Wigner function negativity and contextuality in quantum computation on rebits

We describe a universal scheme of quantum computation by state injection on rebits (states with real density matrices). For this scheme, we establish contextuality and Wigner function negativity as computational resources, extending results of [M. Howard et al., Nature 510, 351--355 (2014)] to two-level systems. For this purpose, we define a Wigner function suited to systems of $n$ rebits, and prove a corresponding discrete Hudson's theorem. We introduce contextuality witnesses for rebit states, and discuss the compatibility of our result with state-independent contextuality.


I. INTRODUCTION
In quantum computation by state injection (QCSI) [1], the set of quantum gates is by construction not universal. This restriction is made up for by the injection of states that could not be created within the scheme itself, the so-called magic states.
Besides its promise for the realization of fault-tolerant quantum computation, QCSI is of fundamental theoretical interest. Since the magic states enable universality, one is led to ask: Precisely which quantum properties of these states are responsible for the gain in computational power?
Contextuality [2], [3] and negativity of Wigner functions have recently been proposed as the quintessential quantum properties of magic states; See [4], [5], [6]. Contextuality is an obstruction to modelling the inherent randomness of quantum measurement in a statistical mechanics fashion, namely by a probability distribution over configurations with predetermined measurement outcomes for all measurable observables. Wigner functions [7], [8] are the closest quantum analogue of probability distributions over phase space. The key difference is that Wigner functions can assume negative values, and this negativity is taken as an indication of quantumness. Despite their separate origins in the fields of quantum optics and foundations of quantum mechanics, Wigner function negativity and contextuality are closely related indicators of non-classical behaviour [9], [4].
The reason for the appearance of Wigner functions in the discussion of QCSI is their relation [5], [10] to the stabilizer formalism [11]. The stabilizer formalism is also relevant for QCSI, since the restricted gate set therein is typically chosen to be the Clifford gates. These gates are indeed not universal, and-if supplemented only with Pauli measurements and stabilizer states-can be efficiently classically simulated by stabilizer techniques.
An epitome for the link between Wigner functions and QCSI via the stabilizer formalism is the discrete Hudson's theorem [10], which says that in Hilbert spaces of odd prime-power (hence finite) dimension, the pure states with positive Wigner function are exactly the stabilizer states. Thus, stabilizer states are "classical" from both the perspectives of Wigner functions and QCSI. In the wake of this result, contextuality and Wigner function negativity have been established as quantum resources for QCSI with qudits of odd prime dimension [6], [4].
Extending these properties to 2-level systems is pertinent, since quantum algorithms are typically formulated in terms of qubits. But attempts to do so hit barriers: As for the Wigner functions, many constructions cannot be adapted to qubits [10], [12]; and for the remaining ones, [5], [13], the discrete Hudson's theorem breaks down. There are qubit stabilizer states with negative Wigner function. As for contextuality, it now arises in its state-independent form [14]. In result, every quantum state of more than one qubit can be considered contextual [4], which is at odds with viewing contextuality as a resource possessed only by special states.
Here, we establish Wigner function negativity and contextuality as necessary resources for QCSI on two-level systems. We achieve this at the price of restricting from qubits to rebits, i.e., real density matrices of n two-level systems. This restriction does not affect universality [15]. The role that was previously played by the stabilizer states is now played by the CSS-states [16], and the group of Clifford gates is replaced by the subgroup of CSS-ness preserving Clifford gates. Within this new setting, we resurrect a discrete Hudson's theorem, as well as a number of related properties of the Wigner function. The final picture for rebits resembles that for qudits, but with one difference: contextuality and Wigner function negativity are no longer synonymous. There exist noncontextual states with negative Wigner function. This paper is organized as follows. Section II summarizes the known results on the roles of contextuality and negativity in qudit QCSI, and defines our setting for rebits. In Section III we present a universal scheme of quantum computation by state injection on rebits. In Section IV, we construct a matching Wigner function, equipped with a discrete Hudson's theorem and extended Gottesman-Knill theorem. In Section V we provide necessary and sufficient conditions for contextuality in terms of the Wigner function. Section VI contains our results on contextuality and negativity as resources in rebit-QCSI. We conclude in Section VII. QCSI has four operational quantum components: the restricted unitary gates, the restricted measurements, the cheap states and the magic states. The cheap states are those that can be produced from sequences of measurements from the restricted set and restricted unitary gates, possibly classically conditioned on measurement outcomes. The classical side-processing is unrestricted.
A typical choice for the restricted operations is that they live within the stabilizer world. That is, the restricted set of unitary gates is in the group of Clifford gates, the restricted set of observables is the Pauli observables or a subset thereof, and the cheap states are stabilizer states.

A. Summary of the qudit case
For the case of odd prime local dimension d, QCSI has been investigated for the restricted gate set being the Clifford gates [6], [4]. For this scenario, two essential quantum properties of the magic states have been identified, namely the negativity of their Wigner function, and their contextuality with respect to stabilizer measurements. Specifically, it has been established that (i) Negativity in the Wigner function of raw magic states is necessary for successful magic state distillation (Theorem 3 in [6]) and for the hardness of classical simulation of QCSI (Theorem 1 in [6]).
(ii) Contextuality of magic states w.r.t stabilizer measurements is necessary for universality of QCSI [4].
The Wigner function plays a dual role for QCSI. It is relevant for the phenomenology observed (see above), but it is also deeply involved in the mathematical description of the computational scheme. This is revealed in the following five properties, which hold for odd prime d when the restricted operations belong to the stabilizer world, (iii) The set of stabilizer states is singled out by a Hudson's theorem as the set of pure states with nonnegative Wigner function [10].
(iv) The set of Clifford gates is singled out as the set of unitaries that transform the Wigner function covariantly [10].
(v) Clifford gates and stabilizer measurements preserve positivity of the Wigner function [6].
(vi) Necessary and sufficient conditions for contextuality w.r.t to the restricted set of measurements can be expressed in terms of the Wigner function [4].
(vii) For one-qudit states, negativity of the Wigner function and contextuality w.r.t. measurements from the restricted set are the same [4].
The above physical properties (i) and (ii) are consequences of the structural properties (iii) -(vii). For example, an efficient classical simulation method for the evolution of states with non-negative Wigner function under the restricted gates can be built on properties (iv) and (v) [6]. Its existence directly implies (i). Furthermore, Hudson's theorem (iii) connects this simulation method with the Gottesman-Knill theorem.

B. The trouble with qubits
For systems of qubits, both the employed contextuality witnesses [17] and Wigner functions run into difficulty. As for contextuality, if the goal is to establish it as a quantum resource, one has to overcome a problem posed by the phenomenon of state-independent contextuality which is revealed, for example, by the Mermin square and star [14]. Mermin's square can be translated into a contextuality witness for which all quantum states of n ≥ 2 qubits come out contextual [4]. If contextuality is generic then it cannot be a resource.
As for the Wigner functions, many of the Wigner functions proposed for Hilbert spaces of finite dimension d n require for their definition the existence of 2 −1 in F d , and thus do not apply to the qubit case d = 2; for examples see e.g. [10], [12].
Yet some Wigner functions do survive the transition to d = 2; see e.g. [5], [13]. However, in these cases, the general connection with the stabilizer world breaks down. Not all stabilizer states have non-negative Wigner function anymore, and the Wigner function no longer transforms covariantly under all Clifford operations.
For the construction [5], [13], Wigner function negativity of the magic states is necessary for universality. Therein, not a single Wigner function is considered but instead the whole class introduced in [8]. A "classical" state must be positively represented for each of these Wigner functions. The number of pure n-qubit states for which this holds is super-exponentially small compared to the number of n-qubit stabilizer states [10].

C. Rebits
In this paper, we discuss the case of local dimension d = 2. We present a universal scheme of QCSI for which contextuality and Wigner function negativity are established as necessary quantum resources. The price we pay is that we have to restrict from qubits to rebits. Specifically, we require that the density matrix of the processed quantum state ρ is real; i.e. at each point in the quantum computation it holds that x|ρ|y ∈ R, for all |x , |y in the computational basis.
For the discussed scheme of rebit QCSI, the set of cheap states is the CSS states, the set of restricted gates is the CSS-ness preserving Clifford gates, and the allowed measurements are of observables from the set That is, in our construction the restricted operations belong to the CSS-stabilizer world, rather than the more general stabilizer world.

D. CSS states and CSS-ness preserving Clifford operations
Calderbank-Shor-Steane (CSS) states are a subset of the stabilizer states. They are defined by the property that for any CSS state |ψ , the corresponding Pauli stabilizer group S(|ψ ) decomposes into an X-and a Z-part; i.e., S(|ψ ) = S X (|ψ ) × S Z (|ψ ), where all elements of S X (|ψ ) and S Z (|ψ ) are of the form X(a X ) and Z(a Z ), respectively. All CSS states are real, but not all real stabilizer states are of CSS type.
We now characterize the CSS-ness preserving transformations. Denote by Ω the set of pure CSS-states and by G CSS the subgroup of the n-qubit orthogonal group O 2 n (R) which preserves the set Ω of CSS states, By definition, G CSS is a subgroup of the real n-qubit Clifford group C n . The following can be said about the structure of G CSS .

Lemma 1
The n-rebit CSS-ness preserving group G CSS is where i, j ∈ {1, 2, . . . , n} and i = j. We have the group isomorphism In Eq.(4), the component Z 2n 2 corresponds to the Pauli operators T u , the component GL n (Z 2 ) corresponds to the group generated by the CN OT , and the subgroup Z 2 is generated by the simultaneous Hadamard gate } is mapped onto itself by conjugation under gates from the group on the r.h.s. of Eq. (3), it is clear that this group is a subgroup of G CSS as defined in Eq. (2). That it is indeed all of G CSS is proved in Appendix C.
We note that the set Ω of "cheap" CSS states, the CSS-ness preserving unitary gates G CSS and the projective measurements of observables in O form a compatible classical reference structure for QCSI, in the sense that none of these operations can map states inside Ω to states outside Ω.

III. UNIVERSAL QUANTUM COMPUTATION BY STATE INJECTION ON REBITS
It has been shown in [15] that rebits are sufficient for universal quantum computation. In that scheme, first, a quantum state of n qubits, is encoded into a state of n + 1 rebits, The additional rebit, with basis states |R = |0 and |I = |1 , allows to keep track of the real and imaginary parts of the unencoded n-qubit state. Second, an encoded set of gates is constructed which (i) is universal, and (ii) preserves real-ness of the states in Eq. (5).
Using the encoding Eq. (5), we construct a universal scheme of QCSI on rebits. The restricted gate set used therein consists of CNOT-gates, the simultaneous Hadamard-gate H all on all rebits, and Pauli-flips, i.e., These unitary gates are supplemented by measurements of observables in the set O, or, w.l.o.g., of observables The (unitary) Pauli operators and the simultaneous Hadamard-gate can be dispensed with, because they can be propagated past the readout measurements. This is a consequence of the well-known propagation relations for Pauli operators under conjugation by Clifford gates, and CN OT (i, j)H all = H all CN OT (j, i). If those gates are eliminated, we remain with the CNOT-gates and measurements of X i and Z i . We note that this is precisely the set of gates which can be performed fault-tolerantly on the surface code [18] using defect braiding [19]. However, for the present purpose, we keep the redundant H all and Pauli flips in the restricted gate set.
For the universal gate set, we pick supplemented with measurements of the Pauli observables Z i , for i = 1, .., n.
We now demonstrate that the encoded versions of these gates can be realized only using the gates from the restricted set and the injection of two types of ancilla states, |A and |B , defined as |A = |0 |R + cos π 4 |1 |R + sin π 4 |1 |I √ 2 , The ancilla |A is the encoded (|0 + e iπ/4 |1 )/ √ 2, with respect to the encoding of Eq. (5).
(a) The measurement of Z i . Since the Pauli-operator Z is real, its measurement does not differentiate between the real and imaginary parts of the measured state, and The CNOT-gate between qubits i and j. The CNOT-gate is real and hence does not mix the real and imaginary parts of the state it is applied to. Hence, CN OT (i, j) = CN OT (i, j). Graphically, enc.
(c) The Hadamard gate H i . The encoded Hadamard gate is realized by injection of an ancilla |B into the circuit The gate exp(iπ/8 Z i ). The encoded version of this gate uses an ancilla states |A and |B , and proceeds in two steps. The first step is a pre-processing jointly for all the exp(iπ/8 Z i ) gates in the circuit. Namely, at the beginning of the computation, each ancilla state |A is in its own separate code block. In the pre-processing step, all data and ancila rebits are merged into the same code block. The merging can be done two blocks at a time, and the corresponding circuit is . For a pair of encoded input states |ψ , |φ , the result of the code merging circuit is |ψ ⊗ |φ or |ψ ⊗ |φ * , depending on the outcome of the X-measurement (|φ * denotes the state obtained from |ψ by complex conjugation w.r.t. the computational basis).
We will only ever use the code merging circuit for encoding the ancilla |A = |π/8 into a single code block. Since |π/8 and | − π/8 allow to perform the π/8-phase gate with the same efficiency, the probabilistic nature of the code merging circuit does not affect the computation.
The code merging circuit contains a conditional phase gate which is not part of the restricted gate set. It is realized via the following state-injection circuit, The second step then is the encoded version of the standard state injection circuit for the π/8-gate [20],

Z in
A out (7) This circuit consists solely of operations whose encoded versions we have already demonstrated.

IV. A WIGNER FUNCTION FOR REBITS
In the last section we described a universal scheme of quantum computation by state injection on rebits, and here we construct the matching Wigner function. We first propose the rebit Wigner function and examine its basic properties. Second, we prove a discrete Hudson's theorem for rebits. Third, we prove covariance of the rebit Wigner function under CSS-ness preserving Clifford unitaries; and finally show that the evolution of states with positive Wigner function under CSS-ness preserving Clifford unitaries and measurements can be efficiently classically simulated.

A. Definition of a Wigner function for rebits
We now proceed to construct the Wigner W function for n-rebit states, which is suited to describe the computational scheme introduced in the previous section. It is a modification of the Wigner functionW [6], [4] for qubits.
In the qubit case, there are 4 n Pauli operators T a , The Pauli operators T form an orthonormal basis of the vector space of square matrices of size 2 n with complex coefficients endowed with the inner product defined by (A, B) = 1 2 n Tr(A † B), In the present work, we are interested in rebits, which are defined by symmetric real density operators. We consider the set which is an orthonormal basis of the space of symmetric matrices (see Lemma 19 in Appendix B), and define with For later use, denote Note that the operator A u can also be written is the symplectic inner product in Z 2n 2 . When considering real states, the family (A u ) u∈V is not a basis of the space of symmetric matrices since it contains too many matrices. Nevertheless, in close analogy with the qudit Wigner function [10], [6], the rebit Wigner function of Eq. (11) has the following properties (compare with [21]): 1. Any real density matrix ρ satisfies W is thus informationally complete.
2. W transforms covariantly under the group of CSSness preserving Clifford transformations.
3. The CSS-states are the only pure states with nonnegative W (discrete Hudson's theorem).

The trace inner product is given as
6. The phase point operators satisfy TrA u = 1. Thus, TrB = u W B (u) for any symmetric operator B.  The original Hudson's theorem in infinite-dimensional Hilbert space [22] singles out the Gaussian states as the pure states with positive Wigner function. This result has a counterpart in finite, odd prime-power dimension. Namely, the pure states with positive Wigner function are the stabilizer states [10]. In this way, a connection between Wigner functions and the discrete world of the stabilizer formalism is established. For no known Wigner function defined on qubits, this result carries over.
Here, for the Wigner function defined in the previous section, we find that for multiple rebits a discrete Hudson's theorem holds with the stabilizer states replaced by the more special CSS states.
Theorem 1 A pure real state |ψ has non-negative Wigner function W ψ if and only if it is a CSS state.
Recall that a Wigner function W ρ for some density operator ρ is said to be non-negative if W ρ (u) ≥ 0 for all u ∈ V , and is said to be negative otherwise.
In order to prove this result we follow the strategy proposed by Gross for the qudit case [10]. First, we determine the Wigner function of CSS states in Section IV B 1, proving that these Wigner functions are non-negative. Then, in Section IV B 2, we consider a pure state with non-negative Wigner function and we prove that this function is precisely the Wigner function of a CSS state. Finally, the fact that the Wigner function is informationally complete allows us to conclude the proof of Theorem 1 in Section IV B 3.

Wigner function of CSS states
We start by computing the Wigner function of pure CSS states.

Lemma 2
The Wigner function of a pure CSS state |ψ is of the form Moreover, every such function 1 2 n δ t+V S is the Wigner function of a CSS state.
In particular, the Wigner function of a pure CSS state is non-negative.
Proof of Lemma 2. Let |ψ be a CSS state. Its stabilizer group S is generated by r independent operators (−1) αi Z(a i ), for 1 ≤ i ≤ r, and n − r independent operators (−1) αi X(b i ), for r + 1 ≤ i ≤ n. Denote by N the subspace of Z n 2 generated by the vectors b i , for r + 1 ≤ i ≤ n, so that its orthogonal complement is N ⊥ = a 1 , a 2 , . . . , a n .
The elements of S are thus of the form (−1) α(v) T v , where v ∈ N ⊥ × N . Moreover, we can easily check that the phase (−1) α(v) defines a character of N ⊥ × N . Since every such character can be written as v → (−1) [t,v] , for some vector t ∈ Z 2n 2 , we have This, together with the definition Eq.(13) of A u leads to To transition from the third to the fourth line above, we have use the property that V S ⊂ V A .

Non-negative Wigner functions
To complete the proof of Theorem 1, we consider a pure state which has non-negative Wigner function and we determine its Wigner function. We will show that this function coincides with the Wigner function of a CSS state. By refining the qudit proof of Gross [10] we will show that Lemma 3 If a pure real state |ψ has non-negative Wigner function W ψ , then its Wigner function is of the form where The proof of this result comprises the next 5 lemmas. First, we find, by explicit computation that Lemma 4 The Wigner function W ψ of a pure real state |ψ , at some point (p, q) ∈ Z 2n 2 is where ψ(x) denotes the inner product ψ|x .
This result is proved in Appendix B. This encourages us to study the function ψ : Z n 2 → R defined by ψ(x) = ψ|x . The support of ψ, denoted supp(ψ), is the set of vectors x ∈ Z n 2 such that ψ(x) = 0. For fixed q, we consider the function K(q, ·) defined by It is related to the Wigner function of the state |ψ via a Fourier transformation The definition of the Fourier transform for the present binary setting is recalled in Appendix A.
Eq. (17) allows us to relate properties of |ψ and W ψ .
|x be a pure real state. If W ψ is non-negative then the function ψ has constant absolute value over its support supp(ψ).
Proof of Lemma 5. By Lemma 4, W (·, q) is the Fourier transform of the function K(q, ·) defined in Eq.(16), up to multiplication by 2 n/2 . That means that K(q, ·) has non-negative Fourier transform. Therefore, we can apply Bochner's theorem, exactly as stated in Theorem 44 of [10] (This result and its proof are unchanged in the binary setting). This proves that the matrix A x y = K(q, x−y) is postive semi-definite, where the tuples x and y are viewed as the binary writing of the matrix indices. From a well known characterization of postive semi-definite matrices, every principal minor of the matrix A x y is non-negative. In particular, the determinant is non-negative. This implies the following inequality.
If q ∈ supp(ψ) and x ∈ Z n 2 , then we obtain since ψ(q) = 0. Now, consider two vectors q and q of supp(ψ). Applying Eq.(18) to q and x = q + q we find |ψ(q)| ≥ |ψ(q + q + q )| = |ψ(q )| and exchanging the roles of q and q , we obtain the reverse inequality of (18), and thus This proves that ψ has constant absolute value over its support supp(ψ).
Lemma 6 Let |ψ = x ψ(x)|x be a pure real state. If W ψ is non-negative then the support of ψ is an affine subspace of Z n 2 , supp(ψ) = q 0 + N .
Proof of Lemma 6. Let q, q + x and q + y be three vectors in supp(ψ). We have to show that q + x + y is also in supp(ψ) [30]. In order to obtain an equation relating more vectors of Z n 2 , we consider the following 3 × 3 principal minor of the matrix A x y , which is also non-negative by Bochner's theorem.
The expansion of this determinant leads to the inequality By contradiction, assume that ψ(q + x + y) = 0, then we have From Lemma 5, the three real numbers ψ(q), ψ(q + x) and ψ(q + y) have the same absolute value. Therefore Eq.(20) cannot be satisfied since the three terms of the left hand side are equal and positive. This contradiction implies that ψ(q + x + y) ∈ supp(ψ). Hence supp(ψ) is an affine space: supp(ψ) = q 0 + N where q 0 ∈ Z n 2 and N is a linear subspace of Z n 2 .
Lemma 7 Let |ψ = x ψ(x)|x be a pure real state. If W ψ is non-negative then for every q ∈ q 0 + N , the function W ψ (·, q) is where c = c(q) ∈ R and p 0 = p 0 (q) ∈ Z n 2 may both depend on q. Moreover, if q / ∈ q 0 +N , then W ψ (·, q) = 0.
Proof of Lemma 7. First, we fix a vector q ∈ Z n 2 and we focus on the support the function W ψ (·, q). From Lemma 4, this function satisfies Therefore, W ψ (·, q) is the zero function when q does not belong to the support of ψ, which is q 0 + N from Lemma 6.
In what follows, the vector q is chosen in q 0 + N . In the above expression of W ψ , the term ψ(q)ψ(q + x) can be replaced by K(q, x), defined in Eq. (16). The support of the function K is supp(K) = (q 0 + N) × N where q 0 + N is the support of ψ. Then, K can be restricted to its support. This gives where K is the restriction of K to its support. Now note that, for every vector q ∈ Z n 2 , the function W ψ (·, q) is constant over the cosets of N ⊥ . Therefore, this function induces a function W ψ ([·], q) over Z n 2 /(N ⊥ ): The space Z n 2 /(N ⊥ ) is isomorphic to the linear space N . Indeed, the application from Z n 2 to the dual N * of N , defined by x → (x, ·) induces an isomorphism between Z n 2 /(N ⊥ ) and N * . Thus, N * is canonically isomorphic to N .
Up to this isomorphism Z n 2 /(N ⊥ ) N , the functions K (q, ·) and W ψ ([·], q) are both defined over the same space and W ψ ([·], q) is the Fourier transform of K (q, ·) up to multiplication by 2 n/2 , that is FK (q, ·) = 2 n/2 W ψ ([·], q). Applying F to this equality, we obtain The function K (q, ·) has constant absolute value over N by Lemma 5, thus we apply the second item of Bochner Theorem (Theorem 44 in [10]) to W ψ ([·], q). This tells us that W ψ ([·], q) is orthogonal to its translations, i.e. [p] A positive function which satisfies this orthogonality condition can be either zero or proportional to an indicator function δ [p0] . But W ψ ([·], q) cannot be zero. Otherwise K(q, ·) is also the zero function by injectivity of the Fourier transform, and this cannot happen when q is chosen in q 0 + N . The next lemma concludes the proof of Lemma 3.
where p 0 , q 0 ∈ Z n 2 and N is a linear subspace of Z n 2 . Proof of Lemma 8. From Lemma 7, the global support, Our first goal is to prove that p 0 (q) does not depend on q. To this end, it is natural to separate the variables p and q in the writing of W ψ obtained in Lemma 4. This leads to whereψ is the Fourier transform of ψ. Thus the support of W ψ is also supp(W ψ ) = supp(ψ) × supp(ψ). This can be satisfied if and only if p 0 is independent of q in Eq. (21). This proves that the support of W ψ is the cartesian product Now, let us prove that W ψ has constant absolute value over its support. Let (p, q) ∈ supp(W ψ ). Combining Lemma 7 and Eq. (22), we find that the modulus of where c(q) is the constant introduced in Lemma 7. Recall that c(q) is independent of p. We proved in Lemma 5 that |ψ(q)| is constant, therefore |c(q)| is also independent of q. This proves that |c| is constant over supp(ψ). By positivity of W ψ , we have c = |c| and for some constant c ∈ R.
To conclude the proof it remains to evaluate the value of c. By the normalisation of Property 6. of the Wigner function, it suffices to compute the cardinality of the support of W ψ . We find | supp(W ψ )| = |N ⊥ | · |N | = 2 n−dim N · 2 dim N = 2 n , which gives c = 1/2 n . This concludes the proof.

Proof of Hudson's theorem for rebits
Lemma 2 together with Lemma 3 enable us to prove a rebit version of Hudson's Theorem.
Proof of Theorem 1. Lemma 2 implies that every CSS states has non-negative Wigner function. Now, consider a pure real state |ψ which admits a nonnegative Wigner function. In order to prove that this is a CSS state, it is enough to prove that its Wigner function coincides with the Wigner function of a pure CSS state |ϕ . Indeed, since the Wigner function is informationally complete (Property 1.), this implies |ψ = |ϕ . We proved in Lemma 3 that W ψ can be written

C. Covariance of the rebit Wigner function
Our next goal is to demonstrate that the action of CSSness preserving Clifford gates on Wigner functions W ρ can be understood simply from the action of such gates on the underlying phase space, c.f. Lemma 11 below. To prepare for this result, we make two observations. Lemma 9 Let g ∈ G CSS . Then, there exists a unique pair (F, x) composed of a vector x ∈ Z 2n 2 and a symplectic matrix F ∈ Sp 2n (Z 2 ) such that The proof of Lemma 9 is given in Appendix C. Furthermore, the action of a g ∈ G CSS on a translation operator T a ∈ T by conjugation induces a morphism from the CSS Clifford group to the affine group AGL 2n (Z 2 ). Recall that an affine transformation of Z 2n 2 is an application of the form A(F, t) : a → F a + t, where F ∈ GL 2n (Z 2 ) is a linear application and t is a vector of Z 2n 2 . In the present work F is often symplectic and this affine map is then called an affine symplectic map. The set of affine symplectic transformations of Z 2n 2 is a subgroup of the affine group denoted ASp 2n (Z 2n 2 ).
Lemma 10 Let F be the application The proof of Lemma 10 is given in Appendix C. The application F is well defined by unicity in Lemma 9. The translation vector t and the vector x of Lemma 9 are related by the equation t = F x.
We are now ready to state the covariance result.

Lemma 11
The n-rebit Wigner function W is covariant under G CSS , in the sense that for all ρ, for all u ∈ Z 2n 2 , and for all g ∈ G CSS it holds that Applying this result to gρg † = (g −1 ) † ρg −1 , we find where F(g) = A(F, t).
Proof of Lemma 11. Let g ∈ G CSS and let F(g) = A(F, t) be its induced affine symplectic map. First, consider the image of A u by conjugation by g. Using Eq.(13), we obtain where we have used [u, a] = [F u, F a] and the fact that F induces a bijection of the set V A . This leads to which proves the covariance.
For n ≥ 2, W is not covariant under all real Clifford operations. As an example, consider n = 2 and g = H 1 , which is real Clifford but not CSS-ness preserving. H 1 converts a Bell state into a 2-qubit graph state. The former has positive and the latter negative Wigner function. Hence, H 1 does not transform W covariantly.

D. Efficient simulation of Clifford circuits
An operational justification for emphasizing positivity of Wigner functions is the following result [6] for qudits: Circuits of Clifford gates and stabilizer measurements acting on an initial state with non-negative Wigner function can be efficiently simulated classically. The discrete Hudson's theorem [10] ensures that for pure states, the simulation method based on Wigner functions has the same scope as the Gottesman-Knill theorem. For mixed states it is an extension of that theorem, since not all states with non-negative Wigner function are mixtures of stabilizer states [10].
Here we prove an analogue of the result [6] for the rebit Wigner function W defined in Eqs. (11), (12).
Theorem 2 Every circuit consisting of CSS-ness preserving Clifford unitaries and measurements, acting on a product state ρ = n i=1 ρ i with non-negative Wigner function W ρ , can be efficiently classically simulated.
Proof of Theorem 2. We describe a simulation method based on sampling. For a quantum state ρ represented by a Wigner function W ρ , the probability of an outcome s corresponding to the POVM element E(s) is For the allowed observables O ∈ O, the POVM elements E(s) = (I + s O)/2 all have positive Wigner function W E(s) . Therefore, P (s) can be efficiently estimated if W ρ is positive (i.e., is a probability distribution), and can be efficiently sampled from. We show by induction that this is indeed the case for all Wigner functions generated by the above circuits.
First, the initial Wigner function for the state ρ(0) = ρ 1 ⊗ ρ 2 ⊗ .. ⊗ ρ n , W ρ(0) = W ρ1 W ρ2 · .. · W ρn , can be efficiently sampled from. It is positive, and the W ρi may be sampled from independently, which is efficient. Now we show that if the Wigner function W ρ(t) after time step t can be efficiently sampled from, then so can the Wigner function W ρ(t+1) after step t + 1. We distinguish two cases: (a) ρ(t + 1) = gρ(t)g † , with g ∈ G CSS , and (b) Thus, sampling from W ρ(t+1) can be efficiently reduced to sampling from W ρ(t) . In particular, gates in G CSS preserve the positivity of the Wigner function.
(b) Projective measurement. We note Lemma 12 The Wigner function of the state ρ of the system after measuring T a ∈ O with the outcome s ∈ {±1} is where ρ is the state before measurement. In particular, measurements of observables in O preserves the positivity of the Wigner function of the system.
W ρ(t+1) is sampled from as follows. Repeat: (1) The sampling routine for W ρ(t) is called, which returns a u ∈ V .
(3) A fair coin is flipped, and, depending on the outcome, u or u + a is reported as sample from W ρ(t+1) . This concludes the proof of Theorem 2, subject to the proof of Lemma 12.

Remark 1:
The locality of the initial state, ρ(0) = ρ 1 ⊗ ρ 2 ⊗ .. ⊗ ρ n is of no physical significance. It is just one possible way to ensure that the positive W ρ(0) can be efficiently sampled from by a classical algorithm.
Remark 2: In most respects, the present simulation method is the same as its qudit counterpart [21], but a difference occurs in measurement. Here, mere positivity of the effect W E(s) and positivity of W ρin for the input state ρ in do not imply positivity of the Wigner function W ρout for the output state ρ out . Example: The two-rebit state ρ = (I +X 1 Z 2 )/4 has positive Wigner function, and the POVM-element (I + Z 1 X 2 )/2 is also positively represented. However, the state after measurement, a pure stabilizer state with stabilizer group S = X 1 Z 2 , Z 1 X 2 , has negative Wigner function. Note that Z 1 X 2 ∈ O.
Proof of Lemma 12. For all T a ∈ A, T y ∈ O, it holds that if [T a , T y ] = 0, then T a T y = T a+y .
This is a consequence of all T y ∈ O being entirely of X-type or Z-type (by definition of O).
We define the set A y as A y = {T a ∈ A| [a, y] = 0}. It has the property that Eq. (26) holds because [T a , T y ] = 0 ⇔ [T y T a , T y ] = 0, and Eq. (25) (T y T a ∈ A, i.e., has the right sign). Now, the update W ρ → W ρ under measurement of the observable T y ∈ O, with outcome s = ±1, is When transitioning from the third to the fourth line above, we used the property Eq. (26).

V. CONTEXTUALITY
A. Scope of hidden variable models for rebit QCSI A quantum-mechanical setting comprising quantum states and measurements is said to be contextual if it cannot be described by any non-contextual hidden variable model. For the rebit scheme of quantum computation by state injection considered here, we first need to determine the scope of the phenomenology that any purported non-contextual HVM needs to reproduce.
The set of quantum states is unrestricted. The candidate HVM must yield the correct measurement statistics for any real quantum state. However, the observables which can be measured in rebit QCSI, and the sets of observables which can be measured jointly, are restricted. To analyze the situation, we first discuss a few examples, and then impose a general criterion.
First, the set of observables which can be physically measured in rebit QCSI is O = {X(a X ), Z(a Z )}. The candidate HVM therefore needs to correctly reproduce the probabilities of measurement outcomes for all observables O ∈ O, and furthermore the correct joint outcome probability distributions for any number of commuting observables in O.
But there is more. For example, consider the two-rebit observable X 1 Z 2 , which is in the set A but not in O. The measurement outcome of X 1 Z 2 can be obtained by measuring the commuting observables X 1 , Z 2 ∈ O, and then post-processing the outcomes. Therefore, a measurement of X 1 Z 2 can be reduced to measurements of observables in O. The same holds for all observables in A. We there-fore require that any candidate HVM must reproduce the correct measurement statistics for all observables in A.
We now turn to the simultaneous measurement of compatible observables. Continuing with the above example, it is possible to simultaneously measure the pair of observables {X 1 , X 1 Z 2 }, namely by the same operations that measured X 1 Z 2 alone. Now, is it possible to simultaneously measure the commuting observables X 1 Z 2 and Z 1 X 2 ? In the setting of rebit QCSI, this is not the case. The measurement of X 1 Z 2 necessitates the measurement of X 1 and Z 2 separately. Since these observables do not commute with Z 1 X 2 , a subsequent measurement of Z 1 X 2 is no longer guaranteed to reveal the original value. Thus, compatible observables in A need not be simultaneously measurable in the same way as compatible observables in O.
Based on the phenomenology discussed above, we adopt the following operational criterion to define the scope of hidden variable models: Criterion 1 Be M a set of commuting observables. Any hidden variable model describing M must correctly predict the joint probability distribution p M of measurement outcomes, if for all observables O ∈ M the outcomes can be simultaneously obtained from measurements on a single copy of the given quantum state.
We denote by M the set of measurement settings M ⊂ A admitted by Criterion 1. Given a quantum state ρ and a set M of compatible observables, we denote by p M,ρ the probability distribution for measurement outcomes corresponding M .
(ii) For all M ∈ M, all triples of commuting observables A, B, AB ∈ M , and all u ∈ S, the value assignments are consistent, (iii) Given the quantum state ρ, the probability distribution q ρ reproduces all probability distributions of measurement outcomes; i.e.
for all M ⊂ M, and all values of s M .
In Sections V B and V C below, we derive necessary and sufficient conditions for the existence of a hidden variable model over M, or, the other way around, for contextuality. These conditions are expressed in terms of the rebit Wigner function. We conclude this section with a characterization of the sets M ∈ M of simultaneously measurable observables in QCSI that are admitted by Criterion 1. Proof of Lemma 13. "If": Assume that a set M ⊂ A has the property that Therefore, for all T a ∈ M , the operators X(a X ) and Z(a Z ) commute with all of M and among themselves. They thus generate a CSS stabilizer By construction, M ⊂ S. Therefore, the measurement outcomes for all observables O ∈ M can be obtained by measuring the set of observables {X(a X ), Z(a Z )| T a ∈ M } ⊂ O, and subsequent classical processing. The set M thus satisfies Criterion 1.
"Only if": Since physical measurements are restricted to observables on O, the only way of measuring an observable T a ∈ A is to separately measure its Xpart X(a X ) and Z-part Z(a Z ), and then post-process the measurement outcomes. We assume that for a given set M = {T a } ⊂ A Criterion 1 holds. Then, [X(a X ), Z(b Z )] = 0, for all T a , T b ∈ M , or, equivalently, a X · b Z = 0, for all T a , T b ∈ M . Since For an illustration of Lemma 13, we previously argued that X 1 Z 1 and Z 1 X 2 cannot be simultaneously measured in rebit QCSI; {X 1 Z 1 , Z 1 X 2 } ∈ M. Lemma 13 detects this as follows: If T a = X 1 Z 2 and T b = Z 1 X 2 then T a+b = −Y 1 Y 2 , and therefore T a+b = −T a T b . Proof of Theorem 3. If W ρ > 0 then W ρ is a valid noncontextual HVM for the setting (ρ, M). To verify this claim, we need to check that if W ρ > 0 then W ρ provides the constructs (a) -(c) required in Definition 1, and that the conditions (i) -(iii) therein are satisfied.

B. A necessary condition for contextuality
A projective measurement of a set M ∈ M of commuting observables is represented by POVM elements E(s M ), and T a ∈ A. Using the orthogonality relation Tr(T a T b ) = 2 n δ a,b , we find that 2 n W E(s) (u) = δ s,(−1) [u,a] . Thus, for all observables T a ∈ A and all states u ∈ V , we obtain the value assignment We now generalize the above computation of the Wigner function of effects from the observables in A to all sets M ∈ M of measurements. To this end, we note that by Lemma 13 the POVM elements E(s M ) of Eq. (30) can be rewritten as Hence we obtain Thus, 2 n W E(s M ) does indeed represent conditional probabilities, as required for 2 n W E(s M ) (u) = p(s M |u). Regarding (i), the assignment of Eq. (31) demonstrates that for all states u ∈ S, all observables in A have definite values, as required. Furthermore, for this value assignment, the expression Eqs. (32) for the conditional probability p(s M |u) matches the required expression Eq. (27).
Regarding (ii), the value assignment Eq. (31) leads to the constraints Since, by Lemma 13, T a+b = T a T b for all T a , T b , T a+b ∈ M , the value assignments of Eq. (31) are consistent for all M ∈ M.
Finally, condition (iii) is satisfied by construction of the Wigner function.
We have thus shown that if W ρ > 0 then W ρ provides a non-contextual HVM for the setting (ρ, M). The claim follows by negation of this statement.

C. A sufficient condition for contextuality
Theorem 4 The n-rebit setting (ρ, M) is contextual if there exists a maximal isotropic subspace U ⊂ Z 2n 2 and a vector ν ∈ Z 2n 2 such that v∈U W ρ (v + ν) < 0.
Comparing Theorems 3 and 4, we find that our necessary and sufficient conditions for contextuality do not match. This indicates the possibility of a Wigner-negative noncontextual phase. Such a phase does indeed exist, as we show later.
To prove Theorem 4, we construct a family of witness functions W which can detect contextuality. Each such function is based on an isotropic subspace U ⊂ Z 2n 2 with a basis B(U ) = {a(1), a(2), .., a(m)}, and can be evaluated on points x ∈ Z m 2 , for any density operator ρ. Namely, we define Proof of Lemma 14. We prove the converse statement, namely that if (ρ, M) is non-contextual then W B(U ) ρ > 0 for all isotropic subspaces U ∈ Z 2n 2 and all bases thereof. Assume there exists a non-contextual HVM describing the setting (ρ, M). Then, by property (i) of Definition 1, the states of this HVM must have definite values ±1 for all observables in A. Furthermore, for any state u of the HVM, these values must satisfy the consistency condition (ii) of Definition 1.
Combining the above three relations, we find that for all T a ∈ A, the value λ(T a ) follows from the values λ(X i ), λ(Z i ) assigned to the local observables X i and Z i , for i = 1, .., n. We may write this as and S = Z 2n 2 . We find that the same relation Eq. (31) which held for HVMs derived from the Wigner function holds for all non-contextual HVMs.
As a consequence, for all u ∈ S, it holds that We rewrite this condition as (35) We now evaluate the witness W B(U ) ρ (x) under the assumption of a non-contextual HVM. Assuming the system is in the state u ∈ S of the HVM, and using the property Eq. (35), the witness of Eq. (33) becomes In transitioning from the first to the second line above, we have used the property that U = span({a(i)}) is isotropic, such that Eq. (35) can be applied. As a result of the above inequality, for any probability distribution q ρ over S, the prediction of any noncontextual HVM is for all isotropic subspaces U ⊂ Z 2n 2 . The negation of this statement proves the claim.
We now relate the witnesses W to the rebit Wigner function.
Proof of Lemma 15. We may rewrite the witness function W defined in Eq. (33) in terms of η, η as (36) We may further rewrite this expression as which demonstrates the claimed relation. In transitioning from the second to the third line above, we have used the fact that ρ is real, and thus Tr T a ρ = 0, for all a with (a X , a Z ) mod 2 = 1.
Proof of Theorem 4. The combined conclusion of Lemmas 14 and 15 is that the n-rebit setting (ρ, M) is contextual if there exists an isotropic subspace U ⊂ Z 2n 2 with orthogonal complement U ⊥ and a vector ν ∈ Z 2n 2 such that We can further simplify this condition. Suppose that v∈U ⊥ W ρ (v + ν) ≥ 0 holds for all ν ∈ Z 2n 2 when U is maximally isotropic in Z 2n 2 . Then the same holds for all isotropic subspaces of Z 2n 2 . To verify this claim, consider a maximally isotropic space U and an isotropic subspacẽ U of U . Then, there exists a space U ⊂ Z 2n 2 such that If every term in brackets on the rhs is ≥ 0, so is the lhs. Since every isotropicŨ can be embedded in a maximally isotropic U , the above claim follows. That is, we may restrict the condition Eq. (37) to maximally isotropic subspaces U . In those cases, U ⊥ = U , which yields the condition stated in Theorem 4.

D. When is the sufficient condition tight?
Below we demonstrate that Wigner function negativity is necessary and sufficient for contextuality on all states that are diagonal in a real stabilizer basis. Fig. 1 shows two extremal situations in the application of Theorems 3, 4. An example for where the necessary and sufficient conditions for contextuality match, i.e. where Wigner function negativity is both necessary and sufficient for contextuality, is the family of two-rebit states In this case, the conditions of Theorems 3 and 4 for contextuality both read for all combinations of α, β = ±1. The corresponding phase diagram is depicted in Fig. 1a. The physical states fill the square with |a|, |b| ≤ 1. The corners of that square represent the joint eigenstates of the Pauli operators XZ and ZX, and they sit deep in the contextual phase. This fits with our earlier observation that the commuting observables XZ and ZX cannot be simultaneously measured in rebit QCSI. Hence their joint eigenstates cannot be prepared by the restricted gates.
The opposite extreme is represented by the general one-rebit stateρ The corresponding phase diagram is depicted in Fig. 1b. The set of physical states is constrained by x 2 + z 2 ≤ 1. By Theorem 3,ρ(x, z) is non-contextual if |x| + |z| ≤ 1, and, by Theorem 4, contextual if |x| > 1 ∨ |z| > 1. We thus find that not a single physical one-rebit state can be classified as guaranteed contextual by Theorem 4. But this is not a failure of Theorem 4 to get traction. For single qubits, non-contextual HVMs can be constructed [2], [14], and they imply non-contextual HVMs for single rebits as a special case. The statesρ(x, y) with x 2 + z 2 ≤ 1 and |x| + |z| > 1 are thus negatively represented but non-contextual. This example settles to the negative the question of whether Wigner function negativity and contextuality are the same for rebits.
The former example generalizes as follows.

Lemma 16
Be ρ an n-rebit state diagonal in a stabilizer eigenbasis. Then, ρ is contextual if and only if W ρ < 0.
Proof of Lemma 16. Denote by S U = {T v | v ∈ U } ⊂ A the stabilizer in whose joint eigenbasis the state ρ is diagonal; i.e., the corresponding maximal isotropic subspace U is such that T v ρT † v = ρ for all v ∈ U . Then, by covariance of the Wigner function under translations, In this case, the expression on the lhs of the condition in Theorem 4 simplifies to v∈U W ρ (v + ν) = 2 n W ρ (ν).
And thus, Theorem 4 itself simplifies to the statement that if W ρ (ν) < 0 for some ν ∈ Z 2n 2 then ρ is contextual. This combined with Theorem 3 proves the claim.
To summarize, unlike for qudits in odd prime dimension, for rebits contextuality and Wigner function negativity are in general not the same. However, they coincide on all states that are diagonal in a real stabilizer basis.

A. Resources
We are now prepared to establish contextuality and Wigner function negativity as necessary resources for universality of QCSI on rebits.
Theorem 5 In quantum computing via state injection on rebits, contextuality of the initial state is necessary for computational universality.

Furthermore,
Corollary 1 In quantum computing via state injection on rebits, Wigner function negativity of the initial state is necessary for computational universality.

Corollary 1 is the combination of Theorems 3 and 5.
In preparation for the proof of Theorem 5, we note that the witness functions W B(U ) transform covariantly under CSS-ness preserving unitaries, similar to the Wigner function. Namely, every CSS-ness preserving unitary g can be written as g = T a g F , where Then, using the form Eq. (36) of the contextuality witnesses, On the r.h.s., F −1 B(U ) is again the basis of an isotropic subspace, since F , F −1 preserve the commutation relations. In result, for two density matrices ρ and ρ related by a CSS-ness preserving Clifford unitary, if there is a witness W that evaluates to x on ρ then there is a witness W that evaluates to the same value x on ρ .
Proof of Theorem 5. If the discussed computational scheme is universal, it must in particular be capable of executing an encoded Hadamard gate. In turn, the encoded Hadamard gate can be used to convert an encoded Bell state (a CSS state) into an encoded graph state |G 2 with stabilizer XZ, ZX . We are using the encoding of n qubits into n + 1 rebits by Rudolph and Grover stated in Eq. (5), For this encoding, for all qubits i = 1..n we have With i I = i Y A , this is compatible with the Pauli multiplication table Y = iZX = i I X Z. All observables in A have an even number of Y 's, and therefore For the state |G 2 , the contextuality witness based on the operators T a = XZ and T b = ZX is negative, namely (43) For two-dimensional isotropic subspaces U , −2 is the most negative value that a witness W B(U ) can yield. The final state |G 2 thus reveals contextuality maximally.
We now prove that also the initial state fed into the computation must reveal contextuality maximally. The proof is by induction. We consider the circuit which created the state |G 2 , and assume the gates are performed sequentially, one in each step m. We show that if the state ρ(m) after step m reveals contextuality maximally then so does the state ρ(m − 1) after step m − 1. That is, if there exists a witness W such that W ρ(m) (η) = −2 then there exists another witness W such that W ρ(m−1) (η ) = −2.
For the gates in the circuit, we distinguish between unitaries and projective measurements. Case i: the gate in step m is a unitary. Then, by construction of the computational scheme, the gate is a CSS-ness preserving Clifford unitary. Then, the claim of the induction step follows from the covariance of the witness functions, Eq. (40).
Case ii: The gate in step m is a projective measurement. Then, by construction of the computational scheme, it is the measurement of an observable T c ∈ O. Thus, irrespective of whether a given step in the circuit is a unitary transformation or a projective measurement, if the state after completing the step witnesses contextuality with the maximum negative value, so does the state before the step. By induction, the state before the first gate, i.e. the injected state, witnesses contextuality.

B. Coping with Mermin's square
Mermin's square [14] provides a beautifully simple proof of the Kochen-Specker theorem [3] in dimension four and higher, but for the programme of establishing contextuality of magic states as a quantum computational resource it poses a problem. Namely, the square can be converted into a contextuality witness of CSW type [17] for which all two-qubit states come out contextual [4]. But if contextuality is generic, then it is not a resource.
In more general terms, Mermin's square exhibits the phenomenon of state-independent contextuality. It represents an obstacle to viewing contextuality as a resource possessed by some quantum states but not others.
When restricting to Pauli observables, state-independent contextuality only occurs in Hilbert spaces of even dimension [23], and therefore was not an issue in [4]. However, in the present situation, the Hilbert space dimension is even, and furthermore, by a simple local rotation, Mermin's square can be embedded into real quantum mechanics, Since, as in qudit QCSI, also in rebit QCSI contextuality is attributed to quantum states, state-independent contextuality seems likely to cause difficulty. Yet, in Theorem 5 we established contextuality of magic states as a necessary resource. We thus have to explain why Mermin's square, and more generally the phenomenon of state-independent contextuality, did in fact not void the contextuality-as-resource viewpoint.
To do so, we revisit the results established in Section V. First, by Theorem 3, states with non-negative Wigner function are non-contextual. Hence contextuality is not generic, as required for a resource.
Next, we consider the rotated Mermin square, Eq. (44). For all columns and all rows except the bottom one, the belonging observables pairwise commute and generate a stabilizer group of CSS type. They can therefore be simultaneously measured in rebit QCSI. The measurement outcomes ±1 must multiply to +1 in each of these contexts, which is implied by the identities among the observables, X 1 · X 2 · X 1 X 2 = +I etc.
For the bottom row, the belonging observables XZ, ZX and −Y Y still commute and thus generate a stabilizer group, but this group is not of CSS type. As discussed at the beginning of Section V, these observables cannot be simultaneously measured in rebit QCSI. Therefore, the pre-determined measurement outcomes λ(XZ), λ(ZX), λ(−Y Y ) need not satisfy the constraint λ(XZ)λ(ZX)λ(−Y Y ) = −1 implied by the operator relation XZ · ZX · (−Y Y ) = −I. Therefore, λ(·) = +1 for all observables in the rotated Mermin square is a consistent value assignment w.r.t. rebit QCSI. The algebraic contradiction vanishes because we have effectively removed the bottom row from the diagram. This situation is handled by our definitions as follows: is not required by Definition 1 of a non-contextual HVM (c.f. condition (ii)).
Generalizing the above observation, the phenomenon of state-independent contextuality does not come into play for the present setting of QCSI, even if it does exist for systems of rebits. The reason is the restriction of the physically measurements to observables in O, the set of pure-X and pure-Z Pauli operators.
Lemma 17 Consider a system of n rebits where the measurable observables are restricted to the set O. Then, the set S of consistent value assignments of a noncontextual HVM, λ u : A → {±1}, ∀u ∈ S, is non-empty.
Thus, there is no state-independent contextuality in rebit QCSI. Contextuality may persist at the levels of possibility and probability [24].

VII. CONCLUSION
We have established that contextuality and Wigner function negativity are necessary for the universality of the discussed scheme of quantum computation by state injection on rebits. To this end, we have introduced an nrebit Wigner function which provides necessary and sufficient conditions for contextuality with respect to CSS-ness preserving stabilizer measurements. This Wigner function comes with a Hudson's theorem that singles out the "cheap" CSS-states and a covariance property that singles out the restricted gate set on which the discussed computational scheme is based.
For rebits, as was the case for qudits in odd prime dimension, all states with non-negative Wigner function are non-contextual. Therefore, for both the qudit and the rebit case, the possibility that contextuality is sufficient for universality remains open. For the case of qubits as discussed in [4], this is not the case due to the existence of contextual states with non-negative Wigner function.
In summary, we have extended all the essential properties that held for QCSI in the case of qudits of odd prime dimension [4], [6] to rebits, with the sole exception that for the present rebit scheme, Wigner function negativity does not imply contextuality. A schematic phase diagram w.r.t. Wigner negativity and contextuality for the three cases of qudits, qubits and rebits is shown in Fig. 2.
To widen the scope of the discussion, we note that contextuality has also been established as a resource for measurement-based quantum computation (MBQC) [25], [26], [27]. Namely, in MBQC contextuality is necessary for the ability to compute non-linear Boolean functions. One may thus want to compare the roles played by contextuality in QCSI and MBQC. But there was an obstacle: The MBQC result has to date only been established for the case of qubits, where most of the existing results [4] do not apply. The present paper removes this mismatch, and thus prepares the ground for a comparison between the two computational schemes.
We conclude with three open questions.
• In QCSI contextuality is about speedup, as one might expect for a scheme of quantum computation. But in MBQC it is about computability. What is the reason for this dichotomy?
• Due to the formulation in terms of a Wigner function, covariance plays an important role for QCSI. Is covariance also a useful concept in the discussion of MBQC?
• We noted that the restricted gate set in the present scheme of rebit QCSI is precisely the gate set that can be implemented by defect braiding and fusion with surface codes [19]. There is more complicated lattice surgery by which, in addition, the Hadamard gate can be realized [28], [29]. In this way, the full real subgroup of the qubit stabilizer group becomes available as the restricted gate set, and the real stabilizer states are the "cheap" / non-magic states. Is there a Wigner function with matching Hudson's theorem and covariance property?
Acknowledgments: RR thanks Rob Spekkens for discussion. ND is supported by the Lockheed Martin Corporation. PAG is supported by FRQNT (Quebec), and RR is supported by NSERC, Cifar and IARPA.

Lemma 18
The Fourier transform F is involutive, i.e. F • F = Id, or equivalently F is its own inverse.
Proof of Lemma 18. Let us determine the image of a function f : M → R by F • F.
which demonstrates the claim. Proof of Lemma 19. Denote by E i,j the matrix with entry 0 everywhere expect at the intersection of the i-th row and j-th column where it is 1. The space S N (R) is generated by the matrices (E i,j + E j,i ) with 1 ≤ i < j ≤ N and E i,i with 1 ≤ i ≤ N . Moreover, we can easily check that these N (N + 1)/2 matrices are independent. Thus the dimension of S N (R) is N (N + 1)/2. In our case N = 2 n and dim S 2 n (R) = 2 2n−1 + 2 n−1 .
The set A contains 2 2n−1 + 2 n−1 symmetric matrices. These matrices are pairwise orthogonal, i.e. they satisfy 1 2 n Tr(T u T v ) = 0 when u = v, thus they are linearly independent. This proves that they form a basis of the space of symmetric matrices. The orthonormality is a consequence of the orthonormality of the Paulis.
We show that from a given Wigner function we can obtain the corresponding real density operator, proving that the Wigner function is informationally complete.
Lemma 20 Let ρ be a real density operator and let W ρ be its Wigner function. Then ρ satisfies Proof of Lemma 20. We expand the r.h.s. of the above equation by inserting the definition Eq. (11) of W ρ and Eq. (13) for A u , and obtain u∈Z 2n Now note that the sum u∈Z 2n 2 (−1) [u,v+w] is 2 2n δ v,w , which is a standard property of characters. Hence, From Lemma 19, this sum is the decomposition of ρ in the orthonormal basis A. This proves that we recover the state ρ.
Further using the properties that ρ is Hermitian and real, Now, we consider the case where ρ AB factorizes, ρ AB = σ A ⊗ τ B . We may write any phase space point acts non-trivially only on system A (B). Then, Proof of Lemma 4. By inserting into the Wigner function the expansion |ψ ψ| = x,y∈Z n 2 ψ(x)ψ(y)|x y|, we obtain We use the expression Eq. (B1) for A 0 , and verify by direct calculation that Inserting Eq.(B2) in the above W ψ (u) gives as stated in Lemma 4.

Appendix C: CSS-ness preserving Clifford gates
Here, we prove Lemma 1 from Section II D, and Lemmas 9, 10 from Section IV C, about the structure of the CSS-ness preserving subgroup of the Clifford group.

Proof of Lemma 9.
First, we omit the phase ±1 of T a and focus on the effect of the conjugation on the vector a. Let g ∈ G CSS and let ϕ g be the automorphism of P n defined by conjugation by g: This morphism of group P n induces a morphism of its quotient P n /{±I}, which is isomorphic to Z 2n 2 , that is ϕ g induces a matrix F ∈ M 2n (Z 2 ) such that where λ(a) ∈ {±1}. Since ϕ g is an automorphism, F ∈ GL 2n (Z 2 ). Moreover, the conjugation conserves the commutation relation and we know that T a and T b commute if and only if [a, b] = 0. This proves that F ∈ Sp 2n (Z 2 ).
Proof of Lemma 10. Consider a pair g, g ∈ G CSS and denote by F(g) = A(F, t) and F(g ) = A(F , t ) their images. The value of F(gg ) is defined by the conjugation by gg . We obtain This gives F(gg ) = A(F F , F t + t), which is indeed the composition of F(g) = A(F, t) and F(g ) = A(F , t ). Hence, F(gg ) = F(g)F(g ), for all g, g ∈ G CSS .
Proof of Lemma 1. Our fist goal is to describe G CSS as the normalizer of the special Pauli operators O.

Lemma 21
The group G CSS is the normalizer in Pauli-observables which have only an X-part or only a Z-part.
Proof of Lemma 21. If g belongs to the normalizer of O, then it conserves CSS codes and CSS states.
In order to obtain the inverse implication, we will show that an operator g which preserves CSS states, stabilizes the set of all CSS groups by conjugation. Applying this argument to rank one groups X i and Z i , we obtain the lemma. Thus, we want to prove that the image under conjugation by g of a CSS group is also a CSS group. This is true when S has rank n. We work by induction. Assume the result for every CSS group of rank r and let us prove that it is also true for a CSS group S of rank r−1. Let S be the group gSg † obtained after conjugation et let M be the subspace M = {a ∈ Z 2n 2 | ± T a ∈ S }.
We associate with M two subspaces Now, choose two logical operatorsX andZ for the code S which anti-commute. The two CSS groups S,X and S,Z are sent onto CSS groups by conjugation. Denote by N and R respectively the corresponding subspaces of Z 2n 2 , defined as M . These two spaces can be decomposed as These spaces both contain M Z ⊕M X and have dimension r, hence we have M Z ⊕ M X = N = R. To find a contradiction, consider the operators gXg † = λ(a)T a and gZg † = λ(b)T b . By construction, we have a ∈ N and b ∈ R. Using the equality N = R, we can see that the two inner products (a Z , b X ) and (b Z , a X ) are 0, which implies that T a and T b commute. This is a contradiction since g preserves the commutation relation. Finally, we proved that S is a CSS group. The set of all CSS group is preserved by conjugation by g.
We now return to the subject of Lemma 9, and further characterize the matrices F appearing on the r.h.s. of Eq. (23). These matrices have one of the two following block structures.
where F Z , F X ∈ GL n (Z 2 ) and F X = (F −1 Z ) t . In what follows, we denote by F CSS the set of symplectic matrices introduced in Eq. (C2). The result is that every CSS Clifford operator induces a pair (F, x) ∈ F CSS × Z 2n 2 . To demonstrate Eq. (C2), note that the conjugation ϕ g of Eq. (C1) preserves the set of CSS operators X(u) and Z(v). Suppose an operator X(u) is sent onto X(u ) and that X(v) is sent onto Z(v ). Then, the image of X(u + v) is X(u )Z(v ) which is impossible. Therefore, ϕ g has two possible structures, either it conserves both sets {X(u) | u ∈ Z n 2 } and {Z(u) | u ∈ Z n 2 }, or it exchanges these two sets. This proves that the matrix F has one of the two following block structures.
where F Z , F X ∈ GL n (Z 2 ). Finally, F Z = (F t X ) −1 is a consequence of the requirement that the F 's must preserve the symplectic form.
The knowledge of the structure of the matrix F will now be useful to determine the phase λ(a) of the operator gT a g † = λ(a)T F a . Since every character of Z 2n 2 is of the form a → (−1) [x,a] for some vector x of Z 2n 2 , it suffices to show that λ is the restriction of such a character to the set V A . Denote by (e i ) 2n i=1 the canonical basis of the space Z 2n 2 and denote by µ the character of Z 2n 2 defined by µ(e i ) = λ(e i ). To prove that µ = λ on the set V A , it is enough to show that • If a X = b X = 0 or if a Z = b Z = 0, then we have λ(a + b) = λ(a)λ(b).
In what follows, we assume that F is block diagonal. The proof is similar in the anti-diagonal case. If a X = b X = 0, then we have ϕ g (T a+b ) = λ(a + b)T F (a+b) which is also ϕ g (T a T b ) = λ(a)λ(b)T (F Z a Z ,0) T (F Z b Z ,0) = λ(a)λ(b)T F (a+b) . The equality λ(a + b) = λ(a)λ(b) follows. The proof of the second implication is similar. This implies that λ coincides with the character µ on the set V A , which means that λ(a) = (−1) [x,a] for some vector x ∈ Z 2n 2 . To illustrate the above with examples, we list the pairs (F, x) for a few gates g ∈ G CSS of special interest. The matrix E i,j denote the n × n binary matrix whose only non-zero coefficient is in position (i, j) • If g = T u then F = I n and x = u.
The fact that the pair (F, x) associated with a Pauli operator T u is (0, u) is a direct consequence of the commutation relations between Pauli operators.
We now return to the subject of Lemma 10, and describe the image of the map F. It holds that Im F = {A(F, t) | F ∈ F CSS , t ∈ Z 2n 2 }.
Recall that this application F is well defined by unicity in Lemma 9. The translation vector t and the vector x of Lemma 9 are related by the equation t = F x.
In order to determine the image of F, note that we already know some elements of Im F. Indeed, from Eq. (C4), all the transformations A(F, 0) with F = I n + E i,j 0 0 I n + E j,i belong to this subgroup. The matrices I n +E i,j are called transvection matrices and they are known to generate the group SL n (Z 2 ), which coincides with GL n (Z 2 ). This implies that Im F contains all the A(F, 0) associated with where M ∈ GL n (Z 2 ). This means that Im F contains all the block diagonal matrices of F CSS . The anti-diagonal matrices of F CSS can be obtained by multiplication with the matrix F of Eq. (C3). This shows that Im F contains all the affine maps A(F, 0), with F ∈ F CSS . Finally, to reach A(F, t) = A(0, t)A(F, 0), note that A(0, t) ∈ Im F by Eq. (C5).
Thanks to this group morphism, we obtain a complete description of the group G CSS . First, we have the group isomorphism By construction of F, its kernel is the set of orthogonal matrices commuting with every matrix. This is {±I 2 n }. We have seen above that Im F is generated by the images of ⊗ i H i , CN OT (i, j) and T u . Thus, from the previous isomorphism, the group G CSS is generated by these 3 types of operators and by Ker(F) = {±I}. This proves the first part of Lemma 1.
The Affine group AGL(Z 2 ) is known to be the semidirect product of the group of translations by the general linear group. We obtain a similar structure for Im F. It is the semi-direct product of the group of translations A(0, t) by F CSS , which implies To prove this decomposition, it is suficient to check that these two sets are subgroups of Im F which jointly generate Im F and that the subgroup of translations is a normal subgroup.
By definition the group F CSS can also be decomposed as a semi-direct product The set of block-diagonal matrices of F CSS is a subgroup isomorphic to GL n (Z 2 ) and it is normal since it is a subgroup of index 2 of F CSS . The second component is the subgroup of F CSS generated by the matrix of order 2 and is isomorphic to Z 2 . The second item of Lemma 1 follows from Eq. (C7), Eq. (C8), and Eq. (C9).