Verifiable blind quantum computing with trapped ions and single photons

We report the first hybrid matter-photon implementation of verifiable blind quantum computing. We use a trapped-ion quantum server and a client-side photonic detection system networked via a fibre-optic quantum link. The availability of memory qubits and deterministic entangling gates enables interactive protocols without post-selection - key requirements for any scalable blind server, which previous realisations could not provide. We quantify the privacy at<~0.03 leaked classical bits per qubit. This experiment demonstrates a path to fully verified quantum computing in the cloud.

Quantum computers are poised to outperform the world's most powerful supercomputers, with applications ranging from drug discovery to cybersecurity.These computers harness quantum phenomena such as entanglement and superposition to perform calculations that are believed to be intractable with classical computers.As quantum processors control delicate quantum states, they are necessarily complex and physical access to high-performance systems is limited.Cloud-based approaches, where users can remotely access quantum servers, are likely to be the working model in the near term and beyond; many users already perform computations on commercially available devices for state-of-the-art research [1][2][3][4][5].
However, delegating quantum computations to a server carries the same privacy and security concerns that bedevil classical cloud computing.Users are currently unable to hide their work from the server or to independently verify their results in the regime where classical simulations become intractable.Remarkably, the same phenomena that enable quantum computing can leave the server "blind" in a way that conceals the client's input, output, and algorithm [6][7][8]; because quantum information cannot be copied and measurements irreversibly change the quantum state, information stored in these systems can be protected with information-theoretic security, and incorrect operation of the server or attempted attacks can be detected -a surprising possibility which has no equivalent in classical computing.Blind quantum computing (BQC) requires not only a universal quantum computer as the server, but also a quantum link connecting it to the client [9,10].Photons are a natural choice to provide that link, and indeed the first demonstrations of BQC were performed in purely photonic systems [11][12][13][14].However, unavoidable photon loss, either due to limited photon detection efficiencies or absorption in the link, results in potential security risks [11,13] and places hard limits on the scalability of this approach due to the resource overhead incurred by post-selection [15].Ideally, quantum information at the server should be stored in a stable quantum memory that can be manipulated with high fidelity, yet readily interfaced to a photonic link.The ability to retain quantum information on the server then enables the client to perform adaptive mid-circuit adjustments in order to execute the target computation deterministically and securely.Combining two completely different platforms at the single-quantum level is technically challenging [16,17]; so far, quantum network nodes with integrated memory qubits have been realised with solid state systems [18,19] and trapped atoms [20,21].
Here, we demonstrate BQC using a trapped-ion quantum processor (server) that integrates a robust memory qubit encoded in 43 Ca + with a single-photon interface based on 88 Sr + to establish a quantum link to the client (photon detection system).We implement an interactive protocol, where the client can remotely prepare singlequbit states on the server adaptively from shot to shot using real-time classical feedforward control.The complexity needed for universal quantum computation is contained entirely within the server, while the client is a simple photon polarisation measurement device that is independent of the size and complexity of the algorithm and supports near-perfect blindness by construction.The client and the server are controlled by independent hardware and connected only by a classical signalling bus and an optical fibre.Our system achieves noise levels below a certain threshold for which arbitrary improvements to the protocol security and success rate (robustness) are theoretically possible [22].
Protocol.Quantum algorithms can be described in the measurement-based quantum computing model, which prescribes a sequence of measurements on a highly entangled resource state [23,24].Information-theoretic blindness can be achieved, even against maliciously operating servers, if either the state preparation or the measurements are performed by the client [6,[25][26][27].
In the presence of noise, even a faithfully operating server produces erroneous results that are indistinguish- Verifiable blind quantum computing in the measurement-based model.The computation is expressed as a sequence of measurements on a brickwork state (twodimensional graph with vertices representing virtual qubits, and edges indicating CZ gates).The server holds m physical memory qubits (orange atoms) and one physical network qubit (violet atom).The server can entangle these qubits deterministically with each other.The network qubit can also be entangled with a photon; by measuring this photon, the client can steer the network qubit in the server remotely without the server learning about its state.This allows the client to hide the computation (inputs, outputs, and circuit) from the server.Moreover, the client can verify that the computation has not been tampered with by (randomly) interleaving test rounds, which produce classically simulatable outcomes and cannot be distinguished from the actual computation by the server.
able from nefarious modifications to the honest protocol [7,8,28,29].Blindness allows the client to secretly test the quantum resources provided by the server.The protocol implemented here achieves this by interleaving "computation" and "test" rounds.A statistical argument provides bounds for the security and robustness of this protocol for the important class of bounded-error quantum polynomial time (BQP) decision problems [22].The client accepts a result if the observed fraction of failed test rounds, p fail , is below a chosen threshold, ω.If ω is below the theoretical threshold ω max , the overhead due to repetition is low: the probability of accepting an incorrect result decreases exponentially with the number of rounds.The minimum value for ω depends on the amount of noise in the devices.The client assumes a maximum expected test round failure rate, p max , and chooses ω > p max such that the probability of rejecting any result also decreases exponentially with the number of rounds, making the protocol robust to a limited amount of noise.
To blindly run the above protocol with measurement angles α ℓ , the client performs remote state preparation (RSP) into |θ ℓ ⟩ = exp(−i θ ℓ 2 Z) |+⟩, with secret phase shift θ ℓ ∈ Θ for every qubit ℓ = 1, 2, . . ., q, and shifts the measurement angles accordingly.This way, θ ℓ act as a classical encryption key such that α ℓ remain private to the client.To ensure that the corresponding measurement outcomes, m ℓ ∈ {0, 1}, are uninformative, the client hides bit flips in half of the measurement angles that are indicated by secret key bits, r ℓ ∈ {0, 1} [Eq.( 1)].The client can recover the unencrypted measurement outcomes as m ℓ ⊕ r ℓ .
Here we implement BQC on linear cluster states [Fig.2].Two physical qubits are sufficient to implement linear clusters of arbitrary length, as qubits can be reinitialised after every mid-circuit measurement.The first qubitthe network qubit -can be steered into an arbitrary state by the client using RSP [31], while the second qubit -the memory qubit -carries the information encoded in the leading node of the expanding linear cluster state.We break the cluster state into discrete interaction steps between the server and the client, starting with the initialisation step [Fig.2], which prepares the memory qubit in |θ 1 ⟩.At each interaction of a computation round, the client performs RSP to steer the network qubit into |θ ℓ+1 ⟩ and communicates to the server, where R ℓ = 1≤j<ℓ/2 (m ℓ−2j ⊕r ℓ−2j ) is the adaptive feedforward correction from decrypted previous measurements.After applying the CZ gate and a SWAP gate, the server measures the network qubit in the Bδ ℓ basis and returns the result, m ℓ , to the client [interaction blocks in Fig. 2].This process leaves the leading cluster state node on the memory qubit, encrypted by R ℓ [32], while the network qubit is available for further RSP.
The client randomly assigns each round a secret label identifying them as a computation or a test.In test rounds, the client prepares every second qubit in a Z eigenstate, |r ℓ ⟩, which are called "dummy qubits".This step leaves the remaining, so-called "trap qubits", in a separable state.The outcome m ℓ != r ℓ of measuring these trap qubits with δ ℓ = θ ℓ + πr ℓ can thus be predicted efficiently by the client.
Server.The server controls an ion trap quantum processor containing one 88 Sr + and one 43 Ca + ion.Ion- photon entanglement needed for RSP is generated by fast excitation and spontaneous decay [37] on the 422 nm transition of 88 Sr + .The single photons are collected by free-space optics and coupled into a single-mode optical fibre [38], which forms the quantum link with the client.The memory qubit is encoded in 43 Ca + , which provides a long coherence time (∼ 10 s) and is unaffected by concurrent manipulation of 88 Sr + [21].Thus, 88 Sr + can be used for mid-circuit measurements and sympathetic cooling between interaction steps.The CZ gate required to build the cluster state is combined with the SWAP gate into an iSWAP gate.This enables reuse of 88 Sr + for RSP whilst the current state of the computation is retained on the memory qubit.Errors during the initialisation step are detected in real time [m err = 1 in Fig. 2] in which case this step is repeated.
Client.The client receives single photons from the server through an optical fibre.The quantum capability of the client is reduced to projective polarisation measurements of these photons in a basis that can be dynamically reconfigured by changing the voltages on two electro-optic modulators (EOMs) [32] [Fig.3].This measurement remotely steers the network qubit into a state that depends only on the polarisation measurement basis and the measurement outcome obtained, information known exclusively to the client [ θℓ and c ℓ in Fig. 2].Birefringence in the optical fibre transforms the photonic state before reaching the client by an unknown unitary operation, which drifts on a timescale of ∼ 10 min due to thermal effects.To compensate for this drift, the client periodically recalibrates the EOM voltages [32] [Fig.3(c)].
Blindness.We consider information that could leak to an adversarial server, concerning the client's polarisation measurement, via the network qubit, which is controlled by the server, and through classical signals, which are controlled by the client.We quantify the information that the server could gain from measuring the network qubit at 0.031(4) bits per interaction step using quantum state tomography, and find good agreement with independent estimates [32].In our demonstration, mismatched electronic delays between different polarisation measurement outcomes are the dominant cause for information leakage.However, as the client controls the relevant classical signals, these delays could be matched.The remaining leakage of ∼ 0.001 bits per interaction step would be dominated by imperfections in the polarising optics used by the client.
Results.We realise different quantum computations with one and two interaction steps, see Figs. 4(a) and 4(b) respectively.We could use the output qubit in further interaction steps, or make a final measurement in the basis Bδq+1 to complete the (q + 1)-node cluster computation.In this demonstration, however, the output qubit is always measured in the Z basis.Since this measurement commutes with the CZ gate preceding it, the computation is equivalent to a cluster state with one fewer node.The one-and two-step interactions therefore implement the computations HZ(α 1 ) |+⟩ and X(α 2 )Z(α 1 ) |+⟩, respectively, where H is the Hadamard gate, X(α) = exp(−i α 2 X) and Z(α) = exp(−i α 2 Z) are single-qubit rotations, and α 1 and α 2 are encrypted using Eq.(1) during the protocol.From the server's perspective, the outcomes appear random [squares in Fig. 4(a)] as a result of the bit-flip encryption, δ ℓ ∝ r ℓ π, which is applied by the client in both the computation and test rounds.The client on the other hand can use the round type (computation or test) and encryption key (r ℓ ) to decode the outcomes.The decoded computation outcomes, indicated by the circles in Fig. 4(a) and the colourmap in Fig. 4(b), match the expected fringe pattern as a func- tion of the blind measurement angles α 1 and α 2 .Experimental imperfections lead to a reduction in contrast and to phase shifts.The client observes an error rate of p (1) fail = 0.201(3) on the first qubit and p (2) fail = 0.095(2) on the second qubit [bottom panel in Fig. 4(a)], which are consistent with known error sources [32].By changing the final measurement basis from Z to Bδq+1 with an additional π/2 pulse, which would have no significant impact on the error budget, and randomly choosing one qubit as trap qubit in every test round, we find that a two-node cluster computation could be verified using our apparatus [32]; the expected average test round failure probability of ∼ 0.18 would be significantly below ω max = 0.25 required for secure and robust verification of this state.The corresponding test round results for the three-node cluster computation are shown in the Supplementary Material [32]; the observed failure rates indicate that verification is not possible in this case, largely due to technical limitations (motional heating) on the ≈ 0.91 fidelity of the iSWAP gate [21].
Conclusion.We have implemented a protocol for blindly delegating quantum computations to a trapped- ion quantum processor, using a client apparatus that requires only single-photon polarisation measurements and classical communication.We have established bounds on information leakage through both the classical and quantum channels that are present in our implementation.We have shown that the size of the cluster state can be increased without increasing the number of physical qubits in the server and without modifications to the client hardware.If more memory qubits were added to the server [39,40], the computational space could be extended to higher-dimensional cluster states.We have taken steps to include verification into the protocol, and the measured test round error indicates that computations on two-node cluster states could be verified robustly and reliably.We predict that for a BQP decision problem with small inherent algorithmic error and p max = 0.185, the probability of accepting an incorrect result and that of rejecting any result would both be 10 −5 after 24 000 repetitions, including 14 400 test rounds; every additional 1200 repetitions would halve this likelihood [32].This approach is expected to provide both security and robustness for larger cluster states and other algorithms as long as the errors remain below the size-dependent threshold, ω max ≈ 1−(3/4) 2/q , where q is the total number of qubits in the cluster state.The protocol that we have implemented does not incorporate error correction; to verify larger cluster states, the error per interaction step would need to be reduced.The infidelity of the iSWAP gate is the leading error source [21], but we note that in other systems, CZ gates between 88 Sr + and 43 Ca + with fidelity 0.998 have been demonstrated [41].The state-of-the-art ion-photon entanglement fidelity of 0.979(1) (this apparatus) is limited primarily by technical imperfections in the optical setup (alignment).
In comparison with previous experimental implementations [11][12][13][14], which were based on purely photonic platforms without quantum memory, this work overcomes several major challenges associated with real-world BQC deployments.As quantum logic operations in the server are deterministic and the interaction with the client is heralded, our implementation eliminates the need for post-selection, avoiding the associated efficiency, scalability, and security issues [11,12,14].Here, photon losses in particular do not present a security threat, and the use of a memory qubit combined with fast and adaptive hardware facilitates true shot-by-shot randomisation of all protocol parameters in real time.
Future realisations could involve a complex network of servers and clients.Photons could be routed to a number of clients using optical switches, and the distance to the server increased using frequency conversion of the photons to telecommunication wavelengths [42] or using recent developments in fibre technology [43].The photonically-interfaced trapped-ion quantum information platform demonstrated here paves the way for secure delegation of confidential quantum computations from a client with minimal quantum resources to a fully capable, but untrusted, quantum server.
We thank Sandia National Laboratories for supplying the HOA2 ion trap used in this experiment, and the developers of the experimental control system AR-TIQ [44].DPN  We make extensive efforts to conduct our experiments under conditions that are representative of a real deployment.The client and the server are controlled by independent personal computers and hardware from the AR-TIQ open-source control system [44].The experiment and calibration schedule is coordinated over Ethernet.For timing-critical communication, such as the interaction during the protocol, low-latency electronic signals are used.Throughout the data acquisition and analysis process, the client does not reveal any protocol secrets to the server.

LINEAR CLUSTER STATE
In computation rounds, the memory qubit state after q interactions is given by where X and Z are Pauli operators and H is the Hadamard gate.

SEQUENCE TIMINGS
The time taken to process one node of a cluster state includes an average 100 µs until successful detection of a single photon at the client for RSP (limited by photon loss in the quantum link), ∼ 400 µs for transfer between the logic and the memory qubit in 43 Ca + [21], ∼ 340 µs for the iSWAP gate between 88 Sr + and 43 Ca + , ∼ 135 µs for readout of 88 Sr + , 50 µs for deshelving of 88 Sr + , ∼ 230 µs for sympathetic ground state cooling using 88 Sr + , and ∼ 150 µs for the communication of the measurement outcome from the server to the client.
The duration of each photon generation attempt is 1 µs, which includes server-side fast state preparation of 88 Sr + (∼ 350 ns laser switching latency + 300 ns pulse duration + 50 ns delay), server-side pulsed excitation within a 12.5 ns window, client-side photon detection windows (∼ 30 ns), and communication of the outcome, i.e. whether a photon was received (∼ 64 ns).The client and the server continue attempts in a loop until either a photon is detected at the client or a timeout (1 ms) is reached.In the case of a timeout (probability < 10 −4 ), a series of system checks (ion loss, laser lock status) is performed before continuing the protocol.

CLIENT APPARATUS
In order to meet the timing requirements for rapid manipulation of the photon polarisation, EOMs (Thorlabs, EO-AM-NR-C4) were selected for their fast switching speeds.For achieving universality, two electro-optic modulators in series provide the necessary degrees of freedom to be able to realise any polarisation measurement basis.

Temperature stability of EOMs
Even though the EOMs are manufactured in a dualcrystal configuration which provides passive cancellation of the differential temperature dependence between the ordinary and extraordinary axes, significant temperature-dependent polarisation drifts were observed in a preliminary investigation [33].Therefore, the final optical layout of the client apparatus is designed with shared temperature stabilisation of the EOMs [Fig.S5].A two-layer enclosures with added thermal insulation surrounds the EOM modules.In addition, active stabilisation is employed using a Peltier element on the top surface of the mount, with a heatsink and a fan for ducted heat removal.With the feedback gains calibrated using a variant of the Ziegler-Nichols method [34], the temperature settles within ∼ 2 min and reaches a stability below 0.1 mK under typical operating conditions.

Optical impurities in EOMs
The incoming light is focussed into the first EOM, then recollimated and focussed into the second EOM, using 300 mm plano-convex lenses.Focussing the light through the crystals significantly reduces depolarising effects due to spatial inhomogeneities in the EOM crystals.

Polarising beam splitter
Imperfections of the polarising beamsplitter (PBS) reduce the distinguishability of orthogonal polarisation states.We measure the extinction ratio of the PBS for pure s and p polarisation, and obtain T s /T p = 0.5 × 10 −4 and R p /R s = 1.3 × 10 −4 in transmitted and reflected power, respectively.We note that this imperfection has no effect on the blindness of the implementation; it merely reduces the RSP fidelity.

Internal birefringence cancellation
The action of an ideal EOM is to rotate the polarisation around a fixed axis represented by the unitary transformation where the rotation angle ϕ is a function of the voltage U applied across the crystal and X = |H⟩⟨V | + |V ⟩⟨H| in the basis given by the extraordinary axis of the EOM.
For a pair of ideal EOMs to be able to reach any output polarisation from an arbitrary input, the rotation axes must be made orthogonal to each other.This can in principle be achieved by placing a quarter waveplate between the EOMs; in practice, however, there is an unknown amount of static birefringence from each optical element including the EOM crystals and mirrors.To compensate this exactly, the inverse unitary operation has to be constructed with optical elements.It can be shown that at least a triplet of waveplates, e.g. two quarter-wave and one half-wave, are required to implement the most general unitary acting on the polarisation qubit [35].In Fig. S5, all optical components that could affect the polarisation are labelled with a unitary operator.The operators Ê1 and Ê2 capture the unknown static birefringence in the two EOMs.We adjust the waveplate triplets Ŵ1 and Ŵ2 to approximately cancel all unwanted sources of birefringence, such that where PBS = Ẑ = |H⟩⟨H|−|V ⟩⟨V | is the projector implemented by the PBS and QWP = exp(i π 4 Ẑ) is the unitary of an ideal quarter waveplate aligned with a principal axis.We do not correct the transformation from the input state |ψ⟩ to | ψ⟩ because this merely rotates the overall coordinate system.

Switching dynamics
Significant drift behaviour was observed after changing the electric field across the crystal [33].This can be attributed to charging of the crystal by the high-voltage electrodes attached to it.We therefore apply compensation pulses after each pulse with the same duration and amplitude, but opposite sign, in order to zero the time-averaged electric field.A systematic analysis of the pulse duration, settling time and the duty cycle showed that with compensation pulses in place the detrimental effects, which otherwise dominate, can be fully removed.We determine the switching speed by recording the intensity of the transmitted fraction over time.The intensity settles to 1 % of the final value within 18 µs, in synchronisation with the settling of the driving voltage, which we therefore identify as the speed-limiting factor.

Precharacterisation
To characterise the action of the client setup on arbitrary polarisation inputs, we use motorised waveplates following a Glan-Taylor polariser at the input.For this characterisation, we use ∼ 1 mW of continuous-wave laser light at 422 nm.The fraction of horizontally polarised output power contains information about the state amplitudes, but not their phase.To gain knowledge of the phase, amplitude information of linearly independent input states must be combined.We collect data for all combinations of quarter-waveplate (measured retardance 2π × 0.2584(4) rad) angles q ∈ {−π/4, 0, π/4} rad and half-waveplate (measured retardance 2π × 0.5000(1) rad) angles h ∈ {−π/8, 0, π/8, π/4} rad in random order.For each EOM voltage setting, we perform a nonlinear fit to the waveplate scan data using the model for the transmitted fraction t, where |ψ⟩ = cos(ϑ/2) |H⟩+ sin(ϑ/2) exp(iφ) |V ⟩, the waveplate angles (q, h) are var-ied in the scan, and (ϑ, φ) are adjusted during the optimisation.The result of this analysis is shown in Fig. 3(b) of the main text.Using a density matrix formulation of Eq. ( 2), the purity of the reconstructed states is found to be consistent with Tr(ρ 2 ) = 1 for all EOM voltage settings used.

Orthogonal measurements
In order to achieve perfect blindness, the measurements implemented by the client apparatus must not leak information to the server.One possibility for this to happen would be secret-dependent noise, such as imperfections that depend on the EOM voltage settings.Using the same measurement setup as described at the beginning of this section, we record data for an exhaustive list of quarter-and half-waveplate angles (overlap between adjacent polarisation states ≈ 3 × 10 −4 ).For each EOM voltage pair (U a , U b ) scanned, we select the two input polarisation states |ψ + ab ⟩ and |ψ − ab ⟩ created by these waveplates that respectively maximise the power transmitted and reflected by the PBS.The overlap ⟨ψ − ab |ψ + ab ⟩ 2 shown in Fig. S6 averages to 0.0016 (median value).

Ion-photon entanglement
The performance of the ion-photon interface was monitored continuously using two-qubit tomography, which allows to reconstruct the density matrix that describes the joint state of the network qubit and the polarisation qubit [Fig.S7(a)], as described in Ref. [38].

Polarisation analyser
The stability of the polarisation analyser was independently examined ex situ using repeated tomography measurements over the same set of EOM control voltages for 62 h [Fig.S7(b)].Over this time period, the infidelity due to polarisation drifts was less than 3 × 10 −4 , limited by the accuracy of the measurement.

Remote state preparation calibration
As the fibre connecting the server and the client is naturally exposed to changes in temperature and strain, its birefringence needs to be calibrated periodically.In order to do so, the client instructs the server to perform X-, Yand Z-basis measurements for EOM voltages on a regular 21×21 grid, in random overall order.Ion readout results are inverted for heralds in avalanche photodiode (APD) s and combined with results for APD p.Let Σ B |y⟩ denote the number of readout observations with outcome y ∈ {s, p} when measured in the B ∈ {X, Y, Z} basis.Direct inversion tomography is used to reconstruct the The client then determines the EOM voltage settings which minimise the angular deviation of ⃗ b from the axis on the Bloch sphere corresponding to each of the 5 target bases required during the verifiable blind quantum computing protocol.
Combining the readout results from both APDs s and p leads to a reduction in RSP fidelity if the states created by different heralds are not exactly orthogonal, for example due to a systematic delay mismatch in the heralding signal chains [Fig.S9(a)].At the time the experiments were performed, this resulted in ∼ 5 % infidelity in each qubit in the cluster state.This mismatch can be eliminated by matching the delays of the heralding signals, or by analysing the data separately for the two different heralds, such as for the fidelities shown in Fig. S7(c).

TRAP FAILURE PROBABILITY FOR 2 INTERACTION STEPS
The trap qubit error rate is affected by remote steering into |θ⟩ (fidelity F ′ θ ≈ 0.924 lower than F θ due to unaccounted timing mismatch between APDs [Fig.S9(a)] when the data presented in the main text was gathered), the error-detected iSWAP gate (fidelity F ′ iS ≈ 0.973), mapping of the superposition between the {|F = 4, m F = 4⟩ , |F = 3, m F = 3⟩} logic qubit and the magnetic field-insensitive {|F = 4, m F = 0⟩ , |F = 3, m F = 0⟩} qubit within the 43 Ca + ground state hyperfine structure (fidelity F map ≈ 0.98), and the iSWAP without error detection (fidelity F iS ≈ 0.913).We neglect state preparation, measurement, and single-qubit rotation errors (fidelities > ∼ 0.99).The trap qubit failure rate is therefore expected to be The dummy qubit error rate is affected by remote steering into |z⟩ (fidelity F z ≈ 0.996) and the final iSWAP gate: The measured values p fail and p (2 fail that are stated in the main text agree well with these estimates.We note that the last qubit in a cluster state must not be swapped back from the memory qubit to the network qubit; the number of iSWAP gates impacting this qubit is therefore reduced by one.For the two-qubit cluster state, which could be implemented using the same sequence by changing the final measurement basis from Z to Bθq+1 , we need to consider a second trap qubit placement: with the first qubit the dummy qubit and the second qubit the trap qubit, we expect We plot the error observed on each of the qubits in the three-node cluster state in Fig. S8.In this implementation, the first and the last qubit in the linear cluster state exhibit lower error rates than the qubits in between.The error in the first qubit is smaller due to the iSWAP error detection in the initialisation round.The last qubit is not transferred back from the memory qubit to the network qubit for the final measurement, which reduces the number of iSWAP gates impacting this qubit by one.

ERROR DETECTION
Errors during the initialisation step are detected in real time (error probability ∼ 0.1) in which case the current round is aborted and restarted after a period of cooling [21].The overhead due to repetition of this step is independent of the size of the cluster state and hence does not affect the scalability of the implemented protocol.Here, the client can keep the same random variable θ1 because the phase shift a 1 π depends on the photon polarisation measurement outcome, which is inherently random.The server therefore obtains a maximally mixed state on the network qubit.Information leaking through classical communication as a result of reusing θ1 could also be eliminated, as the client is in control of all relevant signals.The error detection probability is closely related to the iSWAP infidelity; by reducing this infidelity, error detection would become obsolete.

PHOTON LOSS
The average time taken to obtain a single-photon herald is ≈ 100 µs; hence the probability for no herald to occur within the timeout period of 1 ms is < 10 −4 .If no photon is received within this period, the client instructs the server to repeat the current round starting from the initialisation step after a series of system checks.The timeout allows the server to recover from rare events that could temporarily hinder the generation of single photons, such as ion loss, misalignments in the photon collection optics, or laser failures.The information leakage due to repetition in these rounds is purely classical and could be eliminated by the client, who is in control of all relevant signals.Alternatively, the client could introduce fresh randomness at every retry to avoid this issue.The loss of determinism due to photon loss is influenced by the timeout period and could be completely eliminated if the client continued execution of the protocol despite an unsuccessful steering attempt.In this case, the server would check for system failures after the client has completed this round of the protocol.The computational error that is incurred by this approach due to photon loss would reduce exponentially with increasing timeout period.

BLINDNESS
Here we consider experimental imperfections that could adversely affect the blindness of the protocol.Blindness is characterised by how much information an adversarial server could learn about the client's photon measurement basis choices θ ℓ (3 bits of information per shot).Table S1  TABLE S1.Sources of information leakage in a single interaction step.The optimised values assume matched heralding delay (from excitation of 88 Sr + until electronic detection) and balanced polarisation measurement outcomes.We use quantum state tomography to quantify the information that the server could gain from measuring the network qubit and find good agreement with independent estimates inferred from known imperfections (measurement basis, imbalanced outcomes).The values are to be compared with the amount of information (3 bits) that specifies the steered state, |θ ℓ ⟩.
of the experiment, indexed by ℓ, we assume that the server has unrestricted access to • the qubit measurement angle δ ℓ (classical signal), • the phase reference set by the photon detection time (classical signal), • the number of attempts until a single-photon herald (classical signal), • and the state of the memory and network qubits.
Blindness is compromised if the above observables correlate with θ ℓ .

Classical information leaks
In this section, we analyse the effect of classical sources of information leakage that are present in our system.These sources do not include side-channel attacks, which are in general difficult to treat systematically.We note that, in a real deployment, the client could straightforwardly monitor and eliminate leakage on all classical channels.Encrypted measurement angle δ ℓ does not leak information because it is encrypted with private randomness at every shot by the client.We note that the use of a pseudo-random number generator does not compromise blindness (against computationallybounded adversaries) provided that its implementation is cryptographically secure.

Single-photon heralding delays
The arrival time of photons at the APDs with respect to the pulsed excitation of 88 Sr + , is inherently random due to the nature of spontaneous decay.As these heralding times set the phase reference for the network qubit, they must be communicated to the server.Statistical differences between the herald timing distributions could therefore be exploited by the server to learn about the polarisation measurement outcome.
The server could employ a maximum-likelihood strategy to guess the photon measurement result.The detector properties may be known to the server.This includes the probability distributions Pr s (x) and Pr p (x) for a herald at time x in detector s and detector p, respectively.The server would assume that a photon heralded at time x was observed in detector s if Pr s (x) > Pr p (x), and vice versa.This maximum-likelihood strategy succeeds with probability σ(x).The expected information gain is given by R ML = x Pr(x)R(σ(x)), where R(q) = 1 + q log 2 (q) + (1 − q) log 2 (1 − q) is the mutual entropy for a binary guess with success probability q, and Pr(x) is the overall probability of observing the arrival time x.
In this demonstration, no measures were taken to equalise the detector responses of the APDs.Observed differences [Fig.S9(a)] are mainly due to unmatched delays in the electronic signal chain, by 6.57(2) ns, leading to R ML ≈ 0.35 bits information leakage.This imperfection could be minimised by adding delay to one of the signals (e.g. by extending the cable by ≈ 1.3 m).After correcting for the delay mismatch, the information content would be reduced to R ML ≈ 7×10 −5 bits, dominated by higher-order electronic distortion, such as differences in timing jitter between the electronic inputs used for timestamping.Here, a field-programmable gate array is used for timestamping; it only provides 1 ns resolution, with inconsistent jitter between inputs.We note that this is not a fundamental limitation and leakage of this kind could be eliminated by the client by appropriately conditioning the classical heralding signals.

Single-photon heralding probability
As the client publicly announces when a photon was successfully heralded, the server learns about the number of attempts taken, hence the detection efficiency, of the client apparatus.If the detection efficiency depends on the secret measurement settings chosen by the client, the server could, in principle, obtain information that would compromise the blindness of the protocol.Here we analyse the extent to which this affects our demonstration of blind quantum computing.
We observe variations in the detection efficiency depending on the EOM voltage settings of ≈ ±5 % [Fig.S9(b)].The EOM voltages are changed after every photon received by the client. 1 Therefore, the server obtains only one attempt-number sample per measurement setting.At every shot, the server's a priori knowledge is reset, due to this shot-by-shot randomisation, to the exponential distribution with an expectation value λ 0 estimated from the number of attempts in previous shots.The Fisher information, I(λ) = λ −2 , quantifies the information each sample contributes towards an updated estimate of the underlying distribution, i.e. the exponential distribution for this shot with secret-dependent expectation value λ.This quantity needs to be compared to the relative entropy, S(λ 0 , λ), between the exponential distributions with respective expectation values λ and λ 0 .

Quantum information leaks
We analyse the information which the server could gain on average from measuring the network qubit after RSP in terms of the Holevo bound χ.For perfect blindness, χ = 0, whereas one qubit can maximally transmit χ = 1 bit.We exclude test rounds, where the client steers the network qubit into Z basis eigenstates, from this analysis.Including dummy qubits would strictly reduce the Holevo information because these states do not correlate with θ ℓ .Hence, the resulting improvement in overall privacy depends on the fraction of rounds which are tests.
The server receives quantum states that are generated by steering of the network qubit.For every qubit in the computation, the client chooses secretly one of 4 measurement bases, Bi , i ∈ {1, 2, 3, 4}, to steer the network qubit into ρ + i with probability q i or ρ − i with probability (1 − q i ), depending on the measurement outcome.Averaged over the outcomes 2 , the server receives the states 1 In < ∼ 5 % of cases in the present implementation, retries (due to errors in the initialisation step, with probability ∼ 0.1, and failures to produce a single-photon herald within the time-out interval, with probability < 10 −4 ) were performed without the client changing the measurement settings.However, this additional information does not change the conclusion of this analysis and the issue could be eliminated by introducing fresh randomness at every retry as well. 2 If the basis angle θ ℓ is leaked, a simple measurement of the network qubit deterministically reveals also the client's measurement outcome.
The Holevo information, which bounds the amount of information contained in this quantum state, is given by where S(ρ) = −Tr (ρ log 2 (ρ)).
In our experiment, ρ + i and ρ − i are steered by the measurement of an entangled subsystem (a photon), which can be described using positive operator-valued measurements (POVMs).We use the maximally-entangled Bell state (|s⟩ |0⟩ + |p⟩ |1⟩)/ √ 2 between the photon and the environment to simulate RSP, which is justified by the proof in the section "remote state preparation by steering".

Imbalanced and mixed outcomes
We estimate the blindness of RSP using the POVMs { F } describing a PBS with extinction ratios ϵ s and ϵ p for sand p-polarised input, and two APDs that are placed in the (ideally) s-and p-polarised output ports of the PBS, characterised by detection efficiencies η s and η p , respectively: where Fp and Fs correspond to photon detection in APD p and APD s, respectively, and F0 corresponds to a photon loss event.As long as PBS imperfections act as depolarising noise, such as for finite polarisation extinction, these effects have no effect on the Holevo information.We may therefore assume without loss of generality ∀i that ρ + i and ρ − i are orthogonal pure states, which occur with probability q i = ηp ηp+ηs ≈ 1 2 .Choosing the more favourable configuration of measurement bases 3 , the average information contained in one qubit is bounded from above by 3 It is less favourable to let ρ + j = |jπ/4⟩⟨jπ/4|, as the error due to imbalanced rates adds constructively.However, using {ρ + 1 , ρ − 2 , ρ + 3 , ρ + 4 } j = |jπ/4⟩⟨jπ/4| for example, part of the error cancels.
With the average imbalance ⟨|0.5 − q|⟩ Ua,U b derived from measurements shown in Fig. S9(c) and specified in the main text, we infer that the information leakage due to this effect is χ ≈ 2.9 × 10 −4 bits.Even if static photon loss is introduced to balance the detection efficiency on both detectors, the secret-dependent variation remains the dominant source of leakage: we estimate χ ≈ 2.6 × 10 −4 bits for this scenario.While the origin of the variations shown in Fig. S9(c) has not been confirmed, we suspect that the EOMs disturb the wavefront of the photons, which affects the mode matching into the optical fibres that are used for convenience to couple the photons into the APDs.Because the quantum information is encoded in the polarisation of the photon, their spatial mode is irrelevant to our implementation, rendering this observation of voltage-dependent imbalance of heralds practically insignificant.Alternatively, this source of leakage could be eliminated fully if the client conditioned heralds on local randomness (at the cost of a 50 % reduction in the total heralding rate).

Rotated POVMs
Using the POVMs in the product space of the photon polarisation and the network qubit, The electronic signal delay between orthogonal heralds shown in Fig. S9(a) not only leaks information via the classical reference time signal, but also causes a relative Z rotation of the network qubit depending on the photon measurement outcome.Inserting ϕ = Ω Z ∆t, where Ω Z ≈ 2π × 14 MHz is the 88 Sr + Zeeman qubit splitting and ∆t = 6.57(2) ns is the measured delay difference between the two heralds [Fig.S9(a)], we obtain χ ≈ 0.035 bits.
Once the heralding delays are matched, imperfections in the photon polarisation measurement are expected to dominate information leakage through this channel.Using the average overlap of 0.0016 between projectors corresponding to different heralds [Fig.S6], we obtain ϕ ≈ 0.08 rad, resulting in χ ≈ 7 × 10 −4 bits of potential information leakage.
Alternatively, rather than relying on the orthogonality of the polarisation measurement, the client could exploit the fact that every polarisation measurement basis can be reached by two distinct EOM voltage settings and switch randomly between them.The effectiveness of this approach would depend on the accuracy of the voltage calibration, which could be increased by acquiring calibration data with sufficient precision.

Measured quantum information leaks
We use quantum state tomography to reconstruct the steered state of the network qubit for all eight equatorial target states of the measurement-based protocol (see average fidelities w.r.t.|θ⟩ in Fig. S7(c)).Using the estimated density matrices, we calculate the Holevo information according to Eq. ( 3) and obtain of 0.031(4) bits per qubit, averaged over all runs where the polarisation measurement bases matched the (more favourable) configuration that was assumed above in the derivation of Eq. ( 4).

Number of rounds
Fault probability FIG.S10.We evaluate p fault for a 2-qubit cluster state as a function of the number of rounds in the protocol proposed in Ref. [22], assuming pmax = 0.185.We obtain τ ≂ 0.6 and ωmax ≂ 0.205 for all data points shown (crosses).
We evaluate an upper bound to the probability of the client accepting an incorrect result, Pr[fail], for the verification protocol proposed in Ref. [22] by numerically minimising Eq. (E5) from Ref. [22] for k = 2 qubits and an intrinsic algorithmic error probability p = 0.During this minimisation, we constrain the probability of the client rejecting any result due to noise, p rej , by setting p rej = Pr[fail].The minimum fault probability, p fault := min C Pr[fail], where C denotes the constraints, is shown in Fig. S10 for a variable number of total rounds, n, including τ n test rounds.The associated optimal threshold, ω, the fraction of test rounds, τ , and security parameters (φ, ϵ 1 , ϵ 2 , ϵ 3 ) are adjusted by the minimiser.The probability of a failure, i.e., the probability of a security issue (accepting an incorrect result, Pr [fail]) and that of a robustness issue (rejecting any result, p rej ), decreases exponentially with the number of rounds.Proof.After the client's measurement, the remaining single-qubit state in the server's quantum register can be described by U † 1 X m |0⟩.The server's output therefore becomes U 2 U † 1 X m |0⟩ = U |0⟩.
Lemma 2. Protocol 1 implements Resource 1 with perfect security against a malicious server.
Proof.As part of the proof, let σ be defined as in Simulator 1.

Simulator 1
Instructions: 1.The simulator expects a single-qubit quantum state |ϕ1⟩ as an input from the ideal functionality on its left interface.
2. It expects a single-qubit quantum state |ϕ2⟩ as an input from the distinguisher on its right interface.
3. It samples a single-qubit unitary U1 randomly from the Haar measure.
4. It applies the two-qubit unitary U1 ⊗ I to the state |ϕ1⟩|ϕ2⟩ and performs a Bell measurement on it, obtaining measurement outcomes m1 and m2.
5. It then sets U2 = U † 1 Z m 1 X m 2 and outputs the classical description of U2 on its right interface to the distinguisher.
It remains to be shown that the composition of Resource 1 with σ (the ideal world) generates the same distribution on its interfaces as the client's instructions of Protocol 1 (the real world).
Let |ψ⟩ be the purification of the distinguisher's quantum register just before sending the first qubit of its register to the client.Then, in the real world, after the client's measurement, the state of the server's quantum register can be described (up to a global phase) by ⟨0|(X m U 1 ⊗ I)|ψ⟩, and the classical message from the client contains the description of the unitary U X m U 1 , where U 1 is chosen according to the Haar measure.Substituting U 1 for X m U 1 yields ⟨0|(U 1 ⊗ I)|ψ⟩, and the classical description of U U 1 without changing the distribution of U 1 .
In the ideal world, after the simulator's measurement, the state of the server's quantum register can be described (up to a global phase) by and the classical message from the client contains the description of the unitary U † 1 Z m1 X m2 , where U 1 is chosen according to the Haar measure.This can be rewritten equivalently as FIG. 1.Verifiable blind quantum computing in the measurement-based model.The computation is expressed as a sequence of measurements on a brickwork state (twodimensional graph with vertices representing virtual qubits, and edges indicating CZ gates).The server holds m physical memory qubits (orange atoms) and one physical network qubit (violet atom).The server can entangle these qubits deterministically with each other.The network qubit can also be entangled with a photon; by measuring this photon, the client can steer the network qubit in the server remotely without the server learning about its state.This allows the client to hide the computation (inputs, outputs, and circuit) from the server.Moreover, the client can verify that the computation has not been tampered with by (randomly) interleaving test rounds, which produce classically simulatable outcomes and cannot be distinguished from the actual computation by the server.

FIG. 3 .
FIG. 3. The client performs remote state preparation (RSP) using a fast-switching polarisation analyser.(a) The control voltages (Ua, U b ) of two EOMs separated by a λ/4 waveplate enable the client to arbitrarily rotate the measurement basis given by the PBS.(b) Laser light is used to reconstruct this basis for different Ua, U b .Polarisation ellipses are shown for the basis states heralded by detector p, where the colour represents their phase.(c) To find Ua, U b which maximise the fidelity F to each target state needed during the protocol, we perform tomography on the network qubit after RSP.The averaged results from 36 calibrations over 2 weeks are shown in the Bloch sphere representation of the network qubit.Values indicate F , with standard deviations obtained from bootstrapping.

FIG. 4 .
FIG. 4. Experimental results on an expanding linear cluster state, where the leading qubit is measured in the Z basis after (a) one, and (b) two interaction steps between the client and the server.(a) While the server observes mixed outcomes (squares, ∼ 2000 test and computation rounds each), for each α1, the client can decode the results using the secret keys.A fit to the decoded computation outcomes (circles) is shown to guide the eye.Error intervals indicate the binomial standard error.The test round errors are significantly below the threshold for verification of a two-node cluster state (dashed line).(b) The decoded outcome is shown for different blind measurement settings, (α1, α2), each comprising ∼ 3100 computation rounds (see Supplementary Material [32] for interleaved test round results).
FIG. S5.Detailed beam path for the fast photon polarisation analyser used by the client.The EOMs are thermally shielded and actively stabilised to 20 °C with 0.1 mK stability.The waveplate triplets Ŵ1 and Ŵ2 are used to cancel unwanted birefringence in the sections comprising { M3, M4} and { Ê2, M5, M6}, respectively.The birefringence in components { F , M1, M2, Ê1} is absorbed into the calibration of the device.
FIG. S6.Overlap of polarisation input states which produce orthogonal polarisation measurement outcomes.
FIG. S7.Long-term stability of (a) the photonic quantum networking link (b) the client apparatus and (c) the combined system.The measurements (a), (b), and (c) were performed at different times.

16 , 1 2 (p trap 1 fail + p trap 2 fail ) ≈ 0. 18 . 5 FIG
FIG. S8.Observed trap failure rates on each of the qubits in the three-node cluster state (with qubit 3 measured in the Z basis).
FIG. S9.(a) Histogram of delay between pulsed excitation of 88 Sr + and a single-photon herald from detectors s and p.(b) Average number of attempts (1 µs per attempt) until a single-photon herald is announced by the client as a function of EOM control voltages.(c) Ratio of heralds with outcome p with respect to all heralds as a function of EOM control voltages.
[21]2.Protocol used to generate a linear cluster state using a trapped-ion quantum server and a photonic client.The client can steer the network qubit into |θ ℓ ⟩ = | θℓ + c ℓ π⟩ by measuring the polarisation of the photon in the basis Bθ ℓ and obtaining c ℓ ∈ {0, 1} as outcome.In the initialisation step, the server transfers this state onto a memory qubit such that the network qubit can be steered again[21].Every subsequent interaction step extends the size of the cluster state; the client steers the network qubit remotely into |θ ℓ+1 ⟩, the server entangles it (CZ gates), and performs a measurement in the basis Bδ ℓ , where δ ℓ is provided by the client.See text for details.
acknowledges support from Merton College, Oxford.DL acknowledges support from the ANR project SecNISQ.AM and DM acknowledge support from the U.S. Army Research Office (refs.W911NF-20-1-0015 and W911NF-18-1-0340).GA consults for Nu Quantum Ltd and acknowledges support from Wolfson College, Oxford.RS is partially employed by Oxford Ionics Ltd and acknowledges funding from an EPSRC Fellowship EP/W028026/1 and Balliol College, Oxford.CJB is a director of Oxford Ionics and acknowledges support from a UKRI FL Fellowship.EK acknowledges support from grant ref.EP/X026167/1.We acknowledge technical and financial support from VeriQloud (of which EK is a co-founder) during the initial design of this project, via an industry partnership grant from the NQIT Quantum Technology Hub EP/M013243/1.This work was supported by the U.K. EPSRC "Quantum Computing and Simulation" Hub EP/T001062/1, and the E.U.Quantum Technology Flagship Project AQTION (No. 820495).
summarises the sources of information leakage that are quantified in this section.At every shot