Simulating MIP(2,1) protocols by MIP (3,1) , and IP protocols by

MIP (2,1)
Hirotada Kobayashi and Keiji Matsumoto
February 25, 2008

Introduction

We simulate classical interactive proof systems by the ones with the quantum provers and the classical verier.
Here, quantum provers may share an arbitrary entangled state. Especially, we simulate (1) 1-round 2-provers MIP
proof systems by 1-round 3-quantum provers MIP* proof systems, and (2) polynomial-rounds IP proof systems with
1-round 2-quantum provers MIP* proof systems.

Notations and conventions

jjthe dierence of probability distributionsjj1 means the total variation (statistical distance).
Pi : the ith prover.(i = 1; 2;

:), V : the verier.

Pi : the private space of ith prover. V: V s private space.

N
: the initial state of i Pi .

3
3.1

Simulating polynomial round classical single prover by 2-quantum

prover
Assertion

Theorem 1 Suppose there is a classical single prover, r-rounds interactive proof system which accepts a language
L with the probability pc and ps for completeness side and soundness side, respectively. Suppose also that the
probability distribution for the th and 0 th round question are mutually independent. Based on such a protocol, we
can construct a classical protocol for a proof system with two quantum provers such that the acceptance probability
for the completeness side is pc , and the acceptance probability for the soundness pqc
c is upperbounded as follows.
pqc
s

1 ps
5 (r 1)

Here, the provers may share an arbitrary entangled state.

3.2

A protocol

Suppose that in a classical protocol, the verier asks question q ( = 1;

; r) and the prover replies a at th
round ( = 1;
; r). The set of questions q := q1 q2
qr is denoted by Q. A corresponding 2-quantum prover
protocol is described as follows.
Qr
(1) The verier generates q, according to the distribution p (q1 ; q2 ;
; qr ) =
=1 p (q ). The verier asks q =
q1 q2
qr to P1 , and qr0 := q1
qr0 to P2 . where r0 2 f1; r 1g is chosen randomly.
(2) P1 and P2 sends a1

ar and a0r0 := a01

a0r0 to the verier, respectively.

1

(3) The verier checks the consistency of the answers. If the consistency is checked, he proceeds to the verication
procedure of the classical IP protocol.

3.3

Proof of the theorem 1

Obviously, the acceptance probability of the protocol for the completeness side cannot be smaller than the classical
protocol, since the provers can only do classical operations, generating a depending only on q . Hence, we below
discuss only the soundness side, where the dishonest provers can increase the probability of acceptance.
If the provers are dishonest, in general, the state of P1 P2 can be an entangled state. Each prover performs
a local measurement, whose composition depends on q and qr0 respectively, and sends its measurement result, a
and a0r0 , respectively, to the verier. (Composition of unitary operations, measurements, and computations are
encapsulated in a measurement.) Since our protocol is single round, we are only interested in the statistics of each
measurement, which is encapsulated in a POVM. We denote by fMaq g the POVM of the measurement by P1 . Here,
subscript indicates the measurement result corresponding to each operator, andP
the composition of the measurement
q
depends
on
the
question
from
the
verier
indicated
as
the
superscript.
Hence,
a Ma = 1. Similarly, we denote by
o
n
P
q
q
~ arr0 = 1.
~ arr0 the POVM by P2 , and
M
M
a r0

Let q = q1 q2
qr be an elements of Q. The way to choose q will be discussed later, but for a while,we choose
it randomly according to the same distribution as q.
q1 q q +1 qr
Let us dene Maq := Ma
and denote by Maq the marginal of Maq on a = a1
a . We dene
q
q
q
q
p
p
q
q
q
q
q
~a
~ aq . We also
M
Ma , qa ( ) := Ma
Ma , ~ qa ( ) := M
the following CP maps: qa ( ) := Ma
dene
X
q
q
a :
a :=
a

qr , though we do not
Note that qa is not the marginal of qa . Note also that qa and a depends on q +1
write explicitly.
By c (r0 ), we denote the probability that the answer from the two provers are consistent
Pr conditioned that the
particular value of r0 is chosen. c is the average probability of consistency, and c = r 1 1 r0 =1 c (r0 ).
qr
q2
q1
Our strategy is to show qa
ar
a2
a1 , or (6). This means that P1 is forced to generate a depending
only on q . First we show the key inequalities used in the proof. Below, E means the expectation.
Lemma 2 We have following inequalities:
X
q +
Eqq
a +
a

Eqq

Eqq
Eqq

~ qa

q
a

q
a

~ qa

I ( )
~ qa

~ qa

+
+

q
a

( )
I ( )

q
a

~ aq

1
1

q
a

~ qa

1
1

( )

p
3 1

p
3 1

p
6 1

( );

(1)

( ):

(2)

( );

(3)

1)

(4)

Its proof will be presented in the appendix B. Here, we show intuitive discussion which suggests these inequalities.
A key observation is as follows. If a particular measurement result occurs with certainty, the quantum state
cannot be changed by the measurement. In our case, by convention, suppose P1 does his measurement rst. Then,
the perfect coincidence means that P2 s measurement cannot demolish the state after the measurement by P1 . By
replacing the order of the measurement, we also have that P1 s measurement cannot demolish the post measurement
state by P2 . Since the coincidence has to occur only with high probability, non-demolishment has to be true only
approximately, and goodness of this approximation should be increasing in 1
c . Thus, the inequalities (1)-(3).
(3) follows from the inequalities (1)-(3) and the triangle inequality. Note also, for a0 1 6= a 1 , we have
q 1q
~ qa 11 0;since the coincidence occurs with high probability. Hence the inequality (4) has to be true.
a0 1 a
Combination of (1)-(4) leads to the following lemma.

Lemma 3

Eqq

q
a

q
a

q
a

I( )

1
1

p
10 1

1) :

1
1

q
a

Proof.
X

Eqq

q
a

q
a

q
a

q
a

q
a

~ qa

I ( )

1
1

Eqq

( )

1
1

+ Eqq

I ( )

1
1

(5)

X
c

~ aq

q
a

(1
p
4 1

q
a

The rst term of the RHS of (5) is evaluated as follows.

X
q
q
~ qa 1 ( )
Eqq
I
a
a
1
Eqq

~ qa

q
a

p
1)) + 3 1

(
c

~ qa

q
a

1
1

1
1

( )

+ Eqq

q
a

~ qa

q
a

1
1

( )

1)

1);

where the inequality in the third line is due to the identity (4) and the inequality (1). The second term of (5) is,
using the lemma 10, upperbounded by
X
p
q 1
Eqq
I ~ qa 11
I ( )
6 1
1) ;
c(
a 1
1

where the inequality is due to (3).

We had almost proven the theorem. The rest of the task is to concatenate the lemma 3 and to show the existence
of good choice of q . First, we have
X

Eqq

q
a

q1
a1

qr
ar

q2
a2

qr
ar

qr0 +2
ar0 +2

I( )

r 1 X
X

Eqq

qr0 +1
ar0 +1

qr0 +2
ar0 +2

qr
ar

qr0 +1
ar0 +1

qr0
a r0

I( )

r0 =1 a
r 1
X

Eqq

r0 =1 a1
r 1
X

r0 =1

qr0
a r0

I( )

ar0 +1

p
10 1

10 (r

qr0 +1
ar0 +1

qr0 +1
ar0 +1

p
1) 1

(r0 )
c

The inequality in the third line is due to the lemma 10, the inequality in the fourth line is due to the lemma 3, and
p
the last inequality is due to convexity of . Since this is true for the average over all q , there at least is a particular
pair of q with
X
p
q
qr
q2
q1
Eq
I ( ) 1 10 (r 1) 1
(6)
c:
a
ar
a2
a1
a

Therefore, if x 2
= L, the input is accepted with the probability not larger than
(
1 X
q
qr
q2
q1
max 1; ps + Eq
c
a
ar
a2
a1
2
a
p
=
max 1; ps + 5 (r 1) 1
c
c
1

1 ps
5 (r 1)

I( )

3.4

Correlated sequence of questions

So far, we have assumed that the probability distribution for q and q 0 are independent, since it is su cient to
accept PSPACE. However, it may be interesting to simulate simulate correlated sequence of questions by single
round protocol. Indeed, it turns out to be possible, and the proof of the validity of the protocol is easier.
(1) The verier generates q, according to the distribution p (q1 ; q2 ;
; qr ), and choose r0 2 f1; r 1g uniformly
randomly. The verier asks qr0 := q1
qr0 to P2 , and ips a coin. With probability 12 , he asks P1 either qr0
or qr0 +1 , respectively.
(2) P1 and P2 reply.
(3) The verier checks the consistency of the answers. If the verier had asked q r to P1 , after checking the
consistency, he proceeds to the verication procedure of the classical IP protocol.
Theorem 4 Suppose there is a classical single prover, r-rounds interactive proof system which accepts a language
L with the probability pc and ps for completeness side and soundness side, respectively. Also, we assume that the
question to the questions are generated non-adaptively, i.e., all the questions q1 , q2 ,
, qr0 are generated before the
protocol starts. Based on such a protocol, we can construct a classical protocol for a proof system with two quantum
provers such that the acceptance probability for the completeness side is
pqc
c =

pc + 2 (r
2 (r

1)
1)

=1

1 pc
;
2 (r 1)

and the acceptance probability for the soundness pqc

c is upperbounded as follows.
pqc
s

1
2

1 pc
6 (r 1)

Here, the provers may share an arbitrary entangled state.

qc
pqc
c is trivial. Hence, we analyze ps .
If the provers are dishonest, in general, the state of P1 P2 can be an entangled state. Each prover performs a
local measurement, whose composition depends on the
from the verier, and send back the measurement
o
n questions
q
q
~
and Ma the POVM of the measurement by P1 and P2 when
result. In this section, we denote by Ma
q
a . We dene the following CP maps:
) is the marginal of Maq on a = a1
the question is q . Ma (
q
q
q
q
P
q
q
q
q
q
q
q
q
~a
~ a , a :=
Ma
Ma , ~ a ( ) :=
M
M
Let us denote by c ( ; ) the
a ( ) :=
a +1 ar a
probability of the consistency when q and q is send to P1 and P2 , respectively.
The evaluation of the performance of this protocol is indeed easier than the previous one, where we had to
q
construct qa11 ,
, arr 11 from the real proversaction qa . In this protocol, qa is real.

Lemma 5
Eq

X
a

Eq

~q

q
a

q
a

~ qa

q
a

~ qa

q
a

I ( )

q
a

I ( )

Eq

X
a

Eq
Eq

~ qa

~ qa

I
q
a

( )
I ( )

q
a

~q
a

q
a

~q

( )

p
3 1

p
3 1

p
3 1

p
6 1

( ;

( ; );

(8)

( ; );

(9)

( ; );

(10)

1)

(11)

( ;

1) ;

(7)

The proof of this is similar to the inequalities (1)-(4). Using these inequalities, we have the following lemma.

Lemma 6
Eq

q
a

q
a

q
a

I( )

1
1

p
6 1

( ;

1) + 6

1;

1):

1
1

I ( )

Proof.
Eq

q
a

q
a

q
a

q
a

q
a

~ aq

I ( )

1
1

Eq

( )

1
1

+ Eq

~ qa

q
a

q
a

1
1

q
a

(12)

The rst term of the RHS of (12) is evaluated as follows.

Eq

q
a

q
a

~q

~ qa

q
a

( )

1
1

Eq

X
a

(1
p
4 1

p
1)) + 3 1

( ;
c

( ;

~q

q
a

1
1

( ;

1
1

( )

+ Eq

q
a

q
a

~ qa

1
1

( )

1)

1);

where the inequality in the third line is due to the identity (11) and the inequality (7). The second term of (12) is,
using the lemma 10, upperbounded by
X
p
q 1
I ~ aq 11
I ( )
Eq
6 1
1;
1) ;
c(
a 1
1

where the inequality is due to (10).

We had almost proven the theorem. The rest of the task is to concatenate the lemma 6. First, we have
Eq

q
a

q1
a1

qr
ar

q2
a2

qr
ar

qr0 +2
ar0 +2

I( )

Eq

r 1 X
X

qr0 +1
ar0 +1

qr0 +2
ar0 +2

qr
ar

qr0 +1
ar0 +1

qr0
a r0

I( )

r0 =1 a

Eq

r 1
X

r0 =1 a1
r 1
X

r0 =1

qr0 +1
ar0 +1

qr0 +1
ar0 +1

qr0
a r0

I( )

ar0 +1

p
6 1

p
(r0 + 1; r0 ) + 6 1

(r0 ; r0 )

12 (r

p
1) 1

Therefore, if x 2
= L, the input is accepted with the probability not larger than
(
1
1
1 X
q
qr
1
max 1; ps + Eq
c+
a
ar
2 (r 1)
2 (r 1)
2
a
1

2 (r

1
1

1
1
2

1)
1
2 (r

2 (r

1)

1 p
6 (r 1)

1)

1 p
6 (r 1)

max 1; ps + 6 (r
2

p
1) 1

c:

q2
a2

q1
a1

I( )

4
4.1

Simulating classical 2-classical-prover proof system by 3-quantumprover proof system

Assertion

Theorem 7 Suppose there is a classical two provers one round interactive proof system which accepts a language
L with the probability pc and ps for completeness side and soundness side, respectively. Based on this protocol, we
can construct a classical protocol for three quantum provers with unlimited entanglement such that the acceptance
probability for the completeness side is pc , and the acceptance probability for the soundness pqc
c is upperbounded as
follows:
2
1 ps
:
pqc
1
s
6 max fjQ1 j ; jQ2 jg
Corollary 8 NP

4.2

1
polynomial ),

MIP (3; 1; 1; 1

NEXP

1
exp(cn) ).

MIP (3; 1; 1; 1

A protocol

Suppose that the verier asks q 1 2 Q1 and q 2 2 Q2 to the rst and the second prover respectively, in a given this
symmetrized classical proof system. Our quantum protocol with classical messages is as follows.
(1) The verier ask q 1 2 Q1 and q 2 2 Q2 to P1 and P2 , respectively. With probability 12 , he asks P3 either q 1 2 Q1
or q 2 2 Q2 . The joint probability distribution of q1 , q2 is denoted by p(q 1 ; q 2 ), and its marginal distributions
are denoted by p1 (q 1 ) and p2 (q 2 ).
n 2o
n 1o
, and send the measurement result a1 2 A1
and Naq
(2) P1 and P2 performs the measurement Maq
a2A2n
a2A1 n
o
o
ea;q2
faq1
), in case that the question from
( N
and a2 2 A2 to the verier. Meantime, P3 performs M
a2A2

a2A1

the verier is an element of Q1 ( Q2 , respectively). He sends the measurement result a3 to the verier.

(3) The verier checks the relation a1 = a3 ( a2 = a3 ), in case that the veriers question is an element of Q1 (Q2 ,
respectively).

4.3

Some more denitions

12

4.4

:= trP3
p
p
p q p q q
q
~ aq
~ aq , q := P qa
Ma
Ma , ~ a ( ) := M
M
a ( ) :=
a
p
p
p
p
P
q
~aq
~aq , q := q qa
N
Naq
Naq , ~ qa ( ) := N
a ( ) :=
a
P
P
1
q
fq , 2 (q) :=
eq
1 M
Naq N
c (q) :=
a
c
a
a trMa
a tr1
P
P
1
1
1
1
+ 21 q2 2Q2 p2 q 2 1c q 2
c := 2
c q
q1 2Q1 p1 q

Proof of the theorem

Lemma 9
q

12

12

p
6 1
p
6 1

12
1
12
1

1
c

(q);

(13)

1
c

(q)

(14)

Proof. We only prove the rst one. By monotonicity of the trace distance,
q

12

12

I( )

Using the same argument as the proof of the inequality (3), we have (13).

I ~q ( )

Observe that
q0

q 00

q 000

12

12

q0

q 00

q 000

12

q0

q0

q 00

q 000

12

1
q 00

q 000

12
1

q 00

+ I
q

q 000

12

12

1
q 000

+ I
p
6 1

1
c

12

(q) + 6

p
1

1
c

12

12
1

q0

12

q 000

1
q 00

12

q 00

12

(q 0 ) + 6

12

12
1

12
1

q 00

+ I

q 00

+ I

12

p
1

2
c

12

(q 00 ) + 6

p
1

2
c

(q 000 );

(15)

where the last inequality is due to (13).

Suppose that, prior to the protocol starts, the provers had measure their quantum state by a sequence of
measurements
1
1
Y
Y
q1
q2
;
=jQ1 j

=jQ2 j

and reply to the veriers question obeying this measurement outcome. Obviously, with such a strategy, the provers
cannot cheat the verier beyond the classical limit. Below, we show that any proversstarategy can be approximated
by such an imaginary strategy in terms of the joint probability distribution of a1 0 , a2 0 for all 0 and 0 .
The joint probability distribution of a1 0 , a2 0 of the imaginary strategy is
X

tr

1
Y

1
Y

q1
a

=jQ1 j

q2
a

12

q1 0
a 0

= tr

1
Y

=jQ2 j

0;

0)

6=

0;

0)

=
a

X
0

;a

tr

1
Y

1
Y

q1 0
a 0

1
Y

q1
1

0 1
X
p
1
6

1
c

q2 0
a 0

q1
1

1
Y

=
q2

12

=1

1
0 1q
X

=1

where the inequality in the last line is due to (15).

0,

2
c

q2

6=

q2
0
a 0

q2

12

(q 1 ) + 6

1
Y

q1
0
a 0

between this and the realprobability distribution tr

where the sum in the LHS is taken for variables a1 , and a2 with

q2 0
a 0

q1

12

0.
12

q2

12

We are interested in the dierence

.

tr

q1 0
a 0

q2 0
a 0

12

Therefore, if pi (q1i ) pi (q2i )

X
p(q 1 0 ; q 2 0 )
0;

jQ1 j

p1 (q 1 0 )

0;

0)

jQ1 j

=1

0 1
X
p

1
c

jQ2 j

(q 1 ) + 6

0 = +1

0 1q
X

p2 (q 2 0 )

0 =1

=1

jQ1 j

X X
=1

jQ1 j

0 =1

i
pi (qjQ
) (this can be assumed without loss of generality),
ij

p
p1 (q 1 0 ) 1

p
jQ1 j p1 (q 1 ) 1

1
c

(q 1 ) + 6

jQ2 j

1
c

(q 1 ) + 6

jQ2 j

=1

q
p2 (q 2 0 ) 1

0 = +1

q
jQ2 j p2 (q 2 ) 1

jQ1 j

p
1X
12 max fjQ1 j ; jQ2 jg @
p1 (q 1 ) 1
2 =1
v
u jQ1 j
u1 X
12 max fjQ1 j ; jQ2 jg t
p1 (q 1 ) (1
2 =1
p
= 12 max fjQ1 j ; jQ2 jg 1
c

q2

=1

jQ2 j

X X
=1

2
c

2
c

2
c

q2

q2

jQ2 j
q
1X
1 (q 1 ) +
p2 (q 2 ) 1
c
2 =1
1
c

(q 1 )) +

jQ2 j
1X
p2 (q 2 )
2 =1

2
c

2
c

q2 A

q2

Suppose that there is a classical protocol which accepts the language L with the probability pc and ps for completeness side and soundness side, respectively. Based on this protocol, our modied quantum protocol with classical
message will accept L with the probability pc . The acceptance probability for the soundness pqc
s is upperbounded
as follows:
2
3
X
1
pqc
min 41; ps +
p(q 1 0 ; q 2 0 ) ( 0 ; 0 )5
c
s
2 ;
0
0
p
ps + 6 max fjQ1 j ; jQ2 jg 1
c
c min 1;
1 ps
6 max fjQ1 j ; jQ2 jg

1
To see this, let y =

and see how the function

y 2 )(ps + 6y max fjQ1 j ; jQ2 jg) ;

f (y) = (1

behaves in the interval [0; 1]. At y = 0; f (0) = pc 1, f 0 (0) > 0. f 0 (y) stays positive until y reaches y , and then
f 0 (y) turns to negative, and in the end, f (1) = 0: Meantime, pc + 6y max fjQ1 j ; jQ2 jg is monotone increasing, and
1 ps
. Observe y is smaller than y . Therefore, the upperbound to pqc
reaches f (y) = 1 at y = y := 6 maxfjQ
cc
1 j;jQ2 jg
equals f (y) in the interval [0; y ] and equals 1 y 2 in the interval [y ; 1], which takes maximum at y = y , and
we have the upperbound presented above.

References
[1] A. Winter, "Coding Theorems of Quantum Information Theory," doctoral thesis, quant-ph/9907077 (1999)

Some useful facts

Lemma 10 Let f

ag

be an instrument, i.e.,
X
k

a
a

is a CP map and

(X)

(Y )k1

kX

is trance preserving. Then,

Y k1

Proof. Observe that an instrument can be viewed as a CPTP map from a state to a pair of classical informations
and states. In other words, the map
M
X!
a (X)
a

is a CPTP map. Therefore,

X
a

(X)

(Y )k1

and X :=

Lemma 12 Let Xa and

(X)

(Y )

Y k1 :

be a state, X be a positive operator with X

X

p
3 1

1. Then, we have

trX

Xa , we have the following lemma.

P
P
be a positive Hermitian matrices with a Xa 1 and a tr
s
X
X
p
p
X
X
3
1
trXa a
a a
a
a
a

kX

p
:=

X M
a

Lemma 11 (Lemma 1.4, winter ) Let

Letting

= 1. Then,

Proof of the lemma 2

In the proof or the following lemma, we repeatedly use the following argument. Since q and q obey the same
probability distribution and the probability distribution of q and q 0 are independent, we have
Eqq

q
a

tr

~q

+
+

( )

Eqq

Eq

Eq

qr

+ +1

~q

( )

Eqq

q
a

tr

trMa

+ +1

qr

~ aq
M

trMaq

~ aq
M

~ aq
M

trMaq

=
Proof. We use the lemma 12. Let
X

q
a

q
a

~ qa

+
+

:=

+
+

q
a

+
+

c ( ):

I ( ) and Xa

I ( )

s
3 1

=
Since

s
3 1

(16)
+

:= I

tr I

~ aq
M

tr

q
a

q
a

+
+

I ( )

~ q , and we obtain
M
a

~ qa

+
+

( );

is concave, taking the average both side, we have the inequality (1). The inequality (2) is proved almost
analogously. Let a + := I ~ qa +
( ) and Xa := Maq
I, and we obtain
Eqq

X
a

q
a

+
+

~ qa

~ qa

( )

s
3 1

Eqq

X
a

tr

q
a

+
+

~ qa

( );

which is nothing but our second inequality. The inequalities (1)-(2), with the help of the triangle inequality, leads
to (3).
q
The identity (4) is proved as follows. Since qa
1( )
1 ( ) due to the denition of qa ,
a
o
Xn
X
q
q 1
q
q 1
q
q 1
q
q 1
~
~
~
~
(
)
tr
(
)
=
E
tr
(
)
Eqq
qq
a
a 1
a
a 1
a
a 1
a
a 1
a

Combining this identity with the identity (16), we have (4).

10

Eqq tr

q
a

~ qa

1
1

( ):