Error suppression and error correction in adiabatic quantum computation I: techniques and challenges

Adiabatic quantum computation (AQC) is known to possess some intrinsic robustness, though it is likely that some form of error correction will be necessary for large scale computations. Error handling routines developed for circuit-model quantum computation do not transfer easily to the AQC model since these routines typically require high-quality quantum gates, a resource not generally allowed in AQC. There are two main techniques known to suppress errors during an AQC implementation: energy gap protection and dynamical decoupling. Here we show that both these methods are intimately related and can be analyzed within the same formalism. We analyze the effectiveness of such error suppression techniques and identify critical constraints on the performance of error suppression in AQC, suggesting that error suppression by itself is insufficient for large-scale, fault-tolerant AQC and that a form of error correction is needed. We discuss progress towards implementing error correction in AQC and enumerate several key outstanding problems. This work is a companion paper to"Error suppression and error correction in adiabatic quantum computation II: non-equilibrium dynamics"', which provides a dynamical model perspective on the techniques and limitations of error suppression and error correction in AQC. In this paper we discuss the same results within a quantum information framework, permitting an intuitive discussion of error suppression and correction in encoded AQC.

Adiabatic quantum computation (AQC) is expected to be inherently robust against certain errors, such as dephasing and energy relaxation [1,2]. This robustness suggests the possibility of an easier route to scalable quantum computation than the conventional gate-based "circuit" model, with less stringent requirements for fault tolerance and fewer resources devoted to error suppression and correction. However, AQC's inherent robustness is not sufficient for fault tolerance. For example, several studies [2][3][4][5][6] show that single-qubit noise can drive undesirable transitions out of the adiabatic ground state. In response, error suppression techniques have been developed that can reduce the rate at which these transitions occur. However, it is well understood that error suppression alone is insufficient for fault tolerance in the circuit model. Fault tolerance requires an additional mechanism to remove the entropy generated by errors that do occur in the encoded system -i.e., error correction. Since this thermodynamic argument is independent of the computational model, we reasonably expect that achieving fault-tolerant AQC will also require some form of error correction.
In this paper, we address both error suppression and error correction in AQC, and prove several facts about them. We begin our discussion in Section I with an overview of the failure mechanisms present in AQC. In Section II we discuss error suppression techniques based on error-detecting quantum stabilizer codes. Currently known suppression strategies include: energy gap protection (EGP) [7], in which the addition of the stabilizer generators to the system Hamiltonian causes errors to incur large energetic penalties; dynamical decoupling (DD) [8], whereby stabilizer generators are applied periodically as unitary operators, refocusing errors much like traditional spin echos; and Zeno effect suppression [9], which prevents * Electronic address: kyoung@sandia.gov errors from accumulating through frequent measurements of the stabilizer generators. These three techniques apparently operate by very different physical mechanisms. However, Facchi et al. [10] have shown that both Zeno suppression and DD may be viewed as limiting cases of a more general mathematical framework. We extend this unification by showing that DD and EGP may both be understood using the same formalism, and that the two methods are effectively equivalent in their error suppression power. Our result shows that all three error suppression techniques may be considered functionally equivalent for AQC, with some important caveats related to their physical implementation and their behavior in the presence of a thermal bath.
With Section III, we turn our attention to error correction, where we discover two fundamental obstacles to adaptation of stabilizer code quantum error correction to AQC: (i) in the presence of the adiabatic Hamiltonian, correctable errors rapidly become uncorrectable errors and (ii) the resources required by circuit-model error correction, such as stabilizer measurements and unitary gates, are generally outside the scope of the adiabatic paradigm. In Section IV of the paper, we explore possible ways to overcome these obstacles when adapting stabilizer-based error correction to AQC. We identify alternative implementations of logical operators and continuous-time error correction by cooling as possible yet very challenging routes forward. Section V finishes with a discussion of our view of the future of adiabatic fault tolerance.
The major results discussed in this manuscript are: 1. In the Hamiltonian formalism, the energy gap protection and dynamical decoupling methods for error suppression based on stabilizer encodings may be described by a unified mathematical formalism.
2. AQC appears to be fundamentally incompatible with stabilizer quantum error correction. Patching this incompatibility requires unphysical resources.
A companion paper entitled, "Error suppression and correction in adiabatic quantum computation: non-equilibrium dynamics" [11], develops a dynamical model for describing error suppression and correction in AQC, and discusses most of the results in this paper from a dynamical perspective.

I. THE QUANTUM ADIABATIC ALGORITHM AND IMPORTANT FAILURE MODES
The quantum adiabatic algorithm [1] operates by slowly changing an N -qubit system's Hamiltonian from a simple separable Hamiltonian H init , whose ground state is easily prepared, to a final target Hamiltonian, H prob , whose highly nontrivial ground state encodes the solution to a problem of interest. The adiabatic theorem promises that, if the Hamiltonian is changed slowly enough, then the system will remain in its (time-varying) ground state, and thus the solution can be read out by measuring the final state. In the simplest case, the closed-system dynamics may be described by a timedependent Hamiltonian, where s(0) = 0, s(T ) = 1, and T is the adiabatic interpolation time. More complicated interpolation schemes, including the addition of ancillary Hamiltonians, have been considered elsewhere [12,13], but are unnecessary for our discussions here. Importantly, the adiabatic model does not require the ability to perform high-quality quantum gates or measurements during the computation, key elements of fault tolerant circuit-model quantum computation. The adiabatic model is expected to be robust to some errors that plague other computation models, such as the cluster-state or circuit models. In particular, Ref. [2] showed that AQC possesses an inherent robustness to both control errors and some forms of decoherence. In this section we give a brief overview what can go wrong with adiabatic computations and discuss which failure modes can be suppressed with current techniques.
Perhaps the best known failure mode of AQC is diabatic errors (a.k.a. Landau-Zener transitions), in which the Hamiltonian is varied too quickly and the state fails to track the instantaneous ground state. The obvious solution to this problem is to perform the interpolation more slowly, although identifying diabatic errors and determining the maximum allowable speed are nontrivial. For certain problems, the location of the minimum energy gap between the ground and first excited state is well known (e.g., for adiabatic Grover search, it happens exactly in the middle [12]). This knowledge permits efficiently varying the interpolation speed so that it proceeds rapidly in regions where the gap is large, and slowly in regions where the gap is small. Unfortunately, the location and magnitude of the minimum gap are not known for most problems. The blunt approach of slowing the entire interpolation is problematic because even simple problems may have exponentially small minimum gaps, leading to exponentially long interpolation times. This problem is not the focus of this paper, but solving it will necessarily involve (or enable) great leaps in our understanding of the computational complexity of the adiabatic algorithm.
While the system can be quite susceptible to diabatic transitions, AQC is known to possess some intrinsic robustness to Hamiltonian control errors [2]. As long as the evolution remains adiabatic, small perturbations to the intermediate Hamiltonians are likely to be unimportant. However, errors in the final Hamiltonian can be fatal, since it is the final Hamiltonian that encodes the problem to be solved. In particular, if the final Hamiltonian is close to a critical point, small perturbations may drastically alter the character of the ground state. This failure mode is addressed in [14]. Finally, because the success of an adiabatic interpolation relies ultimately on the population in the final ground state, it is robust to environmental couplings that cause decoherence in the eigenbasis of H(s) (sometimes called dephasing). However, most system-bath couplings will cause transitions from the adiabatic ground state as well as Lamb shifts of the system Hamiltonian. The resulting open system dynamics may be radically different from those of the ideal closed system. This paper is largely concerned with these errors, and we focus on techniques designed to suppress and correct the influence of these system-bath couplings in a manner consistent with the adiabatic paradigm. Specifically, we attempt to avoid reliance on quantum gates and measurements as much as possible.

II. SUPPRESSING ERRORS IN AQC
In this section we introduce quantum stabilizer codes and discuss their role in protecting adiabatic quantum computations. A system undergoing adiabatic quantum evolution while coupled to an external environment/bath is described in a tensorproduct Hilbert space, H sys ⊗ H env , by a Hamiltonian Here H AQC acts on the system and performs the adiabatic evolution, and H B is the bath Hamiltonian. B j is a bath operator, and E j is a single qubit Pauli error operator. The total number of system-bath coupling operators is n e , and is generally proportional to the total number of qubits in the system. Eigenstates of H AQC (t) may be labeled as |n, k t according to their principal quantum number n and an index k distinguishing any degeneracy; the subscript labeling the time is necessary because the Hamiltonian is time-dependent (so |n, k t = |n, k t ). The system-bath interaction terms in the Hamiltonian can cause the computation to fail by inducing transitions out of the adiabatically evolving ground state.

A. Quantum stabilizer codes
All currently known techniques for suppressing the errors induced by the system-bath interaction terms rely on encoding the system in an error detecting stabilizer code [15,16]. "Encoding" comprises: 1. introducing (many) extra physical qubits to the system, and 2. mapping the original computational qubits (on which the computation is performed) into logical qubits that are distributed across many physical qubits, much as in a classical repetition code.
All the physical qubits together define a large system with a Hilbert spaceH sys . The logical qubits are a subsystem, corresponding to a factor space L, so the entire Hilbert space factors asH sys = L ⊗ S. The complementary subsystem S is the syndrome subsystem, This factorization into subsystems is carefully chosen so that physical errors (on a small number of physical qubits) can be detected by Pauli measurements on the syndrome. These measurement operators, the stabilizer generators, are the quantum analogue of parity checks in classical linear block codes. The stabilizer generators generate an abelian subgroup of the Pauli group (the stabilizer group, comprising all possible products of generators), and are used to compactly define the code. Stabilizers can be measured without disturbing the encoded quantum information, because logical qubit operators (by definition) commute with the stabilizers.
An encoded system is always initialized in a known eigenstate of all the stabilizers. Subsequently measuring the stabilizers will reveal (detect) any error operation that anticommutes with one or more stabilizer generator (since such a detectable error necessarily flips the sign of some stabilizer eigenvalues). These errors will be generated by terms in the system-bath Hamiltonian, whose effect on the system is to apply E j operations (Eq. (2)) on the system. Thus we want to choose a code such that each E j in the system-bath interaction anticommutes with at least one of the stabilizer generators. Utilizing a code with N g stabilizer generators adds N g physical qubits, enlarging the system's Hilbert space by a factor of 2 Ng . The encoding process replaces the original problem Hamiltonian H AQC with an encoded Hamiltonian, in which the Pauli operators, σ x , σ y , σ z (that acted on physical bits in the unencoded Hamiltonian) are replaced by the code's logical operators,X,Ȳ ,Z. In addition, a time-dependent system control Hamiltonian, H C , expressible in terms of the code's stabilizer generators, is added to implement any desired error suppression. The encoded Hamiltonian is then: We have assumed that the system-bath interaction remains qualitatively the same after the encoding, but is extended to N e > n e terms to describe the extra qubits. Importantly, we have assumed that any controls we apply act only on the system and have no effect on system-bath couplings.
States of the encoded system may now be labeled by the same two quantum numbers as before, but with N g additional binary quantum numbers, collected into the vector ν, indicating the eigenvalues of the stabilizer generators, S j |n, k; ν t = (−1) νj |n, k; ν t , where S j ∈ S is a generator of the stabilizer group and ν j = {0, 1} is the j th element of the vector ν. We shall refer to the subspace on which all the stabilizer eigenvalues are +1 (and therefore all ν j = 0) as the codespace. States in the codespace will therefore be labeled as |n, k; 0 t . The projector onto the codespace is time-invariant, and expressible in terms of the stabilizer generators as Encoding will help to protect logical information (stored initially in the codespace) by permitting active suppression of errors that cause transitions out of the codespace. Errors that mix states within the codespace are necessarily high weight [17] (and therefore, hopefully, unlikely). Encoding also makes it possible in principle to correct errors, by using the results of stabilizer measurements to detect and identify errors, then inverting them. However, such correction operations traditionally require resources (measurements and gates) that we have abjured.
In the following discussion we will make extensive use of the toggling frame, a rotating frame of reference defined in terms of the control and bath Hamiltonians. Transformations to and from this frame are effected by the unitary operator, There is no need to time order the integral because H C (s) may be written entirely in terms of the stabilizer generators of the code, all of which are mutually commuting, and H B acts on a different part of the Hilbert space. The following notation is used for an operator A in the toggling frame: , while states in the toggling frame are related to states in the Schrodinger picture by: |ψ t = U † C (0, t) |ψ t . Evolution of states in this frame is generated by the toggling frame Hamiltonian:

B. Dynamical decoupling
Dynamical decoupling (DD) is a well-known quantum control technique for suppressing errors produced by spurious terms in a system's Hamiltonian [18]. The methods were first applied to AQC in Ref. [8], with higher-order strategies shown to be particularly effective in Ref. [19]. In DD, the stabilizer generators are applied as unitary operations by manipulating the control Hamiltonian H C . The sequence in which they are applied is given by the vector n, at times given by K(t) ∈ Z, so that at time t, the last operator applied to the system was S n K(t) . The unitary operator defining the toggling frame may then be written as, U DD The operator U C (t) is an element of the full stabilizer group and therefore commutes withH AQC (t). In the toggling frame the Hamiltonian takes the form: Since E j is a Pauli operator, it either commutes or anticommutes with each member of the stabilizer group and we may write, where A well-chosen DD sequence will cause p j (t) to rapidly alternate between 0 and 1, which modulates the the system-environment coupling (in the toggling frame) by a rapidly oscillating function of t. The unitary operator governing the evolution at time t is U (t, 0) = exp + {−i t 0 dsH DD (s)}, and if the DD sequence is wellchosen, the system-environment coupling averages to zero on timescales longer than the DD interpulse period (i.e., the integral vanishes thanks to the modulation factor (−1) p(s) in the exponential).

C. Energy gap protection
The EGP approach, introduced in Ref. [7], appears quite different. It uses a constant-in-time control Hamiltonian, given by a sum of the stabilizer generators, H EGP States in the codespace are then eigenstates of H C with eigenvalue −αN g , but any state outside the codespace is subjected to an energy penalty. Since H C is a function only of the stabilizer generators, U EGP C (t) again commutes with the code's logical operators which compriseH AQC (t), so we can write the Hamiltonian in the toggling frame as: Error operators in the EGP toggling frame can be shown to take the form: where the sums are taken over all stabilizer generators S m that anti-commute with the error operator E j . To obtain this expression we have exploited the following: (i) the stabilizer generators commute with each other (allowing easy manipulation of the exponential operators), and (ii) each generator either commutes or anti-commutes with the noise operators: Let w j be the number of generators that anticommute with E j . Then the action of this toggling frame Hamiltonian on any state,|Ψ =|ψ c ⊗|φ ∈ H sys ⊗ H env with|ψ c in the codespace is, Thus the coupling term E j ⊗B j (t) is modulated by a factor of e 2iwj αt . Just as in the case of DD (above), the error terms are modulated by an oscillating function in the interaction picture -which ensure that they average to zero on sufficiently long timescales as long as the frequency of oscillation is larger than the typical frequencies inB j (t). In the case of EGP the oscillations are smooth and sinusoidal, whereas for (impulsive) DD the oscillations are square waves in time. EGP can be made to mimic a decoupling sequence by choosing α so that the EGP oscillations match the frequency of a DD sequence. Numerical studies provide evidence that in such cases EGP and DD suppress errors equally well, as shown in Fig. 1. i Xi + (t/T ) (Z1 + Z2 + Z1Z2) under the influence of Hamiltonian noise, Hη(t) = i ηi(t)Zi. In these numerical simulations ηi is a classical stochastic process of 1/f type with spectrum S(ω) = 10 −3 /ω, and the success probabilities were averaged over 1000 instances of this noise process for each evolution time T . Four simulations were performed: (i) the unencoded system (thick black line), (ii) the system encoded into four physical qubits using the [[4,2,2]] quantum code [15] (red dashed line), (iii) the encoded system with EGP applied at strength Ω = 1 (thin blue line), (iv) the encoded system with DD applied at frequency Ω/2π (black x's). Initial performance increase is due to reduction of diabatic errors, while later performance degradation is due to the accumulation of errors. Both EGP and DD are capable of suppressing this type of noise equally well, as shown by approximately equal success probabilities of cases (iii) and (iv). Encoding without error suppression, case (ii), performs especially poorly because twice as many qubits are exposed to noise as in the unencoded case and no measures are taken to suppress it.
In fact, there no requirement that the weights α be constant in time or equal across the stabilizer generators. Many dynamical decoupling schemes vary the time interval between the pulses; For example, Uhrig's dynamical decoupling scheme (UDD) [20] chooses the pulse arrival times as t n = T cos(nπ/2(N + 1)), where N is the total number of pulses in time interval τ . To mimic this UDD sequence, where the modulation frequency is not constant in time, we choose a time dependent weight term, α(t) = N T / t(T − t). This approach was used, suitably regularized and in the context of a single qubit, by the authors of Ref. [21] to produce an effective UDD sequence using continuous controls. More generally, allowing α to vary in time allows the strongest identification between the DD and EGP approaches, and a unified treatment of both as quantum control protocols. For instance, choosing α j (t) = i πδ(t − t j i )/2 applies S j at time t j i as a unitary operator (impulsive DD), but in the EGP formalism, and points to how one might smoothly interpolate between the two methods. In this approach, optimal control techniques can be used to choose the α j (t) to optimally mitigate the system-bath interaction.

D. A few important differences
The discussion above indicates that DD and EGP suppression methods have very similar behavior with respect to noise and are capable of providing approximately equivalent error suppression. This relationship is further examined in the context of filter functions in Appendix B and in a dynamical framework in Ref. [11]. But while these error suppression techniques are closely related, it is important to be aware of some key differences, including the relative ease of their physical implementation and their effect on thermalization.
Many codes possess high-weight stabilizer generators. These codes cannot reasonably be implemented by EGP, since high-weight Hamiltonians are experimentally infeasible. They can be implemented by DD, however, by exploiting the fact that unitary operators may be generated by many different Hamiltonians. A high-weight DD pulse can be generated by single-body Hamiltonians, e.g.
However, the single-body Hamiltonian implementing the DD does not commute with the encoded AQC Hamiltonian. If its implementation is not impulsive (i.e., the DD Hamiltonian is not significantly stronger than the AQC Hamiltonian), then it will be imperfect. The error can be computed fairly easily with the Baker-Campbell-Hausdorf formula and vanishes in the impulsive limit. Despite this complication, DD appears to be the only option for implementing high-weight stabilizer generators. In fact, there exist codes [22] that possess a large number of 2-body stabilizer generators and only a few high-weight generators. These codes may benefit from a hybrid approach where low-weight generators are added as energy penalties, while those of high-weight are included as DD pulses.
Another important difference between DD and EGP is their behavior in thermal environments. Whereas EGP establishes a real energy difference between the codespace and the various syndrome spaces, DD does not. If a system with an EGP Hamiltonian is coupled to a cold thermal reservoir, thermalization will lead to a Gibbs distribution (ρ ∝ e −βH ), in which the syndrome spaces are thermally populated according to their energy, and the codespace is preferentially populated (since it has the lowest energy). In contrast, DD creates no real energy difference between syndrome spaces, and the system's steady-state population will be uniformly distributed across all the syndrome spaces. This distinction between EGP and DD will be important in Sec. IV.

III. ERROR CORRECTION
The error suppression mechanisms described above reduce the rate at which errors appear in the system, by effectively renormalizing the system-bath coupling (see Ref. [11] for details). But the coupling cannot be eliminated completely without using an infinite amount of energy (e.g., DD pulses applied at infinitely high frequency, or an infinitely strong EGP Hamiltonian). Since our resources are finite, physical errors will still accumulate over long timescales, and eventually cause logical errors. Typical AQC problems (e.g. combinatoric optimization) may have some intrinsic robustness to logical errors (e.g., a few bits flipped in the solution to a Boolean satisfiability problem can be fixed efficiently with classical post-processing), but as they accumulate, they will cause the computation to fail. Using large systems for long computations thus still requires some form of error correction.
Implementing error correction requires, to start, utilizing a code that is error-correcting (rather than just error-detecting). Not only must each error E k anticommute with at least one stabilizer generator, but the set of generators with which it anticommutes (E k 's syndrome), must uniquely identify E k 's effect on the encoded computation, and therefore how to correct it. For simplicity, we will consider nondegenerate codes [23], in which each correctable error's syndrome is unique [24]. Such codes can thus determine what error has occurred (instead of simply detecting that some error occurred). Each correctable error can be labeled by its syndrome, a binary vector ν indicating which stabilizer generators anticommute with the error: For example, in a code with four stabilizer generators, an error labeled E 0101 commutes with S 1 and S 3 , but anticommutes with S 2 and S 4 . A code for which the number of correctable errors is exactly equal to the total number of nontrivial syndromes (i.e., 2 Ng − 1) is called perfect [15,16].

A. A challenge for error correction
The simplest way to incorporate error correction into an AQC is to just do the encoding, and nothing else. Perform the encoded adiabatic interpolation, then measure both the stabilizers and the logical Z operators on the final state. In the absence of errors, the stabilizer measurements would all yield +1, and the logical Z measurements would yield the answer to the computation. If one or more physical errors do occur, and accumulate to produce a correctable error, then the correct answer can be decoded (classically) from the final measurement outcomes. So this naïve implementation of error correction offers at least one advantage over pure error suppression.
However, it is unlikely to be sufficient. In the absence of some correcting mechanism during the evolution, errors will accumulate. With a probability that approaches 1 as the computation grows (in size and time), a logical error will occur, and the (decoded) final answer will be wrong. Thus, we anticipate an additional need for some ongoing entropy-extracting process.
First, however, we must address a different (yet arguably more pernicious) problem, which arises even for very small systems where bath-induced uncorrectable errors are rare: the encoded problem Hamiltonian transforms correctable errors to logical errors.
To illustrate this issue, we consider a simple case. Suppose the system is encoded and initialized in the ground state |0 of an initial Hamiltonian, and evolves unperturbed under the adiabatically changing Hamiltonian until, at time τ , a correctable Pauli error E ν occurs. Then the system evolves unperturbed through the end of the AQC, at which point we measure the code stabilizers. Because the Hamiltonian always commutes with the stabilizers and only a single correctable error has occurred, one might think that the error can be detected and identified by its syndrome, ν, enabling a restoration of the system to the ground state (in the codespace) by an application of E ν . Unfortunately, in the timespan between the error and its subsequent correction, things go horribly awry.
The overall evolution according to our simplified error model is: where the unitary evolution generated by the adiabatic Hamiltonian is given by a time-ordered exponential, (We neglect the as-yet-unspecified error suppressing control Hamiltonian, as its presence does not change the result.) We assume that the only error that occurs is E ν , and that there are not other deviations (such as Landau-Zener transitions) from ideal adiabatic evolution, so U AQC (0, τ ) |0; 0 0 = |0; 0 τ . Now, the encoded AQC Hamiltonian,H AQC (s), is a weighted sum of the code's logical X, Y and Z operators. Each is a Pauli operator, so it either commutes or anticommutes with the error operator E ν . The encoded AQC Hamiltonian (at any normalized time s) splits into a commuting and an anticommuting term,H where After some algebra, Eq. (11) becomes Between the time when the error happens (τ ) and when it is corrected (T ), the encoded system experiences a new, effective Hamiltonian,H ν =H + ν (s) −H − ν (s). Since the state |0; 0 τ is not generally an eigenstate ofH ν , the system will undergo unintended evolution within the codespace, moving it out of the ground state (a logical error). The root problem here is that the encoded adiabatic Hamiltonian acts differently on different syndrome spaces (eigenspaces of the stabilizers). Correctable errors flip various stabilizers' eigenvalues, moving the system from one syndrome space to another. Only on the codespace itself isH AQC guaranteed to act like the original problem Hamiltonian H AQC . In other words, the AQC Hamiltonian itself rapidly turns correctable errors into logical errors. Like non-transversal implementations of logic gates in the circuit model, naïvely encoded AQC Hamiltonians cause errors to propagate, and decoding at the end of the computation is unlikely to be effective.
The problem persists even if errors are corrected during the computation. Even the best error correction is not instantaneous, so errors will survive for some time before being corrected. In large computations, the equilibrium between noise and correction occurs at a finite density of errors, meaning that at every instant the system will be out of the codespace. Thus, it is absolutely necessary to modify the encoded Hamiltonian so thatH AQC is sufficiently similar to H AQC not just on the codespace, but on every likely syndrome space.

B. Protected Hamiltonians
The promotion of physical errors to logical errors by the adiabatic Hamiltonian poses a serious threat to error correction in AQC using stabilizer codes. In this section, however, we demonstrate that this threat may be avoided by carefully choosing the logical operators -but doing so comes at a steep cost: these protected logical operators are complicated sums of high-weight Pauli operators.
Physical errors become logical errors becauseH AQC does not act identically on all of the syndrome spaces. In principle, it would be enough if any error mapped the ground state[s] of H AQC to another eigenstate ofH AQC , H AQC (t)E ν |0, k; 0 t = 0,k;ν (t)E ν |n, k; 0 t . But our error correcting code is not allowed to "know" what the ground state is. This condition has to hold for any encoded logical Hamiltonian built as a sum of logical operators. So, whenever an AQC is encoded in a stabilizer code, some logical Hamiltonians will rapidly transform some physical errors into logical errors unless the following stronger condition is satisfied: for any error E ν and any eigenstate |n, k of the logical Hamiltonian, E ν |n, k; 0 must be an eigenstate of the encoded logical Hamiltonian. In other words, If this condition holds, then at least adiabatic evolution is still possible in the presence of errors (although errors might reduce or eliminate the gap, or even cause an excited state to become the ground state). If we want Eq. (15) to hold, then the encoded Hamiltonian (and therefore the encoded logical operators) is constrained.
The eigenstates specified in Eq. (15) form a complete orthonormal basis, so the most general encoded Hamiltonian that satisfies Eq. (15) is a sum of their projectors, H AQC (t) = n,k,ν n,k;ν (t) |n, k; ν t n, k; ν| = n,k,ν n,k;ν (t)E ν |n, k; 0 t n, k; 0| E † ν . (16) The projector |n, k; 0 t n, k; 0| may be written as a product of the projector onto the codespace (expressible entirely in terms of code's stabilizers) and the logical projector onto the encoded state |n, k t (expressible entirely in terms of the code's logical operators).
To construct an encoded Hamiltonian with these properties, we can exploit the freedom in defining logical operators of a code. Multiplying a logical operator by a stabilizer operator yields an equally valid representation of the same logical operator. We can represent elements of the stabilizer group by binary vectors j, of length N g , in which a 1 indicates the presence of the corresponding generator, i.e.
Ng . For example, if there are four stabilizer generators, then S 0110 ≡ S 2 S 3 . In this notation, the fact that (Pauli) errors either commute or anticommute with each of the stabilizers can be written as: Then ifL i is a particular encoded logical operator, each stabilizer operator S j defines an equivalent logical operatorL i S j that acts identically on the codespace. Linear combinations, e.g. j β ijLi S j , are also valid logical operators. Now, any problem Hamiltonian can be written as a sum of logical operators, When we encode it, we can choose any encoding L i → j β ij (t)L i S j (where the j sum is taken over all binary vectors of length N g , andL i is an arbitrary encoded representation of L i ) as long as j β ij (t) = 1. So, an equivalent encoded problem Hamiltonian is Now, we impose the constraint that it satisfy Eq. (15). Inserting Eq. (18) into Eq. (15) and multiplying by E ν on the left, we obtain where E νLi = γ iνLi E ν , and Γ ν ij = γ iν (−1) j·ν is 1 if E ν commutes withL i S j and −1 otherwise. Direct computation then shows that Γ ν ij obeys the orthogonality condition Recall that |n, k; 0 t is defined to be an eigenstate of i α i (t)L i for any choice of α i (t). Therefore, the sum j β ij (t)Γ ν ij cannot depend on i and we may substitute With this definition, we see that n,k;ν (t) = n,k;0 (t)λ ν (t). This means that an encoded operator satisfying Eq. (15) acts identically (up to a scale factor λ ν ) on each syndrome subspace, including the codespace. Correctable errors map eigenstates ofH AQC in the codespace to eigenstates in the appropriate syndrome space. In particular, the ground state maps either to the lowest-energy eigenstate in the syndrome space (if λ ν is positive) or the highest-energy eigenstate (if λ ν is negative).
We refer to λ ν as a deformation factor in Ref. [11] since it represents the deformation of the codespace energy structure when reproduced within syndrome spaces. This means that the most general Hamiltonian satisfying condition Eq. (15) can be constructed by symmetrizing over whereH(t) is a Hamiltonian encoded using any logical operators. We refer to such Hamiltonians as protected Hamiltonians since adiabatic evolution under them does not lead to propagation of errors in the correctable syndrome subspaces. Furthermore, we define the canonical protected Hamiltonian by setting all λ ν in Eq. (21) to 1, The canonical protected Hamiltonian acts truly identically on every syndrome space, with no scale factor at all. Similar Hamiltonians were introduced in a slightly different context in Ref. [25]. Unfortunately, implementing the canonical protected logical operators seems infeasible. They generally contain (many) terms of very high weight, up to the total number of qubits in the system. However, if we allow a scale factor (i.e., choose non-canonical but still protected logical operators), then it is possible to reduce the maximum weight by choosing the coefficients λ ν to eliminate the highest weight logical operators from Eq. (21). Inverting Eq. (20), we have, which can be used to choose the λ ν (t)'s such that the β ij (t)'s corresponding to high weight operators vanish. Note that we have explicitly included the time dependence in λ ν (t) and β ij (t) to maintain generality, but it may be convenient to force them to be time independent, as in the canonical protected Hamiltonian (where λ ν (t) = 1). The time dependence may be useful for constructing more sophisticated error suppression schemes, such as increasing the penalty if a particular error is otherwise more likely at a certain time, but we do not consider such schemes here.
In the appendix, we examine the [ [5,1,3]] code [15] and show that while the canonical protected logical operators are weight-5, we can construct protected logical operators with weight 3. Any logical operator for a distance-d code must have weight at least d, so it is encouraging that protected operators of weight d exist in this case. If such a construction is possible for any code (an open question), it would remove one obstacle to implementation.
However, a further challenge is the sheer number of Pauli operators terms required to implement these protected logical operators; for example, the canonical protected logical operators for n-qubit codes are sums of O(2 n ) Pauli operators. The minimum-weight protected logical operators that we construct in the appendix are simpler, but still contain O(2 d ) distinct Paulis. Applying a single weight-d operator (for d 1) as a Hamiltonian is already challenging (see concluding discussion). Balancing many such terms seems fantastically difficult. We suspect it will be feasible only if there exist protected logical operators in which the required sum of Pauli operators can be factored or otherwise decomposed into a sum of a few products. For example, (X + Z) ⊗n , expanded as a sum of Paulis, contains 2 n terms -but because it factors, it is no harder to implement than X ⊗n . We are not aware of any such structure in protected logical operators, but further research might reveal one.

IV. ERROR CORRECTION BY LOCAL COOLING
Suppose that a way is found to prevent the adiabatic Hamiltonian from converting physical errors to logical errors (e.g., by implementing protected logical Hamiltonians). AQC would then face "only" the same problem that confronts circuitmodel computation; errors accumulate over time. These errors are the manifestation of entropy injected into the system by coupling to the bath, and unless we actively pump that entropy out, the computation is likely to fail within a relatively short time. Active error correction, however, requires fast gates and high-weight stabilizer measurements during the computationboth of which are outside the standard AQC toolset (and infeasible in many of the physical systems on which AQC might be implemented). Local cooling offers a potential route around this difficulty.
In the local cooling model, each physical qubit is coupled to a very low temperature bath that serves as the entropy sink for the system. The coupling is designed such that if the stabilizer generators are added to the Hamiltonian, the bath is able to detect the increase in energy associated with an error and then to absorb that energy and reverse the error. The dynamics of error correction by cooling is worked out in detail in Ref. [11] and we sketch the scheme here.
We will consider the Hamiltonian of Eq. (3) with an additional local coupling of each error operator to a cold, damped reservoir given by In addition to this interaction Hamiltonian, the reservoirs have free Hamiltonians of independent oscillators: k . We assume that each reservoir has a broad frequency distribution and is well damped such that it is in its ground state at all times with high probability. It is shown in Ref. [11] that such a system-reservoir coupling, a control Hamiltonian of the EGP type and a protected Hamiltonian implementation of the logical Hamiltonian are sufficient for an automated implementation of error correction where the excitations induced by local Pauli perturbations from the bath are quenched by the cold reservoir.
However, because the reservoir is coupled to the system through low weight Pauli operators (E j ), it can only cool local excitations. Cooling away a high-weight error would have to be accomplished through a sequence of single-Pauli operations that reduce the error weight until the system is returned to the codespace. However, as shown in Ref. [11] the cooling dynamics is a biased random walk in syndrome space and therefore in order for such a sequence of single Pauli operations to successively cool away several errors the energy landscape of the system must be such that the energy penalty associated with an error increases with its weight. That is, the energy of states in a correctable syndrome subspace must increase monotonically with the weight of the error that takes the codespace to that syndrome space. The EGP control Hamiltonians corresponding to most stabilizer codes do not have this property (we shall discuss exceptions to this in a moment). For example, for the abelian toric code [26], a state with two errors can have the same energy penalty as a state with one error if the two errors are neighboring, i.e. a string excitation does not have an excited state energy proportional to the string length and a local measurement of energy cannot distinguish between such degenerate errors. Such models have no "string tension" [27].
EGP control Hamiltonians that provide a favorable landscape, where syndrome subspace energies scale with error weight, may be constructed explicitly as where δ(k) > 0 is the energy penalty associated with weight k errors and δ(k) < δ(k + 1). However, as in the case of the protected Hamiltonian for logical evolution, such constructions result in Hamiltonians that are very high weight. In fact, recent work has shown that there are significant obstacles to constructing systems with the kind of energy landscape discussed above, known as a self-correcting quantum memory, using local stabilizers in two dimensions [28,29]. These results do not, however, rule out construction of an energy landscape for which low weight operators are penalized according to their weight, but higher weight operators are not. Such a code would exhibit string tension that "snaps" after the string length grows too long, and would likely provide enhanced protection over standard codes. It might be constructed as in Eq. (24) by choosing the energy penalties so that high-weight stabilizers cancel, as we did in Section III B to construct the protected logical operators. Furthermore, although the restriction to two-dimensional (planar) codes may be appealing from an engineering perspective, self-correcting lattice codes in four (and perhaps three) spatial dimensions do exist [30][31][32][33][34]. Embedding such higher-dimensional codes into two dimensions requires non-planar connectivity, but this is not necessarily unrealistic; superconducting qubit systems routinely construct non-planar interaction graphs by coupling distant qubits with wires [35].

V. DISCUSSION
This work arose from our attempts to answer the question, "Can AQC be made fault tolerant?" We began without a clear picture of what 'fault tolerance' should mean in the adiabatic context. Taking cues from the theory of circuit model fault tolerance, we believed that developing a clear understanding of error suppression and error correction in AQC would be a necessary first step, whatever the ultimate definition turned out to be. In this paper, we have presented such a framework, investigating relationships between error suppression methods and describing a serious challenge to adiabatic error correction. Through the methods of protected Hamiltonians and local cooling, we have even suggested techniques for avoiding these obstacles and correcting errors without resort to circuit model gates or syndrome measurements. Our analysis, however, falls short of establishing a threshold theorem for adiabatic fault tolerance. We cannot prove fault tolerance because controlling the encoded AQC (using slowly varying Hamiltonians rather than fast gates) seems to require high-weight Hamiltonians. These Hamiltonians are not available in any feasible technology to our knowledge. We are therefore unable to propose a feasible control protocol, and so have no credible model to describe control errors. Without a plausible error model, we cannot attempt to prove fault tolerance or calculate a threshold. If in the future the implementation of protected logical Hamiltonians is shown to be practical, then it may become possible to construct fault tolerant logical-operation protocols, and to prove the existence of a threshold. But, absent such a breakthrough, logical Hamiltonians on encoded qubits appear to require unphysical resources, leaving us pessimistic that any form of fault tolerance will ever be achieved in a purely adiabatic model of quantum computation.
This conclusion rests on several assumptions. We now list these assumptions, and the limitations in our analysis, in the hope that future work may find ways to circumvent the obstacles identified here.
First, we have assumed that protecting AQC from noise will require the use of high-distance stabilizer codes. This assumption is motivated by fault tolerance in the circuit model, which depends critically on the use of high-distance quantum codes, because the computation must be robust to a constant (albeit low) density of errors. In the adiabatic setting, highdistance codes lead directly to two specific problems: (i) the encoded logical Hamiltonian quickly transforms correctable errors into uncorrectable logical errors; and (ii) the logical operators that comprise the encoded Hamiltonian necessarily have high weight. Our work suggests a solution to problem (i), but problem (ii) poses a greater challenge. In the circuit model, high-weight logical operators are implemented by performing many one-or two-qubit unitaries in parallel. Though such sequences are more complicated than unencoded gate operations, the (linear in N ) increase in gate complexity is far outweighed by enhanced (exponential in N ) resilience against noise. In the adiabatic model, however, logical operations are implemented as Hamiltonians -not unitaries. And whereas high-weight unitaries can be implemented in O(1) time using parallel gates, there is no comparable way to apply high-weight Hamiltonians. Solving this issue will likely require significant advances. Perturbative gadgets can approximate high-weight Hamiltonians with only weight-two interactions, but introduce unprotected gauge qubits to the system. Furthermore, the published analyses [36] of gadget perturbation theory require couplings that scale exponentially with the operator weight, though perhaps more sophisticated gadget perturbation theories can be developed which reduce this penalty. Even more desirable (though correspondingly less likely) would be the development of qubits whose dominant interactions are naturally highweight [37]. Should this obstacle be overcome, our construction of protected logical operators (Sec. III B) will be highly relevant.
Second, we have assumed that the only available error correction mechanism is local cooling. The local nature of the cooling is clearly physically motivated, but local cooling can only drive single qubits and act upon local information [11]. It is possible that a more sophisticated cooling mechanism that acts on multiple qubits in a neighborhood (similar to a continuous-time error decoding algorithm) could be constructed. Such a mechanism might obviate the need for a monotonic energy landscape as stated in Sec. IV. However, we have no constructive ideas for implementing such a cooling mechanism at this time.
Finally, an overriding assumption in this whole work is that elements of the circuit model, like fast gates and measurements, are not available. Of course, one could begin incorporating more elements of the circuit model in order to implement error correction. However, in that case, the model of computation begins to look more and more like the circuit model itself. If fault-tolerant AQC demands development of all the resources required for computation in the circuit model, why bother with AQC at all? for a single qubit, the error detection code allows us to stabilize a single state (|+ or |− in the example below), rather than a subspace. The Hamiltonian describing noisy qubit evolution is

VI. ACKNOWLEDGEMENTS
Here c(t) is the control field that could either implement DD or EGP, and η(t) is the stochastic noise. Dynamical decoupling proceeds by applying a sequence of X-type pulses to perturbatively decouple the noise, while EGP introduces a timeindependent energy penalty for noise-induced error transitions. We consider a classical approximation of the system-bath coupling and represent the bath fluctuations as a classical stochastic process. This is not necessary for the following but we do so for simplicity. In the toggling frame, this Hamiltonian takes the form,H Defining the fidelity as the probability of finding the state in the |+ state after the evolution, where · η indicates a classical stochastic average over instances of the noise, η(t). To first order in the Magnus expansion [38], the effective unitary operator is ds η(t) (cos(χ(s))σ z + sin(χ(s))σ y )) Where χ(t) = For EGP, χ(t) = ωt, while for dynamical decoupling χ(t) = n t π, where n t is the number of pi-pulses applied up to time t. The resulting filter functions are shown in Fig. 2. Note that for dynamical decoupling with hard pulses, the effective Hamiltonian converges at first order in the Magnus expansion.
Higher order terms will appear for the continuous driving case, but will be negligible for weak noise and short time.