- Research
- Open Access
- Published:

# Ancilla-driven blind quantum computation for clients with different quantum capabilities

*EPJ Quantum Technology*
**volume 10**, Article number: 16 (2023)

## Abstract

Blind quantum computation (BQC) allows a client with limited quantum power to delegate his quantum computational task to a powerful server and still keep his input, output, and algorithm private. There are mainly two kinds of models about BQC, namely circuit-based and measurement-based models. In addition, a hybrid model called ancilla-driven universal blind quantum computation (ADBQC) was proposed by combining the properties of both circuit-based and measurement-based models, where all unitary operations on the register qubits can be realized with the aid of single ancilla coupled to the register qubits. However, in the ADBQC model, the quantum capability of the client is strictly limited to preparing single qubits. If a client can only perform single-qubit measurements or a few simple quantum gates, he will not be able to perform ADBQC. This paper solves the problem and extends the existing model by proposing two types of ADBQC protocols for clients with different quantum capabilities, such as performing single-qubit measurements or single-qubit gates. Furthermore, in the two proposed ADBQC protocols, clients can detect whether servers are honest or not with a high probability by using corresponding verifiable techniques.

## 1 Introduction

The implementation of quantum computing is generally based on circuit-based model [1–3] and measurement-based model [4–12]. In the circuit-based model, quantum computing is realized by directly acting single-qubit or multi-qubit gates on the qubits in quantum registers. In contrast, the measurement-based model is implemented by performing adaptive single-qubit measurements on a highly entangled resource state. Since the two models can simulate each other, they are computationally equivalent. Each model has its own advantages and disadvantages and which one is chosen mainly depends on the physical system and the quantum devices of the user.

In 2010, a mixture of the two models, called ancilla-driven quantum computation (ADQC), was proposed by Anders et al. [13], where qubits are stored in quantum registers like the circuit-based model, whereas the operations on the register are performed by measuring an ancilla attached to the register in different bases similar to the measurement-based model. After that, another ADQC protocol without performing measurements was proposed to further enrich the field of ADQC [14]. The main feature of ADQC is that the ancilla qubit is coupled to various qubits of register through a fixed two-qubit entanglement operator \((H\otimes H) CZ\), and only the ancilla qubit is initialized or measured. Due to the entanglement effect of the register and ancilla, arbitrary quantum operations on qubits of the register can be realized by performing suitable measurements on the ancilla. ADQC has excellent advantages in some physical systems where register qubits with long decoherence time are difficult to operate, while relatively short-lived ancilla qubits are easier to control and can be prepared and measured quickly, such as neutral atoms in optical lattices [15], cavity QED superconducting qubits [16], and aluminum ions in optics [17, 18]. Besides, ADQC can simulate any positive operator valued measurement (POVM) on register qubits by accessing a fully controlled ancilla which is attached to the register sequentially. Therefore, it is also useful for experimental systems where their measurements would destroy physical qubits, such as photonic systems. In 2022, Xu and Tong proposed a new approach, different from ADBQC, to implement multi-qubit controlled nonadiabatic holonomic gates with connecting systems to promote the realization of quantum computation in natural physical environments [19]. To learn more about the development of quantum computation can turn to Ref. [20].

Although quantum computation has been extensively studied, the physical realization of it is still very challenging. Even if quantum computers become available, they are likely to be owned by only a handful of centers around the world much like today’s supercomputer rental system. Clients who want to utilize these quantum resources can only delegate their computational tasks to the organizations that own quantum computers. The burdens of clients are greatly reduced in such a delegated quantum computing model, but their privacy is seriously threatened. Fortunately, some quantum cryptographic techniques, such as quantum key distribution [21, 22], quantum identity authentication [23, 24], quantum secret sharing [25, 26],and quantum secure direct communication [27, 28], can be utilized to protect the privacy of clients.

Blind quantum computation (BQC) as a combination of quantum computation and quantum cryptography is a kind of delegated quantum computing that can protect private data of clients. It allows a client who only has some simple quantum devices to delegate quantum computing tasks to a powerful quantum server, while keeping the data of the client including input, output, and algorithm hidden from the server. The first BQC protocol was proposed by Childs based on the circuit model [29], where the client Alice must possess quantum memory, prepare \(|0\rangle \), and have the ability to perform \(SWAP\) gates. Broadbent, Fitzsimons, and Kashefi proposed the first universal BQC protocol (known as the BFK protocol) [30], in which the client only needs to prepare single-qubit states and does not require quantum memory and the ability to perform complex quantum gates. Then Morimae et al. proposed another BQC model [8] in which the client only makes measurements, as in some experimental settings such as quantum optical systems, the measurement of a qubit is much easier than generating a single-qubit state. Since then, a series of BQC protocols were proposed based on these two protocols [31–44] and a few proof-of-principle experiments were demonstrated in photonic systems [45, 46]. Recently, Li et al. proposed a new model of BQC where a client only needs to perform several single-qubit gates [47] and it provides a new research path for BQC.

In addition, an ancilla-driven blind quantum computation (ADBQC) protocol was proposed for the first time by Sueki et al. [48]. ADBQC is an important quantum computation model constructed based on ADQC by providing the property of blindness in quantum cloud environments. Compared with ADQC, ADBQC can significantly reduce the user’s quantum capabilities while retaining its physical advantages and keeping the user’s input private. In ADQC, users need more complicated quantum power such as performing two-qubit gates and having quantum memory, while in ADBQC in Ref. [48], users are required to only prepare single qubits. However, it is unrealistic that all users have the same quantum ability. As mentioned above, BQC mainly deals with three types of clients. Therefore, it is also necessary to design ADBQC protocols suitable for various clients with different quantum capability, such as performing single-qubit measurements or gates. This paper extends the existing ADBQC model by proposing two ADBQC protocols for another two kinds of clients who only have the ability to perform single-qubit measurements or gates. Moreover, the two proposed ADBQC protocols can be verifiable, as clients can easily verify whether the server deviates from the calculation by introducing trap qubits.

The rest of this paper is organized as follows. Section 2 describes the preliminaries, including basic notations and structure of the circuit gadgets needed to realize ADBQC. In Sect. 3, we briefly review a typical ADBQC protocol for the users who prepare single-qubit states [48]. Section 4 presents two ADBQC protocols for another two types of users and analyzes the security and the verifiability of them. Section 5 compares the two proposed ADBQC protocols with the existing one and the last section concludes the paper.

## 2 Preliminaries

In this section, we give a brief introduction to ADBQC. A more detailed description is available in [13, 48, 49]. There are two types of qubits in ADBQC: register qubits and ancilla qubits. The role of an ancilla qubit is to indirectly control the evolution of the register qubit by performing operations such as single-qubit gates and single-qubit measurements on the ancilla qubit after establishing the entanglement between the ancilla and register qubits. We first review the notations and unitary matrices used in a typical ADBQC protocol [48], then present the structure of circuit gadgets which can be used to simulate \(HR_{Z}(\theta )\) and *CZ* gates. By combining these gadgets, ADQC can be realized blindly in the form of delegated computation. In addition, we refer to the client as Alice and the server as Bob for simplicity.

### 2.1 Review of ADBQC in ref. [49]

Let notations \(\{|\pm \rangle \}\) and \(\{|0\rangle ,|1\rangle \}\) denote the *X*-basis measurement and the *Z*-basis measurement, separately. In addition, \(S_{i} \in \{0,1\}\) means the result of the *i*th measurement. Set the state \(|+_{\alpha ,\varphi }\rangle =\cos (\frac{\alpha}{2})|0\rangle +e^{i \varphi}\sin (\frac{\alpha}{2})|1\rangle \), the state \(|-_{\alpha ,\varphi }\rangle =\cos (\frac{\alpha}{2})|0\rangle -e^{i \varphi}\sin (\frac{\alpha}{2})|1\rangle \), the rotation operator about the *X*-axis \(R_{X}(\theta )=e^{-\frac{i \theta X}{2}}\), and the rotation operator about the *Z*-axis \(R_{Z}(\theta )=e^{-\frac{i \theta Z}{2}}\). And the Pauli matrices are defined as

ADBQC is performed with the help of different single ancilla, on which single-qubits measurements and 2-qubit entangle operators \(\widetilde{E}_{AR}\) determined by the ADBQC scheme chosen by Bob and the computation progress are carried out, where \(\widetilde{E}_{AR}=(H\otimes H)CZ\) or \(CZ(H\otimes H)\). An ancilla \(|+_{\gamma , \delta}\rangle \) is coupled to register qubits with \(\widetilde{E}_{AR}\) and then is measured in certain basis \(\{|\pm _{\theta , \phi}\rangle \} \). The back-action of this measurement on the register qubit can be described by a Kraus operator \(K_{\pm}=_{A}\langle \pm _{\theta ,\phi}|\widetilde{E}_{AR}|+_{ \gamma ,\delta}\rangle _{A}\) [50], and \(P^{\pm}=\operatorname{tr}(K^{ \pm \dagger}_{R}K^{\pm}_{R})\) are the probabilities of obtaining measurement outcomes + or −.

Arbitrary single-qubit gates together with the \(CNOT\) gate form the universal set of gates for quantum computation. Two ways are used in ADBQC to carry out arbitrary single-qubit gates, one using \(HR_{Z}{(\theta )}\) and the other using \(R_{X}(\theta )\) and \(R_{Z}(\theta )\), as any unitary operation *U* can be decomposed as follows:

where *α*, *β*, *γ*, and *δ* are real numbers. The matrix of \(HR_{Z}(\theta )\), \(R_{Z}(\theta )\) and \(R_{X}(\theta )\) are presented as

### 2.2 Circuit gadgets of ADBQC

Here we only describes the circuit gadgets for implementing the *CZ* gate and \(HR_{Z}(\theta )\), while gadgets for achieving \(R_{X}(\theta )\) and \(R_{Z}(\theta )\) are similar. More details can be found in Ref. [48]. In the ADBQC model, a circuit is constructed by Bob and Alice layer-by-layer to execute ADBQC as shown in Fig. 1(a). Actually, universal BQC can be realized by simulating arbitrary one or two-qubit gates using the universal gate pattern as shown in Fig. 1(b). The universal gate pattern consists of \(HR_{Z}(\theta )\) and *CZ* gates and whether it simulates a one or two-qubit gate is determined by the angle *θ* in each \(HR_{Z}(\theta )\). Thus, universal ADBQC can be achieved by using the gadgets in Fig. 2 and Fig. 3 to implement \(HR_{Z}(\theta )\) and the *CZ* gates.

## 3 Review of Sueki et al.’s ADBQC protocol [48]

The ADBQC protocol proposed by Sueki et al. [48] is briefly reviewed in this part. In this protocol, Alice who can only generate single-qubit states can perform ADQC with the help of server Bob while keeping Alice’s privacy including input, output, and algorithm perfectly secret.

Assume the client Alice needs to choose an appropriate circuit gadget to implement computation on register qubits. If Alice wants to execute the operation \(HR_{Z}(\theta )\), she needs to prepare and send ancilla \(|+_{\gamma ,\frac{\pi}{2}}\rangle \) or \(|-_{\gamma ,\frac{\pi}{2}}\rangle \) to Bob with equal probabilities, where *γ* is chosen randomly by Alice. Then, according to the measurement result sent by Bob, Alice will update the selection of the next measurement angle. However, if Alice needs to achieve the *CZ* gate, she only needs to receive the classical measurement \(S'\) from Bob. The specific steps can be briefly described as follows.

(T1) Resource preparation phase: The circuit scale \(N\times M\) required to execute ADBQC is predetermined by Alice and Bob before the protocol starts as shown in Fig. 1(a), where *N* is the number of register qubits and *M* is the depth of the algorithm Alice wants to execute. All the register qubits are initialized in \(|0\rangle \).

(T2) Calculation phase: For every gate pattern in Fig. 1(b), it is composed of the *CZ* operation and \(HR_{Z}(\theta )\) operation. The *CZ* operation is completed by Bob according to the calculation progress, and Bob only needs to inform Alice of the measurement results \(S'\) through the classic channel. The realization of the \(HR_{Z}(\theta )\) operation requires mutual interaction between Alice and Bob and the following four steps:

(1) Alice chooses an ancilla parameter *γ* randomly and secretly and then sends one of the ancilla qubits \(\{|+_{\gamma ,\frac{\pi}{2}}\rangle , |-_{\gamma ,\frac{\pi}{2}} \rangle \}\) to Bob. Bob couples the ancilla to a register qubit and then measures it in *Z* basis. After performing the measurement on the ancilla, Bob sends the outcome \(S_{1}\) to Alice.

(2) Bob prepares \(|0\rangle \) as an ancilla and couples it to the register qubit via the two-qubit unitary \((H\otimes H)CZ\). The purpose of this step is to generate the *H* gate on the register qubit to offset the redundant *H* gate generated in the previous step.

(3) Alice calculates \(\theta =-\theta '-(-1)^{S_{1}} (\gamma +r\pi )\) with a random bit \(r \in \{0,1\}\) and sends *θ* to Bob through a classic channel, where \(\theta '\) is the actual rotation angle in the computation. Because Bob does not know the value of *γ*, he cannot deduce the real calculated angle through *θ*. Bob couples the ancilla \(|+\rangle \) to the register qubit and measures the coupled ancilla in \(\{|+_{\frac{\pi}{2},\theta}\rangle , |-_{\frac{\pi}{2},\theta} \rangle \}\). Then Bob sends the measurement result \(S_{2}\) to Alice.

(4) Alice updates the value of \(\theta '\) to correct Pauli by-products from \(S_{2}\) and \(S'\) by the method similar to that used in MBQC [30].

(T3) Output phase: At the end of the protocol, Alice will instruct Bob to apply appropriate measurement on each output qubit. Since the output quantum states are encrypted by Pauli-*X* and *Z* gates, Bob cannot obtain Alice’s actual output from the measurements. Alice simply chooses whether to flip the classical measurement results or not according to the Pauli by-products related to each output qubit. If Bob is honest, Alice will get the correct calculation.

In the reviewed ADBQC protocol [48], only clients with the ability to prepare single quantum states can perform ADBQC. This limits the opportunity for clients with only other fundamental quantum capabilities to participate in ADBQC. Furthermore, the protocol lacks verifiability and Bob could easily mess up the computation to cheat Alice.

## 4 The presented ADBQC protocols

This section extends the existing ADBQC model for users who prepare single-qubit states in Ref. [48] by proposing two ADBQC protocols, called Protocol 1 and Protocol 2, for another two types of users. The proposed protocols both consist of three parts: the resource preparation phase, the computation phase, and the verification phase, where the steps in the resource preparation phase and the verification phase are similar, but the \(HR_{Z}(\theta )\) is implemented in a different way in the computation phase. Each of these protocols has a different minimum quantum capability requirement for the client, such as performing single-qubit measurements in Protocol 1 and performing some single-qubit gates in Protocol 2. In addition, to satisfy verifiability, we must perform measurements directly on the output register qubits rather than using the ADBQC to simulate POVM. Through the trap checking, Alice can verify the computation result with a high probability.

### 4.1 The presented ADBQC protocols in which Alice only makes measurements

In Protocol 1, Alice who only has the ability to perform Pauli- *X*, *Y*, and *Z* basis measurements wants to perform ADQC on register qubits with the help of Bob while keeping her own data hidden. The detailed steps of Protocol 1 are given as follows.

(Q1) Resource preparation phase: The circuit size \(N\times M\) is determined by Alice and Bob before starting the protocol, where *N* is the number of register qubits and *M* is the depth of the algorithm Alice wants to execute. All the register qubits are initialized in \(|0\rangle \). Alice chooses \(2N/3\) as the number of trap qubits, which is optimal [37].

(Q2) Calculation phase: The gate pattern shown in Fig. 4 is used to perform ADBQC in this protocol. The gate pattern is composed of the *CZ* gate and \(HR_{Z}(\theta )\).

For the simulation of the *CZ* gate in each gate pattern in Fig. 2, the operations are the same as the reviewed Sueki et al.’s protocol. Bob should send the measurement result \(S'\) to Alice for removing the Pauli by-products.

For the simulation of the operation \(HR_{Z}(\theta )\) in each gate pattern in Fig. 5, two sets \(A \equiv \{\frac{\pi}{4}, \frac{3\pi}{4}, \frac{5\pi}{4}, \frac{7\pi}{4}\}\) and \(B \equiv \{0, \frac{2\pi}{4}, \frac{4\pi}{4}, \frac{6\pi}{4}\}\) are defined. If the angle that Alice needs to perform according to her algorithm is in the set *A*, Alice and Bob follow the steps of case *a*. Otherwise, they turn to the case *b*. We also let \(S_{i}\) be the result of the *i*th measurement in the following steps.

Case *a*: (1) Bob prepares the Bell state \(\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) and sends half of it to Alice, keeping the remaining particle as the ancilla. (2) Alice performs an *X*-basis measurement on the particle sent by Bob. After her measurement, Bob has the state \(Z^{S_{1}}|+\rangle \), where \(S_{1} \in \{0, 1\}\) is Alice’s measurement result. (3) Bob couples the ancilla to the register qubit using the 2-qubit operator \((H\otimes H)CZ\) and then performs the \(R_{Z}(\frac{\pi}{4})\) gate on the coupled ancilla. Later, it is sent to Alice through quantum channel. (4) Alice performs the *X* or *Y*-basis measurement on the ancilla according to her algorithm and keeps the measurement result \(S_{2}\). (5) Bob prepares \(|0\rangle \) and performs the coupling operator \((H\otimes H)CZ\) on \(|0\rangle \) and the register qubit. (6) Bob prepares Bell state \(\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) again, sends Alice half of it and keeps the other particle as the ancilla. (7) Alice measures the particle sent by Bob in the *Z* basis. After her measurement, Bob has the state \(X^{S_{3}}|0\rangle \), where \(S_{3} \in \{0, 1\}\) is Alice’s measurement result. (8) Bob performs the 2-qubit gate \((H\otimes H)CZ\) on the ancilla and register qubit, then sends the ancilla to Alice. (9) Alice discards the ancilla sent by Bob directly. At last, Alice implements the operation \(X^{S_{2}+S_{3}}HR_{Z}(-(-1)^{S_{1}}(\theta - \frac{\pi}{4}))\).

Case *b*: (1) Bob prepares the Bell state \(\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) and sends one of two qubits to Alice while keeping the remaining one as the ancilla. (2) Different from that in case *a*, Alice performs an *Z*-basis measurement on the particle sent by Bob here. According to Alice’s measurement result \(S_{1} \in \{0, 1\}\), Bob has the state \(X^{S_{1}}|0\rangle \). (3) Bob performs the 2-qubit gate \((H\otimes H)CZ\) on the ancilla and register qubits, then performs the gate \(R_{Z}(\frac{\pi}{4})\) on the ancilla. Later, Bob sends it to Alice via the quantum channel. (4) Alice discards the ancilla sent by Bob. (5) Bob prepares \(|0\rangle \) and performs the coupling operator \((H\otimes H)CZ\) on the register qubit and \(|0\rangle \). (6) Bob prepares the Bell state \(\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) again, sends Alice half of it and keeps the other particle as ancilla. (7) Alice measures the particle sent by Bob in the *X* basis. After her measurement, Bob has the state \(Z^{S_{2}}|+\rangle \), where \(S_{2} \in \{0, 1\}\) is Alice’s measurement result. (8) Bob couples the ancilla to the register qubit using the \((H\otimes H)CZ\) gate and sends the coupled ancilla to Alice. (9) Alice measures the ancilla sent by Bob in the *X* or *Y* basis according to the algorithm and remains the measurement result \(S_{3}\). By these steps, Alice achieves the operation \(Z^{S_{1}}X^{S_{3}}HR_{Z}(-(-1)^{S_{2}}\theta )\).

(Q3) Verification phase: Assume the output state after Q2 is \(\sigma _{q}P|\Psi \rangle =\sigma _{q} P(|\zeta \rangle _{r} \otimes |0\rangle _{t}^{\otimes N/3} \otimes |+\rangle _{t}^{\otimes N/3})\), where \(\sigma _{q} \equiv \otimes _{j=1}^{N} X_{j}^{x_{j}} Z_{j}^{z_{j}} \) with \(x_{j}\) and \(z_{j} \in \{0,1\}\) are Pauli by-products similar to the measurement-based quantum computation [30], *P* is an *N*-qubit permutation, and \(|\zeta \rangle _{r}\) is a quantum state of \(N/3\) qubits, consisting of \(|\pm \rangle \), \(|0\rangle \), and \(|1\rangle \). We denote the qubits with subscript *r* are the actual output qubits and the qubits with subscript *t* are trap qubits. Bob sends qubits of state \(\sigma _{q}P|\Psi \rangle \) to Alice one by one. Alice measures the qubits in X or Z bases. If the error rate of the trap qubits is acceptable, Alice accepts the results of these computational register qubits. Otherwise, she rejects them.

### Security analysis

The blindness and verifiability of Protocol 1 are analyzed. Furthermore, the property of blindness is shown in three aspects, namely algorithmic blindness, input blindness, and output blindness.

### Algorithm blindness of Protocol 1

In protocol 1, there is only one-way transmission of information from Bob to Alice, Thus Alice’s privacy is guaranteed by the no-signaling principle [51]. Let *A* be the random variable representing the angle of Alice’s measurement. Let *B* be the random variable representing the type of POVM performed by Bob, and \(M_{B}\) is a random variable representing the outcome of Bob’s POVM. Let *T* be the random variable that Bob sends to Alice and it represents the measurement result when simulating the *CZ* gate. Because of the no-signaling principle,

for all \(M_{B}\), *a*, \(a'\), and *b*. From Bayes’ theorem, there is the relationship between probabilities,

This means the conditional probability distribution of Alice’s computational angles is equal to its priori probability distribution. So Bob cannot learn anything about Alice’s measurement angles and the blind of algorithm of Protocol 1 is guaranteed.

### Input blindness of Protocol 1

Let the initial state of the computation be the standard state \(|0\rangle ^{\otimes N}\) and the algorithm for computation part includes the preparation of the input state. It has been shown above that the algorithm of Protocol 1 are blind, so Bob has no way of knowing what input state Alice prepared.

### Output blindness of Protocol 1

Let *O* be the random variable representing Alice’s output, *B* be the random variable that represents the type of POVM carried out by Bob, \(M_{B}\) be the random variable representing the outcome of Bob’s POVM, and *T* be the random variable that Bob sends to Alice representing the measurement result when simulating the *CZ* gate. Because of the no-signaling principle,

for all \(M_{B}\), *o*, \(o'\), and *b*. Then, from Bayes’ theorem,

As the conditional probability of Alice’s output is equal to it’s prior probability, Bob cannot learn anything about the Alice’s output.

### Verifiability of Protocol 1

Assuming that Bob is dishonest and he will not implement some steps of the protocol as required. His general attack is to create a different state *ρ* instead of \(\sigma _{q}|\Psi \rangle \). This attack can be deduced to a random Pauli attack by a completely positive-trace preserving (CPTP) map [37].

Our notations follows that of Ref. [37]. We define *α* as the number of non-trivial Pauli operators acting on the *N* register qubits in a random Pauli attack, where non-trivial Pauli operators means *X*, *Z*, and *XZ* operators. Let *a*, *b*, *c* be the number of *X*, *Z*, and *XZ* operators in *α*. Since \(\alpha = a + b + c \leq 3\max(a,b,c)\), we have \(\max(a,b,c) \geq \frac{\alpha}{3}\).

Let \(\max(a,b,c) = a\). Then, the probability that all *X* operators of \(\sigma _{\alpha}\) do not change any trap is \(\frac{(N-a)!\prod_{K=0}^{a-1}(\frac{2N}{3}-k)}{(N)!} = (\frac{2}{3})^{a} \frac{\prod_{K=0}^{a-1}(N-\frac{3K}{2})}{\prod_{K=0}^{a-1}(N-K)} \leq (\frac{2}{3})^{a} \leq (\frac{2}{3})^{\alpha /3}\). We can obtain the same result for \(\operatorname{max} (a,b,c) = b\). For \(\operatorname{max} (a,b,c) = c\), we have the probability \(\frac{(N-a)!\prod_{K=0}^{a-1}(\frac{N}{3}-k)}{(N)!} = (\frac{1}{3})^{a} \frac{\prod_{K=0}^{a-1}(N-3K)}{\prod_{K=0}^{a-1}(N-K)} \leq (\frac{1}{3})^{a} \leq (\frac{1}{3})^{\alpha /3}\). This means that the probability of Alice being tricked by Bob is exponentially small. Therefore, Protocol 1 is verifiable.

### 4.2 The presented ADBQC protocol where Alice only performs single-qubit gates

Protocol 2 for a user Alice who can only perform single-qubit gates delegating her ADBQC to a server Bob is presented in this part. The specific steps are as follows.

(D1) Resource preparation phase: The operations in this phase are similar to the step Q1 of Protocol 1. Bob prepares the input register qubits and Alice chooses *h* as the number of trap qubits. Note that if there are too many traps, the computational efficiency will be reduced. But if there are too few traps, the probability of detecting a malicious Bob will be small.

(D2) Calculation phase: Protocol 2 uses the gate pattern shown in Fig. 4 to perform ADBQC.

For the implementation of the *CZ* gate in each gate pattern, the operation is similar as the reviewed Sueki et al.’s protocol [48]. Bob should send Alice the measurement result \(S'\) as shown in Fig. 3 to Alice.

For the implementation of \(HR_{Z}(\theta )\) in each gate pattern, specific operations are as follows: (1) Bob couples ancilla to register qubit and sends the coupled ancilla to Alice. (2) Alice performs \(R_{Z}(\frac{\pi}{4})\) gate *K* times on ancilla according to her algorithm, and then Alice sends it back to Bob. (3) Bob measures the particle sent by Alice in the *X* basis and sends Alice the measurement result *S* through the class channel. Its simple graphical representation is shown in Fig. 6.

(D3) Verification phase: At the end of D2, let the output state be \(\sigma _{q}P|\Phi \rangle = \sigma _{q} P(|\zeta '\rangle _{r} \otimes |\lambda \rangle _{t})\), where both \(|\zeta '\rangle _{r}\) and \(|\lambda \rangle _{t}\) are composed of \(|\pm \rangle \), \(|0\rangle \), and \(|1\rangle \). The number of qubits contained in \(|\zeta '\rangle _{r}\) is \(N-h\), while that in \(|\lambda \rangle _{t}\) is *h*. Alice instructs Bob to perform suitable measurements on qubits of \(\sigma _{q}P|\Phi \rangle \) one by one, such as *Z* on \(|0\rangle \) or \(|1\rangle \) and *X* on \(|+\rangle \) or \(|-\rangle \). If the error rate of the trap qubits is acceptable, Alice accepts the results of these computational register qubits. Otherwise, she rejects them.

### Security analysis

Next, blindness and verifiability of Protocol 2 are analyzed. Protocol 2 needs a bidirectional quantum channel between Alice and Bob and thus it no longer satisfies the no-signaling principle [51]. In fact, Bob also has no access to Alice’s private information because he cannot distinguish which operations Alice did in step D2. Suppose Bob is evil and wants to capture what Alice did in step D2. He can prepare a three-qubit state \(|\Psi \rangle _{BBA}=a|000\rangle _{BBA}+b|001\rangle _{BBA}+c|010 \rangle _{BBA}+d|100\rangle _{BBA}+e|101\rangle _{BBA}+f|110\rangle _{BBA}+g|011 \rangle _{BBA}+h|111\rangle _{BBA}\) with \(\vert a \vert ^{2}+\vert b \vert ^{2}+\vert c \vert ^{2}+\vert d \vert ^{2}+\vert e \vert ^{2}+\vert f \vert ^{2}+\vert g \vert ^{2}+ \vert h \vert ^{2}=1\), where subscript *A* denotes the qubits Bob sends to Alice and subscript *B* denotes the qubits retained by Bob himself. Bob retains two qubits of the quantum state and sends the remaining one to Alice, who performs *K* times \(R_{Z}(\frac{\pi}{4})\) on it and then sends it back to Bob. According to the number of \(R_{Z}(\frac{\pi}{4})\) gate performed by Alice, there are eight possible states in Bob’s position: \(|\Psi _{0}\rangle _{BBA} = (I\otimes I\otimes I)|\Psi \rangle _{BBA}, |\Psi _{1}\rangle _{BBA} = (I\otimes I\otimes R_{Z}(\frac{\pi}{4}))| \Psi \rangle _{BBA}, (I\otimes I\otimes R_{Z}(\frac{2\pi}{4})|\Psi \rangle _{BBA},\ldots, |\Psi _{7}\rangle _{BBA} = (I\otimes I\otimes R_{Z}( \frac{7\pi}{4}))|\Psi \rangle _{BBA}\). If Bob wants to distinguish among these eight states by joint measurements, the eight quantum states must be orthogonal to each other, i.e., \(\vert b \vert ^{2}+\vert e \vert ^{2}+\vert g \vert ^{2}+\vert h \vert ^{2} =0\). Thus, the three-qubit state prepared by Bob must be \(|\Psi \rangle _{BBA} = a|000\rangle _{BBA}+c|010\rangle _{BBA}+d|100 \rangle _{BBA}+f|110\rangle _{BBA} \). Obviously, the qubit that Bob assigns to Alice is not entangled with the two qubits that Bob keeps, thus Bob cannot know what operations Alice performed.

### Algorithm blindness of Protocol 2

Let *K* be the random variable which represents the number of single-qubit gates performed by Alice, *B* be the random variable representing the type of the POVM which Bob performs on the whole 3-qubit system, and \(M_{B}\) be the random variable which represents the result of the POVM. Bob’s knowledge about Alice’s measurement angles is given by the conditional probability distribution of \(K = k\) given \(B = b\), \(M_{B} = m_{B}\):

From Bayes’ theorem, we have

This means that Bob cannot learn anything about the number of operations \(R_{z}(\frac{\pi}{4})\) performed by Bob.

### Input blindness of Protocol 2

The preparation of the input state is included in the computational part. The input blindness of Protocol 2 is also guaranteed as long as the algorithm of Protocol 2 is blind.

### Output blindness of Protocol 2

Let *O* be the random variable which represents the output of Alice’s algorithm, *B* be the random variable representing the type of the POVM which Bob performs on the whole 3-qubit system, and \(M_{B}\) be the random variable which represents the result of the POVM. Bob’s knowledge about the output \(O = o\) of Alice’s algorithm is given by the conditional probability distribution of \(B = b\) and \(M_{B} = m_{B}\):

From Bayes’ theorem, we have the following result which shows Alice’s privacy about the output is guaranteed:

### Verifiability of Protocol 2

Among the output register qubits, there are both the actual output qubits that are the result of the computation and the trap qubits that are used to detect Bob’s honesty. We just need to select actual output qubits and trap qubits from the same set of qubits and Bob cannot distinguish between the actual output and trap qubits by the choice of measurement bases.

Suppose here the output and trap qubits are selected from \(\{|0\rangle , |1\rangle , |+\rangle , |-\rangle \}\). Alice instructs Bob on the choices of the measurement bases through the classical channel. If Bob disturbs the computation to produce a different output \(\rho '\) instead of \(\sigma _{q}P|\Phi \rangle \) or chooses different measurement bases to measure trap qubits, Bob may return incorrect measurement results at the locations of trap qubits. Without loss of generality, we assume that the probability of each trap qubit returning an incorrect measurement is *δ*, where \(0<\delta <1\). If the number of trap qubits is *k*, the probability *p* that Bob disrupts the computation without being detected by Alice is \(\delta ^{k}\). As long as *k* is large enough, *p* approaches zero.

## 5 Comparisons among typical ADBQC protocols

In this part, we compare the two proposed ADBQC protocols, namely Protocol 1 and Protocol 2, the existing ADBQC protocol proposed by Sueki et al. [48] in three aspects which are illustrated in Table 1.

From Table 1, it can be seen that the proposed ADBQC protocols have extended the existing ADBQC protocol in Ref. [48] which just deals with the users who have the ability to generate single-qubit states to be suitable for another two types of clients and offer greater flexibility for clients with different quantum capability participating in ADBQC. In addition, the introduction of trap qubits in the ADBQC protocols proposed in this paper not only hides the scale of the algorithm but also makes them verifiable, which ensures the security of the users participating in ADBQC and plays a great role in advancing the future development of the ADBQC model. Note that although the original ADBQC protocol proposed by Sueki et al. [48] did not consider the property of verification, the trap qubit technology used in the two proposed protocols also can be employed to make it be verifiable.

## 6 Conclusions

In this paper, two ADBQC protocols have been proposed for another two types of clients with different quantum capabilities. In Protocol 1, the user can perform ADBQC by only making Pauli-*X*, *Y*, or *Z* basis measurements. Protocol 2 requires the client to have the ability to perform single-qubit gates to achieve ADBQC with the aid of a server. If the quantum capability of the client needs to be further reduced, the double-server approach in MBQC [9] can be considered, which can reduce the quantum capability of the client to be totally classical. However, compared to the MBQC model, the computational efficiency in the ADBQC model is significantly lower since the number of entanglement operations that need to be performed is much higher than that are used in the MBQC model when performing the same algorithm. How to improve the computational efficiency of ADBQC protocols will be future work.

## References

David ED. Quantum computational networks. In: Proceedings of the royal society of London. A. mathematical and physical sciences. 1989. p. 73–90.

Broadbent A. Delegating private quantum computations. Can J Phys. 2015;93(9):941–6.

Zhang X, Weng J, Li X et al.. Single-server blind quantum computation with quantum circuit model. Quantum Inf Process. 2018;17(6):134.

Raussendorf R, Briegel HJ. A one-way quantum computer. Phys Rev Lett. 2001;86(22):5188.

Takeuchi Y, Morimae T, Hayashi M. Quantum computational universality of hypergraph states with Pauli-X and Z basis measurements. Sci Rep. 2019;9(1):13585.

Dunjko V, Kashefi E, Leverrier A. Blind quantum computing with weak coherent pulses. Phys Rev Lett. 2012;108(20):200502.

Morimae T, Fujii K. Blind topological measurement-based quantum computation. Nat Commun. 2012;3(1):1–6.

Tomoyuki T, Fujii K. Blind quantum computation protocol in which Alice only makes measurements. Phys Rev A. 2013;87(5):050301.

Tomoyuki T, Fujii K. Secure entanglement distillation for double-server blind quantum computation. Phys Rev Lett. 2013;111(2):020502.

Li Q, Chan WH, Wu C et al.. Triple-server blind quantum computation using entanglement swapping. Phys Rev A. 2014;89(4):040302.

Sheng YB, Zhou L. Deterministic entanglement distillation for secure double-server blind quantum computation. Sci Rep. 2015;5(1):7815.

Miller J, Miyake A. Hierarchy of universal entanglement in 2D measurement-based quantum computation. npj Quantum Inf. 2016;2(1):16036.

Anders J, Oi DKL, Kashefi E, Browne DE et al.. Ancilla-driven universal quantum computation. Phys Rev A. 2010;82(2):020301.

Proctor TJ, Kendon V. Minimal ancilla mediated quantum computation. EPJ Quantum Technol. 2014;1(1):13.

Jaksch D, Briegel HJ, Cirac JI et al.. Entanglement of atoms via cold controlled collisions. Phys Rev Lett. 1999;82(9):1975.

Majer J, Chow JM, Gambetta JM et al.. Coupling superconducting qubits via a cavity bus. Nature. 2007;449(7161):443–7.

Chou C, Hume DB, Koelemeij JC et al.. Frequency comparison of two high-accuracy al optical clocks. Phys Rev Lett. 2010;104(7):070802.

Yang B, Yang L. Effect on ion-trap quantum computers from the quantum nature of the driving field. Sci China Inf Sci. 2020;63(10):202501.

Xu G, Tong D. Realizing multi-qubit controlled nonadiabatic holonomic gates with connecting systems. AAPPS Bull. 2022;32(1):13.

Lau JWZ, Lim KH, Shrotriya H, Kwek LC. NISQ computing: where are we and where do we go? AAPPS Bull. 2022;32(1):27.

Price AB, Rarity JG, Erven C. A quantum key distribution protocol for rapid denial of service detection. EPJ Quantum Technol. 2020;7(1):8.

Li L, Li J, Yan C et al.. Quantum key distribution based on single-particle and EPR entanglement. Sci China Inf Sci. 2020;63(6):169501.

Li Q, Li Z, Chan WH et al.. Blind quantum computation with identity authentication. Phys Lett A. 2018;382(14):938–41.

Li C, Tian Y, Chen X et al.. An efficient anti-quantum lattice-based blind signature for blockchain-enabled systems. Inf Sci. 2021;546:253–64.

Qin H, Tang WK, Tso R. Hierarchical quantum secret sharing based on special high-dimensional entangled state. IEEE J Sel Top Quantum Electron. 2020;26(3):1–6.

Ju X-X, Zhong W, Sheng Y-B, Zhou L. Measurement-device-independent quantum secret sharing with hyper-encoding. Chin Phys B. 2022;31(10):100302.

Sheng Y-B, Zhou L, Long G-L. One-step quantum secure direct communication. Sci Bull. 2022;67(4):367–74.

Zhou L, Xu B-W, Zhong W, Sheng Y-B. Device-independent quantum secure direct communication with single-photon sources. Phys Rev Appl. 2023;19(1):014036.

Childs AM. Secure assisted quantum computation. Quantum Inf Comput. 2005;5(6):456–66.

Broadbent A, Fitzsimons J, Kashefi E. Universal blind quantum computation. In: Proceedings of the 50th annual IEEE symposium on foundations of computer science. 2009. p. 517–26.

Gheorghiu A, Kashefi E, Wallden P. Robustness and device independence of verifiable blind quantum computing. New J Phys. 2015;17(8):083040.

Hayashi M, Morimae T. Verifiable measurement-only blind quantum computing with stabilizer testing. Phys Rev Lett. 2015;115(22):220502.

Fitzsimons JF, Kashefi E. Unconditionally verifiable blind quantum computation. Phys Rev A. 2017;96(1):012303.

Morimae T. Measurement-only verifiable blind quantum computing with quantum input verification. Phys Rev A. 2016;94(4):042301.

Huang HL, Bao WS, Li T et al.. Universal blind quantum computation for hybrid system. Quantum Inf Process. 2017;16(8):199.

Hayashi M, Hajdušek M. Self-guaranteed measurement-based quantum computation. Phys Rev A. 2018;97(5):052308.

Morimae T. Verification for measurement-only blind quantum computing. Phys Rev A. 2014;89(6):060302.

Takeuchi Y, Morimae T. Verification of many-qubit states. Phys Rev X. 2018;8(2):021060.

Sato G, Koshiba T, Morimae T. Arbitrable blind quantum computation. Quantum Inf Process. 2019;18(12):370.

Shan RT, Chen X, Yuan KG. Multi-party blind quantum computation protocol with mutual authentication in network. Sci China Inf Sci. 2021;64(6):162302.

Zhang X, Luo W, Zeng G et al.. A hybrid universal blind quantum computation. Inf Sci. 2019;498:135–43.

Yang Z, Bai M-Q, Mo Z-W. The brickwork state with fewer qubits in blind quantum computation. Quantum Inf Process. 2022;21(4):125.

Sheng Y-B, Zhou L. Blind quantum computation with a noise channel. Phys Rev A. 2018;98(5):052343.

Li W, Lu S, Deng D-L. Quantum federated learning through blind quantum computing. Sci China, Phys Mech Astron. 2021;64(10):100312.

Barz S, Kashefi E, Broadbent A et al.. Demonstration of blind quantum computing. Science. 2012;335(6066):303–8.

Barz S, Fitzsimons JF, Kashefi E et al.. Experimental verification of quantum computation. Nat Phys. 2013;9(11):727–31.

Li Q, Liu C, Peng Y et al.. Blind quantum computation where a user only performs single-qubit gates. Opt Laser Technol. 2021;142:107190.

Sueki T, Koshiba T, Morimae T. Ancilla-driven universal blind quantum computation. Phys Rev A. 2013;87(6):060301.

Anders J, Andersson E, Browne DE et al.. Ancilla-driven quantum computation with twisted graph states. Theor Comput Sci. 2012;430:51–72.

Khaneja N, Brockett R, Glaser SJ. Time optimal control in spin systems. Phys Rev A. 2001;63(3):032308.

Popescu S, Rohrlich D. Quantum nonlocality as an axiom. Found Phys. 1994;24(3):379–85.

## Acknowledgements

This work was supported the National Natural Science Foundation of China (Grant Nos. 62271436, U1736113), the Science and Technology Innovation Program of Hunan Province (Grant No. 2022RC1187), the Natural Science Foundation of Hunan Province (Grant No. 2018JJ2403), and the Key Project of Hunan Province Education Department (Grant No. 20A471).

## Author information

### Authors and Affiliations

### Contributions

The main idea in this paper were proposed by Qunfeng Dai and the first manuscript was written by Qunfeng Dai and Qin Li. All the authors checked the correctness of the proposed methods and contributed to the final manuscript.

### Corresponding author

## Ethics declarations

### Competing interests

The authors declare no competing interests.

## Additional information

### Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

## Rights and permissions

**Open Access** This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.

## About this article

### Cite this article

Dai, Q., Quan, J., Lou, X. *et al.* Ancilla-driven blind quantum computation for clients with different quantum capabilities.
*EPJ Quantum Technol.* **10**, 16 (2023). https://doi.org/10.1140/epjqt/s40507-023-00173-2

Received:

Accepted:

Published:

DOI: https://doi.org/10.1140/epjqt/s40507-023-00173-2

### Keywords

- Blind quantum computation
- Verifiable blind quantum computation
- Ancilla-driven quantum computation
- Quantum entanglement