Total Functions in QMASerge Massar1 and Miklos Santha2,3

1Laboratoire d’Information Quantique CP224, Université libre de Bruxelles, B-1050 Brussels, Belgium.2CNRS, IRIF, Université Paris Diderot, 75205 Paris, France.3Centre for Quantum Technologies & MajuLab, National University of Singapore, Singapore.December 15, 2020

The complexity class QMA is the quan-tum analog of the classical complexity classNP. The functional analogs of NP andQMA, called functional NP (FNP) andfunctional QMA (FQMA), consist in ei-ther outputting a (classical or quantum)witness, or outputting NO if there doesnot exist a witness. The classical com-plexity class Total Functional NP (TFNP)is the subset of FNP for which it can beshown that the NO outcome never occurs.TFNP includes many natural and impor-tant problems. Here we introduce thecomplexity class Total Functional QMA(TFQMA), the quantum analog of TFNP.We show that FQMA and TFQMA can bedefined in such a way that they do not de-pend on the values of the completeness andsoundness probabilities. We provide ex-amples of problems that lie in TFQMA,coming from areas such as the complex-ity of k-local Hamiltonians and public keyquantum money. In the context of black-box groups, we note that Group Non-Membership, which was known to belongto QMA, in fact belongs to TFQMA. Wealso provide a simple oracle with respect towhich we have a separation between FBQPand TFQMA.

1 IntroductionClassical complexity classes are generally definedas consisting of decision problems. But functionalanalogs of these classes can also be defined. Thefunctional analog of NP is denoted FNP (Func-tional NP). As a simple example, the functionalanalog of the travelling salesman problem is thefollowing: given a weighted graph and a length `,Serge Massar: smassar@ulb.ac.be

either output a circuit with length less than `, oroutput NO if such a circuit does not exist. Thefunctional analog of P, denoted FP, is the subsetof FNP for which the output can be computed inpolynomial time.

Total functional NP (TFNP), introduced in[37] and which lies between FP and FNP, is thesubset of FNP for which it can be shown that theNO outcome never occurs. As an example, factor-ing (given an integer n, output the prime factorsof n) lies in TFNP since for all n a (unique) setof prime factors exists, and it can be verified inpolynomial time that the factorisation is correct.TFNP can also be defined as the functional ana-log of NP ∩ coNP [37].

TFNP contains many natural and impor-tant problems, including factoring, local searchproblems[29, 42, 35], computational versions ofBrouwer’s fixed point theorem[41] and findingNash equilibria[22, 17]. Although there proba-bly do not exist complete problems for TFNP,there are many syntactically defined subclasses ofTFNP that contain complete problems, and forwhich some of the above natural problems can beshown to be complete. For recent work in thisdirection, see [23].

The quantum analog of NP is QMA [34].QMA has been extensively studied, and containsa rich set of complete problems, see e.g. [12].These complete problems are all promise prob-lems. For instance the most famous one, thek-local Hamiltonian problem, involves a promisethat the ground state energy of the input k-localHamiltonian is either less than b or greater thana, with a−b = 1/q(n), for some polynomial q(n),and the problem is to determine which is the case.

Functional QMA, the problem of producing aquantum state that serves as witness for a QMAproblem was first introduced in the unpublishedmanuscript [28]. For instance the functional ana-log of the k-local Hamiltonian problem is the fol-

1

arX

iv:1

805.

0067

0v4

[qu

ant-

ph]

12

Dec

202

0

lowing: given the classical description of a k-localHamiltonian, either output a state with energyless than b, or output NO if such a state does notexist.

In [28] it was observed that there is no obvi-ous reduction of FQMA problems to QMA prob-lems. This should be opposed to the case of NPcomplete problems for which finding a witness re-duces to solving the decision problem.

It is well known that the definition of QMAdoes not depend on the values of the complete-ness and soundness probabilities, as they can bebrought exponentially close to 1 and 0 respec-tively [34, 36, 40]. We discuss different definitionsof Functional QMA. We show that with an ap-propriate definition, based on the notion of eigen-basis of a quantum verification procedure, onecan prove a similar amplification result. Thesetheoretical considerations are the topic of Section2.

In Section 2 we also introduce the functionalclass TFQMA (Total Functional QMA) as thesubset of FQMA such that only the YES an-swer of the FQMA problem occurs, i.e. for allclassical inputs x there exists a witness. Simi-larly to TFNP, the problems in TFQMA arenot promise problems, rather they have a struc-ture such that one can prove that only the YESanswer occurs.

The main aim of the present paper is to showthat TFQMA is an interesting and rich complex-ity class. In Section 3 we provide examples ofproblems that belong to TFQMA. These arerelated to problems previously studied in quan-tum complexity, such as commuting quantum k-SAT, commuting k-local Hamiltonian, the Quan-tum Lovász Local Lemma (QLLL) [8] and pub-lic key quantum money based on knots [20]. Weshow how these problems can be adapted to fitinto the TFQMA framework. Then in Section4 we consider relativized problems. In the con-text of black-box groups, we show that GroupNon-Membership, which was known to belong toQMA [50], in fact belongs to TFQMA. We alsoexhibit problems based on the Quantum FourierTransform (QFT) and provide a simple oraclewith respect to which there is a separation be-tween FBQP and TFQMA.

In the conclusion we present open questionsraised by the present work.

2 Definitions

2.1 QMA

We denote by Hn the Hilbert space of n qubits.For pure states we use the Dirac ket notation|ψ〉, whereas for density matrices we just use theGreek letter ρ. We denote by In the identity ma-trix acting on n qubits.

We denote by poly the set of all functionsf : N → N, where N = {1, 2, ...}, for whichthere exists a polynomial time deterministic Tur-ing machine that outputs 1f(n) on input 1n. Notethat if f ∈ poly then there exists a polynomial qsuch that for all n ∈ N, f(n) < q(n).

Computational processes that can be carriedout in polynomial time are sometimes called effi-cient.

Definition 1. Quantum Verification Proce-dure. A quantum verification procedure is afamily of polynomial time uniform quantum cir-cuits Q = {Qn : n ∈ N} with Qn taking as in-put (x, |ψ〉 ⊗ |0k(n)〉) where x ∈ {0, 1}n is a bi-nary string of length n, |ψ〉 is a state of m(n)qubits, and both m = m(n) and k = k(n) belongto poly. The last k qubits, initialized to the state|0k〉, form the ancilla Hilbert space Hk, and them-qubit states |ψ〉 form the witness Hilbert spaceHm. The outcome of the run of Qn is a randombit which is obtained by measuring the first qubitin the computational basis. We denote this out-come by Qn(x, |ψ〉), and we interpret the outcome1 as accept and the outcome 0 as reject.

Note that a quantum verification procedure canof course also take as input a mixed state ρ, ratherthan a pure state |ψ〉. Mixed states can be writ-ten as convex combinations of pure states. Theacceptance (rejection) probability for the mixedstate is the convex combination of the acceptance(rejection) probabilities for the constituent purestates. Abusing slightly the notation, we usethe same notation Qn(x, ρ) for the outcome ofthe quantum verification procedure on the mixedstate ρ.

Definition 2. (a,b)–Quantum VerificationProcedure. Let q ∈ poly, and let a, b : N →[0, 1] be polynomial time computable functionswhich satisfy

a(n)− b(n) ≥ 1/q(n) . (1)

2

We say that a quantum verification procedure Qis an (a, b)-quantum verification procedure (orshortly an (a, b)-procedure) if for every x oflength n, one of the following holds:

∃|ψ〉 : Pr[Qn(x, |ψ〉) = 1] ≥ a, (2)∀|ψ〉 : Pr[Qn(x, |ψ〉) = 1] ≤ b. (3)

We call a and b the completeness and soundnessprobabilities of the quantum verification proce-dure.

Definition 3. QMA and coQMA. Let a, bbe functions as in Definition 2. The classQMA(a, b) is the set of languages L ⊆ {0, 1}∗such that there exists an (a, b)-procedure Q, wherefor every x, we have x ∈ L if and only if Equa-tion (2) holds (and consequently, x /∈ L if andonly if Equation (3) holds).We call Q a quantum verification procedure

for L. For x ∈ L, we say that a |ψ〉 satisfyingEquation (2) is a witness for x.The class coQMA(a, b) is the set of languages

L ⊆ {0, 1}∗ such that there exists an (a, b)-quantum verification procedure Q′, where for ev-ery x, we have x ∈ L if and only if Equation (3)holds (and consequently, x /∈ L if and only ifEquation (2) holds).

It is of course essential to understand towhat extent the above definitions depend on thebounds a and b. Obviously we can decrease a andincrease b: QMA(a, b) ⊆ QMA(a′, b′) with a′ ≤a and b′ ≥ b, so long as a′(n) − b′(n) ≥ 1/q′(n),for some q′ ∈ poly.

But can one increase a and decrease b? Thiswas first addressed by Kitaev who showed thatthe separation a − b could be amplified to expo-nentially close to 1 by using multiple copies ofthe input state and multiple copies of the verifi-cation circuit [34], that is by increasing both mand k. This was further improved in [36] (see also[40]) where it was shown that by running forwardsand backwards the original quantum verificationprocedure, only one copy of the input state wasneeded to obtain the same amplification, that isone needs only increase k.

Theorem 1. QMA Amplification [34, 36,40]. For all a, b be functions as in Definition 2,for all r ∈ poly, we have QMA(a, b) ⊆ QMA(1−2−r, 2−r).

As a consequence the precise values of thebounds a and b are irrelevant. Traditionally theyare taken to be 2/3 and 1/3. We will do here thesame.

Definition 4. We define the class QMA asQMA(2/3, 1/3).

We will come back to the QMA amplificationprocedure below.

We now turn to a particular kind of (a, b)-procedure which will be our main topic of study:

Definition 5. a-Total Quantum VerificationProcedure. Let a : N→ [0, 1] be a polynomiallytime computable function. We say that a quan-tum verification procedure Q is an a-total quan-tum verification procedure (or shortly an a-totalprocedure) if for every x of length n, the follow-ing holds:

∃|ψ〉 : Pr[Qn(x, |ψ〉) = 1] ≥ a . (4)

Note that an a-total procedure is also an (a, b)-procedure for all b satisfying the conditions ofDefinition 2. Note that the language associatedto an a-total procedure is L = {0, 1}∗. That isthe decision problem for total procedures is triv-ial, since for all x ∈ {0, 1}∗ there exists a witnessfor x. Therefore for total procedures, the onlyinteresting questions concern the witnesses.

In order to prepare for a detailed study of to-tal procedures, we therefore delve deeper into thestructure of the witness space.

2.2 Structure of the witness space.

The methods used in [36, 40] to obtain Theo-rem 1 are based on Jordan’s lemma [30] (for ashort proof of Jordan’s lemma, see [43]). Theuse of Jordan’s lemma in this context providesimportant insights into the structure of the wit-ness space. A succinct proof of this structure wasgiven in [3]. We state here these result which willplay an important role in what follows.

Theorem 2. Structure of witness space [36,3]. Given a quantum verification procedure Q ={Qn}, for all x ∈ {0, 1}n, there exists a basisBQ(x) = {|ψi〉 : 1 ≤ i ≤ 2m} of the witnessspace Hm such that the acceptance probability oflinear combinations of the basis states does not

3

involve interferences, that is for all αi such that∑i |αi|2 = 1, we have

Pr[Qn(x,∑i αi|ψi〉) = 1]

=∑i |αi|2 Pr[Qn(x, |ψi〉) = 1] . (5)

Proof. This result follows from the spectral de-composition of the POVM element correspond-ing to the quantum verification procedure givingoutcome 1, see beginning of Section 6.1 of [3] fordetails.

Definition 6. Eigenbasis, spectrum andeigenspaces of a quantum verification pro-cedure. Fix a quantum verification procedureQ = {Qn}, x ∈ {0, 1}n, and an eigenbasisBQ(x) = {|ψi〉} of Q for x.Given |ψi〉 ∈ BQ(x), we call

pi = Pr[Qn(x, |ψi〉) = 1] (6)

the acceptance probability of |ψi〉.We call the set of acceptance probabilities the

spectrum of Q for x:

Spect(Q, x) = {p ∈ [0, 1] : ∃|ψi〉 ∈ BQ(x)such that Pr[Qn(x, |ψi〉) = 1] = p} . (7)

Given p ∈ Spect(Q, x), we call

HQ(x, p) = Span({|ψi〉 ∈ BQ(x): Pr[Qn(x, |ψi〉) = 1] = p}) (8)

the eigenspace of Q for x with acceptance proba-bility p.

The eigenbasis is not necessarily unique: if twostates |ψi〉, |ψi′〉 ∈ BQ(x) have the same accep-tance probability, than a unitary transformationacting on |ψi〉, |ψi′〉 yields a new eigenbasis. How-ever, as the following result shows, this is the onlyfreedom one has when choosing an eigenbasis.

Theorem 3. Uniqueness of the spectrumand eigenspaces of Q. Given a quantum veri-fication procedure Q = {Qn} and x ∈ {0, 1}∗, thespectrum Spect(Q, x) of Q and the eigenspacesHQ(x, p) of Q with acceptance probability p ∈Spect(Q, x) are unique and do not depend on thechoice of eigenbasis BQ(x).

Proof. Follows from the uniqueness of the spec-tral decomposition of the POVM element corre-sponding to the quantum verification proceduregiving outcome 1.

2.3 RelationsConsider a quantum verification procedure Q. Inthis section we are interested in the set of stateson which Q accepts with high probability. Weare also interested in the set of states on whichQ rejects with high probability. This leads us tothe following definitions.

Definition 7. Accepting and rejecting den-sity matrices and subspaces. Let Q = {Qn}be a quantum verification procedure and fix a ∈[0, 1].We define the following relations over binary

strings and density matrices:

R≥aQ (x, ρ) = 1 if Pr[Qn(x, ρ) = 1] ≥ a ,

R≤aQ (x, ρ) = 1 if Pr[Qn(x, ρ) = 1] ≤ a . (9)

Using the notion of eigenspace HQ(x, p) of Qintroduced previously, we define the following bi-nary relations over binary strings and quantumstates:

H≥aQ (x, |ψ〉) = 1 if |ψ〉 ∈ Span({HQ(x, p) : p ≥ a}) ,

H≤aQ (x, |ψ〉) = 1 if |ψ〉 ∈ Span({HQ(x, p) : p ≤ a}) .(10)

To simplify notation, we denote

R≥aQ (x) ={ρ : R≥aQ (x, ρ) = 1

}, (11)

R≤bQ (x) ={ρ : R≤bQ (x, ρ) = 1

}, (12)

H≥aQ (x) ={|ψ〉 : H≥aQ (x, |ψ〉) = 1

}, (13)

H≤bQ (x) ={|ψ〉 : H≤bQ (x, |ψ〉) = 1

}, (14)

and we will generally express results in termsof the sets R≥aQ (x), R≤bQ (x) and the subspacesH≥aQ (x),H≤bQ (x), rather then the correspondingrelations.

The following result explains how these defini-tions are related.

Theorem 4. Partial equivalence betweenaccepting and rejecting density matricesand subspaces. Let a, b be functions as inDefinition 2 and let Q be an (a, b)-procedure.Then,

1. we have the inclusion

H≥aQ (x) ⊆ R≥aQ (x)

H≤aQ (x) ⊆ R≤aQ (x) (15)

4

(where we view H≥aQ (x) and H≤aQ (x) not assets of pure states, but as the sets of den-sity matrices associated to these pure states);

2. and in the other direction, if R≥aQ (x) is nonempty, then H≥aQ (x) is non empty, while ifR≤aQ (x) is non empty, then H≤aQ (x) is nonempty

Proof. We consider the ≥ a case, the ≤ a case issimilar.Denote by {|ψi〉} the basis of eiegnestates of Q

for x.Point 1 is trivial: H≥aQ (x) is constituted of all

linear combinations of eigenstates |ψi〉 whose ac-ceptance probability pi is greater or equal thana. Hence, using Eq. (5), these states belong toR≥aQ (x).

Point 2 is also easy. Since R≥aQ (x) is non empty,there is at least one density matrix ρ whose ac-ceptance probability is greater or equal than a.We can write ρ as a convex combination of purestates. At least one of these pure states musthave acceptance probability greater or equal thana. We write this state in the basis of eigenstatesas

|ψ〉 =∑i

αi|ψi〉

=∑i:pi<a

αi|ψi〉+∑i:pi≥a

αi|ψi〉 . (16)

Equation (5) then implies that at least one ofthe terms in the sum over i : pi ≥ a must be nonvanishing.

2.4 Functional QMA

Consider an (a, b)-procedure Q. We are inter-ested in the functional task of outputting a wit-ness for Q, and in defining the correspondingcomplexity class.

At first sight, the definition should be in termsof the relation R≥aQ (x) as this characterises the setof density matrices that will accept with prob-ability larger than the completness threshold a.Indeed, this approach was followed in [28]. How-ever using H≥aQ (x) as basis for the definition ofFQMA has advantages as we now discuss.

First, R≥aQ (x) is not closed under linear com-binations: if the projectors onto |ψ〉 and |ψ′〉 be-long to R≥aQ (x), then the projector onto the linear

combination a|ψ〉+ b|ψ′〉 does not necessarily be-long to R≥aQ (x). On the other hand H≥aQ (x) is asubspace and hence closed under linear combina-tions.

Second, R≥aQ (x) does not transform simplyunder the amplification procedure described in[36, 40], while H≥aQ (x) does transform in a simpleway, see Theorem 5 below.

We therefore adopt a definition of FQMAbased on the subspace H≥aQ (x).

For reasons that we discuss in the next para-graphs, we define Functional QMA in terms oftwo relations:

Definition 8. Functional QMA (FQMA).Let a, b be functions as in Definition 2.The class FQMA(a, b) is the set{(H≥aQ (x, |ψ〉),H≤bQ (x, |ψ〉))} of pairs of re-lations, where Q is an (a, b)-procedure.

In order to motivate the above definition, it isinteresting to consider the following example.

Example 1. Consider a function ε : N →[0, 1/3) that decreases faster than 1/poly(n) forany polynomial poly(n), for instance ε(n) =2−n−2

The example consists of a quantum verificationprocedure Q whose spectrum is the set

Spect(Q, x) = {13 ,

23 − ε(n), 2

3} . (17)

Consider the interaction between an all pow-erful prover and a verifier in BQP. The proverwants to convince the verifier that he can producea witness for x for Example 1, which we view asa (2/3, 1/3)-procedure. But it is impossible forthe verifier (except possibly by using the struc-ture of Q) to differentiate with high probabil-ity between the case where the prover sends himan eigenstate with acceptance probability 2/3 (avalid witness), and an eigenstate with acceptanceprobability 2/3 − ε(n) (not a valid witness). Onthe other hand the verifier will reject with highprobability if the prover provides an eigenstatewith acceptance probability 1/3. Thus from thepoint of view of the verifier it is important to char-acterise not only what are the valid witnesses, butalso what are the states he will reject with highprobability. Hence Definition 8 involves two rela-tions.

In the classical case of Functional NP, thereare only two kinds of certificates, those which

5

are accepted with probability 1 and those whichare accepted with probability 0, hence FunctionalNP can be described by a single relation. Inthe case of Functional QMA, there are threekinds of states in the witness Hilbert space, thosewhich are accepted with probability greater thana, those which are accepted with probability lessthan b, and the states which have intermediateacceptance probabilities. Hence it is natural todescribe Functional QMA by two relations.

2.5 FQMA amplification

We now show how the QMA Amplification results[36, 40] apply to Functional QMA. We will showthat, as for QMA, the bounds a and b that ap-pear in the the definition of FQMA(a, b) can bechanged at will. The analysis is based on [36, 40],but needs some new concepts, as we need to showthat the structure of the witness space does notchange under amplification.

Definition 9. Eigenspace preserving mapof quantum verification procedures. Let Qand Q′ be two quantum verification procedures.We say that there exists an eigenspace preserv-ing map from Q to Q′ if for all x ∈ {0, 1}∗:

1. there exists a basis BQ(x) = {|ψi〉} of thewitness Hilbert space Hm which is a jointeigenbasis of Q and Q′ for x;

2. there exists a polynomial time computablestrictly increasing function f : [0, 1] → [0, 1]such that if pi = Pr[Qn(x, |ψi〉) = 1] is theacceptance probability of |ψi〉 for Qn, andp′i = Pr[Q′n(x, |ψi〉) = 1] is the acceptanceprobability of |ψi〉 for Q′n, then p′i = f(pi).

In what follows we will refer to an eigenspace pre-serving map simply as an e–map.

As a consequence, if there exists an e-map fromQ to Q′, then most questions about witnessesfor Q can be reduced to questions about wit-nesses for Q′, in particular H≥aQ (x) = H≥f(a)

Q′ (x)and H≤bQ (x) = H≤f(b)

Q′ (x). However R≥aQ (x) 6=R≥f(a)Q′ (x) and R≤aQ (x) 6= R

≤f(a)Q′ (x) which is one

of the reasons why we define functional QMA interms of H≥aQ (x) and H≤aQ (x).

The reason why we require that the functionf be polynomial time computable is because we

wish that the soundness and completeness thresh-olds ofQ be mapped onto the soundness and com-pleteness thresholds of Q′, where we recall thatthe soundness and completeness thresholds mustbe polynomial time computable, see Definition 2.That is, if Q is an (a, b)-procedure such that thereexists an e–map from Q to Q′ via f , then Q′

is an a′, b′-procedure with a′(n) = f(a(n)) andb′(n) = f(b(n)).

Note that eigenspace preserving maps are tran-sitive: if there exists an e-map from Q to Q′, andif there exists an e-map from Q′ to Q′′, then thereexists an e-map from Q to Q′′. Note also that ifwe require that the inverse f−1 of the strictly in-creasing function f in Definition 9 is also polyno-mial time computable, then eigenspace preservingmaps are an equivalence relation.

Theorem 5. QMA Amplification[36] is aneigenspace preserving map. Let Q be a quan-tum verification procedure. Let a, b be functionsas in Definition 2. For all r ∈ poly there existsa quantum verification procedure Q′, such thatthere exists an e-map from Q to Q′, and such thatthe polynomial time computable strictly increas-ing function f that defines the e–map (see Defi-nition 9) satisfies f(a) ≥ 1−2−r and f(b) ≤ 2−r.

Proof. One checks that the QMA amplificationprocedure of [36] is an eigenspace preserving mapwith the above properties.

Note that the amplification procedure of [36]does not allow us to choose f(a) and f(b) arbi-trarily. For this reason we introduce the followingdeamplification procedure.

Theorem 6. QMA Deamplification is aneigenspace preserving map. Let Q be a quan-tum verification procedure. Let a, b and a′, b′ bepairs of functions as in Definition 2 with a ≥a′ > b′ ≥ b. Then there exists a quantum ver-ification procedure Q′, such that there exists ane-map from Q to Q′, and such that the polyno-mial time computable strictly increasing functionf that defines the e–map (see Definition 9) sat-isfies f(a) = a′ and f(b) = b′.

Proof. We construct Q′ as follows.Let z, z′ : N → [0, 1], with z > z′, be two

polyomial time computable functions to be fixedbelow.On any input (x, |ψ〉) run Q; if Q accepts, then

accept with probability z ∈ [0, 1] and reject with

6

probability 1 − z; if Q rejects, then accept withprobability z′ ∈ [0, 1] and reject with probability1− z′.

It is immediate to check that Q e–maps to Q′,with the the strictly increasing function f thatdefines the e–map (see Definition 9) given by

f(p) = (z − z′)p+ z′ . (18)

We now solve for z and z′ the equations f(a) =a′ and f(b) = b′. It is easy to check that z, z′ arerational functions of a, b, a′, b′ hence polynomialtime computable, that z, z′ ∈ [0, 1], and that z >z′ since a ≥ a′ > b′ ≥ b.

Theorem 7. FQMA is independent of thebounds (a, b). Let Q be a quantum verificationprocedure. Let a, b and a′, b′ be pairs of functionsas in Definition 2 with a′ < 1−2−r and b′ > 2−r,for some r ∈ poly. Then there exists a quantumverification procedure Q′, such that there existsan e-map from Q to Q′, and such that the strictlyincreasing function f that defines the e–map (seeDefinition 9) satisfies f(a) = a′ and f(b) = b′.

Proof. We first use the amplification procedure of[36] to construct an intermediate quantum veri-fication procedure Q′′, such that there exists ane-map from Q to Q′′ (as follows from Theorem5). The parameters of the amplification proce-dure are chosen such that the strictly increasingfunction f1 that defines the e–map from Q to Q′′(see Definition 9) satisfies f1(a) ≥ 1 − 2−r andf1(b) ≤ 2−r.We then apply toQ′′ deamplification as in The-

orem 6 to obtain the quantum verification proce-dure Q′. The parameters of the deamplificationprocedure are chosen such that the strictly in-creasing function f2 that defines the e–map fromQ′′ to Q′ (see Definition 9) satisfies f2(f1(a)) = a′

and f2(f1(b)) = b′.

As a consequence of Theorem 7, the precisevalues of the bounds a and b are irrelevant to thedefinition of FQMA. Therefore, similarly to thedefinition of QMA we make the following defini-tion.

Definition 10. We define the class FQMA asFQMA(2/3, 1/3).

2.6 FBQPThe class BQP is the set of decision problems thatcan be efficiently solved on a quantum computer.

Definition 11. Efficiently preparablestates. Let m ∈ poly. A family of densitymatrices {ρ(x) : x ∈ {0, 1}n, n ∈ N} is efficientlypreparable if ρ(x) acts on Hm(n) and if thereexists a polynomial time uniform family ofquantum circuits Q = {Qn : n ∈ N} with Qntaking as input (x, |0k〉) with x ∈ {0, 1}n andk ∈ poly with k ≥ m, and where ρ(x) is obtainedby tracing out the last k −m qubits of Qn(x).

Definition 12. The language class BQP.BQP ⊆ QMA is the set of languages L ⊆{0, 1}∗ such that there exists:

1. an (2/3, 1/3) quantum verification procedureQ = {Qn : n ∈ N} with Qn taking as input(x, |ψ〉 ⊗ |0k〉), where x ∈ {0, 1}n is a binarystring of length n, |ψ〉 is a state of m qubits,with m, k ∈ poly;

2. an efficiently preparable set of density ma-trices {ρ(x)} where ρ(x) acts on Hm;

and where for every x, we have x ∈ L if and onlyif

Pr[Qn(x, ρ(x)) = 1] ≥ 2/3, (19)

and x /∈ L if and only if

∀|ψ〉,Pr[Qn(x, |ψ〉) = 1] ≤ 1/3. (20)

Definition 13. Functional BQP. The classFBQP is the subset of pairs of relations{(H≥2/3

Q (x, |ψ〉),H≤1/3Q (x, |ψ〉))} in FQMA, with

Q an (2/3, 1/3)-procedure, such that there ex-ists an efficiently preparable set of density ma-trices {ρ(x)} and for all x, if H≥2/3

Q (x, |ψ〉) isnon empty then ρ(x) ∈ R≥2/3

Q (x, |ψ〉).

2.7 Total Functional QMA

We now address the central topic of this study,the subset of FQMA for which there always ex-ists a witness. We had previously introduced a–total procedures in Definition 5. We can now de-fine the corresponding functional classes.

Definition 14. Totality. A pair of rela-tions (H≥aQ (x, |ψ〉),H≤bQ (x, |ψ〉)) in FQMA(a, b)is called total if for all inputs x there existsat least one witness |ψ〉, i.e. if H≥aQ (x) is nonempty.

7

Definition 15. Total Functional QMA(TFQMA). Let a, b be functions as inDefinition 2. The class TFQMA(a, b) isthe set (H≥aQ (x, |ψ〉),H≤bQ (x, |ψ〉)) of pairs oftotal relations, i.e. the set of pairs of relationsin FQMA where Q is an a–total verificationprocedure.The class TFQMA = TFQMA(1/3, 2/3) is

the set of total relations in FQMA.

We emphasize that problems in TFQMA arenot promise problems: they satisfy that for allx there exists at least one witness. In analogywith FNP and TFNP, we expect problems inTFQMA to be simpler than general problems inFQMA.

2.8 Gapped quantum verification procedures

A sub-class of quantum verification procedureswhich will be of interest are those which havea gap in their spectrum. They are defined asfollows.

Definition 16. Gapped (a,b)–QuantumVerification Procedure. An (a, b)-procedureQ is a gapped (a, b)- procedure if for every xof length n, there are strictly no eigenstates withacceptance probability comprised between a and b.As a consequence the spaces H≥aQ (x) and H≤bQ (x)generate the entire witness Hilbert space:

Hm = Span(H≥aQ (x) ∪H≤bQ (x)) . (21)

Definition 17. gapQMA. Let a, b be functionsas in Definition 2. The class gapQMA(a, b) isthe set of languages L ⊆ {0, 1}∗ such that thereexists a gapped (a, b)-procedure Q, where for ev-ery x, we have x ∈ L if and only if Equation (2)holds (and consequently, x /∈ L if and only ifEquation (3) holds).

Definition 18. Total Functional gapQMA (TFgapQMA). Let a, b be func-tions as in Definition 2. The classTFgapQMA(a, b) is the set of pairs of to-tal relations {(H≥aQ (x, |ψ〉),H≤bQ (x, |ψ〉)} forwhich Q is a gapped (a, b)-quantum verificationprocedure.We define the class TFgapQMA as

TFgapQMA(2/3, 1/3).

2.9 1– and/or 0–Quantum Verification Proce-duresBecause of the FQMA amplification theorem, inall the above definitions we can replace the upperbound a (by convention taken to be 2/3) in thedefinition by 1− 2−r, and the lower bound b (byconvention taken to be 1/3) by 2−r, for any poly-nomial r. However sometimes one can show thatone can take a = 1 and/or b = 0, which is po-tentially a stronger statement. In particular theinclusions TFgapQMA(1, 0) ⊆ TFgapQMA ⊆TFQMA might be strict.

When a = 1 and/or b = 0 we are dealing withexact quantum computation. This means that thequantum circuit is made out of a finite (or possi-bly enumerable) set of quantum gates, and all op-erations (state preparation, gates, measurementsin the computational basis) are implemented withzero error. Exact quantum computation has beenstudied in several contexts. In particular QMA1is the subset of QMA in which the acceptingprobability in the case of YES instances is 1,i.e. QMA1 = QMA(1, 1/3). Complete prob-lems for QMA1 were described in [13, 24]. Forarguments why it appears difficult to prove thatQMA = QMA1, see [2].

To simplify notation when dealing with exactquantum computation, we write

R1Q(x) = R≥1

Q (x) , (22)

R0Q(x) = R≤0

Q (x) , (23)

H1Q(x) = H≥1

Q (x) , (24)

H0Q(x) = H≤0

Q (x) . (25)

3 Problems in TFQMA3.1 Preliminary Considerations3.1.1 Introduction

In this section and the next one we provide ex-amples of problems in TFQMA which are notobviously in FBQP.

At the heart of any such example is a quantumverification procedure Q. The minimum require-ments for an example to be included in our listis to be able to show that Q is an a-total quan-tum verification procedure, i.e. that R≥aQ (x) isnon empty for all x (and consequently H≥aQ (x)is non empty). However in some cases we canalso determine the eigenbasis BQ(x) = {|ψi〉}

8

of Q for x, and (at least partially) characterisethe pair of relations (H≥aQ (x, |ψ〉),H≤bQ (x, |ψ〉)) inTFQMA(a, b). The precise formulation of theexamples will depend on how much we can sayabout them.

When possible we shall formulate the prob-lems in such a way that they belong toTFgapQMA(1, 0), as this is the strongest state-ment.

For convenience in what follows, the input sizewill not necessarily be denoted by n, which canbe reserved for some parameter in the input.

3.1.2 Measurements

It is often convenient to describe some of the stepsof a quantum verification procedures as a mea-surement. By this we mean that we carry outan ideal quantum measurement (also known asa quantum non demolition measurement) whichis realised as a unitary transformation. Considerthe operator A =

∑a aΠa, where the a’s are the

eigenvalues of A and Πa are orthogonal projec-tors. Measuring A on state |ψ〉 corresponds tocarrying out the unitary evolution

|ψ〉|0〉 →∑a

Πa|ψ〉|a〉 (26)

where the second register is an ancilla that reg-isters the outcome of the measurement. Subse-quent operations can then be carried out condi-tional on the state of the ancilla.

A specific measurement we will use severaltimes is the projection on the antisymmetric andsymmetric spaces. This can be realised by imple-menting the SWAP test [15] as follows: one car-ries out a Hadamard transform on an ancilla, thena conditional SWAP, and finally a Hadamard onthe ancilla.

|φ〉|ψ〉|0〉 → 1√2|φ〉|ψ〉 (|0〉+ |1〉)

→ 1√2

(|φ〉|ψ〉|0〉+ |ψ〉|φ〉|1〉)

→ 12 (|φ〉|ψ〉+ |ψ〉|φ〉) |0〉

+12 (|φ〉|ψ〉 − |ψ〉|φ〉) |1〉 (27)

After these operations, if the ancilla is in the |0〉state one has projected onto the symmetric space,while if it is in the |1〉 state one has projected ontothe anti–symmetric space. In the first case we say

that the SWAP test has outputted "Symmetric",while in the second case that it has outputted"Anti-symmetric".

3.2 Eigenstates of commuting k-local Hamil-tonian

3.2.1 Background

Definition 19. k-local Hamiltonian. Fixk, d ∈ N. A qudit is a quantum system of di-mension d. Denote by H the Hilbert space of nqudits. Let A ∈ poly. A k-local Hamiltonian isa Hermitian matrix acting on H which can bewritten as H =

∑A(n)a=1 Ha, where each term Ha

(sometimes called constraint) is a Hermitian op-erator that acts non trivially on at most k quditsand whose matrix elements in the computationalbasis have an efficient classical description.

The k-local Hamiltonian problem is to deter-mine whether the ground state of H has energy≤ b or ≥ a, with a − b ≥ 1/poly(n), for somepolynomial poly(n), with the promise that onlyone of these cases occurs. The k-local Hamilto-nian problem is QMA complete [34, 31] even whenk = 2 [33].

The commuting k-local Hamiltonian is thecase where the operators Ha commute. It wasshown by Bravyi and Vyalyi that the commuting2-local Hamiltonian problem is in NP [14]. Someadditional cases of commuting k-local Hamilto-nian problems also in NP are: the 3-local Hamil-tonian where the systems are qubits [5], the 3-local Hamiltonian where the systems are qutritsand the interaction graph is planar or more gener-ally nearly Euclidean [5], the planar square latticeof qubits with plaquette-wise interactions [47];approximating the ground state energy when theinteraction graph is a locally expanding graph [6].The complexity of the commuting k-local Hamil-tonian problem in the general case is unknown.

A particularly interesting case is when each Ha

is a projector, that is has only 0, 1 eigenvalues.The k-local Hamiltonian problem in this case re-duces to the question whetherH has a frustrationfree eigenstate, an eigenstate with eigenvalue 0.This is known as quantum k-SAT ( denoted k-QSAT), and was introduced in [13] where it wasshown that 2-QSAT is in P and k-QSAT for k ≥ 4is QMA1 complete (where QMA1 is the subsetof QMA in which the accepting probability in the

9

case of YES instances is 1). It was later shownthat 3-QSAT is also QMA1 complete [24].

3.2.2 Notation

Consider a commuting k-local Hamiltonian H =∑Aa=1Ha, [Ha, Ha′ ] = 0, acting on n qubits. Since

the Ha’s are hermitian and commute, they pos-sess a common eigenbasis. That is, there exists abasis B = {|ψhj〉} of the Hilbert space Hn, whereeach basis state |ψhj〉 is also an eigenstate of allthe constraints Ha:

Ha|ψhj〉 = ha|ψhj〉 , (28)〈ψh′j′ |ψhj〉 = δh′hδj′j . (29)

We denote by h = (h1, ..., hA) ∈ RA the stringof eigenvalues of Ha. The same symbol h is alsoused as the first index in labelling the basis states|ψhj〉. The second index j ∈ Jh labels orthogonalstates within the subspaces with the same eigen-value h.

We denote by E the energy of the eigenstate:

E =A∑a=1

ha . (30)

We denote by

F = {(h, j)} (31)

the sets of indices of the basis B. Since B is abasis we have |F | = 2n. We denote by

G = {h : ∃j (h, j) ∈ F} (32)

the set of possible strings of eigenvalues of Ha.Since there may exist orthogonal eigenstates withthe same string of eigenvalues, |G| ≤ 2n withequality not necessarily attained.

Note that given an eigenstate |ψhj〉, one canefficiently determine the string h = (h1, ..., hA)by measuring each Ha in succession, where theorder is immaterial since the Ha commute.

In the case where each Ha is a projector, ha ∈{0, 1}, and h ∈ {0, 1}A.

3.2.3 Frustration-Free or Degenerate Eigenspaceof commuting quantum k-SAT

Definition 20. Frustration free or degener-ate eigenspace of commuting quantum k-SAT with n constraints. Denote by x the clas-sical description of a commuting k-local Hamil-tonian acting on the space of n qubits Hn, with

A = n constraints with 0, 1 eigenvalues (projec-tors), and where by hypothesis each constraintcan be measured with zero error in polynomialtime using a quantum computer.Denote by H1(x) the subspace of the space of

2n+ 1 qubits H2n+1 spanned by states satisfyingone of the two conditions:

1. States with the first qubit set to 0, the nextn qubits a frustration free state, i.e. a statesuch that its eigenvalue sequence is h = 0A,and the last n qubits are in an arbitrarystate;

2. States with the first qubit set to 1 and theremaining 2n qubits the antisymmetric lin-ear combination of two orthogonal eigen-states with the same eigenvalue sequence h =(h1, ..., hn):

H1(x) = Span({|0〉|ψ0Aj〉|ψh′j′〉 : j ∈ J0A , (h′, j′) ∈ F}

∪ { 1√2|1〉(|ψhj〉|ψhj′〉 − |ψhj′〉|ψhj〉

): h ∈ G, j, j′ ∈ Jh, j 6= j′}

). (33)

Denote by H0(x) the orthogonal subspace:

H0(x)= Span({|0〉|ψhj〉|ψh′j′〉 : (h, j), (h′, j′) ∈ F, h 6= 0A}∪{|1〉|ψhj〉|ψh′j′〉 : (h, j), (h′, j′) ∈ F, h 6= h′}∪{|1〉|ψhj〉|ψhj〉 : (h, j) ∈ F}

∪{ 1√2|1〉(|ψhj〉|ψhj′〉+ |ψhj′〉|ψhj〉

): h ∈ G, j, j′ ∈ Jh, j 6= j′}

)(34)

Theorem 8. The pair of subspaces(H1(x),H0(x)) defined in Definition 20 be-long to (1, 0)-total functional gap QMA:

(H1(x),H0(x)) ∈ TFgapQMA(1, 0) . (35)

Proof. We will show that there is a quantum ver-ification procedure Q that accepts with probabil-ity 1 on the states in H1(x) and accepts withprobability 0 on the states in H0(x). Further-more we will show that H1(x) is non empty

10

for all x. This then implies that Q is a (1, 0)gapped total quantum verification procedure,and (H1(x),H0(x)) ∈ TFgapQMA(1, 0).Quantum verification procedure.We first describe Q.Measure the first qubit, obtaining outcome b.If b = 0, measure all the Ha on the first n

qubits, let the result be h. Accept if h = 0A, andotherwise reject.If b = 1, measure all the Ha both on the first n

qubits and on the second n qubits, yielding twon bit eigenvalue sequences h = (h1, ..., hn) andh′ = (h′1, ..., h′n). Reject if h 6= h′.If h = h′ carry out a SWAP test. Reject if the

SWAP test outputs "Symmetric", accept if theSWAP test outputs "Antisymmetric".Q is a gapped (1, 0)-procedure.Note that the states enumerated in Equa-

tions (33) and (34) form a basis of the space of2n + 1 qubits. Consequently we have H2n+1 =Span(H1(x) ∪H0(x)).

It is straightforward to check that Q leaves allthe states enumerated in Equations (33) and (34)invariant, and accepts with probability 1 on thestates in Equation (33), and rejects with proba-bility 1 on the states in Equation (34). ThereforeQ is a gapped (1, 0)-procedure, and the statesenumerated in Equations (33) and (34) form aneigenbasis of Q for x.Q a total procedure.To prove that Q is total, we show that H1(x)

is non empty for all x.To this end, for every basis vector |ψhj〉 ∈ B

we consider its associated eigenvalue sequenceh = (h1, ..., hn) ∈ G. The basis B comprises2n states. The number of associated eigenvaluesequences |G| is less or equal than 2n. There-fore, by the pigeonhole principle, either |G| = 2nand there is a one to one mapping between basisstates and bits strings, in which case there is a ba-sis state |ψhj〉 with eigenvalue sequence h = 0A;or |G| < 2n and there is at least one collision, i.e.at least two basis states with the same eigenvaluesequence.In the first case a witness is provided by the

frustration free state

|0〉|ψ0Aj〉|ψ′〉 , (36)

where |ψ′〉 is any state of n qubits.In the second case there exists a state of the

form|1〉√

2(|ψhj〉|ψhj′〉 − |ψhj′〉|ψhj〉

), (37)

where |ψhj〉 and |ψhj′〉 are different basis vectorswith the same eigenvalue sequence. This state isalso accepted by probability 1 by Q.Hence H1(x) is non empty for all x.

Note that if one or more of the constraintsHa = In is the identity operator, then there isno frustration free state, and the witnesses arenecessarily of the form given in Equation (37).

Note that the existence argument in the proofof Theorem 8 is based on the pigeonhole princi-ple, and therefore the problem frustration free ordegenerate eigenspace of commuting quantum k-SAT with n constraints has a form very similar tothe problems in the Polynomial Pigeonhole Prin-ciple (PPP) class introduced in [41]. It has thefollowing classical analog: given a k-SAT formulawith n variables and n clauses, either find a sat-isfying assignment, or find two assignments suchthat the clauses all have the same value.

3.2.4 Almost degenerate states of commuting k-Hamiltonian.

Definition 21. Almost degenerateeigenspace of commuting k-local Hamil-tonian. Denote by x the classical descriptionof a commuting k-local Hamiltonian acting onthe space of n qubits Hn, H =

∑Aa=1Ha, with

the local terms bounded by 0 ≤ Ha ≤ In/A,and where by hypothesis each k-local term canbe measured with zero error in polynomialtime using a quantum computer, and where byhypothesis the eigenvalues of the k-local termscan be efficiently computed, and efficiently addedand subtracted with zero error.Denote by H1(x) the subspace of the space of

2n qubits H2n spanned by the antisymmetric lin-ear combination of two orthogonal eigenstates,|ψh1j1〉 and |ψh2j2〉, (h1, j1) 6= (h2, j2), with al-most identical energies |E1 − E2| ≤ 2−n, whereE1 =

∑a h

1a and E2 =

∑a h

2a:

H1(x) = Span(

{ 1√2

(|ψh1j1〉|ψh2j2〉 − |ψh2j2〉|ψh1j1〉

): (h1,2, j1,2) ∈ F, (h1, j1) 6= (h2, j2),|E1 − E2| ≤ 2−n}

) (38)

11

and denote by H0(x) the orthogonal subspace:

H0(x) = Span({|ψhj〉|ψhj〉|(h, j) ∈ F}

∪ { 1√2

(|ψh1j1〉|ψh2j2〉+ |ψh2j2〉|ψh1j1〉

): (h1,2, j1,2) ∈ F, (h1, j1) 6= (h2, j2)}

∪ { 1√2

(|ψh1j1〉|ψh2j2〉 − |ψh2j2〉|ψh1j1〉

): (h1,2, j1,2) ∈ F, (h1, j1) 6= (h2, j2),|E1 − E2| > 2−n}

) (39)

Theorem 9. The pair of subspaces(H1(x),H0(x)) defined in Definition 21 be-long to (1, 0)-total functional gap QMA:

(H1(x),H0(x)) ∈ TFgapQMA(1, 0) . (40)

Proof. Quantum verification procedure.We first describe Q.Carry out a SWAP test. Reject if the SWAP

test outputs "Symmetric".If the SWAP test outputs "Antisymmetric",

measure all the Ha on the first n qubits andon the second n qubits to obtain the eigenval-ues h1 = (h1

1, h12, ..., h

1A) and h2 = (h2

1, h22, ..., h

2A).

Compute the energies E1 =∑a h

1a and E2 =∑

a h2a. Reject if |E1 − E2| > 2−n and accept

if |E1 − E2| ≤ 2−n. (Recall that according toour hypothesis, the difference of energies can becomputed exactly using an efficient classical al-gorithm.)Q is a gapped (1, 0)-procedure.Note that the states enumerated in Equa-

tions (38) and (39) form a basis of the spaceof 2n qubits. Consequently we have H2n =Span(H1(x) ∪H0(x)).It is straighforward to check that Q leaves all

the states enumerated in Equations (38) and (39)invariant, and accepts with probability 1 on thestates in Equation (38), and rejects with proba-bility 1 on the states in Equation (39). ThereforeQ is a gapped (1, 0)-procedure, and the statesenumerated in Equations (38) and (39) form aneigenbasis of Q for x.Q is a total procedure.To prove that Q is total, we show that H1(x)

is non empty for all x.Since there are 2n states |ψhj〉 and their en-

ergies lie in the interval [0, 1], by the pigeonholeprinciple, there are at least two different states,

|ψhj〉 and |ψh′j′〉 with (h, j) 6= (h′, j′), such thatthe corresponding energies differ by at most 2−n.The quantum verification procedure therefore ac-cepts with probability 1 on the antisymmetric lin-ear combination of these states.

3.2.5 Multiple copies of eigenstates of commutingk-local Hamiltonian.

The quantum no–cloning principle suggests an-other type of problem, namely producing severalcopies of a state that has certain properties. Inorder to translate this requirement into a quan-tum verification procedure it must be possible toverify these properties efficiently. We illustratethis in the case of a commuting k-local Hamil-tonian H =

∑Aa=1Ha. The required property is

that the states be joint eigenstates of all the Ha’swith the same eigenvalues.

Note that creating a single joint eigenstateof the Ha’s (with random eigenvalues) is easy:take the completely mixed state (half of a max-imally entangled state) and measure all the Ha

operators on the state. To create two iden-tical copies, we can try the following proce-dure: start with the maximally entangled state|φ+〉 = 2−n/2∑2n−1

i=0 |i〉1|i〉2 (which can be effi-ciently produced). Now measure the Ha’s onthe first system. Denote by h = (h1, ..., hn)the measured eigenvalues. If the correspondingeigenspace is one-dimensional, the state after themeasurement is |ψh〉1|ψ∗h〉2, where |ψ∗〉 denotesthe complex conjugate of the state |ψ〉 in thestandard basis. (If the corresponding eigenspaceis degenerate with degeneracy Jh, the state af-ter the measurement is J−1/2

h

∑Jhj=1 |ψhj〉1|ψ∗hj〉2

where {|ψhj〉; j = 1, ..., Jh} is an orthonormal ba-sis of the eigenspace with eigenvalues h). Thus ifthe Ha’s are real in the standard basis, we can ef-ficiently create two identical eigenstates. But wedo not know an efficient procedure to create twoidentical eigenstates when the Ha’s are complex,nor do we know of an efficient procedure to createthree identical eigenstates when the Ha are real.

These remarks lead to the following problem:

Definition 22. Multiple copies of eigen-states of commuting k-local Hamiltonian.Denote by x the classical description of a com-muting k-local Hamiltonian acting on the spaceof n qubits Hn, H =

∑Aa=1Ha, and where by hy-

12

pothesis each k-local term can be measured withzero error in polynomial time using a quantumcomputer.Denote by H1(x) the subspace of the space of

3n qubits H3n spanned by the products of stateswith the same eigenvalues h:

H1(x) = Span({|ψhj〉|ψhj′〉|ψhj′′〉: h ∈ G, j, j′, j′′ ∈ Jh}

) (41)

and denote by H0(x) the orthogonal subspace:

H0(x) = Span({|ψhj〉|ψh′j′〉|ψh′′′j′′〉

: (h, j), (h′, j′), (h′′, j′′) ∈ F,h 6= h′ OR h′ 6= h′′ OR h′′ 6= h}

) . (42)

(For definiteness we have considered the casewhere we request 3 copies of the eigenstates. Thecase where the Ha are complex and we request 2copies can be treated in the same way).

Theorem 10. The pair of subspaces(H1(x),H0(x)) defined in Definition 22 be-long to (1, 0)-total functional gap QMA:

(H1(x),H0(x)) ∈ TFgapQMA(1, 0) . (43)

Proof. Quantum verification procedure.We first describe Q.Measure all the Ha on qubits 1, ..., n, on qubits

n+ 1, ..., 2n, and on qubits 2n+ 1, ..., 3n. Acceptif the outcomes h = (h1, ..., hA) are equal. Oth-erwise reject.Q is a gapped (1, 0)-procedure.Note that the states enumerated in Equa-

tions (41) and (42) form a basis of the spaceof 3n qubits. Consequently we have H3n =Span(H1(x) ∪H0(x)).

It is straighforward to check that Q leaves allthe states enumerated in Equations (41) and (42)invariant, and accepts with probability 1 on thestates in Equation (41), and rejects with proba-bility 1 on the states in Equation (42). ThereforeQ is a gapped (1, 0)-procedure, and the statesenumerated in Equations (38) and (39) form aneigenbasis of Q for x.Q a total procedure.Since {|ψhj〉} is a basis of Hn, H1(x) is non

empty for all x. In fact Dim(H1(x)

)≥ 2n.

3.3 Quantum Lovász Local LemmaThe Quantum Lovász Local Lemma (QLLL) in-troduced in [8] provides conditions under whichthe quantum k-SAT problem is satisfiable. Thesatisfiability conditions were extended in [45] and[27].

As an example we give the following resulttaken from [8]: Let {Π1, ...,Πm} be a k-QSAT in-stance where all projectors have rank at most r. Ifevery qubit appears in at most D = 2k/(e · r · k)projectors, then the problem is satisfiable. Forour purposes we will call the hypothesis of thisstatement the QLLL condition.

A Constructive Quantum Lovász Local Lemmaprovides conditions under which the frustrationfree state can be efficiently constructed by a quan-tum algorithm, i.e. is in FBQP. Initial resultsused commutativity of the constraints [48, 44].This condition was dropped in [21] which pro-vides a constructive algorithm under a uniformgap constraint defined as follows: let ε = 1/q(n)for some polynomial q(n), then for any subsetS of the constraints the gap of HS =

∑i∈S Πi is

greater than ε, where the gap is the difference be-tween the two smallest eigenvalues of HS . Notethat there is no known efficient quantum algo-rithm that can check whether the uniform gapconstraint is satisfied.

It is not known how the constructive algorithmof [21] works when the uniform gap condition doesnot hold. It may be that it always outputs a stateclose to the ground state. It may also be that itsometimes outputs a state far from the groundstate. If the latter is true, then this gives rise toan interesting problem in TFQMA.

Definition 23. Quantum verification proce-dure for ground state energy under QLLLconditions. Denote by x the classical descrip-tion {Π1, ...,Πm} of a k-QSAT instance satis-fying the QLLL condition. Denote by H =m−1∑m

i=1 Πi the Hamiltonian obtained by sum-ming all the projectors, rescaled to have eigen-values in the interval [0, 1].Denote by QQLLL the following quantum veri-

fication procedure:On input (x, |ψ〉), apply to |ψ〉 the phase es-

timation algorithm [46, 32, 19] for the unitaryoperator U = exp(iπH) to `(n) bits of precision,where ` ∈ poly.In order to implement the unitary operator

U = exp(iπH) and its powers in the phase esti-

13

mation algorithm, use the algorithm of [18] thatefficiently realises Hamiltonian simulation withexponentially small error. Fix the error of theHamiltonian simulation so that the error madeduring the phase estimation algorithm is at most1/h(n), where h ∈ poly .Denote by φ̃ the estimated phase.Accept if φ̃ = 0. Otherwise reject.

Recall that on an eigenstate of U , U |ψφ〉 =ei2πφ|ψφ〉, the phase estimation algorithm yieldsan l bit approximation of φ ∈ [0, 1). If the eigen-phase φ is a multiple of 2−l (i.e. if φ can bewritten exactly in binary using l bits), then thephase estimation algorithm will yield the exactvalue of φ with probability 1.

Note that in Definition 23 we take U =exp(iπH) so that the eigenphases φ of U lie inthe interval [0, 1/2). This ensures that we can-not mistake the large eigenvalues with the smallones (which would be the case if we had takenU = exp(i2πH)). Further details on the phaseestimation algorithm can be found in [19], see alsothe discussion in Section 4.4.

Theorem 11. The quantum verification pro-cedure QQLLL described in Definition 23 is a(1 − 1

h)–Total Quantum Verification Procedure.Furthermore the ground states of H belong toR≥1−1/hQQLLL

(x); and all eigenstates of H with energyE ≥ 2−`+1 belong to R≤1/2+1/h

QQLLL(x).

Proof. Denote by |ψEj〉 the eigenstates of H withenergy E: H|ψEj〉 = E|ψEj〉, where j ∈ JE la-bels orthogonal energy eigenstates with the sameenergy E. Recall that 0 ≤ E ≤ 1. By the QLLLconditions, the Hamiltonian has at least one frus-tration free state, i.e. a state with energy 0. Wedenote these ground states |ψ0j〉, j ∈ J0.First let us neglect the error made in the

Hamiltonian simulation.The phase estimation algorithm acting on state|ψEj〉 will output φ̃, which is an ` bit estimate ofE/2.

Recall that if E/2 is an integer multiple of 2−`,then φ̃ = E/2 with probability 1. As a conse-quence the ground states |ψ0j〉 will be acceptedwith probability 1.

Taking into account the error in the Hamilto-nian simulation, the probability that the quan-tum verification procedure accepts on |ψ0j〉 isat least 1 − 1

h . Hence procedure QQLLL is a

(1− 1h)–total quantum verification procedure and

the ground states |ψ0j〉 belongs to R≥1−1/hQ (x).

Let us now consider the probability that theprocedure QQLLL accepts on the other eigen-states |ψEj〉. Once again we first neglect the errormade in the Hamiltonian simulation. It followsfrom the analysis of [19] that the probability thatφ̃ differs from E/2 by more than 2−` is less than1/2. Hence all eigenstates with energy E ≥ 2−`+1

will accept with probability less or equal than1/2.

Taking into account the error in the Hamilto-nian simulation, the probability that the quan-tum verification procedure accepts on |ψEj〉 withE ≥ 2−`+1 is at most 1/2 + 1/h.

Note that there may exist eigenstates with en-ergy 2−`+1 ≥ E > 0. We do not know whatis the acceptance probability of QQLLL on theseeigenstates.

Note that the procedure of Theorem 7 allowsus to change the bounds 1 − 1/h and 1/2 + 1/hthat appear in the statement of Theorem 11, forinstance to 2/3 and 1/3. However a detailed anal-ysis is complicated by the fact that we do notknow the eigenbasis of QQLLL. (If the Hamilto-nian simulation did not induce any error, then theeigenbasis of QQLLL would consist of the energyeigenstates |ψEj〉. The error in the Hamiltoniansimulation modifies the eigenbasis slightly.)

Note that the classical analogue of the prob-lem based on the quantum verification proce-dure QQLLL is in FBPP (the functional analogof BPP), as there exist efficient randomized clas-sical algorithms to find a satisfying assignmentwhen the Lovász Local Lemma conditions aresatisfied[38, 39].

3.4 Quantum money based on knots.

Public key quantum money was introduced in [1].Here we show how the scheme of [20] in whichthe quantum money consists of coherent super-position of (representations of) knots induces aproblem in TFQMA.

We first recall that any knot can be representedby a grid diagram G. We denote by D(G) the sizeof the grid diagram. Any grid diagram G can beencoded by two disjoint permutations ΠX and ΠO

of D(G) elements. We denote by

|G〉 = |D(G),ΠX ,ΠO〉 (44)

14

a quantum encoding of such a grid diagram. Theone-variate Alexander polynomial A(G) can beefficiently computed from the representation Gof a knot [7].

In [20] it is proposed that the following states,labeled by grid diagrams G, can be used as quan-tum money

|$G〉 =∑

G′: 2≤D(G′)≤2D(G),A(G′)=A(G)

√q(D(G′))√

N|G′〉, (45)

where D(G) is the dimension of the grid di-agram G; A(G) is the Alexander polynomialof the corresponding knot; the superposition isover grid diagrams G′ of dimension between 2and 2D with the same Alexander polynomialA(G′) = A(G); N is a normalisation factor;q(d′) is the following quasi–Gaussian distribu-tion over grid diagram dimensions between 2and 2D: q(d′) = dy(d′)/ymine, where y(d′) =

1d′![d′!e

] exp(−(d′ −D)2/2D

), for 2 ≤ d′ ≤ 2D,

with ymin the minimum value of y(d′) for 2 ≤d′ ≤ 2D, and where for a positive real number xwe denote by dxe the smallest integer which is atleast x, and we set [x] = dx− 1/2e.

Note that one does not know of an efficient pro-cedure to check if a polynomial is an Alexanderpolynomial associated to a knot, nor of an effi-cient algorithm which, given an Alexander poly-nomial, finds the associated knot. For this reasonthe input to the following procedure is a grid di-agram G and a quantum state.

Definition 24. Quantum verification proce-dure for quantum money based on knots.Denote by Q$ the quantum verification proceduredescribed in [20], which for completeness we re-call briefly.On input (G, |φ〉) carry out the following steps:

1. Verify that |φ〉 is a superposition of basis vec-tors that validly encode grid diagrams, i.e.that it has the form Eq. (44). If this is thecase then move on to step 2, otherwise re-ject.

2. Measure the Alexander polynomial on |φ〉. Ifthis is measured to be A(G) then continue onto step 3. Otherwise, reject.

3. Measure the projector onto grid dia-grams with dimensions in the range

[D(G)/2, 3D(G)/2]. If you obtain +1 thencontinue to step 4. Otherwise, reject.

4. Apply the Markov chain verification algo-rithm described in [20]. If |φ〉 passes thisstep, accept. Otherwise, reject.

This is the crucial step that checks that thestate is a coherent superposition of knotswhich can be mapped one into the other byelementary grid moves, that is elementarymoves that map a knot onto an equivalentknot.

Theorem 12. The quantum verification proce-dure Q$ described in Definition 24 is a (1 −C exp(−D(G)/2))–Total Quantum VerificationProcedure, for some positive constant C. Fur-thermore the states Equation (45) belong toR≥1−C exp(−D(G)/2)Q$

(G).

Proof. Consider the action of Q$ on input(G, |$G〉). Steps 1 and 2 succeed with probability1. Step 3 succeeds with probability 1 − δ whereδ is approximately given by exp(−D(G)/8).

Note that the unnormalised state after step 3can be written

(1− δ)|$G〉+ |$⊥G〉 (46)

where |$⊥G〉 is orthogonal to |$G〉 and has norm〈$⊥G|$⊥G〉 = δ(1− δ).Given as input a state of the form |$G〉, step 4

succeeds with probability 1. However because thestate has been distorted at step 3 (see Equation(46)), on input (G, |$G〉) step 4 of Q$ succeedswith slightly reduced probability lower–boundedby 1−O(

√δ).

Hence procedure Q$ is a 1−O(√δ)–total quan-

tum verification procedure and the state |$G〉 be-longs to R≥1−O(

√δ)

Q (G).Using the inequality

√δ ≤ C exp(−D(G)/2)

for some positive constant C provides the state-ment in the proof.

It is not known what other states will passthe above quantum verification procedure. It isconjectured, see discussion in [20], that quantumcomputers cannot efficiently produce states thatpass the above quantum verification procedure.

15

4 Relativized Problems

4.1 Introduction

In this section we give problems in which thequantum computer has access to an oracle. Thecomplexity is counted as the complexity of thequantum algorithm, including the number of callsto the oracle which each count as one computa-tional step.

A quantum oracle is an infinite sequence ofunitary transformations U = {Un}n≥1. We as-sume that each Un acts on p(n) qubits for somep ∈ poly. We assume that given an n-bit stringas input, a quantum algorithm calls only Un, notUm for any m 6= n. When there is no danger ofconfusion, we will refer to Un simply as U .

We now describe how one makes a call to theoracle. Assume a quantum computer’s state hasthe form

|Φ〉 =∑z

∑b∈{−1,0,1}

αz,b|z〉|b〉|φz,b〉 (47)

where |z〉 is a basis of the workspace register, |b〉is a control qutrit with basis {| − 1〉, |0〉, | + 1〉},and |φz,b〉 is a p(n)-qubit answer register. Then to“query Un” means to apply the following unitarytransformation

|Φ〉 →∑z

∑b∈{−1,0,1}

αz,b|z〉|b〉U b|φz,b〉 , (48)

where we have assumed that if we can applyU , then we can also apply controlled–U andcontrolled–U−1.

Let C be a quantum complexity class, and letU = {Un}n≥1 be a quantum oracle. Then byCU , we mean the class of problems solvable by aC machine that, given an input of length n, canquery Un at unit cost as many times as it likes.

4.2 Finding a marked state

We first give a very simple oracle, which is thebasis of Grover’s algorithm [25, 26] with respectto which we have a separation between FBQPand TFQMA. See [11, 4] for previous use of thisoracle in separating complexity classes.

Oracle 1. Marking a state. Let {|ψn〉 ∈Hn;n ∈ N} be a family of states chosen uniformlyat random from the Haar measure. We denote by

A = {An} the oracle acting on n + 1 qubits thatmarks the n qubits state |ψn〉 ∈ Hn:

An|a〉|ψn〉 = |a⊕ 1〉|ψn〉 ,An|a〉|φ〉 = |a〉|φ〉 ∀|φ〉 ⊥ |ψn〉 (49)

where a ∈ {0, 1}.

Definition 25. Finding a marked state.Given oracle A and the corresponding family ofstates {|ψn〉}, denote by H1(n) the space spannedby the state |ψn〉 and denote by H0(n) the orthog-onal space:

H1(n) = Span({|ψn〉}) ,H0(n) = Span({|φ〉 : |φ〉 ⊥ |ψn}) . (50)

Theorem 13. The pair of subspaces(H1(x),H0(x)) defined in Definition 25 be-long to (1, 0)-total functional gap QMAA, butare not in FBQPA:

(H1(x),H0(x)) ∈ TFgapQMAA(1, 0) (51)(H1(x),H0(x)) /∈ FBQPA . (52)

Proof. Quantum verification procedure.We first describe the quantum verification pro-

cedure Q.The value of the classical input x is irrelevant,

only its length n is used. On input (n, |χ〉), ap-pend to |χ〉) a single qubit in state |0〉 to obtainthe state |0〉|χ〉; act with A on this state; measurethe first qubit; accept if the measurement resultis 1 and reject if the measurement result is 0.Q is a gapped (1, 0)-total procedure.It is immediate to show that Q accepts with

probability 1 on the states in H1(n) and ac-cepts with probability 0 on the states in H0(n).Furthermore H1(n) is non empty for all x.Therefore Q is a (1, 0) gapped total quantumverification procedure, and (H1(n),H0(n)) ∈TFgapQMAA(1, 0).Hardness in FBQPA.It is well known that finding a marked state in

a Hilbert space of dimension d requires Θ(d1/2)queries to the oracle. The lower bound followsfrom arguments in [11], and the upper bound isgiven by Grover’s algorithm[25, 26]. Since d = 2na quantum computer will need Θ(2n/2) opera-tions to find the marked state.

16

4.3 Group Non–MembershipBlack-box groups, in which group operations areperformed by an oracle B, were introduced byBabai and Szemerédi in [10]. In this model sub-groups are given by a list of generators. It wasshown in [10] that for such subgroups, GroupMembership belongs to NPB, i.e. there ex-ists a succinct classical certificate for member-ship. Subsequently, by extending the oracle B tothe quantum setting, Watrous [50] showed thatGroup Non-Membership is in QMAB, i.e. thereexists a succinct quantum certificate for non-membership. Consequently, as we show below,the general question of Group (Non-)Membershipbelongs to TFQMAB. (Note that [4] pro-vides evidence that the certificate for GroupNon-Membership could be classical, in whichcase Group (Non-)Membership would belong toTFQCMAB).

Oracle 2. Black-box groups. We use Babaiand Szemerédi’s model of black-box groups withunique encoding [10], adapted to the quantumcontext. In this model we know how to multi-ply and take inverses of elements of the group,but we don’t know anything else about the group.More precisely, let {Gn} be a family of groups,

with |Gn| ≤ 2n. Each element x ∈ Gn isrepresented by a randomly chosen classical labell(x) ∈ {0, 1}n, to which we associate a quantumstate |l(x)〉 (the label l(x) written in the computa-tional basis). We denote by B = {Bn} the familyof oracles that perform the group operations asfollows:If the state of the quantum computer is

|ψ〉 =∑

x,y∈Gn

∑z

ψxyz|l(x)〉|l(y)〉|z〉, (53)

where |z〉 is some workspace, then the oracle actsas

Bn|ψ〉 =∑

x,y∈Gn

∑z

ψxyz|l(x)〉|l(yx−1)〉|z〉. (54)

We suppose that the representation of the unitelement |l(e)〉 is known. The oracle can then beused to compute the inverse of an element (byinputting |l(x)〉|l(e)〉), and group multiplication(by first computing |l(x−1)〉, and then inputing|l(x−1)〉|l(y)〉).In addition we suppose that the oracle can

check that a register contains a valid label. One

possibility is that if the inputs are orthogonal tostates of the form Equation (53), i.e. if the firsttwo registers do not contain valid labels, then theoracle returns a standard error signal | ⊥〉.

For simplicity of notation in the following weuse interchangeably the notations g and l(g) forthe group elements. The context will make clearwhich is used.

Fix the index n. Suppose you receive as in-put the labels l(g1), ..., l(gk) and l(h) of group ele-ments g1, ..., g,h ∈ Gn. Denote byH = 〈g1, ..., gk〉the subgroup of Gn generated by g1, ..., gk. Group(Non-)Membership is the question: does H con-tain h?

Babai and Szemerédi [10] showed that there ex-ists a short classical certificate for h ∈ H, thatwe denote by C(g1, ..., gk, h). The certificate isan efficient representation of h as a product ofthe group elements g1, ..., gk and their inversesg−1

1 , ..., g−1k , see [10] for details.

Watrous showed [50] that for h /∈ H there ex-ists a succinct quantum certificate.

|ψH〉 = 1|H|1/2

∑x∈H|l(x)〉 . (55)

Definition 26. Quantum verification proce-dure for group (non-)membership. Givenoracle B, and the corresponding family of groups{Gn}, let x = (n, l(g1), ..., l(gk), l(h)). Denote byQG(N)M the following quantum verification pro-cedure which on input (x, |ψ〉) acts as:

1. Measure the first qubit of the quantum input|ψ〉 in the standard basis. Denote by |ψ′〉 theremaining part of the quantum input.

2. If the first qubit is 0, then check whether|ψ′〉 = |C(g1, ..., gk, h)〉 is a classical certifi-cate certifying that h ∈ H. Accept if this isthe case, otherwise reject.

3. if the first qubit is 1, then on |ψ′〉 carry outthe quantum verification procedure for groupnon membership described in [50]. Accept orreject accordingly.

Theorem 14. Given access to oracle B, thequantum verification procedure QG(N)M describedin Definition 26 is an 1

2 -total quantum verifica-tion procedure. Furthermore,

17

1. If h ∈ H, then

|0〉|C(g1, ..., gk, h)〉 ∈ R1QG(N)M

(x) (56)

for all valid certificates C(g1, ..., gk, h) thath ∈ H; and all states with the first qubit setto 1 reject with high probability:

{|1〉|ψ′〉} ∈ R≤2−2n

QG(N)M(x); (57)

2. If h /∈ H, then the state

|1〉|ψH〉 ∈ R≥1/2QG(N)M

(x), (58)

and all states with the first qubit set to 0reject with unit probability:

{|0〉|ψ′〉} ∈ R0QG(N)M

(x). (59)

Proof. If the input has the form |0〉|ψ′〉, then theverification procedure is classical, and the prob-abilities of accepting is 1 if h ∈ H and the inputis a valid classical certificate, otherwise the prob-ability of accepting is 0.

If the input has the form |1〉|ψH〉 and h /∈ H,then the probability that the quantum verifica-tion procedure for group non membership acceptsis 1/2 (see [50]).If the input has the form |1〉|ψ′〉, and h ∈ H,

then the probability that the quantum verifica-tion procedure for group non membership acceptsis upper bounded by 2−2n (see [50]).

4.4 Problems based on QFT

We consider here problems for which the verifi-cation procedure is based on the efficiency of theQuantum Fourier Transform and the phase esti-mation algorithm [46, 32, 19].

The Quantum Fourier Transform is based on aunitary that can be efficiently exponentiated. Wewill suppose below that this unitary is given byan oracle.

Unitaries that can be efficiently exponentiatedwere studied in [9] in the context of the time en-ergy uncertainty. The only explicit example weare aware of where U can be efficiently expo-nentiated but cannot be efficiently diagonalisedis when U is the time evolution of a commut-ing k-local Hamiltonian: U = exp(iH) withH =

∑aHa, where Ha is k-local and the Ha all

commute. Therefore the problems below also ap-ply in the case where the input x is the classicaldescription of such a commuting k-local Hamil-tonian, and U = exp(iH). If additional classesof unitaries that can be efficiently exponentiatedbut cannot be efficiently diagonalized are discov-ered, then this provides new TFQMA problems,which justifies using the present oracle based for-mulation.

Oracle 3. Efficient exponentiation of uni-taries. Let {Un : n ∈ N} be a family of unitarymatrices acting on n qubits chosen uniformly atrandom from the Haar measure. We denote byC = {Cn} the oracle which implements the trans-formations Un and their powers as follows:

Cn(|k〉|ψ〉|ϕ〉

)= |k〉

(Ukn |ψ〉

)|ϕ〉 (60)

where |k〉 is a classical register of n bits, withk ∈ {0, ..., 2n − 1}, |ψ〉 is a state of n qubits, and|ϕ〉 is some workspace.

We denote by φ ∈ [0, 1) and |ψφα〉 ∈ Hn theeigenphases and eigenstates of Un:

Un|ψφα〉 = ei2πφ|ψφα〉,〈ψφ′α′ |ψφα〉 = δα′αδφ′φ, (61)

where α ∈ N labels orthogonal states with thesame eigenvalue. (For simplicity of notation, wedo not add an index n to the states |ψφα〉: itwill be obvious from the context what size Hilbertspace they belong to).

We denote by S(n) the set of couples (φ, α)that satisfy Equation (61):

S(n) = {(φ, α) : Un|ψφα〉 = ei2πφ|ψφα〉} (62)

and we denote by S2 , dis(n) the set of distinctcouples ((φ, α), (φ′, α′)):

S2 , dis(n) = {(φ, α, φ′, α′) ∈ S(n)× S(n): (φ < φ′) OR (φ = φ′ AND α < α′)} .

We denote by Hsym(n) the symmetric space

Hsym(n) = Span({|ψφα〉|ψφα〉 : (φ, α) ∈ S}

∪ { 1√2(|ψφα〉|ψφ′α′〉+ |ψφ′α′〉|ψφα〉

): (φ, α, φ′, α′) ∈ S2 , dis}) , (63)

18

and by Hanti(n) the antisymmetric space

Hanti(n) = Span({|ψAφαφ′α′〉 : (φ, α, φ′, α′) ∈ S2 , dis}) , (64)

with

|ψAφαφ′α′〉 = |ψφα〉|ψφ′α′〉 − |ψφ′α′〉|ψφα〉√

2(65)

the antisymmetric states.We denote by 2πd(φ, φ′) is the distance on the

unit circle between the angles 2πφ and 2πφ′:

d(φ, φ′) = min{|φ− φ′|, 1− |φ− φ′|} . (66)

The following problem is a generalisation of theproblem based on Definition 21 to the case wherethe input is an oracle implementing unitary trans-formations, rather than by a commuting k-localHamiltonian.

Definition 27. Almost DegenerateEigenspace of U . Given oracle C, denoteby S≤2−n ⊆ S × S the set of neighbouring eigen-values of Un, and by H≤2−n the correspondingsubspace of Hanti(n):

S≤2−n = {((φ, α), (φ′, α′)) ∈ S × S: d(φ, φ′) ≤ 2−n, (φ′, α′) 6= (φ, α)}

H≤2−n = Span({|ψAφαφ′α′〉 : ((φ, α), (φ′, α′)) ∈ S≤2−n}) ; (67)

and denote by S>9/2n ⊆ S × S the set of non-neighbouring eigenvalues of Un, and by H>9/2n

the corresponding subspace of Hanti(n):

S>9/2n = {((φ, α), (φ′, α′)) ∈ S × S: d(φ, φ′) > 9/2n, (φ′, α′) 6= (φ, α)}

H>9/2n = Span({|ψAφαφ′α′〉 : ((φ, α), (φ′, α′)) ∈ S>9/2n}) . (68)

Theorem 15. Given access to oracle C,and given n, there exists a 2/3-total quan-tum verification procedure Q acting on 2nqubits such that the corresponding pair ofrelations (H≥2/3 , C

Q (n, |ψ〉),H≤1/3 , CQ (n, |ψ〉)) ∈

TFQMAC(2/3, 1/3) satisfy

H≥2/3 , CQ (n, |ψ〉) ⊇ H≤2−n ,

H≤1/3 , CQ (n, |ψ〉)) ⊇ Span(Hsym(n),H>9/2n) .

(69)

Proof. Quantum verification procedure. Wefirst describe Q, which we view as acting on twon qubit states.Step 1: Carry out a SWAP test on the two n

qubit states. Reject if the SWAP test outputs"Symmetric"; proceed to Step 2 if the SWAP testoutputs "Antisymmetric".Step 2: Carry out the phase estimation algo-

rithm on both n qubits states to n bits of preci-sion, obtaining two estimates φ̂ and φ̂′. Reject ifd(φ̂, φ̂′) > 5/2n, otherwise accept.Eigenbasis of Q.First note that the SWAP test leaves sym-

metric and antisymmetric spaces Hsym(n) andHanti(n) invariant. Therefore the symmetricstates, which all accept with probability 0, con-stitute part of the eigenbasis of Q.

Second, recall that after phase estimation aneigenstate of Un is not modified, but the ancillacontains a superposition of estimates of the phase

|ψφα〉 ⊗ |0n〉 → |ψφα〉 ⊗∑φ̂

cφφ̂|φ̂〉 (70)

where φ̂ are the n bit estimates of the phase. Theprobability of state |ψφα〉 yielding estimate φ̂ istherefore

Pr[φ̂|ψφα

]= |cφφ̂|

2 . (71)

As a consequence, the probability that Step 2,acting on a linear superposition of antisymmetricstates

|ψ〉 =∑

(φ,α,φ′,α′)∈S2 dis

γφαφ′α′ |ψAφαφ′α′〉 (72)

yields estimates (φ̂, φ̂′) is

Pr[φ̂, φ̂′|ψ

]=∑

(φ,α,φ′,α′)∈S2 , dis |γφαφ′α′ |2|cφφ̂|

2|cφ′φ̂′ |2+|cφ′φ̂|

2|cφφ̂′ |2

2 .

(73)

Since there are no interferences between the dif-ferent antisymmetric states in the superposition,the antisymmetric states are the other part of theeigenbasis of Q, see Theorem 2.Acceptance and rejection probability of

antisymmetric states.Recall [19] that the phase estimation algo-

rithm with n bit of precision acting on an eigen-state |ψφα〉 yields an estimated phase with errorbounded by

Pr[d(φ, φ̂) > k

2n]<

12k − 1 . (74)

19

For an antisymmetric state |ψAφαφ′α′〉 the quan-tum verification procedure Q will yield two esti-mates for the phases φ̂ and φ̂′ with probability

Pr[φ̂, φ̂′|ψAφαφ′α′

]=|cφφ̂|

2|cφ′φ̂′ |2 + |cφ′φ̂|

2|cφφ̂′ |2

2= 1

2(Pr(φ̂|ψφα) Pr(φ̂′|ψφ′α′)

+ Pr(φ̂|ψφ′α′) Pr(φ̂|ψφ′α′))

(75)

First we show that if |ψAφαφ′α′〉 ∈ H≤2−n , thatis if d(φ, φ′) ≤ 2−n, then Pr[d(φ̂, φ̂′)) ≤ 5/2n] ≥2/3, i.e. the acceptance probability is greater orequal then 2/3.

To this end we consider each term in Equa-tion (75) separately, for instance consider termPr(φ̂|ψφα) Pr(φ̂′|ψφ′α′). Now use the triangle in-equality to obtain

d(φ̂, φ̂′) ≤ d(φ̂, φ) + d(φ, φ′) + d(φ′, φ̂′) . (76)

Hence if d(φ̂, φ̂′) > 5/2n and d(φ, φ′) ≤ 2−n,then either d(φ̂, φ) > 2/2n or d(φ′, φ̂′) > 2/2n.From Equation (74) the probability of at leastone of the later events occurring is less than1/3. Hence if d(φ, φ′) ≤ 2−n, then Pr[d(φ̂, φ̂′)) >5/2n] < 1/3, and consequently the probabil-ity of the complementary event is bounded byPr[d(φ̂, φ̂′)) ≤ 5/2n] ≥ 2/3. This is true foreach term in Equation (75), and therefore alsofor P (φ̂, φ̂′|ψAφαφ′α′).Second we show that if |ψAφαφ′α′〉 ∈ H≥9/2n ,

that is if d(φ, φ′) ≥ 9/2−n, then Pr[d(φ̂, φ̂′) ≤5/2n] ≤ 1/3, i.e. the acceptance probability isless or equal than 1/3.To this end reason again for each term Equa-

tion (75) separately. Use again the triangle in-equality, and note that if d(φ, φ′) ≥ 9/2n andd(φ̂, φ̂′) ≤ 5/2n, then either d(φ̂, φ) ≥ 2/2n ord(φ′, φ̂′) ≥ 2/2n. Hence if d(φ, φ′) ≥ 9/2−n, thenPr[d(φ̂, φ̂′) ≤ 5/2n] ≤ 1/3.The set of neighbouring states H≤2−n is

non-empty. Since Un acts on n qubits, it has 2neigenstates, which form an orthonormal basis ofthe Hilbert space with eigenphases in φ ∈ [0, 1).By the pigeonhole principle, there must be atleast 2 eigenstates with eigenphases φ, φ′ satisfy-ing d(φ, φ′) ≤ 2−n.

The following problem is a generalisation of theproblem multiple copies of eigenstates of com-muting k-local Hamiltonian, see Definition 22 to

the case where the input is an oracle implement-ing unitary transformations, rather than by acommuting k-local Hamiltonian.

Definition 28. Multiple copies of eigen-states U . Given access to oracle C, denote byT eq(n) the set of triples of equal eigenvalues, andby Heq(n) the corresponding subspace:

T eq(n) = {((φ1, α1), (φ2, α2), (φ3, α3)) ∈ S×3

: φ1 = φ2 = φ3}Heq(n) = Span({|ψφ1α1〉|ψφ2α2〉|ψφ3α3〉

: ((φ1, α1), (φ2, α2), (φ3, α3) ∈ T eq}) ;(77)

and denote by Tneq(n) the set of triples of eigen-values where at least two of are significantly dif-ferent, and by Hneq(n) the corresponding sub-space:

Tneq(n) = {((φ1, α1), (φ2, α2), (φ3, α3) ∈ S×3

: d(φ1, φ2) > 14/2n

OR d(φ1, φ3) > 14/2n

OR d(φ2, φ3) > 14/2n}Hneq(n) = Span({|ψφ1α1〉|ψφ2α2〉|ψφ3α3〉

: ((φ1, α1), (φ2, α2), (φ3, α3) ∈ Tneq}) .(78)

Theorem 16. Given access to oracle C,and given n, there exists a 2/3-total quan-tum verification procedure Qeq acting on 3nqubits such that the corresponding pair ofrelations (H≥2/3 , C

Qeq(n, |ψ〉),H≤1/3 , C

Qeq(n, |ψ〉)) ∈

TFQMAC(2/3, 1/3) satisfy

H≥2/3 , CQeq

(n, |ψ〉) ⊇ Heq(n) ,

H≤1/3 , CQeq

(n, |ψ〉)) ⊇ Hneq(n) .(79)

Proof. Quantum verification procedure. Wefirst describe the quantum verification procedureQeq, which we view as acting on three n-qubitstates. Carry out the phase estimation algorithmon the three n qubit states yielding outcomes φ̂1,φ̂2, φ̂3. Accept if d(φ̂i, φ̂j) ≤ 10/2n for the threepairs (i, j) ∈ {(1, 2), (2, 3), (3, 1)}, otherwise re-ject.Eigenbasis of the quantum verifica-

tion procedure The basis of product states{|ψφ1α1〉|ψφ2α2〉|ψφ3α3〉} constitute the eigenbasisof Qeq. This follows from the remarks on the

20

phase estimation algorithm made in the proof ofTheorem 15.Acceptance probability of states inHeq(n). We now show that on states of the form|ψφ1α1〉|ψφ2α2〉|ψφ3α3〉 with φ1 = φ2 = φ3 thequantum verification procedure Qeq will acceptwith probability greater than 2/3.First, using Equation (74), note that the prob-

ability that d(φ̂i, φi) ≤ k/2n for i = 1, 2, 3 simul-taneously is lower bounded by (1− 3/(2k − 1)).

Second, the triangle inequality implies thatif d(φ̂i, φi) ≤ k/2n for i = 1, 2, 3, thend(φ̂i, φ̂j) ≤ 2k/2n for the three pairs (i, j) ∈{(1, 2), (2, 3), (3, 1)}.

Setting k = 5 yields the result.Acceptance probability of states in Hneq.

The quantum verification algorithm accepts withprobability less than 1/3 on all states in Hneq.

Consider a state of the form|ψφ1α1〉|ψφ2α2〉|ψφ3α3〉 ∈ Hneq. Consequently,there is at least one pair (i, j) for whichd(φi, φj) > 14/2n. If this state accepts, thend(φ̂i, φ̂j) ≤ 10/2n. Consequently, using thetriangle inequality, either d(φi, φ̂i) > 2/2n ord(φj , φ̂j) > 2/2n. Using Equation (74) withk = 2 shows that at least one of these eventshas probability less than 1/3. Hence the overallacceptance probability of the state is less than1/3.Heq is non-empty. Trivial.

The problems based on Definitions 27 and 28are expected to be hard because outputting aneigenstate of U with a specified eigenvalue is ex-pected to be hard in general. It is instructivehowever to consider variants of the problem thatare easy. For instance outputting a random eigen-state of U and the corresponding eigenvalue (upto precision 2−n) is easy: take the completelymixed state and run the phase estimation al-gorithm. The output of the algorithm will bean approximate eigenvalue φ̂, and the state afterrunning the algorithm will be a superposition ofeigenstates with eigenvalues close to φ̂. And ifone carries out this procedure on one half of amaximally entangled state, one obtains a super-position of eigenstate times their complex conju-gate (see remark in Section 3.2.5) This is why werequest 3 copies in Definition 28.

Note also that if we have additional informa-tion on the structure of U , constructing eigen-

states may become easy. For instance suppose,as in Kitaev’s factorization algorithm, that thereis a set of orthogonal states on which U acts likeU |χj〉 = |χj+1〉, where j = 0, ..., N−1, and wherewe identify |χN 〉 = |χ0〉. Suppose also that wecan efficiently implement the transformation Vwhich transforms the computational basis state|j〉 into |χj〉: V |j〉|0〉 = |0〉|χj〉. Then actingwith V on the state N−1/2∑N

j=0 ei2πjk/N |j〉|0〉

will yield an eigenstate of U with eigenvalueei2πk/N .

5 Open Questions

We have provided several examples of problemsbelonging to TFQMA, showing that it is an note-worthy complexity class. We sketch here someinteresting open questions.

One of our examples is based on a quan-tum money scheme. Can one extend and definemore precisely the relation between TFQMA andquantum money?

Can one find additional problems in TFQMA?Note that in the classical case there are manyproblems that belong to TFNP, including someproblems of real practical importance, such as lo-cal search problems and finding Nash equilibria.Are there problems of real practical importancein TFQMA?

We have introduced some natural restrictionsof QMA and TFQMA: gapped quantum verifi-cation procedures in Section 2.8, and 1– and/or0–quantum verification procedures in Section 2.9.Another natural restriction is to require thatthere is a unique witness, i.e. that the witnessHilbert space is one-dimensional. Can one findexamples of this type?

When the witness is classical, the class QMAbecomes QCMA. When in addition the verifieris classical, one obtains the classical class MA.One can define the functional problems associ-ated to these classes FQCMA and FMA, andthe corresponding total functions TFQCMA andTFMA. In all these cases one can introducegapped versions, and unique versions of the func-tional classes. Are there examples of problemsthat fall in these classes? (Note that [4] pro-vides evidence that the certificate for Group Non–Membership could be classical, in which caseTheorem 14 would have to be changed to reflectinclusion in TFQCMAB).

21

What would be the consequences if some ofthese complexity classes coincide? What wouldbe the consequences if some of these complexityclasses are trivial, i.e. coincide with FBQP, orwith FBPP (the functional analog of BPP)?

Total functional NP (TFNP) can also be de-fined as the functional analog of NP ∩ coNP[37]. We believe that one can similarly showthat TFQMA is the functional analog of QMA∩coQMA. We hope to report on this result in afuture publication.

In the case of TFNP, there exist a number ofsyntactically defined subclasses which each con-tain some complete problems, such as Polyno-mial Local Search (PLS), Polynomial Parity Ar-gument (PPA), Polynomial Parity Argument ona Directed Graph (PPAD), Polynomial Pigeon-hole Principle (PPP). Are there syntactically de-fined subclasses of TFQMA? If these syntac-tically defined subclasses of TFQMA exist, dothey have natural complete problems? Do thesyntactically defined subclasses of TFNP (suchas PLS, PPA, PPAD, PPP, etc...) have quantumanalogs? Could one show that the problems con-sidered in section 3 are complete for some of thesesyntactically defined subclasses. This would pro-vide evidence for the hardness of these problems.Note that several of the problems we have intro-duced are based on the pigeonhole principle whichis at the basis of class PPP. These problems mayfit into a quantum analog of PPP.

Acknowledgments.

We thank András Gilyén, Han-Hsuan Lin,Frank Verstraete and Ronald de Wolf for usefuldiscussions. Our research was partially funded bythe Singapore Ministry of Education and the Na-tional Research Foundation under grant R-710-000-012-135 and by the QuantERA ERA-NETCofund project QuantAlgo. S.M. thanks the Cen-ter for Quantum Technologies, Singapore, wherepart of this work was carried out.

References[1] S. Aaronson, Quantum copy-protection and

quantum money. In Computational Complex-ity, 2009. CCC’09. 24th Annual IEEE Confer-ence on (pp. 229-242). IEEE (2009).

[2] S. Aaronson, On perfect completeness forQMA, Quantum Information and Computa-tion 9, 81-89 (2009).

[3] D. Aharonov, M. Ben-Or, F. G. S. L. Bran-dao, O. Sattath, The Pursuit For Unique-ness: Extending Valiant-Vazirani Theoremto the Probabilistic and Quantum Settings,arXiv:0810.4840 (2008)

[4] S. Aaronson and G. Kuperberg, Quantumversus classical proofs and advice, In Compu-tational Complexity, 2007. CCC’07. Twenty-Second Annual IEEE Conference on (pp. 115-128). IEEE (2007)

[5] D. Aharonov, and L. Eldar, On the com-plexity of commuting local Hamiltonians, andtight conditions for topological order in suchsystems. In Foundations of Computer Science(FOCS), 2011 IEEE 52nd Annual Symposiumon (pp. 334-343). IEEE (2011)

[6] D. Aharonov, and L. Eldar, The commutinglocal Hamiltonian problem on locally expand-ing graphs is approximable in NP, QuantumInformation Processing 14, pp. 83-101 (2015)

[7] J. W. Alexander. Topological invariants ofknots and links. Transactions of the AmericanMathematical Society, 30(2): 275–306, 1928.

[8] A. Ambainis, J. Kempe, O. Sattath, A quan-tum Lovász local lemma. Journal of the ACM(JACM) 59, 24 (2012)

[9] Y. Atia and D. Aharonov, Fast-forwarding ofHamiltonians and exponentially precise mea-surements. Nature communications 8, 1572(2017)

[10] L. Babai and E. Szemerédi. On the complex-ity of matrix group problems I. In Proc. IEEEFOCS, pages 229–240, 1984.

[11] C. Bennett, E. Bernstein, G. Brassard,and U. Vazirani. Strengths and weaknessesof quantum computing. SIAM J. Comput.,26(5):1510–1523, 1997. quant-ph/9701001.

[12] A. D. Bookatz (2012). QMA-complete prob-lems. Quantum Info. Comput. 14, pp. 361–383, 2014. arXiv preprint arXiv:1212.6312.

[13] S. Bravyi, Efficient algorithm for a quan-tum analogue of 2-SAT. Contemporary Math-ematics, 536, 33-48 (2011). arXiv:quant-ph/0602108v1

22

[14] Bravyi, S., and Vyalyi, M. (2005). Commuta-tive version of the local Hamiltonian problemand common eigenspace problem. QuantumInformation and Computation, 5(3), 187-215.

[15] H. Buhrman, R. Cleve, J. Watrous, R. DeWolf, Quantum fingerprinting. Physical Re-view Letters, 87(16), 167902 (2001)

[16] Toby S. Cubitt and Martin Schwarz, A con-structive commutative quantum Lovász LocalLemma, and beyond, arXiv: 1112.1413 (2011)

[17] Chen, X., Deng, X., and Teng, S. H. (2009).Settling the complexity of computing two-player Nash equilibria. Journal of the ACM(JACM), 56(3), 14

[18] Berry, D. W., Childs, A. M., Cleve, R.,Kothari, R., and Somma, R. D. (2017). Expo-nential improvement in precision for simulat-ing sparse Hamiltonians. In Forum of Mathe-matics, Sigma (Vol. 5). Cambridge UniversityPress.

[19] R. Cleve, A. Ekert, C. Macchiavello, M.Mosca, Quantum algorithms revisited. In Pro-ceedings of the Royal Society of London A:Mathematical, Physical and Engineering Sci-ences (Vol. 454, No. 1969, pp. 339-354). TheRoyal Society (1998)

[20] E. Farhi, D. Gosset, A. Hassidim, A. Lu-tomirski, P. Shor, Quantum money fromknots. In Proceedings of the 3rd Innovationsin Theoretical Computer Science Conference(pp. 276-289). ACM (2012)

[21] A. Gilyén, O. Sattath, On preparing groundstates of gapped Hamiltonians: An effi-cient Quantum Lovász Local Lemma, InFoundations of Computer Science (FOCS),2017 IEEE 58th Annual Symposium on.IEEE, 2017. p. 439-450. arXiv preprintarXiv:1611.08571 (2016)

[22] Daskalakis, C., Goldberg, P. W., and Pa-padimitriou, C. H. (2009). The complexity ofcomputing a Nash equilibrium. SIAM Journalon Computing, 39(1), 195-259.

[23] P. W. Goldberg and C. Papadimitriou,(2018). Towards a unified complexity theoryof total functions. Journal of Computer andSystem Sciences, 94, 167-192

[24] D. Gosset and D. Nagaj, Quantum 3-SAT isQMA 1-complete. SIAM Journal on Comput-ing, 45(3), 1080-1128 (2016)

[25] L. K. Grover, A fast quantum mechanicalalgorithm for database search?, Proceedingsof 28th Annual ACM Symposium on Theoryof Computing, May 1996, pp. 212 – 219.

[26] L. K. Grover, Quantum mechanics helps insearching for a needle in a haystack, PhysicalReview Letters, Vol. 79, July 1997, pp. 325–328.

[27] K. He, Q. Li, X. Sun, J. Zhang. Quan-tum Lovász local lemma: Shearer’s bound istight. In Proceedings of the 51st Annual ACMSIGACT Symposium on Theory of Comput-ing, pp. 461-472 (2019)

[28] D. Janzing, P. Wocjan, and T. Beth. Cool-ing and low energy state preparation for3-local Hamiltonians are FQMA-complete,arXiv:quant-ph/0303186, 2003.

[29] D. S. Johnson, C. H. Papadimitriou and M.Yannakakis, (1988). How easy is local search?Journal of Computer and System Sciences,37(1), 79-100.

[30] C. Jordan, Essai sur la géométrie à n dimen-sions. Bulletin de la Société mathématique deFrance, 3, 103-174 (1875)

[31] J. Kempe and O. Regev, 3-Local Hamilto-nian is QMA-complete, Quantum Info. andComput., Vol.3(3), pp.258-264, 2003, Arxiv:quant-ph/0302079

[32] Kitaev, A. Y. (1995). Quantum measure-ments and the Abelian stabilizer problem.arXiv preprint quant-ph/9511026.

[33] Kempe, J., Kitaev, A., and Regev, O.(2006). The complexity of the local Hamilto-nian problem. SIAM Journal on Computing,35(5), 1070-1097.

[34] A. Y. Kitaev, A. H. Shen, and M. N. Vyalyi,Classical and quantum computation, Gradu-ate Studies in Mathematics, Vol. 47 (AMS,Providence, RI), 2002.

[35] Krentel, M. W. (1989, October). Structurein locally optimal solutions. In Foundations ofComputer Science, 1989., 30th Annual Sym-posium on (pp. 216-221). IEEE.

[36] C. Marriott and J.Watrous, QuantumArthur-Merlin games, Computational Com-plexity, 14(2):122152 (2005).

23

[37] N. Megiddo and C. H. Papadimitriou, Ontotal functions, existence theorems and com-putational complexity, Theoretical ComputerScience, 81, pp. 317–324 (1991).

[38] R. A. Moser, A constructive proof of theLovász Local Lemma. In: STOC 2009, pp.343–350. arXiv: 0810.4812

[39] R. A. Moser and G. Tardos. A constructiveproof of the general Lovász local lemma. J.ACM 57 (2 (2010), p. 11. arXiv:0903.0544

[40] D. Nagaj, P. Wocjan, Y. Zhang, Fast ampli-fication of QMA. Quantum Information andComputation, 9(11), 1053-1068 (2009).

[41] Papadimitriou, C. H. (1994). On the com-plexity of the parity argument and other in-efficient proofs of existence. Journal of Com-puter and System Sciences, 48(3), 498-532.

[42] Papadimitriou, C. H., Schaeffer, A. A., andYannakakis, M. (1990, April). On the com-plexity of local search. In Proceedings of thetwenty-second annual ACM symposium onTheory of computing (pp. 438-445). ACM.1990.

[43] O. Regev, Witness-preserving QMA amplifi-cation, Quantum Computation Lecture notes,Spring 2006, Tel Aviv University (2006)

[44] O. Sattath and I. Arad. A ConstructiveQuantum Lovász Local Lemma for Commut-ing Projectors. Quant. Inf. & Comp. 15(12)(2015), pp. 987–996. arXiv:1310.7766.

[45] O. Sattath, S. C. Morampudi, C. R. Lau-mann, R. Moessner. When a local Hamilto-nian must be frustration-free. Proceedings ofthe National Academy of Sciences, 113(23),6433-6437 (2016).

[46] P. W. Shor, Algorithms for quantum compu-tation: Discrete logarithms and factoring. InFoundations of Computer Science, 1994 Pro-ceedings., 35th Annual Symposium on (pp.124-134). IEEE (1994)

[47] N. Schuch, Complexity of commuting Hamil-tonians on a square lattice of qubits,Quantum Inf. Comput. 11, 901 (2011),arXiv:1105.2843v2

[48] Martin Schwarz, Toby S. Cubitt, and FrankVerstraete, An Information-Theoretic Proofof the Constructive Commutative QuantumLovász Local Lemma, arXiv:1311.6474 (2013)

[49] M. Szegedy, Quantum Speed-up of MarkovChain Based Algorithms, In Proc. of 45thAnnual IEEE Symposium on Foundations ofComputer Science, pp. 32–41, 2004.

[50] J. Watrous, Succinct quantum proofs forproperties of finite groups. In : Foundationsof Computer Science, 2000. Proceedings. 41stAnnual Symposium on. IEEE, 2000. p. 537-546.

24