Blind and Delegated Quantum Computation

Delegated quantum computation lets a computationally limited client ask a quantum server to perform a computation. Blind quantum computation adds a privacy guarantee: the server learns no more about the client’s input, algorithm, or output than a declared leakage function permits. Verifiable delegation adds an integrity guarantee: a cheating server can make the client accept an incorrect result only with bounded probability.

These are distinct properties. A protocol may verify a public computation without hiding it, or hide a computation without detecting a deliberately wrong result. Neither property forces the server to answer. A malicious server can usually delay, refuse service, or cause an abort.

This page is the canonical home for the security contract, client capability models, universal blind quantum computation (UBQC), trap and authentication methods, classical-verifier protocols, homomorphic-encryption boundary, resource accounting, implementation risks, and experimental status. Graph States owns their multipartite state structure. Quantum Teleportation owns teleportation and Pauli feed-forward. Verification of Quantum Advantage owns the broader evidence contract for advantage claims rather than private delegation. Distributed Quantum Computing owns multi-QPU execution, remote gates, partitioning, and network-aware resource accounting; the present page owns privacy and verifiability when computation is delegated across a trust boundary.

The Delegation Task

Let Alice be the client and Bob the quantum server. Alice supplies a computation $C$, an input $x$ or quantum state $\rho_{\mathrm{in}}$, and a security parameter $\lambda$. Bob supplies quantum processing, memory, measurement, and communication resources. At the end Alice obtains one of:

• a classical result $z$;
• a quantum output register, usually still encrypted under a Pauli key;
• a rejection symbol $\mathsf{rej}$.

The ideal computation is a channel $\mathcal U_C$. For a unitary task,

$$\mathcal U_C(\rho_{\mathrm{in}}) = U_C\rho_{\mathrm{in}}U_C^\dagger.$$

For sampling, measurement, or noisy-channel tasks, $\mathcal U_C$ should be read as the complete intended channel, including the declared measurement and classical output. Stating only a circuit is not enough. One must also specify who owns each input and output register, which transcript fields are public, what Bob may retain, and whether Alice accepts approximate output.

Four guarantees that should not be merged

An honest execution should be correct. One convenient quantum-output criterion is

$$\frac12 \left\| \rho_A^{\mathrm{hon}} - \mathcal U_C(\rho_{\mathrm{in}}) \right\|_1 \leq \varepsilon_{\mathrm{cor}}.$$

If the protocol includes tests, honest noise may make Alice reject. Its completeness error is

$$\Pr[\mathsf{rej}\mid \text{honest Bob}] \leq \varepsilon_{\mathrm{cmp}}.$$

Blindness concerns Bob’s information, not Alice’s output accuracy. Write $V_B$ for Bob’s final quantum system together with the entire classical transcript visible to him. Let $L(C)$ be explicitly permitted leakage, such as a padded upper bound on circuit size. An information-theoretic blindness statement has the form

$$\frac12 \left\| \rho_{V_B}^{\mathrm{real}}(C,\rho_{\mathrm{in}}) - \mathsf{Sim}_B\bigl(L(C)\bigr) \right\|_1 \leq \varepsilon_{\mathrm{bl}}.$$

The simulator has the allowed leakage but not Alice’s private data. If it can reproduce Bob’s real view, Bob cannot extract extra information from that view. Perfect blindness has $\varepsilon_{\mathrm{bl}}=0$; statistical blindness allows a small trace-distance error.

Computational protocols use a different claim. For every efficient quantum distinguisher $D$ and security parameter $\lambda$,

$$\left| \Pr[D(V_B^{(0)})=1] - \Pr[D(V_B^{(1)})=1] \right| \leq \operatorname{negl}(\lambda),$$

provided the two delegated tasks have the same permitted leakage and the declared post-quantum assumption holds. Calling this “unconditional” would be wrong even if the underlying quantum computation is ideal.

Verifiability concerns accepted wrong outputs. For a classical result and an accepted error tolerance $\eta$, a direct condition is

$$\Pr\left[ \mathsf{acc} \mathbin{\wedge} d\bigl(z,z_C\bigr)>\eta \right] \leq \varepsilon_{\mathrm{ver}}.$$

For quantum output, the ideal resource instead says that Alice receives either the correct output, up to the stated error, or $\mathsf{rej}$. This formulation avoids pretending that one can inspect an unknown quantum state and compare it with a classical answer sheet.

Composability and availability

A stand-alone argument may fail when sessions run concurrently or when the output becomes input to another protocol. A composable proof compares the real protocol with an ideal delegated-computation resource in an environment that may include other systems. For sequential components with independently established errors, a conservative ledger is

$$\varepsilon_{\mathrm{tot}} \leq \varepsilon_{\mathrm{cor}} + \varepsilon_{\mathrm{cmp}} + \varepsilon_{\mathrm{bl}} + \varepsilon_{\mathrm{ver}} + \varepsilon_{\mathrm{auth}},$$

where $\varepsilon_{\mathrm{auth}}$ covers classical-channel authentication. The exact composition theorem depends on the framework; the sum is a ledger, not a replacement for a proof.

No term above guarantees availability. Bob can stop sending messages or force tests to fail. Redundant providers and service-level mechanisms may improve availability, but they do not turn cryptographic verification into a liveness theorem.

Trust and Capability Models

There is no single “minimal client” without a trust model. Preparing one of a few qubit states, measuring incoming photons, keeping two servers isolated, and running lattice-based cryptography are incomparable resources.

Model	Client capability	Communication	Main security basis	Characteristic cost or assumption
prepare-and-send	prepare single qubits from a finite equatorial set	quantum to server, then interactive classical	information-theoretic UBQC blindness	trusted preparation and a quantum link
receive-and-measure	measure single qubits sent by the server	quantum to client plus classical interaction	no-signaling and protocol-specific measurement assumptions	client detectors, loss handling, and an untrusted source model
remote state preparation	measure a flying qubit entangled with server memory	quantum network plus classical feed-forward	prepares hidden states at the server	matter–photon interface, heralding, and memory coherence
small quantum verifier	prepare, encode, or measure a constant-size quantum register	quantum and classical	quantum authentication or hidden tests	more client hardware, often simpler security reductions
classical multi-server	classical control of separated entangled servers	classical only	nonlocal rigidity plus no communication between provers	at least two servers and enforceable isolation
classical single-server	probabilistic polynomial-time classical client	classical only	computational soundness from post-quantum assumptions	cryptographic setup and usually large overhead

“Device-independent” must also be qualified. A receive-and-measure protocol may remove trust in a client measurement model for a particular privacy claim, while a multi-prover protocol may certify behavior from nonlocal correlations. Neither label means that timing, laboratory isolation, randomness, classical software, and all interfaces can be ignored. The declared boundary matters more than the adjective.

Universal Blind Quantum Computation

UBQC is the cleanest example of information-theoretic blindness with a weak quantum client. It uses measurement-based quantum computation, but only a small amount of that model is needed here.

Minimal measurement-based mechanics

Bob prepares a universal graph-state geometry, such as a brickwork state, by entangling qubits with controlled-$Z$ gates. A single-qubit measurement basis in the equatorial plane is

$$|\pm_\alpha\rangle = \frac{|0\rangle\pm e^{i\alpha}|1\rangle}{\sqrt2}.$$

Measuring successive graph vertices teleports logical information through the resource while applying gates determined by the measurement angles. Outcomes are random, so later angles must depend on parities of earlier outcomes. For the algorithmic angle $\phi_i$, write the corrected angle as

$$\phi_i' = (-1)^{s_i^X}\phi_i + s_i^Z\pi,$$

where $s_i^X$ and $s_i^Z$ are protocol-defined parities of earlier decoded outcomes. The graph’s flow or generalized flow determines those dependencies. The full measurement-pattern model, including branch maps, byproduct propagation, flow or gflow determinism, and compilation boundaries, belongs to Measurement-Based Quantum Computation; here the issue is how to conceal the pattern from Bob.

Protocol skeleton

For each resource qubit $i$, Alice samples

$$\theta_i \xleftarrow{\$} \mathcal A, \qquad r_i \xleftarrow{\$} \{0,1\},$$

where

$$\mathcal A = \left\{ 0,\frac\pi4,\frac\pi2,\ldots,\frac{7\pi}{4} \right\}.$$

The protocol proceeds as follows.

1. Alice sends Bob independently prepared states $|+_{\theta_i}\rangle$. A private quantum input is first incorporated with its own Pauli and phase masks.
2. Bob entangles the qubits according to the public, usually padded, resource graph.
3. Before measurement $i$, Alice computes $\phi_i'$ from earlier decoded outcomes and sends

$$\delta_i = \phi_i' + \theta_i + r_i\pi \pmod{2\pi}.$$

4. Bob measures in the basis $\{|+_{\delta_i}\rangle, |-_{\delta_i}\rangle\}$ and returns the raw bit $b_i$.
5. Alice removes the outcome pad,

$$s_i = b_i\oplus r_i,$$

and uses $s_i$ to compute future corrections. 6. Alice decodes the classical output or removes the final Pauli key from a quantum output.

Information flow in prepare-and-send blind computation. The random phase $\theta_i$ hides the physical measurement angle, while $r_i$ one-time-pads the reported outcome. Blindness limits Bob’s view to declared leakage $L(C)$; verifiability requires an additional mechanism such as hidden traps or quantum authentication. Neither prevents deliberate abort.

Why the phase mask works

Bob receives an ensemble whose average state is maximally mixed:

$$\begin{aligned} \frac18 \sum_{\theta\in\mathcal A} |+_\theta\rangle\langle+_\theta| &= \frac12 \begin{pmatrix} 1 & \frac18\sum_\theta e^{-i\theta}\\ \frac18\sum_\theta e^{i\theta} & 1 \end{pmatrix}\\ &= \frac{I}{2}. \end{aligned}$$

The roots of unity sum to zero. Moreover, measuring $|+_{\theta_i}\rangle$ at physical angle $\delta_i$ is equivalent to measuring an unrotated state at angle

$$\delta_i-\theta_i = \phi_i'+r_i\pi.$$

Adding $\pi$ swaps the labels of the two basis vectors, so $r_i$ encrypts the outcome without changing the logical operation after Alice decodes it.

This calculation gives the mechanism but is not, by itself, a security proof. Bob sees a joint object consisting of quantum systems, adaptive classical messages, timing, and any private ancilla he retains. A UBQC proof shows that the entire malicious-server view can be simulated from the allowed leakage, including coherent deviations across rounds.

A masked-angle example

Suppose

$$\phi_i=\frac\pi4, \qquad s_i^X=s_i^Z=1.$$

Then

$$\phi_i' = -\frac\pi4+\pi = \frac{3\pi}{4}.$$

If Alice sampled $\theta_i=\pi/2$ and $r_i=1$, she sends

$$\delta_i = \frac{3\pi}{4} + \frac\pi2 + \pi = \frac\pi4 \pmod{2\pi}.$$

Bob sees the ordinary-looking instruction $\pi/4$. If he reports $b_i=0$, Alice records $s_i=1$. The arithmetic does not reveal $\phi_i$ because Bob does not know the phase and outcome masks or the corrected feed-forward parities.

What UBQC still leaks

The standard construction does not make the interaction invisible. Unless it is padded and scheduled independently of private data, Bob may learn:

• the resource-graph geometry and an upper bound on width and depth;
• the number and timing of measurements;
• which messages are quantum and which are classical;
• loss, retry, and abort patterns;
• the output type or number of output qubits;
• network metadata and client identity.

A universal brickwork graph hides which gates are active within the graph, but its dimensions can reveal a circuit-size bound. Padding hides size only within an anonymity set and adds qubits, time, and noise. The leakage function $L(C)$ must list what remains; “the server learns nothing” is incomplete.

From Blindness to Verifiability

Blindness can make tests indistinguishable from computation. This lets Alice hide checks among useful operations so that Bob cannot target only the data.

Hidden traps and dummies

In trap-based verifiable blind quantum computation, Alice embeds vertices with known deterministic outcomes. Dummy qubits isolate selected trap qubits from the computation graph. Random preparation and hidden placement prevent Bob from knowing which vertices are traps.

An honest execution produces the expected trap outcomes, apart from the declared physical-noise model. A malicious deviation large enough to corrupt the computation has a protocol-dependent probability of disturbing a hidden trap. Repetition, graph coloring, or encoded constructions can reduce the soundness error while retaining polynomial overhead.

For intuition only, if each independent repetition detects a fixed attack with probability at least $p_{\mathrm{det}}$, then $R$ repetitions miss it with probability at most

$$\varepsilon_{\mathrm{ver}} \leq (1-p_{\mathrm{det}})^R.$$

Real security proofs cannot assume that a quantum adversary attacks rounds independently. They reduce arbitrary coherent deviations to a form for which the hidden test structure gives a bound. The toy expression is useful for planning, not for replacing that reduction.

Quantum authentication

Another family authenticates the quantum data. Alice encodes the input using a secret key, for example through a random Clifford or signed polynomial code. Bob computes on authenticated data using prescribed gadgets. At the end Alice checks the authentication syndrome and accepts only if it is valid.

Authentication hides the data when combined with a quantum one-time pad and detects tampering, but its client operations, ancillary states, interaction, and fault-tolerance requirements differ from trap-based UBQC. It is often the natural language for interactive-proof constructions. Stabilizer Formalism owns stabilizer codes; cryptographic authentication adds a secret encoding and an adversarial acceptance statement.

Computation rounds and test rounds

Some protocols randomly interleave computation rounds with efficiently checkable test rounds. If blindness or randomized compiling makes the two types indistinguishable to Bob, failures in the tests constrain his ability to corrupt the computation unnoticed. The report must state:

• the sampling rule for round types;
• the tolerated honest test-failure rate;
• the statistical confidence procedure;
• the adversarial model, including coherent attacks;
• how test outcomes translate into an accepted-output bound.

Passing a few stabilizer checks is not automatically universal verification. The inference depends on the protocol theorem and its noise assumptions.

Classical Clients and Multiple Servers

Removing the client’s last trusted quantum operation is conceptually valuable, but it moves the burden elsewhere.

Two or more noncommunicating servers

A classical verifier can interact with entangled quantum provers that are prevented from communicating during the protocol. Nonlocal games and rigidity theorems constrain the provers’ effective measurements and shared state. This supports classical control and verification of general quantum computations, and variants can provide blindness.

The isolation assumption is cryptographic, not cosmetic. If the servers share the verifier’s questions during the live protocol, the soundness argument may collapse. Space-like separation is one route, but practical deployments must also control hidden radio, optical, timing, and supply-chain channels. A two-server protocol does not become a one-server protocol merely because both machines are operated by the same provider.

The 2017 classical-client experiment used two entangled photonic servers and demonstrated a small blind, verified factorization task. It established building blocks, not a scalable classical-client cloud service.

One server under computational assumptions

Mahadev’s 2018 protocol showed that a probabilistic polynomial-time classical verifier can verify general quantum computation with one quantum prover under post-quantum cryptographic assumptions related to learning with errors (LWE). Trapdoor claw-free function families let the verifier enforce measurements in incompatible bases without possessing a qubit.

This changes the security category:

• soundness is computational rather than information-theoretic;
• the prover is assumed unable to break the selected post-quantum primitive;
• key generation, parameter selection, classical cryptography, and protocol compilation enter the trusted base;
• asymptotic polynomial overhead may still be impractical at useful sizes.

Classical verification does not automatically hide the circuit or input. Blind delegation requires a protocol and proof that explicitly provide privacy, or an additional encryption layer. “Mahadev-style” is not a complete security specification.

Measurement-only clients

In a measurement-only protocol, Bob sends quantum systems and Alice performs single-qubit measurements. No-signaling can protect Alice’s choices in models where her laboratory does not leak the basis or outcome. This may be easier than preparing calibrated states on some optical platforms.

The direction of the quantum channel reverses the implementation risks. Alice must address detector behavior, wavelength and mode dependence, loss, malicious bright-light inputs, and basis-dependent side channels. Protocols also differ in whether Alice’s measurement device is trusted, characterized, or covered by a device-independent claim. Those variants should not be merged.

Quantum Homomorphic Encryption

Blind interactive computation and quantum homomorphic encryption (QHE) solve related but different tasks. In QHE, a client encrypts quantum data, a server evaluates a circuit on the ciphertext, and the client decrypts the result. A compact scheme asks that decryption cost depend on the security parameter and output size rather than on the full evaluated circuit.

The quantum one-time pad encrypts an $n$-qubit state as

$$\mathcal E_{a,b}(\rho) = X^a Z^b\rho Z^b X^a, \qquad a,b\in\{0,1\}^n.$$

Averaging over secret keys gives

$$\frac{1}{4^n} \sum_{a,b} \mathcal E_{a,b}(\rho) = \frac{I}{2^n}.$$

Clifford gates transform Pauli keys into new Pauli keys, so Alice can update the encryption classically. Non-Clifford gates are harder: they require interaction, auxiliary states, gate gadgets, or classical homomorphic encryption of key-dependent corrections. This is one reason $T$-gate count or $T$-depth appears in resource bounds.

There is also a no-go boundary. Perfectly information-theoretic, deterministic fully homomorphic quantum encryption for arbitrary circuits incurs exponential overhead under the standard compactness setting. Computational schemes and restricted circuit families avoid that conclusion by changing the security or functionality assumptions. The no-go result does not forbid interactive blind computation, approximate tradeoffs, or QHE for limited gate sets.

Resource and Security Ledger

“Polynomial overhead” is not a deployment estimate. For a delegated protocol, record at least the following.

Quantity	Question to report
client quantum power	Which states, gates, measurements, memory time, and calibration accuracy are required?
server quantum power	Is universal fault-tolerant computation assumed, or only a restricted graph-state resource?
quantum communication	How many transmitted or heralded qubits are required, at what loss and fidelity?
classical communication	How many rounds and bits are sent, and which messages are adaptive?
graph or circuit overhead	How many physical resource qubits represent one logical operation after padding and compilation?
verification overhead	What fraction of qubits or rounds are traps and tests, and how does it scale with $\varepsilon_{\mathrm{ver}}$?
leakage	Which dimensions, timing fields, metadata, abort causes, and output types remain visible?
honest acceptance	What noise level gives the claimed $\varepsilon_{\mathrm{cmp}}$?
fault tolerance	Which encoded operations, decoders, thresholds, and logical error targets are assumed?
cryptography	Which assumptions, security parameter, authentication keys, and randomness sources are used?

For one execution, a useful latency decomposition is

$$T_{\mathrm{wall}} = T_{\mathrm{prepare}} + N_{\mathrm{round}}T_{\mathrm{network}} + T_{\mathrm{server}} + T_{\mathrm{verify}} + T_{\mathrm{decode}}.$$

Adaptive measurement makes network round-trip latency especially important. Batching or parallel graph layers can reduce rounds only when the dependency structure permits it.

The probability of delivering an accepted result is also an end-to-end quantity. In a simplified independent-component ledger,

$$p_{\mathrm{deliver}} = p_{\mathrm{link}} p_{\mathrm{memory}} p_{\mathrm{honest\ pass}} p_{\mathrm{service}}.$$

This is not a security theorem. It makes visible why excellent blindness can coexist with a poor usable-result rate.

Noise and Fault Tolerance

Cryptographic and physical errors play different roles. A trap should detect a malicious deviation, but honest noise can also trigger it. Raising the test tolerance improves completeness and may weaken soundness unless the proof accounts for the noise. Postselecting every inconvenient event can open a security loophole and destroy scalability.

Fault-tolerant blind computation combines encrypted or hidden logical operations with quantum error correction. Topological measurement-based constructions can hide a computation within a three-dimensional cluster-state architecture. Authentication-code protocols can incorporate fault-tolerant gadgets. In either case, one must jointly track:

$$\varepsilon_{\mathrm{logical}}, \quad \varepsilon_{\mathrm{cmp}}, \quad \varepsilon_{\mathrm{ver}}, \quad \varepsilon_{\mathrm{bl}}.$$

These terms are not interchangeable. A low logical error rate does not prove blindness, and a strong trap bound does not correct decoherence. Threshold Theorem owns the conditions under which logical error can be suppressed; Resource Estimation owns physical-qubit, factory, cycle, decoder, and runtime accounting.

Implementation Security

A proof applies to an interface model. Hardware and software must implement that interface closely enough that excluded degrees of freedom do not carry the secret.

State-preparation leakage

The states labeled $|+_{\theta}\rangle$ must differ only in the intended qubit degree of freedom. Angle-dependent spectra, emission time, pulse energy, spatial mode, multiphoton probability, or device memory can reveal $\theta$. The relevant object is Bob’s full emitted state $\rho_\theta^{QE}$, including side-channel system $E$, not an ideal qubit alone.

Malicious inputs to the client

Receive-and-measure and remote-state-preparation clients should constrain wavelength, intensity, timing, and spatial mode. Otherwise Bob may probe the measurement setting with reflected light, exploit detector nonlinearities, or inject systems outside the proof’s dimension. Optical isolators, filters, power monitoring, randomized calibration, and explicit abort rules belong to the security design.

Loss and selective reporting

If a party may declare “no detection” after learning a hidden variable, postselected data can be biased. The protocol must specify which losses are trusted, when a herald is committed, whether retries reuse secrets, and how acceptance depends on missing events. Loss tolerance is a theorem property, not an automatic benefit of using photons.

Randomness and key lifecycle

Phase masks, outcome pads, trap locations, challenge bits, and cryptographic keys require suitable private randomness. Reusing $(\theta_i,r_i)$ across sessions creates transcript correlations. Keys and decoded feed-forward data should be domain-separated by session, authenticated in transit, and erased according to the threat model. Quantum Randomness owns entropy certification and extraction.

Metadata, compiler, and abort leakage

A private source program can leak before the quantum protocol begins. Compiler branching, graph dimensions, cache and queue behavior, message timing, retry counts, and distinct error messages may depend on private data. A secure stack uses data-independent padding where required, canonical compilation, fixed transcript formats, authenticated session identifiers, and coarse abort categories. Logging should retain enough evidence to audit a failure without recording secret masks.

Collusion and endpoint compromise

Multi-client and multi-server claims must list allowed coalitions. A protocol secure against one malicious server may fail if that server colludes with a client, source, orchestrator, or second server. Blindness also does not protect against malware that reads Alice’s input before encryption or her output after decryption.

Experimental Milestones and Present Status

Experiments have progressed from all-photonic demonstrations to networked matter qubits, but they remain small compared with a fault-tolerant private cloud computation.

Year	Milestone	What it established	What it did not establish
2012	photonic demonstration of blind quantum computing	concealed input, operation, and output in a small measurement-based experiment	scalable loss-tolerant service or fault tolerance
2013	experimental verification with a weak quantum verifier	hidden tests could detect selected deviations in a photonic computation	large adversarial computation under realistic noise
2017	blind computation for a classical client with two servers	proof-of-principle factoring of 15 with entangled, noncommunicating photonic servers	one-server classical-client deployment or useful scale
2023	two-client Qline blind computation	adaptive multiclient privacy on a distributed photonic architecture	full verifiability in that experiment or large computations
2024	trapped-ion server with a photonic measurement client	hybrid verifiable blind computation, server memory, deterministic entangling gates, and operation without postselection	a fault-tolerant universal workload
2025	distributed solid-state blind gates	universal single- and two-qubit blind gate set over a two-node silicon-vacancy network	large verified computation or general application privacy at scale
2025	verifiable multiclient Qline experiment	hidden checks for a distributed multiclient photonic protocol	production-scale secure multiparty quantum cloud computing

The 2024 trapped-ion experiment reported at most roughly $0.03$ leaked classical bits per qubit under its experimental analysis. That number is a platform-specific measured privacy quantity, not a universal UBQC constant. The 2025 solid-state result demonstrated a universal blind gate set, which is a capability milestone rather than an end-to-end fault-tolerant computation.

The present evidence therefore supports feasibility of important primitives: hidden state preparation, adaptive masked control, matter–photon networking, traps, multiclient coordination, and small verified outputs. It does not yet support claims of scalable, low-overhead, fault-tolerant, privately delegated quantum computing. Honest-noise acceptance, network loss, memory lifetime, client calibration, and verification overhead remain central engineering constraints.

Choosing a Protocol

Start from the threat model rather than from the best-known acronym.

1. State whether the secret is the input, circuit, output, or all three.
2. Define allowed leakage, including dimensions, timing, and abort behavior.
3. Decide whether integrity, privacy, or both are required.
4. Inventory the client’s trusted quantum abilities and network direction.
5. Decide whether information-theoretic security is necessary or a named post-quantum assumption is acceptable.
6. State which parties may collude and how server isolation is enforced.
7. Choose a protocol with a composable proof matching those assumptions.
8. Compile the actual workload and produce a physical resource, latency, and accepted-result-rate estimate.
9. Validate side channels, loss handling, randomness, authentication, and session separation.
10. Report honest failures and adversarial tests separately.

For a client able to prepare a few calibrated qubit states, prepare-and-send UBQC is conceptually direct. For a client with good detectors and a networked matter-qubit server, remote state preparation may fit the hardware better. A fully classical client must accept either multiple isolated servers or computational assumptions in known general constructions. There is no assumption-free conversion from every client model to every other one.

Common Mistakes

• Equating encryption with verification. A maximally mixed server view can hide data while the server returns arbitrary output.
• Equating verification with blindness. A public test of a known circuit may give integrity without privacy.
• Proving only that each qubit is mixed. Security concerns the joint quantum and classical transcript under coherent attacks.
• Omitting leakage. Circuit dimensions, timing, loss, and aborts can be informative even when gate angles are masked.
• Calling computational security unconditional. LWE-based classical-client protocols depend on an explicit hardness assumption and parameter regime.
• Ignoring the no-communication assumption. Multi-server soundness can depend critically on isolation during the protocol.
• Treating traps as error correction. Traps detect deviations; they do not by themselves repair honest physical noise.
• Postselecting without a proof. Selective loss can bias the retained transcript and invalidate privacy or soundness.
• Reporting asymptotic efficiency alone. Constants, quantum-link success, network rounds, padding, and fault-tolerant encoding may dominate.
• Promising availability. A malicious server can usually force abort even in an ideally blind and verifiable protocol.

Exercises

Exercise 1: Separate the guarantees

A protocol encrypts Alice’s input perfectly, but Bob may replace the output with any string and Alice always accepts. Classify its correctness, blindness, verifiability, and availability against malicious Bob.

Solution

The encryption may provide perfect blindness for the input, provided the full view and leakage are covered by a proof. The protocol is not verifiable because Bob can make Alice accept a wrong result with probability one. Its honest correctness may still be perfect if an honest Bob computes correctly. It has no malicious-server availability guarantee because Bob can return nonsense or stop. The four statements concern different experiments.

Exercise 2: Average the phase ensemble

Show directly that uniformly averaging $|+_\theta\rangle\langle+_\theta|$ over $\theta=k\pi/4$ for $k=0,\ldots,7$ gives $I/2$.

Solution

Write

$$|+_\theta\rangle\langle+_\theta| = \frac12 \begin{pmatrix} 1&e^{-i\theta}\\ e^{i\theta}&1 \end{pmatrix}.$$

The diagonal entries average to $1/2$. The off-diagonal sum is a geometric series over all eighth roots of unity:

$$\sum_{k=0}^{7}e^{ik\pi/4} = \frac{1-e^{i2\pi}}{1-e^{i\pi/4}} =0.$$

The conjugate sum also vanishes, leaving $I/2$.

Exercise 3: Decode a masked instruction

Let $\phi_i=3\pi/4$, $s_i^X=1$, $s_i^Z=0$, $\theta_i=7\pi/4$, and $r_i=1$. Compute $\phi_i'$ and the angle $\delta_i$ sent to Bob. If Bob returns $b_i=1$, what outcome does Alice record?

Solution

The corrected angle is

$$\phi_i' = -\frac{3\pi}{4}.$$

Therefore

$$\delta_i = -\frac{3\pi}{4} + \frac{7\pi}{4} + \pi = 2\pi =0 \pmod{2\pi}.$$

Alice decodes $s_i=b_i\oplus r_i=1\oplus1=0$.

Exercise 4: Leakage and padding

Two private circuits compile to brickwork graphs of dimensions $12\times20$ and $15\times17$. Alice pads both to $16\times24$. What circuit information is hidden, and what still leaks if message timing follows graph layers?

Solution

Bob can no longer distinguish the two circuits from the graph dimensions; he learns only that the compiled computation fits inside $16\times24$, assuming the dummy construction is itself blind. If timing reveals which layers contain real adaptive work, the active depth or dependency pattern may still leak. Alice needs a fixed schedule and fixed transcript shape if those properties are intended to be hidden. Network identity, total padded size, and the fact that a session occurred remain visible unless separately protected.

Exercise 5: Toy trap amplification

In a simplified independent-round model, any fixed corrupting attack triggers a trap with probability at least $1/4$ per repetition. How many repetitions make the miss probability at most $10^{-6}$?

Solution

We need

$$\left(\frac34\right)^R \leq 10^{-6}.$$

Thus

$$R \geq \frac{\ln 10^{-6}}{\ln(3/4)} \approx 48.0.$$

Since $R$ is an integer and direct substitution is required, $R=49$ is the first value strictly below $10^{-6}$. A real protocol needs a proof against coherent attacks and cannot assume independent detection events without justification.

Exercise 6: Pauli-key update through a Hadamard gate

An encrypted qubit is $X^aZ^b|\psi\rangle$. Show that after Bob applies $H$, Alice can regard the output as an encryption of $H|\psi\rangle$ with updated key $(a',b')=(b,a)$, up to an irrelevant global phase.

Solution

Using $HXH=Z$ and $HZH=X$,

$$HX^aZ^b = Z^aX^bH = (-1)^{ab}X^bZ^aH.$$

The factor $(-1)^{ab}$ is a global phase. Therefore the new $X$ key is $b$ and the new $Z$ key is $a$. Clifford gates permit this efficient classical key tracking; non-Clifford gates require additional machinery.

Exercise 7: Choose a client model

Alice has no qubit source but has a well-characterized single-photon detector. She requires information-theoretic blindness from one server and can receive photons over a quantum link. Which family is the natural starting point, and which assumptions still need examination?

Solution

A receive-and-measure or remote-state-preparation protocol is the natural starting point. Alice must still state whether her measurement device is trusted or covered by the protocol proof, constrain incoming optical modes and intensity, handle loss without selective-reporting leakage, protect basis and outcome data inside her laboratory, authenticate classical communication, and verify that the server-memory and heralding model matches the theorem. Having a detector does not by itself establish device independence.

Exercise 8: Compose an error ledger

A delegated protocol has $\varepsilon_{\mathrm{bl}}=2^{-60}$, $\varepsilon_{\mathrm{ver}}=2^{-40}$, $\varepsilon_{\mathrm{auth}}=2^{-64}$, and negligible correctness error. Give the additive upper bound for these three failure contributions and identify what it says about denial of service.

Solution

The ledger gives

$$\begin{aligned} \varepsilon_{\mathrm{tot}} &\leq 2^{-60}+2^{-40}+2^{-64}\\ &= 2^{-40}\left(1+2^{-20}+2^{-24}\right). \end{aligned}$$

The verification term dominates. This upper bound says nothing about denial of service: Bob may still force an abort with probability one. Availability needs a separate operational design and claim.

References

1. A. M. Childs, “Secure assisted quantum computation,” Quantum Information & Computation 5, 456–466 (2005), arXiv:quant-ph/0111046.
2. A. Broadbent, J. Fitzsimons, and E. Kashefi, “Universal blind quantum computation,” in 50th Annual IEEE Symposium on Foundations of Computer Science, 517–526 (2009), doi:10.1109/FOCS.2009.36.
3. V. Dunjko, J. F. Fitzsimons, C. Portmann, and R. Renner, “Composable security of delegated quantum computation,” in Advances in Cryptology – ASIACRYPT 2014, 406–425 (2014), doi:10.1007/978-3-662-45608-8_22.
4. J. F. Fitzsimons, “Private quantum computation: an introduction to blind quantum computing and related protocols,” npj Quantum Information 3, 23 (2017), doi:10.1038/s41534-017-0025-3.
5. T. Morimae and K. Fujii, “Blind quantum computation protocol in which Alice only makes measurements,” Physical Review A 87, 050301(R) (2013), doi:10.1103/PhysRevA.87.050301.
6. D. Aharonov, M. Ben-Or, E. Eban, and U. Mahadev, “Interactive proofs for quantum computations,” SIAM Journal on Computing 46, 1230–1272 (2017), arXiv:1704.04487.
7. J. F. Fitzsimons and E. Kashefi, “Unconditionally verifiable blind quantum computation,” Physical Review A 96, 012303 (2017), doi:10.1103/PhysRevA.96.012303.
8. A. Gheorghiu, T. Kapourniotis, and E. Kashefi, “Verification of quantum computation: an overview of existing approaches,” Theory of Computing Systems 63, 715–808 (2019), doi:10.1007/s00224-018-9872-3.
9. B. W. Reichardt, F. Unger, and U. Vazirani, “Classical command of quantum systems,” Nature 496, 456–460 (2013), doi:10.1038/nature12035.
10. U. Mahadev, “Classical verification of quantum computations,” in 59th Annual IEEE Symposium on Foundations of Computer Science, 259–267 (2018), doi:10.1109/FOCS.2018.00033.
11. L. Yu, C. A. Pérez-Delgado, and J. F. Fitzsimons, “Limitations on information-theoretically secure quantum homomorphic encryption,” Physical Review A 90, 050303(R) (2014), doi:10.1103/PhysRevA.90.050303.
12. A. Broadbent and S. Jeffery, “Quantum homomorphic encryption for circuits of low $T$-gate complexity,” in Advances in Cryptology – CRYPTO 2015, 609–629 (2015), arXiv:1412.8766.
13. T. Morimae and K. Fujii, “Blind topological measurement-based quantum computation,” Nature Communications 3, 1036 (2012), doi:10.1038/ncomms2043.
14. S. Barz, E. Kashefi, A. Broadbent, J. F. Fitzsimons, A. Zeilinger, and P. Walther, “Demonstration of blind quantum computing,” Science 335, 303–308 (2012), doi:10.1126/science.1214707.
15. S. Barz, J. F. Fitzsimons, E. Kashefi, and P. Walther, “Experimental verification of quantum computation,” Nature Physics 9, 727–731 (2013), doi:10.1038/nphys2763.
16. H.-L. Huang et al., “Experimental blind quantum computing for a classical client,” Physical Review Letters 119, 050503 (2017), doi:10.1103/PhysRevLett.119.050503.
17. B. Polacchi et al., “Multi-client distributed blind quantum computation with the Qline architecture,” Nature Communications 14, 7743 (2023), doi:10.1038/s41467-023-43617-0.
18. P. Drmota et al., “Verifiable blind quantum computing with trapped ions and single photons,” Physical Review Letters 132, 150604 (2024), doi:10.1103/PhysRevLett.132.150604.
19. Y.-C. Wei et al., “Universal distributed blind quantum computing with solid-state qubits,” Science 388, 1054–1059 (2025), doi:10.1126/science.adu6894.
20. B. Polacchi et al., “Experimental verifiable multiclient blind quantum computing on a Qline architecture,” Physical Review Letters 134, 200603 (2025), doi:10.1103/PhysRevLett.134.200603.