Computational self-testing for entangled magic states

In the seminal paper [Metger and Vidick, Quantum '21], they proposed a computational self-testing protocol for Bell states in a single quantum device. Their protocol relies on the fact that the target states are stabilizer states, and hence it is highly non-trivial to reveal whether the other class of quantum states, non-stabilizer states, can be self-tested within their framework. Among non-stabilizer states, magic states are indispensable resources for universal quantum computation. In this letter, we show that a magic state for the CCZ gate can be self-tested while that for the T gate cannot. Our result is applicable to a proof of quantumness, where we can classically verify whether a quantum device generates a quantum state having non-zero magic.

Introduction.In device-independent quantum information processing, we treat a quantum device as a black box and can only access it classically.By using classical input-output statistics obtained through interacting with the device, our goal is to make statements about the inner workings of the quantum device.A scheme for characterizing a quantum device provides an approach to achieve device-independent quantum key distribution [1][2][3][4][5][6][7] and delegated quantum computation [8,9].
A stringent form of device-independent certification for quantum devices is self-testing, which was introduced by Mayers and Yao [10].In traditional self-testing protocols (see e.g., [11][12][13]), a classical verifier certifies that computationally unbounded devices, which are also called provers, have prepared the target state up to some isometry (i.e., a change of basis) and measured qubits with the observable as required by the verifier.Their crucial assumption is that there are multiple provers, and each prover is allowed to be entangled but cannot classically communicate with others.In practice, however, this non-communication assumption is difficult to enforce.
Recently, a different type of self-testing called computational self-testing (C-ST) was proposed [14], which replaces the non-communicating multiple provers with a single computationally bounded quantum prover who only performs efficient quantum computation.To remove the non-communication assumption, their protocol relies on a standard assumption in post-quantum cryptography where the Learning with Errors (LWE) problem [48] cannot be solved by quantum computers in polynomial time [15].Since the prover is assumed to be computationally bounded, the probability of solving the LWE problem is negligibly small, which we call the LWE assumption.Here, it is important to note that unlike in classical public-key cryptography, this LWE assumption must hold only during execution of the self-testing protocol [49].The C-ST [14] has been applied to deviceindependent quantum key distribution [7] and oblivious transfer [16].
The self-testing protocol [14] consists of interactions between the classical verifier and the prover, and after the interactions, the verifier decides to either "accept" or "reject" the prover.In general, a C-ST protocol must satisfy two properties.One is completeness where the honest prover (i.e., the ideal device) is accepted by the verifier with high probability.The other is soundness where if the verifier accepts the prover with high probability, the device's functionality is close to the ideal one, i.e., the device generates the target state and executes measurements on it with high precision as required by the verifier.So far, the C-ST protocol has been constructed only for Bell states (σ a X ⊗ σ b X )(|0 |+ + |1 |− )/ √ 2 with a, b ∈ {0, 1} [14], which are stabilizer states, and their protocol measures the stabilizers σ Z ⊗σ X and σ X ⊗σ Z to self-test them.Here, |± := (|0 ± |1 )/ √ 2 with {|0 , |1 } being the computational basis, and σ Z and σ X are the Pauli-Z and X operators, respectively.The underlying primitives of their protocol are the extended noisy trapdoor claw-free function (ENTCF) families introduced in [17,18] that are constructed from the LWE problem.The ENTCF families consist of two families of function pairs, one used to check the Pauli-Z operator, and the other used for checking the Pauli-X operator.Hence, it should be straightforward to extend the result in [14] to all the stabilizer states whose stabilizers are tensor products of the Pauli-Z and X operators.However, for other states, such as non-stabilizer states, constructing C-ST protocols is non-trivial.
Among non-stabilizer states, hypergraph states [19], generated by applying controlled-controlled-Z (CCZ) gates on graph states [20], are useful in various quantum information processing tasks, such as preparing a magic state [21] for quantum computation, decreasing the number of bases for measurement-based quantum computation [22,23], enhancing the amount of violation of Bell's inequality [24], and demonstrating quantum supremacy [25].Experimentally, generating hypergraph states with high fidelity is generally hard since it requires CCZ gates.Hence, it is important to certify whether a generated state is the target hypergraph state.Indeed, several certification methods have been invented [26][27][28], where the measurements are assumed to be trusted.
In this Letter, we construct a C-ST protocol for the entangled magic state CCZ|+ ⊗3 .This hypergraph state is useful for use as a magic state or a building block of Union Jack states [23], and for realizing the violation of Bell's inequality [24].As for magic states, T |+ with T := |0 0| + e iπ/4 |1 1| is a major one, but we show that no C-ST protocol can be constructed for it within the framework of [14].
We explain an intuitive idea of how to construct the C-ST protocol for CCZ|+ ⊗3 .This state is a simultaneous +1 eigenstate of σ X,1 CZ 23 , σ X,2 CZ 13 , and σ X,3 CZ 12 , which we call generalized stabilizers.Here, σ X,i and CZ jk denote the Pauli-X operator acting on the i th qubit and the controlled-Z (CZ) gate acting on the j th and k th qubits, respectively.Since these three operators are not the tensor products of Pauli-Z and X, the arguments in [14] cannot be directly applied.To overcome this problem, we generalize the idea in [27].This shows that expected values of the generalized stabilizers for a state ρ can be estimated by measuring the individual qubits of ρ with the ideal Pauli-Z and X measurements followed by classical processing.Since the ideality of the measurements is not assumed in the self-testing scenario, we generalize the result in [27] so that it works even if the measurements are untrusted.
In constructing C-ST protocols for n-qubit states, there are two obstacles that must be overcome.Our construction would overcome one of them, and we will discuss that in Discussion section.
Recently, by exploiting the ENTCF families, various protocols have been invented for the proof of quantumness [17,[29][30][31][32], verification of quantum computations [18,[33][34][35], remote state preparation [36,37], and zero-knowledge arguments for quantum computations [38][39][40].We show that our self-testing protocol for the entangled magic state is applicable to another type of proof of quantumness where the classical verifier can certify whether the device generates a state having non-zero magic.The magic represents the non-stabilizerness, and it is regarded as quantumness in the sense that implementing non-Clifford gates via injection of non-stabilizer states upgrades classically simulatable Clifford circuits to universal quantum circuits.
Computational self-testing of magic states.First, we show that it is impossible to construct a C-ST protocol for the magic state T |+ with the same usage of ENTCF families in [14].More specifically, with the current usage of these families, the classical verifier can only check Pauli-Z and X measurements, but the statistics of the outcomes of these two measurements are the same for T |+ and T † |+ [50].Therefore, the classical verifier accepts the prover even when the prover generates T † |+ , which violates the aforementioned soundness.
Next, we turn to the C-ST protocol for the entangled magic state.Before we describe it, we briefly introduce the main properties of the ENTCF families [17,18], where the formal definitions are given in Sec.I of the Supplemental Material [41].
Let X and Y be finite sets specified by a security parameter (i.e., the value that determines the concrete hardness of solving the underlying LWE problem).ENTCF families consist of two families, F and G, of function pairs such that each of the functions injectively maps an element of X to the one of Y [51].A function f in these families is injective, namely f (x) = f (x ) if x = x ∈ X .A function pair (f k,0 , f k,1 ) in F = {(f k,0 , f k,1 )} k is indexed by a key k, which is public information specifying parameters in the LWE problem, and f k,0 and f k,1 have the same image over X .Hence, given y ∈ Y, there exists a claw (x 0 (k, y), x 1 (k, y)) in X satisfying y = f k,0 (x 0 (k, y)) = f k,1 (x 1 (k, y)).The function pair is called claw-free if it is hard to find a claw in quantum polynomial time.For a claw (x 0 (k, y), x 1 (k, y)) and d ∈ X , we define bit u(k, y, d) := d • (x 0 (k, y) ⊕ x 1 (k, y)).A function pair (f k,0 , f k,1 ) in the other family of function pairs G = {(f k,0 , f k,1 )} k is also indexed by a key k, but f k,0 and f k,1 have disjoint images over X .Because of its disjointness, bit b(k, y) is uniquely determined such that given k and y, there exists an element x satisfying y = f k,b(k,y) (x).
Depending on the family of function pairs, the verifier generates a key k and trapdoor information t k .The trapdoor is a piece of secret information that enables the verifier to efficiently compute an element x from y = f k,b (x) for any b ∈ {0, 1}.
Below, we describe Protocol 1, which consists of a three-round interaction between the classical verifier and the computationally bounded quantum prover (see Fig. 1).The target state of our C-ST protocol is the Z-rotated entangled magic state, which is defined for s 1 , s 2 , s 3 ∈ {0, 1} by In the protocol description, x ∈ R T means that the variable x is chosen from set T uniformly at random.Protocol 1 1.The verifier chooses bases θ := θ 1 θ 2 θ 3 ∈ R B := {000, 001, 010, 100, 111}.The basis choices 0 and 1 correspond to the computational and the Hadamard basis, respectively.We call the basis choice θ ∈ {000, 001, 010, 100} the test case and θ = 111 the hypergraph case.

Classical verifier
Step 1: ✓ = 111 Check of (e): Step H g 3 m H E a 6 f y 5 w g A h r q 5 w l O E N h t s x z i X e 5 g D V 5 3 6 z p + m q N / 2 L w c F g 5 g S m 6 p 2 t 6 o T u 6 o U d 6 / 7 V W w 6 / R 9 F L n V W 1 p h V 2 I H o 5 s v P 2 r q v D q Y e 9 T 9 a d n D 0 U s + l 5 1 9 m 7 7 T P M W W k t f 2 z 9 + 2 V h a n 2 p M 0 w U 9 s f 9 z e q B b v o F Z e 9 U u 1 8 T 6 C S L 8 H g 3 m H E a 6 f y 5 w g A h r q 5 w l O E N h t s x z i X e 5 g D V 5 3 6 z p + m q N / 2 L w c F g 5 g S m 6 p 2 t 6 o T u 6 o U d 6 / 7 V W w 6 / R 9 F L n V W 1 p h V 2 I H o 5 s v P 2 r q v D q Y e 9 T 9 a d n D 0 U s + l 5 1 9 m 7 7 T P M W W k t f 2 z 9 + 2 V h a n 2 p M 0 w U 9 s f 9 z e q B b v o F Z e 9 U u 1 8 T 6 C S L 8 H g 3 m H E a 6 f y 5 w g A h r q 5 w l O E N h t s x z i X e 5 g D V 5 3 6 z p + m q N / 2 L w c F g 5 g S m 6 p 2 t 6 o T u 6 o U d 6 / 7 V W w 6 / R 9 F L n V W 1 p h V 2 I H o 5 s v P 2 r q v D q Y e 9 T 9 a d n D 0 U s + l 5 1 9 m 7 7 T P M W W k t f 2 z 9 + 2 V h a n 2 p M 0 w U 9 s f 9 z e q B b v o F Z e 9 U u 1 8 T 6 C S L 8 H g 3 m H E a 6 f y 5 w g A h r q 5 w l O E N h t s x z i X e 5 g D V 5 3 6 z p + m q N / 2 L w c F g 5 g S m 6 p 2 t 6 o T u 6 o U d 6 / 7 V W w 6 / R 9 F L n V W 1 p h V 2 I H o 5 s v P 2 r q v D q Y e 9 T 9 a d n D 0 U s + l 5 1 9 m 7 7 T P M W W k t f 2 z 9 + 2 V h a n 2 p M 0 w U 9 s f 9 z e q B b v o F Z e 9 U u 1 8 T 6 C S L 8 Step 3: y 1 , y 2 , y 3 Z + e P e x h y f e q s 3 f b Z x q 3 0 J r 6 8 t F Z P b 2 c m q 7 O 0 D W 9 s P 8 r q t E D 3 8 A s v 2 k 3 G y J 1 j g g / g P y z 3 a 1 I 0 b < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " j Q p 7 s 9 Z 9 Z + e P e x h y f e q s 3 f b Z x q 3 0 J r 6 8 t F Z P b 2 c m q 7 O 0 D W 9 s P 8 r q t E D 3 8 A s v 2 k 3 G y J 1 j g g / g P y z 3 a 1 I 0 b < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " j Q p 7 s 9 Z 9 Z + e P e x h y f e q s 3 f b Z x q 3 0 J r 6 8 t F Z P b 2 c m q 7 O 0 D W 9 s P 8 r q t E D 3 8 A s v 2 k 3 G y J 1 j g g / g P y z 3 a 1 I 0 b < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " j Q p 7 s 9 Z 9 Z + e P e x h y f e q s 3 f b Z x q 3 0 J r 6 8 t F Z P b 2 c m q 7 O 0 D W 9 s P 8 r q t E D 3 8 A s v 2 k 3 G y J 1 j g g / g P y z 3 a 1 Quantum prover (device) Step 4: Hadamard round (ii): CCZ gate Entangled magic state q = 100 < l a t e x i t s h a 1 _ b a s e 6 4 = " B 1 s 9 p 0 D a c B I e f 7 3 J M 0 P f g H X < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j / y 7 s t 6 o 0 c X w J a f o D t k y J 2 A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j / y 7 s t 6 o 0 c X w J a f o D t k y J 2 A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j / y 7 s t 6 o 0 c X w J a f o D t k y J 2 A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j / y 7 s t 6 a w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4

a t e x i t s h a 1 _ b a s e 6 4 = " + K i T 8 G s 8 5 b u i v k w l a 8 A 5 + V a e k i I = " >
x f e 7 m k R D e o t q u r U q X t u n a r y Y q 1 S Q 3 Q w Z Z 0 4 e e r 0 m e m z t X P n L 1 y c q T U f 0 n t 7 Q J / r + 1 1 p Z W a P w s s u z N 9 H K 2 J 1 5 c n X t 2 3 9 V A c 8 G O 7 9 U / / R s 0 M P 9 0 q t i 7 3 H J F L f w J / r R 3 t O j t Q e r c 9 k N e k G H 7 P 8 5 H d A 7 v k E 4 + u q / X J G r z 1 B 8 g P 3 n c x 8 H G 7 e b N j X t l b u N p Y f V V 0 z j G q 5 j n t / 7 H p b w G M t o 8 b l v 8 R G f 8 c V a t L r W w A o m q d Z U p b m C 3 8 I a / Q D u h a 2 l < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " + K i T 8 G s 8 5 b u i v k w l a 8 A 5 + V a e k i I = " x f e 7 m k R D e o t q u r U q X t u n a r y Y q 1 S Q 3 Q w Z Z 0 4 e e r 0 m e m z t X P n L 1 y c q T U f 0 n t 7 Q J / r + 1 1 p Z W a P w s s u z N 9 H K 2 J 1 5 c n X t 2 3 9 V A c 8 G O 7 9 U / / R s 0 M P 9 0 q t i 7 3 H J F L f w J / r R 3 t O j t Q e r c 9 k N e k G H 7 P 8 5 H d A 7 v k E 4 + u q / X J G r z 1 B 8 g P 3 n c x 8 H G 7 e b N j X t l b u N p Y f V V 0 z j G q 5 j n t / 7 H p b w G M t o 8 b l v 8 R G f 8 c V a t L r W w A o m q d Z U p b m C 3 8 I a / Q D u h a 2 l < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " + K i T 8 G s 8 5 b u i v k w l a 8 A 5 + V a e k i I = " x f e 7 m k R D e o t q u r U q X t u n a r y Y q 1 S Q 3 Q w Z Z 0 4 e e r 0 m e m z t X P n L 1 y c q T U f 0 n t 7 Q J / r + 1 1 p Z W a P w s s u z N 9 H K 2 J 1 5 c n X t 2 3 9 V A c 8 G O 7 9 U / / R s 0 M P 9 0 q t i 7 3 H J F L f w J / r R 3 t O j t Q e r c 9 k N e k G H 7 P 8 5 H d A 7 v k E 4 + u q / X J G r z 1 B 8 g P 3 n c x 8 H G 7 e b N j X t l b u N p Y f V V 0 z j G q 5 j n t / 7 H p b w G M t o 8 b l v 8 R G f 8 c V a t L r W w A o m q d Z U p b m C 3 8 I a / Q D u h a 2 l < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " + K i T 8 G s 8 5 b u i v k w l a 8 A 5 + V a e k i I = " x f e 7 m k R D e o t q u r U q X t u n a r y Y q 1 S Q 3 Q w Z Z 0 4 e e r 0 m e m z t X P n L 1 y c q T U f 0 n t 7 Q J / r + 1 1 p Z W a P w s s u z N 9 H K 2 J 1 5 c n X t 2 3 9 V A c 8 G O 7 9 U / / R s 0 M P 9 0 q t i 7 3 H J F L f w J / r R 3 t O j t Q e r c 9 k N e k G H 7 P 8 5 H d A 7 v k E 4 + u q / X J G r z 1 B 8 g P 3 n c x 8 H G 7 e b N j X t l b u N p Y f V V 0 z j G q 5 j n t / This figure shows the procedures for the honest device that passes step (e).If the device executes the displayed state preparation, measurements, and CCZ gate operation, where the register |f k i ,b (x) (register |x b (ki, yi) ) is measured in the computational (Hadamard) basis, the entangled magic state is prepared.The measurement with q = 100, which requests Pauli-X (Z) measurement on the 1 st qubit (2 nd and 3 rd qubits), corresponds to measuring the generalized stabilizer of the entangled magic state.Therefore, the outcomes v1, v2, v3 of this honest device pass the check at step (e).
ifier sends keys k , k 2 , k 3 to the prover but keeps trapdoors t k1 , t k2 , t k3 secret from the prover.
4. The verifier chooses a round type from {preimage round, Hadamard round} uniformly at random and sends it to the prover.(i) For a preimage round: the verifier receives preimages (b 1 , x ; b 2 , x 2 ; b 3 , x 3 ) from the prover with b i ∈ {0, 1} and x i ∈ X .The verifier rejects the prover and sets a flag f lag ← f ail Pre unless all the preimages are correct (namely, f ki,bi (x i ) = y i holds for i = 1, 2, 3).
(ii) For an Hadamard round: the verifier receives d 1 , d 2 , d 3 ∈ X from the prover.Then, the verifier sends measurement bases q 1 , q 2 , q 3 ∈ R {0, 1} to the prover, and the prover returns measurement outcomes v 1 , v 2 , v ∈ {0, 1}.Depending on the bases θ, the verifier executes the following checks.If the flag is set, the verifier rejects the prover.
(a) θ =000: set (e) θ =111: set f lag ← f ail Hyper if one of the following holds: q = 100 and u(k Completeness.We show in Theorem 1 that Protocol 1 satisfies the aforementioned completeness. Theorem 1 There exists a computationally bounded quantum prover that is accepted in Protocol 1 with probability 1−negl(λ).Here, negl(λ) is a negligible function in the security parameter λ, namely a function that decays faster than any inverse polynomial in λ.
The device is accepted in Protocol 1 if all the checks in the preimage and Hadamard rounds are passed, whose details are given in Sec.III of the Supplemental Material [41].Here, we particularly explain the procedures for the honest device that can pass step (e).Since step (e) corresponds to the check of the generalized stabilizers, the honest device passes this check if it generates the entangled magic state.Figure 1 shows how to generate this state.After returning d 1 , d 2 , d 3 , the state of the honest device is close to a tensor product of three Pauli-X basis eigenstates due to the claw-free property of function family F, and hence applying the CCZ gate to this state results in the entangled magic state up to Pauli-Z operators.

Soundness.
We next show in Theorem 2 that Protocol 1 satisfies the aforementioned soundness.For the purpose of self-testing, we are interested in the last round of the interaction [step 4 (ii)] when θ = 111.Here, the verifier sends the measurement bases q ∈ {0, 1} 3 to the device and receives the outcomes v := v 1 v 2 v 3 ∈ {0, 1} 3 .We can model the behavior of the device in step 4 (ii) when θ = 111 by the unnormalized state σ (s1,s2,s3) on the device's Hilbert space H with s 1 , s 2 , s 3 ∈ {0, 1} and projective measurements {P (v) q } v on this state that output v given inputs q to the device.Here, s i is determined by bit u(k i , y i , d i ) for i ∈ {1, 2, 3}.
The goal of Protocol 1 is to ensure that the state σ (s1,s2,s3) := σ (s1,s2,s3) /tr[σ (s1,s2,s3) ] is close to the entangled magic state defined in Eq. ( 1), which is the target state to certify, and measurements P (v) q are specific tensor products of Pauli measurements, up to an isometry and a small error.This error is quantified by the probabilities that the verifier rejects the prover, namely the verifier sets a f lag to f ail Pre , f ail Test or f ail Hyper .We now present the soundness as follows, where p a := Pr{f lag ← f ail a } with a ∈ {Pre,Test, Hyper}, || • || 1 being the trace norm, and Theorem 2 Consider a device that is rejected by the verifier with probabilities p Pre , p Test and p Hyper , and make the LWE assumption.Let |φ (s1,s2,s3) H be the target entangled magic state to certify with s 1 , s 2 , s 3 ∈ {0, 1}, state σ (s1,s2,s3) defined above, λ the security parameter, H the device's Hilbert space, and H some Hilbert space.Then, there exists an isometry V : H → C 8 ⊗ H , states ζ (s1,s2,s3) H on H , and a constant r > 0 such that in the case of θ = 111 (hypergraph case), and for any a, b, c ∈ {0, 1} and q 1 , q 2 , q 3 ∈ {0, 1}, Here, |a q1 with a, q 1 ∈ {0, 1} is |a q1 := |a if q 1 = 0 and |a q1 := (|0 + (−1) a |1 )/ √ 2 if q 1 = 1.|b q2 and |c q3 are defined analogously.
Here, Eq. ( 2) guarantees how precisely the prover generates the entangled magic state under the isometry V , and Eq. ( 3) how precisely it implements the specific single-qubit measurements on it according to the measurement bases q.Using V † V = I, Eq. ( 3) also reveals that the actual probability distribution of the device {tr[P (abc) q1q2q3 σ (s1,s2,s3) ]} a,b,c is close to the ideal one obtained by measuring |φ (s1,s2,s3) H in the Pauli-Z and X bases.Note that Eqs. ( 2) and (3) are analogous to the statements in the traditional self-testing (see e.g., [11][12][13]).One notable difference from the traditional selftesting is that our isometry V is allowed to be a global operation acting on the whole device's Hilbert space H because we do consider the single quantum device.The proof of Theorem 2 is given in Sec.IV of the Supplemental Material [41].
Applications to the proof of quantumness.Recently, various protocols have been invented to enable the classical verifier to certify the quantumness of the device [17,18,29,31,32,34].Here, the meaning of quantumness differs depending on the protocols.For instance, the protocols [17,31,32] verify whether the prover has a superposed state or not, the protocols [18,34] verify whether the prover can efficiently solve BQP problems, and the protocol [29] verifies that the prover can query to an oracle in superposition.Importantly, if the prover is accepted by the verifier, then the prover has quantum capability.
Our C-ST protocol given as Protocol 1 can be used for the proof of magic under the IID scenario where the device's functionality is the same for each repetition of the protocol.To measure the magic, we focus on the max-relative entropy of magic [42].We adopt this measure for simplicity, but our arguments can be applied to any reasonable measure of the magic.Let D max (ρ) := log (1 + R g (ρ)) be the max-relative entropy of magic of an n-qubit state ρ, where R g (ρ) is defined by the minimum of t ≥ 0 such that ρ ∈ (1 + t)STAB − tS, STAB ⊂ S is the convex hull of all n-qubit stabilizer states, and S is the set of n-qubit states.If ρ is a stabilizer state, R g (ρ) = 0, and hence D max (ρ) = 0.By contraposition, if D max (ρ) > 0, state ρ is a non-stabilizer state.Based on above observations, we outline the protocol for the proof of magic as follows [52] (see Sec. V of the Supplemental Material [41]).Protocol 2 1.The verifier and prover repeat Protocol 1 a constant number of times, and the verifier estimates the error probabilities p Pre , p Test and p Hyper using Hoeffding's inequality from the numbers of set flags.
2. If the estimated trace norm T est [the square root of the right-hand side of Eq. ( 2)] is strictly less than 1/3, then the verifier accepts the prover.Otherwise, the verifier rejects the prover.
We first show that if our protocol is passed, with a small significance level [53], which can be set to any value such as 10 −10 , the verifier can guarantee that the prover generates a state having non-zero magic up to the isometry.If state ρ has no magic, we have φ Hoeffding's inequality with precision 1/6 implies that T est < 1/3 holds with probability 10 −10 .Therefore, such a state ρ is accepted with probability of at most 10 −10 .
On the other hand, there is a strategy that passes this protocol with probability 1 − 10 −10 .This is because Theorem 1 states that there exists a prover's strategy that achieves all of the error probabilities p Pre , p Test and p Hyper being negl(λ), and hence from Hoeffding's inequality, T est ≤ negl(λ) + 1/6 < 1/3 holds except for probability 10 −10 .
Discussions.In this Letter, we have constructed a computational self-testing protocol for the three-qubit entangled magic state.To generalize [14] to n-qubit states, there are two obstacles: (1) The verifier chooses the state bases θ 1 ...θ n ∈ R {0, 1} n with which the prover is requested to generate the state for n times.Since the target state is prepared only when all the θ's are 1, it takes exponential time on average to generate the target state.(2) The verifier checks all the patterns of measurements, namely it checks the correctness of Pauli-Z and X measurements for each qubit, which takes 2 n times.
Our construction would solve the first problem.We have shown for n = 3 that the number of state bases is sufficient to be n + 2, which means the target state is prepared on average by repeating the protocol (n + 2) times.We leave its rigorous analysis and the second problem as future work.
Note added.Recently, we became aware of independent related works [46] and [47] that extend the result [14] to self-test n Bell states and n BB84 states, respectively.By exploiting these results, it could be possible to extend our result to self-test n tensor products of CCZ magic states CCZ|+ ⊗3 .
for some negligible function negl(•), where the expectation is taken over x ← X .Here H 2 (•, •) is the Hellinger distance.Moreover, there exists an efficient procedure SAMP F that on input k and b ∈ {0, 1}, prepares the state • Adaptive Hardcore Bit: for all k ∈ K F the following conditions hold for some integer w that is a polynomially bounded function in λ.
-For all b ∈ {0, 1} and x ∈ X , there exists a set G k,b,x ⊆ {0, 1} w such that Pr d←{0,1} w {d / ∈ G k,b,x } is negligible in λ, and moreover there exists an efficient algorithm that checks for membership in G k,b,x given k, b, x and the trapdoor t k .
-There is an efficiently computable injection J : X → {0, 1} w such that J can be inverted efficiently on its range, and such that the following holds.Let Then for any efficient quantum algorithm A, there exists a negligible function negl(•) such that Definition 5 (Trapdoor Injective Function Family [S18]) Let λ ∈ N be a security parameter.Let X and Y be finite sets.Let K G be a finite set of keys.A family of functions is called a trapdoor injective function family if the following conditions hold: • Efficient Function Generation: There exists an efficient probabilistic algorithm GEN G which generates a key k ∈ K G together with a trapdoor t k , (k, t k ) ← GEN G (1 λ ).
• • Efficient Range Superposition: For all k ∈ K G and b ∈ {0, 1}, 1.There exists an efficient deterministic procedure CHK G that on input k, b ∈ {0, 1}, x ∈ X , and y ∈ Y, outputs 1 if y ∈ Supp(f k,b (x)) and 0 otherwise.Note that CHK G is not provided the trapdoor t k .
2. There exists an efficient procedure SAMP G that on input k and b ∈ {0, 1} returns the state • For all quantum polynomial-time procedures A, there exists a negligible function negl(•) such that Definition 7 (Extended Trapdoor Claw-free Family [S18]) A NTCF family F is an extended trapdoor clawfree family if • For all k ∈ K F and d ∈ {0, 1} w , let For all quantum polynomial-time algorithms A, there exists a negligible function negl(•) such that Definition 8 (Decoding maps for the ENTCF families [S14]) We define the following maps that decode the output of an ENTCF.
• For a key k ∈ K G and y ∈ Y, let b(k, y) be the bit such that y is in the union of the supports of the distributions f k, b(k,y) (x) over x ∈ X .This is well-defined because the function pairs in G have disjoint images.
• For a key k ∈ K F or K G , y ∈ Y, and b ∈ {0, 1}, let xb (k, y) be the preimage of the function such that y is in the support of the distribution f k,b (x b (k, y)).If y is not in the support, then nothing is defined for xb (k, y) (so instead we define xb (k, y) := ⊥).
• For a key k ∈ K F , y ∈ Y and d ∈ X , we define û(k, y, d) , where the preimages x0 (k, y) and x1 (k, y) can be efficiently computed by using the trapdoor information t k .

C. Definitions
Throughout the paper, we adopt the following definitions based on [S14].
Definition 9 (Distance measures) (i) For A ∈ L(H), the schatten-p norm is defined by where |A| := √ A † A. Note that ||A|| 1 is called the trace norm, and ||A|| ∞ is called the operator norm (largest singular value).
(ii) For A ∈ L(H) and ψ ∈ Pos(H), we define the state-dependent (semi) norm of A with respect to ψ as (ii) For A, B ∈ L(H), we define (iii) For A, B ∈ L(H) and ψ ∈ Pos(H), we define We use the notation

D. Auxiliary Lemmas
We summarize auxiliary lemmas that will be frequently used in our soundness in Sec.IV.All the lemmas in this section have been derived in [S14].We state them here for the reader's convenience.Lemma 19 Let H 1 , H 2 be Hilbert spaces with dim(H 1 ) ≤ dim(H 2 ), V : H 1 → H 2 an isometry, and A and B binary observables on H 1 and H 2 , respectively.Then, the following holds for any ψ ∈ Pos(H 1 ): Lemma 20 Let H 1 , H 2 be Hilbert spaces with dim(H 1 ) ≤ dim(H 2 ) and V : H 1 → H 2 an isometry.Let A and B be binary observables on H 1 and H 2 , respectively, ψ ∈ Pos(H 1 ), and ≥ 0.Then, for any b ∈ {0, 1}: Lemma 21 (Lifting lemma) Let ψ, ψ ∈ D(H) be computationally indistinguishable: ψ c ≈ δ ψ .

IV. PROTOCOL SOUNDNESS
In this section, we provide the proof of our Theorem 2 presented in the main text.
Note that ψ (θ) with θ ∈ B represents the state of the prover just after step 3 of Protocol 1, namely the state just after returning images y to the verifier.The state ψ (θ) is implicitly averaged over the keys (k 1 , k 2 , k 3 ) chosen by the verifier, and all the statements we make in terms of the device D hold on overage over the keys.
2. (Measurement in the preimage round) A projective measurement on systems H D ⊗H Y performed in the preimage round is defined as .
Here, Π For any θ ∈ {0, 1} 3 , the post-measurement normalized state after measurement M is written as where σ 4. (Measurement after receiving questions q in the Hadamard round) Given the verifier's questions q ∈ {0, 1} 3 , P q denotes the projective measurement on systems H D ⊗ H Y ⊗ H R : .
By performing this measurement, the prover obtains the outcomes v ∈ {0, 1} 3 that are returned to the verifier.
Definition 23 For a device D = (S, Π, M, P ), we define a set of binary observables with projective measurement P q :   We call {A i,q=000 } 3 i=1 and {A i,q=111 } 3 i=1 non-tilde observables.Any other binary observables {A i,q } i,q are called tilde observables.Note that all the A i,q act on the same Hilbert space regardless of i and q.The difference lies in classical post-processing of the answers v, where A i,q focuses only on the outcome v i with the other outcomes being marginalized.If two binary observables A i,q and A j,q have the same input q, the only difference is classical post-processing of the measurement outcomes.As classical post-processing obviously commute, [A i,q , A j,q ] = 0 (9) holds for any i, j ∈ {1, 2, 3}.
Definition 24 (Efficient device) A device D is called efficient if state preparations for ψ (θ) and measurements Π, M, P q can be performed efficiently.
For any efficient device, from the injective invariance property (Definition 6), post-measurement states ρ (θ) in Eq. ( 7) are shown to be computationally indistinguishable.
Lemma 25 Let D be an efficient device and ρ (θ) be a post-measurement state defined in Eq. (7).Then, for any θ, θ ∈ {0, 1} 3 and quantum polynomial-time algorithm D, there exists a negligible function negl(•) such that The same statement holds for states ψ (θ) in Eq. ( 6) because the following proof is valid also for ψ (θ) .

B. Success Probabilities of a Device
If the prover's answer is incorrect in the protocol, the verifier sets a flag.In this section, we relate the probabilities that the prover passes these checks to the states and measurements in Sec.IV A. Note that Lemmas 26, 27 and 28 correspond to Lemmas 4.10 (i), (ii) and (iii) in [S14], respectively.Lemma 26 (Preimage check) Let D = (S, Π, M, P ) be a device.The probability of passing i th preimage check (namely CHK(k i , y i , b i , x i ) = 1) conditioned on basis choice θ ∈ B and the preimage round is written as Pr{Prover passes the i th preimage check|θ, preimage round} =δ θi,0 y,xī,bī tr Π ( b(ki,yi),x(ki,yi);bī,xī) Let p min denote the minimum probability of Eq. ( 11) over i ∈ {1, 2, 3} and θ ∈ B, and we define Then, the upper bound on γ P (D) is obtained as Note that Pr{f lag = f ail Pre |preimage round} can be estimated through repeating the self-testing protocol.
Next, we calculate the second term of Eq. ( 18): Here, , qī} expresses the probability that the prover's answer v i is accepted by the verifier conditioned on measuring state ρ (θ) with wt(θ) = 1 and θ i = 1 when q with q i = 1 is input to the device.This probability can be written by using the expressions of the states and measurements as By using the definition of Eq. ( 16), for θ such that wt(θ) = 1 and θ i = 1, Eq. ( 23) is rewritten as i,q|qi=1 σ (θ1,v1;θ2,v2;θ3,v3) .
The RHS has 3 × 2 3 trace terms, and its minimum term is 1 − γ T (D) as defined in Eq. ( 14).To take a lower bound on the RHS, we replace the (3 × 2 3 − 1) trace terms by 1 and only one term by 1 − γ T (D).By doing so, we have which results in Eq. ( 17).
Next, we introduce a perfect device, whose γ P (D) in Eq. ( 12) is negligible.This means that the perfect device can pass the preimage round of our protocol with probability 1 − negl(λ).
The following lemma claims that for any efficient device D, we can efficiently construct another efficient perfect device D , which uses the same measurements as D, and whose initial state is close to the one of D. Lemma 30 implies that the efficient device can be replaced with the corresponding perfect one by adding an approximation error of O( γ P (D)), it suffices to show the soundness proof to the efficient perfect device.We omit the proof of Lemma 30 as it is essentially the same as that of Lemma 4.13 in [S14].
Lemma 30 Let D = (S, Π, M, P ) be an efficient device with S = {ψ (θ) } θ∈B and γ P (D) < 1 − 1/poly(λ).Then there exists an efficient perfect device D = (S , Π, M, P ), which uses the same measurements Π, M, P and whose states S = {ψ (θ) } θ∈B satisfy the following for any θ ∈ B: At the end of this section, we describe Lemma 31 and Corollary 32 that are frequently used in the rest of our soundness proof.We omit these proofs since these are essentially the same as those of Lemma 4.8 and Corollary 4.9 [S14].

D. Approximate Relations of Non-Tilde Observables and Pauli Observables
In this section, we introduce swap isometry.This isometry is a completely positive and trace preserving (CPTP) map that adds three-qubit Hilbert space C 8 to prover's Hilbert space H and swaps the three-qubit space in H to C 8 .This isometry is an extension of the one in Definition 4.27 [S14] to the three-qubit case.
Definition 36 (Swap isometry) Given a device D = (S, Π, M, P ) with Hilbert space H, we define swap isometry V S : H → C 8 ⊗ H using non-tilde observables introduced in Eq. ( 8) as Here, superscript a in A a indicates the exponent, and A (a) is the projector onto (−1) a -eigenspace of A.
The goal of this section is to prove Lemmas 37, 38, 41, and 45, which state that non-tilde observables A i,0 and A i,1 are close to the Pauli observables under isometry V S .
Lemma 37 Conjugating Pauli observables by swap isometry V S gives the following.
Here, σ Z,i and σ X,i denote σ Z and σ X acting on the i th qubit, respectively.
(Proof) These can be proven by inserting Eq. (36).Next, we show that under isometry V S , the binary observable A 1,1 is approximately equal to σ X .
Corollary 50 (Extension of Corollary 44) Let D = (S, Π, M, P ) be an efficient perfect device.There exists a normalized state α such that for any θ ∈ B, (Proof) Taking the sum of the equations in Lemma 49 over v yields the statement for θ of the test case.We can lift up the statement for any θ ∈ B thanks to Lemma 25.Below, we present crucial Lemmas 51, 52 and 53 for proving our main result, Theorem 54.Lemma 51 shows that any two joint observables are close to the products of the Pauli observables.
Note that Lemma 51 will be used to prove Theorem 54 (ii).

G. Certifying Entangled Magic States
Theorem 54 We define Z-rotated entangled magic states as Let D = (S, Π, M, P ) be an efficient device, device's Hilbert space be H, σ (1,s1;1,s2;1,s3) be defined in Eq. ( 26), and H be some Hilbert space.Then, there exists an isometry V : H → C 8 ⊗ H , and a constant d > 0 such that there are states ζ (s1,s2,s3) ∈ D(H ) for s 1 , s 2 , s 3 ∈ {0, 1} satisfying the following.In the description, γ P (D), γ T (D) and γ H (D) are defined in Lemmas 26, 27, and 28, respectively [S6].(i) The unnormalized state in an Hadamard round is close to the entangled magic state up to isometry V : In both proofs of (i) and (ii), by Lemma 30, up to an additional error O( γ P (D)), we can assume that device D is perfect.In these proofs, we take isometry V as swap isometry V S defined in Eq. (36).
By the definition of γ H (D) given in Eq. ( 25), we have 1,001 A 2,001 A 3,001 ) (s3) σ (1,s1;1,s2;1,s3) ] ≈ γ H (D) tr(ϕ (s1,s2,s3) ). (93) D / 0 Y 5 v e e w D T m M I 8 c n 3 u E C 9 z g V o E y p I w o o 9 V U p S b W d O N L K N k P I 8 e S B A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " B 1 s 9 p 0 D a c B I e f 7 3 J M 0 D / 0 Y 5 v e e w D T m M I 8 c n 3 u E C 9 z g V o E y p I w o o 9 V U p S b W d O N L K N k P I 8 e S B A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " B 1 s 9 p 0 D a c B I e f 7 3 J M 0 D / 0 Y 5 v e e w D T m M I 8 c n 3 u E C 9 z g V o E y p I w o o 9 V U p S b W d O N L K N k P I 8 e S B A = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " B 1 s 9 p 0 D a c B I e f 7 3 J M 0 w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4+ 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > < l a t e x i ts h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4 w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4+ 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > < l a t e x i ts h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4 w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4 + 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > X < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j / y 7 s t 6 j 8 / l a t e x i t > Z < l a t e x i t s h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4 w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4 + 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4 w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4 + 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4 L b a x C w s a K i h D w I T H 2 I A C l 9 s W Z B B s 5 n Z Q Z 8 5 h p P v 7 A s e I s L b C WY I z F G Y P e d z n 1 V b A m r x u 1 X R 9 t c a n G N w d V s Y x Q 0 9 0 R 0 1 6 p H t 6 o Y 9 f a 9 X 9 G i 0 v N Z 7 V t l b Y p Z G T i d z 7 v 6 o y z x 4 O v l R / e va w h y X f q 8 7 e b Z 9 p 3 U J r 6 6 t H F 8 3 c c n a m P k v X 9 M r + r 6 h B D 3 w D s / q m 3 W R E 9 h I R / g D 5 5 3 N 3 g s J 8 U q a k n F l I p F a C r w h j E t O Y 4 / d e R A p r S C P P 5 w q c 4 g z n o W d p U I p J 4 + 1 U K R R o Y v g W 0 t Q n u k y J 2 g = = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " 6 Y C n m w P P F T B z g 6 l k y d 6 G C e u b 2 2 4

3 Y i=1 1 X
7 H p b w G M t o 8 b l v 8 R G f 8 c V a t L r W w A o m q d Z U p b m C 3 8 I a / Q D u h a 2 l < / l a t e x i t > b=0 |bi|x b (k i , y i )i < l a t e x i t s h a 1 _ b a s e 6 4 = " E G E + 7 l S r D n v + r A C h C 5 e W V + E / k 5 E = " > A A A C m 3 i c h V F N S x t B G H 5 c r b V p N d F e C k W Q B s W C h H f b o l I Q p F 6 K e N D E q G D i s r s Z 4 5 D 9 Y n c T m q 7 5 A / 0 D H u y l g o j 4 L + y l 0 F 4 9 5 C e I x x R 6 6 a F v N g t i Q + s 7 z M w z z 7 z P O 8 / M G J 4 l g 5 C o P a A M D j 0 Y f j j y K P X 4 y e h Y O j M + s R W 4 d d 8 U R d O 1 X H / H 0 A N h S U c U Q x l a Y s f z h W 4 b l t g 2 a i v d / e 2 G 8 A P p O p t h 0 x N l W 6 8 6 c l + a e s i U l p k v e b 5 b 0 S K 5 p L b 2 X p e C u q 1F x h K 1 9 t R D o + T r T t U S h x 8 0 Y 7 a m y b m m J l 8 m n J b J U o 7 i m O o H a g K y S G L d z Z y h h A p c m K j D h o C D k L E F H Q G 3 X a g g e M y V E T H n M 5 L x v k A L K d b W O U t w h s 5 s j c c q r 3 Y T 1 u F 1 t 2 Y Q q 0 0 + x e L u s 3 I K 0 3 R F 5 9 S h b 3 R B 1 / T 7 n 7 W i u E b X S 5 N n o 6 c V n p b + 9 K z w 6 1 6 V z X O I g 1 v V f z 2 H 2 M d i 7 F Wy d y 9 m u r c w e / r G x 6 N O 4 W 1 + O p q h E 7 p h / 1 + o T V / 5 B k 7 j p 3 m 6 I f L H S P E H q H 8 / d z / Y e p V T K a d u v M k u v 0 u + Y g T P 8 Q K z / N 4 L W M Z 7 r K P I 5 3 7 G J b 7 j h z K p r C i r y l o v V R l I N E 9 x J 5 T i H x t d n y g = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = "E G E + 7 l S r D n v + r A C h C 5 e W V + E / k 5 E = " > A A A C m 3 i c h V F N S x t B G H 5 c r b V p N d F e C k W Q B s W C h H f b o l I Q p F 6 K e N D E q G D i s r s Z 4 5 D 9 Y n c T m q 7 5 A / 0 D H u y l g o j 4 L + y l 0 F 4 9 5 C e I x x R 6 6 a F v N g t i Q + s 7 z M w z z 7 z P O 8 / M G J 4 l g 5 C o P a A M D j 0 Y f j j y K P X 4 y e h Y O j M + s R W 4 d d 8 U R d O 1 X H / H 0 A N h S U c U Q x l a Y s f z h W 4 b l t g 2 a i v d / e 2 G 8 A P p O p t h 0 x N l W 6 8 6 c l + a e s i U l p k v e b 5 b 0 S K 5 p L b 2 X p e C u q 1 F x h K 1 9 t R D o + T r T t U S h x 8 0 Y 7 a m y b m m J l 8 m n J b J U o 7 i m O o H a g K y S G L d z Z y h h A p c m K j D h o C D k L E F H Q G 3 X a g g e M y V E T H n M 5 L x v k A L K d b W O U t w h s 5 s j c c q r 3 Y T 1 u F 1 t 2 Y Q q 0 0 + x e L u s 3 I K 0 3 R F 5 9 S h b 3 R B 1 / T 7 n 7 W i u E b X S 5 N n o 6 c V n p b + 9 K z w 6 1 6 V z X O I g 1 v V f z 2 H 2 M d i 7 F W y d y 9 m u r c w e / r G x 6 N O 4 W 1 + O p q h E 7 p h / 1 + o T V / 5 B k 7 j p 3 m 6 I f L H S P E H q H 8 / d z / Y e p V T K a d u v M k u v 0 u + Y g T P 8 Q K z / N 4 L W M Z 7 r K P I 5 3 7 G J b 7 j h z K p r C i r y l o v V R l I N E 9 x J 5 T i H x t d n y g = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " E G E + 7 l S r D n v + r A C h C 5 e W V + E / k 5 E = " > A A A C m 3 i c h V F N S x t B G H 5 c r b V p N d F e C k W Q B s W C h H f b o l I Q p F 6 K e N D E q G D i sr s Z 4 5 D 9 Y n c T m q 7 5 A / 0 D H u y l g o j 4 L + y l 0 F 4 9 5 C e I x x R 6 6 a F v N g t i Q + s 7 z M w z z 7 z P O 8 / M G J 4 l g 5 C o P a A M D j 0 Y f j j y K P X 4 y e h Y O j M + s R W 4 d d 8 U R d O 1 X H / H 0 A N h S U c U Q x l a Y s f z h W 4 b l t g 2 a i v d / e 2 G 8 A P p O p t h 0 x N l W 6 8 6 c l + a e s i U l p k v e b 5 b 0 S K 5 p L b 2 X p e C u q 1 F x h K 1 9 t R D o + T r T t U S h x 8 0 Y 7 a m y b m m J l 8 m n J b J U o7 i m O o H a g K y S G L d z Z y h h A p c m K j D h o C D k L E F H Q G 3 X a g g e M y V E T H n M 5 L x v k A L K d b W O U t w h s 5 s j c c q r 3 Y T 1 u F 1 t 2 Y Q q 0 0 + x e L u s 3 I K 0 3 R F 5 9 S h b 3 R B 1 / T 7 n 7 W i u E b X S 5 N n o 6 c V n p b + 9 K z w 6 1 6 V z X O I g 1 v V f z 2 H 2 M d i 7 F W y d y 9 m u r c w e / r G x 6 N O 4 W 1 + O p q h E 7 p h / 1 + o T V / 5 B k 7 j p 3 m 6 I f L H S P E H q H 8 / d z / Y e p V T K a d u v M k u v 0 u + Y g T P 8 Q K z / N 4 L W M Z 7 r K P I 5 3 7 G J b 7 j h z K p r C i r y l o v V R l I N E 9 x J 5 T i H x t d n y g = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " E G E + 7 l S r D n v + r A C h C 5 e W V + E / k 5 E = " > A A A C m 3 i c h V F N S x t B G H 5 c r b V p N d F e C k W Q B s W C h H f b o l I Q p F 6 K e N D E q G D i s r s Z 4 5 D 9 Y n c T m q 7 5 A / 0 D H u y l g o j 4 L + y l 0 F 4 9 5 C e I x x R 6 6 a F v N g t i Q + s 7 z M w z z 7 z P O 8 / M G J 4 l g 5 C o P a A M D j 0 Y f j j y K P X 4 y e h Y O j M + s R W 4 d d 8 U R d O 1 X H / H 0 A N h S U c U Q x l a Y s f z h W 4 b l t g 2 a i v d / e 2 G 8 A P p O p t h 0 x N l W 6 8 6 c l + a e s i U l p k v e b 5 b 0 S K 5 p L b 2 X p e C u q 1 F x h K 1 9 t R D o + T r T t U S h x 8 0 Y 7 a m y b m m J l 8 m n J b J U o 7 i m O o H a g K y S G L d z Z y h h A p c m K j D h o C D k L E F H Q G 3 X a g g e M y V E T H n M 5 L x v k A L K d b W O U t w h s 5 s j c c q r 3 Y T 1 u F 1 t 2 Y Q q 0 0 + x e L us 3 I K 0 3 R F 5 9 S h b 3 R B 1 / T 7 n 7 W i u E b X S 5 N n o 6 c V n p b + 9 K z w 6 1 6 V z X O I g 1 v V f z 2 H 2 M d i 7 F W y d y 9 m u r c w e / r G x 6 N O 4 W 1 + O p q h E 7 p h / 1 + o T V / 5 B k 7 j p 3 m 6 I f L H S P E H q H 8 / d z / Y e p V T K a d u v M k u v 0 u + Y g T P 8 Q K z / N 4 L W M Z 7 r K P I 5 3 7 G J b 7 j h z K p r C i r y l o v V R l I N E 9 x J 5 T i H x t d n y g = < / l a t e x i t > < l a t e x i t s h a 1 _ b a s e 6 4 = " U x B l 3 C F E o r 0 s 5 t Y X r F z T b k m C b w 8= " > A A A C p X i c h V F N S x t B G H 7 c a r V R a 2 o v g p d g S B u h h H d V a h G E o B c v g l / 5 g E S G 3 c 2 o S z a 7 y + 5 k M Y b + A f + A h 5 4 s t E X 8 G V 5 6 6 F X B n 1 B 6 V O i l h 7 7 Z L E or t e 8 w M 8 8 8 8 z 7 v P D N j + o 4 d K q L r A e 3 J 4 N D T 4 Z F n q d G x 8 e c T 6 R e T 5 d B r B 5 Y s W Z 7 j B V X T C K V j u 7 K k b O X I q h 9 I o 2 U 6 s m I 2 V 3 v 7 l U g G o e 2 5 O 6 r j y 9 2 W s e / a e 7 Z l K K Z E u t g Q e t 1 q e C p / K C j f F P q b j t B n 6 5 7 v t M P M o d D v q N n l i D P 7 f C T m Y g 2 D e Z H O U o H i y D w E e g K y S G L D S 3 9 B H Q 1 4 s N B G C x I u F G M H B k J u N e g g + M z t o s t c w M i O 9 y X e I 8 X a N m d J z j C Y b f K 4 z 6 t a w r q 8 7 t U M Y 7 X F p z j c A 1 Z m k K N L O q M b + k r n 9 J 1 + / b N W N 6 7 R 8 9 L h 2 e x r p S 8 m j q e 2 f / 5 X 1 e J Z 4 e B e 9 a h n h T 2 8 i 7 3 a 7 N 2 P m d 4 t r L 4 + O j q 5 2 V 7 a y n V f 0 U f 6 w f 5 P 6
)(y)|x |y .Definition 6 [Injective Invariance [S18]] A NTCF family F is injective invariant if there exists a trapdoor injective function family G such that • The algorithm CHK F and SAMP F are the same as the algorithms CHK G and SAMP G .

A
. Modeling Devices in the Protocol Definition 22 (Device) The behavior of an arbitrary prover can be modeled by a device D := (S, Π, M, P ), which are specified as follows [S14].1. (State just after returning images y) We define set of states S := {ψ (θ) } θ∈{0,1} 3 as measurement to obtain outcomes b ∈ {0, 1} 3 and x ∈ X 3 given y ∈ Y 3 .3.(Measurement and post-measurement states in the Hadamard round) A projective measurement on systemsH D ⊗ H Y performed in the Hadamard round to obtain d ∈ {0, 1} 3w is defined as ) comes from n × |B| = 3 × 5 with n being the number of qubits to certify, where n = 2 and |B| = 4 in [S14].Lemma 27 (Test case) Let D = (S, Π, M, P ) be a device.We define γ T (D) := 1 − min