Verifiable Blind Quantum Computing with Trapped Ions and Single Photons

We report the first hybrid matter-photon implementation of verifiable blind quantum computing. We use a trapped-ion quantum server and a client-side photonic detection system networked via a fiber-optic quantum link. The availability of memory qubits and deterministic entangling gates enables interactive protocols without postselection—key requirements for any scalable blind server, which previous realizations could not provide. We quantify the privacy at $\lesssim 0.03$ leaked classical bits per qubit. This experiment demonstrates a path to fully verified quantum computing in the cloud.

Figure 1

Verifiable blind quantum computing in the measurement-based model. The computation is expressed as a sequence of measurements on a brickwork state (two-dimensional graph with vertices representing virtual qubits, and edges indicating cz gates). The server holds $m$ physical memory qubits (orange atoms) and one physical network qubit (violet atom). The server can entangle these qubits deterministically with each other. The network qubit can also be entangled with a photon; by measuring this photon, the client can steer the network qubit in the server remotely without the server learning about its state. This allows the client to hide the computation (inputs, outputs, and circuit) from the server. Moreover, the client can verify that the computation has not been tampered with by (randomly) interleaving test rounds, which produce classically simulatable outcomes and cannot be distinguished from the actual computation by the server.

Figure 2

Protocol used to generate a linear cluster state using a trapped-ion quantum server and a photonic client. The client can steer the network qubit into $|{\theta }_{\ell }⟩=|{\tilde{\theta }}_{\ell }+c_{\ell }\pi ⟩$ by measuring the polarization of the photon in the basis ${\widehat{B}}_{{\tilde{\theta }}_{\ell }}$ and obtaining $c_{\ell }\in \{0,1\}$ as outcome. In the initialization step, the server transfers this state onto a memory qubit such that the network qubit can be steered again [21]. Every subsequent interaction step extends the size of the cluster state; the client steers the network qubit remotely into $|{\theta }_{\ell +1}⟩$, the server entangles it (cz gates), and performs a measurement in the basis ${\widehat{B}}_{{\delta }_{\ell }}$, where ${\delta }_{\ell }$ is provided by the client. See text for details.

Figure 3

The client performs remote state preparation (RSP) using a fast-switching polarization analyzer. (a) The control voltages ($U_a$, $U_b$) of two EOMs separated by a $\lambda /4$ wave plate enable the client to arbitrarily rotate the measurement basis given by the PBS. (b) Laser light is used to reconstruct this basis for different $U_a$, $U_b$. Polarization ellipses are shown for the basis states heralded by detector $p$, where the color represents their phase. (c) To find $U_a$, $U_b$ which maximize the fidelity $F$ to each target state needed during the protocol, we perform tomography on the network qubit after RSP. The averaged results from 36 calibrations over 2 weeks are shown in the Bloch sphere representation of the network qubit. Values indicate $F$, with standard deviations obtained from bootstrapping.

Figure 4

Experimental results on an expanding linear cluster state, where the leading qubit is measured in the $\mathsf{Z}$ basis after (a) one and (b) two interaction steps between the client and the server. (a) While the server observes mixed outcomes (squares, $\sim 2000$ test and computation rounds each), for each ${\alpha }_1$, the client can decode the results using the secret keys. A fit to the decoded computation outcomes (circles) is shown to guide the eye. Error intervals indicate the binomial standard error. The test round errors are significantly below the threshold for verification of a two-node cluster state (dashed line). (b) The decoded outcome is shown for different blind measurement settings, (${\alpha }_1$, ${\alpha }_2$), each comprising $\sim 3100$ computation rounds (see Supplementary Material [32] for interleaved test round results).