 He's a cross-program speaker. So Scott Aronson is, in fact, an old friend of PCMI. He's been here before. And I think he's somebody who almost needs no introduction. He's a great luminary in the world of quantum computation, AI, and a number of other things. And we're very pleased to have him give a talk about verifiable quantum supremacy. Can you hear now? All right, can you hear? All right. So thank you for inviting me. Let's see. So I am currently on leave from quantum computing for a couple of years working at OpenAI on how to stop the robot apocalypse, which I haven't figured out how to do that. I did ask Dali for his insights about verifiable quantum supremacy. And it came up with this image here. I'm not sure if there's any insight there or not. But basically, what I want to do in this talk is tell you about quantum supremacy or advantage experiments, what's been accomplished over the past four or five years, and in particular, with demonstrating the possibility of a real quantum speedup on a NISC, noisy intermediate scale quantum device, one that is not a full error-corrected quantum computer like we heard about in the last talk. And then I want to tell you, what are the shortcomings of these experiments? Why are we not satisfied with them? And what remains to be done? What I hope will happen next. And if I'm too busy trying to stop the robot apocalypse, then I hope that the truly important problems, like these, of designing better sampling-based quantum supremacy experiments, can be taken up by one of you. And so I'm offering a research program free of charge for anyone who would like it, basically. So I don't actually have many slides, so feel free to interrupt me if anything is not clear. I mean, I know that this is a diverse audience in terms of people's backgrounds, so feel free to interject. OK, so you've all heard something presumably about quantum supremacy experiments, which a lot of people have switched to calling them quantum advantage experiments for various reasons. I might use the two terms interchangeably. But so what is the idea here? So since the 1990s, we have known that of certain quantum algorithms, such as Schor's factoring algorithm, that seem to get exponential speed-ups, at least compared to any currently known classical algorithm, for certain very specific problems, in the case of Schor's algorithm factoring integers and taking discrete logs. But these algorithms generally seem to require a fault-tolerant quantum computer, so one that is constantly doing error correction to cope with the unwanted interaction between the quantum computer and its environment. And to do error correction by any known method seems to require hundreds or thousands of physical qubits for every logical qubit that you are trying to simulate. So if you wanted to run Schor's algorithm, let's say to factor RSA 2048 beyond what classical supercomputers could do in a reasonable time with any currently known algorithm, then it seems like you would need thousands of logical qubits, which then translates into millions or hundreds of millions of physical qubits. And maybe someday that will happen. Maybe there will be a Manhattan Project to build that. I understand that there was a PCMI show of Oppenheimer last week. It'll be a lot harder to keep secret this time, I think. I think that if you try to do the Manhattan Project today within about 15 minutes, what is happening in Los Alamos would be trending on Twitter. Excuse me, on X, yes. But OK, with enough effort, maybe you could build that. But that is not where we are now. And so maybe 12 or 13 years ago, some of us started asking the question, well, suppose you want to use a noisy device, a non-corrected, non-fault tolerant, maybe not even universal device, but such as might be available within the next decade or so. And your goal was to do something, a some well-defined task, much faster than any known classical method could do that task. Now, notice that I did not say a useful task. That's not part of what we're aiming for here. And I feel like part of the problem when there is all this press about quantum computers speeding up finance and vehicle routing and industrial optimization, I mean, it really gives people the impression that quantum speed-up is a done deal, and now we just have to get all the commercial value out of it. When actually the core scientific question, just can we beat a classical computer in a fair comparison for anything at all? Even that is still, I think, still not experimentally demonstrated or not clearly enough. And that is still true even today. But at least on that scientific goal, we've managed to make some progress. So how was that done? So if your only goal is to do something faster with a quantum computer and you don't care about whether it's useful, it turns out that a key thing that you typically want to do is to switch attention from problems with a single right answer, like factoring, to sampling problems. A sampling problem is one where the desired output is a sample from a certain probability distribution. So even if your quantum computer is running perfectly, it might never produce the same output twice in its whole lifetime. It'll generate a different output every time and now verifying whether the quantum computer is working correctly, well, that'll be a key question. But it'll be something statistical that we'll need to do to say, are these a reasonable set of outputs that have been generated? So actually, there was a very, I think, prescient early work in that direction by Tarhal and Divincenzo in 2004 on constant-depth quantum circuits. Barbara Tarhal is here, I think, somewhere here. But so around 2010 or so, I guess independently, Bremener, Joseph, and Shepard, and me and Alex Arkhipov started thinking about different ways that you might achieve this with near future quantum computers. And what we both found was that there were at least two advantages to switching your attention to these sampling problems. The first advantage is that the problem that you're solving can be much, much closer to the native hardware. The analogy that we used in our paper was if you wanted to prove that a dolphin is smart, you might be able to laboriously teach it arithmetic, teach it to simulate solving some puzzle. But actually, it would be much easier to just watch it in its habitat doing whatever dolphins do. And so likewise, rather than teaching a quantum computer to do modular exponentiation, maybe if we just want to see that it is hard to simulate with a classical computer, it will be easier to just apply a more or less random sequence of gates and just sample from the resulting distribution and then argue that a classical computer would have taken a long time to do the same thing. And that brings me to the second point, which is that we were able to give evidence that at least the exact versions of these sampling tasks really are hard for classical computers. We could show that if there were a fast classical algorithm that could sample from exactly the same distribution that the ideal quantum device would sample from, then the polynomial hierarchy would collapse to the third level. Now, if you don't know what that means, you could take my word for it that it's bad. But if you know that the P versus NP problem, it's sort of like P equaling NP, but just sort of at a higher level up, where we wouldn't quite notice it here on Earth. But in the heavens, they would notice it. So in the present state of complexity theory, that's close to the strongest kind of evidence that we hope for, that anything is hard. So the proposal by me and Arkhipov was called boson sampling. And all we said to do is generate a bunch of single photons, send them through a network of beam splitters and phase shifters, what are called linear optical elements, and then measure where they end up. So have an array of photo detectors that measure how many photons there are in each output port. And since this is quantum mechanics, the answer will be a sample from a probability distribution. The photons could end up in a different place each time. But the task is just precisely to simulate what the device does. And now the key fact that we relied on is actually something that I learned from Avi Wigderson back in 2000, when I was just starting as a grad student. And he said, it turns out that there are these two really central functions in computer science of matrices, the determinant and the permanent. And it turns out that if you have n, and there are two very basic types of particles in the universe, fermions and bosons. And it turns out that if you have n identical fermions, and you want to know what is the amplitude for them to go from some input state to some output state, and they're not interacting, then you have to calculate the determinant of an n by n matrix. And if they're bosons, then you have to take the permanent of an n by n matrix. And now in computer science, we know that these two functions, I mean they're almost the same in their definition. They differ just because the determinant has minus signs, and the permanent does not. But they differ dramatically in computational complexity. The determinant is computable in polynomial time, for example, using Gaussian elimination. The permanent was famously proved by Valiant in 1979 to be sharp P complete, which means at least as hard as any combinatorial counting problem, like computing partition functions or things like that. OK, so now, you know, I'm avi. I remember remarked on how unfair it was that the permanent, sorry, that the bosons have to work so much harder than the fermions just to calculate their own time evolution. And that joke kind of stuck with me. And like it might make you wonder, are bosons in some sense solving a sharp P complete problem, which we believe is even harder than an NP complete problem, just to calculate their own evolution? But you have to be careful. And the subtlety is that, well, if you measure a bunch of photons or other bosons, you just see them in one particular place. You never get to actually see the amplitudes directly in quantum mechanics, which means that you never actually get to see the permanent of some matrix of your choice. And so nature is more subtle than just giving you the answer to your sharp P complete problem. What it lets you do, in some sense, is to sample a random matrix, say, a random N by N complex matrix. But in a way that is biased toward those matrices that have larger permanence. And so then what we did was to argue that even that task seems to be hard for a classical computer, not sharp P hard, but one can use the sharp P hardness of the permanent to say that even if you had a fast classical sampling algorithm, that would still have unlikely consequences. Now, if your classical simulation is only approximate, then the discussion gets complicated. You have to make some stronger conjectures than just that the polynomial hierarchy or whatever does not collapse. And the status of those stronger conjectures is still open, I would say, like more than a decade after we posed them. But it seems like you have pretty robust evidence for the hardness of these sampling problems. And I should mention that a Boson sampling machine would not be a universal quantum computer, we don't think, or even, for that matter, a universal classical computer. We don't even know how to build an AND gate or a CNOT gate using just these passive linear optics. If you have adaptive measurements, then it does become universal for quantum computation. That is the famous Canilla-Flam Milburn, or KLM theorem. But without that, you have a model that in some ways seems very, very weak. And yet it can sample these distributions that it seems that there's no classical polynomial time algorithm to sample. So we proposed this, and we were led to this not by any God knows, by any knowledge of experimental physics, but mostly just because we knew that something about the permanent and its sharp peak completeness, and we had heard that Bosons give rise to permanence and their amplitudes. So maybe one can do something interesting with Bosons because of that. But then after we started talking about it, we found that the quantum optics experimentalists had been sort of looking for something to do, and they just kind of ate this up. And so initially, in 2013, they did experiments with three photons verifying that, yes, their amplitudes look like permanence of 3 by 3 matrices. Obviously, that's not in any way challenging a classical computer yet. But then they scaled up to, I think, five or six, and then 14 photons. And then in 2020, so during the pandemic, actually, the group of Chaoyang Liu at USTC in China reported that they had done boson sampling with about 50 and then 100 average photons detected. Actually, they did a variant of it called Gaussian boson sampling. And this seemed very hard to simulate with a classical computer. We're going to come back to that question because a recurring theme is that often because of all of the shortcuts that have to be made or the corners that have to be cut in order to do these experiments at all, often they turn out to be much, much easier to simulate on a classical computer than you would hope. And in this case, a big issue with current boson sampling experiments is that something like 70% of the photons get lost on their way through. And the more photons are lost, the better classical simulations can work. Now, even before that, actually, Google had beaten them to the punch with a different kind of quantum supremacy demonstration. So basically, in 2014 or so, Google hired John Martinez, who is one of the top superconducting qubits people in the world to build a group that was going to build like a 50 or 60 or 70 qubit superconducting chip, which would go into a dilution refrigerator. That's that upside down wedding cake over there. And be cooled to about 10 millikelvin so that the qubits in it actually behave as qubits. And then you have 50 or 60 qubits arranged, let's say, in a rectangular lattice with controllable nearest neighbor couplings. So you can do two qubit gates between the neighboring pairs. And now they face the question, well, once we build this, what should we do with it? And they looked around, and the only thing that seemed like you could be pretty confident that it would be a classical computer was, well, something like boson sampling. But their system was not designed for bosonic excitations. It was based on superconducting qubits. So they asked us, can you just adapt the theory to that setting? To, let's say, applying a random quantum circuit to a collection of qubits, that will be easier than spending 100 million or whatever to redesign the experiment. So we said, OK, we'll do that. We are indeed cheaper. And so then Liji Chen and I had some work, evidence for the hardness of simulating that in 2017. And then in 2019, they reported that they had actually done this experiment using a chip called sycamore with 53 qubits. Actually, 54, but one of them didn't work. And they sampled repeatedly from some probability distribution over 53-bit strings. And at the time, they estimated that the best classical algorithm that they knew running on a supercomputer would take 10,000 years to produce the same samples. And then that number got endlessly repeated in the press. But the fundamental problem, you could say, with quantum supremacy experiments is that you can't take any of those numbers too seriously. Because then people will think about it more. And they'll say, oh, actually there's a better classical algorithm. And the time will be whittled down, let's say, to a few weeks. And then if you can do something classically in a few weeks and quantumly in three minutes, OK, well, then maybe that's still a quantum advantage. But that's less than you thought. And then you say, oh, but actually if I just spend more money to use more and more cloud resources, then I can just parallelize my classical effort. And if I spend enough money, I can do that in two minutes. I can do that faster than the quantum computer. And now we have to say, well, OK, I guess time is not the only resource we care about. Maybe we also care about electricity costs. Or we care about CO2 emissions or whatever. And by those metrics, I think, compared to the best current classical algorithms, we still have some kind of quantum advantage. But maybe it's a factor of 100 or so. It is hanging by a thin thread. So that already kind of indicates the need for doing better experiments. And this is before we're even talking about anything useful. This is just establishing the reality of any quantum speed ups at all. But I think the issue is even, and the hardware has improved. And USTC has also done superconducting experiments with 60 qubits and the two-qubit gate fidelities, which is maybe the most important number. Those have improved since 2019. And you could do a better quantum supremacy experiment today. Most of the major labs seem to have moved on from this. They seem like they feel like this is a done deal. Now it's just fault tolerance or bust. I want to make the case to you that this is not a done deal. Yeah. Yeah, well, this was Richard Borchards who had that metaphor. And I had a blog post to sort of, I mean, he was treating that as a reductio ad absurdum, basically, of this entire approach. So the point of my blog post was to explain why his analogy doesn't really work. Basically, what I said was that what you want to know is sort of that the difficulty has to do with some sort of asymptotic scaling. You want to know that there is something that is sort of increasing exponentially with the size of your problem. In the case of the T-cups, the issue seems to be merely that, well, OK, number one, there's an issue of Avogadro's number, that you have this large but constant number of particles. And maybe a simulation would have to keep track of all of them. And the best computer to simulate the dynamics of your T-cup really is just the T-cup itself, which you think of as an analog computer. You drop it. And actually, I tried it at home with my kids. We dropped a bunch of T-cups, and we plotted a distribution of how many pieces. I mean, it was very ambiguous what counts as a piece, because they get really, really tiny. But we tried to count how many pieces and see if we could learn something about the distribution. But the other difficulty there is that a large part of the problem is just that you don't have sufficient knowledge of the initial state. It's just that you don't know the initial conditions. Whereas here, what we're trying to put our finger on is that you can know with, for example, the Google Quantum Supremacy Experiment, you can know the initial conditions perfectly. You can know the circuit perfectly. And yet it would still be exponentially hard to generate the samples for a completely different reason than in the T-cup case, right? Not because of chaos and the initial conditions, but because of the exponentiality of the Hilbert space, right? So that's kind of the difference between the cases. And it is not the same as, but it's related to the fact that these are programmable devices, right? You can return your qubits to the old zero state and then you can return to applying the same circuit that you did before, right? Up to small inaccuracies and calibration, but those small inaccuracies are not the reason why it's hard to simulate, right? The reason why it's hard to simulate is just the enormous size of the quantum states. All right, so to say it in a little bit more detail, the random circuit proposal is basically that you, the classical skeptic, challenge a quantum computer by sending it a randomly generated quantum circuit, call it C, on some number of qubits N, and then you demand that the quantum computer send back to you quickly a list of samples, call them S1 up to SK, which in the ideal case, would be drawn independently from probability distribution that I'll call D sub C, okay? Which is just whatever distribution you get by starting with all qubits in the zero state, applying C and then measuring each of the qubits in the zero one basis, okay? So there's this sort of tricky conceptual distinction here, which is that the problem is not simulate this device or simulate the physics of this particular device. If that was the problem, then by definition, the device could never get it wrong, right? Just like when you drop the T cup, right? It never fails to simulate that T cup, right? But instead, we are giving a mathematical specification of what we want, okay? Such that you could easily imagine that the quantum device would fail to solve the problem, right? The fact that the quantum device correctly solves this is itself something that has to be experimentally checked. Okay? So you get K samples. So imagine that N is 53 here. Imagine that K is a few million, let's say, okay? The nice thing about superconducting qubits is that they're very fast and you can get each sample in something like, you know, 40 microseconds, okay? So in a few minutes, you can get millions of samples. Now, what does the random circuit look like? Well, basically, you know, it has these two qubit gates which are staggered in such a way that every qubit can influence every other one, right? So we want, you know, scrambling to happen, which means, you know, we need horizontally and vertically adjacent qubits. You know, we need them in a pattern where information is getting across. And in Google's experiment, the depth of the circuit was 20, okay? So, you know, there's sort of, you know, enough time for every qubit to send a message to every other, although, you know, not with a whole lot of room to spare. And now we face the really crucial question, which is once you've measured and you've gotten these outputs, how do you verify that the quantum computer did anything interesting? So what Google did was, you know, one of the simplest things that you could imagine, which they called the Linear Cross Entropy Benchmark, or LXEB, okay? Even though it's not really about entropy at all. I don't know why they called it that. Okay, so, but here's what it is, okay? So you, using your knowledge of the circuit C and using a classical computer, where, you know, which is assumed to, you know, be able to do two to the n classical computation. And, you know, we'll come back to that point. Okay, you calculate what would have been the probability for an ideal quantum computer to have outputted each of the samples that you saw, okay? That's these squared matrix elements there, okay? And you do that for each of the S sub i's that was observed, okay? And then, you know, that gives you the sort of predicted probability for each of the outputs that you observed, and then you add all those numbers up, okay? And, and then you, you consider the quantum computer to have passed the test, if and only if that sum exceeds a certain threshold, okay? So what's going on here? Well, if we imagine that you just picked the S sub i's uniformly at random, just, you know, with, you know, not needing a quantum computer at all, then we would expect that, you know, since these probabilities have to add up to one and there's two to the n of them, you know, on average they're gonna be two to the minus n, right? And if so, if I add up k of them, then I would get k over two to the n. That would be my expected value for this sum, okay? But if the quantum computer is really working properly, then the sum ought to be larger than that, okay? Why? Because, well, you know, the outcomes with the higher probabilities should be occurring more frequently, right? That's what it means to be, you know, doing sampling in the correct way. So how much larger should it be? Well, if you do the calculation, you find so, so the amplitudes can be approximated as just independent complex calcians with means of zero, which means that the probabilities can be approximated as exponentially distributed random variables. So like, you know, on average they're two to the minus n, but they have little wiggles in them. Some of them are two over two to the n, or three over two to the n, or a half over two to the n. They're, you know, exponentially distributed. And if the quantum computer is working right, you should be preferentially seeing the heavier ones. And, you know, and so what should be the expected value of this sum? Well, it's an integral, which, you know, even I, as a computer scientist, remembered how to do. And the answer you get is two over two to the n. So precisely twice the classical value, okay? And so now you have a situation that's very closely analogous to the Bell inequality, okay, for those who have seen that. It's like you have some number where, you know, you believe that any classical theory could achieve at most a certain number, and an ideal quantum device would achieve some larger number, right? And the goal with your experiment, well, your, you know, your device is not ideal, so you're not gonna achieve that larger number. In this case, two, you know, a b equals two in that expression there. Your goal is just to get any value of b that is larger than one, right? That beats what you expect is the classical bound. And what Liji Chen and I did was precisely to give some complexity theoretic reduction, you know, admittedly based on a non-standard assumption that said that, you know, it is unlikely that a classical algorithm, that an efficient classical algorithm could generate samples with a b value grade that is anything bounded above one, okay? So what did Google report in its 2019 experiment? Well, they reported, you know, drumroll, that they achieved a value of b that is 1.002, okay? But the good news was that, you know, this was like separated from one by like, you know, you know, 20, you know, sigmas of, you know, standard deviation or something. So, you know, while it was only a tiny bit more than one, it definitely was more than one, okay? Yeah. I mean, it is the simplest test that I could think of also. Well, we had this in the paper with Liji. We used something else called a heavy output generation, hog, but, you know, that one, like it involved this like two thresholds, whereas here you only need one threshold. And so, you know, actually once I saw this test, I was like, yeah, this seems simpler. And actually I had an analysis of, you know, like, you know, how to generate certified random bits from quantum supremacy experiments that was just in stock a month ago. And like for that application, for example, like you really, you know, this test is really the thing that you want, right? It's, you know, it leads to the, by far the simplest analysis. So that's one thing that made me warm on this test. But I don't know, I mean, you know, if you want to suggest a different test, you know, I don't think the actual choice of test matters all that much, yeah. Yeah, I think, you know, because they realized that like you don't actually have to calculate entropy. Like that's not, you know, you just want kind of the simplest thing that's going to differentiate the quantum sampling from classical sampling. And that just calculate all the probabilities and add them all up. So, yeah, I mean, you know, we're gonna see, like, what are the drawbacks of this whole paradigm? But I think that, to be honest, that the drawbacks would apply equally to this linear cross entropy, or to just about any other similar test that you could come up with. If there's a counter example, then I'd love to hear about that offline. Okay, so that brings me to, well, what is wrong with the current experiments? Okay, so, you know, of course, you know, we don't, you know, these qubits are just the bare physical qubits. They are not error corrected at all. And because they're not error corrected, you know, we are extremely limited in what can be done. In Google's experiment, each two qubit gate had a fidelity of about 99.5%, okay? And that's, you know, that's amazing compared to what was achievable 10 or 20 years ago. But it still means that if you apply 1,000 two qubit gates in sequence, well, your total circuit fidelity is gonna go like 0.995 to the 1,000 power, or something like that, right? So, your signal gets sort of exponentially attenuated as you scale the system up. Now, you know, and this is the reason why they only got an LXCB score of 1.002, right? It's just because, you know, now, maybe scientifically, the most important thing that we learned from the Google experiment was that the circuit fidelity seems to only decrease in that way and not in any worse way, okay? So Gil Kallai, who some of you might have seen as a, you know, prominent skeptic of quantum computing, you know, he went on the record with a firm prediction that, you know, there are going to be some sort of conspiratorial correlations between all the gates and, you know, the errors will not be anything like independent, okay? That prediction was tested and in these experiments, it was wrong, okay? And so, you know, Gil now in his latest papers is saying, you know, basically, you know, this is impossible and he doesn't quite say, you know, that the experiment was fraudulent, but he sort of leaves that as the only possible conclusion. So, but, you know, now USTC has also done this kind of experiment. So, you know, I think, you know, that, you know, that position might become increasingly difficult for him. But in any case, you know, you know, with the errors falling off in that way, I mean, that's sort of good news because it means that if you could increase your two-qubit fidelity to something like 99.99%, then quantum error correction ought to work. You know, for the, you know, we have, we know of, you know, the surface code or other fault-tolerance codes that seem like they then ought to work. But in the meantime, you know, before we can get to fault tolerance, it means that there's sort of no hope of scaling these experiments up to hundreds of qubits or, you know, thousands of gates because the signal will just be too tiny to detect. Like, the distribution that we're sampling from basically will get, you know, exponentially closer and closer to the uniform distribution, okay? And then, you know, the deviations from uniformity will get tinier and tinier and, you know, we'll need exponentially many samples in order to even notice those deviations. You know, and then there goes any hope of a quantum speedup. Okay, but, you know, the even more immediate problem is that, you know, there are taking advantage of the fact that the gates are spatially local, you know, in superconducting qubits or in the case of Boson sampling that many of the photons are lost. Okay, so taking advantage of the imperfections of the existing experiments turns out to allow classical simulations of these experiments, spoofing attacks that are much more efficient than we would like. Okay, so some of the main attacks, Pan-Chen and Zhang have shown how to do tensor network contractions where, you know, as I said, it just, you know, if you wanna do it on a classical computer, faster than the Google experiment, it just comes down to a question of money and electricity at the end of the day. And there's another classical algorithm by a Gal et al, which is actually polynomial time, so it just runs on a laptop, and it achieves a linear cross entropy score with Google's parameters that's like 1.0002. Okay, so it gets about one-tenth of the excess that Google got in its experiment. So, you know, you can see the experiment is still winning, but only by one order of magnitude, right? If they improve their algorithm, then, you know, the quantum advantage could just go away entirely. Okay, but none of this even gets to what I see as the most fundamental issue, which is that, you know, in order to verify the results of these experiments at all, we had to calculate this linear cross entropy number with our classical computer, and that took two to the end time, right? Classic, or, you know, you could say the time that is needed for verification is directly tied to the time that a classical person would need to spoof the results, right? They both involve sort of calculating, you know, the same basic numbers, right? And so what that means is that there is no hope of scaling these experiments who just completely beyond the range where any classical computer could hope to compete, like where it really would take, you know, billions of years or whatever, because if we went to that range, then we couldn't even verify that the experiments were doing what they were supposed to do, right? So, you know, now Shor's algorithm doesn't have this problem, right? You know, because the factoring problem is in the complexity class NP, right? If you, you know, it might be very hard to find the factors, but once you've found them, they're easy to multiply, and actually also easy to check that they're prime. But, you know, with these experiments, the difficulty of classical spoofing seems directly tied to the difficulty of classical verification. And that is what I want to get around while remaining, you know, in the realm of things that we can implement on current quantum computers, okay? So, this one slide here kind of summarizes how I think about the present situation in quantum algorithms, okay? There are basically three goals, three things that we want our quantum speed up to achieve. The first is that it should be niskey, okay? That's not a technical term, but it should be implementable on current devices, or current or near future devices, okay? And roughly speaking, anything that involves doing, you know, arithmetic on superpositions over integers that are encoded in binary as ensures algorithm or as in all sorts of recent cryptographic protocols is not niskey, okay? That, you know, we have no hope of doing any of that with current devices, okay? Something that looks more like a random circuit or maybe like some physics simulations, that has a chance of being niskey. The second thing we want is of course, at least in principle, there should be a quantum advantage compared to the best known classical algorithm, okay? Both, you know, concretely, you know, in terms of like actual numbers, you know, with our device compared to the best classical computers, but also asymptotically, right? We want to see that as we scaled to more and more qubits that, you know, ideally we're beating the best classical algorithm by an exponentially scaling amount, right? We don't want to be in the T-cup situation. And then the third requirement, as I said, is that we ought to be able to efficiently verify the outputs of the experiment using our classical computer, okay, without having to take classical exponential time as with random circuit sampling, okay? And I would say that the current situation is that we know how to achieve any two of these three goals. Okay, so if you want something that's niskey and that's efficiently verifiable, I mean the whole field of quantum machine learning, right? And like these optimization methods, like QAOA and VQE, right? These are all giving you candidates for that. Okay, the trouble is despite thousands of papers that have been written now about these kinds of heuristic optimization algorithms, we still have no clear case that any of them are beating a classical computer in a fair comparison, okay? For any optimization or machine learning problem, right? And, you know, until that question is addressed head on, it doesn't matter how many more papers are written about these algorithms, right? Okay, if you want in principle quantum advantage and efficiently verifiable, I mean that goes back to the beginning of the field, Schwarz's algorithm is a candidate for that. But there's also a whole bunch of recent cryptographic protocols for, you know, verifying, you know, for proving what a quantum computer is doing to a classical skeptic. Some of you might know that Armola Mahadev had a big breakthrough in that subject five years ago. And there's a bunch of related works by Norm Yao, Greg Kahanumoku Meyer, Umesh Vazharani, and many others, which have shown, you know, like, you don't necessarily have to do the modular exponentiation function on a superposition of inputs. It would be enough to do x squared mod n, you know, on a f of x equals x squared mod n on a superposition of x's. And then you can use that in a cryptographic protocol to prove quantum advantage, which has, you know, they have this beautiful argument that I loved at first sight, where here's what they say. They say, look, either, you know, you can't break, you know, this cryptosystem of like squaring modular composite number, either, you know, that cryptosystem is secure and you can't break it. And in that case, their protocol is sound and, you know, you prove quantum advantage to the classical skeptic, or else the cryptosystem is broken. And in that case, you've proven quantum advantage in a completely different way. Right, by, you know, doing, you know, you presumably did something like Shor's algorithm. Okay, so, okay, and then if you want something that's both Niskey and that gets an in-principle quantum advantage, but that's not efficiently verifiable, then that's exactly the current generation of sampling-based quantum supremacy experiments, such as random circuit sampling and boson sampling. Okay, so the challenge, obviously, is to get to the center of this Venn diagram, either by starting with these heuristic optimization methods and getting, you know, a clear quantum advantage out of them, or by starting with these, you know, cryptographic protocols or things based on lattices and number theory and figuring out how to implement one of them on a NISC device. You know, good luck with that. Or, you know, and this is the direction that I've personally thought about the most, starting with the kinds of quantum supremacy experiments that we know how to do, and then figuring out a way to make their outputs efficiently checkable with a classical computer. Okay, so how might we achieve that third arrow? So I wanna give you, so I don't have an answer. If I had the answer, then that's what the talk would be about. Okay, but I'm at least gonna give you a pretty clear open question that I think directly bears on this. Okay, so here's my open question. So given a quantum circuit C, let me define C to be peaked. If it has the property that when you run C on the all zero initial state, and then you measure the output in the standard basis, there is some particular basis state, call it X, that occurs with a really large probability. By really large, let's say we mean at least a tenth. Okay, now we could generalize this definition. To the output state of C having any properties at all that we can feasibly detect by measuring that state, like better than just by running C inverse, and seeing that we get back to the all zero state, more efficiently than that. I wanted to have some property, it could be in the Hadamard basis, it could be biased in some way that is easy for us to detect. Okay, that's what I want. Okay, and now I'm gonna imagine the following thought experiment. Okay, we're going to pick a random quantum circuit, just like in the quantum supremacy experiments, with let's say N qubits and some number M of gates. Let's say M is N squared, or at some other polynomial in N. Okay, but now we're going to throw out the circuit unless it is peaked. Okay, we're going to condition on the event that our random circuit is peaked. Okay, so now we have a random peaked circuit. And now my question is what can we say about these random peaked circuits? What do they look like? Okay, and let me give you two extreme possibilities, neither of which I know how to prove as impossible. Okay, the first extreme possibility would be that a random peaked circuit just looks like a whole bunch of random gates followed by the inverses of those gates. Right, so if I have U and then U inverse, well of course that is peaked because it just computes the identity. Which means that the all zero string will have a probability one of being output. So, or more generally, the random peaked circuit could be such that when I do a whole bunch of cancellations with my classical computer, I reduce the circuit to something trivial, right? And like I easily see with my classical computer that this is a sort of trivial circuit, not hard to simulate. Now the other extreme possibility would be that a random peaked circuit is indistinguishable by any efficient classical algorithm from just a fully random quantum circuit, right? They look identical to any classical test that I can apply. And nevertheless, I can take the peaked circuit, put it on my quantum computer, and then I'll see the difference, right? I'll see that there's some output that it's producing at least a 10th of the time, okay? So in this second case, I think that what we would have established would be that the kinds of quantum circuits that we want for verifiable NISC quantum supremacy at least exists, okay? We still would not have answered the question of how to find those circuits efficiently, right? We would still have that problem, but at least the circuits would platonically be out there, okay? You know, circuits that sort of look random, look like the things that we can run on current devices, but secretly that are obfuscatedly, they are concentrating the amplitude on some particular output that we can recognize at the end. Okay, and one can ask a whole bunch of related questions. So here's one of my favorites. Given an N qubit, M gate, a random quantum circuit, let's say that you get to add more gates onto the end of that circuit, okay? In order to get an overall circuit that is piqued. Okay, then how many more gates must you add, okay? So I claim a clear upper bound here is M, right? You know, if you can add M more gates, then you just add, you know, the inverse of the random circuit, and then of course you have something piqued. Hey, but can you do it with substantially fewer than M additional gates? Even let's say what, with M over two additional gates. Now using recent results about random quantum circuits, you know, giving you T designs, it is possible to prove that the number of gates you have to add is at least like M to the one fifth power or something like that, okay? But that's, you know, that leaves an enormous room between the upper bound and the lower bound. One could also ask, you know, what fraction of quantum circuits are piqued? Again, I have upper and lower bounds, which are pretty easy, but which are far from matching each other. And then of course how hard is it to sample a random piqued circuit? Or what about a piqued circuit that is hard to distinguish from random, okay? That looks random. So I did work with a recently graduated student at UT named Yuxuan Zhang, and we have at least some preliminary empirical data, okay, albeit not a theorem. So what we did is we generated random quantum circuits with different numbers of qubits, you know, eight, 10, 12, and so forth. That's the x-axis. And then we looked at, we fixed some number of gates, you know, let's say, you know, the random circuit has maybe 100 gates. And then we try to add either like 50 or 33 or 25 gates onto the end of that circuit to get an overall circuit that is as piqued as possible, okay, and we just use local search, you know, we use like a heuristic optimization to try to search for the circuit that is piqued. And so what we found is that, you know, actually much more piqued circuits than I would have guessed exist, okay? So we find, for example, when there are 12 qubits, you know, you can take 100 random gates and you can add 50 more gates onto the end of it. And, you know, and you get, you know, like some output that's occurring with probability a quarter, okay? How is that happening? I don't know. You know, if the, if our 100 gate circuit, you know, if it had instead generated a hard random state, then it is easy to check that this would not have been possible, okay? Which means that whatever the last 50 gates are doing, they are exploiting some sort of structure in the output of our 100 gate circuit that is not shared by a hard random state, okay? But what is that structure? We have no idea. We've examined the circuits, you know, they look random to us. We don't see any pattern. And yet clearly there is something, right? They, you know, they end up, okay, that's the good news for verifiable NISC supremacy. The bad news is that the amount of piquedness that we're able to find seems to be decreasing exponentially with the number of qubits, okay? So it might be that there's a surprising thing here. You know, maybe even usable at the level of 50 qubits or 60 qubits, but at least from the numerical data, it's not looking like it would scale to hundreds of qubits. But, you know, again, we don't know or maybe our solver is just not working well enough. So what if the suitable piqued circuits just don't exist or they do exist but they can't be found efficiently? You know, I heard just a month ago, I heard a really cute idea for another type of quantum supremacy experiment that we can do, which is that we could just take the standard random circuit sampling experiments and run over and over, you know, until we start seeing collisions, right? Which that should not take two to the end time because of the birthday paradox. You know, 23 people in a room is enough to make two have the same birthday. Likewise, we should only need to order two to the end over two samples until we start seeing collisions. And with those collisions, we could start doing statistics that can differentiate or the distribution that we're sampling from the uniform distribution. So, you know, with Andrea Mari, we ran some numbers and it looks like you might be able to do this by taking the current superconducting devices and just running them for like a few months. That, you know, maybe that's worth doing, I don't know. So, let me conclude. You know, like, you know, in some sense, the real question I'm trying to ask here goes all the way back to the beginning of quantum computing theory. Okay, we're asking sort of how generic are quantum speedups? You know, you know that, you know, Schor's algorithm can give you a speedup for this very special problem. You know that a random circuit can give you a speedup in some sense, but it's, you know, it might take you exponential time just to verify that you achieved the speedup, right? So, can you get the best of both worlds? Can you have a circuit that looks basically random and it nevertheless, you know, choreographs a pattern of interference, you know, in a way to achieve a huge and verifiable speedup over any classical algorithm? Or is there some law of conservation of weirdness that says that like any quantum speedup, if you want it to be exponential, you know, it has to be for some really weird task with some really weird circuit and there's no free lunch. So, you know, we now urgently need to know just how non-weird can we make it. All right, so thanks. Thanks very much, Scott. So we have time for a few questions, comments. Yeah, please. Oh, yes. Why? Well, because I can't rule out the possibility that there might be interesting physics simulations, which in this case might be verifiable not because the problems are in NP, which is, you know, the computer science reason, but rather for the physics reason that we could take the output of our quantum computer and compare it to experimental reality. Like, you know, for estimating the rate of a chemical reaction, we can compare that to the, you know, data from the lab. What is the rate of that chemical reaction, right? And we can validate the results of our physical simulation in that sort of way. You know, that's the hope, anyway. You know, the big question is whether you can do that with a NISC device and in a way that actually beats the best that you can do with a classical computer. Some of you might know that IBM tried to do that recently, but it turned out not to be beatable by classic, I mean, it turned out rather to be not to be unbeatable, to be beatable, but. Good, anything else? Yeah. Thank you. I want to follow up on the random circuit sampling. And I wonder when you and your student were doing these experiments, do you do the Clifford Plus T random circuit sampling or some very special class of quantum circuits? Let's see, I'm trying to remember which basis of gates we used. Yeah, I mean, my guess would be that it doesn't matter very much, but, you know, it's possible that it would matter. I think that, I think it was like C knots in random one qubit gates, but I could check that and get back to you. Right, the reason I'm wondering this is, so in some cases, a restricted set of Clifford Plus T circuits is also very interesting. For example, the Toffley-Hagmar circuits, because they correspond to some very nice group structure that we could leverage. So I wonder, is it possible in order for us to understand about this problem of peak circuit, is it possible to look at it from a number of theoretic perspective and say, well, I want to get this group element like from, let's say, the orthogonal matrix over diatic fractions. Then how far am I from this current matrix to this one specific matrix? So I cannot rule out the possibility that the gate set might matter for that random peak circuit's problem. You know, like the Salove-Katayev theorem, right, doesn't tell you that it's irrelevant because it blows up the size of the circuit. My intuition would be that probably like the gate set matters if you care about which unitaries can be exactly generated or so forth. And if you just care about these approximate questions, like do you have some basis state that's output with at least the 10th probability, then my guess is that the answer should just be universal. It shouldn't really depend on the set of gates. But you know, I don't have a proof of that. I could be wrong. Thank you. Anything else? Yeah. Well, it wouldn't mean that you have to calculate the probabilities, not necessarily, right? Like, you know, someone might equally argue, well, with Schor's algorithm in order to generate a circuit that outputs the factors of this number, don't you have to already know the factors? Okay, well, no you don't because Schor explained why not, right? You know, it might be that there is some way of generating a circuit that looks random, knowing that the circuit is piqued, you know, maybe even knowing what is the special output, okay, but with some additional secret information that would come out of the generation process, but it would not imply some general ability to calculate any of the output probabilities. I don't know if that's possible or not. That's precisely my question. It's just a question of sampling what, okay? For Boson sampling, you're given the beam splitter network and now you have to calculate the output probabilities, okay? In this case, we get to pick the circuit. That's the key difference. I should mention that on Thursday, I'll have a technical talk apparently with yet another approach to near-term quantum supremacy which uses the time-honored trick of completely changing the question. Okay, one last question maybe, yeah. Maybe, I mean, I mean, you could say, you know, this is not a, you know, necessarily a hard computational complexity question, right? This is a question that might be answerable, you know, using tools from information theory or analysis of entropy or things like that. I don't know, that's for any of you to try to solve while I go and deal with the robot apocalypse. Okay, and on that note, I think why don't we, thanks, Scott, and have a nice talk.