Efficient verification of Boson Sampling

Ulysse Chabaud1,∗ Frederic Grosshans1, Elham Kashefi1,2, and Damian Markham1,3

1Sorbonne Universite, CNRS, LIP6, F-75005 Paris, France2School of Informatics, University of Edinburgh, 10 Crichton Street, Edinburgh, EH8 9AB and

3JFLI, CNRS, National Institute of Informatics, University of Tokyo, Tokyo, Japan

The demonstration of quantum speedup, also known as quantum computational supremacy, thatis the ability of quantum computers to outperform dramatically their classical counterparts, is animportant milestone in the field of quantum computing. While quantum speedup experiments aregradually escaping the regime of classical simulation, they still lack efficient verification protocols andrely on partial validation. To that end, we derive an efficient protocol for verifying with single-modeGaussian measurements the output states of a large class of continuous variable quantum circuitsdemonstrating quantum speedup, including Boson Sampling experiments, with and without i.i.d.assumption, thus enabling a convincing demonstration of quantum speedup with photonic computing.Beyond the quantum speedup milestone, our results also enable the efficient and reliable certificationof a large class of intractable continuous variable multi-mode quantum states.

I. INTRODUCTION

Quantum information promises many technological appli-cations beyond classical information [1–4]. For quantumcomputing, Shor’s famous factoring algorithm [5] has high-lighted the possibility of spectacular quantum advantagesover classical computing. The ability of quantum comput-ers to greatly outperform their classical counterparts isreferred to as “quantum computational supremacy” [6, 7],or quantum speedup [8]. We use the latter terminologyin this article.

While a universal quantum computer factoring largeproducts of primes would provide a compelling evidenceof quantum speedup, the experimental requirements as-sociated with such a demonstration preclude its reali-sation in the near future [9]. For that reason, varioussub-universal models of quantum computing, such as Bo-son Sampling [10], have been introduced [11–15]. Beyondtheir conceptual relevance, these models, although notbelieved to possess the full computational power of auniversal quantum computer, enable the possibility ofa demonstration of quantum speedup in the near term,under certain complexity-theoretic assumptions. Each ofthese sub-universal models is associated with a computa-tional problem that the model solves efficiently, but whichis hard to solve for classical computers. These computa-tional problems are sampling problems, for which the taskis to draw random samples from an ideal probability distri-bution fixed by the model. In practice, any experimentalimplementation would suffer from noise and imperfec-tions, and would sample from an imperfect probabilitydistribution which approximates the ideal one. Hence,the fact that even an approximate version of the sam-pling problem associated with a sub-universal model ishard for classical computers is crucial for an experimentaldemonstration of quantum speedup. For all models, suchan approximate sampling hardness, which corresponds to

∗Electronic address: ulysse.chabaud@gmail.com

the fact that a probability distribution which has a smallconstant total variation distance with the ideal probabilitydistribution is still hard to sample classically, comes atthe cost of assuming some additional reasonable—thoughunproven—conjectures.

The experimental demonstration of quantum speedupthus involves a quantum device solving efficiently a sam-pling task which is provably hard to solve for classicalcomputers under reasonable theoretical assumptions, to-gether with a verification that the quantum device indeedsolved the hard task [7]. While the former has been re-cently achieved with random superconducting circuits [16],the latter is still incomplete and relying on various ques-tionable assumptions [17–19], and verification is a crucialmissing point for a convincing demonstration of quantumspeedup.

The setting of verification involves two parties, whichin the language of interactive proof systems are referredto as the prover and the verifier. The prover is conceivedas a powerful, untrusted party, while the verifier is atrusted party with restricted computational power. Theverifier asks the prover to perform a computational taskand verifies its correct behaviour, with possibly multiplerounds of interaction. While this setting corresponds toa cryptographic scenario between two parties, e.g., in thecase of delegated computing, it also embeds the notion ofcertification of a physical experiment, where the experi-ment behaves as the prover and the experimenter as theverifier. Assumptions can be made on the prover, such asrestricting its computational capabilities or assuming thatit follows a specific behaviour. In the physical picture, thiscorresponds for example to choosing a noise model for anexperiment. A common assumption is the so-called inde-pendently and identically distributed (i.i.d.) assumption,i.e., assuming that the output of the quantum experimentis the same at each run. Assuming i.i.d. behaviour forthe prover leads to more efficient verification protocols,and this assumption can usually be removed using cryp-tographic techniques at the cost of an increased numberof runs in the protocol [20, 21]. We use the language ofinteractive proof systems in what follows, but we empha-

arX

iv:2

006.

0352

0v2

[qu

ant-

ph]

8 J

un 2

020

2

sise that our results are not restricted to that particularcontext and are relevant especially in experimental sce-narios. There has been much work done on verification ofuniversal quantum computation [21–23], much less whenthe verification is limited to sub-universal models. Wenow briefly review the state of affairs in this direction.

A verification protocol for a quantum speedup exper-iment should guarantee the closeness in total variationdistance between the experimental probability distribu-tion and the ideal probability distribution [7]. Such averification is especially difficult because of the natureof the computational task at hand, i.e., sampling froman almost uniform probability distribution over an ex-ponentially large sample space. In particular, any ef-ficient non-interactive verification of current quantumspeedup experiments with a verifier restricted to classicalcomputations requires additional cryptographic assump-tions [24]. Existing verification protocols for quantumspeedup with a classical verifier either rely on little-studiedassumptions [12, 25, 26], or induce an overhead for theprover [23, 27, 28] which prevents a near-term use for anexperimental demonstration of quantum speedup.

Weaker but more resource-efficient methods of verifica-tion with a classical verifier, which is sometimes referredto as validation [29], consist in performing a partial verifi-cation, where only specific properties of the experimentalprobability distribution are tested. For example, theverifier may perform statistical tests using experimen-tal samples [14, 16], compare the experimental probabil-ity distribution with specific mock-up distributions [30],or benchmark the individual components in the experi-ment. Ultimately, validation relies on making additionalassumptions about the inner functionning of the quantumdevice [31].

In order to avoid relying on such undesirable assump-tions, while keeping verification within near-term experi-mental reach, another way for performing verification isto allow the verifier to have minimal quantum capabilities.In that context, the purpose of the verifier is to obtain areliable bound on the trace distance between the outputstate produced by the prover and the ideal, target state,which in turn implies a bound on the distance betweenthe tested and target probability distributions of the sam-ples [32]. This can done by obtaining, e.g., an estimateof the fidelity with the target state, or a fidelity witness,i.e., a tight lower bound on the fidelity [33].

In the context of quantum computing in finite-dimensional Hilbert spaces [32], this minimal quantumcapability corresponds, e.g, to being only able to preparesingle-qubit or qudit states or to perform local measure-ments. Protocols for verification of Instantaneous Quan-tum Polynomial time circuits [12] with these minimalrequirements have been derived under the i.i.d. assump-tion with single-qubit states [34] or with local measure-ments [35] and more recently without the i.i.d. assump-tion with single-qubit states [36] or with local measure-ments [37].

Similarly in the context of infinite-dimensional Hilbert

spaces [38], which includes Boson Sampling and relatedsub-universal models [10, 39–44], this minimal quantumcapability corresponds, e.g., to being only able to preparesingle-mode Gaussian states, or to perform single-modeGaussian measurements. Gaussian state preparationsand measurements are at the same time well understoodtheoretically [45], classically simulable [46], and routinelyimplemented at large scales experimentally [47–49]. How-ever, there is no efficient verification protocol using single-mode Gaussian state preparation nor single-mode Gaus-sian measurements for Boson Sampling with input singlephotons: current methods used for the validation of Bosonsampling are either not scalable or only provide partialcertificates on the tested probability distribution [29, 50–54].

II. RESULTS

Our contribution is three-fold: we introduce three nonin-teractive protocols (detailed below) for the reliable certi-fication of continuous variable quantum states, where theverifier only needs to perform classical computations andsingle-mode Gaussian measurements, namely heterodynedetection [55], in order to verify an unknown state sentby an untrusted prover. The three protocols share thesame structure, depicted in Fig. 1.

For each of our three protocols, we derive one versionassuming i.i.d. behaviour for the prover and another ver-sion making no assumptions whatsoever on the prover.Other than that, all protocols rely solely on the verifierhaving access to single-mode heterodyne detection andon the validity of quantum mechanics. Moreover, all pro-tocols are robust and efficient, as they provide analyticalconfidence intervals and require a polynomial number ofmeasurements in the number of modes and in the size ofthe confidence interval.

Firstly, generalising several results from [56, 57], wederive a protocol for reliably estimating the fidelity ofan unknown continuous variable quantum state withany single-mode continuous variable quantum state ofbounded support over the Fock basis using heterodynedetection (Protocol 1).

Secondly, using this single-mode fidelity estimation pro-tocol as a subroutine, we obtain a protocol for reliablyestimating a fidelity witness, i.e., a tight lower bound onthe fidelity, for a large class of multi-mode continuousvariable quantum states using heterodyne detection of anunknown state (Protocol 2). For m modes, this class ofcertifiable states corresponds to the m-mode states of theform: (

m⊗i=1

Gi

)U

(m⊗i=1

|Ci〉), (1)

where U is an m-mode passive linear transformation (aunitary transformation of the creation and annihilation

3

operators of the modes), where each state |Ci〉 is a single-mode pure state with bounded support over the Fock basis,and where each operation Gi is a single-mode Gaussianunitary, for all i ∈ 1, . . . ,m.

Thirdly, using this multi-mode fidelity witness estima-tion protocol as a subroutine, we obtain a protocol forverifying the output states of Boson Sampling experi-ments (Protocol 3). Our protocol provides a certificateon the total variation distance between the experimen-tal and ideal probability distributions for any observable,efficiently in the number of modes and input photons,thus enabling a convincing demonstration of quantumspeedup with photonic quantum computing. Moreover,the verification protocol is implemented within the sameexperimental setup, simply by replacing the output detec-tors by balanced heterodyne detection. We also optimisethe efficiency of the protocol to the specific setting ofBoson Sampling.

Note that other fidelity witnesses for multi-mode pho-tonic state preparations have been introduced in [58].However, the number of measurements needed to estimatewith constant precision the output state of a Boson Sam-pling interferometer with n input photons over m modeswith their witnesses scales as Ω(mn+4), under the i.i.d.assumption, while we show that our protocol provides thesame precision with O(m2+t logm) measurements (wherethe prefactor in the O depends on a free parameter t > 0).Moreover, we are able to remove the i.i.d. state prepa-ration assumption, at the cost of an increased—thoughstill polynomial—number of measurements needed for thesame estimate precision and confidence interval.

The rest of the paper is structured as follows: werecall heterodyne detection in section III, we present oursingle-mode fidelity estimation protocol in section IV,we introduce our multi-mode fidelity witness estimationprotocol in section V and we discuss the verification ofBoson Sampling in section VI. Finally, we conclude insection VII.

III. HETERODYNE DETECTION

Hereafter, m denotes the number of modes and |n〉n∈N

is the single-mode Fock basis. Let us define the single-mode displacement operator D(β) = exp[βa† − β∗a], for

all β ∈ C, and the single-mode squeezing operator S(ξ) =exp[ 1

2 (ξ∗a − ξa†)], for all ξ ∈ C, where a† and a arethe creation and annihilation operators of the mode [59],respectively. We use bold math for multi-mode notations.For all β, ξ ∈ Cm, we write D(β) =

⊗mi=1 D(βi) and

S(ξ) =⊗m

i=1 S(ξi).

Heterodyne detection, also called double homodyne,dual-homodyne or eight-port homodyne detection [47],is a single-mode Gaussian measurement, projecting onto(unnormalised) coherent states. Mathematically, mea-suring a state ρ with heterodyne detection amounts tosampling from its Husimi Q phase space quasiprobability

N+M<latexit sha1_base64="xSUlfgsm5lQ60ML+RKEcDBHYaTM=">AAAB8XicbVBNSwMxEJ2tX7V+VT16CRZBEMpuFfRY9OJFqWA/sF1LNs22odlkSbJCWfovvHhQxKv/xpv/xrTdg7Y+GHi8N8PMvCDmTBvX/XZyS8srq2v59cLG5tb2TnF3r6FlogitE8mlagVYU84ErRtmOG3FiuIo4LQZDK8mfvOJKs2kuDejmPoR7gsWMoKNlR46aiAf09uTm3G3WHLL7hRokXgZKUGGWrf41elJkkRUGMKx1m3PjY2fYmUY4XRc6CSaxpgMcZ+2LRU4otpPpxeP0ZFVeiiUypYwaKr+nkhxpPUoCmxnhM1Az3sT8T+vnZjwwk+ZiBNDBZktChOOjEST91GPKUoMH1mCiWL2VkQGWGFibEgFG4I3//IiaVTK3mm5cndWql5mceThAA7hGDw4hypcQw3qQEDAM7zCm6OdF+fd+Zi15pxsZh/+wPn8AUBtkKM=</latexit>

M<latexit sha1_base64="Iu/7veY3xFeSfx0iIJV60iTaESM=">AAAB73icbVBNSwMxEJ2tX7V+VT16CRbBU9mtgh6LXrwIFewHtGvJptk2NJusSVYoS/+EFw+KePXvePPfmG73oK0PBh7vzTAzL4g508Z1v53Cyura+kZxs7S1vbO7V94/aGmZKEKbRHKpOgHWlDNBm4YZTjuxojgKOG0H4+uZ336iSjMp7s0kpn6Eh4KFjGBjpU5PjeRDejvtlytu1c2AlomXkwrkaPTLX72BJElEhSEca9313Nj4KVaGEU6npV6iaYzJGA9p11KBI6r9NLt3ik6sMkChVLaEQZn6eyLFkdaTKLCdETYjvejNxP+8bmLCSz9lIk4MFWS+KEw4MhLNnkcDpigxfGIJJorZWxEZYYWJsRGVbAje4svLpFWremfV2t15pX6Vx1GEIziGU/DgAupwAw1oAgEOz/AKb86j8+K8Ox/z1oKTzxzCHzifPzjYkBY=</latexit>

N<latexit sha1_base64="bmOy6HDOS1Yow7YUA0RW0DKgBUM=">AAAB7XicbVBNSwMxEJ2tX7V+VT16CRbBU9mtgh6LXjxJBfsB7VqyabaNzSZLkhXK0v/gxYMiXv0/3vw3pts9aOuDgcd7M8zMC2LOtHHdb6ewsrq2vlHcLG1t7+zulfcPWlomitAmkVyqToA15UzQpmGG006sKI4CTtvB+Hrmt5+o0kyKezOJqR/hoWAhI9hYqdVTI/lw2y9X3KqbAS0TLycVyNHol796A0mSiApDONa667mx8VOsDCOcTku9RNMYkzEe0q6lAkdU+2l27RSdWGWAQqlsCYMy9fdEiiOtJ1FgOyNsRnrRm4n/ed3EhJd+ykScGCrIfFGYcGQkmr2OBkxRYvjEEkwUs7ciMsIKE2MDKtkQvMWXl0mrVvXOqrW780r9Ko+jCEdwDKfgwQXU4QYa0AQCj/AMr/DmSOfFeXc+5q0FJ585hD9wPn8AczePCw==</latexit>

N<latexit sha1_base64="VTcO0RJik27lNj/XbhN4QBafNOQ=">AAAB8HicdVDLSgMxFM3UV62vqks3wSK4GmZap7W7ohtXUsE+pB1KJs20oUlmSDJCGfoVblwo4tbPceffmGkrqOiBC4dz7uXee4KYUaUd58PKrayurW/kNwtb2zu7e8X9g7aKEolJC0cskt0AKcKoIC1NNSPdWBLEA0Y6weQy8zv3RCoaiVs9jYnP0UjQkGKkjXTXjzTlRMHrQbHk2GWn7jkV6NgVr+5VPUNqbjUjru3MUQJLNAfF9/4wwgknQmOGlOq5Tqz9FElNMSOzQj9RJEZ4gkakZ6hAZo2fzg+ewROjDGEYSVNCw7n6fSJFXKkpD0wnR3qsfnuZ+JfXS3R47qdUxIkmAi8WhQmDOoLZ93BIJcGaTQ1BWFJzK8RjJBHWJqOCCeHrU/g/aZdtt2KXb85KjYtlHHlwBI7BKXBBDTTAFWiCFsCAgwfwBJ4taT1aL9brojVnLWcOwQ9Yb5/0H5CF</latexit>

↵1, . . . ,↵N<latexit sha1_base64="B5fLgYgAiZrfW4HtTpTxbI7HUZg=">AAACAHicdVDLSgMxFM34rPU16sKFm2ARXJRhpnVauyu6cSUV7APaYcikmTY08yDJCGXoxl9x40IRt36GO//GTDuCih4InJxz703u8WJGhTTND21peWV1bb2wUdzc2t7Z1ff2OyJKOCZtHLGI9zwkCKMhaUsqGenFnKDAY6TrTS4zv3tHuKBReCunMXECNAqpTzGSSnL1wwFi8Ri5VnkwjKQo59drVy+ZRsVs2GYVmkbVbtg1W5G6VcuIZZhzlECOlqu/qwE4CUgoMUNC9C0zlk6KuKSYkVlxkAgSIzxBI9JXNEQBEU46X2AGT5QyhH7E1QklnKvfO1IUCDENPFUZIDkWv71M/MvrJ9I/d1IaxokkIV485CcMyghmacAh5QRLNlUEYU7VXyEeI46wVJkVVQhfm8L/SadiWFWjcnNWal7kcRTAETgGp8ACddAEV6AF2gCDGXgAT+BZu9cetRftdVG6pOU9B+AHtLdPc+CWVg==</latexit>

, <latexit sha1_base64="p3zS5f+KSY5H8G2ajrbL4yQIMN0=">AAAB+HicdVDLSgNBEJz1GeMjUY9eBoPgQZbdxE3MLejFYwTzgGwIs5NOMmR2dpmZFeKSL/HiQRGvfoo3/8bJQ1DRgoaiqpvuriDmTGnH+bBWVtfWNzYzW9ntnd29XH7/oKmiRFJo0IhHsh0QBZwJaGimObRjCSQMOLSC8dXMb92BVCwSt3oSQzckQ8EGjBJtpF4+50OsGI/Emd8HrkkvX3DsolP1nBJ27JJX9cqeIRW3PCOu7cxRQEvUe/l3vx/RJAShKSdKdVwn1t2USM0oh2nWTxTEhI7JEDqGChKC6qbzw6f4xCh9PIikKaHxXP0+kZJQqUkYmM6Q6JH67c3Ev7xOogcX3ZSJONEg6GLRIOFYR3iWAu4zCVTziSGESmZuxXREJKHaZJU1IXx9iv8nzaLtluzizXmhdrmMI4OO0DE6RS6qoBq6RnXUQBQl6AE9oWfr3nq0XqzXReuKtZw5RD9gvX0CQrqTfw==</latexit>

heterodyne

Prover Verifier

M<latexit sha1_base64="Lsz51ABGi4tYqLZa60fE9UplHwA=">AAAB7XicdVBNSwMxEM3Wr1q/qh69BIvgacm2bmtvRS9ehAq2Fdq1ZNNsG5vdLElWKEv/gxcPinj1/3jz35htK6jog4HHezPMzPNjzpRG6MPKLS2vrK7l1wsbm1vbO8XdvbYSiSS0RQQX8sbHinIW0ZZmmtObWFIc+px2/PF55nfuqVRMRNd6ElMvxMOIBYxgbaR2T47E7WW/WEJ2GdVdVIHIrrh1t+oaUnOqGXFsNEMJLNDsF997A0GSkEaacKxU10Gx9lIsNSOcTgu9RNEYkzEe0q6hEQ6p8tLZtVN4ZJQBDIQ0FWk4U79PpDhUahL6pjPEeqR+e5n4l9dNdHDqpSyKE00jMl8UJBxqAbPX4YBJSjSfGIKJZOZWSEZYYqJNQAUTwten8H/SLttOxS5fnZQaZ4s48uAAHIJj4IAaaIAL0AQtQMAdeABP4NkS1qP1Yr3OW3PWYmYf/ID19gnn9o9c</latexit>

FIG. 1: A pictorial representation of the structure of ourprotocols. The verifier (within the blue dashed rectangle)asks the prover (black box) for N +M copies of some targetcontinuous variable pure quantum state. The prover sends a(mixed) quantum state ρN+M over N +M subsystems (underthe i.i.d. assumption, this state is of the form ρ⊗N+M ). Theverifier measures N subsystems of ρN+M at random withheterodyne detection and analyses the obtained samples tocheck if the remaining state ρM over M subsystems is close toM copies of the target state, with a precision parameter ε > 0and a confidence parameter δ > 0. If the answer is positive,the verifier may then decide to use the verified state ρM forany quantum information processing task. In an experimentalscenario, the blackbox prover corresponds to the experimentwhile the experimenter plays the role of the verifier; in thatcase, the state ρN+M is the output quantum state over N +Mruns of the experiment.

function [55]:

Qρ(α) =1

π〈α|ρ|α〉 , (2)

where |α〉 = e−|α|22

∑n≥0

αn√n!|n〉 is the coherent state of

amplitude α ∈ C. Heterodyne detection corresponds to asimultaneous noisy measurement of conjugate quadraturesand can be implemented experimentally by mixing thestate to be measured with the vacuum on a balanced beamsplitter and detecting both output branches with homo-dyne detection. Unbalancing the beam splitter and chang-ing the phase of the local oscillator in the homodyne detec-tion also allows the measurement of squeezed quadraturesrotated in phase space (Fig. 2). We refer to this Gaussianmeasurement as unbalanced heterodyne detection with un-balancing parameter ξ ∈ C. The positive-operator valuedmeasure (POVM) elements of a tensor product of single-mode unbalanced heterodyne detection over m modeswith unbalancing parameters ξ = (ξ1, . . . , ξm) ∈ Cm aregiven by

Πξα =1

πm|α, ξ〉〈α, ξ| , (3)

for all α = (α1, . . . , αm) ∈ Cm, where |α, ξ〉 =⊗mi=1 |αi, ξi〉 is a tensor product of squeezed coherent

states S(ξi)D(αi) |0〉. Writing ξ = reiθ, the unbalalancingparameter is related to the optical setup by r = | log

(TR

)|,

where T and R are the reflectance and transmittance of

4

-

-

<latexit sha1_base64="94wfdLRRBjCkyTC3Y5p5yTs2egQ=">AAAB63icbVDLSgNBEOz1GeMr6tHLYBA8hd0o6DHoxWME84BkCbOT2eyQeSwzs0II+QUvHhTx6g9582+cTfagiQUNRVU33V1Rypmxvv/tra1vbG5tl3bKu3v7B4eVo+O2UZkmtEUUV7obYUM5k7RlmeW0m2qKRcRpJxrf5X7niWrDlHy0k5SGAo8kixnBNpf6OlGDStWv+XOgVRIUpAoFmoPKV3+oSCaotIRjY3qBn9pwirVlhNNZuZ8ZmmIyxiPac1RiQU04nd86Q+dOGaJYaVfSorn6e2KKhTETEblOgW1ilr1c/M/rZTa+CadMppmlkiwWxRlHVqH8cTRkmhLLJ45gopm7FZEEa0ysi6fsQgiWX14l7XotuKzVH66qjdsijhKcwhlcQADX0IB7aEILCCTwDK/w5gnvxXv3Phata14xcwJ/4H3+ACD6jks=</latexit>

LO

vacuum

<latexit sha1_base64="Y9AsMRvmdxTQqcE8JuUntKKm/5U=">AAAB6nicbVBNS8NAEJ34WetX1aOXxSJ4KkkV9Fj04rGi/YA2lM120i7dbMLuRiyhP8GLB0W8+ou8+W/ctjlo64OBx3szzMwLEsG1cd1vZ2V1bX1js7BV3N7Z3dsvHRw2dZwqhg0Wi1i1A6pRcIkNw43AdqKQRoHAVjC6mfqtR1Sax/LBjBP0IzqQPOSMGivdd594r1R2K+4MZJl4OSlDjnqv9NXtxyyNUBomqNYdz02Mn1FlOBM4KXZTjQllIzrAjqWSRqj9bHbqhJxapU/CWNmShszU3xMZjbQeR4HtjKgZ6kVvKv7ndVITXvkZl0lqULL5ojAVxMRk+jfpc4XMiLEllClubyVsSBVlxqZTtCF4iy8vk2a14p1XqncX5dp1HkcBjuEEzsCDS6jBLdShAQwG8Ayv8OYI58V5dz7mrStOPnMEf+B8/gBdM43Z</latexit>

FIG. 2: A schematic representation of optical single-modeunblanced heterodyne detection of a state ρ, with unbalancingparameter ξ. The dashed red lines represent beam splitters.LO stands for local oscillator, i.e., a strong coherent state.The blue cylinders are photodiode detectors.

the unbalanced beam splitter, respectively, with θ beingthe phase of the local oscillator [42].

With these properties of heterodyne detection laid out,we detail in the following section our single-mode fidelityestimation protocol based on heterodyne detection.

IV. SINGLE-MODE FIDELITY ESTIMATION

Normalised single-mode pure quantum states withbounded support over the Fock basis are referred to as corestates [60, 61]. In what follows, we introduce a protocolfor estimating the fidelity of any single-mode continuousvariable (mixed) quantum state with any target core stateusing heterodyne detection, by generalising heterodynefidelity estimates from [56, 57]. We give two versions ofour protocol, with and without the i.i.d. assumption.

We denote by Eα←D

[f(α)] the expected value of a func-

tion f for samples drawn from a distribution D. Let usintroduce for k, l ≥ 0 the polynomials

Lk,l(z) = ezz∗ (−1)k+l

√k!√l!

∂k+l

∂zk∂z∗le−zz

∗

=

min (k,l)∑p=0

√k!√l!(−1)p

p!(k − p)!(l − p)!zl−pz∗k−p,

(4)

for z ∈ C, which are, up to a normalisation, the Laguerre2D polynomials appearing in the expression of quasiprob-ability distribution of Fock states [62]. Following [57],for all k, l ∈ N, we introduce with these polynomials thefunctions

fk,l(z, η) =1

η1+ k+l2

e(1− 1η )zz∗Ll,k

(z√η

), (5)

for all z ∈ C and all 0 < η < 1. Now let us define, forall p ∈ N∗, all z ∈ C and all 0 < η < 1, the generalisedfunctions:

g(p)k,l (z, η) :=

p−1∑j=0

(−1)jηjfk+j,l+j(z, η)

√(k + j

k

)(l + j

l

).

(6)

The functions z 7→ g(p)k,l (z, η) are polynomials multiplied

by a converging Gaussian function and are thus boundedover C. Using these functions, we derive the followingresult:

Lemma 1. Let p ∈ N∗, let k, l ∈ N and let 0 < η ≤p+1

p√

(k+p+1)(l+p+1). Let ρ =

∑+∞i,j=0 ρij |i〉〈j| be a single-

mode density operator. Then,∣∣∣∣ρkl − Eα←Qρ

[g(p)k,l (α, η)]

∣∣∣∣ ≤ ηp√(

k + p

k

)(l + p

l

), (7)

where the function g(p)k,l is defined in Eq. (6).

We give a proof in Appendix A. In particular, since hetero-dyne detection corresponds to sampling from the HusimiQ function of the measured state, this result enables esti-mating an element k, l of the density matrix from samplesof heterodyne detection by computing the mean of the

function z 7→ g(p)k,l (z, η) over these samples. These het-

erodyne estimates generalise both the ones introducedin [56], which we retrieve in the limit η → 1 and for whichan assumption on the size of the support of the measuredstate is necessary, and the ones introduced in [57], whichwe retrieve by setting p = 1 and which yield less efficientestimates.

Additionnally, for any core state |C〉 =∑c−1n=0 cn |n〉

where c ∈ N∗, defining for all p ∈ N∗, all 0 < η < 1 andall z ∈ C,

g(p)C (z, η) :=

∑0≤k,l≤c−1

c∗kcl g(p)k,l (z, η), (8)

computing the mean of the function z 7→ g(p)C (z, η) over

samples from heterodyne detection of a state allows us toestimate the fidelity of the measured state with the corestate |C〉.

Based on this result, we now present the version ofour single-mode fidelity estimation protocol under i.i.d.assumption and discuss afterwards its version withouti.i.d. assumption:

Protocol 1 (Single-mode fidelity estimation). Let c ∈N∗ and let |C〉 =

∑c−1n=0 cn |n〉 be a core state. Let also

N,M ∈ N∗, and let p ∈ N∗ and 0 < η < 1 be freeparameters. Let ρ⊗N+M be N +M copies of an unknownsingle-mode (mixed) quantum state ρ.

1. Measure N copies of ρ with heterodyne detection,obtaining the samples α1, . . . , αN ∈ C.

5

2. Compute the mean FC(ρ) of the function z 7→g

(p)C (z, η) (defined in Eq. (8)) over the samplesα1, . . . , αN ∈ C.

3. Compute the fidelity estimate FC(ρ)M .

The value FC(ρ)M obtained is an estimate of the fidelitybetween the M remaining copies of ρ and M copies ofthe target core state |C〉. The efficiency of the protocolis summarised by the following result:

Theorem 1. Let ε, δ > 0. With the notations of Pro-tocol 1, the estimate FC(ρ)M is ε-close to the fidelity

F (|C〉⊗M , ρ⊗M ) with probability 1− δ for

N = O

((M

ε

)2+ 2cp

log

(1

δ

)). (9)

We give a detailed version of the theorem together withits proof in Appendix B, which combines Lemma 1 withHoeffding’s inequality [63]. Since the parameter p ∈ N∗

may vary freely, the scaling can be brought arbitrarilyclose to N = O((Mε )2 log( 1

δ )). In practice, since theconstant prefactor increases with p, an optimisation yieldsthe optimal choice for p which minimises N when M ,ε and δ are fixed. Moreover, the choice of the otherfree parameter 0 < η < 1 contributes to minimising theconstant prefactor and the efficiency of Protocol 1 mayalso be refined by taking into account the expression ofthe single-mode target core state in the Fock basis.

Hence, Protocol 1 gives a reliable and efficient wayof estimating the fidelity of an unknown single-modecontinuous variable quantum state with any target corestate. These core states play an important role in thecharacterisation of single-mode non-Gaussian states [61].Additionnally, they form a dense subset (for the tracenorm) of the set of normalised single-mode pure quantumstates. Hence, given any target normalised single-modepure state |ψ〉, we can use our fidelity estimation protocolby targeting instead a truncation of the state |ψ〉 in theFock basis in order to estimate the fidelity of any single-mode continuous variable quantum state with the state|ψ〉 using heterodyne detection.

In an experimental scenario, one may set M = 1 in Pro-tocol 1 and deduce information about the output stateof a single run of the experiment. In a cryptographicscenario, where the state ρ is provided by an untrustedprover, the verifier may want to use some copies of thestate to perform fidelity estimation of the remaining Mcopies, before using these remaining states for subsequentquantum information processing. In that context, thei.i.d assumption may no longer be justified: the quantumstate sent by the prover ρN+M over N +M subsystemsmay no longer be of the form ρ⊗N+M , as all subsystemscan possibly be entangled with each other (as well aswith other quantum systems on the side of the prover).Hence, we extend Protocol 1 to a version which does notmake the i.i.d. assumption, using a de Finetti reduction

from [57, 64]. The non-i.i.d. version of Protocol 1 ob-tained is nearly identical, up to slight differences in theclassical post-processing: a small fraction of the measuredsubsystems have to be discarded at random and anotherfraction of the samples are used for an energy test. Thiscomes at the cost of an increased number of measurementswhich corresponds however to a polynomial overhead fora polynomial precision and confidence. We give a detailedanalysis in Appendix C.

V. MULTI-MODE FIDELITY WITNESSESTIMATION

In this section, we extend our single-mode fidelity estima-tion protocol from the previous section to the multi-modecase, and we show that being able to estimate single-modefidelities with heterodyne detection is sufficient to esti-mate tight fidelity witnesses, i.e., tight lower bounds onthe fidelity, for the large class of multi-mode states inEq. (1).

Note that the transformation in Eq. (1) may always be

expressed as S(ξ)D(β) U , where ξ,β ∈ Cm, since single-mode Gaussian unitaries can be decomposed as a displace-ment and a squeezing with complex parameter [59]. Note

also that an m-mode passive linear transformation U is as-sociated with an m×m unitary matrix U which describesits action on the creation and annihilation operators ofthe modes [47].

Our extension to the multi-mode case is based on twoobservations (Lemmas 2 and 3 hereafter).

Firstly, if all the single-mode subsystems ρi of a multi-mode quantum state ρ are close enough to single-modepure states, then ρ is close to the tensor product of thesesingle-mode pure states. Formally:

Lemma 2. Let ρ be a state over m subsystems. Forall i ∈ 1, . . . ,m, we denote by ρi = Tr1,...,m\i(ρ)

the reduced state of ρ over the ith subsystem. Let|ψ1〉 , . . . , |ψm〉 be pure states. For all i ∈ 1, . . . ,m,we write F (ρi, ψi) = 1− εi, where F is the fidelity. Then,

1−m∑i=1

εi ≤ F (ρ, ψ1 ⊗ · · · ⊗ ψm) ≤m∏i=1

(1− εi). (10)

We give a proof in Appendix D. The left hand side ofEq. (10) provides a lower bound on the fidelity, whichwe show is tight for small εi. Importantly, this fidelitywitness is only a function of the single-mode fidelities. Inparticular, being able to estimate single-mode fidelitieswith single-mode pure states using balanced heterodynedetection is enough to estimate fidelity witnesses withpure product states using balanced heterodyne detection.At this point, we may estimate tight fidelity witnessesfor pure product states using Protocol 1 for each of thesingle-mode subsystems in parallel. We make use of theproperties of heterodyne detection in order to furtherextend the class of target states for which a tight fidelitywitness can be efficiently obtained.

6

Secondly, a passive linear transformation followed bysingle-mode Gaussian unitary operations before unbal-anced heterodyne detection is equivalent to perform-ing balanced heterodyne detection directly, then post-processing efficiently the classical samples. Formally:

Lemma 3. Let β, ξ ∈ Cm and let V = S(ξ)D(β) U ,

where U is an m-mode passive linear transformation withm × m unitary matrix U . For all γ ∈ Cm, let α =U†(γ − β). Then,

Πξγ = VΠ0αV†. (11)

We give a proof in Appendix E. A striking consequence isthat a certain class of quantum operations before a bal-anced heterodyne measurement can be inverted efficientlyby unbalancing the detection and perfoming classical op-erations on the samples instead. This result generalisesa technique used in continuous variable quantum keydistribution protocols based on heterodyne detection, aswell as in a scheme for homomorphic encryption of lin-ear optics quantum computation [65], which allows oneto apply a unitary symmetrization at the level of theclassical samples rather than directly on the quantumstate [66]. In particular, for such a transformation V ,if a multi-mode pure product state

⊗mi=1 |ψi〉 can be

efficiently verified using balanced heterodyne detection,then the state V

⊗mi=1 |ψi〉 can be efficiently verified us-

ing unbalanced heterodyne detection by post-processingclassically the samples obtained.

This leads us to our multi-mode fidelity witness esti-mation protocol. Like for Protocol 1, we give the versionof our protocol under i.i.d. assumption, and discuss after-wards its version without i.i.d. assumption:

Protocol 2 (Multi-mode fidelity witness estimation). Let

c1, . . . , cm ∈ N∗. Let |Ci〉 =∑ci−1n=0 ci,n |n〉 be a core state,

for all i ∈ 1, . . . ,m. Let U be an m-mode passive lin-ear transformation with m × m unitary matrix U , andlet β, ξ ∈ Cm. We write |ψ〉 = S(ξ)D(β) U

⊗mi=1 |Ci〉

the m-mode target pure state. Let N,M ∈ N∗, and letp1, . . . , pm ∈ N∗ and 0 < η1, . . . , ηm < 1 be free parame-ters. Let ρ⊗N+M be N+M copies of an unknown m-mode(mixed) quantum state ρ.

1. Measure all m subsystems of N copies of ρ withunbalanced heterodyne detection with unbalancingparameters ξ = (ξ1, . . . , ξm), obtaining the vectorsof samples γ(1), . . . , γ(N) ∈ Cm.

2. For all k ∈ 1, . . . , N, compute the vectors α(k) =

U†(γ(k) − β

). We write α(k) = (α

(k)1 , . . . α

(k)m ) ∈

Cm.

3. For all i ∈ 1, . . . ,m, compute the mean FCi(ρ)

of the function z 7→ g(pi)Ci

(z, ηi) (defined in Eq. (8))

over the samples α(1)i , . . . , α

(N)i ∈ C.

4. Compute the fidelity witness estimate Wψ = 1 −∑mi=1 FCi(ρ)M .

The value Wψ obtained is an estimate of a tight lowerbound on the fidelity between the M remaining copiesof ρ and M copies of the m-mode target state |ψ〉 =

S(ξ)D(β) U⊗m

i=1 |Ci〉. The efficiency and completenessof the protocol are summarised by the following result:

Theorem 2. Let ε, δ > 0. With the notations of Pro-tocol 2, for all i ∈ 1, . . . ,m, let ni be the number ofindices j ∈ 1, . . . ,m such that cj = ci. Then,

1+logF (|ψ〉⊗M ,ρ⊗M )−ε ≤Wψ ≤ F (|ψ〉⊗M ,ρ⊗M )+ε,(12)

with probability 1− δ, for

N = O

(maxi

(Mm

ε

)2+2cipi

log(ni) log

(1

δ

)).

(13)In particular, if the tested state is perfect, i.e., ρ⊗N+M =

|ψ〉〈ψ|⊗N+M, then Wψ ≥ 1− ε with probability 1− δ.

We give a detailed version of the theorem together withits proof in Appendix F, which combines Theorem 1 withLemmas 2 and 3.

Note that Protocol 2 uses Protocol 1 as a subroutine.Writing p = mini pi and c = maxi ci, with ni ≤ m we

obtain N = O((Mmε )2+ 2c

p log(m) log( 1δ )). In particular,

compared to the single-mode case, the overhead for certi-

fying m-mode states is only O(m2+ 2cp logm), which is a

huge improvement compared to, e.g., the exponential scal-ing of tomography [67]. Since the parameter p ∈ N∗ mayvary freely, the scaling can be brought arbitrarily closeto N = O((Mm

ε )2 log(m) log( 1δ )). The constant prefactor

increases with p, and optimisation may yield the optimalchoice for p which minimises N when M , m, ε and δ arefixed. Moreover, the choice of the other free parameters0 < ηi < 1 also contributes to minimising the constantprefactor.

Without the i.i.d. assumption, we obtain an equivalentprotocol by using the version of our single-mode fidelityestimation protocol which does not assume i.i.d. statepreparation for estimating the single-mode fidelities. Likefor Protocol 1, the final protocol is nearly identical, upto slight differences in the classical post-processing. Re-moving the i.i.d. assumption then comes at the cost ofan increased number of measurements necessary for apolynomial witness precision and confidence interval, cor-responding to a polynomial overhead. We give a detailedanalysis in Appendix G.

The class of states for which fidelity witnesses can beefficiently estimated using Protocol 2 includes classicallyintractable quantum states, such as the output states ofBoson Sampling experiments, as we detail in the nextsection.

VI. VERIFICATION OF BOSON SAMPLING

The setup of Boson Sampling with input single-photonsconsists in n single-photon states fed into an interferome-

7

. . .. . .

. . .. . .

|0i<latexit sha1_base64="mFbyg4gJW0ZXAvvu82LjFXT3NAg=">AAAB8HicbVBNS8NAEJ34WetX1aOXxSJ4KkkV9Fj04rGC/ZA2lM120i7dbMLuRiixv8KLB0W8+nO8+W/ctjlo64OBx3szzMwLEsG1cd1vZ2V1bX1js7BV3N7Z3dsvHRw2dZwqhg0Wi1i1A6pRcIkNw43AdqKQRoHAVjC6mfqtR1Sax/LejBP0IzqQPOSMGis9PLldReVAYK9UdivuDGSZeDkpQ456r/TV7ccsjVAaJqjWHc9NjJ9RZTgTOCl2U40JZSM6wI6lkkao/Wx28IScWqVPwljZkobM1N8TGY20HkeB7YyoGepFbyr+53VSE175GZdJalCy+aIwFcTEZPo96XOFzIixJZQpbm8lbEgVZcZmVLQheIsvL5NmteKdV6p3F+XadR5HAY7hBM7Ag0uowS3UoQEMIniGV3hzlPPivDsf89YVJ585gj9wPn8AtneQWQ==</latexit>

|1i<latexit sha1_base64="HYi+qGuWADJ/vOJt8E+CnN5z0G4=">AAAB8HicbVBNS8NAEJ34WetX1aOXxSJ4KkkV9Fj04rGC/ZA2lM120i7dbMLuRiixv8KLB0W8+nO8+W/ctjlo64OBx3szzMwLEsG1cd1vZ2V1bX1js7BV3N7Z3dsvHRw2dZwqhg0Wi1i1A6pRcIkNw43AdqKQRoHAVjC6mfqtR1Sax/LejBP0IzqQPOSMGis9PHldReVAYK9UdivuDGSZeDkpQ456r/TV7ccsjVAaJqjWHc9NjJ9RZTgTOCl2U40JZSM6wI6lkkao/Wx28IScWqVPwljZkobM1N8TGY20HkeB7YyoGepFbyr+53VSE175GZdJalCy+aIwFcTEZPo96XOFzIixJZQpbm8lbEgVZcZmVLQheIsvL5NmteKdV6p3F+XadR5HAY7hBM7Ag0uowS3UoQEMIniGV3hzlPPivDsf89YVJ585gj9wPn8AuAKQWg==</latexit>

|0i<latexit sha1_base64="mFbyg4gJW0ZXAvvu82LjFXT3NAg=">AAAB8HicbVBNS8NAEJ34WetX1aOXxSJ4KkkV9Fj04rGC/ZA2lM120i7dbMLuRiixv8KLB0W8+nO8+W/ctjlo64OBx3szzMwLEsG1cd1vZ2V1bX1js7BV3N7Z3dsvHRw2dZwqhg0Wi1i1A6pRcIkNw43AdqKQRoHAVjC6mfqtR1Sax/LejBP0IzqQPOSMGis9PLldReVAYK9UdivuDGSZeDkpQ456r/TV7ccsjVAaJqjWHc9NjJ9RZTgTOCl2U40JZSM6wI6lkkao/Wx28IScWqVPwljZkobM1N8TGY20HkeB7YyoGepFbyr+53VSE175GZdJalCy+aIwFcTEZPo96XOFzIixJZQpbm8lbEgVZcZmVLQheIsvL5NmteKdV6p3F+XadR5HAY7hBM7Ag0uowS3UoQEMIniGV3hzlPPivDsf89YVJ585gj9wPn8AtneQWQ==</latexit>

|1i<latexit sha1_base64="HYi+qGuWADJ/vOJt8E+CnN5z0G4=">AAAB8HicbVBNS8NAEJ34WetX1aOXxSJ4KkkV9Fj04rGC/ZA2lM120i7dbMLuRiixv8KLB0W8+nO8+W/ctjlo64OBx3szzMwLEsG1cd1vZ2V1bX1js7BV3N7Z3dsvHRw2dZwqhg0Wi1i1A6pRcIkNw43AdqKQRoHAVjC6mfqtR1Sax/LejBP0IzqQPOSMGis9PHldReVAYK9UdivuDGSZeDkpQ456r/TV7ccsjVAaJqjWHc9NjJ9RZTgTOCl2U40JZSM6wI6lkkao/Wx28IScWqVPwljZkobM1N8TGY20HkeB7YyoGepFbyr+53VSE175GZdJalCy+aIwFcTEZPo96XOFzIixJZQpbm8lbEgVZcZmVLQheIsvL5NmteKdV6p3F+XadR5HAY7hBM7Ag0uowS3UoQEMIniGV3hzlPPivDsf89YVJ585gj9wPn8AuAKQWg==</latexit>

U<latexit sha1_base64="EDctSmRfGfOqEjxJ+hB77dV8gDU=">AAAB7XicbVBNS8NAEJ3Ur1q/qh69LBbBU0mqoMeiF48V7Ae0oWy2m3btZhN2J0IJ/Q9ePCji1f/jzX/jts1BWx8MPN6bYWZekEhh0HW/ncLa+sbmVnG7tLO7t39QPjxqmTjVjDdZLGPdCajhUijeRIGSdxLNaRRI3g7GtzO//cS1EbF6wEnC/YgOlQgFo2ilVm9EkTT75Ypbdecgq8TLSQVyNPrlr94gZmnEFTJJjel6boJ+RjUKJvm01EsNTygb0yHvWqpoxI2fza+dkjOrDEgYa1sKyVz9PZHRyJhJFNjOiOLILHsz8T+vm2J47WdCJSlyxRaLwlQSjMnsdTIQmjOUE0so08LeStiIasrQBlSyIXjLL6+SVq3qXVRr95eV+k0eRxFO4BTOwYMrqMMdNKAJDB7hGV7hzYmdF+fd+Vi0Fpx85hj+wPn8AQ06jsg=</latexit>

FIG. 3: Boson Sampling with interferometer U with n photonsover m modes and heterodyne detection with reconfigurableunbalancing parameter ξ. The detectors represented are ho-modyne detectors. Setting ξ = 0 (balanced detection) allowsto certify efficiently the multi-mode output state with a fi-delity witness. Setting ξ 6= 0, with |ξ| = Ω(2− polym) allows toperform efficiently a sampling task which is hard for classicalcomputers, unless the polynomial hierarchy collapses [42, 43].

ter over m modes, together with the vacuum state overm − n modes, and measured either with single-photonthreshold detection [10] or with unbalanced heterodynedetection [42, 43] (Fig. 3). The output probabilities are re-lated to permanents of complex matrices, which are hardto compute [68] and even to approximate [10]. A strikingconsequence is that classical computers cannot sampleexactly from the corresponding probability distributionsunless the polynomial hierarchy collapses, contradicting awidely believed conjecture from complexity theory. Aaron-son and Arkhipov importantly showed that even an ap-proximate version of their model is still hard to samplefor classical computers, provided two additional conjec-tures on the permanent of random Gaussian matriceshold true [10]. More precisely, they showed under theseconjectures that sampling from a probability distributionthat has small constant total variation distance with anideal Boson Sampling distribution is classically hard inthe so-called antibunching regime n = O(

√m) (in fact

they used m = Ω(n6) and conjectured that m = Ω(n2)was sufficient, as it was later shown [69]).

The output state of a Boson Sampling experimentwith n photons fed into an interferometer over m modes,described by an m-mode passive linear transformationU reads U |1 . . . 10 . . . 0〉. This state is of the form of

Eq. (1), with Gi = 1 for all i ∈ 1, . . . ,m, |Ci〉 = |1〉for i ∈ 1, . . . , n and |Cj〉 = |0〉 for j ∈ n + 1, . . . ,m.Our fidelity witness estimation protocol from the previoussection can thus be applied to certify efficiently the fidelityof the output state of a Boson Sampling experiment withthe ideal output state, using only balanced heterodyne de-tection. Then, our protocol yields a certificate of the total

variation distance with the ideal probability distributionfor any observable by the Fuchs–Van de Graaf inequal-ity [33] and standard properties of the trace distance [32].Indeed, for any observable O and any states ρ and σ,

‖POρ − POσ ‖ ≤ D(ρ,σ) ≤√

1− F (ρ,σ), (14)

where the left hand side is the total variation distancebetween the probability distributions corresponding to ameasurement of the observable O for the states ρ and σ,D is the trace distance and F the fidelity.

We give the version of our Boson Sampling verificationprotocol under i.i.d. assumption and discuss afterwardsits version without i.i.d. assumption.

Protocol 3 (Boson Sampling verification). Let n =

O(√m). Let U be an m-mode passive linear trans-

formation with m × m unitary matrix U . Let |ψ〉 =

U |1 . . . 10 . . . 0〉 be the m-mode Boson Sampling targetstate, with n input photons over m modes. Let N,M ∈ N∗,and let p ∈ N∗, 0 < η < 1 and λ > ε > 0 be free parame-ters. Let ρ⊗N+M be N+M copies of an unknown m-mode(mixed) quantum state ρ.

1. Measure all m subsystems of N copies of ρ withbalanced heterodyne detection, obtaining the vectorsof samples γ(1), . . . , γ(N) ∈ Cm.

2. For all k ∈ 1, . . . , N, compute the vectors α(k) =

U†γ(k). We write α(k) = (α(k)1 , . . . α

(k)m ) ∈ Cm.

3. For all i ∈ 1, . . . , n, compute the mean Fi,|1〉(ρ)

of the function z 7→ g(p)|1〉 (z, η) (defined in Eq. (8))

over the samples α(1)i , . . . , α

(N)i ∈ C, and for all

j ∈ n + 1, . . . ,m, compute the mean Fj,|0〉(ρ)

of the function z 7→ g(p)|0〉 (z, η) over the samples

α(1)j , . . . , α

(N)j ∈ C.

4. Compute the fidelity witness estimate Wψ = 1 −∑ni=1 Fi,|1〉(ρ)M −∑m

j=n+1 Fj,|0〉(ρ)M .

5. Abort if Wψ < 1−λ+ε. Otherwise, accept and mea-sure all m subsystems of the remaining M copies ofρ with unbalanced heterodyne detection (resp. single-photon threshold detection), obtaining the M vectorsof samples (s(1), . . . , s(M)) ∈ Cm (resp. ∈ Nm).

The efficiency and completeness of the protocol are sum-marised by the following result:

Theorem 3. Let δ > 0. We use the notations of Proto-col 3. If the protocol accepts, then with probability 1−δ thesamples s(1), . . . , s(M) are drawn from a probability dis-tribution which has less than

√λ total variation distance

with the ideal Boson Sampling probability distribution, for

N = O

((Mm

ε

)2+ 2p

log(m) log

(1

δ

)). (15)

8

Moreover, if the tested state is perfect, i.e., ρ⊗N+M =

|ψ〉〈ψ|⊗N+M, then Protocol 3 accepts with probability 1−

δ.

The proof of this result follows directly from the factthat Protocol 3 uses Protocol 2 as a subroutine, togetherwith Theorem 2 and Eq. (14). Since p ∈ N∗ is a freeparameter, for a constant ε the asymptotic scaling of theprotocol for verifying a single sample with confidence 1−δis N = O(m2 log(m) log( 1

δ )). Like for the protocols fromthe previous sections, the constant prefactor increaseswith p, so an optimisation may yield the optimal choicefor p which minimises N when M , m, ε and δ are fixed.Moreover, the choice of the other free parameter 0 < η < 1also contributes to minimising the constant prefactor.Additionnally, the choice of ε between 0 and λ can bemade to ensure robustness of the protocol with Eq. (12):if ε is closer to 0 then the protocol will reject a good statewith less probability. On the other hand, this increasesthe number of samples needed with Eq. (15).

Protocol 3 allows one to verify a Boson Sampling exper-iment efficiently, by trusting only single-mode Gaussianmeasurements. Compared to other experimental plat-forms, the assumption of trusted measurements is espe-cially relevant in the case of photonic quantum computing,where the measurement apparatus may be easily broughtapart from the rest of the experiment, allowing to treatthe latter as an untrusted black-box. Moreover, we obtaina version of Protocol 3 without the i.i.d. assumption byusing the version of Protocol 2 which does not assume ani.i.d. behaviour for the prover from the previous section.This slightly modifies the classical post-processing, requir-ing the verifier to discard at random a small fraction ofthe samples and perform an energy test using anotherfraction of the samples. This comes at the cost of a poly-nomial overhead for the number of measurements neededfor a polynomial confidence, and we refer to Appendix Gfor the detailed derivation.

By simply changing the unbalancing of heterodynedetection of the output modes of a Boson Sampling inter-ferometer, one can switch between verification of BosonSampling output states and demonstration of quantumspeedup with continuous variable measurements withinthe same experimental setup. Indeed, Boson Samplinginterferometers with unbalanced heterodyne detection arehard to sample classically when the unbalancing of theheterodyne detection is not too small [42, 43], but theiroutput can be efficiently checked simply by switchingto balanced heterodyne detection with Protocol 3. Thiscan be done within the same experimental setup usinga tunable beam splitter (Fig. 3). However, showing thehardness of approximate sampling for Boson Samplingwith Gaussian measurements is an important step be-fore an experimental demonstration of quantum speedupwith continuous variable Gaussian measurements. Al-ternatively, by switching between balanced heterodynedetection and single-photon threshold detectors, for ex-ample with a movable mirror [70], one can switch be-tween verification of Boson Sampling output states and

demonstration of quantum speedup with discrete variablemeasurements, for which approximate sampling hardnessis demonstrated, assuming two conjectures on the perma-nent of random Gaussian matrices and the fact that thepolynomial hierarchy does not collapse [10].

VII. DISCUSSION

In this work, we have introduced various methods forefficiently retrieving information about single-mode andmulti-mode continuous variable quantum states.

We have generalised heterodyne estimates bothfrom [56] and [57], obtaining the best of both worlds:a reliable single-mode fidelity estimation protocol withheterodyne detection which does not make an assump-tion of bounded support for the measured state, whileremaining efficient (Protocol 1).

From this fidelity estimation protocol for single sub-systems, we have derived a fidelity witness estimationprotocol with heterodyne detection for a large class ofquantum states over multiple subsystems (Protocol 2).This result stems from two observations: on the one hand,if all the subsystems of a quantum state are close to purestates, then this quantum state is close to the tensorproduct of the pure states; on the other hand, a class ofquantum operations before heterodyne detection can bereversed via classical post-processing.

Applying our fidelity witness estimation protocol tothe case of Boson Sampling, we have shown how to ver-ify efficiently Boson Sampling experiments (Protocol 3).Our verification applies to the original Boson Samplingproposal [10], where the sampling giving rise to quantumspeedup is performed using single-photon threshold de-tectors, as well as to related proposals [42, 43], wherethe sampling is performed using unbalanced heterodynedetection instead. In the latter case, the verification andthe computational runs only differ by the unbalancing ofthe verifier’s heterodyne detection. Using a tunable beamsplitter, this means that Boson Sampling and its verifi-cation can be implemented within the same setup. Notehowever that approximate sampling hardness has not yetbeen demonstrated for Boson Sampling with continuousvariable measurements, which is a crucial point beforeany experimental demonstration. It will likely requireextending anti-concentration and average-case hardnessconjectures for the permanent or the hafnian to the loophafnian [71, 72]. On the other hand, one may alreadyperform a demonstration of quantum speedup with BosonSampling and discrete variable measurements, by usingbalanced heterodyne detection for the verification andsingle-photon threshold detection for the sampling.

For all our protocols, we have derived a version withi.i.d. assumption and another without this assumption.The two versions share the same structure, and given thatthe latter only comes at the cost of a polynomial overheadin the number of measurements and additional classicalpost-processing, using the i.i.d. version of our protocol

9

for verifying a large-scale Boson Sampling experimentwould already provide a convincing evidence of quantumspeedup with photonic computing.

To that end, it would be interesting to optimise furtherour protocols for an experimental implementation, byfinding the optimal choice for the free parameters andby analysing the case where the verifier has access toimperfect rather than ideal heterodyne detection [56]. Aspreviously mentioned, it would also be interesting to showthe hardness of approximate sampling for Boson Sam-pling with Gaussian measurements, as it would allow averifier restricted to single-mode Gaussian measurementsto perform both the verification and the hard samplingtask.

Demonstration of quantum speedup is likely to beachieved not via a single experiment but rather throughnumerous experimental realisations competing withalways-improving classical simulation algorithms [18, 19,73–76]. In that context, but also long after the quantum

speedup milestone is achieved, efficient methods for re-liable certification of quantum devices will be of utmostimportance [77]. Beyond the quantum speedup milestone,our methods will find various applications for the reliablecertification of multi-mode continuous variable quantumstates in existing and upcoming experiments.

Acknowledgments

We thank Tom Douce, Anthony Leverrier, Saleh Rahimi-Keshari, Ganael Roeland, Mattia Walschaers, NicolasTreps and Valentina Parigi for interesting discussions.We acknowledge support of the European Union’s Hori-zon 2020 Research and Innovation Program under GrantAgreement No. 820445 (QIA), and the ANR through theANR-17-CE24-0035 VanQuTe.

[1] S. Wiesner, ACM Sigact News 15, 78 (1983).[2] C. H. Bennett and S. J. Wiesner, Physical review letters

69, 2881 (1992).[3] C. H. Bennett and G. Brassard, Theor. Comput. Sci. 560,

7 (1984).[4] A. W. Harrow, A. Hassidim, and S. Lloyd, Physical review

letters 103, 150502 (2009).[5] P. W. Shor, SIAM Review 41, 303 (1999).[6] J. Preskill, arXiv preprint arXiv:1203.5813 (2012).[7] A. W. Harrow and A. Montanaro, Nature 549, 203 (2017).[8] T. F. Rønnow, Z. Wang, J. Job, S. Boixo, S. V. Isakov,

D. Wecker, J. M. Martinis, D. A. Lidar, and M. Troyer,Science 345, 420 (2014).

[9] T. Haner, M. Roetteler, and K. M. Svore, arXiv preprintarXiv:1611.07995 (2016).

[10] S. Aaronson and A. Arkhipov, Theory of Computing 9,143 (2013).

[11] B. M. Terhal and D. P. DiVincenzo, arXiv preprint quant-ph/0205133 (2002).

[12] D. Shepherd and M. J. Bremner, Proceedings of the RoyalSociety A: Mathematical, Physical and Engineering Sci-ences 465, 1413 (2009).

[13] M. J. Bremner, R. Jozsa, and D. J. Shepherd, Proceed-ings of the Royal Society A: Mathematical, Physical andEngineering Sciences 467, 459 (2011).

[14] S. Boixo, S. V. Isakov, V. N. Smelyanskiy, R. Babbush,N. Ding, Z. Jiang, M. J. Bremner, J. M. Martinis, andH. Neven, Nature Physics 14, 595 (2018).

[15] R. Mezher, J. Ghalbouni, J. Dgheim, and D. Markham,arXiv preprint arXiv:1905.01504 (2019).

[16] F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin,R. Barends, R. Biswas, S. Boixo, F. G. Brandao, D. A.Buell, et al., Nature 574, 505 (2019).

[17] S. Aaronson and L. Chen, arXiv preprintarXiv:1612.05903 (2016).

[18] A. M. Dalzell, A. W. Harrow, D. E. Koh, and R. L.La Placa, Quantum 4, 264 (2020).

[19] B. Barak, C.-N. Chou, and X. Gao, arXiv preprintarXiv:2005.02421 (2020).

[20] R. Renner, Nature Physics 3, 645 (2007).[21] A. Gheorghiu, T. Kapourniotis, and E. Kashefi, Theory

of Computing Systems 4, 715 (2019), arXiv:1709.06984.[22] A. Broadbent, J. Fitzsimons, and E. Kashefi, in 2009 50th

Annual IEEE Symposium on Foundations of ComputerScience (IEEE, 2009), pp. 517–526.

[23] U. Mahadev, in 2018 IEEE 59th Annual Symposium onFoundations of Computer Science (FOCS) (IEEE, 2018),pp. 259–267.

[24] D. Hangleiter, M. Kliesch, J. Eisert, and C. Gogolin,Physical review letters 122, 210502 (2019).

[25] G. D. Kahanamoku-Meyer, arXiv preprintarXiv:1912.05547 (2019).

[26] M.-H. Yung and B. Cheng, arXiv preprintarXiv:2005.01510 (2020).

[27] Z. Brakerski, P. Christiano, U. Mahadev, U. Vazirani,and T. Vidick, in 2018 IEEE 59th Annual Symposium onFoundations of Computer Science (FOCS) (IEEE, 2018),pp. 320–331.

[28] Z. Brakerski, V. Koppula, U. Vazirani, and T. Vidick,arXiv preprint arXiv:2005.04826 (2020).

[29] N. Spagnolo, C. Vitelli, M. Bentivegna, D. J. Brod,A. Crespi, F. Flamini, S. Giacomini, G. Milani, R. Ram-poni, P. Mataloni, et al., Nature Photonics 8, 615 (2014).

[30] S. Aaronson and A. Arkhipov, arXiv preprintarXiv:1309.7460 (2013).

[31] S. Ferracin, T. Kapourniotis, and A. Datta, New Journalof Physics 21, 113038 (2019).

[32] M. A. Nielsen and I. L. Chuang, Quantum Computationand Quantum Information: 10th Anniversary Edition(Cambridge University Press, New York, NY, USA, 2011),10th ed.

[33] C. A. Fuchs and J. Van De Graaf, IEEE Transactions onInformation Theory 45, 1216 (1999).

[34] D. Mills, A. Pappa, T. Kapourniotis, and E. Kashefi,arXiv preprint arXiv:1704.01998 (2017).

[35] D. Hangleiter, M. Kliesch, M. Schwarz, and J. Eisert,arXiv:1602.00703 (2016).

[36] T. Kapourniotis and A. Datta, Quantum 3, 164 (2019).

10

[37] Y. Takeuchi and T. Morimae, Physical Review X 8,021060 (2018).

[38] S. L. Braunstein and P. van Loock, Rev. Mod. Phys. 77,513 (2005).

[39] A. P. Lund, A. Laing, S. Rahimi-Keshari, T. Rudolph,J. L. O’Brien, and T. C. Ralph, Phys. Rev. Lett. 113,100502 (2014).

[40] J. P. Olson, K. P. Seshadreesan, K. R. Motes, P. P. Rohde,and J. P. Dowling, Physical Review A 91, 022317 (2015).

[41] C. S. Hamilton, R. Kruse, L. Sansoni, S. Barkhofen, C. Sil-berhorn, and I. Jex, Physical review letters 119, 170501(2017).

[42] U. Chabaud, T. Douce, D. Markham, P. Van Loock,E. Kashefi, and G. Ferrini, Physical Review A 96, 062307(2017).

[43] L. Chakhmakhchyan and N. J. Cerf, Physical Review A96, 032326 (2017).

[44] A. Lund, S. Rahimi-Keshari, and T. Ralph, PhysicalReview A 96, 022301 (2017).

[45] G. Adesso, S. Ragy, and A. R. Lee, Open Systems &Information Dynamics 21, 1440001 (2014).

[46] S. D. Bartlett, B. C. Sanders, S. L. Braunstein, andK. Nemoto, Phys. Rev. Lett. 88, 097904 (2002).

[47] A. Ferraro, S. Olivares, and M. G. Paris, arXiv:quant-ph/0503237 (2005).

[48] S. Yokoyama, R. Ukai, S. C. Armstrong, C. Sornphiphat-phong, T. Kaji, S. Suzuki, J.-i. Yoshikawa, H. Yonezawa,N. C. Menicucci, and A. Furusawa, Nature Photonics 7,982 (2013).

[49] J.-i. Yoshikawa, S. Yokoyama, T. Kaji, C. Sornphiphat-phong, Y. Shiozawa, K. Makino, and A. Furusawa, APLPhotonics 1, 060801 (2016).

[50] F. Flamini, N. Spagnolo, and F. Sciarrino, Reports onProgress in Physics 82, 016001 (2018).

[51] I. Agresti, N. Viggianiello, F. Flamini, N. Spagnolo,A. Crespi, R. Osellame, N. Wiebe, and F. Sciarrino, Phys-ical Review X 9, 011013 (2019).

[52] D. J. Brod, E. F. Galvao, A. Crespi, R. Osellame, N. Spag-nolo, and F. Sciarrino, Advanced Photonics 1, 034001(2019).

[53] H. Wang, J. Qin, X. Ding, M.-C. Chen, S. Chen, X. You,Y.-M. He, X. Jiang, L. You, Z. Wang, et al., Physicalreview letters 123, 250503 (2019).

[54] M. Walschaers, Journal of Physics B: Atomic, Molecularand Optical Physics 53, 043001 (2020).

[55] H. Yuen and J. Shapiro, IEEE Transactions on Informa-tion Theory 26, 78 (1980).

[56] M. G. Paris, Physical Review A 53, 2658 (1996).

[57] U. Chabaud, T. Douce, F. Grosshans, E. Kashefi, andD. Markham, arXiv preprint arXiv:1905.12700 (2019).

[58] L. Aolita, C. Gogolin, M. Kliesch, and J. Eisert, Naturecommunications 6, 8498 (2015).

[59] C. Weedbrook, S. Pirandola, R. Garcıa-Patron, N. J. Cerf,T. C. Ralph, J. H. Shapiro, and S. Lloyd, Rev. Mod. Phys.84, 621 (2012).

[60] D. Menzies and R. Filip, Physical Review A 79, 012313(2009).

[61] U. Chabaud, D. Markham, and F. Grosshans, PhysicalReview Letters 124, 063605 (2020).

[62] A. Wunsche, Journal of Physics A: Mathematical andGeneral 31, 8267 (1998).

[63] W. Hoeffding, Journal of the American statistical associ-ation 58, 13 (1963).

[64] R. Renner and J. I. Cirac, Physical review letters 102,110504 (2009).

[65] Y. Ouyang, S.-H. Tan, J. Fitzsimons, and P. P. Rohde,Physical Review Research 2, 013332 (2020).

[66] A. Leverrier, R. Garcıa-Patron, R. Renner, and N. J. Cerf,Physical review letters 110, 030502 (2013).

[67] G. M. D’Ariano, M. G. Paris, and M. F. Sacchi, Advancesin Imaging and Electron Physics 128, 206 (2003).

[68] L. G. Valiant, Theoretical computer science 8, 189 (1979).[69] T. Jiang and Y. Ma, Transactions of the American Math-

ematical Society 372, 1509 (2019).[70] R. A. Abrahao and A. P. Lund, arXiv preprint

arXiv:1812.08978 (2018).[71] R. Kruse, C. S. Hamilton, L. Sansoni, S. Barkhofen, C. Sil-

berhorn, and I. Jex, Physical Review A 100, 032326(2019).

[72] N. Quesada, The Journal of chemical physics 150, 164113(2019).

[73] A. Neville, C. Sparrow, R. Clifford, E. Johnston, P. M.Birchall, A. Montanaro, and A. Laing, Nature Physics13, 1153 (2017).

[74] R. Garcıa-Patron, J. J. Renema, and V. Shchesnovich,Quantum 3, 169 (2019).

[75] P. Clifford and R. Clifford, arXiv preprintarXiv:2005.04214 (2020).

[76] C. Huang, F. Zhang, M. Newman, J. Cai, X. Gao, Z. Tian,J. Wu, H. Xu, H. Yu, B. Yuan, et al., arXiv preprintarXiv:2005.06787 (2020).

[77] J. Eisert, D. Hangleiter, N. Walk, I. Roth, D. Markham,R. Parekh, U. Chabaud, and E. Kashefi, arXiv preprintarXiv:1910.06343 (2019).

11

AppendixIn this appendix we provide the proofs for the results stated in the main text. The proofs of intermediate lemmas

are indicated by a vertical bar running along the side of the page.

Appendix A: Proof of Lemma 1

We recall notations from the main text. Let us introduce for k, l ≥ 0 the polynomials

Lk,l(z) = ezz∗ (−1)k+l

√k!√l!

∂k+l

∂zk∂z∗le−zz

∗

=

min (k,l)∑p=0

√k!√l!(−1)p

p!(k − p)!(l − p)!zl−pz∗k−p,

(A1)

for z ∈ C, which are, up to a normalisation, the Laguerre 2D polynomials. For all k, l ∈ N, we give with thesepolynomials the functions [57]

fk,l(z, η) =1

η1+ k+l2

e(1− 1η )zz∗Ll,k

(z√η

), (A2)

for all z ∈ C and all 0 < η < 1. The function z 7→ fk,l(z, η), being a polynomial multiplied by a converging Gaussianfunction, is bounded over C. Now let us define, for all p ∈ N∗, all z ∈ C and all 0 < η < 1, the more general boundedfunctions

g(p)k,l (z, η) :=

p−1∑j=0

(−1)jηjfk+j,l+j(z, η)

√(k + j

k

)(l + j

l

). (A3)

We start by showing the following result, which generalises Lemma 3 of [57]:

Lemma 4. Let p ∈ N∗, let k, l ∈ N and let 0 < η < 1. Let ρ =∑+∞i,j=0 ρij |i〉〈j| be a density operator. Then,

Eα←Qρ

[g(p)k,l (α, η)] = ρkl + (−1)p+1

+∞∑q=p

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

), (A4)

where the function gk,l is defined in Eq. (6).

Proof. We prove the lemma by induction on p ∈ N∗. By Lemma 3 of [57], with E = +∞, we have, for allsingle-mode (mixed) state ρ =

∑i,j≥0 ρij |i〉〈j|, for all k, l ∈ N

Eα←Qρ

[fk,l(α, η)] = ρkl +

+∞∑q=1

ρk+q,l+qηq

√(k + q

k

)(l + q

l

). (A5)

With Eq. (A3), this gives

Eα←Qρ

[g(1)k,l (α, η)] = ρkl +

+∞∑q=1

ρk+q,l+qηq

√(k + q

k

)(l + q

l

), (A6)

hence the lemma is proven for p = 1 since(q−1

0

)= 1.

12

Assuming the lemma holds for some p ∈ N∗,

Eα←Qρ

[g(p)k,l (α, η)] = ρkl + (−1)p+1

+∞∑q=p

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

= ρkl + (−1)p+1ρk+p,l+pηp

√(k + p

k

)(l + p

l

)

+ (−1)p+1+∞∑q=p+1

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

).

(A7)

Now by Eq. (A5), with k = k + p and l = l + p, we have

Eα←Qρ

[fk+p,l+p(α, η)] = ρk+p,l+p +

+∞∑q=1

ρk+q+p,l+q+pηq

√(k + q + p

k + p

)(l + q + p

l + q

), (A8)

so that

Eα←Qρ

[g

(p+1)k,l (α, η)

]= Eα←Qρ

[g

(p)k,l (α, η) + (−1)pηp

√(k + p

k

)(l + p

l

)fk+p,l+p(α, η)

]

= ρkl + (−1)p+1ρk+p,l+pηp

√(k + p

k

)(l + p

l

)

+ (−1)p+1+∞∑q=p+1

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

+ (−1)pηp

√(k + p

k

)(l + p

l

)ρk+p,l+p

+ (−1)pηp

√(k + p

k

)(l + p

l

)+∞∑q=1

ρk+q+p,l+q+pηq

√(k + q + p

k + p

)(l + q + p

l + p

)

= ρkl + (−1)p+1+∞∑q=p+1

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

+ (−1)pηp

√(k + p

k

)(l + p

l

)+∞∑q=1

ρk+q+p,l+q+pηq

√(k + q + p

k + p

)(l + q + p

l + p

)

= ρkl + (−1)p+1+∞∑q=p+1

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

+ (−1)p

√(k + p

k

)(l + p

l

) +∞∑q=p+1

ρk+q,l+qηq

√(k + q

k + p

)(l + q

l + p

)

= ρkl + (−1)p+2+∞∑q=p+1

ρk+q,l+qηq

×[√(

k + p

k

)(l + p

l

)(k + q

k + p

)(l + q

l + p

)−(q − 1

p− 1

)√(k + q

k

)(l + q

l

)].

(A9)

13

We have (k + p

k

)(l + p

l

)(k + q

k + p

)(l + q

l + p

)=

(k + p)!(l + p)!(k + q)!(l + q)!

k!p!l!p!(k + p)!(q − p)!(l + p)!(q − p)!

=(k + q)!(l + q)!

k!(k + p)!p!2(q − p)!2

=

(q

p

)2(k + q

k

)(l + q

l

),

(A10)

so the last expression in Eq. (A9) simplifies as

Eα←Qρ

[g

(p+1)k,l (α, η)

]= ρkl + (−1)p+2

+∞∑q=p+1

ρk+q,l+qηq

√(k + q

k

)(l + q

l

)[(q

p

)−(q − 1

p− 1

)]

= ρkl + (−1)p+2+∞∑q=p+1

ρk+q,l+qηq

(q − 1

p

)√(k + q

k

)(l + q

l

),

(A11)

which completes the proof of Lemma 4.

An immediate application of Lemma 4 gives

∣∣∣∣ Eα←Qρ

[g(p)k,l (α, η)]− ρkl

∣∣∣∣ ≤ +∞∑q=p

ρk+q,l+qηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

≤ maxq≥p

(ηq(q − 1

p− 1

)√(k + q

k

)(l + q

l

))+∞∑q=p

ρk+q,l+q

≤ maxq≥p

(ηq(q − 1

p− 1

)√(k + q

k

)(l + q

l

)).

(A12)

This last bound is tight: if q0 ≥ p is the integer achieving the maximum in the last equation, then the inequality is anequality for ρ = |q0〉〈q0|. We have

ηq+1

(q

p− 1

)√(k + q + 1

k

)(l + q + 1

l

)Q ηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)

⇔ η Qq − p+ 1

q

√(q + 1

k + q + 1

)(q + 1

l + q + 1

)

⇔ η Q

(1− p− 1

q

)√1− k

k + q + 1

√1− l

l + q + 1,

(A13)

where the right hand side in the last line is an increasing function of q. Hence, for η ≤ p+1

p√

(k+p+1)(l+p+1), which

corresponds to q = p in the above equation, we have

ηq+1

(q

p− 1

)√(k + q + 1

k

)(l + q + 1

l

)≤ ηq

(q − 1

p− 1

)√(k + q

k

)(l + q

l

)(A14)

for all q ≥ p, so that

maxq≥p

(ηq(q − 1

p− 1

)√(k + q

k

)(l + q

l

))= ηp

√(k + p

k

)(l + p

l

), (A15)

14

for η ≤ p+1

p√

(k+p+1)(l+p+1). With Eq. (A12) we finally obtain

∣∣∣∣ Eα←Qρ

[g(p)k,l (α, η)]− ρkl

∣∣∣∣ ≤ ηp√(

k + p

k

)(l + p

l

). (A16)

Note that for η < 1 but η > p+1

p√

(k+p+1)(l+p+1), we can find the first integer q0 such that η ≤ (q0−p+1)(q0+1)

q0√

(k+q0+1)(l+q0+1)by

incrementing q, since (q−p+1)(q+1)

q√

(k+q+1)(l+q+1)in an increasing function of q which goes to 1 when q goes to +∞. The bound

above then gives ∣∣∣∣ Eα←Qρ

[g(p)k,l (α, η)]− ρkl

∣∣∣∣ ≤ ηq0(q0 − 1

p− 1

)√(k + q0

k

)(l + q0

l

). (A17)

While this can be useful to optimise further the efficiency of the protocol, we will assume for the sake of obtainingclosed analytical expressions that η ≤ p+1

p√

(k+p+1)(l+p+1).

Appendix B: Proof of Theorem 1

In this section, we prove the efficiency of Protocol 2, which we recall below:

Protocol 1 (Single-mode fidelity estimation). Let c ∈ N∗ and let |C〉 =∑c−1n=0 cn |n〉 be a core state. Let also

N,M ∈ N∗, and let p ∈ N∗ and 0 < η < 1 be free parameters. Let ρ⊗N+M be N +M copies of an unknown single-mode(mixed) quantum state ρ.

1. Measure N copies of ρ with heterodyne detection, obtaining the samples α1, . . . , αN ∈ C.

2. Compute the mean FC(ρ) of the function z 7→ g(p)C (z, η) (defined in Eq. (B10)) over the samples α1, . . . , αN ∈ C.

3. Compute the fidelity estimate FC(ρ)M .

The value FC(ρ)M obtained is an estimate of the fidelity between the M remaining copies of ρ and M copies of thetarget core state |C〉. Defining

ηC,p := min

cε

(c+ p)(∑c−1

n=0 |cn|√(

n+pn

))2

1p

,p+ 1

p(p+ c),

1

2

, (B1)

the efficiency of the protocol is summarised by the following result:

Theorem 4. Let ε > 0. With the notations of Protocol 1 and η ≤ ηC,p, we have∣∣∣F (|C〉⊗M , ρ⊗M )− FC(ρ)M∣∣∣ ≤ ε, (B2)

with probability greater than 1− P iidC , where

P iidC = 2 exp

[− Nε2+ 2c

p

M2+ 2cp KC,p

], (B3)

where KC,p is a constant independent of ρ given in Eq. (B26).

Proof. Let us prove the theorem for M = 1. The general case is then an immediate corollary by replacing ε by εM ,

since F (C⊗M , ρ⊗M ) = F (C, ρ)M and by Lemma 2 of [57]:

|a− b| ≤ ε ⇒ |aM − bM | ≤Mε, (B4)

for all M ∈ N∗, all ε > 0 and all a, b ∈ [0, 1] (note that when the estimate FC(ρ) obtained is bigger than 1 we mayreplace it by 1 instead without loss of generality).

The proof combines Lemma 1 with Hoeffding inequality. The latter is expressed as follows:

15

Lemma 5. (Hoeffding) Let λ > 0, let n ≥ 1, let z1, . . . , zn be i.i.d. complex random variables from a probabilitydensity D over R, and let g : C 7→ R be a bounded function and let G ≥ maxz g(z)−minz g(z). Then

Pr

[∣∣∣∣∣ 1

N

N∑i=1

g(zi)− Ez←D

[g(z)]

∣∣∣∣∣ ≥ λ]≤ 2 exp

[−2Nλ2

G2

]. (B5)

In order to apply Lemma 5, we first derive an analytical bound for the functions g(p)k,l :

Lemma 6. For all k, l ∈ N, all z ∈ C, all p ∈ N∗ and all η ≤ 12 ,

|g(p)k,l (z, η)| ≤ 1

η1+ k+l2

(max (k, l) + p

p− 1

)√2|l−k|

(max (k, l)

min (k, l)

). (B6)

Proof. By Lemma 6 of [57], we have

|fi,j(z, η)| ≤ 1

η1+ i+j2

√2|i−j|

(max (i, j)

min (i, j)

), (B7)

for all i, j ∈ N, all z ∈ C and all η ≤ 12 . Hence, with Eq. (A3), for all k ≤ l ∈ N,

|g(p)k,l (z, η)| ≤

p−1∑i=0

|fk+i,l+i(z, η)|ηi√(

k + i

i

)(l + i

i

)

≤√

2l−k

η1+ k+l2

p−1∑i=0

√(l + i

k + i

)(k + i

i

)(l + i

i

)

=

√2l−k

η1+ k+l2

p−1∑i=0

√(l + i

i

)2(l

k

)

=1

η1+ k+l2

√2l−k

(l

k

) p−1∑i=0

(l + i

i

)

=1

η1+ k+l2

(l + p

p− 1

)√2l−k

(l

k

),

(B8)

for all z ∈ C and all η ≤ 12 . The same reasoning holds for l ≤ k ∈ N and we obtain

|g(p)k,l (z, η)| ≤ 1

η1+ k+l2

(max (k, l) + p

p− 1

)√2|l−k|

(max (k, l)

min (k, l)

), (B9)

for all k, l ∈ N, all z ∈ C, all p ∈ N∗ and all η ≤ 12 .

Let |C〉 =∑c−1n=0 cn |n〉 be a core state. Recalling the definition

g(p)C (z, η) :=

∑0≤k,l≤c−1

c∗kcl g(p)k,l (z, η), (B10)

from the main text, with Lemma 6 we obtain:

|g(p)C (z, η)| ≤ 1

ηc

∑0≤k,l≤c−1

|ckcl|ηc−1− k+l2

(max (k, l) + p

p− 1

)√2|l−k|

(max (k, l)

min (k, l)

)

=B

(p)C

ηc,

(B11)

16

for all z ∈ C, all p ∈ N∗ and all η ≤ 12 , where

B(p)C :=

∑0≤k,l≤c−1

|ckcl|ηc−1− k+l2

(max(k, l) + p

p− 1

)√2|l−k|

(max(k, l)

min(k, l)

). (B12)

Let N ∈ N∗, let ρ =∑k,l≥0 ρkl |k〉〈l| be a density matrix and let α1, . . . , αN be i.i.d. samples from balanced heterodyne

detection of N copies of ρ. Let us write

FC(ρ) =1

N

N∑i=1

g(p)C (αi, η). (B13)

With Lemma 5, for all λ > 0,

Pr

[∣∣∣∣FC(ρ)− Eα←Qρ

[g(p)C (α, η)]

∣∣∣∣ ≥ λ] ≤ 2 exp

−2Nλ2η2c(R

(p)C

)2

≤ 2 exp

− Nλ2η2c

2(B

(p)C

)2

,(B14)

for all z ∈ C, all p ∈ N∗, where we defined

R(p)C := max

z[ηcgC(z, η)]−min

z[ηcgC(z, η)], (B15)

the range of the function z 7→ ηcgC(z, η) and where we used Eq. (B11) and R(p)C ≤ 2B

(p)C for η ≤ 1

2 in the second line.

For η ≤ p+1p(p+c) , we have η ≤ p+1

p√

(k+p+1)(l+p+1)for all 0 ≤ k, l ≤ c− 1. Hence, for η ≤ min

p+1p(p+c) ,

12

,

∣∣∣∣F (C, ρ)− Eα←Qρ

[g(p)C (α, η)]

∣∣∣∣ =

∣∣∣∣∣∣∑

0≤k,l≤c−1

c∗kcl

(ρkl − E

α←Qρ[g

(p)k,l (α, η)]

)∣∣∣∣∣∣≤

∑0≤k,l≤c−1

|ckcl|∣∣∣∣ρkl − E

α←Qρ[g

(p)k,l (α, η)]

∣∣∣∣≤ ηp

∑0≤k,l≤c−1

|ckcl|√(

k + p

k

)(l + p

l

)

= ηp

(c−1∑n=0

|cn|√(

n+ p

n

))2

= ηpA(p)C ,

(B16)

where we used Eq. (B10) in the first line, Lemma 1 in the third line for all 0 ≤ k, l ≤ c− 1, and where we defined

A(p)C :=

(c−1∑n=0

|cn|√(

n+ p

n

))2

. (B17)

For η ≤ min

p+1p(p+c) ,

12

, combining Eqs. (B14) and (B16) yields

|F (C, ρ)− FC(ρ)| ≤∣∣∣∣ Eα←Qρ

[g(p)C (α, η)]− FC(ρ)

∣∣∣∣+

∣∣∣∣F (C, ρ)− Eα←Qρ

[g(p)C (α, η)]

∣∣∣∣≤ λ+ ηpA

(p)C ,

(B18)

17

with probability greater than 1− P iidC , where

P iidC = 2 exp

− Nλ2η2c

2(B

(p)C

)2

. (B19)

We now optimise over the choice of λ and η for a given precision ε > 0. Namely, fixing λ+ ηpA(p)C = ε we maximise

λ2η2c. Writing

ηpA(p)C = µ, (B20)

this amounts to maximising λ2µ2cp , with λ+ µ = ε. The optimal choice is given by:

λ =pε

c+ pand µ =

cε

c+ p. (B21)

This in turn gives

λ =pε

c+ pand η =

[cε

A(p)C (c+ p)

] 1p

. (B22)

With this choice for η, for small enough ε we will always have η ≤ min

p+1p(p+c) ,

12

. To ensure that this is always the

case independently of the value of ε, we may fix instead

λ =pε

c+ pand η = min

[

cε

A(p)C (c+ p)

] 1p

,p+ 1

p(p+ c),

1

2

. (B23)

Then, plugging these expressions in Eq. (B19) we finally obtain

|F (C, ρ)− FC(ρ)| ≤ ε, (B24)

with probability greater than 1− P iidC , where

P iidC = max

2 exp

[−Nε

2+ 2cp

K(p)C

], 2 exp

[− Nε2

K(p)′

C

], 2 exp

[− Nε2

K(p)′′

C

]

= 2 exp

[−Nε

2+ 2cp

KC,p

],

(B25)

where

K(p)C =

2(A

(p)C

) 2cp(B

(p)C

)2

(c+ p)2+ 2cp

c2cp p2

K(p)′

C =2p2c−2

(B

(p)C

)2

(c+ p)2+ 2cp

(p+ 1)2c

K(p)′′

C =22c+1

(B

(p)C

)2

(c+ p)2

p2

KC,p = maxK

(p)C ,K

(p)′

C ,K(p)′′

C

,

(B26)

and where the constants B(p)C and A

(p)C are defined in Eqs. (B12) and (B17), respectively. Hence, the number of samples

needed for a precision ε > 0 and a failure probability δ > 0 scales as

N = O

(1

ε2+ 2cp

log

(1

δ

)). (B27)

Note that, as indicated in Eq. (A17), the choice of η in Eq. (B1) is not optimal in general, and an optimisationdepending on the expression of the target core state may lead to a better prefactor in Eq. (B27).

18

Appendix C: Removing the i.i.d. assumption for Protocol 1

In this section, we derive a version of Protocol 1 which does not assume i.i.d. state preparation. The protocol is asfollows:

Protocol 4 (General single-mode fidelity estimation). Let c ∈ N∗ and let |C〉 =∑c−1n=0 cn |n〉 be a core state. Let also

N,M ∈ N∗, and let p ∈ N∗, E,S ∈ N and 0 < η < 1 be free parameters. Let ρN+M be an unknown quantum stateover N +M subsystems. We write N = N ′ +K +Q, for N ′,K,Q ∈ N.

1. Measure N = N ′ + K + Q subsystems of ρN+M chosen at random with heterodyne detection, obtaining thesamples α1, . . . , αN ′ , β1, . . . , βK , γ1, . . . γQ ∈ C. Let ρM be the remaining state over M subsystems.

2. Discard the Q samples γ1, . . . γQ.

3. Record the number R of samples βi such that |βi|2 + 1 > E, for i ∈ 1, . . . ,K. The protocol aborts if R > S.

4. Otherwise, compute the mean FC(ρ) of the function z 7→ g(p)C (z, η) (defined in Eq. (8)) over the samples

α1, . . . , αN ′ ∈ C.

5. Compute the fidelity estimate FC(ρ)M .

Note that this protocol differs from Protocol 1 by two additional classical post-processing steps, steps 2 and 3. Thesesteps are part of a de Finetti reduction for infinite-dimensional systems [64] detailed in [57]. In particular, step 3 is anenergy test, and the energy parameters E and S should be chosen to guarantee completeness, i.e., if the perfect corestate is sent then it passes the energy test with high probability.

The value FC(ρ)M obtained is an estimate of the fidelity between the remaining state ρM over M subsystems andM copies of the target core state |C〉. The efficiency of the protocol is summarised by the following result:

Theorem 5. Let ε > 0. With the notations of Protocol 4 and η ≤ ηC,p, defined in Eq. (B1),∣∣∣F (|C〉⊗M ,ρM )− FC(ρ)M∣∣∣ ≤ 2ε+ P deFinetti

C , (C1)

or the protocol aborts in step 3, with probability greater than 1− (P supportC + P deFinetti

C + P choiceC + PHoeffding

C ), where

P supportC = 8K3/2 exp

[−K

9

(Q

4(N ′ +M +Q)− 2S

K

)2]

P deFinettiC =

(Q

4

)E2/2

exp

[− Q(Q+ 4)

8(N ′ +M +Q)

]P choiceC =

M(Q+M − 1)

N ′ +M

PHoeffdingC = 2

(N ′ +M

Q

)exp

−N ′ +M −Q2M2+ 2c

p

(ε1+ c

p

GC,p− 2QM1+ c

p

N ′

)2 ,

(C2)

where GC,p is a constant independent of ρ given in Eq. (C11). In particular, setting

N ′ = O

(M7+ 2c

p

ε4+ 2cp

)

Q = O

(M4+ c

p

ε2+ 2cp

)

K = O

(M7+ 2c

p

ε4+ 2cp

)E = O(logM)

S = o(Q),

(C3)

19

yields ∣∣∣F (|C〉⊗M ,ρM )− FC(ρ)M∣∣∣ = O(ε) (C4)

or the protocol aborts in step 3, with probability greater than 1− PC , where

PC = O

(1

poly(M, 1ε )

), (C5)

for

N = O

(M7+ 2c

p

ε4+ 2cp

). (C6)

Proof. Theorem 5 is an optimised version of Theorem 5 of [57], where the heterodyne estimates fk,l(z, η) defined in

Eq. (5) are replaced by the more efficient generalised estimates g(p)k,l (z, η), with an additional free parameter p. The

proof thus is nearly identical, and amounts to replacing occurences of the estimates fk,l(z, η) by the estimates g(p)k,l (z, η).

In particular, we use our Lemmas 1 and 6 instead of Theorem 1 and Lemma 6 of [57]. In particular, the constantsused in the proof of [57] are mapped as:

Kψ 7→(A

(p)C

) 1p

=

(c−1∑n=0

|cn|√(

n+ p

n

))2

1p

Mψ 7→ B(p)C =

∑0≤k,l≤c−1

|ckcl|ηc−1− k+l2

(max (k, l) + p

p− 1

)√2|l−k|

(max (k, l)

min (k, l)

).

(C7)

Note that we also adapt the notations from [57] for the global coherence of this work as:

n 7→ N ′ +M +Q

k 7→ K

q 7→ Q/4

m 7→M

E 7→ E − 1

s 7→ S

r 7→ R

ε 7→ ε

ε′ 7→ ε.

(C8)

With these mappings, following the proof of [57] we obtain:∣∣∣F (|C〉⊗M ,ρM )− FC(ρ)M∣∣∣ ≤ 2ε+ P deFinettiC , (C9)

or R > S, i.e., the protocol aborts in step 3, with probability greater than 1 − (P supportC + P deFinettiC + P choiceC +

PHoeffdingC ), where

P supportC = 8K3/2 exp

[−K

9

(Q

4(N ′ +M +Q)− 2S

K

)2]

P deFinettiC =

(Q

4

)E2/2

exp

[− Q(Q+ 4)

8(N ′ +M +Q)

]P choiceC =

M(Q+M − 1)

N ′ +M

PHoeffdingC = 2

(N ′ +M

Q

)exp

−N ′ +M −Q2M2+ 2c

p

(ε1+ c

p

GC,p− 2QM1+ c

p

N ′

)2 ,

(C10)

20

where

Cψ 7→ GC,p =(A

(p)C

) cp

∑0≤k,l≤c−1

|ckcl|

ε

M(A

(p)C

) 1p

c−1− k+l2 (

max (k, l) + p

p− 1

)√2|l−k|

(max (k, l),

min (k, l)

)(C11)

is a constant independent of ρ (the expression of GC,p used here depends on M and ε without loss of generality, sinceis upper bounded by its value for ε/M = 1). Setting

N ′ = O

(M7+ 2c

p

ε4+ 2cp

)

K = O

(M7+ 2c

p

ε4+ 2cp

)

Q = O

(M4+ c

p

ε2+ 2cp

)E = O(logM)

S = o(Q),

(C12)

with Eq. (C9) we obtain ∣∣∣F (|C〉⊗M ,ρM )− FC(ρ)M∣∣∣ = O(ε), (C13)

with probability 1− PC , where

PC = P supportC + P deFinetti

C + P choiceC + PHoeffding

C = O

(1

poly(M, 1ε )

), (C14)

for

N = N ′ +K +Q = O

(M7+ 2c

p

ε4+ 2cp

). (C15)

Since the parameter p ∈ N∗ may vary freely, the asymptotic scaling of the number of samples N needed for a precision

ε > 0 and a polynomial confidence thus is given by N = O(M7

ε4 ).

Appendix D: Proof of Lemma 2

In this section, we prove a generalised version of Lemma 2 for tensor product of Hilbert spaces. Setting M = 1, weretrieve the Lemma in the main text:

Lemma 7. Let ρm×M be an m ×M-mode state in H = H⊗M1 ⊗ · · · ⊗ H⊗Mm . For all i ∈ 1, . . . ,m, we denote by

ρMi = TrH\H⊗Mi(ρ) the M -mode reduced state of ρm×M over the Hilbert space H⊗Mi . Let |ψ1〉 , . . . , |ψm〉 be pure states

in H1, . . . ,Hm. For all i ∈ 1, . . . ,m, we write F(ρMi , ψ

⊗Mi

)= 1− εi. Then,

1−m∑i=1

εi ≤ F(ρm×M ,

m⊗i=1

ψ⊗Mi

)≤

m∏i=1

(1− εi). (D1)

Additionnally, we have the looser bound:

1−m∑i=1

εi ≤ F(ρm×M ,

m⊗i=1

ψ⊗Mi

)≤ exp

(−

m∑i=1

εi

). (D2)

21

Proof. Since |ψ1〉 , . . . , |ψm〉 are pure states,

F

(ρm×M ,

m⊗i=1

ψ⊗Mi

)= Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ · · · ⊗ |ψm〉〈ψm|⊗M ], (D3)

and

F (ρMi , ψ⊗Mi ) = Tr[ρMi |ψi〉〈ψi|⊗M ]

= Tr[ρm×M (1⊗ |ψi〉〈ψi|⊗M ⊗ 1)],(D4)

for all i ∈ 1, . . . ,m, where 1 is the identity operator. The left hand side of Eq. (D1) is obtained by writing

F (ρm×M ,⊗m

i=1 ψ⊗Mi ) as a telescopic sum:

Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ · · · ⊗ |ψm〉⊗M 〈ψm|] = Tr [ρm×M1]

− Tr [ρm×M (1− |ψ1〉〈ψ1|⊗M )⊗ 1]

− Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ (1− |ψ2〉〈ψ2|⊗M )⊗ 1]

− Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ |ψ2〉〈ψ2|⊗M ⊗ (1− |ψ3〉〈ψ3|⊗M )⊗ 1]

− . . .− Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ |ψ2〉〈ψ2|⊗M ⊗ · · · ⊗ (1− |ψm〉〈ψm|⊗M )]

≥ 1−m∑i=1

Tr[ρm×M (1⊗ (1− |ψi〉〈ψi|⊗M )⊗ 1)]

= 1−m∑i=1

(1− Tr[ρm×M (1⊗ |ψi〉〈ψi|⊗M ⊗ 1)]

),

(D5)by linearity of the trace, where we used Tr (ρm×M ) = 1. This gives

F

(ρm×M ,

m⊗i=1

ψ⊗Mi

)≥ 1−

m∑i=1

(1− F

(ρMi , ψ

⊗Mi

)), (D6)

with Eqs. (D3) and (D4).

The right hand side of Eq. (D1) is obtained by Cauchy-Schwarz inequality and a simple induction:

Tr [ρm×M |ψ1〉〈ψ1|⊗M ⊗ · · · ⊗ |ψm〉〈ψm|⊗M ]

= Tr[(√

ρm×M |ψ1〉〈ψ1|⊗M ⊗ 1)(

1⊗ |ψ2〉〈ψ2|⊗M ⊗ · · · ⊗ |ψm〉〈ψm|⊗M√ρm×M

)]≤ Tr

[ρm×M |ψ1〉〈ψ1|⊗M ⊗ 1

]Tr[ρm×M (1⊗ |ψ2〉〈ψ2|⊗M ⊗ · · · ⊗ |ψm〉〈ψm|⊗M )

]≤ . . .

≤m∏i=1

Tr [ρm×M (1⊗ |ψi〉〈ψi|⊗M ⊗ 1)],

(D7)

where we used the cyclicity of the trace and the fact that |ψ1〉 , . . . , |ψm〉 are pure states. With Eqs. (D3) and (D4)this concludes the proof of Eq. (D1).By the inequality of arithmetic and geometric means,

m∏i=1

(1− εi) ≤(

1− 1

m

m∑i=1

εi

)m

≤ exp

(−

m∑i=1

εi

),

(D8)

22

which gives a looser bound in terms of the total single-mode deviation∑mi=1 εi:

1−m∑i=1

εi ≤ F(ρm×M ,

m⊗i=1

ψ⊗Mi

)≤ exp

(−

m∑i=1

εi

). (D9)

Note that Eq. (D1) is tight for small εi, since the right hand side is then equivalent to the left hand side. The looserbound in Eq. (D2) is also tight for small εi.

Note also that this result is not restricted to a particular protocol for fidelity estimation nor to the continuousvariable regime: if the fidelities of the single subsystems of a quantum state over m subsystems with some target purestates are higher than 1− λ

m , for some λ > 0, then by Lemma 2 the general state has fidelity at least 1− λ with thetensor product of the m pure states.

Appendix E: Proof of Lemma 3

In this section, we prove Lemma 3 from the main text which we recall below:

Lemma 8. Let β, ξ ∈ Cm and let V = S(ξ)D(β) U , where U is an m-mode passive linear transformation with m×munitary matrix U . For all α ∈ Cm, let γ = Uα+ β. Then,

Πξγ = VΠ0αV†. (E1)

Proof. Recall that the POVM elements for a tensor product of unbalanced heterodyne detections with unbalancingparameters ξ ∈ Cm are given by

Πξα =1

πm|α, ξ〉〈α, ξ| , (E2)

for all α, ξ ∈ Cm, where |α, ξ〉 = S(ξ)D(α) |0〉 is a tensor product of squeezed coherent states.The POVM elements of a tensor product of single-mode balanced heterodyne detection are given by Π0

α, for allα ∈ Cm, and we have

Πξα = S(ξ)Π0αS†(ξ). (E3)

In particular, a single-mode squeezing followed by a single-mode balanced heterodyne detection can be simulated byperforming directly an heterodyne detection unbalanced according to the squeezing parameter. One retrieves balancedheterodyne detection by setting the unbalancing parameter to 0 and homodyne detection by letting the modulus ofthe unbalancing parameter go to infinity.

Passive linear transformations correspond to unitary transformations of the creation and annihilation operatorsof the modes. These transformations, which may be implemented by unitary optical interferometers, map coherentstates to coherent states: if U is a passive linear transformation and U is the unitary matrix describing its action onthe creation and annihilation operators of the modes, an input coherent state |α〉 is mapped to an output coherent

state U |α〉 = |Uα〉, where Uα is obtained by multiplying the vector α by the unitary matrix U . Hence, the POVMelements of a passive linear transformation followed by a product of single-mode balanced heterodyne detections aregiven by

UΠ0αU† = Π0

Uα, (E4)

for all α ∈ Cm. This implies that the passive linear transformation U† followed by a tensor product of single-modebalanced heterodyne detections can be simulated by performing the heterodyne detections first, then multiplying thevector of samples obtained by U .

A similar property holds with single-mode displacements: since displacements map coherent states to coherentstates, up to a global phase, by displacing their amplitude, a single-mode displacement followed by a single-modeheterodyne detection can be simulated by performing the heterodyne detection first, then translating the sampleobtained according to the displacement amplitude. In particular we have

D(β)Π0αD†(β) = Π0

α+β, (E5)

23

for all α,β ∈ Cm, where α+ β = (α1 + β1, . . . , αm + βm).Combining the properties of heterodyne detection in Eqs. (E3), (E4) and (E5), we have:

UΠ0αU† = Π0

Uα,

D(β)Π0αD†(β) = Π0

α+β,

S(ξ)Π0αS†(ξ) = Πξα,

(E6)

for all α,β, ξ ∈ Cm and all m-mode passive linear transformations U with m × m unitary matrix U . WritingV = S(ξ)D(β)U , we obtain

VΠ0αV† = S(ξ)D(β)UΠ0

αU†D†(β)S†(ξ)

= S(ξ)D(β)Π0UαD

†(β)S†(ξ)

= S(ξ)Π0Uα+βS

†(ξ)

= ΠξUα+β.

(E7)

Appendix F: Proof of Theorem 2

In this section, we prove the efficiency of Protocol 2, which we recall below:

Protocol 2 (Multi-mode fidelity witness estimation). Let c1, . . . , cm ∈ N∗. Let |Ci〉 =∑ci−1n=0 ci,n |n〉 be a core state, for

all i ∈ 1, . . . ,m. Let U be an m-mode passive linear transformation with m×m unitary matrix U , and let β, ξ ∈ Cm.

We write |ψ〉 = S(ξ)D(β) U⊗m

i=1 |Ci〉 the m-mode target pure state. Let N,M ∈ N∗, and let p1, . . . , pm ∈ N∗ and0 < η1, . . . , ηm < 1 be free parameters. Let ρ⊗N+M be N +M copies of an unknown m-mode (mixed) quantum state ρ.

1. Measure all m subsystems of N copies of ρ with unbalanced heterodyne detection with unbalancing parametersξ = (ξ1, . . . , ξm), obtaining the vectors of samples γ(1), . . . , γ(N) ∈ Cm.

2. For all k ∈ 1, . . . , N, compute the vectors α(k) = U†(γ(k) − β

). We write α(k) = (α

(k)1 , . . . α

(k)m ) ∈ Cm.

3. For all i ∈ 1, . . . ,m, compute the mean FCi(ρ) of the function z 7→ g(pi)Ci

(z, ηi) (defined in Eq. (8)) over the

samples α(1)i , . . . , α

(N)i ∈ C.

4. Compute the fidelity witness estimate Wψ = 1−∑mi=1 FCi(ρ)M .

The value Wψ obtained is an estimate of a tight lower bound on the fidelity between the M remaining copies of ρ and

M copies of the m-mode target state |ψ〉 = S(ξ)D(β) U⊗m

i=1 |Ci〉. The efficiency and completeness of the protocolare summarised by the following result:

Theorem 6. Let ε > 0. With the notations of Protocol 2,

1 + log[F (|ψ〉⊗M ,ρ⊗M )

]− ε ≤Wψ ≤ F (|ψ〉⊗M ,ρ⊗M ) + ε, (F1)

with probability 1− P iidW , where

P iidW = 2

m∑i=1

exp

[− Nε

2+2cipi

M2+

2cipi KCi,pi

], (F2)

where for all i ∈ 1, . . . ,m, KCi,pi is a constant independent of ρ, defined in Eq. (B26). Moreover, if the tested state

is perfect, i.e., ρ⊗N+M = |ψ〉〈ψ|⊗N+M, then Wψ ≥ 1− ε with probability 1− P iidW .

Proof. We use the notations of the protocol above and we first prove the theorem in the case where the target state isa tensor product of single-mode pure states, i.e., S(ξ)D(β) U = 1 and α(k) = γ(k) for all k ∈ 1, . . . , N.

We thus consider for the target state a tensor product |ψ〉 =⊗m

i=1 |Ci〉 of core states. For all i ∈ 1, . . . ,m wewrite |Ci〉 =

∑cin=0 ci,n |n〉, where ci ∈ N∗, and ρi = Tr1,...,m\i(ρ) the reduced state of ρ over the ith mode. Let

24

ε > 0. For all i ∈ 1, . . . ,m, with ηi ≤etaCi,pi , defined in Eq. (B1), we have by Theorem 4, with ε

m :∣∣∣F (|Ci〉⊗M , ρ⊗Mi )− FCi(ρ)M∣∣∣ ≤ ε

m, (F3)

with probability higher than 1− P iidCi , where

P iidCi = 2 exp

[− Nε

2+2cipi

M2+

2cipi m

2+2cipi KCi,pi

], (F4)

where KCi,pi is a constant independent of ρ given in Eq. (B26). Hence, taking the union bound of the failureprobabilities P iidCi , we obtain∣∣∣∣∣1−

m∑i=1

(1− F (|Ci〉⊗M , ρ⊗Mi )

)−Wψ

∣∣∣∣∣ =

∣∣∣∣∣m∑i=1

(F (|Ci〉⊗M , ρ⊗Mi )− FCi(ρ)M

)∣∣∣∣∣≤

m∑i=1

∣∣∣F (|Ci〉⊗M , ρ⊗Mi )− FCi(ρ)M∣∣∣

≤ ε,

(F5)

with probability higher than 1− P iidW , where

P iidW = 2

m∑i=1

exp

[− Nε

2+2cipi

M2+

2cipi m

2+2cipi KCi,pi

]. (F6)

By Lemma 7, with ρm×M = ρ⊗M and |ψi〉 = |Ci〉,

1−m∑i=1

(1− F (|Ci〉⊗M , ρ⊗Mi )

)≤ F (|ψ〉⊗M ,ρ⊗M ) ≤ exp

[−

m∑i=1

(1− F (|Ci〉⊗M , ρ⊗Mi )

)]. (F7)

Hence,

1 + log[F (|ψ〉⊗M ,ρ⊗M )

]≤ 1−

m∑i=1

(1− F (|Ci〉⊗M , ρ⊗Mi )

)≤ F (|ψ〉⊗M ,ρ⊗M ). (F8)

With Eq. (F5) we obtain

1 + log[F (|ψ〉⊗M ,ρ⊗M )

]− ε ≤Wψ ≤ F (|ψ〉⊗M ,ρ⊗M ) + ε, (F9)

with probability 1− P iidW , where

P iidW = 2

m∑i=1

exp

[− Nε

2+2cipi

M2+

2cipi m

2+2cipi KCi,pi

], (F10)

where for all i ∈ 1, . . . ,m, KCi,pi is a constant independent of ρ, defined in Eq. (B26). Moreover, if the tested state

is perfect, i.e., ρ⊗N+M = |ψ〉〈ψ|⊗N+M, then F (|ψ〉⊗M ,ρ⊗M ) = 1. In that case, by Eq. (F16),

Wψ ≥ 1− ε, (F11)

with probability 1− P iidW .

We now generalise the previous proof to the case where the target state is of the form

|ψ〉 = S(ξ)D(β) U

m⊗i=1

|Ci〉 , (F12)

25

where for all i ∈ 1, . . . ,m each of the states |Ci〉 =∑ci−1n=0 ci,n |n〉 is a core state, where U is an m-mode passive

linear transformation with m×m unitary matrix U and where ξ,β ∈ Cm. To that end, we make use of the propertiesof heterodyne detection: by Lemma 8, writing V = S(ξ)D(β) U , the POVM VΠ0

αV†α∈Cm can be simulated with

the POVM Πξγγ∈Cm by computing α = U†(γ −β), i.e., translating the vector of samples γ by the vector of complex

amplitudes −β and multiplying the vector obtained by the m×m unitary matrix U†. Formally, let ρ be an m-mode(mixed) state, then,

Tr (V †ρV Π0α) = Tr (ρ VΠ0

αV†)

= Tr (ρΠξUα+β).(F13)

In particular, computing the fidelity witness estimate Wψ in Protocol 2, i.e., using samples γ from unbalancedheterodyne detection of copies of ρ post-processed as α = U†(γ − β), gives

1 + log

[F

(m⊗i=1

|Ci〉〈Ci|⊗M , (V †ρV )⊗M

)]− ε ≤Wψ ≤ F

(m⊗i=1

|Ci〉〈Ci|⊗M , (V †ρV )⊗M

)+ ε, (F14)

with probability 1− P iidW by Eq. (F16). Given that

F

(m⊗i=1

|Ci〉〈Ci|⊗M , (V †ρV )⊗M

)= F (ψ⊗M ,ρ⊗M ), (F15)

we finally obtain

1 + log[F (|ψ〉⊗M ,ρ⊗M )

]− ε ≤Wψ ≤ F (|ψ〉⊗M ,ρ⊗M ) + ε, (F16)

with probability 1− P iidW , where P iidW is defined in Eq. (F2).

The estimate of the fidelity witness obtained is tight when the fidelity is close to 1. For example, if F (|ψ〉⊗M ,ρ⊗M ) = 0.9,then

0.894− ε ≤Wψ ≤ 0.9 + ε. (F17)

Furthermore, the witness is quite robust: the value of the witness may still be relevant even when the fidelity is further

away from 1. For example, if F (|ψ〉⊗M ,ρ⊗M ) = 0.5, then

0.3− ε ≤Wψ ≤ 0.5 + ε, (F18)

with probability greater than 1− P iidW .Writing ni the number of indices j ∈ 1, . . . ,m such that cj = ci, for all i ∈ 1, . . . ,m, the number of samples

needed for a precision ε > 0 of the estimate Wψ and a confidence 1− δ scales as

N = O

(maxi

(Mm

ε

)2+2cipi

log(ni) log

(1

δ

)), (F19)

with Eq. (F2).

Appendix G: Removing the i.i.d. assumption for Protocol 2

In this section, we derive a version of Protocol 2 which does not assume i.i.d. state preparation.For N,M ∈ N∗, let Hi and Kk denote single-mode infinite-dimensional Hilbert spaces, for all i ∈ 1, . . . ,m and all

k ∈ 1, . . . , N +M. Let H be an m× (N +M)-mode infinite-dimensional Hilbert space. We write

H ' K⊗m1 ⊗ · · · ⊗ K⊗mN+M

' H⊗(N+M)1 ⊗ · · · ⊗ H⊗(N+M)

m .(G1)

26

. . .

. . .

m<latexit sha1_base64="hgrbGyfUs1b/Mr5+M32Ck4D9zmA=">AAAB6HicbVBNS8NAEJ3Ur1q/qh69LBbBU0mqoMeiF48t2FpoQ9lsJ+3a3STsboQS+gu8eFDEqz/Jm//GbZuDtj4YeLw3w8y8IBFcG9f9dgpr6xubW8Xt0s7u3v5B+fCoreNUMWyxWMSqE1CNgkfYMtwI7CQKqQwEPgTj25n/8IRK8zi6N5MEfUmHEQ85o8ZKTdkvV9yqOwdZJV5OKpCj0S9/9QYxSyVGhgmqdddzE+NnVBnOBE5LvVRjQtmYDrFraUQlaj+bHzolZ1YZkDBWtiJD5urviYxKrScysJ2SmpFe9mbif143NeG1n/EoSQ1GbLEoTAUxMZl9TQZcITNiYgllittbCRtRRZmx2ZRsCN7yy6ukXat6F9Va87JSv8njKMIJnMI5eHAFdbiDBrSAAcIzvMKb8+i8OO/Ox6K14OQzx/AHzucP1tuM9Q==</latexit>

mk

<latexit sha1_base64="8KqbklZk5oG1NAg1iyR68epYKPc=">AAAB+3icdVDLTgIxFO3gC/E14tJNIzFxNZmBQWBHdOMSE3kkgKRTOtDQdiZtx0gIv+LGhca49Ufc+Td2ABM1epImJ+fcm3t6gphRpV33w8qsrW9sbmW3czu7e/sH9mG+paJEYtLEEYtkJ0CKMCpIU1PNSCeWBPGAkXYwuUz99h2RikbiRk9j0udoJGhIMdJGGtj5Hkd6HIQ9RUccDSa3PDewC65zXiyW/Sp0nYrrueWaIdWK79dK0HPcBQpghcbAfu8NI5xwIjRmSKmu58a6P0NSU8zIPNdLFIkRnqAR6RoqECeqP1tkn8NTowxhGEnzhIYL9fvGDHGlpjwwk2lS9dtLxb+8bqLDan9GRZxoIvDyUJgwqCOYFgGHVBKs2dQQhCU1WSEeI4mwNnWlJXz9FP5PWkXHKznFa79Qv1jVkQXH4AScAQ9UQB1cgQZoAgzuwQN4As/W3Hq0XqzX5WjGWu0cgR+w3j4BN6+UkQ==</latexit>

FIG. 4: The notations for the subsystems of a quantum state ρm×(N+M) over m× (N +M) modes, seen as N +M groups

of m subsystems or as m groups of N +M subsystems. The red dots depict the single-mode subsystems of ρm×(N+M). Thereduced state of ρm×(N+M) corresponding to the ith group of N +M subsystems is denoted ρN+M

i , for all i ∈ 1, . . . ,m, and

the reduced state of ρm×(N+M) corresponding to the kth group of m subsystems is denoted σmk , for all k ∈ 1, . . . , N +M.

For any ρm×(N+M) ∈ H, we define

σmk = TrH\K⊗mk(ρm×(N+M)), (G2)

the m-mode reduced state over K⊗mk , for all k ∈ 1, . . . , N +K +Q+M. We also define

ρN+Mi = TrH\H⊗(N+M)

i(ρm×(N+M)), (G3)

the (N +M)-mode reduced state over H⊗(N+M)i , for all i ∈ 1, . . . ,m (see Fig. 4).

The protocol is then as follows:

Protocol 5 (General multimode-mode fidelity witness estimation). Let c1, . . . , cm ∈ N∗. Let |Ci〉 =∑ci−1n=0 ci,n |n〉 be

a core state, for all i ∈ 1, . . . ,m. Let U be an m-mode passive linear transformation with m ×m unitary matrix

U , and let β, ξ ∈ Cm. We write |ψ〉 = S(ξ)D(β) U⊗m

i=1 |Ci〉 the m-mode target pure state. Let N,M ∈ N∗, and letp1, . . . , pm ∈ N∗, 0 < η1, . . . , ηm < 1, and E1, . . . , Em, S1, . . . , Sm ∈ N be free parameters. We write N = N ′ +K +Q,for N ′,K,Q ∈ N. Let ρm×(N+M) ∈ H be an unknown quantum state over m× (N +M) subsystems.

1. Measure all the m subsystems of N = N ′+K+Q chosen at random m-mode reduced states σmk (see Eq. (G2)) of

ρm×(N+M) with unbalanced heterodyne detection with unbalancing parameter ξ, obtaining the vectors of samplesγ(1), . . . ,γ(N ′+K+Q) ∈ Cm. Let ρm×M be the remaining state over m×M subsystems.

2. Discard the last Q vectors of samples.

3. For all k ∈ 1, . . . , N ′ +K, compute the vectors α(k) = U†(γ(k) − β

). We write α(k) = (α

(k)1 , . . . α

(k)m ) ∈ Cm.

4. For all i ∈ 1, . . . ,m, record the number Ri of samples α(k)i such that |α(k)

i |2+1 > Ei, for k ∈ N ′+1, . . . , N ′+K.The protocol aborts if Ri > Si for any i ∈ 1, . . . ,m.

5. For all i ∈ 1, . . . ,m, compute the mean FCi(ρ) of the function z 7→ g(pi)Ci

(z, ηi) (defined in Eq. (8)) over the

samples α(1)i , . . . , α

(N ′)i ∈ C.

27

6. Compute the fidelity witness estimate Wψ = 1−∑mi=1 FCi(ρ)M .

Akin to Protocol 4 compared to Protocol 1, this protocol differs from Protocol 2 by two additional classical post-processing steps, steps 2 and 4. These steps are part of a de Finetti reduction for infinite-dimensional systems [64]detailed in [57]. In particular, step 3 is an energy test, and the energy parameters Ei and Si should be chosen toguarantee completeness, i.e., if the perfect state is sent then it passes the energy test with high probability.

The value Wψ obtained is an estimate of a tight lower bound of the fidelity between the remaining state ρm×M overm×M subsystems and M copies of the m-mode target state |ψ〉. The efficiency of the protocol is summarised by thefollowing result:

Theorem 7. Let ε > 0. With the notations of Protocol 4 and η ≤ ηC,p, defined in Eq. (B1),

1 + logF (|ψ〉⊗M ,ρm×M )−O(ε) ≤Wψ ≤ F (|ψ〉⊗M ,ρm×M ) +O(ε) (G4)

or the protocol aborts in step 3, with probability greater than 1− PW , where

PW = O

(1

poly(m,M, 1ε )

), (G5)

for

N = O

(M7+ 2c

p m4+ 2cp

ε4+ 2cp

). (G6)

Proof. For the proof we only consider the case where the target state is a tensor product of core states |ψ〉 =⊗m

i=1 |Ci〉,i.e., S(ξ)D(β) U = 1, since the generalisation to the multi-mode target states of the form S(ξ)D(β) U

⊗mi=1 |Ci〉 using

Lemma 3 is identical to the i.i.d. case, detailed in section F. Then, the proof is similar to the one of Theorem 6, usingTheorem 5 instead of Theorem 4.

Writing ρm×M ∈ H⊗M1 ⊗ · · · ⊗ H⊗Mm , for all i ∈ 1, . . . ,m (see Fig. 4 with N = 0), let

ρMi = Tr⊗j 6=iH

⊗Mj

(ρm×M ), (G7)

be the reduced state over H⊗Mi of the state ρm×M . By Theorem 5,∣∣∣F (|Ci〉⊗M ,ρMi )− FCi(ρ)M∣∣∣ = O(ε) (G8)

or the protocol aborts in step 3, with probability greater than 1− PCi , where

PCi = O

(1

poly(M, 1ε )

), (G9)

for

N = O

(M7+ 2c

p

ε4+ 2cp

). (G10)

Replacing ε by εm and taking the union bound of the failure probabilities we obtain∣∣∣∣∣1−

m∑i=1

(1− F (|Ci〉⊗M ,ρMi )

)−Wψ

∣∣∣∣∣ =

∣∣∣∣∣m∑i=1

(F (|Ci〉⊗M ,ρMi )− FCi(ρ)

)∣∣∣∣∣≤

m∑i=1

∣∣∣F (|Ci〉⊗M ,ρMi )− FCi(ρ)∣∣∣

= O(ε),

(G11)

or the protocol aborts in step 3, with probability greater than 1− PW , where

PW = O

(1

poly(m,M, 1ε )

), (G12)

28

for

N = O

(M7+ 2c

p m4+ 2cp

ε4+ 2cp

). (G13)

By Lemma 7 we have

1 + logF (|ψ〉⊗M ,ρm×M ) ≤ 1−m∑i=1

(1− F (|Ci〉⊗M ,ρMi )

)≤ F (|ψ〉⊗M ,ρm×M ), (G14)

so with Eq. (G11) we finally obtain

1 + logF (|ψ〉⊗M ,ρm×M )−O(ε) ≤Wψ ≤ F (|ψ〉⊗M ,ρm×M ) +O(ε) (G15)

or the protocol aborts in step 3, with probability greater than 1− PW , where

PW = O

(1

poly(m,M, 1ε )

), (G16)

for

N = O

(M7+ 2c

p m4+ 2cp

ε4+ 2cp

). (G17)

Since the parameter p ∈ N∗ may vary freely, the asymptotic scaling of the number of samples N needed for a precision

ε > 0 and a polynomial confidence thus is given by N = O(M7m4

ε4 ).