This paper was converted on www.awesomepapers.org from LaTeX by an anonymous user.
Want to know more? Visit the Converter page.

\sidecaptionvpos

figurec

Pseudoentanglement Ain’t Cheap

Sabee Grewal sabee@cs.utexas.edu. The University of Texas at Austin.    Vishnu Iyer vishnu.iyer@utexas.edu. The University of Texas at Austin.    William Kretschmer kretsch@berkeley.edu. Simons Institute for the Theory of Computing, UC Berkeley.    Daniel Liang dl88@rice.edu. Rice University.
Abstract

We show that any pseudoentangled state ensemble with a gap of tt bits of entropy requires Ω(t)\Omega(t) non-Clifford gates to prepare. This bound is tight up to polylogarithmic factors if linear-time quantum-secure pseudorandom functions exist. Our result follows from a polynomial-time algorithm to estimate the entanglement entropy of a quantum state across any cut of qubits. When run on an nn-qubit state that is stabilized by at least 2nt2^{n-t} Pauli operators, our algorithm produces an estimate that is within an additive factor of t2\frac{t}{2} bits of the true entanglement entropy.

1 Introduction

Recent work [ABF+24] introduced the notion of pseudoentangled quantum states, in analogy with pseudorandomness in classical computation. An ensemble of quantum states is said to be pseudoentangled if states in the ensemble have low entanglement across every bipartition, but they are difficult to distinguish from states with much larger entanglement. A more formal definition is the following:

Definition 1.1.

A pseudoentangled ensemble with gap f(n)f(n) vs. g(n)g(n) (where f(n)>g(n)f(n)>g(n)) consists of two ensembles of nn-qubit states {|Ψk,|Φk}k\{\ket{\Psi_{k}},\ket{\Phi_{k}}\}_{k} indexed by a key k{0,1}poly(n)k\in\{0,1\}^{\mathrm{poly}(n)} such that

  • |Ψk\ket{\Psi_{k}} and |Φk\ket{\Phi_{k}} are preparable in quantum polynomial time.

  • With probability at least 1poly(n)1-\mathrm{poly}(n) over the choice of kk, the entanglement entropy across every cut of size Ω(f(n))\Omega(f(n)) of |Ψk\ket{\Psi_{k}} (respectively, |Φk\ket{\Phi_{k}}) is Θ(f(n))\Theta(f(n)) (respectively, Θ(g(n))\Theta(g(n))).

  • For any polynomial p(n)p(n), no polynomial-time quantum adversary can distinguish

    ρ𝐄k[|ΨkΨk|p(n)]andσ=𝐄k[|ΦkΦk|p(n)]\rho\coloneqq\mathop{\bf E\/}_{k}\left[\ket{\Psi_{k}}\!\!\bra{\Psi_{k}}^{\otimes p(n)}\right]\qquad\text{and}\qquad\sigma=\mathop{\bf E\/}_{k}\left[\ket{\Phi_{k}}\!\!\bra{\Phi_{k}}^{\otimes p(n)}\right]

    with better than negligible success probability.

[ABF+24] showed that pseudoentangled states can be instantiated in polynomial time and logarithmic depth, assuming the existence of quantum-secure one-way functions. So, under a standard cryptographic assumption, there exists an efficient construction of pseudoentanglement. Nevertheless, in applications, we sometimes need constructions that are even simpler and more efficient, due to constraints beyond total gate complexity. For example, [ABF+24] suggested that a construction of “holographic” pseudoentangled states might imply that the AdS/CFT dictionary is hard to compute. However, it remains open to build such pseudoentangled states that are compatible with the laws of AdS/CFT. There are also various other measures of quantum state complexity, beyond circuit depth. For example, a counting argument shows that stabilizer states and free-fermionic states can require super-logarithmic depth, but these states are also “easy” in the sense that their evolutions are efficiently classically simulable [AG04, Val02] and they are efficiently learnable [AG08, Mon17, AG23].

In this work, we study the relationship between pseudoentanglement and non-Clifford complexity. The Clifford group is a remarkably useful object in quantum information that consists of all quantum circuits generated by Hadamard, Phase, and CNOT gates. Clifford gates are almost universal for quantum computing: the addition of any single-qubit non-Clifford gate gives rise to a universal gate set, as shown by Shi [Shi02]. Generally speaking, Clifford gates are “cheaper” than non-Clifford gates, in a sense that can be formalized in a variety of applications. Examples where the cost of a quantum operation is dominated by non-Clifford gates include quantum fault tolerance based on magic state distillation [BK05], near-Clifford classical simulation algorithms [AG04, BG16, RLCK19, BBC+19], and quantum learning algorithms based on the stabilizer formalism [LC22, GIKL23a, GIKL23b, GIKL23c, GIKL23d, LOLH22, LOH23, HG23, CLL23].

A related work by Grewal, Iyer, Kretschmer, and Liang [GIKL23d, GIKL23c] investigated the stabilizer complexity of a different cryptographic object called pseudorandom quantum states. These are ensembles of quantum states that cannot be distinguished from Haar-random by any polynomial-time adversary. The main result of [GIKL23c], improving upon earlier work by the same authors, shows that nn-qubit pseudorandom states require at least Ω(n)\Omega(n) non-Clifford gates. The present work asks whether a similar lower bound on non-Clifford resources holds for quantum pseudoentanglement.

As it happens, several of the known pseudoentangled state ensembles are also pseudorandom states ensembles, including the only known instantiations of pseudoentanglement that achieve an optimal gap of Θ(n)\Theta(n) vs. ω(logn)\omega(\log n) [ABF+24, GTB23]. However, [ABF+24] further observed that a pseudoentangled ensemble need not be pseudorandom, nor vice-versa. Hence, it is not clear that the computational resources needed to construct pseudoentangled states mirror those for pseudorandom states.

On the other hand, existing work has made clear that that some amount of non-Cliffordness is needed to generate pseudoentangled states. Fattal, Cubitt, Yamamoto, Bravyi, and Chuang [FCY+04] gave an efficient algorithm for computing the entanglement entropy across any bipartition of a stabilizer state (i.e., a state preparable using Clifford gates only). Combined with Montanaro’s algorithm for learning an unknown stabilizer state [Mon17], this implies that any ensemble {|Ψk,|Φk}k\{\ket{\Psi_{k}},\ket{\Phi_{k}}\}_{k} of stabilizer states cannot be pseudoentangled.

Our main result is an algorithm with a much stronger guarantee than the combination of [FCY+04, Mon17]. In short, our algorithm estimates the entanglement entropy of an unknown quantum state across any cut of qubits, where the accuracy of the estimate scales with the number of Pauli operators that stabilize the state (i.e., the number of Pauli operators for which the state is a +1+1-eigenvector).

Theorem 1.2 (Informal version of Corollary 4.4).

There is a polynomial-time quantum algorithm that takes as input

  1. 1.

    O(n3)O(n^{3}) copies of an nn-qubit quantum state |ψ\ket{\psi} that is stabilized by at least 2nt2^{n-t} Pauli operators, and

  2. 2.

    A bipartition AB=[n]A\sqcup B=[n] of qubits,

and outputs an estimate of the entanglement entropy of |ψ\ket{\psi} across the partition. The estimate is within an additive factor of t2\frac{t}{2} bits of the true entanglement entropy, with high probability.

We remark that the set of states for which this is applicable is rather large and includes states prepared by a Clifford circuit with up to t2\lfloor\frac{t}{2}\rfloor auxiliary single-qubit non-Clifford gates (such as the TT-gate). When the algorithm is run on a stabilizer state (i.e., when t=0t=0), then our algorithm outputs the entanglement entropy across any cut of qubits exactly, recovering the aforementioned result of [FCY+04, Mon17]. On the other hand, the bounds degrade as tt becomes too close to nn.

As a straightforward consequence, we show that pseudoentangled state ensembles require a number of non-Clifford gates that scales linearly in the pseudoentanglement gap.

Theorem 1.3 (Restatement of Corollary 4.5).

Any family of Clifford circuits that produces a pseudoentangled ensemble {|Ψk,|Φk}k\{\ket{\Psi_{k}},\ket{\Phi_{k}}\}_{k} with entropy gap f(n) vs. g(n)f(n)\text{ vs. }g(n) satisfying f(n)g(n)tf(n)-g(n)\geq t must use Ω(t)\Omega(t) auxiliary non-Clifford single-qubit gates.

So, pseudoentangled ensembles with the optimal Θ(n)\Theta(n) vs. ω(logn)\omega(\log n) gap require a linear number of non-Clifford gates. Interestingly, this matches the lower bound on non-Clifford gates needed for pseudorandom states [GIKL23c].

Corollary 4.5 is optimal up to polylogarithmic factors under plausible computational assumptions. In particular, Ma [Ma24] constructs pseudoentangled state ensembles in O(npolylog(n))O(n\ \mathrm{polylog}(n)) time under the assumption that linear-time quantum-secure pseudorandom functions exist.111The details will be included in a forthcoming work due to Ma [Ma24]. This is to say that under this assumption, pseudoentangled state ensembles on nn qubits require at most O(npolylog(n))O(n\ \mathrm{polylog}(n)) non-Clifford gates in total. It is widely conjectured that linear-time classically-secure pseudorandom functions exist [IKOS08, FLY22], and it is plausible that these (or other) constructions are also secure against quantum adversaries.

Prior to this work, it was unknown if even O(1)O(1) non-Clifford gates sufficed to construct pseudoentangled states. While one can efficiently learn states prepared by O(logn)O(\log n) non-Clifford gates [GIKL23a, GIKL23b], it is unclear how to leverage those algorithms to estimate entanglement entropy. Following intuition from simulation algorithms for near-Clifford circuits, whose running times scale exponentially in the number of non-Clifford gates, it was also conceivable that a super-logarithmic number of non-Clifford gates would be sufficient to construct pseudoentangled states.

Concurrent Work

While finalizing this work, we became aware of independent and concurrent work by Gu, Oliveiro, and Leone [GOL24]. Their [GOL24, Lemma 7] resembles our Theorem 3.1. However, we only prove bounds for the von Neumann entropy, whereas [GOL24] prove similar bounds for any α\alpha-Rényi entanglement entropy, which captures the von Neumann entropy as a special case.

1.1 Main Ideas

For an nn-qubit quantum state |ψ\ket{\psi}, let Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) denote the Pauli operators PP for which P|ψ=1P\ket{\psi}=1.222See Definition 2.10 for a formal definition. We find it convenient to work with Weyl operators, a subset of Pauli operators that form a basis of 2n×2n\mathbb{C}^{2^{n}\times 2^{n}}. One can think of Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) as the stabilizer group of |ψ\ket{\psi} with all of the phase information removed. For example, for any computational basis state |x\ket{x}, Weyl(|x){I,Z}n\mathrm{Weyl}(\ket{x})\equiv\{I,Z\}^{\otimes n}. Let AB=[n]A\sqcup B=[n] be a bipartition of qubits. Denote Weyl(|ψ)A\mathrm{Weyl}(\ket{\psi})_{A} as the subset of Pauli operators in Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) that act only the qubits indexed by AA, and define Weyl(|ψ)B\mathrm{Weyl}(\ket{\psi})_{B} analogously. We use dim(G)\dim(G) to refer to the minimum number of generators of a group GG. It is easy to verify that Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}), Weyl(|ψ)A\mathrm{Weyl}(\ket{\psi})_{A}, and Weyl(|ψ)B\mathrm{Weyl}(\ket{\psi})_{B} are abelian subgroups of the Pauli group. We prove the following bounds on the entanglement entropy across (A,B)(A,B), which hold for any quantum state.

Theorem 1.4 (Restatement of Theorem 3.1).

Let ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi} be an nn-qubit quantum state and let AB=[n]A\sqcup B=[n] be a partition of qubits. Then

dim(Weyl(|ψ))dim(Weyl(|ψ)B)|A|𝖲(ρA)|A|dim(Weyl(|ψ)A),\dim\left(\mathrm{Weyl}(\ket{\psi})\right)-\dim\left(\mathrm{Weyl}(\ket{\psi})_{B}\right)-\lvert A\rvert\leq\mathsf{S}(\rho_{A})\leq\lvert A\rvert-\dim\left(\mathrm{Weyl}(\ket{\psi})_{A}\right),

where ρA=trB(ρ)\rho_{A}=\mathrm{tr}_{B}(\rho) is the reduced density matrix of ρ\rho after tracing out the qubits in BB and 𝖲(ρA)\mathsf{S}(\rho_{A}) is the entanglement entropy across (A,B)(A,B).

Crucially, the quantities in Theorem 1.4 can be (approximately) computed efficiently, given a polynomial number of copies of |ψ\ket{\psi}. First, we learn generators for Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) with Bell difference sampling, a quantum measurement that consumes four copies of a state and produces a Pauli operator (see the end of Section 2.1 for further detail). Bell difference sampling many times, along with some classical post-processing, suffices to (approximately) learn generators of Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}), as proven in prior work [GIKL23c, GIKL23a]. Then, using these generators of Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}), we can compute (approximations of) Weyl(|ψ)A\mathrm{Weyl}(\ket{\psi})_{A} and Weyl(|ψ)B\mathrm{Weyl}(\ket{\psi})_{B} in polynomial time by solving a system of linear constraints. We note that these approximations suffice, due to a result of Audenaert [Aud07, Theorem 1], which relates the entanglement entropy of states that are close in trace distance.

Let us now explain how the upper and lower bounds in Theorem 1.4 are proved, and then explain some applications. At a high level, we argue that there exist Clifford circuits acting locally on either AA or BB that exhibit entanglement (or the lack thereof) in the system. Because the Clifford circuits are local, we conclude that the original state must have the same entanglement (or lack thereof). The formal proofs are given in Section 3.

We begin with the upper bound. Trivially, the entanglement entropy is at most |A|\lvert A\rvert. To simplify the presentation, define adim(Weyl(|ψ)A)a\coloneqq\dim(\mathrm{Weyl}(\ket{\psi})_{A}). By known techniques, one can construct a Clifford circuit acting only on AA that maps Weyl(|ψ)A\mathrm{Weyl}(\ket{\psi})_{A} to Pauli-ZZ strings on a subset of aa qubits.333It is well known that Clifford unitaries map Pauli operators to Pauli operators, see Section 2.1 for more detail. This has the effect of mapping the state |ψ\ket{\psi} to a product state where a subset of aa qubits in AA are in a computational basis state and the remaining qubits are in some arbitrary state. The aa qubits cannot be entangled with the rest of the system, and our upper bound follows.

For the lower bound, we argue that there exist Clifford circuits acting locally on AA and BB, respectively, that distill EPR pairs across qubits of AA and BB. Observe that the EPR state is stabilized by the Pauli operators generated by XXX\otimes X and ZZZ\otimes Z. While these two Pauli operators commute with one another, they locally anticommute (i.e., XX and ZZ do not commute). Clifford circuits acting locally on AA (or BB, respectively) do not affect the global or local commutation relations. As such, any pair of locally anticommuting Pauli operators in Weyl(ψ)\mathrm{Weyl}(\psi) can be mapped, via local Clifford circuits on AA and BB, respectively, to XXX\otimes X and ZZZ\otimes Z, creating an EPR pair on one qubit of AA and BB each. Our lower bound follows from counting the number of EPR pairs we can produce in this way.

For both the upper and lower bounds, the Clifford circuits can be found efficiently. Indeed, a similar approach played a crucial role in the tomography algorithms given in [GIKL23a, GIKL23b]. Additionally, one can view our lower bound as an efficient algorithm for entanglement distillation of quantum states with large stabilizer dimension (Definition 2.11), which may be of independent interest.

We conclude by explaining how to apply Theorem 1.4 to get our entanglement estimation algorithm (Theorem 1.2) and the pseudoentanglement lower bound (Theorem 1.3). Our algorithm outputs upper and lower bounds (u,)(u,\ell), essentially by computing the quantities appearing in Theorem 1.4. When run on a quantum state |ψ\ket{\psi} that is stabilized by least 2nk2^{n-k} Pauli operators, we prove that uku-\ell\leq k. Therefore, u+2\frac{u+\ell}{2} will always be within an additive factor of k2\frac{k}{2} bits of the true entanglement entropy. As a corollary, we obtain a lower bound on preparing pseudoentangled states. Suppose we have two state ensembles {|Ψk}k\{\ket{\Psi_{k}}\}_{k} and {|Φk}k\{\ket{\Phi_{k}}\}_{k} that are prepared with at most tt non-Clifford gates. If we run our entropy estimation algorithm on copies drawn from either ensemble, we will recover upper and lower bounds (u,)(u,\ell) such that u2tu-\ell\leq 2t. Therefore, the pseudoentanglment gap between these ensembles is at most 2t2t.

2 Preliminaries

For a positive integer nn, [n]{1,2,,n}[n]\coloneqq\{1,2,\dots,n\}. For x=(a,b)𝔽22nx=(a,b)\in\mathbb{F}_{2}^{2n}, aa and bb always denote the first and last nn coordinates of xx, respectively. For vectors v1,,vkv_{1},\ldots,v_{k}, v1,,vk\langle v_{1},\ldots,v_{k}\rangle denotes their span. For matrix Xd×dX\in\mathbb{C}^{d\times d}, X1\lVert X\rVert_{1} denotes the sum of the absolute values of its singular values (known as the trace norm, nuclear norm, or Schatten 1-norm). For quantum mixed states ρ,σ\rho,\sigma, disttr12ρσ1\mathrm{dist}_{\rm{tr}}\coloneqq\frac{1}{2}\lVert\rho-\sigma\rVert_{1} is the trace distance. For us, log\log denotes the logarithm with base 22, and ln\ln is the logarithm with base e2.718e\approx 2.718.

Let ABA\sqcup B be a partition of [n][n]. We refer to (A,B)(A,B) as a cut of nn qubits. Let ρ\rho be an nn-qubit quantum state. The entanglement entropy across (A,B)(A,B) is defined as

𝖲(ρA)tr(ρAlogρA)=tr(ρBlogρB),\mathsf{S}(\rho_{A})\coloneqq-\mathrm{tr}(\rho_{A}\log\rho_{A})=-\mathrm{tr}(\rho_{B}\log\rho_{B}),

where ρA=trB(ρ)\rho_{A}=\mathrm{tr}_{B}(\rho) and ρB=trA(ρ)\rho_{B}=\mathrm{tr}_{A}(\rho) are the states obtained by tracing out BB and AA, respectively.

Define the binary entropy function 𝖧(p)\mathsf{H}(p) by

𝖧(p)=plog(p)(1p)log(1p).\mathsf{H}(p)=-p\log(p)-(1-p)\log(1-p).

The following is a well-known upper bound on 𝖧(p)\mathsf{H}(p).

Fact 2.1.
𝖧(p)(4p(1p))1/ln4ep1/ln4ep0.72.\mathsf{H}(p)\leq\left(4p(1-p)\right)^{1/\ln 4}\leq e\cdot p^{1/\ln 4}\leq e\cdot p^{0.72}.

If two states are close in trace distance, then so is their entanglement entropy.

Lemma 2.2 (Fannes-Audenaert inequality [Aud07, Theorem 1]).

Let ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi} and σ=|ϕϕ|\sigma=\ket{\phi}\!\!\bra{\phi} be nn-qubit states satisfying disttr(|ψ,|ϕ)ε\mathrm{dist}_{\mathrm{tr}}(\ket{\psi},\ket{\phi})\leq\varepsilon, and let AB=[n]A\sqcup B=[n] be a partition. Then

|𝖲(ρA)𝖲(σA)|εn+𝖧(ε)|\mathsf{S}(\rho_{A})-\mathsf{S}(\sigma_{A})|\leq\varepsilon n+\mathsf{H}(\varepsilon)

2.1 Symplectic Vector Spaces and Weyl Operators

There is a deep connection between quantum information and symplectic vector spaces over 𝔽2\mathbb{F}_{2} that we leverage throughout this work. Many in the quantum information and theoretical computer science communities may not be familiar with this connection, so we take care to review these notions here.

To obtain a symplectic vector space, one must equip a vector space with a symplectic form.

Definition 2.3 (Symplectic form).

Let VV be a vector space over a field 𝔽\mathbb{F}. A symplectic form is a mapping ω:V×V𝔽\omega:V\times V\to\mathbb{F} that satisfies the following conditions.

  1. 1.

    Bilinear: ω\omega is linear in each argument separately.

  2. 2.

    Alternating: For all vVv\in V, ω(v,v)=0\omega(v,v)=0.

  3. 3.

    Non-degenerate: If for all vVv\in V, ω(u,v)=0\omega(u,v)=0, then u=0u=0.

A symplectic vector space is a pair (V,ω)(V,\omega), where VV is a vector space and ω\omega is a symplectic form. We will equip 𝔽22n\mathbb{F}_{2}^{2n} with the standard symplectic form, which we refer to as the symplectic product.

Definition 2.4 (Symplectic product).

For x,y𝔽22nx,y\in\mathbb{F}_{2}^{2n}, we define the symplectic product as [x,y]=x1yn+1+x2yn+2++xny2n+xn+1y1+xn+2y2++x2nyn[x,y]=x_{1}\cdot y_{n+1}+x_{2}\cdot y_{n+2}+\dots+x_{n}\cdot y_{2n}+x_{n+1}\cdot y_{1}+x_{n+2}\cdot y_{2}+\dots+x_{2n}\cdot y_{n}.

In this work, one should always view 𝔽22n\mathbb{F}_{2}^{2n} as a symplectic vector space equipped with the symplectic product.

The symplectic product allows us to define the symplectic complement.

Definition 2.5 (Symplectic complement).

Let TF22nT\subseteq F_{2}^{2n} be a subspace. The symplectic complement of TT, denoted by TT^{\perp}, is defined by

T{a𝔽22n:xT,[x,a]=0}.T^{\perp}\coloneqq\{a\in\mathbb{F}_{2}^{2n}:\forall x\in T,[x,a]=0\}.

We will also need the notion of isotropic and symplectic subspaces.

Definition 2.6 (Isotropic subspace).

A subspace W𝔽22nW\subseteq\mathbb{F}_{2}^{2n} is isotropic when WWW\subseteq W^{\perp}. Equivalently, WW is isotropic if and only if [w1,w2]=0[w_{1},w_{2}]=0 for all w1,w2Ww_{1},w_{2}\in W.

Definition 2.7 (Symplectic subspace).

A subspace W𝔽22nW\subseteq\mathbb{F}_{2}^{2n} is symplectic when WW={0}W\cap W^{\perp}=\{0\}.

Every symplectic space has a standard basis, which we refer to as the symplectic basis.

Fact 2.8.

Any 2d2d-dimensional symplectic space over 𝔽2\mathbb{F}_{2} has a basis {x1,,xd,z1,,zd}\{x_{1},\dots,x_{d},z_{1},\dots,z_{d}\} such that

[xi,zj]=δijand[xi,xj]=[zi,zj]=0.[x_{i},z_{j}]=\delta_{ij}\qquad\text{and}\qquad[x_{i},x_{j}]=[z_{i},z_{j}]=0.

Any basis with the above form is referred to as a symplectic basis.

The direct sum of two symplectic vector spaces is also symplectic. This is a basic fact, but we include a proof for completeness.

Fact 2.9.

If V,WV,W are symplectic vector spaces over 𝔽2\mathbb{F}_{2}, so is their direct sum.

Proof.

Denote the symplectic forms on VV and WW by ωV\omega_{V} and ωW\omega_{W}, respectively. Let AVWA\coloneqq V\oplus W, where VW={(v,w):vV,wW}V\oplus W=\{(v,w):v\in V,w\in W\}. Define the form ωA\omega_{A} on AA by ωA(a1,a2)=ωV(v1,v2)+ωW(w1,w2)\omega_{A}(a_{1},a_{2})=\omega_{V}(v_{1},v_{2})+\omega_{W}(w_{1},w_{2}) where ai=vi+wia_{i}=v_{i}+w_{i}. We will prove that (A,ωA)(A,\omega_{A}) is symplectic.

It is obvious that AA is a vector space, so it remains to prove that ωA\omega_{A} is a symplectic form. Recall from Definition 2.3 that we must show that ωA\omega_{A} is bilinear, alternating, and non-degenerate. It is clear that ωA\omega_{A} is bilinear because it is the sum of two bilinear forms. For a=(v,w)Aa=(v,w)\in A, we have ωA(a,a)=ωV(v,v)+ωW(w,w)=0\omega_{A}(a,a)=\omega_{V}(v,v)+\omega_{W}(w,w)=0, so ωA\omega_{A} is alternating.

Finally, we prove that ωA\omega_{A} is non-degenerate. Suppose we have an element a=(v,w)a=(v,w) such that for all aAa^{\prime}\in A we have ωA(a,a)=ωV(v,v)+ωW(w,w)=0\omega_{A}(a,a^{\prime})=\omega_{V}(v,v^{\prime})+\omega_{W}(w,w^{\prime})=0. Now choose a vVv^{\prime}\in V such that [v,v]=0[v,v^{\prime}]=0 (one must exist since VV is symplectic). ωA(a,a)=ωV(v,v)+ωW(w,w)=0\omega_{A}(a,a^{\prime})=\omega_{V}(v,v^{\prime})+\omega_{W}(w,w^{\prime})=0 by assumption, and, because ωV(v,v)=0\omega_{V}(v,v^{\prime})=0, it follows that ωW(w,w)=0\omega_{W}(w,w^{\prime})=0 for all wWw^{\prime}\in W. Since ωW\omega_{W} is non-degenerate, w=0w=0. A similar argument shows that v=0v=0. Therefore, ωA\omega_{A} is non-degenerate. ∎

Each element of 𝔽22n\mathbb{F}_{2}^{2n} can be identified with a Weyl operator. For x=(a,b)𝔽22nx=(a,b)\in\mathbb{F}_{2}^{2n}, let a,ba^{\prime},b^{\prime} be the embeddings of a,ba,b into n\mathbb{Z}^{n}, respectively. Then the Weyl operator WxW_{x} is defined as

Wxiab(Xa1Za1)(XanZbn).W_{x}\coloneqq i^{a^{\prime}\cdot b^{\prime}}(X^{a_{1}}Z^{a_{1}})\otimes\dots\otimes(X^{a_{n}}Z^{b_{n}}).

The symplectic structure of 𝔽22n\mathbb{F}_{2}^{2n} respects the commutation relations of the Weyl operators. Specifically, for x,y𝔽22nx,y\in\mathbb{F}_{2}^{2n}, [x,y]=0[x,y]=0 iff WxWy=WyWxW_{x}W_{y}=W_{y}W_{x}. Therefore, working with symplectic vector spaces lets us discard cruft while retaining relevant algebraic structure. We also note that Weyl operators form an orthogonal basis of 2n×2n\mathbb{C}^{2^{n}\times 2^{n}} with respect to the Hilbert-Schmidt inner product, so every quantum state and unitary transformation can be written as a linear combination of Weyl operators.

We define 𝒵0n×𝔽2n\mathcal{Z}\coloneqq 0^{n}\times\mathbb{F}_{2}^{n} as the subset of 𝔽22n\mathbb{F}_{2}^{2n} corresponding to Pauli-ZZ strings. We define the unsigned stabilizer group of a quantum state as the subspace of 𝔽22n\mathbb{F}_{2}^{2n} that stabilizes or anti-stabilizes the state.

Definition 2.10 (Unsigned stabilizer group).

Given an nn-qubit quantum state |ψ\ket{\psi}, Weyl(|ψ){x𝔽22n:Wx|ψ=±|ψ}\mathrm{Weyl}(\ket{\psi})\coloneqq\{x\in\mathbb{F}_{2}^{2n}:W_{x}\ket{\psi}=\pm\ket{\psi}\} is the unsigned stabilizer group of |ψ\ket{\psi}.

It is easy to verify that Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) is an isotropic subspace. We define the stabilizer dimension, which quantifies the size of the Pauli group stabilizing a given state.

Definition 2.11 (Stabilizer dimension).

Let |ψ\ket{\psi} be a nn-qubit pure state. The stabilizer dimension of |ψ\ket{\psi} is the dimension of Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) as a subspace of 𝔽22n\mathbb{F}_{2}^{2n}.

The stabilizer dimension of a state is closely related to the number of non-Clifford gates required to prepare it.

Fact 2.12 ([GIKL23c, Lemma 4.2]).

Let |ψ\ket{\psi} be an nn-qubit state which is the output of a Clifford circuit with at most tt single-qubit non-Clifford gates. Then |ψ\ket{\psi} has stabilizer dimension at least n2tn-2t.

For a Clifford circuit CC and any x𝔽22nx\in\mathbb{F}_{2}^{2n}, we define C(x)C(x) to be the y𝔽22ny\in\mathbb{F}_{2}^{2n} such that Wy=±CWxCW_{y}=\pm CW_{x}C^{\dagger}. We can extend this notation to subsets SS of 𝔽22n\mathbb{F}_{2}^{2n} by writing C(S)={C(x):xS}C(S)=\{C(x):x\in S\}. Conjugation by any Clifford circuit is an automorphism of the Pauli group. Furthermore, C(x)C(x) preserves the symplectic form.

Fact 2.13.

For any Clifford circuit CC and x,y𝔽22nx,y\in\mathbb{F}_{2}^{2n}, [C(x),C(y)]=[x,y][C(x),C(y)]=[x,y].

Proof.

Recall that WC(x)WC(y)=(1)[C(x),C(y)]WC(y)WC(x)W_{C(x)}W_{C(y)}=(-1)^{[C(x),C(y)]}W_{C(y)}W_{C(x)}. Suppose that WC(x)=(1)c1CWxCW_{C(x)}=(-1)^{c_{1}}CW_{x}C^{\dagger} and WC(y)=(1)c2CWyCW_{C(y)}=(-1)^{c_{2}}CW_{y}C^{\dagger}. We have

WC(x)WC(y)\displaystyle W_{C(x)}W_{C(y)} =(1)c1+c2CWxCCWyC\displaystyle=(-1)^{c_{1}+c_{2}}CW_{x}C^{\dagger}CW_{y}C^{\dagger}
=(1)c1+c2CWxWyC\displaystyle=(-1)^{c_{1}+c_{2}}CW_{x}W_{y}C^{\dagger}
=(1)[x,y](1)c1+c2CWyWxC\displaystyle=(-1)^{[x,y]}(-1)^{c_{1}+c_{2}}CW_{y}W_{x}C^{\dagger}
=(1)[x,y](1)c1+c2CWyCCWxC\displaystyle=(-1)^{[x,y]}(-1)^{c_{1}+c_{2}}CW_{y}C^{\dagger}CW_{x}C^{\dagger}
=(1)[x,y]WC(y)WC(x).\displaystyle=(-1)^{[x,y]}W_{C(y)}W_{C(x)}.

Thus [C(x),C(y)]=[x,y][C(x),C(y)]=[x,y]. ∎

Since the inverse of any Clifford circuit is itself a Clifford circuit, we have the following as a simple corollary:

Corollary 2.14.

Given a subspace H𝔽22nH\subseteq\mathbb{F}_{2}^{2n} and a Clifford circuit CC, HH is isotropic (resp. symplectic) if and only if C(H)C(H) is isotropic (resp. symplectic).

Finally, we remark on Bell difference sampling [Mon17, GNW21], an algorithmic primitive used in this work. Define pψ(x)2nψ|Wx|ψ2p_{\psi}(x)\coloneqq 2^{-n}\braket{\psi|W_{x}|\psi}^{2}. Bell difference sampling is a quantum measurement that takes four copies of a state |ψ\ket{\psi}, and produces a sample x𝔽22nx\in\mathbb{F}_{2}^{2n} drawn from the distribution qψq_{\psi} which is defined as

qψ(x)a𝔽22npψ(a)pψ(x+a).q_{\psi}(x)\coloneqq\sum_{a\in\mathbb{F}_{2}^{2n}}p_{\psi}(a)p_{\psi}(x+a).

This process takes O(n)O(n) time. We refer readers to [GIKL23c, Section 2] for further detail.

3 Entanglement Entropy Bounds

We prove upper and lower bounds on the entanglement entropy across any cut of qubits for any nn-qubit quantum state |ψ\ket{\psi}. The quality of our bounds depends on Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}). For example, if dim(Weyl(|ψ))=0\dim(\mathrm{Weyl}(\ket{\psi}))=0, our bounds become trivial, and, if dim(Weyl(|ψ))=n\dim(\mathrm{Weyl}(\ket{\psi}))=n (i.e., |ψ\ket{\psi} is a stabilizer state), our bounds are tight, recovering the main result of [FCY+04].

To state our bounds, we must introduce some notation. Let A[n]A\subseteq[n] be a subset of qubits, and let SS be a subspace of 𝔽22n\mathbb{F}_{2}^{2n}. We denote by SAS_{A} the intersection of SS with operators that act only on qubits indexed by AA. In symbols, we can express this as follows:

SA{(x,z)S:i[n]A,xi=zi=0}.S_{A}\coloneqq\{(x,z)\in S:\forall i\in[n]\setminus A,x_{i}=z_{i}=0\}.

So, for example,

𝒵A{(0n,z)𝔽22n:i[n]A,zi=0}\mathcal{Z}_{A}\coloneqq\{(0^{n},z)\in\mathbb{F}_{2}^{2n}:\forall i\in[n]\setminus A,z_{i}=0\}

are essentially the Pauli-ZZ strings that act on the qubits indexed by AA.

Computationally speaking, one can compute SAS_{A} efficiently, given a basis of SS, by solving a system of linear constraints to zero all coordinates corresponding to i[n]Ai\in[n]\setminus A.

In the remainder of this section, we prove the following theorem.

Theorem 3.1.

Let ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi} be an nn-qubit quantum state and let AB=[n]A\sqcup B=[n] be a partition of qubits. Then

dim(Weyl(|ψ))dim(Weyl(|ψ)B)|A|𝖲(ρA)|A|dim(Weyl(|ψ)A).\dim\left(\mathrm{Weyl}(\ket{\psi})\right)-\dim\left(\mathrm{Weyl}(\ket{\psi})_{B}\right)-\lvert A\rvert\leq\mathsf{S}(\rho_{A})\leq\lvert A\rvert-\dim\left(\mathrm{Weyl}(\ket{\psi})_{A}\right).

3.1 Proof of Upper Bound

Lemma 3.2.

Let ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi} be an nn-qubit quantum state and let A[n]A\subseteq[n] be a partition of qubits. Then

𝖲(ρA)|A|dim(Weyl(|ψ)A).\mathsf{S}(\rho_{A})\leq\lvert A\rvert-\dim\left(\mathrm{Weyl}(\ket{\psi})_{A}\right).
Proof.

Let AAA^{\prime}\subseteq A be any set of size dim(Weyl(|ψ)A)\dim(\mathrm{Weyl}(\ket{\psi})_{A}). By known techniques, one can find a Clifford circuit CC acting only on AA that maps the Paulis in Weyl(|ψ)A\mathrm{Weyl}(\ket{\psi})_{A} to 𝒵A\mathcal{Z}_{A^{\prime}}.444An explicit algorithm for computing this CC can be found in [GIKL23a, Section 3]. As a consequence, this CC behaves as C|ψ=|xA|ϕ[n]AC\ket{\psi}=\ket{x}_{A^{\prime}}\ket{\phi}_{[n]\setminus A^{\prime}}, where |xA\ket{x}_{A^{\prime}} is a computational basis state on AA^{\prime} and |ϕ[n]A\ket{\phi}_{[n]\setminus A^{\prime}} is an arbitrary state on the remaining qubits. Because CC is local to AA, it does not affect the entanglement entropy across the partition. Furthermore, it is clear that the qubits |xA\ket{x}_{A^{\prime}} are unentangled from the rest of the system. As such, only the qubits in AAA\setminus A^{\prime} can exhibit entanglement across the partition, and there are |A||A|=|A|dim(Weyl(|ψ)A)\lvert A\rvert-\lvert A^{\prime}\rvert=\lvert A\rvert-\dim\left(\mathrm{Weyl}(\ket{\psi})_{A}\right) many such qubits. So, the entanglement entropy across the partition is bounded above by |A|dim(Weyl(|ψ)A)\lvert A\rvert-\dim\left(\mathrm{Weyl}(\ket{\psi})_{A}\right). ∎

3.2 Proof of Lower Bound

Lemma 3.3.

Let V𝔽22nV\subseteq\mathbb{F}_{2}^{2n} be a symplectic subspace of dimension 2v2v and have SVS\subseteq V be a subspace of dimension v+kv+k. There exists a symplectic subspace TST\subseteq S with dimension at least 2k2k.

Proof.

Take any nonzero e1Se_{1}\in S. Because dim(S)>v\dim(S)>v, there exists some f1Sf_{1}\in S such that [e1,f1]=1[e_{1},f_{1}]=1. Let W1W_{1} be the span of e1e_{1} and f1f_{1}. We will prove that S=W1(W1S)S=W_{1}\oplus\left(W_{1}^{\perp}\cap S\right) is a direct sum. First, we argue that W1(W1S)={0}W_{1}\cap\left(W_{1}^{\perp}\cap S\right)=\{0\}.555In fact, because W1W_{1} is symplectic, even W1W1={0}W_{1}\cap W_{1}^{\perp}=\{0\}. Take zW1z\in W_{1}. Since WW is the span of e1e_{1} and f1f_{1}, we can write z=αe1+βf1z=\alpha e_{1}+\beta f_{1}. If zz is also in WSWW^{\perp}\cap S\subseteq W^{\perp}, then 0=[x,z]=β0=[x,z]=\beta and 0=[y,z]=α0=[y,z]=\alpha, so z=0z=0. Next, we prove that any vSv\in S can be written as a sum of w1W1w_{1}\in W_{1} and w1cW1Sw_{1}^{c}\in W_{1}^{\perp}\cap S. Clearly w1[v,e1]f1+[v,f1]e1W1w_{1}\coloneqq[v,e_{1}]f_{1}+[v,f_{1}]e_{1}\in W_{1}, and define w1cv+[v,e1]f1+[v,f1]e1w_{1}^{c}\coloneqq v+[v,e_{1}]f_{1}+[v,f_{1}]e_{1}. It is easy to check [e1,w1c]=[f1,w1c]=0[e_{1},w_{1}^{c}]=[f_{1},w_{1}^{c}]=0, so w1cW1w_{1}^{c}\in W_{1}^{\perp}. Furthermore, if since e1,f1W1Se_{1},f_{1}\in W_{1}\subset S, w1cSw_{1}^{c}\in S as well. It is clear that v=w1+w1cv=w_{1}+w_{1}^{c}.

Repeat this process to collect pairs (e1,f1),,(er,fr)(e_{1},f_{1}),\dots,(e_{r},f_{r}) until we have that Sj=1rWjS\cap_{j=1}^{r}W_{j}^{\perp} doesn’t contain an er+1e_{r+1} and fr+1f_{r+1} such that [er+1,fr+1]=1[e_{r+1},f_{r+1}]=1. Observe by linearity that any object in xj=1rWjx\in\cap_{j=1}^{r}W_{j}^{\perp} must have [x,y]=0[x,y]=0 for all yi=1rWiy\in\bigoplus_{i=1}^{r}W_{i}. Consequently, Sj=1rWje1,,erS\cap_{j=1}^{r}W_{j}^{\perp}\oplus\langle e_{1},\ldots,e_{r}\rangle is an isotropic subspace of dimension v+krv+k-r. Since all isotropic subspaces within VV must have dimension at most vv,

v+krvrk.v+k-r\leq v\implies r\geq k.

Hence, i=1rWi\bigoplus_{i=1}^{r}W_{i} has dimension at least 2k2k. Since each WiW_{i} is symplectic, their direct sum is symplectic by 2.9. ∎

Lemma 3.4.

Let ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi} be an nn-qubit quantum state and let AB=[n]A\sqcup B=[n] be a partition of qubits. Then

𝖲(ρA)dim(Weyl(|ψ))dim(Weyl(|ψ)B)|A|.\mathsf{S}(\rho_{A})\geq\dim\left(\mathrm{Weyl}(\ket{\psi})\right)-\dim\left(\mathrm{Weyl}(\ket{\psi})_{B}\right)-\lvert A\rvert.
Proof.

Let {bi}i\{b_{i}\}_{i} be a basis for Weyl(|ψ)B\mathrm{Weyl}(\ket{\psi})_{B}, and let {ei}i\{e_{i}\}_{i} be an extension such that, together, they span Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}). Define the subspace S{ei}iS\coloneqq\langle\{e_{i}\}_{i}\rangle. Clearly dim(S)=dim(Weyl(|ψ))dim(Weyl(|ψ)B)\dim(S)=\dim(\mathrm{Weyl}(\ket{\psi}))-\dim(\mathrm{Weyl}(\ket{\psi})_{B}) and S(𝔽22n)B={0}S\cap\left(\mathbb{F}_{2}^{2n}\right)_{B}=\{0\}. Define eiA(𝔽22n)Ae^{A}_{i}\in\left(\mathbb{F}_{2}^{2n}\right)_{A} to be eie_{i} except with the coordinates not in AA set to 0.

Define SA{eiA}iS^{A}\coloneqq\langle\{e^{A}_{i}\}_{i}\rangle.

  • Claim 3.5.

    dim(SA)=dim(S)=dim(Weyl(|ψ))dim(Weyl(|ψ)B)\dim(S^{A})=\dim(S)=\dim(\mathrm{Weyl}(\ket{\psi}))-\dim(\mathrm{Weyl}(\ket{\psi})_{B})

    Proof.

    dim(S)dim(SA)\dim(S)\geq\dim(S^{A}) is trivial, so we just need to argue that the vectors {eiA}i\{e_{i}^{A}\}_{i} are linearly independent. For the sake of contradiction, assume they’re not, i.e., that there exists some set of indices I[dim(S)]I\subseteq[\dim(S)] such that iIeiA=0\sum_{i\in I}e^{A}_{i}=0. Note that iIei0\sum_{i\in I}e_{i}\neq 0 because is {ei}i\{e_{i}\}_{i} is a basis by construction. Therefore, iIei\sum_{i\in I}e_{i} will be zero on the coordinates of AA, but not BB. That is, iIeiWeyl(|ψ)B\sum_{i\in I}e_{i}\in\mathrm{Weyl}(\ket{\psi})_{B}, a contradiction. We conclude that dim(SA)=dim(Weyl(|ψ))dim(Weyl(|ψ)B)\dim(S^{A})=\dim(\mathrm{Weyl}(\ket{\psi}))-\dim(\mathrm{Weyl}(\ket{\psi})_{B}). ∎

(𝔽22n)A(\mathbb{F}_{2}^{2n})_{A} is a symplectic subspace, and each eiA(𝔽22n)Ae^{A}_{i}\in(\mathbb{F}_{2}^{2n})_{A}. Therefore, SAS^{A} is a subspace of a 2|A|2\lvert A\rvert-dimensional symplectic subspace. By Lemma 3.3, there must exist some symplectic subspace TASAT^{A}\subseteq S^{A} of dimension at least 2(dim(SA)|A|)=2(dim(Weyl(|ψ))dim(Weyl(|ψ)B)|A|)2\left(\dim\left(S^{A}\right)-\lvert A\rvert\right)=2\left(\dim\left(\mathrm{Weyl}(\ket{\psi})\right)-\dim\left(\mathrm{Weyl}(\ket{\psi})_{B}\right)-\lvert A\rvert\right). Let {tiA}i\{t_{i}^{A}\}_{i} be a symplectic basis of TAT^{A}. We can express each basis element as tiA=jαjejAt_{i}^{A}=\sum_{j}\alpha_{j}e^{A}_{j} for some setting of αj{0,1}\alpha_{j}\in\{0,1\}. Define tijαjejt_{i}\coloneqq\sum_{j}\alpha_{j}e_{j}, and observe that their span defines a subspace T𝔽22nT\subseteq\mathbb{F}_{2}^{2n} that shares the same dimension as TT^{\prime}. We can then similarly define tiB(𝔽22n)Bt^{B}_{i}\in\left(\mathbb{F}_{2}^{2n}\right)_{B} to be tit_{i} except with the coordinates not in BB set to 0. Observe that ti=tiA+tiBt_{i}=t^{A}_{i}+t^{B}_{i}. By the linearity of the symplectic product and the fact that Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) is isotropic,

0=[ti,tj]=[tiA,tjA]+[tiB,tjB][tiA,tjA]=[tiB,tjB].0=[t_{i},t_{j}]=[t^{A}_{i},t^{A}_{j}]+[t^{B}_{i},t^{B}_{j}]\implies[t^{A}_{i},t^{A}_{j}]=[t^{B}_{i},t^{B}_{j}].

Therefore, {tiB}\{t_{i}^{B}\} is also a symplectic basis for a symplectic subspace of (𝔽22n)B\left(\mathbb{F}_{2}^{2n}\right)_{B}.

Using a Clifford circuit CAC^{A} acting locally on the qubits in AA, we can perform the symplectic map that takes {tiA}\{t_{i}^{A}\} to the symplectic basis of (𝔽22n)A\left(\mathbb{F}_{2}^{2n}\right)_{A^{\prime}} where AAA^{\prime}\subset A and |A|=dim(T)\lvert A^{\prime}\rvert=\dim(T).666Again, this mapping is described in detail in [GIKL23a, Section 3]. Note that CA(tiB)=tiBC^{A}(t_{i}^{B})=t_{i}^{B}. Using a second Clifford circuit CBC^{B} acting locally on the qubits in BB, we can take {tiB}\{t_{i}^{B}\} to the symplectic basis of (𝔽22n)B\left(\mathbb{F}_{2}^{2n}\right)_{B^{\prime}} where BBB^{\prime}\subset B and |B|=|A|=dim(T)\lvert B^{\prime}\rvert=\lvert A^{\prime}\rvert=\dim(T). Note CB(CA(tiA))=CA(tiA)C^{B}(C^{A}(t_{i}^{A}))=C^{A}(t_{i}^{A}).

  • Claim 3.6.

    CB(CA(T))C^{B}(C^{A}(T)) is a Lagrangian subspace of (𝔽22n)AB\left(\mathbb{F}_{2}^{2n}\right)_{A^{\prime}\sqcup B^{\prime}}.

    Proof.

    It is clear from the actions of CAC^{A} and CBC^{B} that each CB(CA(ti))C^{B}(C^{A}(t_{i})) is a member of (𝔽22n)AB\left(\mathbb{F}_{2}^{2n}\right)_{A^{\prime}\sqcup B^{\prime}}. Furthermore, dim(CB(CA(T)))=dim(T)\dim\left(C^{B}(C^{A}(T))\right)=\dim(T), which is half the dimension of (𝔽22n)AB\left(\mathbb{F}_{2}^{2n}\right)_{A^{\prime}\sqcup B^{\prime}}. Finally, since CB(CA(Weyl(|ψ)))C^{B}\left(C^{A}\left(\mathrm{Weyl}(\ket{\psi})\right)\right) is isotropic, so too must CB(CA(T))C^{B}(C^{A}(T)) as a subset of CB(CA(Weyl(|ψ)))C^{B}\left(C^{A}\left(\mathrm{Weyl}(\ket{\psi})\right)\right). ∎

We conclude that the state of the qubits indexed by ABA^{\prime}\sqcup B^{\prime} is a stabilizer state |ϕ\ket{\phi} of 2dim(T)2\dim(T) qubits that is unentangled from the rest of the system.

Our last step is to prove that CB(CA(T))B={0}C^{B}(C^{A}(T))_{B^{\prime}}=\{0\}, which will imply that the entanglement across (A,B)(A^{\prime},B^{\prime}) is dim(T)/2\dim(T)/2 by [FCY+04, Eq. 1]. First recall that S(𝔽22n)B={0}S\cap\left(\mathbb{F}_{2}^{2n}\right)_{B}=\{0\} by construction, which implies T(𝔽22n)B={0}T\cap\left(\mathbb{F}_{2}^{2n}\right)_{B}=\{0\} because TST\subseteq S. Next, we note that CAC^{A} has no effect on (𝔽22n)B\left(\mathbb{F}_{2}^{2n}\right)_{B} since its action is local to AA. Furthermore, CBC^{B} simply permutes (𝔽22n)B\left(\mathbb{F}_{2}^{2n}\right)_{B} (and cannot map elements into (𝔽22n)B)(\mathbb{F}_{2}^{2n})_{B}). Hence,

CB(CA(T))(𝔽22n)B=CB(CA(T))CB(CA((𝔽22n)B)=T(𝔽22n)B={0}.C^{B}(C^{A}(T))\cap\left(\mathbb{F}_{2}^{2n}\right)_{B}=C^{B}(C^{A}(T))\cap C^{B}(C^{A}(\left(\mathbb{F}_{2}^{2n}\right)_{B})=T\cap\left(\mathbb{F}_{2}^{2n}\right)_{B}=\{0\}.

Finally, since (𝔽22n)B(𝔽22n)B\left(\mathbb{F}_{2}^{2n}\right)_{B^{\prime}}\subseteq\left(\mathbb{F}_{2}^{2n}\right)_{B},

CB(CA(T))B=CB(CA(T))(𝔽22n)B={0}.C^{B}(C^{A}(T))_{B^{\prime}}=C^{B}(C^{A}(T))\cap\left(\mathbb{F}_{2}^{2n}\right)_{B^{\prime}}=\{0\}.

Because CAC^{A} and CBC^{B} act locally on AA and BB respectively, they do not change the entanglement between AA and BB, thus completing the proof. ∎

4 The Algorithm

We present and analyze our algorithm for estimating the entanglement entropy across any bipartition of qubits. At a high level, our algorithm computes the upper and lower bounds given in Theorem 3.1. The details are presented below in Algorithm 1.


Input: 8ln(1/δ)+16nε2\frac{8\ln(1/\delta)+16n}{\varepsilon^{2}} copies of ρ=|ψψ|\rho=\ket{\psi}\!\!\bra{\psi}, AB=[n]A\sqcup B=[n], ε(0,3/8)\varepsilon\in(0,3/8), and δ(0,1]\delta\in(0,1]
Promise : |ψ\ket{\psi} has stabilizer dimension at least nkn-k
Output: ,u\ell,u\in\mathbb{R} such that 𝖲(ρA)u\ell\leq\mathsf{S}(\rho_{A})\leq u and 0uk+max{0,2(εn+𝖧(ε))1}0\leq u-\ell\leq k+\max\{0,2(\varepsilon n+\mathsf{H}(\varepsilon))-1\}, with probability at least 1δ1-\delta
1
2Perform Bell difference sampling to draw 2ln(1/δ)+4nε2\frac{2\ln(1/\delta)+4n}{\varepsilon^{2}} samples from qψq_{\psi}.
3Let SS be the symplectic complement of the subspace spanned by the samples.
4Let r{0dim(S)=nk,εn+𝖧(ε)dim(S)>nk.r\coloneqq\begin{cases}0&\dim(S)=n-k,\\ \varepsilon n+\mathsf{H}(\varepsilon)&\dim(S)>n-k.\end{cases}
5Let umin{|A|dimSA,|B|dimSB}+ru\coloneqq\min\{|A|-\dim S_{A},|B|-\dim S_{B}\}+r.
6Let max{dimSdimSB|A|,dimSdimSA|B|}r\ell\coloneqq\max\{\dim S-\dim S_{B}-|A|,\dim S-\dim S_{A}-|B|\}-r.
7return (,u)(\ell,u)
Algorithm 1 Estimating Entanglement Entropy

Let us make a few remarks on Algorithm 1. Note that the bounds (u,)(u,\ell) produced by our algorithm are within a range of k+max{0,2(εn+𝖧(ε))1}k+\max\{0,2\left(\varepsilon n+\mathsf{H}(\varepsilon)\right)-1\} rather than k+2(εn+𝖧(ε))k+2\left(\varepsilon n+\mathsf{H}(\varepsilon)\right) as one might naïvely expect. This comes from a subtle case in our analysis, the details of which are contained in the proof of Theorem 4.3. We observe that in the case where our sampling procedure happens to find the exact subspace Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}), we no longer need to apply Lemma 2.2. Conversely, when our sampling procedure fails to find Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}) exactly, the distance between the bounds in Lemmas 3.4 and 3.2 decreases by at least 11.

We also note that the Bell difference sampling procedure only needs to be performed once. After that, one can compute entanglement entropy bounds across any cut of qubits with only classical post-processing.

To prove the correctness of Algorithm 1, we use the following two statements. The first is about the time complexity of computing symplectic complements. The second says that Bell difference sampling suffices to approximately recover Weyl(|ψ)\mathrm{Weyl}(\ket{\psi}).

Fact 4.1 ([GIKL23a, Lemma 3.1]).

Given a set of mm vectors whose span is a subspace H𝔽22nH\subseteq\mathbb{F}_{2}^{2n}, there is an algorithm that outputs a basis for HH^{\perp} in O(mnmin(m,n))O\left(mn\cdot\min(m,n)\right) time.

Lemma 4.2 ([GIKL23a, Proof of Theorem 5.1]).

Let |ψ\ket{\psi} have stabilizer dimension at least nkn-k, and let SS be the symplectic complement of the space spanned by 2ln(1/δ)+4nε\frac{2\ln(1/\delta)+4n}{\varepsilon} samples from qψq_{\psi}, for some ε(0,3/8)\varepsilon\in(0,3/8). Then with probability at least 1δ1-\delta, there exists a state |ϕ\ket{\phi} such that S=Weyl(|ϕ)Weyl(|ψ)S=\mathrm{Weyl}(\ket{\phi})\supseteq\mathrm{Weyl}(\ket{\psi}) and |ψ|ϕ|21ε\lvert\braket{\psi|\phi}\rvert^{2}\geq 1-\varepsilon.

We now show our main result, namely that Algorithm 1 is correct as specified.

Theorem 4.3.

Algorithm 1 is correct and runs in time O(n3+n2log(1/δ)ε2)O\left(\frac{n^{3}+n^{2}\log(1/\delta)}{\varepsilon^{2}}\right).

Proof.

Let SS be the symplectic complement of the subspace spanned by our 2ln(1/δ)+4nε2\frac{2\ln(1/\delta)+4n}{\varepsilon^{2}} samples from qψq_{\psi}. We note that these samples take 44 copies of ρ\rho and O(n)O(n) time each, and that SS can be computed in time O(n3+n2log(1/δ)ε2)O\left(\frac{n^{3}+n^{2}\log(1/\delta)}{\varepsilon^{2}}\right) by 4.1.

By Lemma 4.2, with probability at least 1δ1-\delta, there exists a state |ϕ\ket{\phi} such that S=Weyl(|ϕ)Weyl(|ψ)S=\mathrm{Weyl}(\ket{\phi})\supseteq\mathrm{Weyl}(\ket{\psi}) and |ψ|ϕ|21ε2\lvert\braket{\psi|\phi}\rvert^{2}\geq 1-\varepsilon^{2}, and therefore disttr(|ψ,|ϕ)ε\mathrm{dist}_{\mathrm{tr}}(\ket{\psi},\ket{\phi})\leq\varepsilon. Assume henceforth that SS and |ϕ\ket{\phi} satisfy these criteria. In fact, we can further assume disttr(|ψ,|ϕ)d\mathrm{dist}_{\mathrm{tr}}(\ket{\psi},\ket{\phi})\leq d, where

d{0dim(S)=nk,εdim(S)>nk,d\coloneqq\begin{cases}0&\dim(S)=n-k,\\ \varepsilon&\dim(S)>n-k,\end{cases}

because if dim(S)=nk\dim(S)=n-k, we must have S=Weyl(|ψ)S=\mathrm{Weyl}(\ket{\psi}), and hence we can choose |ϕ=|ψ\ket{\phi}=\ket{\psi}.

Let σ=|ϕϕ|\sigma=\ket{\phi}\!\!\bra{\phi}. By Lemma 3.2, we have

umin{|A|dimSA,|B|dimSB}𝖲(σA).u^{\prime}\coloneqq\min\{|A|-\dim S_{A},|B|-\dim S_{B}\}\geq\mathsf{S}(\sigma_{A}).

Similarly, Lemma 3.4 implies

max{dimSdimSB|A|,dimSdimSA|B|}𝖲(σA).\ell^{\prime}\coloneqq\max\{\dim S-\dim S_{B}-|A|,\dim S-\dim S_{A}-|B|\}\leq\mathsf{S}(\sigma_{A}).

Note that r=dn+𝖧(d)r=dn+\mathsf{H}(d), =r\ell=\ell^{\prime}-r, and u=u+ru=u^{\prime}+r. Recalling that disttr(|ψ,|ϕ)d\mathrm{dist}_{\mathrm{tr}}(\ket{\psi},\ket{\phi})\leq d, Lemma 2.2 implies that 𝖲(ρA)u\ell\leq\mathsf{S}(\rho_{A})\leq u. So, this establishes that uu and \ell are upper and lower bounds, respectively, on the entanglement entropy.

It remains to bound the difference between uu and \ell. Observe that

u\displaystyle u-\ell =(u+r)(r)\displaystyle=(u^{\prime}+r)-(\ell^{\prime}-r)
(|A|dimSA)(dimSdimSA|B|)+2r\displaystyle\leq(|A|-\dim S_{A})-(\dim S-\dim S_{A}-|B|)+2r
=|A|+|B|dimS+2r\displaystyle=|A|+|B|-\dim S+2r
=ndimS+2r.\displaystyle=n-\dim S+2r.

In the case where dimS=nk\dim S=n-k, we have uku-\ell\leq k. Otherwise, when dim(S)>nk\dim(S)>n-k, we have

ndimS+2r\displaystyle n-\dim S+2r n(nk+1)+2r\displaystyle\leq n-(n-k+1)+2r
=k+2r1\displaystyle=k+2r-1
=k+2(εn+𝖧(ε))1.\displaystyle=k+2(\varepsilon n+\mathsf{H}(\varepsilon))-1.

In both cases, for all SWeyl(|ψ)S\supseteq\mathrm{Weyl}(\ket{\psi}), we have

uk+max{0,2r1},u-\ell\leq k+\max\left\{0,2r-1\right\},

which completes the proof. ∎

If we take ε\varepsilon to be sufficiently small, we can disregard the additional additive error 2r12r-1.

Corollary 4.4.

By setting ε=18n\varepsilon=\frac{1}{8n}, Algorithm 1 outputs upper and lower bounds on the entanglement entropy (u,)(u,\ell) such that uku-\ell\leq k with probability at least 1δ1-\delta. It now uses 1024n3+512n2ln(1/δ)1024n^{3}+512n^{2}\ln(1/\delta) samples of |ψ\ket{\psi} and runs in time O(n5+n4log(1/δ))O\left(n^{5}+n^{4}\log(1/\delta)\right).

Proof.

Assume n2n\geq 2, because we don’t need to compute the entanglement of a single qubit state. 2.1 tells us that 𝖧(ε)<0.37\mathsf{H}(\varepsilon)<0.37, and therefore 2(εn+H(ε))1<2(1/8+0.37)1<02(\varepsilon n+H(\varepsilon))-1<2(1/8+0.37)-1<0. So, max{0,2(εn+H(ε))1}=0\max\left\{0,2(\varepsilon n+H(\varepsilon))-1\right\}=0. We then appeal to Theorem 4.3. ∎

As a corollary, we can show a lower bound on the number of non-Clifford gates necessary to prepare pseudoentangled states.

Corollary 4.5.

Any family of Clifford circuits that produces a pseudoentangled ensemble {|Ψk,|Φk}k\{\ket{\Psi_{k}},\ket{\Phi_{k}}\}_{k} with entropy gap f(n) vs. g(n)f(n)\text{ vs. }g(n) satisfying f(n)g(n)tf(n)-g(n)\geq t must use Ω(t)\Omega(t) auxiliary non-Clifford single-qubit gates.

Proof.

Suppose tt^{\prime} non-Clifford gates are used to construct {|Ψk}k\{\ket{\Psi_{k}}\}_{k} and {|Φk}k\{\ket{\Phi_{k}}\}_{k}. We argue that if 2t<t2t^{\prime}<t, these state ensembles can be distinguished with non-negligible advantage in polynomial time.

All such states |Ψk\ket{\Psi_{k}} and |Φk\ket{\Phi_{k}} have stabilizer dimension at least n2tn-2t^{\prime}, by 2.12. The distinguisher, then, is the following: given copies of an unknown |ψ\ket{\psi} belonging to one of the two ensembles, run Algorithm 1 according to Corollary 4.4, assuming stabilizer dimension at least n2tn-2t^{\prime} and δ=1/3\delta=1/3. This produces bounds (u,)(u,\ell) on the entanglement entropy of |ψ\ket{\psi} across some fixed cut (A,B)(A,B) of size n/2n/2. Then, output that |ψ{|Ψk}k\ket{\psi}\in\{\ket{\Psi_{k}}\}_{k} if f(n)u\ell\leq f(n)\leq u, and output |ψ{|Φk}k\ket{\psi}\in\{\ket{\Phi_{k}}\}_{k} otherwise. The algorithm guesses correctly with probability at least 2/32/3, because u2tu-\ell\leq 2t^{\prime}, so at most one of f(n)f(n) and g(n)g(n) can lie between uu and \ell. ∎

Acknowledgments

We thank Tony Metger for suggesting this problem to us, and Fermi Ma for helpful conversations.

SG is supported (via Scott Aaronson) by a Vannevar Bush Fellowship from the US Department of Defense, the Berkeley NSF-QLCI CIQC Center, a Simons Investigator Award, and the Simons “It from Qubit” collaboration. VI is supported by an NSF Graduate Research Fellowship. WK acknowledges support from the U.S. Department of Energy, Office of Science, National Quantum Information Science Research Centers, Quantum Systems Accelerator. DL is supported by NSF award FET-2243659.

This work was done in part while SG, VI, and DL were visiting the Simons Institute for the Theory of Computing.

References

  • [ABF+24] Scott Aaronson, Adam Bouland, Bill Fefferman, Soumik Ghosh, Umesh Vazirani, Chenyi Zhang, and Zixin Zhou. Quantum Pseudoentanglement. In 15th Innovations in Theoretical Computer Science Conference (ITCS 2024), volume 287 of Leibniz International Proceedings in Informatics (LIPIcs), pages 2:1–2:21, 2024. doi:10.4230/LIPIcs.ITCS.2024.2.
  • [AG04] Scott Aaronson and Daniel Gottesman. Improved Simulation of Stabilizer Circuits. Physical Review A, 70(5), 2004. doi:10.1103/physreva.70.052328.
  • [AG08] Scott Aaronson and Daniel Gottesman. Identifying Stabilizer States, 2008. https://pirsa.org/08080052.
  • [AG23] Scott Aaronson and Sabee Grewal. Efficient Tomography of Non-Interacting-Fermion States. In 18th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 2023), volume 266 of Leibniz International Proceedings in Informatics (LIPIcs), pages 12:1–12:18, 2023. doi:10.4230/LIPIcs.TQC.2023.12.
  • [Aud07] Koenraad M. R. Audenaert. A sharp continuity estimate for the von Neumann entropy. Journal of Physics A: Mathematical and Theoretical, 40(28):8127, 2007. doi:10.1088/1751-8113/40/28/S18.
  • [BBC+19] Sergey Bravyi, Dan Browne, Padraic Calpin, Earl Campbell, David Gosset, and Mark Howard. Simulation of quantum circuits by low-rank stabilizer decompositions. Quantum, 3:181, 2019. doi:10.22331/q-2019-09-02-181.
  • [BG16] Sergey Bravyi and David Gosset. Improved Classical Simulation of Quantum Circuits Dominated by Clifford Gates. Phys. Rev. Lett., 116:250501, 2016. doi:10.1103/PhysRevLett.116.250501.
  • [BK05] Sergey Bravyi and Alexei Kitaev. Universal quantum computation with ideal Clifford gates and noisy ancillas. Phys. Rev. A, 71:022316, 2005. doi:10.1103/PhysRevA.71.022316.
  • [CLL23] Nai-Hui Chia, Ching-Yi Lai, and Han-Hsuan Lin. Efficient learning of tt-doped stabilizer states with single-copy measurements, 2023. arXiv:2308.07014.
  • [FCY+04] David Fattal, Toby S. Cubitt, Yoshihisa Yamamoto, Sergey Bravyi, and Isaac L. Chuang. Entanglement in the stabilizer formalism, 2004. arXiv:quant-ph/0406168.
  • [FLY22] Zhiyuan Fan, Jiatu Li, and Tianqi Yang. The Exact Complexity of Pseudorandom Functions and the Black-Box Natural Proof Barrier for Bootstrapping Results in Computational Complexity. In Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2022, page 962–975, 2022. doi:10.1145/3519935.3520010.
  • [GIKL23a] Sabee Grewal, Vishnu Iyer, William Kretschmer, and Daniel Liang. Efficient Learning of Quantum States Prepared With Few Non-Clifford Gates, 2023. arXiv:2305.13409.
  • [GIKL23b] Sabee Grewal, Vishnu Iyer, William Kretschmer, and Daniel Liang. Efficient Learning of Quantum States Prepared With Few Non-Clifford Gates II: Single-Copy Measurements, 2023. arXiv:2308.07175.
  • [GIKL23c] Sabee Grewal, Vishnu Iyer, William Kretschmer, and Daniel Liang. Improved Stabilizer Estimation via Bell Difference Sampling, 2023. arXiv:2304.13915.
  • [GIKL23d] Sabee Grewal, Vishnu Iyer, William Kretschmer, and Daniel Liang. Low-Stabilizer-Complexity Quantum States Are Not Pseudorandom. In 14th Innovations in Theoretical Computer Science Conference (ITCS 2023), volume 251 of Leibniz International Proceedings in Informatics (LIPIcs), pages 64:1–64:20, 2023. doi:10.4230/LIPIcs.ITCS.2023.64.
  • [GNW21] David Gross, Sepehr Nezami, and Michael Walter. Schur–Weyl duality for the Clifford group with applications: Property testing, a robust Hudson theorem, and de Finetti representations. Communications in Mathematical Physics, 385(3):1325–1393, 2021. doi:10.1007/s00220-021-04118-7.
  • [GOL24] Andi Gu, Salvatore F. E. Oliviero, and Lorenzo Leone. Magic-induced computational separation in entanglement theory, 2024. arXiv:2403.19610.
  • [GTB23] Tudor Giurgica-Tiron and Adam Bouland. Pseudorandomness from subset states, 2023. arXiv:2312.09206.
  • [HG23] Dominik Hangleiter and Michael J. Gullans. Bell sampling from quantum circuits, 2023. arXiv:2306.00083v1.
  • [IKOS08] Yuval Ishai, Eyal Kushilevitz, Rafail Ostrovsky, and Amit Sahai. Cryptography with Constant Computational Overhead. In Proceedings of the Fortieth Annual ACM Symposium on Theory of Computing, STOC ’08, page 433–442, 2008. doi:10.1145/1374376.1374438.
  • [LC22] Ching-Yi Lai and Hao-Chung Cheng. Learning Quantum Circuits of Some TT Gates. IEEE Transactions on Information Theory, 68(6):3951–3964, 2022. doi:10.1109/TIT.2022.3151760.
  • [LOH23] Lorenzo Leone, Salvatore F. E. Oliviero, and Alioscia Hamma. Learning t-doped stabilizer states, 2023. arXiv:2305.15398v1.
  • [LOLH22] Lorenzo Leone, Salvatore F. E. Oliviero, Seth Lloyd, and Alioscia Hamma. Learning efficient decoders for quasi-chaotic quantum scramblers, 2022. arXiv:2212.11338.
  • [Ma24] Fermi Ma. Personal communication, 2024.
  • [Mon17] Ashley Montanaro. Learning stabilizer states by Bell sampling, 2017. arXiv:1707.04012.
  • [RLCK19] Patrick Rall, Daniel Liang, Jeremy Cook, and William Kretschmer. Simulation of qubit quantum circuits via Pauli propagation. Phys. Rev. A, 99:062337, 2019. doi:10.1103/PhysRevA.99.062337.
  • [Shi02] Yaoyun Shi. Both Toffoli and Controlled-NOT need little help to do universal quantum computation, 2002. arXiv:quant-ph/0205115.
  • [Val02] Leslie G. Valiant. Quantum Circuits That Can Be Simulated Classically in Polynomial Time. SIAM Journal on Computing, 31(4):1229–1254, 2002. doi:10.1137/S0097539700377025.