Verifiable blind quantum computing (VBQC) enables a resource-limited client to securely delegate computations to an untrusted quantum server while maintaining privacy and detecting deviations from the prescribed computation. The noise-robust VBQC protocol of Leichtle et al. achieves this through a round-based structure: the client delegates multiple computation rounds and test rounds, using the test outcomes to detect cheating while tolerating honest hardware noise. The protocol's security proof involves numerous interdependent parameters, making it non-trivial to find a valid parameter set for a given hardware noise level and security target. We formalize this as a constrained optimization problem and develop a practical framework to solve it. The framework yields the protocol parameters that minimize the number of rounds for any given setup. We derive a heuristic formula for the minimal number of rounds to help understand the scaling with noise and security targets and to provide rapid resource estimation. Since the number of rounds depends on noise while the time per round depends on hardware rate, the framework also enables optimization of rate-fidelity trade-offs to minimize end-to-end runtime. We demonstrate both applications through a case study of a trapped-ion server with a measurement-only client, showing how the client's polarization control hardware specifications translate into protocol parameters and runtime estimates, providing concrete guidance for near-term implementations.
Verifiable blind quantum computing (VBQC) enables a resource-limited client to securely delegate computations to an untrusted quantum server while maintaining privacy and detecting deviations from the prescribed computation. The noise-robust VBQC protocol of Leichtle et al. achieves this through a round-based structure: the client delegates multiple computation rounds and test rounds, using the test outcomes to detect cheating while tolerating honest hardware noise. The protocol's security proof involves numerous interdependent parameters, making it non-trivial to find a valid parameter set for a given hardware noise level and security target. We formalize this as a constrained optimization problem and develop a practical framework to solve it. The framework yields the protocol parameters that minimize the number of rounds for any given setup. We derive a heuristic formula for the minimal number of rounds to help understand the scaling with noise and security targets and to provide rapid resource estimation. Since the number of rounds depends on noise while the time per round depends on hardware rate, the framework also enables optimization of rate-fidelity trade-offs to minimize end-to-end runtime. We demonstrate both applications through a case study of a trapped-ion server with a measurement-only client, showing how the client's polarization control hardware specifications translate into protocol parameters and runtime estimates, providing concrete guidance for near-term implementations.
Blind quantum computing (BQC) allows a client to delegate quantum computations to a remote server without revealing the input, computation, or output. In addition to being blind, the client can sometimes also verify that the server has performed their instructions correctly, a property known as verifiability. A key part of realizing such verifiable BQC (VBQC) is choosing the design of the client device: many architectures have been proposed, each with different hardware requirements, security properties, and performance characteristics, making it difficult to identify which is most suitable for a given implementation. In this work, we present a comparative analysis of client architectures for VBQC with a matter-qubit server. We restrict our analysis to single-server, single-client protocols with information-theoretic security based on measurement-based quantum computation. We identify three main categories of client: emission-based, measurement-based, and rotation-based, each with multiple variants depending on how the client interacts with the server. We evaluate each across different dimensions: we compare guarantees of existing corresponding security proofs, we derive equations for the rate at which each client can execute a protocol, we provide an overview of each architecture's error behaviour, and discuss hardware cost and design considerations. Client architectures implementing measurement-based remote state preparation and reflection-based teleportation emerge as strong default candidates, but as the right choice remains context-dependent, we provide a framework for navigating considerations to guide the selection of the most suitable architecture for a given setting.
Abstract With the advent of cloud-based quantum computing, it has become vital to provide strong guarantees that computations delegated by clients to quantum service providers have been executed faithfully. Secure—blind and verifiable—delegated quantum computing (SDQC) has emerged as one of the key approaches to address this challenge, yet current protocols lack at least one of the following three ingredients: composability, noise-robustness and modularity. To tackle this question, our paper lays out the fundamental structure of SDQC protocols, namely mixing two components: the computation which the client would like the server to perform and tests that are designed to detect a server’s malicious behaviour. Using this abstraction, our main technical result is a set of sufficient conditions on these components which imply the security and noise-robustness of generic SDQC protocols in the composable Abstract Cryptography framework. This is done by establishing a correspondence between these security properties and the error-detection capabilities of the test computations. Changing the types of tests and how they are mixed with the client’s computation automatically yields new SDQC protocols with different security and noise-robustness capabilities. This approach thereby provides the desired modularity as our sufficient conditions on test computations simplify the steps required to prove the security of the protocols and allows to focus on the design and optimisation of test rounds to specific situations. We showcase this by systematising the search for improved SDQC protocols for bounded-error quantum polynomial-time ( BQP ) computations. The resulting protocols do not require more hardware on the server’s side than what is necessary to blindly delegate the computation without verification, and they outperform all previously known results.
Quantum error mitigation (QEM) is an essential tool for mitigating hardware noise without incurring space overhead. Yet, its reliability depends on modeling, calibration, and implementation, leaving end-to-end security on untrusted quantum hardware unresolved. We address this problem by introducing verifiable blind probabilistic error cancellation (VBPEC), the first secure verification protocol against a fully malicious adversary that integrates QEM. VBPEC brings probabilistic error cancellation (PEC), a widely studied QEM technique, within the scope of composable security by formalizing delegated mitigation as a cryptographic resource in the abstract cryptography framework. The protocol performs PEC with perfect blindness and an exponentially small security error. VBPEC retains the absence of quantum-space overhead from recent statistically-secure verified quantum computation protocols and from PEC. The only overhead takes the form of additional repetitions due to the QEM procedure. To achieve this, we extend trap-based verification from deterministic pass/fail checks to statistical tests that benefit from QEM and develop a new proof technique that integrates the corresponding additional deviation sources. Rather than merely tolerating honest noise below a fixed threshold, VBPEC actively cancels it, enabling correctly mitigated estimates to be accepted with high probability without compromising security. Our framework thus establishes an essential route towards secure, reliable, and practical delegated quantum computation on near-future quantum hardware: VBPEC fundamentally improves the practicality of verification.
Recent experimental achievements motivate an ever-growing interest from companies starting to feel the limitations of classical computing. Yet, in light of ongoing privacy scandals, the future availability of quantum computing through remotely accessible servers pose peculiar challenges: Clients with quantum-limited capabilities want their data and algorithms to remain hidden, while being able to verify that their computations are performed correctly. Research in blind and verifiable delegation of quantum computing attempts to address this question. However, available techniques suffer not only from high overheads but also from over-sensitivity: When running on noisy devices, imperfections trigger the same detection mechanisms as malicious attacks, resulting in perpetually aborted computations. Hence, while malicious quantum computers are rendered harmless by blind and verifiable protocols, inherent noise severely limits their usability. We address this problem with an efficient, robust, blind, verifiable scheme to delegate deterministic quantum computations with classical inputs and outputs. We show that: 1) a malicious Server can cheat at most with an exponentially small success probability; 2) in case of sufficiently small noise, the protocol succeeds with a probability exponentially close to 1; 3) the overhead is barely a polynomial number of repetitions of the initial computation interleaved with test runs requiring the same physical resources in terms of memory and gates; 4) the amount of tolerable noise, measured by the probability of failing a test run, can be as high as 25% for some computations and will be generally bounded by 12.5% when using a planar graph resource state. The key points are that security can be provided without universal computation graphs and that, in our setting, full fault-tolerance is not needed to amplify the confidence level exponentially close to 1.
Abstract In blind quantum computing (BQC), a user with a simple client device can perform a quantum computation on a remote quantum server such that the server cannot gain knowledge about the computation. Here, we numerically investigate hardware requirements for verifiable BQC using an ion trap as server and a distant measurement-only client. While the client has no direct access to quantum-computing resources, it can remotely execute quantum programs on the server by measuring photons emitted by the trapped ion. We introduce a numerical model for trapped-ion quantum devices in NetSquid, a discrete-event simulator for quantum networks. Using this, we determine the minimal hardware requirements on a per-parameter basis to perform the verifiable BQC protocol. We benchmark these for a five-qubit linear graph state, with which any single-qubit rotation can be performed, where client and server are separated by 50 km. Current state-of-the-art ion traps satisfy the minimal requirements on a per-parameter basis, but all current imperfections combined make it impossible to perform the blind computation securely over 50 km using existing technology. Using a genetic algorithm, we determine the set of hardware parameters that minimises the total improvements required, finding directions along which to improve hardware to reach our threshold error probability that would enable experimental demonstration. In this way, we lay a path for the near-term experimental progress required to realise the implementation of verifiable BQC over a 50 km distance.
Cloud-based quantum computing, coupled with the rapid progress in quantum algorithms, brings to the forefront the question of verifiability in delegated quantum computations. In the current landscape of noisy quantum devices, this question must be addressed alongside noise tolerance. In this work, we revisit the circuit-based framework for verifiable quantum computation introduced by Broadbent [Theory of Computing, 2018], and extend it to the setting of server-side noise. Our contribution is an improved upper bound on the noise-tolerance threshold, achieved through a protocol that interleaves computation and test rounds in an indistinguishable manner. This structure enables a concise security proof against arbitrary deviations by the server, while ensuring robustness to realistic noise.