f)=\gamma+\mu$ and $\mathsf{QMAcc}^{*}(f)=\gamma_{1}+\gamma_{2}+\mu$ similar to $\mathsf{QMAcc}(f)=\gamma+\mu$. There are (trivial) relationships between them. First, for any $f$, $\mathsf{QMAcc}(f)\leq\mathsf{QMAcc}^{1}(f)$ by their definitions. Second, for any $f$ for which $\mathsf{QMAcc}^{*}(f)=\gamma_{1}+\gamma_{2}+\mu$,

This is because any $\mathsf{QMA}^{*}$ communication protocol $\mathcal{P}$ such that Merlin sends $\gamma_{1}$ qubits to Alice and $\gamma_{2}$ qubits to Bob can be simulated by a $\mathsf{QMA}$ communication protocol where Merlin sends Alice the $(\gamma_{1}+\gamma_{2})$ qubits sent by Merlin in $\mathcal{P}$, Alice sends the Bob-part in $\mathcal{P}$ ($\gamma_{2}$ qubits) to Bob, and Alice and Bob conduct the subsequent communication protocol in $\mathcal{P}$.

Let us recall the definition of classical distributed verification protocols called distributed Merlin-Arthur protocols ($\mathsf{dMA}$ protocols).

In a $\nu$-round $\mathsf{dMA}$ protocol for a binary-valued function $f$, the prover (Merlin) first sends a message called a proof (or certificate) to the verifier (Arthur) that consists of the nodes of a network $G=(V,E)$. More precisely, the prover sends a $c(u)$-bit string to each $u\in V$. Then, the nodes of $G$ run a $\nu$-round verification algorithm, namely, a randomized algorithm (or protocol) using $\nu$-round communication among the nodes. Here, $t$ nodes $u_{i}$ called terminals have own input string $x_{i}$. Then, the condition that the $\mathsf{dMA}$ protocol should satisfy for verifying whether $f(x_{1},\ldots,x_{t})=1$ or not is as follows.

Let us next recall the definition of quantum verification protocols called distributed quantum Merlin-Arthur protocols ($\mathsf{dQMA}$ protocols). A $\mathsf{dQMA}$ protocol is defined similarly to $\mathsf{dMA}$ protocols except that the message from the prover is a quantum state and the algorithm of each node and the communication among the nodes are also quantum (and thus the complexity is measured by the number of qubits). The condition that the $\mathsf{dQMA}$ protocol should satisfy for verifying whether $f(x_{1},\ldots,x_{n})=1$ or not is as follows; let $\mathcal{H}_{v}$ denote the Hilbert space associated with the quantum register $R_{v}$ sent from the prover to the node $v$.

In the definition above, we consider quantum proofs that are only pure states. Since mixed states are convex combinations of pure states, this restriction does not affect the completeness and soundness parameters and lose generality as in the case for $\mathsf{QMA}$.

Let us define some variants of the $\mathsf{dQMA}$ protocol. For $\mathsf{dQMA}^{\mathsf{sep}}$ protocols, the completeness holds with a separable proof between nodes and the soundness holds against any entangled proof. Actually, the $\mathsf{dQMA}$ protocols in [FGNP21] as well as the $\mathsf{dQMA}$ protocols in this paper are $\mathsf{dQMA}^{\mathsf{sep}}$ protocols while we do not state it in some of the theorems for the simplicity of their statements.

For $\mathsf{dQMA}^{\mathsf{sep},\mathsf{sep}}$ protocols, the completeness holds with a separable proof and the soundness holds against only separable proofs. In other words, a $\mathsf{dQMA}^{\mathsf{sep},\mathsf{sep}}$ protocol is a $\mathsf{dQMA}$ protocol where a prover can send only separable proofs over nodes.