Optimal verification of stabilizer states

Statistical verification of a quantum state aims to certify whether a given unknown state is close to the target state with confidence. So far, sample-optimal verification protocols based on local measurements have been found only for disparate groups of states: bipartite pure states, GHZ states, and antisymmetric basis states. In this work, we investigate systematically optimal verification of entangled stabilizer states using Pauli measurements. First, we provide a lower bound on the sample complexity of any verification protocol based on separable measurements, which is independent of the number of qubits and the specific stabilizer state. Then we propose a simple algorithm for constructing optimal protocols based on Pauli measurements. Our calculations suggest that optimal protocols based on Pauli measurements can saturate the above bound for all entangled stabilizer states, and this claim is verified explicitly for states up to seven qubits. Similar results are derived when each party can choose only two measurement settings, say X and Z. Furthermore, by virtue of the chromatic number, we provide an upper bound for the minimum number of settings required to verify any graph state, which is expected to be tight. For experimentalists, optimal protocols and protocols with the minimum number of settings are explicitly provided for all equivalent classes of stabilizer states up to seven qubits. For theorists, general results on stabilizer states (including graph states in particular) and related structures derived here may be of independent interest beyond quantum state verification.

Engineered quantum systems have the potential to efficiently perform tasks that are believed to be exponentially difficult for classical computers such as simulating quantum systems and solving certain computational problems. With the potential comes the challenge of verifying that the quantum devices give the correct results. The standard approach of quantum tomography accomplishes this task by fully characterizing the unknown quantum system, but with the cost exponential in the system size. However, rarely do we need to completely characterize the quantum system as we often have a good idea of how our devices work, and we may only need to know if the state produced or the operation performed is close to what we expect. The research effort to address these questions have grown into a mature subfield of quantum certification [1].
Statistical verification of a target quantum state ρ = |Ψ Ψ| [2][3][4][5][6] is an approach for certifying that an unknown state σ is "close" to the target ρ with some confidence. More precisely, the verification scheme accepts a density operator σ that is close to the target state with the worst-case fidelity 1− and confidence 1−δ. In other words, the probability of accepting a "wrong" state σ with Ψ|σ|Ψ ≤ 1 − is at most δ. For the convenience of practical applications, usually the verification protocols are constructed using local operations and classical communication (LOCC). Such verification protocols have been gaining traction in the quantum certification community [7][8][9][10][11][12][13][14] because they are easy to implement and potentially require only a small number of copies of the state. However, sample-optimal protocols under LOCC have been found only for bipartite maximally entangled states [2,3,8], two-qubit pure states [9], n-partite GHZ states [13], and most recently antisymmetric basis states [14].
Maximally entangled states and GHZ states are subsumed under the ubiquitous class of stabilizer states, which can be highly entangled yet efficiently simulatable [15,16] and efficiently learnable [17] under Pauli measurements. Another notable example of stabilizer states are graph states [18,19], which have simple graphical representations that transform nicely under local Clifford unitary transformations. They find applications in secret sharing [20], error correcting codes [21,22], and cluster states in particular are resource states for universal measurement-based quantum computing [23]. Stabilizer states and graph states can be defined for multiqudit systems with any local dimension; nevertheless, multiqubit stabilizer states are the most prominent because most quantum information processing tasks build on multiqubit systems. In this paper we only consider qubit stabilizer states and graph states unless stated otherwise, but we believe that many results presented here can be generalized to the qudit setting as long as the local dimension is a prime. Efficient verification of stabilizer states have many applications, including but not limited to blind quantum computing [24,25] and quantum gate verification [26][27][28].
While one might expect that the determination of an optimal verification strategy to be difficult in general, one could hope for the answer for stabilizer states in view of their relatively simple structure. Given an n-qubit stabilizer state, Pallister, Montanaro and Linden [4] showed that the optimal strategy when restricted to the measurements of non-trivial stabilizers (to be introduced below) is to measure all 2 n − 1 of them with equal probabilities, which yields the optimal constant scaling of the number of samples, One could choose to measure only n stabilizer generators at the expense of now a linear scaling [4]: This trade-off is not inevitable in general. Given a graph state associated with the graph G, by virtue of graph coloring, Ref. [7] proposed an efficient protocol which requires χ(G) measurement settings and χ(G) −1 ln δ −1 samples. Here the chromatic number χ(G) of G is the smallest number of colors required so that no two adjacent vertices share the same color. With this protocol, one can verify two-colorable graph states, such as one-or two-dimensional cluster states, with 2 ln δ −1 / tests. In this paper we study systematically optimal verification of stabilizer states using Pauli measurements. We prove that the spectral gap of any verification operator of an entangled stabilizer state based on separable measurements is upper bounded by 2/3. To verify the stabilizer state within infidelity and significance level δ, therefore, the number of tests required is bounded from below by Moreover, we propose a simple algorithm for constructing optimal verification protocols of stabilizer states and graph states based on nonadaptive Pauli measurements. An optimal protocol for each equivalent class of graph states with respect to local Clifford transformations (LC) and graph isomorphism is presented in Table I in the Appendix, and our code is available on Github. These results suggest that for any entangled stabilizer state the bound in (3) can be saturated by protocols built on Pauli measurements. In addition, we study the problem of optimal verification based on X and Z measurements and the problem of verification with the minimum number of measurement settings. This problem is of interest in many scenarios in which the accessible measurement settings are restricted. Our study suggests that the maximum spectral gap achievable by X and Z measurements is 1/2. For the ring cluster state we prove this result rigorously by constructing an explicit optimal verification protocol. We also prove that three settings based on Pauli measurements (or X and Z measurements) are both necessary and sufficient for verifying the odd ring cluster state with at least five qubits.
In the course of study, we introduce the concepts of admissible Pauli measurements and admissible test projectors for general stabilizer states and clarify their basic properties, which are of interest to quantum state verification in general. Meanwhile, we introduce several graph invariants that are tied to the verification of graph states and clarify their connections with the chromatic number. In addition to their significance to the current study, these results provide additional insights on stabilizer states and graph states themselves and are expected to find applications in various other related problems.
The rest of this paper is organized as follows. First, we present a brief introduction to quantum state verification in Sec. II and preliminary results on the stabilizer formalism in Sec. III. In Sec. IV we study canonical test projectors and admissible test projectors for stabilizer states and graph states and clarify their properties. In Sec. V we derive an upper bound for the spectral gap of verification operators based on separable measurements. Moreover, we propose a simple algorithm for constructing optimal verification protocols based on Pauli measurements and provide an explicit optimal protocol for each connected graph state up to seven qubits. In Sec. VI we discuss optimal verification of graph states based on X and Z measurements. In Sec. VII we consider the verification of graph states with the minimum number of settings. Sec. VIII summarizes this paper. To streamline the presentation, the proofs of several technical results are relegated to the Appendices, which also contain Tables I and II.

A. The basic framework
Let us formally introduce the framework of statistical verification of quantum states. Suppose we want to prepare the target state ρ = |Ψ Ψ|, but actually obtain the sequence of states σ 1 , · · · , σ N in N runs. Our task is to determine whether these states are sufficiently close to the target state on average (with respect to the fidelity, say). Following [4][5][6], we perform a local measurement with binary outcomes {E j , 1 − E j }, labeled as "pass" and "fail" respectively, on each state σ k for k = 1, . . . , N with some probability p j . Each operator E j is called a test operator. Here we demand that the target state ρ can pass the test with certainty, which means E j ρ = ρ. The sequence of states passes the verification procedure iff every outcome is "pass". The efficiency of the above verification procedure is determined by the verification operator where m is the total number of measurement settings. If the fidelity Ψ|σ k |Ψ is upper bounded by 1 − , then the maximal average probability that σ k can pass each test is [4,6] max Here β(Ω) is the second largest eigenvalue of the verification operator Ω, and ν(Ω) := 1 − β(Ω) is the spectral gap from the maximum eigenvalue. Suppose the states σ 1 , σ 2 , . . . , σ N produced are independent of each other. Then these states can pass N tests with probability at most where¯ = j j /N with j = 1 − Ψ|σ j |Ψ is the average infidelity [5,6]. If N tests are passed, then we can ensure the condition¯ < with significance level To verify these states within infidelity and significance level δ, the number of tests required is [4][5][6] N ( , δ, If there is no restriction on the measurements, the optimal performance is achieved by performing the projective measurement onto the target state |Ψ Ψ| itself, which yields ν(Ω) = 1 and N = ln δ/ ln(1 − ) ≤ ln δ −1 / as the ultimate efficiency limit allowed by quantum theory. 1 A set of test operators {E j } m j=1 for |Ψ is minimal if any proper subset of {E j } m j=1 cannot verify |Ψ reliably because the common pass eigenspace of operators in the subset has dimension larger than one. A minimal set of test operators has the following properties.

Proposition 1.
Suppose Ω = j p j E j is a verification operator based on a minimal set of m test operators. Then ν(Ω) ≤ 1/m. If the inequality is saturated then p j = 1/m for all j.
Proof. By assumption, for each k ∈ {1, 2, . . . , m}, there exists a pure state |Ψ k that is orthogonal to the target state |Ψ and belongs to the pass eigenspace of E j for all j = k, that is, E j |Ψ k = |Ψ k . Therefore, which implies that Here the second inequality is saturated iff p k = 1/m for all k.

B. Verification of a tensor product
Suppose the target state |Ψ is a tensor product of the form |Ψ = J j=1 |Ψ j , where J ≥ 2 and each tensor factor |Ψ j may be either separable or entangled. It is instructive to clarify the relation between the verification operators of |Ψ and that of each tensor factor.
Given a verification operator Ω for |Ψ , the reduced verification operator of Ω for the tensor factor |Ψ j is defined as where |Ψ j := j =j |Ψ j . Note that Ω j |Ψ j = |Ψ j , so Ω j is indeed a verification operator for |Ψ j . If Ω is separable, then each Ω j is also separable. Reduced test operators can be defined in a similar way.
Conversely, suppose Ω j are verification operators for |Ψ j with spectral gap ν(Ω j ) for j = 1, 2, . . . , J. Let Ω = J j=1 Ω j ; then Ω is a verification operator for |Ψ , and Ω j are reduced verification operators of Ω by the definition in (10). Straightforward calculation shows that the spectral gap of Ω reads which saturates the upper bound in (11 is a probability vector. In addition, |Ψ j is the unique common eigenstate of E (j) k with eigenvalue 1. Let m = max j m j ; then |Ψ can be reliably verified by the following test operators where E To verify this claim, first note that E k |Ψ = |Ψ for k = 1, 2, . . . , m, so each E k is a test operator for |Ψ . Suppose |Φ is a common eigenstate of all E k with eigenvalue 1, that is, Φ|E k |Φ = 1. Let ρ j = trj(|Φ Φ|), where trj denotes the partial trace over all tensor factors except for the jth factor. Then we have (15) for all j, k. This equation implies that tr(ρ j E (j) k ) = 1, so each ρ j is supported in the eigenspace of E (j) k with eigenvalue 1 for all k. It follows that ρ j = |Ψ j Ψ j | and |Φ Φ| = |Ψ Ψ|, so |Ψ is the unique common eigenstate of all E k with eigenvalue 1 and it can be reliably verified by the test operators in (14).
Let (q k ) m k=1 be any probability vector with q k > 0 for all k and Ω = m k=1 q k E k ; then Ω is a verification operator for |Ψ with ν(Ω) > 0 according to the above discussion. In addition, the reduced verification operator of Ω for tensor factor |Ψ j reads According to Proposition 2 we have where the maximization is taken over all probability vectors with m components. The right-hand side coincides with the maximum spectral gap achievable by any verification operator of |Ψ j that is based on the set of test operators {E (j) k } mj k=1 . Note that q k = 0 for m j < k ≤ m when the maximum spectral gap is attained given that E (j)

A. Pauli group
Let H = (C 2 ) ⊗n be the Hilbert space of n qubits. The Pauli group for one qubit is generated by the following three matrices: The n-fold tensor products of Pauli matrices and the identity {1, X, Y, Z} ⊗n form an orthogonal basis for the space B(H) of linear operators on H. Together with the phase factors {±1, ±i}, these operators generate the Pauli group P n , which has order 4 n+1 . Two elements of the Pauli group either commute or anticommute. Up to phase factors, n-qubit Pauli operators can be labeled by vectors in the binary symplectic space Z 2n 2 endowed with the symplectic form Let µ x (µ z ) be the vector composed of the first (last) n elements of µ; then µ = (µ x ; µ z ), where the semicolon denotes the vertical concatenation. In addition, we have [µ, ν] = µ z ·ν x +µ x ·ν z . (Addition and subtraction are the same in arithmetic modulo 2.) The Weyl representation [30] of each vector µ ∈ Z 2n 2 yields a Pauli operator where X µ x = X µ x 1 1 ⊗· · ·⊗X µ x n n and similarly for Z µ z . Each Pauli operator in P n is equal to i k g(µ) for k = 0, 1, 2, 3 and µ ∈ Z 2n 2 . For example, we have X = g((1; 0)), Z = g((0; 1)), and Y = g((1; 1)). By the following identity g(µ) and g(ν) commute iff [µ, ν] = 0. The symplectic complement of a subspace W in Z 2n 2 is defined as The subspace W is isotropic if W ⊂ W ⊥ , in which case [µ, ν] = 0 for all µ, ν ∈ W . Hence all Pauli operators associated with vectors in W commute with each other. The maximal dimension of any isotropic subspace is n, and such a maximal isotropic subspace satisfies the equality W = W ⊥ and is called Lagrangian. Each isotropic subspace W of dimension k is determined by a 2n × k basis matrix over Z 2n 2 whose columns form a basis of W . Conversely, a 2n × k matrix M is a basis matrix for an isotropic subspace iff the following condition holds Two Lagrangian subspaces W and W of Z 2n 2 are complementary if their intersection is trivial (consists of the zero vector only), in which case Span(W ∪ W ) = Z 2n 2 . The Clifford group is the normalizer of the Pauli group P n . Up to phase factors, it is generated by phase gates, Hadamard gates for individual qubits and controlled-not gates for all pairs of qubits. Its quotient over the Pauli group is isomorphic to the symplectic group with respect to the symplectic form in (19).

B. Stabilizer codes
A subgroup S of P n is a stabilizer group if S is commutative and does not contain −1. Since S cannot contain a Pauli operator with phases ±i (otherwise −1 ∈ S), every element except the identity has order 2. Thus, S is isomorphic to an elementary abelian group Z k 2 of order 2 k , where k ≤ n is the number of minimal generators. Suppose that the stabilizer group S is generated by the k generators S 1 , S 2 , . . . , S k ; then the elements of S can be labeled by vectors in Z k 2 as follows, The stabilizer code H S of S is the common eigenspace of eigenvalue 1 of all Pauli operators in S, which has dimension 2 n−k . Alternatively, it is also defined as the common eigenspace of eigenvalue 1 of the k generators S 1 , S 2 , . . . , S k . The projector onto the code space reads Conversely, S happens to be the group of all Pauli operators in P n that stabilize the stabilizer code H S . So there is a one-to-one correspondence between stabilizer groups and stabilizer codes. To later establish the relation between stabilizer groups and isotropic subspaces, we introduce the signed stabilizer group of the stabilizer code H S to be the union where −S := {−S|S ∈ S}. Given the stabilizer group S with generators S 1 , S 2 , . . . , S k , for each w ∈ Z k 2 , define S w as the group generated by (−1) wj S j for j = 1, 2, . . . , k; then S w is also a stabilizer group. The stabilizer code H Sw of S w is the common eigenstate of S 1 , S 2 , . . . , S k with eigenvalue (−1) wj for j = 1, 2, . . . , k and is also denoted by H S,w . The projector onto the stabilizer code reads where χ w (S y ) = χ w (y) = (−1) w·y (28) can be understood as a character on S or Z k 2 [31]. Note that all stabilizer codes H S,w for w ∈ Z k 2 share the same signed stabilizer group, that is,S w =S.
According to the Weyl representation in (20), each element in S is equal to g(µ) or −g(µ) for µ ∈ Z 2n 2 . In this way, S is associated with an isotropic subspace W ⊂ Z 2n 2 of dimension k, and there is a one-to-one correspondence between elements in S and vectors in W . Suppose the k generators S 1 , S 2 , . . . , S k of S correspond to the k symplectic vectors µ 1 , µ 2 , . . . , µ k , which form a basis in W . Then S y corresponds to the vector j y j µ j = M y for each y ∈ Z k 2 , where M := (µ 1 , µ 2 , . . . , µ k ) is a basis matrix for W . Note that all the stabilizer groups S w for w ∈ Z k 2 are associated with the same isotropic subspace according to the above correspondence, and this correspondence extends to the signed stabilizer groupS. Conversely, given an isotropic subspace W of dimension k, 2 k stabilizer groups can be constructed as follows. Let {µ j } k j=1 be any basis for W ; for each vector a in Z k 2 , a stabilizer group can be constructed from the k generators (−1) aj g(µ j ) for j = 1, 2, . . . , k. All these stabilizer groups extend to a common signed stabilizer group. In this way, there is a one-to-one correspondence between signed stabilizer groups and isotropic subspaces.
Suppose S and S are two n-qubit stabilizer groups of orders 2 k and 2 k , respectively; let Π S and Π S be the projectors onto the corresponding stabilizer codes. Then the overlap between Π S and Π S reads Note that S ∩ S is a subgroup ofS ∩ S of index 2 if S ∩ S =S ∩ S . Equation (29) implies the following equation for all w ∈ Z k 2 given thatS w =S andS ∩ S w =S ∩ S . In addition, we have w tr(Π S,w Π S ) = tr(Π S ) = 2 n |S | (31) thanks to the equality w Π S,w = 1. So the number of vectors w ∈ Z n 2 at which tr(Π S,w Π S ) = 0 is equal to |S|/|S ∩ S |. Lemma 1. Suppose S j , T j are stabilizer groups on H j for j = 1, 2, . . . , J; let S = S 1 × S 2 × · · · × S J and T = T 1 ×T 2 ×· · ·×T J be stabilizer groups on H 1 ⊗H 2 ⊗· · ·⊗H J and letT be the signed stabilizer group associated with T . Then where L j = S j ∩T j withT j being the signed stabilizer groups associated withT j .
Proof. To simplify the notation, here we prove (32) in the case J = 2; the general case can be proved in a similar way. Any S ∈ S has the form S = S 1 ⊗ S 2 with S 1 ∈ S 1 and S 2 ∈ S 2 . If in addition S ∈T , then S 1 ∈T 1 and S 2 ∈T 2 . Therefore, S 1 ∈ L 1 and S 2 ∈ L 2 , so that S ∈ L 1 × L 2 , which implies that S ∩T ⊆ L 1 × L 2 . Conversely, any S ∈ L 1 × L 2 has the form S = S 1 ⊗ S 2 with S 1 ∈ S 1 ∩T 1 and S 2 ∈ S 2 ∩T 2 , which implies that S ∈ S and S ∈T . Therefore, L 1 × L 2 ⊆ S ∩T , which confirms (32) in view of the opposite inclusion relation derived above.

C. Stabilizer states
When the stabilizer group S is maximal, that is, |S| = 2 n , the stabilizer code H S has dimension 1 and is represented by a normalized state called a stabilizer state and denoted by |S . Note that |S is uniquely determined by S up to an overall phase factor. According to (25), the projector onto |S reads where S 1 , S 2 , . . . , S n are a set of generators of S. For each w ∈ Z n 2 , define S w as the group generated by (−1) wj S j for j = 1, 2, . . . , n; then S w is also a maximal stabilizer group. In addition, the associated stabilizer state |S w is the common eigenstate of S 1 , S 2 , . . . , S n with eigenvalue (−1) wj for j = 1, 2, . . . , n. Let S y = n j=1 S yj j for y ∈ Z n 2 as in (24) with k = n; then the projector onto |S w reads which reduces to (33) when w = 00 · · · 0. The set of stabilizer states |S w for w ∈ Z n 2 forms an orthonormal basis in H, known as a stabilizer basis. Stabilizer bases are in one-to-one correspondence with Lagrangian subspaces in Z 2n 2 . Based on this observation, one can determine the total number of n-qubit stabilizer states, with the result [30] 2 n n j=1 (2 j + 1) ≥ 2 n(n+3)/2 , which is exponential in the number n of qubits. Note that all stabilizer states in a stabilizer basis share the same signed stabilizer group as defined in (26), that is,S w =S for all w ∈ Z n 2 . In this way, there is a one-toone correspondence between signed stabilizer groups and stabilizer bases (and Lagrangian subspaces).
Suppose S and S are two n-qubit maximal stabilizer groups. Then the fidelity between |S and |S reads according to (29), whereS = S ∪ (−S) is the signed stabilizer group of |S . In addition, for all w, w ∈ Z n 2 according to (30). The number of vectors w ∈ Z n 2 that satisfy the equality | S w |S | 2 = 2 −n |S ∩ S | is equal to 2 n /|S ∩ S |. Two maximal stabilizer groups S and S are complementary if |S ∩ S | = 1 or, equivalently, |S ∩S | = 1, which is the case iff the Lagrangian subspaces associated with S and S , respectively, are complementary. In addition, S and S are complementary iff the stabilizer bases associated with S and S are mutually unbiased [32], that is, The following lemma is useful to computing the fidelities between stabilizer states; see Appendix A for a proof.
where M x (M z ) denotes the submatrix of M composed of the first (last) n rows, and M x (M z ) is defined in a similar way.

D. Graph states
Before introducing graph states, it is helpful to briefly review basic concepts related to graphs. A graph G = (V, E) is defined by a vertex set V and an edge set E in which each element of E is a two-element subset of V . Without loss of generality, the vertex set can be chosen to be V = {1, 2, . . . , n}. Two vertices i, j ∈ V are adjacent if {i, j} ∈ E. The neighbor of a vertex j is composed of all vertices that are adjacent to j. The adjacency relation is characterized by the adjacency matrix A, which is an n × n symmetric matrix with A i,j = 1 if i and j are adjacent and A i,j = 0 otherwise. A subset B of V is an independent set if every two vertices in B are not adjacent. The independence number α(G) of G is the maximum cardinality of independent sets of G. A coloring of G is an assignment of colors to the vertices such that every two adjacent vertices receive different colors. The chromatic number χ(G) of G is the minimum number of colors required to color G. The graph G is two colorable if G can be colored using two distinct colors, that is, χ(G) ≤ 2.
Denote by |+ = (|0 + |1 )/ √ 2 the eigenstate of X with eigenvalue 1. To each graph G = (V, E) with n vertices, a graph state |G of n-qubits (corresponding to the n vertices) can be constructed from the product state |+ ⊗n by applying the controlled-Z gate to every pair of qubits that are adjacent. In other words, where CZ i,j denotes the CZ gate acting on the adjacent qubits i and j. Note that all these CZ gates commute with each other, so their order in the product does not matter. To give some examples, a path or linear graph yields a linear cluster state; a ring or cycle yields a ring cluster state; a square lattice yields a two-dimensional cluster state. A star graph or complete graph yields a GHZ state up to a local Clifford transformation. Alternatively, the graph state |G is uniquely defined (up to a phase factor) as the common eigenstate with eigenvalue 1 of the n stabilizer generators which generate the stabilizer group S G of |G . The elements of S G can be labeled by vectors in Z n 2 as in (24) with k = n, that is, For each w ∈ Z 2n 2 , let |G w be the common eigenstate of S j with eigenvalue (−1) wj for j = 1, 2, . . . , n. Then (34) reduces to The stabilizer states |G w for w ∈ Z n 2 form a stabilizer basis, known as a graph basis.
Let 1 be the n×n identity matrix over Z 2 . The canonical basis matrix of the graph state |G is defined as the  (44) can be expressed asÃy, so the isotropic subspace V G associated with the graph state |G is given by Thanks to the special form of the canonical basis matrices of graph states, Lemma 2 can be simplified as follows.
Lemma 3. Suppose G is an n-vertex graph with adjacency matrix A and S is a maximal stabilizer group of n qubits with basis matrix M . Then where M x (M z ) denotes the submatrix of M composed of the first (last) n rows.
Lemma 4. Suppose G and G are two n-vertex graphs with adjacency matrices A and A , respectively. Then It is known that every stabilizer state is equivalent to a graph state under some local Clifford transformation (LC) [21,33,34]. In addition, Calderbank-Shor-Steane (CSS) states are equivalent to graph states of two-colorable graphs, and vice versa [35]. Recall that a stabilizer state is a CSS state if its stabilizer group can be expressed as the product of two groups one of which is generated by X operators for individual qubits, while the other is generated by Z operators. Two graph states |G and |G are equivalent under LC iff the corresponding graphs G and G are equivalent under local complementation, hence both transformations are abbreviated as LC.
An LC with respect to a vertex j turns adjacent (nonadjacent) vertices in the neighborhood of j into nonadjacent (adjacent) vertices. For example, a complete graph is turned into a star graph under LC with respect to any given vertex. This fact explains why the corresponding graph states are equivalent under LC. Both graph states are equivalent to GHZ states, as illustrated in Fig. 1.

A. Canonical test projectors for stabilizer states
Pauli measurements are the simplest measurements that can be applied to verifying stabilizer states. Each Pauli measurement for a single qubit can be specified by a symplectic vector in Z 2 2 ; to be specific, Pauli X, Y , and Z measurements correspond to the vectors (1; 0), (0; 1), and (1; 1), respectively, while the trivial measurement corresponds to the vector (0; 0). Each Pauli measurement on n qubits can be specified by a symplectic vector µ = (µ x ; µ z ) in Z 2n 2 , which means the Pauli operator measured for qubit j is i µ . . , n. The weight of the Pauli measurement is the number of qubit j such that (µ x j , µ z j ) = (0, 0). The Pauli measurement is complete if the weight is equal to n, so that the Pauli measurement for every qubit is nontrivial. In that case, the corresponding symplectic vector µ is also called complete. The set of complete symplectic vectors in Z 2n 2 is denoted by (Z 2n 2 ) C . Let T µ be the stabilizer group generated by the n local associated with the Pauli measurement; then |T µ | = 2 k , where k is the weight of the Pauli measurement. LetT µ = T µ ∪ (−T µ ) be the signed stabilizer group. Each outcome of the Pauli measurement corresponds to a common eigenspace of the stabilizer group T µ . It can be specified by a vector v ∈ Z n 2 , which corresponds to the common eigenspace of i µ x with eigenvalue (−1) vj for j = 1, 2, . . . , n. The projector onto the eigenspace reads Note that v j can only take on the value 0 if the Pauli measurement for qubit j is trivial; otherwise, Π µ,v = 0. So those vectors v of interest to us belong to a subspace of Z n 2 of dimension k. Nevertheless, vectors outside this subspace do not affect the following analysis.
Suppose we want to verify the n-qubit stabilizer state |S associated with the stabilizer group S. Then any test operator P based on the Pauli measurement µ is a linear combination of Π µ,v for v ∈ Z n 2 . To guarantee that the target state |S can always pass the test, P must satisfy P ≥ Π µ,v whenever S|Π µ,v |S > 0. The canonical test projector based on the Pauli measurement µ is defined as This concept was introduced for GHZ states in [13]. By construction we have P µ ≤ E for any other test operator E based on the same Pauli measurement, so it is natural to choose canonical test projectors if we want to construct an optimal verification protocol. The stabilizer group L µ = S ∩T µ is called a local subgroup of S associated with the Pauli measurement µ. Given any two stabilizer operators S, S in L µ , the tensor factors of S, S for any given qubit commute with each other. Therefore, L µ is locally commutative, and hence the name. The stabilizer operators in L µ can be measured simultaneously by the Pauli measurement µ.
Lemma 5. For any µ ∈ Z 2n 2 , the canonical test projector P µ is identical to the stabilizer code projector associated with L µ , that is, Proof of Lemma 5. According to (30), S|Π µ,v |S is equal to either 0 or |T µ ∩ S|/|T µ | = |L µ |/|T µ |. Moreover, by (31), it is nonzero for exactly |T µ |/|L µ | vectors v in Z n 2 . When S|Π µ,v |S is nonzero, the support of Π µ,v is contained in the stabilizer code H µ associated with L µ . So the support of P µ lies in H µ . In addition, we have so the support of P µ has the same dimension as H µ . It follows that P µ must be the projector onto H µ , which implies (53).
Lemma 5 implies that every canonical test projector of the stabilizer state |S is diagonal in the stabilizer basis associated with the stabilizer group S, the diagonal elements are equal to either 0 or 1, and the rank of the test projector is equal to a power of 2. As a consequence, all canonical test projectors commute with each other. If the local subgroup L µ is trivial, that is, |L µ | = 1, then the test projector is equal to the identity and thus trivial; the corresponding Pauli measurement is thus useless to verify the stabilizer state |S .
To determine the diagonal elements of P µ in the stabilizer basis, we need to specify a concrete basis. To this end, we can choose any minimal set of generators for S, say S 1 , S 2 , . . . , S n . For each w ∈ Z n 2 , let |S w be the common eigenstate of S j with eigenvalues (−1) wj for j = 1, 2, . . . , n. Then {|S w } w∈Z n 2 forms a stabilizer basis (cf. Sec. III C). Define a µ as the (2 n − 1) × 1 column vector composed of the entries then the test projector P µ is determined by a µ given that S w |P µ |S w = 1 when w = 0. In view of this fact, the vector a µ is referred to as the test vector associated with the test projector P µ or the Pauli measurement µ (with respect to a given stabilizer basis). Here the index w can also be replaced by the natural number j 2 j−1 w j if necessary.
To efficiently compute the diagonal elements S w |P µ |S w of the test projector P µ and determine the test vector a µ , we need to introduce additional tools. Let U 1 (U 2 ) be the index set of qubits for which the Pauli measurement µ is nontrivial (trivial), that is, Let M S be the basis matrix of S associated with the generators S 1 , S 2 , . . . , S n ; denote by M x S and M z S the first n rows and last n rows, respectively. Define where M S,µ (U 1 ) is the matrix composed of the rows of M S,µ indexed by the set U 1 and similarly for M x S (U 2 ) and M z S (U 2 ). Note thatM S,µ = M S,µ if the Pauli measurement µ is complete, in which case U 2 is empty. For an m × n matrix M defined over Z 2 , denote by rank(M ) the rank of M and ker(M ) the kernel of M : Denote by rspan(M ) the row span of M : Theorem 1.
Theorem 1 is proved in Appendix B. Note thatM S,µ reduces to M S,µ when the Pauli measurement is complete. As an implication of Theorem 1, the order of the local subgroup L µ and the rank of the test projector P µ read The test projector P µ is trivial iffM S,µ has rank n (full rank). Let r = rank(M S,µ ) and let w 1 , w 2 , . . . , w r be a basis in rspan(M S,µ ). Then rspan(M S,µ ) coincides with the span of these basis vectors, that is, this observation is helpful to computing the diagonal elements of P µ in the stabilizer basis. Equation (64) is equivalent to the following equation, since w ∈ rspan(M S,µ ) iff w·y = 0 for all y ∈ ker(M S,µ ). Let y 1 , y 2 , . . . , y n−r be a basis in ker(M S,µ ), which has dimension n − r; then w ∈ rspan(M S,µ ) iff w · y j = 0 for j = 1, 2, . . . , n − r.
To determine the minimum rank of canonical test projectors, it suffices to consider complete Pauli measurements. According to (66), we have min µ∈Z 2n where κ(S) := min given thatM S,µ = M S,µ for µ ∈ (Z 2n 2 ) C . Note that 2 κ(S) is also the minimum rank of all test operators of |S based on Pauli measurements since the canonical test projector attains the minimum rank for a given Pauli measurement. The following lemma relates the geometric measure of entanglement Λ(S) of any stabilizer state |S [36] to κ(S). Denote by Prod the set of pure product states and by Prod P the set of pure product states whose single-qubit reduced states are eigenstates of Pauli operators. Define Lemma 6.
Proof. The inequality in (73) follows from the definitions of Λ(S) and Λ P (S) in (71) and (72). To prove the equality Λ P (S) = 2 −κ(G) , note that each state in Prod P is a stabilizer state, and the state projector has the form in (51) with µ ∈ (Z 2n 2 ) C . Therefore, where the second equality follows from (37), and the third equality follows from (65) given thatM S,µ = M S,µ for µ ∈ (Z 2n 2 ) C .

B. Canonical test projectors for graph states
For graph states, the discussions in the previous section can be simplified. Here we only consider complete Pauli measurements. Suppose that |G and {|G w } w∈Z n 2 are the graph state and the corresponding graph basis associated with the graph G = (V, E) as defined in Sec. III D. Let A be the adjacency matrix of G; thenÃ = (1; A) is the canonical basis matrix for |G . Define The rank, kernel, and row span of A µ are denoted by rank(A µ ), ker(A µ ), and rspan(A µ ), respectively.
Theorem 2 is a special case of Theorem 1 tailored to the verification of a graph state based on a complete Pauli measurement; a simplified proof is presented in Appendix B. As a corollary, we have The test projector P µ is trivial iff A µ has full rank. Let r = rank(A µ ) and let w 1 w 2 , . . . , w r be a basis in rspan(A µ ). Then rspan(A µ ) = { r j=1 a j w j |a j ∈ Z n 2 ∀j}. Equation (78) is equivalent to the following equation, given that w ∈ rspan(A µ ) iff w·y = 0 for all y ∈ ker(A µ ). Let y 1 , y 2 , . . . , y n−r be a basis in ker(A µ ), which has dimension n − r; then w ∈ rspan(A µ ) iff w · y j = 0 for all j = 1, 2, . . . , n − r. These observations are helpful to computing G w |P µ |G w efficiently.
Similar to (69), the minimum rank of test projectors P µ for |G is given by where Define Then Lemma 6 reduces to The following lemma sets an upper bound for κ(G), which in turn yields an upper bound for the minimum rank of test projectors P µ .

Lemma 8 and (86) imply the following inequalities
which was originally derived in [37].
Proof of Lemma 8. Let B be an independent set of the graph G = (V, E) with cardinality α(G). Consider the Pauli measurement in which X measurements are performed on all qubits in B and Z measurements are performed on all qubits in the complement B = V \ B. Let µ be the corresponding symplectic vector, then µ Since B is an independent set, rspan(diag(µ x )A) ⊆ rspan(diag(µ z )). Consequently, rank A µ = rank(diag(µ z )) = |B|, and we have (88)

C. Admissible test projectors
Suppose we want to verify the stabilizer state |S based on Pauli measurements. Let E be a test operator based on the Pauli measurement specified by the symplectic vector µ ∈ Z 2n 2 . The test operator E is not admissible if there exists another test operator E based on a Pauli measurement such that E ≤ E and tr(E ) < tr(E). Let P µ be the canonical test projector associated with the Pauli measurement µ, then E ≥ P µ , so an admissible test operator is necessarily a canonical test projector. The test vector a µ is (not) admissible if the test projector P µ is (not) admissible. A Pauli measurement is (not) admissible if the corresponding canonical test projector is (not) admissible. Previously, the concepts of admissible measurements and admissible test projectors are considered only for GHZ states [13].
Proposition 3. Any admissible Pauli measurement is complete.
Proof. Following the proof for GHZ states in [13], we prove the contrapositive, that an incomplete Pauli measurement is inadmissible. Without loss of generality, consider a Pauli measurement of weight n − 1 on the n-qubit target stabilizer state |S . After n − 1 single-qubit Pauli measurements, the reduced states of the remaining party for all possible outcomes are eigenstates of a Pauli operator. So we can always find an extra Pauli measurement on the remaining qubit that makes the canonical test projector smaller.
As an example, consider the three-qubit linear cluster state defined by the three stabilizer generators S 1 = XZ1, S 2 = ZXZ, and S 3 = 1ZX. The state can be written as where |± is an eigenstate of X with the eigenvalue ±1.
If we perform X and Z measurements on the first and second qubit, respectively, then the reduced state of the third qubit is left in one of the X eigenstates. Thus, measuring X on the last qubit gives an admissible test projector P XZX , whereas measuring Y or Z results in the same inadmissible test projector that has higher rank than P XZX . Further calculation shows that there are five admissible Pauli measurements in total, namely, XZX, ZXZ, ZY Y , Y Y Z, Y XY (cf. Table I). Different Pauli measurements may give rise to the same canonical test projector. When more than one measurement settings share the same canonical test projector, the projector can be realized by an incomplete Pauli measurement that the two settings have in common. Therefore, this canonical test projector cannot be admissible by by Proposition 3. This observation yields the following lemma.
Lemma 9. No two admissible Pauli measurements lead to the same canonical test projector.
Lemma 9 shows that there is a one-to-one correspondence between admissible Pauli measurements and admissible canonical test projectors.

Corollary 1.
A canonical test projector based on a Pauli measurement is admissible iff it cannot be realized by an incomplete Pauli measurement.
Proof. If the test projector can be realized by an incomplete Pauli measurement, then it is not admissible by Proposition 3. If the test projector is realized by a complete Pauli measurement µ, but is not admissible, then we can find a complete Pauli measurement µ , such that P µ ≤ P µ and tr(P µ ) < tr(P µ ). Note that P µ can also be realized by the incomplete Pauli measurement that the two Pauli measurements µ and µ have in common. This observation completes the proof of Corollary 1.
The following lemma is a useful tool for determining admissible test projectors of stabilizer states; it is a direct consequence of Theorem 1.
Lemma 10. Suppose P µ and P µ are the canonical test projectors for the stabilizer state |S based on Pauli measurements µ and µ , respectively. Then the following statements are equivalent: Here a µ and a µ are the test vectors associated with P µ and P µ , respectively; a µ • a µ denotes the element-wise product of a µ and a µ ; and a µ 1 denotes the 1-norm of a µ , that is, a µ 1 = w∈Z n 2 ,w =0 a µ ,w . In the case of graph states, Lemma 10 can be simplified as follows, assuming that the Pauli measurements are complete.
Lemma 11. Suppose P µ and P µ are the canonical test projectors for the graph state |G based on the complete Pauli measurements µ and µ , respectively. Let A be the adjacency matrix of G. Then the following statements are equivalent: The total number of admissible test projectors for |G is denoted by η(G). Note that η(G) is also the total number of admissible Pauli measurements by Lemma 9. The value of η(G) for every equivalent class of connected graph states up to seven qubits is shown in Table I.

V. OPTIMAL VERIFICATION OF GRAPH STATES
In this section we study optimal verification of entangled (possibly nonconnected) graph states based on Pauli measurements. (Generalization to stabilizer states is straightforward.) First, we show that the spectral gap of any verification protocol based on separable measurements cannot surpass 2/3. We also derive a necessary condition for Pauli measurements to attain the maximum spectral gap. Then we present a simple algorithm for constructing optimal verification protocols based on Pauli measurements. Using this algorithm, we construct an optimal verification protocol, attaining the maximum spectral gap of 2/3, for every equivalent class of connected graph states up to seven qubits. We believe that the maximum spectral gap of 2/3 can be attained for all graph states associated with nonempty graphs. Here a nonempty graph is a graph that has at least one edge.

A. Efficiency limit of separable and Pauli measurements
Given a graph state |G associated with the graph G = (V, E), denote by ν(G) the maximum spectral gap of verification operators that are based on nonadaptive Pauli measurements, and by ν sep (G) the maximum spectral gap attainable by separable measurements. A verification operator Ω based on Pauli measurements is optimal if ν(Ω) = ν(G). Proof. The inequality ν(G) ≤ ν sep (G) follows from the fact that Pauli measurements are separable measurements. To prove the inequality ν sep (G) ≤ 2/3, note that the graph state |G is maximally entangled with respect to at least one bipartition into a single qubit and the other n − 1 qubits since G is nonempty [18,19]. A separable measurement for |G is necessarily separable with respect to the bipartition. Now note that the spectral gap for a Bell state or two-qubit maximally entangled state cannot be increased by increasing the local dimension of one of the subsystems. Therefore, the spectral gap of any verification operator Ω for |G that is based on separable measurements cannot be larger than the maximum spectral gap 2/3 achievable for a Bell state [3,4,8,9], that is, ν(Ω) ≤ 2/3. This result implies the inequality ν sep (G) ≤ 2/3 and confirms Lemma 12.
While Lemma 12 establishes the bound for a vast class of measurements, it provides no information as to what kind of measurements can saturate the bound. Specializing to Pauli measurements, we prove a simple necessary requirement for constructing an optimal verification protocol: X, Y , and Z should be measured with an equal probability for each qubit. Theorem 3. Suppose G = (V, E) is a (possibly nonconnected) graph with no isolated vertex and Ω is a verification operator of |G based on Pauli measurements. Let p X j , p Y j , p Z j be the probability that X, Y , and Z measurements are performed on the jth qubit, respectively. Then If ν(Ω) = 2/3 or β(Ω) = 1/3, Proof. Equation (91) follows from (90). To prove (90), we can assume that the verification protocol employs only canonical test projectors. Let P X j be the product of all canonical test projectors based on Pauli measurements with X measurement on qubit j, then P X j is also a test projector for |G (not necessarily associated with a Pauli measurement) since all canonical test projectors commute with each other. In addition, P X j has rank at least 2 since, otherwise, the reduced state of |G on qubit j would be a pure state, in contradiction with the assumption that G has no isolated vertex, which implies that every single-qubit reduced state is completely mixed [18,19]. Define P Y j and P Z j in a similar way. Then we have which confirms (90) and implies (91). The last statement in Theorem 3 is an immediate consequence of (90).
If G is not connected and has J connected components G 1 , G 2 , . . . , G J . Then |G = J j=1 |G j and we have according to Proposition 9 in Appendix D. In addition, if Ω j are optimal verification operators for |G j , then J j=1 Ω j is an optimal verification operator for |G . As a corollary, ν(G) = 2/3 if ν(G j ) = 2/3 for j = 1, 2, . . . , J. To construct optimal verification protocols, therefore, we can focus on graph states of connected graphs.

B. Algorithm for constructing an optimal verification protocol
To construct an optimal verification protocol based on Pauli measurements, it suffices to consider canonical test projectors associated with admissible Pauli measurements. Suppose we perform the Pauli measurement µ with probability p µ , then the resulting verification operator reads where P µ is the canonical test projector associated with the Pauli measurement µ. Since all canonical test projectors are diagonal in the graph basis, the operator Ω is also diagonal in the graph basis. Let where a µ is the test vector associated with the projector P µ and the Pauli measurement µ. Then all eigenvalues of Ω except the one associated with the target state are contained in λ. In particular, we have where λ ∞ denotes the maximum of the elements in the vector λ, and the last equality follows from Theorem 2.
Maximizing the spectral gap ν(Ω) = 1 − β(Ω) is equivalent to minimizing β(Ω). To this end we need to only consider admissible test vectors (cf. Sec. IV C). Define the test matrix A as the matrix composed of all admissible test vectors a µ as column vectors, and let p be the column vector composed of the probabilities p µ . Then λ = Ap and β(Ω) = Ap ∞ . The minimization of β(Ω) can be cast as a constrained optimization problem After choosing a proper order of the test vectors the minimization can be expressed as a linear programming: Putting all these together, we have a recipe for finding an optimal verification protocol as shown in Algorithm 1. Our Python module that implements the algorithm using the convex optimization package cvxpy and open source solvers are available on Github.

C. Special examples
To illustrate the algorithm presented in Sec. V B, we first consider graph states associated with star graphs 2: Graphical representation of the optimal verification scheme for the star graph. Each term in the sum represents a Pauli measurement setting. Measurement settings in the parenthesis are chosen with the probability 1/6 each; they are given in (102) in terms of all possible sets Y of parties that perform Y measurements (displayed in blue) with |Y| = 2t where t = 0, 1, . . . , n/2 .

Input:
A Adjacency matrix for an n-qubit graph state |G Output: M The set of Pauli measurements (represented by vectors in (Z 2n 2 )C) employed in the optimal verification protocols {pµ} µ∈M Probabilities for individual measurement settings as in (95) ν(Ω) Optimal spectral gap 1: Determine all nontrivial test vectors.

Discard
Aµ that has full rank by checking the determinant.
3. Compute the test vector aµ by virtue of Theorem 2.   Table I). These states can be turned into GHZ states by applying the Hadamard gate on each non-central qubit.
All information about the canonical test projector associated with a Pauli measurement µ = (µ x ; µ z ) ∈ Z 2n 2 is encoded in the matrix A µ defined in (75), which can be thought of as the matrix version of the symplectic inner product between µ and the adjacency matrix A. For the star graph with n vertices we have According to (80), the rank of the canonical test projector associated with µ is the cardinality of the subspace spanned by the rows of A µ . Analysis shows that the smallest subspace is obtained when µ z 1 = 1, µ x j = 1 for j = 1, and every other component is zero; that is, when the Pauli measurement is ZX · · · X. This Pauli measurement effective measures the n−1 stabilizer generators associated with the n − 1 non-central qubits. The resulting rank-2 test projector reads It is the only admissible Pauli measurement that measures Z on the central qubit and, thus, must be included in any optimal verification protocol with probability 1/3 according to Theorem 3. By virtue of the connection with the GHZ state and the result derived in [13], the other admissible Pauli measurements can be described compactly as follows. We perform either X or Y measurement on the central qubit, while either Y or Z measurement on each of the other qubits. Let Y be the set of parties that perform Y measurements assuming that |Y| is even, and Y be the set of parties that perform a Z measurement on a non-central qubit or an X measurement on the central qubit. Let |Y| = 2t with t = 0, 1, . . . , n/2 and where σ 1 = X 1 and σ j = Z j for all j = 1. The Pauli measurement effectively measures the product of the stabilizer S 1 of the central qubit together with all the stabilizers of all non-central qubits in the set Y (cf. Fig. 2). Thus, the corresponding canonical test projector has rank 2 n−1 , and there are 2 n−1 such canonical test projectors. The unique optimal verification strategy is constructed by performing the test P 0 with probability 1/3 and all other admissible tests P Y with probability 1/(3 × 2 n−2 ) each. The resulting verification operator reads Compared with other n-qubit graph states with n ≤ 7, it turns out the graph state associated with the star graph 3: Graphical representation of an optimal verification scheme for the five-qubit ring cluster state. Each term in the sum represents a Pauli measurement setting, and each setting is chosen with the probability 1/6.
requires the most number of measurement settings to construct an optimal verification protocol. In general, optimal verification strategies based on Pauli measurements are not unique. For example, let us consider the five-qubit ring cluster state (No. 8 in Table I). Calculation shows that this graph state has 21 admissible Pauli measurements. Two distinct optimal verification strategies can be constructed from six admissible Pauli measurements each as presented below (left and right columns); each setting is measured with probability 1/6, which is consistent with Theorem 3.
Note that the two strategies have no measurement setting in common. All 12 canonical test projectors associated with these Pauli measurements have rank 8 (some of other nine admissible test projectors have higher ranks).

D. Generic case
By means of the algorithm presented in Sec. V B, we have found an optimal verification protocol based on Pauli measurements for each equivalent class of connected graph states up to seven qubits [18]. It turns out the maximum spectral gap can always attain the upper bound 2/3 for separable measurements presented in Lemma 12. Therefore, we believe that the upper bound 2/3 for the spectral gap can be saturated by Pauli measurements for all graph states. More details can be found in Table I. Note that optimal verification strategies are in general not unique, and it is possible that the numbers of measurement settings in the optimal strategies presented in Table I can be reduced. According to this table, linear cluster states require fewer measurement settings to construct optimal protocols compared with most other graph states: only 5, 6, 6, 8, and 12 settings are required for 3, 4, 5, 6, and 7 qubits, respectively. Curiously, graph state No. 42 requires only 6 measurement settings to construct an optimal verification protocol, which is fewer than the number 7 of qubits. This is the only connected graph state that has this property as far as we know.

VI. OPTIMAL VERIFICATION OF GRAPH STATES WITH X AND Z MEASUREMENTS
According to [7], all graph states can be verified using only X and Z measurements. Here we present an upper bound for the spectral gap of any verification protocol based on X and Z measurements and show that this bound can be saturated for all connected graph states up to seven qubits (which again implying that the bound can be saturated for nonconnected graph states built from these graphs according to Proposition 9). In addition, we construct an optimal verification protocol for every ring cluster state. This result is a simple corollary of Theorem 3. Moreover, the bound ν(Ω) ≤ 1/2 applies whenever each party can perform only two types of Pauli measurements.
To construct an optimal protocol for the graph state |G based on X and Z measurements, it suffices to consider canonical test projectors based on complete X and Z measurements. Each subset B of V determines a complete Pauli measurement by performing X measurements on qubits in B and Z measurements on qubits in the complement B = V \ B; the corresponding local subgroup and canonical test projector are denoted by L B and P B , respectively. Conversely, each complete Pauli measurement based on X and Z measurements is determined by such a subset in V . In view of this fact, complete Pauli measurements based on X and Z measurements and the corresponding canonical test projectors can be labeled by subsets in V . Let µ be the symplectic vector associated with the Pauli measurement determined by B, then µ x j = 1 iff j ∈ B, while µ z j = 1 iff j ∈ B. Conversely, B = {j|µ x j = 1}. Based on this observation, the local subgroup L B and the test projector P B can be determined by virtue of Theorem 2, where the subscript µ characterizing the Pauli measurement can be replaced by B to manifest the role of the set B; in particular, A µ can be expressed as A B . According to (75) and the above discussion, we have and the inequality is saturated iff B is an independent set (cf. the proof of Lemma 8). In conjunction with (79) and (80), this equation implies the following corollary.
Corollary 3. Let B be a subset of the vertex set V of the graph G. Then The inequality (106) is saturated iff B is an independent set; the same holds for the inequality (107).
When B is an independent set, L B is generated by the stabilizer operators S j for all j ∈ B, that is, (108) accordingly, the canonical test projector reads In addition, the test vector in (78) reduces to where supp(w) = {j|w j = 1}.
Test projectors based on independent sets play a key role in constructing the cover and coloring protocols in [7]. Compared with other test projectors, these test projectors are easy to visualize; in addition, it is easier to compute the spectral gap of verification operators based on such test projectors. Nevertheless, more general test projectors are helpful to enhance the spectral gap.
The following lemma follows from (43), (108), and (109). Optimal verification protocols based on X and Z measurements can be found using a similar algorithm as presented in Sec. V B with minor modification. It turns out the bound ν(Ω) ≤ 1/2 in Corollary 2 can be saturated for all entangled graph states up to seven qubits shown in Table II. (In fact, this result also holds for graph states not listed in the table; see Appendix E.) Proposition 4. For any entangled CSS state or entangled graph state associated with a two-colorable graph, the maximum spectral gap achievable by X and Z measurements is 1/2.
Proof. First, consider an entangled graph state. According to Corollary 2, the spectral gap of any verification operator based on X and Z measurements is upper bounded by 1/2. If the graph is two-colorable, then the bound 1/2 can be saturated by a coloring protocol proposed in [7], so the maximum spectral gap achievable by X and Z measurements is 1/2.
Next, consider an entangled CSS state. According to Theorem 3, the spectral gap of any verification operator based on X and Z measurements is also upper bounded by 1/2. Meanwhile, the bound can be saturated by the protocol composed of the two measurement settings XX · · · X and ZZ · · · Z chosen with an equal probability. This result is consistent with the fact that any CSS state is equivalent to a graph state associated with a two-colorable graph, and vice versa [35].

B. Admissible test projectors based on X and Z measurements
In contrast to the definitions in Sec. IV C, there are two sensible definitions of admissible measurements and test projectors based on X and Z measurements. Such a test projector (and corresponding measurement) is admissible if there is no smaller test projectors based on Pauli measurements. The test projector (and corresponding measurement) is weakly admissible if there is no smaller test projectors based on X and Z measurements. Let η XZ be the number of admissible test projectors based on X and Z measurements and η XZ the number of weakly admissible test projectors. Obviously, an admissible test projector based on X and Z measurements is weakly admissible, so we have η XZ ≤ η XZ . This inequality is usually strict since a weakly admissible measurement is not necessarily admissible. Actually, η XZ and η XZ are not invariant under LC and the equality η XZ = η XZ is too strong to expect.
As an example, let U n be an n-qubit Clifford unitary operator with n ≥ 3 that interchanges Y and Z for every qubit, and consider the state |Ψ = U n |G , where |G is the star-graph state as discussed in Sec. V C. Here, the measurement X · · · X yields a rank-4 test projector P µ that is weakly admissible. However, this projector cannot be admissible according to the discussion in Sec. V C (cf. [13]). To be concrete, let P µ be the unique rank-2 admissible test projector based on the measurement Y X · · · X (which would have been ZX · · · X before the unitary operator U n is applied), then we have P µ ≤ P µ and tr(P µ ) < tr(P µ ), so P µ is not admissible.
For graph states, it turns out the two notions of admissibility coincide. The following proposition is proved in Appendix C.
Proposition 5. Given any graph state |G , a test projector based on X and Z measurements is admissible iff it is weakly admissible; η XZ (G) = η XZ (G).
The values of η XZ (G) for graph states up to seven qubits are shown in Table II. These results suggest that the number of admissible settings based on X and Z measurements grows only linearly with the number of qubits, although the total number of admissible measurement settings grows exponentially (cf. Table I).
The following lemma clarifies all admissible test projectors that are based on independent sets; see Appendix C for a proof. This lemma provides further insight on the cover and coloring protocols proposed in [7]. Lemma 14. Suppose B is an independent set of the graph G = (V, E). Then the test projector P B given in (109) is admissible iff B is a maximal independent set.

C. Optimal verification of ring cluster states
A ring cluster state is the graph state associated with a ring graph, that is, a cycle. Here we show that the upper bound 1/2 for the spectral gap in Corollary 2 can be saturated for all ring cluster states by constructing an optimal verification protocol using X and Z measurements only.
To construct an optimal protocol when n is odd, we first introduce n + 1 subsets of V defined as follows, B j = {j, j + 2, j, . . . , j + n − 3}, j = 1, 2, . . . , n, note that the first n subsets are independent sets of G. Each set B j for j = 1, 2, . . . , n + 1 defines a canonical test by performing X measurements on qubits in B j and Z measurements on qubits in the complement V \ B j as described in Sec. VI A. Now an optimal protocol can be constructed by performing the n + 1 tests P Bj with probability 1/(n + 1) each; the resulting verification operator reads To corroborate our claim, note that the test projectors P Bj for j = 1, 2, . . . , n are determined by (109) and all have rank 2 (n+1)/2 ; the corresponding test vectors are determined by (110). To determine the test vector a Bn+1 associated with the test projector P Bn+1 , note that A Bn+1 = A, so that a Bn+1,w = 1 iff w ∈ rspan(A) according to Theorem 2. In addition, A has rank n − 1, and ker(A) is spanned by {1, 1, . . . , 1}, which implies that a Bn+1,w = G w |P Bn+1 |G w = 1 w has even weight, 0 otherwise. Therefore, Here the last inequality follows from (115) and the fact that |{j| supp(w) ∈ B j }| ≤ (n + 1)/2, and the inequality is saturated iff w has weight 1.

VII. VERIFICATION WITH MINIMUM NUMBER OF SETTINGS
Besides the spectral gap, the number of distinct measurement settings is an important figure of merit in practice. What is the measurement complexity required to verify a stabilizer state? Here we summarize our understanding about this problem. Since every stabilizer state is equivalent to a graph state under local Clifford transformations, we can focus on graph states. All statements proven in this section that are not specific to a particular graph apply to connected graphs as well as nonconnected ones. The relation between verification of a nonconnected graph state and verification of its connected components is clarified in Appendix D.

A. Local cover number
Suppose G = (V, E) is a graph with adjacency matrix A. Let |G be the graph state associated with the graph G and the stabilizer group S G . To verify |G based on Pauli measurements, we need to construct a verification operator Ω with positive spectral gap, that is, ν(Ω) > 0 or, equivalently, β(Ω) < 1. The following lemma clarifies the necessary requirements.
Here • µ∈M a µ = 0 means that the element-wise product Proof. The equivalence of statements 1 and 2 follows from the fact that P µ is the stabilizer code projector associated with the local subgroup L µ according to Lemma 5. The equivalence of statements 2 and 3 follows from (76) in Theorem 2. The equivalence of statements 3 and 4 is a simple fact in linear algebra. The equivalence of statements 1 and 5 follows from (97).
The local cover numberχ(G) is defined as the minimum number of Pauli measurement settings required to verify |G . It is equal to the minimum cardinality of M with M ⊂ (Z 2n 2 ) C that satisfies one of the statements in Lemma 15 and can be expressed as follows, Here the terminology is inspired by (117) according to whichχ(G) is equal to the minimum number of local stabilizer groups required to generate the stabilizer group of |G . The above equations can be applied to computing χ(G), although such algorithms are not efficient. In general, we cannot expect to find an efficient algorithm in view of the connection (via Proposition 6 below) betweeñ χ(G) and the chromatic number χ(G), which is NP-hard to compute [39]. The local cover numberχ XZ (G) can be defined and computed in a similar way, except that only X and Z measurements are considered. If one of the statements in Lemma 15 holds, then we have Span(∪ µ∈M ker(A µ )) = Z n 2 , which implies that 2 n ≤ µ∈M | ker(A µ )|, so that As a corollary, we havẽ If one of the five statements in Lemma 15 holds, and p µ = 1/m for all µ ∈ M , where m = |M |, then according to (97). Here the inequality follows from the fact that a µ,w = 0 for at least one µ ∈ M for each w ∈ Z n 2 with w = 0. Therefore, ν(Ω) ≥ 1/m. If m = |M | =χ(G), then ν(Ω) ≤ 1/m according to Proposition 1 given that the number of measurement settings cannot be reduced. These observations imply the following theorem, which clarifies the efficiency limit of verification protocols based on the minimum number of Pauli measurement settings.
Theorem 4. The maximum spectral gap of verification operators of |G based onχ(G) distinct Pauli measurements is 1/χ(G). Theorem 4 follows from Proposition 1 and the commutativity of canonical test projectors, so it applies to all graph states, irrespective whether the graph is connected or not. According to the coloring protocol proposed in [7], by virtue of χ(G) settings based on X and Z measurements, we can achieve spectral gap 1/χ(G). Theorem 4 may be seen as a generalization of this result.

B. Connection to the chromatic number
Here we discuss the connection between the local cover numbersχ(G),χ XZ (G) and the chromatic number χ(G). Note thatχ(G) is invariant under LC of the graph G (corresponding to LC of the graph state |G ), but this is not the case forχ XZ (G) and χ(G). To remedy this defect, defineχ 2 (G) as the minimum number of settings required to verify |G when each party can perform only two different Pauli measurements. Note that each party needs to perform at least two different Pauli measurements to verify any graph state of a connected graph with two or more vertices [6,7]. Define χ LC (G) as the minimum chromatic number of any graph that is equivalent to G under LC, that is, where the symbol LC means equivalence under LC.
Proof. Here the first and third inequalities follow from the definitions. To prove the second inequality, let G be a graph that is equivalent to G under LC and satisfies χ(G ) = χ LC (G). According to [7], |G can be verified by a coloring protocol composed of χ(G ) distinct settings based on X and Z measurements. Therefore, which confirms the second inequality in Proposition 6.
We have verified Conjecture 1 for all connected graphs up to seven vertices (graph states up to seven qubits). Actually we havẽ for all the graphs shown in Table II and all nonconnected graphs built from these graphs thanks to Proposition 9 in Appendix D. (This result does not mean that (126) holds for all connected graphs up to seven vertices sincẽ χ XZ (G) and χ(G) are not invariant under LC; see Appendix E for more detail.) Therefore, for all such graphs, the maximum spectral gap of verification operators based on the minimum number of settings is 1/χ(G) according to Theorem 4. Incidentally, all protocols with the minimum number of settings in Table II are chosen to be coloring protocols. Table II in addition contains the fractional chromatic number χ * (G) for all the graphs listed. The inverse fractional chromatic number 1/χ * (G) is the maximum spectral gap achievable by the cover protocol proposed in [7].
Proof. If G is empty, then |G is a product state of the form |+ ⊗n , which can be verified by performing X measurements on all qubits, soχ(G) = 1. Conversely, if |G can be verified by a single setting based on a Pauli measurement, then |G must be a tensor product of eigenstates of local Pauli operators, so G must be an empty graph. Alternatively, Proposition 7 follows from Lemma 3 in [8] and Proposition 3 in [6].
As an implication of Propositions 6 and 7, we havẽ χ(G) = 2 for any nonempty two-colorable graph. The following theorem provides a partial converse and confirms Conjecture 1 in a special case of practical interest. See Appendix F for a proof.
Theorem 5.χ(G) = 2 iff χ LC (G) = 2. A stabilizer state can be verified by two settings based on Pauli measurements iff it is equivalent to a CSS state or, equivalently, a graph state of a two-colorable graph.
The following proposition determines the local cover numbers of odd ring graphs, which are typical examples of graphs that are not two-colorable. Proposition 8. Suppose G is an odd ring graph with at least five vertices; theñ To prove Proposition 8, note thatχ(G) ≤ χ(G) = 3 for the odd ring graph thanks to Proposition 6. Conversely, χ(G) ≥ 3 according to (122) and the following lemma, which is proved in Appendix G.

VIII. SUMMARY AND OPEN PROBLEMS
We have investigated systematically optimal verification of stabilizer states (including graph states in particular) using Pauli measurements. We proved that the spectral gap of any verification operator of any entangled stabilizer state based on separable measurements (including Pauli measurements) is bounded from above by 2/3. Moreover, we introduced the concepts of canonical test projectors, admissible Pauli measurements, and admissible test projectors and clarified their properties. By virtue of these concepts, we proposed a simple algorithm for constructing optimal verification protocols based on (nonadaptive) Pauli measurements. Although this algorithm is not efficient for large systems, it enables us to construct an optimal protocol for any stabilizer state up to ten qubits without difficulty. In particular, our calculation shows that the bound 2/3 for the spectral gap can be saturated for all entangled stabilizer states up to seven qubits. It is quite surprising that the maximum spectral gap seems to be independent of the specific stabilizer state, although different stabilizer states may have very different entanglement structures. In the case of graph states, we also prove that the upper bound for the spectral gap is reduced to 1/2 if only X and Z measurements are accessible. Again, this bound can be saturated for all entangled graph states up to seven qubits. These results naturally lead to the following conjectures.

Conjecture 2.
For any entangled stabilizer state, the maximum spectral gap of verification operators based on Pauli measurements is 2/3.

Conjecture 3.
For any graph state of a nonempty graph, the maximum spectral gap of verification operators based on X and Z measurements is 1/2. Conjecture 2 holds for GHZ states according to [13]. For a graph state associated with the graph G, this conjecture amounts to the following equality where ν(G) denotes the maximum spectral gap of verification operators for |G that are based on Pauli measurements. When the local dimension is an odd prime p instead of 2, we believe that the maximum spectral gap of verification operators based on Pauli measurements is p/(p + 1), which holds for GHZ states according to [13]. Conjecture 3 holds for graph states associated with twocolorable graphs and ring graphs according to Sec. VI. In addition, we studied the problem of verifying graph states with the minimum number of settings. For any given graph state |G , it turns out that the minimum number of settings requiredχ(G) is upper bounded by the chromatic number χ LC (G) minimized over LC equivalent graphs. In addition, the upper bound still applies even if each party can perform only two types of Pauli measurements, so we haveχ(G) ≤χ 2 (G) ≤ χ LC (G) (cf. Proposition 6). Actually, the two inequalities are saturated for all two-colorable graphs, all graphs up to seven vertices, and ring (or cycle) graphs (cf. Sec. VII and Table II). These facts lead to the following conjecture originally stated in Sec. VII. Conjecture 1.χ(G) =χ 2 (G) = χ LC (G) for any graph G.
In the future, it would be desirable to prove or disprove the above conjectures. In either case, we may gain further insight on quantum state verification and stabilizer states themselves. The number of admissible Pauli measurements (or X and Z measurements) and its scaling behavior with the number of qubits are also of interest from the theoretical perspective. In practice, it is desirable to find more efficient approaches for constructing optimal verification protocols and protocols with the minimum number of measurement settings. Furthermore, our study leads to the following question, which is of interest beyond the immediate focus of this work: What are the generic and maximum values ofχ(G),χ 2 (G), and χ LC (G), respectively, for graphs of n vertices.
Proof of Theorem 1. Let V µ be the isotropic subspace associated with T µ . Then the column span of M µ = (diag(µ x ); diag(µ z )), where the semicolon denotes the vertical concatenation, coincides with V µ . (M µ is a basis matrix for V µ when the Pauli measurement is complete). Let N µ be the n × n diagonal matrix over Z 2 such that (N µ ) jj = 1 iff j ∈ U 2 . Then by construction, the column span of the block matrix coincides with V ⊥ µ , the symplectic complement of V µ . (Note that the first n columns of M ⊥ µ coincide with M µ .) Therefore, where J is the symplectic form (19). Let V S be the Lagrangian subspace associated with the stabilizer group S. Then V S = {M S y|y ∈ Z n 2 }, where M S is the basis matrix of S. U µ = V µ ∩V S is the isotropic subspace associated with the local subgroup L µ . In addition, we have To derive the fourth equality, note that which reduces toM S,µ after interchanging N µ M z S and N µ M x S and deleting rows of zeros. As an implication of (B3), we have | ker(M S,µ )| = |U µ | = |L µ | and which confirms (62). Equation (63) follows from (62) and Lemma 5. Furthermore, Lemma 5 and (34) imply that where the fourth equality follows from (B3). The summation in (B6) is nonzero iff w · y = 0 for all y ∈ ker(M S,µ ). This is the case iff w ∈ rspan(M S,µ ), in which case we have which implies (64).
Proof of Theorem 2. Let V µ be the Lagrangian subspace associated with T µ and M µ := (diag(µ x ); diag(µ z )); then M µ is a basis matrix for V µ . Let V G be the Lagrangian subspace associated with the graph state |G ; then we have V G = {Ãy|y ∈ Z n 2 }, whereÃ = (1; A) is the canonical basis matrix for V G . Let U µ = V µ ∩ V G ; then U µ is the isotropic subspace associated with the local subgroup L µ . In addition, where J is defined in (19), and the fourth equality follows from the fact that M T µ JÃ = A µ . As an implication of (B8), we have | ker(A µ )| = |U µ | = |L µ | and which confirm (76). Equation (77) follows from (76) and Lemma 5. Furthermore, Lemma 5 and (45) imply that where the fourth equality follows from (B8). The summation in (B10) is nonzero iff w · y = 0 for all y ∈ ker(A µ ). This is the case iff w belongs to the row span of A µ , in which case which implies (78).

Appendix C: Proofs of Proposition 5 and Lemma 14
Proof of Proposition 5. Note that an admissible test projector based on X and Z measurements is automatically weakly admissible. To prove Proposition 5 we need to prove that if a test projector P µ XZ based on X and Z measurements is inadmissible, then it is not weakly admissible either; in other words, there always exists a smaller test projector P ν XZ ≤ P µ XZ with tr(P ν XZ ) < tr(P µ XZ ) that is also based on X and Z measurements. According to Corollary 1, the inadmissible measurement µ XZ can be replaced by an incomplete measurement µ XZ on k < n qubits. After the measurement µ XZ , the reduced state on the remaining n − k qubits is a stabilizer state of the form U LC |G , where G is a graph of n − k vertices, and U LC is an outcome-dependent local Clifford unitary [18]. Crucially, when µ XZ consists of X and Z measurements, the unitary operator U LC can only map X to Z and vice versa up to an overall phase factor. Therefore, we can obtain a smaller test projector by performing suitable X and Z measurements on the remaining n − k qubits, which implies that P µ XZ is not weakly admissible and confirms the proposition.
Proof of Lemma 14. In one direction, suppose that B is not maximal and let B be a larger independent set containing B. Then we have P B ≤ P B and tr(P B ) < tr(P B ) according to (109), so P B is not admissible.
In the other direction, suppose that B is maximal. If P B is not admissible, then it is not weakly admissible either by Proposition 5. So there exists a subset B of V such that P B ≤ P B and tr(P B ) < tr(P B ), that is, where L B and L B are the local subgroups associated with the Pauli measurements determined by B and B , respectively, and the equality follows from (108). Equation (C1) implies that B ⊂ B by Lemma 13. Since B is a maximal independent set by assumption, there must exist a vertex j ∈ B that is adjacent to some vertex k ∈ B \ B, which implies that S j / ∈ L B , in contradiction with (C1). This contradiction completes the proof of Lemma 14.
Appendix D: Verification of graph states of nonconnected graphs Let G be a disjoint union of (possibly empty) connected graphs {G j } J j=1 . Then |G = Proof. The stabilizer group S of |G is a direct product of the form S = S 1 × S 2 × · · · × S J , where S j for j = 1, 2, . . . , J are the stabilizer groups of |G j , respectively. Suppose the test projector P is associated with the Pauli measurement specified by the symplectic vector µ; let T µ andT µ be the stabilizer group and signed stabilizer group associated with the Pauli measurement µ. Then T µ has the form T µ = T 1 ×T 2 ×· · ·×T J , where T j for j = 1, 2, . . . , J are stabilizer groups associated with certain Pauli measurements on |G j , respectively. Let L µ = S ∩T µ be the local subgroup associated with the Pauli measurement µ. Thanks to Lemma 1, L µ has the form L µ = L 1 × L 2 × · · · × L J , where L j = S j ∩T j are local subgroups of |G j . According to (53) we have where are canonical test projectors for |G j . Conversely, suppose P j are canonical test projectors for |G j that are associated with the local subgroups L j for j = 1, 2, . . . , J. Then P = J j=1 P j is a canonical test projector for |G that is associated with the local subgroup L 1 × L 2 × · · · × L J . This observation completes the proof of Lemma 17.
Proposition 9. Suppose the graph G is a disjoint union of (possibly empty) connected subgraphs G j for j = 1, 2, . . . , J. Then Here ν(G) denotes the maximum spectral gap of verification operators of |G that are based on Pauli measurements. Equation (D3) still applies if we consider the maximum spectral gap achievable by separable measurements, which follows from almost the same reasoning as the one presented below.χ(G) denotes the minimum number of Pauli measurement settings required to verify |G , whileχ XZ (G) andχ 2 (G) denote the minimum numbers of settings based on XZ measurements and two measurement settings for each party, respectively. Incidentally, the minimum number of measurement settings based on the coloring protocol [7] is equal to the chromatic number χ(G), which satisfies So Proposition 9 may be seen as a generalization of this equation.

Proof.
Suppose Ω is an optimal verification operator for |G with ν(Ω) = ν(G) that can be realized by canonical test projectors. Let Ω j be the reduced verification operator of Ω for |G j . Then Ω j can also be realized by canonical test projectors according to Lemma 17. Therefore, where the second inequality follows from Proposition 2. Conversely, suppose Ω j for j = 1, 2 . . . , J are optimal verification operators of G j that are based on Pauli measurements, so that ν(Ω j ) = ν(G j ). Let Ω = J j=1 Ω j ; then Ω is a verification operator of |G that is based on Pauli measurements. Therefore, Equations (D8) and (D9) together imply (D3).
To prove (D4)-(D6), suppose |G can be verified by m canonical test projectors P 1 , P 2 , . . . , P m ; let Ω = and Ω j = k P (j) k /m; then P (j) k for k = 1, 2, . . . , m are canonical test projectors for |G j according to Lemma 17. Moreover, |G j can be verified by these canonical test projectors since ν(Ω j ) ≥ ν(Ω) ≥ 1/m. If each P k is based on XZ measurements or two measurement settings for each party, then each P (j) k has the same property. These observations imply that Conversely, suppose |G j can be verified by the set of canonical test projectors {P (j) k } mj k=1 . Let m = max j m j ; then |G can be verified by the following canonical test projectors where P (14). Let Ω = k P k /m, then ν(Ω) ≥ 1/m since these canonical test projectors commute with each other. If each P (j) k is based on XZ measurements or two measurement settings for each party, then each P k has the same property. These observations imply that  Table I) under LC with respect to the vertices No. 1, 2, 6, and 3 in succession.
which confirms (D4)-(D6) in view of the opposite inequalities derived above.
Appendix H: Table of optimal verification protocols   TABLE I: Optimal verification protocols for connected graph states up to seven qubits. There are 45 equivalent classes with respect to LC and graph isomorphism and here the labeling follows from [18]. Graph states associated with an edge and star graphs (No. 3, 5, 9, and 20) are omitted since optimal protocols for these states have a simple description as discussed in Sec. V C (cf. Fig. 2). For each graph, the optimal protocol is specified by Pauli measurement settings shown in the fifth column together with the corresponding probabilities shown in the sixth column. The spectral gap ν(Ω) of the verification operator Ω is 2/3, which attains the upper bound presented in Theorem 3. For completeness, the table also shows a minimum coloring of each graph, the number #(Ω) of measurement settings in the optimal protocol and the ranks of canonical test projectors. In addition, η(G) denotes the total number of admissible test projectors (that is, the number of admissible Pauli measurements) for the graph state |G .  Optimal verification protocols based on X and Z measurements and protocols with the minimum number of settings for the same graph states as shown in Table I (cf. [18]). For each graph, the optimal protocol can achieve the spectral gap ν(Ω) = 1/2, which attains the upper bound in Corollary 2. The minimum number of settingsχ(G) is equal to the chromatic number χ(G) shown in the fourth column (cf. Proposition 6); the corresponding protocol achieves the spectral gap 1/χ(G) (cf. Theorem 4). All protocols with the minimum number of settings shown in the table are coloring protocols [7] determined by the colorings shown in Table I. Each protocol is specified by Pauli measurement settings shown in the seventh column: all settings are measured with the same probability unless noted otherwise (for graphs No. 41 and No. 42). When χ(G) = 2, only one protocol for |G is shown because the protocol can achieve the maximum spectral gap ν(Ω) = 1/2 and meanwhile requires the minimum number of settings. For completeness, the table also shows the qubit number n in the second column, the rank of each canonical test projector in the eighth column, and the minimum number of generators of the local subgroup in the ninth column (cf. Sec. IV B). In addition, ηXZ (G) denotes the total number of admissible test projectors for the graph state |G that are based on X and Z measurements (cf. Sec. VI B). χ * (G) denotes the fractional chromatic number of G [39], whose inverse is the maximum spectral gap achievable by the cover protocol proposed in [7]. Note that ηXZ (G), χ(G), and χ * (G) are not LC-invariant.