CODES AND PROTOCOLS FOR DISTILLING T, CONTROLLED-S, AND

TOFFOLI GATES FOR USE IN QUANTUM CIRCUITS

FIELD

This application concerns quantum computing and quantum circuits. For example, among the embodiments disclosed herein are codes and protocols to distill T. controlled- 5, and Toffoli (or CCZ) gates for use in quantum circuits.

SUMMARY

Many schemes for quantum computation rely on first implementing a set of operations called the Clifford operations. These operations do not suffice for universal quantum computation, and so these schemes then implement additional operations, such as T-gates (rotation by angle pi/8), Toffo!i gates (a reversible version of the AND gate), controlled-S gates (a controlled phase gate with pure imaginary phase) or other non-Clifford operations. The implementation of these additional operations is equivalent to being able to produce a certain resource, called a magic state: using a magic state, one can produce one of these operations and vice-versa. These additional operations are typically implemented with limited accuracy in the physical hardware, and so it is desirable to use some method to increase this accuracy. A typical method, called distillation, uses several low quality magic states to produce a smaller number of high quality magic states.

In this disclosure, improved codes are described for the distillation of these states for T gates, controiled-S gates, and Toffoli gates. Examples of these codes use lower overhead for a given target accuracy relative to other distillation techniques.

In certain embodiments, a Reed-Muller magic state distillation protocol is generated for creating magic states in the quantum computing device, and the quantum computing device is configured to implement the Reed-Muller magic state distillation protocol. In particular implementations, the Reed-Muller magic state distillation protocol is for Toffoli gates or controlled-controlled-Z (CCZ) gates. In some implementations, logical vectors implemented by the protocol allow 10 CCZ magic states for 512 qubit code with eighth order error reduction. In certain implementations, the protocol uses R-M stabilizers as shown and described herein.

In some embodiments, a magic state distillation protocol for T gates. controlled-S gates, or CCZ gates is generated using a randomized construction process, and the quantum computing device is configured to implement the magic state distillation protocol. In certain implementations, the magic state distillation protocol has an asymptotic distillation efficiency — ^■ 1.

In particular embodiments, a magic state distillation protocol for T gates, controlled-S gates, or CCZ gates is generated, wherein the magic state distillation protocol includes tri- orthogonal codes for reducing circuit depth, and the quantum computing device is configured to implement the magic state distillation protocol.

In certain embodiments, a controlled- Z operator using a transversal T gate are measured to measure stabilizers of a CCZ magic state. In certain implementations, the stabilizers of the CCZ magic state achieve a second order error reduction. Further, the stabilizers of the CCZ magic state achieve a fourth order error reduction.

In some embodiments, stabilizers of CCZ magic states using one or more transversal CCZ gates are simultaneously measured, in certain implementations, the stabilizers of the CCZ magic state achieve a fourth order error reduction.

In particular embodiments, a magic state distillation protocol for T gates is generated, wherein the magic state distillation protocol includes punctured Reed-Muller codes, and the quantum computing device is configured to implement the magic state distillation protocol. In particular implementations, the punctured Reed-Muller codes comprise any of the Reed-Muller codes as disclosed herein. In further implementations, the punctured Reed- Muller codes are punctured higher-order (above first-order) Reed-Muller codes as disclosed herein. In certain implementations, the punctured Reed-Muller codes are selected based on Hamming distances.

In some embodiments, a magic state distillation protocol is generated using only k ÷ ηχ total qubits, and the quantum computing device is configured to implement the magic state distillation protocol. In particular implementations, the magic state distillation protocol is based on a triorthogonai code.

Any features or aspects of the disclosed embodiments can be used in various combinations and subcombinations with one another. For example, one or more method acts or features from one embodiment can be used with one or more method acts or features from another embodiment and vice versa. The foregoing and other objects, features, and advantages of the invention will become more apparent from the following detailed description, which proceeds with reference to the accompanying figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a generalized example of a suitable computing environment in which several of the described embodiments can be implemented.

FIG. 2 illustrates an example of a possible network topology (e.g., a client-server network) for implementing a system according to the disclosed technology.

FIG. 3 illustrates another example of a possible network topology (e.g., a distributed computing environment) for implementing a system according to the disclosed technology.

FIG. 4 illustrates an exemplary system for implementing embodiments of the disclosed technology.

FIG. 5 is a flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 6 is another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 7 is another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 8 is another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 9 is another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 10 is another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology.

FIG. 11 is yet another flowchart of an example method for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. DETAILED DESCRIPTION

I. GENERAL CONSIDERATIONS

Disclosed herein are representative embodiments of methods, apparatus, and systems for magic state distillation in quantum computing devices, including quantum computing circuit architectures for performing such distillation.

Any of the disclosed example embodiments can be performed by a system comprising a classical processor and memory and/or at least in part by a quantum computing device (quantum computer) itself. The disclosed methods, apparatus, and systems should not be construed as limiting in any way. Instead, the present disclosure is directed toward all novel and nonobvious features and aspects of the various disclosed embodiments, alone or in various combinations and subcombinations with one another. Furthermore, any features or aspects of the disclosed embodiments can be used in various combinations and subcombinations with one another. For example, one or more method acts or features from one embodiment can be used with one or more method acts or features from another embodiment and vice versa. The disclosed methods, apparatus, and systems are not limited to any specific aspect or feature or combination thereof, nor do the disclosed embodiments require that any one or more specific advantages be present or problems be solved.

Although the operations of some of the disclosed methods are described in a particular, sequential order for convenient presentation, it should be understood that this manner of description encompasses rearrangement , unless a particular ordering is required by specific language set forth below. For example, operations described sequentially may in some cases be rearranged or performed concurrently. Further, some of the methods described herein can be altered by changing the ordering of the method acts described, by splitting, repeating, or omitting certain method acts, etc. Moreover, for the sake of simplicity, the attached figures may not show the various ways in which the disclosed methods can be used in conjunction with other methods. Additionally, the description sometimes uses terms like "evaluate" , "determine" , or "choose" to describe the disclosed technology. Such terms are high-level abstractions of the actual operations that are performed. The actual operations that correspond to these terms may vary depending on the particular implementation and are readily discernible by one of ordinary skill in the art. As used in this application and in the claims, the singular forms "a," "an," and "the" include the plural forms unless the context clearly dictates otherwise. Additionally, the term "includes" means "comprises." Further, as used herein, the term "and /or" means any one item or combination of any items in the phrase.

II. OVERVIEW OF DISCLOSED TECHNOLOGY

Magic state distillation is an approach to implementing a universal quantum computer. See, e.g., E. Knill, "Fault-tolerant postselected quantum computation: Schemes," (2004), quant-ph/()4()2171vl; E. Knill, "Fault-tolerant postselected quantum computation: Threshold analysis," (2004), quantph/0404104vl ; Sergei Bravyi and Alexei Kitaev, "Universal quantum computation with ideal Clifford gates and noisy ancilias," Phys. Rev. A 71, 022316 (2005), quant-ph/ 0403025. This approach begins by implementing the Clifford group to high accuracy using either stabilizer codes (e.g., Daniel Gottesman, "A class of quantum error- correcting codes saturating the quantum hamming bound," Phys. Rev. A 54, 1862 (1996), quant-ph/9604038; A. R. Galderbank, E. M Rains, P. W. Shor, and N. J. A. Sioane, "Quantum error correction and orthogonal geometry," Phys. Rev. Lett. 78, 405-408 (1997), quant-ph/9605005) or using Majorana fermions. See Torsten Karzig, Christina Knapp, Roman M Lutchyn, Parsa Bonderson, Matthew B Hastings, Ghetan Nayak, Jason Alicea, Karsten Flensberg, Stephan Piugge, Yuval Oreg, et al, "Scalable designs for quasiparticle- poisoning-protected topological quantum computation with majorana zero modes," Physical Review B 95, 235305 (2017). Then, to obtain universality, some non-Clifford operation is necessary, such as the 7r/'4-rotation (T-gate) or the Toffoli gate (or CCZ which is equivalent to Toffoli up to conjugation by Cliffords). These non-Clifford operations are implemented using a resource, called a magic state, which is injected into a circuit that uses only Clifford operations.

Since these magic states can produce non-Clifford operations, they cannot themselves be produced by Clifford operations. Instead, in distillation, the Clifford operations are used to distill a small number of high accuracy magic states from a larger number of low quality magic state. There are many distillation protocols for the magic state for T gates (see, e.g., E. Knill, "Fault-tolerant postselected quantum computation: Schemes," (2004), quant- ph/0402171 vl; Sergei Bravyi and Alexei Kitaev, "Universal quantum computation with ideal Clifford gates and noisy ancillas," Phys. Rev. A 71 , 022316 (2005), quant-ph/0403025; Adam M. Meier, Bryan Eastin, and Emanuel Knill, "Magic-state distillation with the four- qubit code," Quant. Inf. Comp. 13, 195 (2013), 1204.4221; Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012); Cody Jones, "Multilevel distillation of magic states for quantum computing," Phys. Rev. A 87, 042305 (2013), 1210.3388v2; Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl ), as well as some protocols (see, e.g., Bryan Eastin, "Distilling one- qubit magic states into toffoli states," Physical Review A 87, 032321 (2013), 1212.4872; Cody Jones, "Low-overhead constructions for the fault-tolerant toffoli gate," Physical Review A 87, 022328 (2013) , 1212.5069) to distill magic states for Toffoli gates from T-gates.

In such distillation architectures, the resources (e.g., space, number of Clifford operations, and number of noisy non-Clifford operations) required to distill magic states far exceed the resources required to implement most quantum algorithms using these magic states. Hence, improvements in distillation efficiency can greatly impact the total resource cost.

This disclosure presents a variety of improvements in magic state distillation. One exemplary theme in this disclosure is exploring various protocols to distill magic states for Toffoli, controlled-S, as well as Γ-gates. Several approaches to this are presented. In some embodiments, a generalization of triorthogonal codes is used to allow this distillation. See Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012). In section IV, a randomized construction of such codes is given which achieves distillation efficiency -→· 1; this approach is of interest because not only is the distance of the code fairly large (of order square-root number of qubits ) but also the least weight stabilizer has comparable weight. In section V, another approach based on Reed-Muller codes is disclosed. In addition to theoretical asymptotic results here, a particularly striking code is disclosed which distills 512 T-gates into 10 CCZ magic states while obtaining eight order reduction in error. In particular, a 512 T-gate to 10 Toffoli gate code with distance 8 is disclosed as well as triorthogonal codes with parameters 1 1887, 137, 5] ] , [[912, 112, 6]] , [[937, 87, 7j] with very low prefactors in front of the leading order error terms in those codes.

Also presented herein are approaches to distilling Toffoli states which are not based on a single triorthogonal (or generalized triorthogonal code) but rather on implementing a protocol using a sequence of checks. As in Jeongwan Haah. Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl , inner codes are used to measure various stabilizers of the magic state. Two different methods of doing this are presented, one based on hyperbolic inner codes in section VI and one based on normal inner code in section VII (hyperbolic and normal codes were called even and odd inner codes, respectively, in a version of Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low- space overhead and optimal asymptotic input count," 1703.07847vl ).

In addition to these results for distilling Toff ^' oli states, other results useful specifically for distilling T-gates are presented. In particular, in V E punctured Reed-Muller codes are studied and some protocols are disclosed with a better ratio of input 7 -gates to output 7 -gates than any other known protocol for certain orders of error reduction. Another result in III I) is a method of reducing the space required for any protocol based on triorthogonal codes at the cost of increased depth.

Matrices S = diag(l, i), and T = diagil, e ^,T/'4 ) are used.

III. TRIORTHOGONAL MATRICES; DEFINITIONS AND

GENERALIZATIONS

A. Definitions

Codes with n bits are considered, so that code words are vectors in Fg. Given a vector u, let |u| denote the Hamming weight (the number of nonzero entries of u). Given a vector u, let ¾ denote the i-th entry of u. Given two vectors u, v, let u Λ v denote the entry wise product of u and v, i.e., (u Λ v), _t = v¾v, _; . Let ίϊ · v denote the inner product, so that u · v = ¾ j , where the sum is taken modulo 2.

Here, a code C refers to a linear subspace of F£ - Given two codes C\ Z>, let C Λ V denote the subspace spanned by vectors u Λ v for u€ C and v G P. Given a code C, let C ¹ denote the dual code, e.g. for any vector v, v G if and only if v · = 0 for all u e C. Given two codes, C, ^' D, let span(C, V) denote the span of C and V.

Following Bravyi and Haah (see Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012), a binary matrix G of size m-by-n is called triorthogonal if ·· ^' ■.. , < ^' ' ^' ··... ^{, ;} ' m d 2, (III.1) for ail pairs 1 < a < b < m, and

n

∑G _aj G _bij G _Cj ^ Q mod 2, (IIL2) for ail triples of rows 1 < a < o < c < m.

Further, it will be assumed that the first hr rows of G have odd weight, specifically G _a . _j 1 mod 2 for 1 < a < kr and the remaining rows have even weight, specifically, Σ','- _Ί G _a , _j = 0 mod 2 for kj- + l < a < n. (The notation k,-< instead of A¾r was used in Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012).) Let k ₀ - m - r. (ΙΠ.3)

Let Q _Q denote the span of the even weight rows of G. Let Q _T denote the span of the odd weight rows of G. Let Q denote the span of all the rows of G.

The distance of a, triorthogonal matrix G is defined to be the minimum weight of a, vector such that u G Go " but u Q _T . The distance of a subspace C is defined to be the minimum weight of a nonzero vector in that subspace. Clearly, the distance of G is at least the distance of

B. Triorthogonal Spaces and Punctured Triorthogonal Matrices

Here, a "triorthogonal subspace" is a subspace C such that for any u, v, w £ C, InAvAwl ----- 0 mod 2. Given a triorthogonal matrix G, the vector space QQ is a triorthogonal space. Thus, any ¾-by-n matrix whose rows span <¾ is a triorthogonal matrix. However, if k _T -/-- 0, then the span of the rows of G is not a triorthogonal space.

In this regard, note the following. Let G be an arbitrary triorthogonal matrix of the form iIIL4) where GT is kq- y-n (and contains the odd weight rows of G) and GQ is A¾-by-n (and contains the even weight rows of G ) . Consider the matrix

where / denotes a hp-hy-kp identity matrix and 0 denotes the zero matrix of size kg-hy-hr. This matrix G is a triorthogonal matrix with ail rows having even weight, and its rows span defines a triorthogonal space Q . Thus, from a triorthogonal matrix, one can construct a triorthogonal space by adding hp additional coordinates to the vector and padding the matrix by 1.

A converse direction is now shown based on the idea of puncturing a code. Given any subspace C of dimension m, there exists a matrix G whose rows form a basis of C (after possibly permuting the coordinates of the space) such that ί \ 0 P

G = ( /., P ) - o ₀ /¾

for some matrix P. where I _m is an ra-by-ni identity matrix. Such a matrix in the reduced row echelon form is unique once an ordering of coordinate is fixed, and can be computed by Gauss elimination from any spanning set for C. Choose any kp such that 0 < hp < m. Let P _T be the first hp rows of P and let PQ be the remaining rows of P. Let G _T = (Ό P , where 0 is the hp-by-ko zero matrix, and let Go = ί/ _¾0 i¾ J , where J¾ ₀ is the ¾-by-¾o identity matrix. Then, the matrix

is a triorthogonal matrix. Here, it is said that this matrix is obtained by "puncturing" the previous code on the given coordinates. By the uniqueness of the reduced row echelon form, the matrices Gp and GQ are determined by C, hp, and the ordering of the coordinates.

This idea of puncturing is related to the following protocol for distillation (see also, Austin G. Fowler, Matteo Mariantoni, John M. Martinis, and Andrew N. Cleland, "Surface codes: Towards practical large-scale quantum computation," Phys. Rev. A 86, 032324 (2012), 1208.0928v2). hp = 1 is considered for the moment, but a generalization to a larger hp can also be made. Observe that on a Bell pair \φ) ----- 100) -f- 111) (global normalization factors are ignored), the action of T on the first qubit is the same as T on the second: Ί \φ) - ---- Ί \φ). Once one has T \φ), suppose one measures out the second qubit onto j-f). The state on the first qubit is then the magic state Ί j- ) = >(-f ₂ j ₂ \φ). If the second qubit of this Bell pair is a logical qubit of a code, where the logical T can be fault-tolerantly implemented, then the above observation enables fault-tolerant creation of the magic state. This scheme is different from preparing encoded j-f), applying T, and inverse-encoding, in that the Clifford depth is smaller. (Note also that the projection onto j-f) on the second qubit can be achieved by individual physical qubit measurements.) The Bell pair is the eigenstate of XX and ZZ. or XX and ZZ if the second qubit is encoded in a code where X and Z are logical operators of the code. Therefore, the Bell pair where the second qubit is encoded in a triorthogonal code is the state stabilized by X(v) for any v in a (pre-puncture) triorthogonal space Q, and by Z{v'\ for any v' in Q ¹ .

C. Generalized Triorthogonal Matrices: T-to-CCZ Distillation

Here, the definition of triorthogonal matrices is generalized. This definition has some similarity to the "synthillation" protocols of Earl T Campbell and Mark Howard, "Unified framework for magic state distillation and multiqubit gate synthesis with reduced resource cost," Physical Review A 95, 022316 (2017), 1606.01904v3. The definition here is a special case in that only codes that distill T-gates, controlled-.!? gates, and CCZ gates are considered, rather than arbitrary diagonal matrices at the third level of the Clifford hierarchy. On the other hand, codes of arbitrary distance are presented, rather than just distance 2.

Definition 1. A {hr -f 2kcs + 3kccz)-by-n binary matrix G is generalized triorthogonal if it can be 'written up to permutations of rows as

G ^r

Gcs

(Ϊ11.6) Gccz

Go where GT has kx rows, Gcs ' ^ias kcs airs of rows, and Gccz has kccz triples of rows such that

V G _a G _btl G _C mod 2

an.?

Such a generalized triorthogonal matrix can be used to distill n -gates into bp -gates, /c ₍ controlled- 5 gates, and kccz CCZ gates, where the CCZ gate is a controlied-controlled-Z gate which is conjugate to the Toffoli gate by Clifford operations.

In this paragraph, a quantum code on n qubits is defined. Take X-type stabilizers of the quantum code which correspond to rows of Go (for each row of Go, there is a generator of the stabilizer group which is a product of Pauli X on all qubits for which there is a 1 entry in that row of (¾). For each row of GV, Gcs and Gccz there is one logical qubit, with logical X-type operators corresponding to the row. The corresponding -type logical operators can be determined by the requirement that they commute with the X-type stabilizers and by the commutation relations for iogical X and Z operators. Finaliy, the Z-iype stabilizers of the code are the maximal set of operators that commutes with all logical operators and X-type stabilizers. It can be shown, by generalizing the arguments of Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012). that applying a T-gate to every qubit will apply 7 -gates to the logical qubits corresponding to rows of k _T and will apply controlled-.!? gates to each pair of logical qubits corresponding to a pair of rows of Gcs, and will apply CCZ gates to each triple of logical qubits corresponding to a triple of rows of Gccz, up to an overall Clifford operation on the logical qubits. Input errors are detected up to an order given by the distance of the code, where the distance of a generalized triorthogonal matrix G is defined to be the minimum weight of a vector u such that ii £ Qo ^J - and such that u span(i¾r, Gcs, Gccz) ^'1' , with Gcs, Gccz being the row spans of Gcs, Gccz respectively. D. Space-Time Tradeoff For Triorthogonal Codes

Here, a way of reducing the space required in any protocol based on a triorthogonal code at the cost of increasing circuit depth is discussed. Consider a code with a total of k logical qubits ( k ----- k + kcs + Skccz), ^a total of ηχ -type stabilizer generators, and nz -type stabilizer generators. The number ηχ is equal to the number of rows of G . The usual protocol to prepare magic states is to first initialize the logical qubits in the |-f) state, encode, then apply transversal T, measure stabilizers, and, if no error is found, finally decode yielding the desired magic states. It is possible to implement this protocol using only k + ηχ total qubits as follows.

The idea is to work on the unencoded state, but one can instead spread potential errors so that one can detect them. Recall that encoding is done by preparing a total of n _x ancilla qubits in the j - ) state (call these the X ancilla qubits), a total of nz ancilla qubits in the jO) state (call these the Z ancilla qubits), and applying a Clifford. Call this Clifford U. Then, an equivalent protocol is: prepare a total of n _x ancilla qubits in the j÷) state, a total of nz ancilla qubits in the |0) state, and apply \ \ - _\ exp(ix _? -/8)i/, then measure whether all the X ancilla qubits are still in the j -f) state. (There is no need to check the Z ancilla qubits since the error model has Z errors only after twirling.)

The operator W exp(i _? -/8)i7 is equal to exp(ii^-/8) where P ₃ — WZ _j U, which is a product of Pauli Z operators. Let , ------- PjQ _j where P is a product of Pauli Z operators on some set of logical qubits (which are not embedded in a code space!) and X ancilla qubits, and <¾ is product of Pauli Z on some set of Z ancilla qubits. Since the Z ancilla qubits remain in the |0) state throughout the protocol, an equivalent protocol involving only k ÷ ηχ total qubits is: prepare a total of ηχ ancilla qubits in the |+) state, and apply I I"_ _x exp(iP _j /8), then measure whether all the X ancilla qubits are still in the |+) state. Note that although the product over j ranges from 1 to n, there are only k -f ηχ < n physical qubits.

This operator exp(i7rjP,-/8) can be applied by a sequence comprising a Clifford, a T gate, and the inverse of the Clifford. Indeed, one can apply up to k - n _x of these operators in parallel by finding a Clifford which conjugates each of the k -[- ^■ n _x - different choices of P ₃ to Pauli Z operators on different choices of the k ÷ n _x physical qubits. Hence, one can obtain a protocol using k + n _x total qubits, that requires | _{k ηχ} } rounds of Cliffords and T-gates. While the T-depth of the circuit is larger than the original protocol, the total circuit depth may or may not increase: if the Cliffords are implemented by elementary CNOT gates, then the circuit depth depends upon the depth required to implement the various encoding and decoding operations. Other tradeoffs are possible by varying the number of Z ancillas that are kept: keeping all Z ancillas is the original protocol with minimal depth and maximal space, while reducing the number will increase depth at the cost of space.

A Z error on a T gate will propagate due to the Cliffords. Specifically, a Clifford that maps exp(mZ _j /8) to exp(wrP _j /8), will map an error Ζ _Ί to P ₃ . but the error Ρ _Ί will not further be affected by the other exp(«7rP _? -/8) since they commute. The accumulated error will flip some X ancilla qubits as well as the logical qubits that would be flipped in the usual protocol. The association from the errors in T gates to the logical and X ancilla qubits is identical to the usual protocol. Hence, in the present space-time tradeoff, the output error probability and the success probability are identical to the usual protocol, whenever the error model is such that only T gates suffer from Z errors.

For example, for the 512 qubit protocol below to distill CCZ magic states based on RM (2, 9), the number of physical qubits required is 3 x 10 + n _x - ---- 30 + 1 ÷ 9 + Q - ---- 76. For protocols based on a punctured RM (3, 10) below, ηχ < 1 4- 10 + ^) + (^) = 176, leading in both cases to a large reduction in space required.

IV. RANDOMIZED CONSTRUCTON OF TRIORTHOGONAL AND

GENERALIZED TRIORTHOGONAL MATRIX

In this section, a randomized algorithm is disclosed that either returns a triorthogonal or generalized triorthogonal matrix with the desired n, k _T , kcs, ^ccz-, &o, or returns failure. For notational simplicity, one can begin with the case of kcs = kccz = 0 (a triorthogonal matrix). It will then be explained at the end how to construct generalized triorthogonal matrices by a straightforward generalization of this algorithm.

A. Randomized Construction of Triorthogonal Matrices

The matrix is constructed as follows. The rows of the matrix are constructed iteratively, choosing each row uniformly at random s bject to constraints given by previous rows. More precisely, when choosing the j-th row of the matrix, the row is uniformly chosen at random subject to constraint III.l for b ---- j and for all a < j, and subject to the constraint III.2 for c ----- j and for all a < b < j, and subject to the constraint that the row has either even or odd weight depending on whether it is one of the first hp rows of G or not. If it is not possible to satisfy all these constraints, then the construction is terminated and declared a failure. Otherwise, the algorithm is continued. If the constraints are satisfied for ail rows of G, the resulting matrix is returned; in this case, the algorithm "succeeds" .

Note that the constraints that enter into choosing the j ^' -th row are linear constraints on the entries of the row. Eq. III.l gives j— 1 constraints while Eq. (III.2) gives ( — — 2)/2 constraints (the constraints need not be independent). One can express these constraints as follows: let g _a denote the a-th row vector of G. Then, let , be a (j— l ÷ (j— l) (j— 2)/2 + l)- by-n matrix, with the first j — 1 rows of il , being equal to the first j — 1 rows of G. The next (j— — 2)/2 rows of , are vectors g _a Λ g¾ for a < b < j. The last row of M ₃ is the ail Is vector, i.e., (1, 1, . . . , 1). This vector is denoted 1. The constraints on g, can then be written as ,¾ - (0, 0, , . . , 0, 1), (IV.l) for 1 < j < kr and

M ₃ g ₃ = 0 (IV.2) for hp < j < in. If 1 is in the span of the first j— 1 + (.;/ ^' — — 2)/2 rows of Μ _Ί , then the constraints have no solution; otherwise, the constraints have a solution. Let A4. , denote the row span of ,; then, for k _T < j, the constraint (IV.2) is equivalent to requiring that i . (- ^■ M^-

The probability that the algorithm succeeds is now analyzed, returning a matrix G. The distance of Q ^~ is also analyzed. The goal is to show a lower bound on the probability that the distance is at least d, for some d. The analysis of the distance is based on the first moment method: the probability that a given vector u is in /Q ^'1' is estimated. This probability is then summed over all choices of u such that 0 < juj < d and bound the result.

Let u be a given vector with -I- 0 and u -- --- 1. Let one first compute the probability that u e QQ ^L and u (2 ^' M _m conditioned on the algorithm succeeding. Since u <l M _m , then ΰ Mj for all j < in. Hence,

Prju ^■ g _j = 11 success and u Λ4 _Ί \ = -, (IV.3) since the constraint · g,; = 0 is independent of the constraint g,; G M _j . Note that success of the algorithm depends only on the choices of the odd weight rows, and the even weight rows are chosen after the odd weight rows so that the choice of g, does not affect success. So,

in _j

Pr[fl G QQ ¹ - and u M _M j success] < J - = 2 ^~fe ° . (IV.4) j=k _T + l ^"

Now consider the probability that the algorithm succeeds and u G M _m . As a warm-up, consider the probability that the algorithm succeeds and that some vector with small Hamming weight is in Q. Here, big-0 notation is used from here on, considering the asymptotics of large n.

Lemma 1. Consider any fixed u≠ 0. Then, the probability that the algorithm succeeds and that ύ is in Q is bounded by:

Pr [success and u G £] < P ₂ ^~n~(k~i > ^~ ^ ^k~i ^ ²⁺ > . (IV.5) Further, if m— o(n), then

Pr [success and 3v G Q s.t. jvj≠ 0 and (jvj < n/2— o(n) or jvj > n/2 ÷ o( n)J j = oi l) .

(IV.6)

(The above equation is to be interpreted as meaning that for some function f (n) which is oin) the probability that there exists a nonzero v G Q with jv j < n/2— f(n) or jvj > n/2 -f f(n) is oi l) J ,

Proof. Suppose ύ is in Q . Then, u — X 'li ¾¾· Each of the 2 ^m — 1 possible nonzero choices of the vector b are considered and bound the probability that u = J L- '¾& for the given choice. For a given choice of b, let k be the largest i such that t¾ ^ 0. The vector g¾ is chosen randomly subject to ,¾(.¾ — l)/2 + 1 constraints. Hence, for given ¾ , . . . , gV-i and given b, u, the probability that g _¾ = u -÷- JZ'^T ¹ i¾¾ is bounded by 2 ^{~ ~} ' ^fci . ^{fc~1 !/2÷1} ) . There are 2 ^K_1 possible choices of bi, . . . , ¾~ι · Summing over these choices and summing over k, Eq. (1V.5) follows. By a first moment bound, the probability that there is a nonzero vector of weight at most in G is bounded by

Similarly, the probability that there is a vector with weight at least n— w in Q is bounded by j=0

From this, the lemma follows.

Lemma 2. Lei m < for 0 < Θ < l/y'2. Let 0 < < 1/2 be a constant. Then, the probability that the algorithm succeeds and that the distance of M. _m is smaller pa is

!2S(p)n---n/2+3' ² n-÷-o(n) _i ρζ ΐ ^ where S(p) is the binary entropy function -- iog,( )— (1— p) log ₂ (l— p).

Let ρ(θ) be the supremum of all p such that the above expression tends to zero as n - oo. For all Θ < one has ρ(θ) > 0 with ρ(θ)→ 0 as Θ→ I/ N/2.

Proof. One can say that G has good distance if all nonzero vectors u in Q have n/2— o(n) < < n/2 - o(n). By lemma IV.5, the probability that the algorithm succeeds and that G does not have good distance is o(l).

Let fl 0, 1. One can now bound the probability that the algorithm succeeds and that G has good distance and that d G cM _rn .

If u £ M. _m , then for some m-by-m upper triangular matrix A _l] and for some c £ {0, I , one has w = L _^ ^Λ ¾ + ^cl - (IV.7) ij S .t . ! < ;

Consider each of the 2 ^m ^ ^m_i ^ ² -- 1 possible nonzero choices of the matrix A and each of the two choices of c and bound the probability that Eq. (IV.7) holds for the given choice.

Suppose c = 0 (the case c = 1 follows from this case by considering the vector u + 1). For a given choice of b, let k be the largest i such that b., _k 0 for some i < k. Let gi, . . . , g _t -i be given; one can compute the probability that g _¾ is such that Eq. (IV.7) holds. Let v ----- n + /½¾ Λ ¾ . (IV.8) id s.t.i<j<k Let w - Aikgi + Akk l . (IV.9) i s.t. i<k

Then, Eq. ( IV.7) implies that v = w ,A g _t , (IV.10)

Assuming G has good distance, n/2— o(n) < \w\ . Eq. (IV.10) gives then at least n/2— o(n) linear constraints on g _¾ . The vector g _¾ is chosen randomly subject to k(k— l)/2 + 1 linear constraints. Hence, the probability that Eq. (IV.10) holds is at mos

Summing over all choices of A,,; , the probability that the algorithm succeeds and that G has good distance and that u G cM _m is bounded by

2— 2 1 )

The number of vectors ύ with |u| < pn is (for p < 1/2 )

¹¹ J - 2 ^) ⁿ⁺⁰ ("\ (IV.11)

Hence, by a first moment argument, the probability that the algorithm succeeds and that G has good distance and that M. _m has distance smaller than pn for p < 1/2 is

2 S ) 2 1 ) - o { r?. )

Finally,

Lemma 3. Let m < ι for 0 < 0 < l/y 2. Then, the algorithm succeeds with probability 1 - oil ) .

Proof. Suppose the algorithm fails on step k. Then, the first k— 1 steps of the algorithm succeed and the vector 1 must be in M _k~\ A M _k~ i- However, the probability that this happens is o(l) , as follows using the same proof as in lemma 2. There is one minor modifications to the proof: Eq. (IV .7) is replaced by

1 Ai _j ii g _j . (IV.12) i,j s.t. i^j<k—l Also, there is no need to sum over vectors ύ as instead consideration is given to the probability that a fixed vector is in Λ4 _~ ι Λ Λ _¾ _ι. Otherwise, the proof is the same. □

Hence,

Theorem 1. We can choose rn = (1— o(l)) ^■ y'n/2, and choose /.¾ = for any c < so that kj- = m— ¾, and with high probability the algorithm succeeds and G has distance a at least

2c- _v m

log n

Proof. By lemma 2, the distance of M _m is θ(η). By lemma 3, the algorithm succeeds with high probability. By Eq. IV.4 and a first moment bound, using the fact that the number of vector with weig °ht at most - l—og^ n is 2 ^CV ™ ^÷ "' ^ί;■ the theorem follows, □

Now that in this regime, the distillation efficiency defined as = login/ kr) / log(d) converges to 1 as n—ϊ 00.

B. Randomized Construction of Generalized Triorthogonal Matrices

The randomized construction of triorthogonal matrices above immediately generalizes to a randomized construction of generalized triorthogonal matrices. In the previous randomized construction, each vector g _j was chosen at random subject to certain linear constraints. Note that Eqs. (IV.2, IV.1) have the same left-hand side but different right-hand side. These constraints were homogeneous for row vectors in Go (see Eq. (IV.2) which has the zero vector on the right-hand side) and inhomogeneous for row vectors in G (see Eq. (IV.l) has one nonzero entry on the right-hand side). For a generalized triorthogonal matrix, one can follow the same randomized algorithm as before except that the constraints on the vectors g. _f are modified. The vectors will still be subject to linear constraints that .,g, _; is equal to some fixed vector, with M ₃ as before. However, the fixed vector is changed in the generalized algorithm to obey the definition of a generalized triorthogonal matrix. This modifies the success probability of the algorithm, but one may verify that the algorithm continues to succeed with high probability in the regime considered before. V. REED-MULLER CODE BASED DISTILLATION

In Bryan Eastin, "Distilling one-qubit magic states into toffoli states," Physical Review A 87, 032321 (2013), 1212.4872, and Cody Jones, "Low-overhead constructions for the fault- tolerant toffoli gate," Physical Review A 87, 022328 (2013), 1212.5069, a construction was presented to distill a single Toffoli gate from 8 T gates, so that any single error in the T gates is detected. More quantitatively, if the input T gates have error probability e _in , the output Toffoli has error probability e _ovt ----- 28ej + 0(c ).

In this subsection, alternatives to these constructions using generalized triorthogonal codes based on Reed-Muller codes are presented. The protocols of Bryan Eastin, "Distilling one-qubit magic states into toffoli states," Physical Review A 87, 032321 (2013), 1212.4872, and Cody Jones, "Low-overhead constructions for the fault-tolerant toffoli gate," Physical Review A 87, 022328 (2013), 1212.5069, will be similar to the smallest instances.

A. Review of classical Reed-Muller codes

The space of F ₂ - valued functions over rn binary variables x\ . . . . , x _m is a vector space of dimension 2 ^m , and every such function can be identified with a polynomial in x _x , . . . , x _m . One can choose a bijection {/ : F™— F ₂ } = F ^m defined by function / : F™ ·→ F ₂ codeword (f(z)) _zeF m (V.l) where the right-hand side is the list of function values. In this bijection, the ordering of elements of F™ is implicit, but a different ordering is nothing but a different ordering of bits, and hence as a block-code it is immaterial. For example, the degree zero polynomial /(.x' _l , . . . , x _m ) - ---- 1 is a constant function, that corresponds to all-1 vector of length 2 ^m , and a degree 1 polynomial f(xi, . · . , x _m ) = x is a function that corresponds to a vector of length 2 ^m and weight 2" ^1'"1 . Since the variables x _t . are binary, one has x ^~ = a¾, and every polynomial function is a unique sum of monomials where each variable has exponent 0 or 1.

For an integer r > 0 the Reed-Muller code RM(r, m) C F| ^m is defined to be the set of all polynomials (modulo the ideal (x? ·— x ₂ , - . .)) of degree at most r, expressed as the lists of function values.

RM{r, m) = {{f{x) \ f e W ₂ {xi, . . . , Xm]/(x ² i - Xi) , deg / < r} (V.2) By definition, RMir. rn) C RM(r + 1, TO). For example, RM(0, m) is the repetition code of length 2 ^m . A basis of RM (r, m) comprises monomials that are products of at most r distinct variables. Hence, the number of encoded (classical ) bits in RM(r, m) is equal to ∑i-o (7)* The code distance of RM(r, m) is 2 ^m~r , which can be proved by induction in m.

A property that is used herein is that whenever a polynomial does not contain x-, ^■ · · x _m (the product of all variables) , the corresponding vector of length 2 ^m has even weight. This allows one to see that the dual of RM (r, TO) is again a Reed-Muller code, and direct dimension counting shows that

RM(r, m) ¹ - = RM(m - r - 1, TO) . (V.3) in Reed-Muller code, it is easy to consider the 'wedge product of two codes, which appears naturally in the triorthogonality. Namely, given two binary subspaces V and W, one can define the wedge product as

(v Λ w)i— % Wi where v, w G (V.4) V Λ W = span _F2 {u Λ w : v G V, w G W}. (V.5)

By definition, V ^A2 D V . Since a code word of a Reed-Muller code is a list of function values, one can see that

RM(r, TO) Λ RM(r TO) - RM(r + r', TO). (V.6)

It follows that RM(r, m) is triorthogonal subspace if 3r < TO. (In fact, it is triply even.)

Since a basis of Reed-Muller codes comprises monomials where each variable has exponent 0 or 1, it is often convenient to think of a monomial as a binary m-tuple, that specifies which variable is a factor of the monomial. For example, if TO 3, the constant function / ^~ 1 can be represented as ( 0, 0, 0) , the function /— x _\ can be represented as ( 1 , 0, 0) , and the function / ~ a¾3¾ can be represented as (0, 1, 1). This m-tuple is called an indicator vector. (In contrast to what the name suggests, the "sum" of indicator vectors is not defined.) An indicator vector a that defines a monomial corresponds to a code word I _a G F ^" \ Under the wedge product of two code words, the corresponding two monomials is multiplied. In terms of indicator vector, this amounts to taking bit-wise OR operation which is denoted by V:

Λ I> _} = laVb - (V .7) For example, if m— 3, a -- (1. 0, 1 ) <-> f - ---- xix$ <- I _a - (00000101 )

- ( 1 , 1, 0) <-- f ---- X X 4→ l[ ₆ - (00000011)

a V b = (1 , 1, 1) / = X X?Xi- 4- l _aVb = (00000001)

B. Triorthogonal codes for CCZ

Let, m be a multiple of 3. RM(r = m/3 — 1, in) is considered to build a generalized triorthogonal code on 2 ^m qubits, with j- = kcs— 0 but fcccz > 0. Since 3r = ?rt— 3 < m, the generating matrix of RM(m/3— l, m) qualifies to be (? ₀ . The Z- distance of the triorthogonal code is at least the distance of RM(m/3— 1, τη) ^χ = RM(2m/Z, m), which is 2™' ³ . (In fact, it is exactly this.)

Triples of Gccz specified by triples of indicator vectors a! ^% > , &W , c' ^ are chosen. The triorthogonality conditions can be summarized as follows.

\b < m /3 1,

! cr (i ' _' V 6 ^(j) < 277 /3, (V.8)

— ,·.' if 7— j P < 777. otherw

(A similar set of conditions for Gcs should be straightforward.) oJ- , b^' , is chosen to have weight exactly m/3, so that the first six conditions above are automatically satisfied.

Three constructions of triples obeying these requirements are given. One construction will be analytic, one will be numerical, and one will be a randomized construction using the Lovasz local lemma. It may be useful for the reader to think of a vector G F™ as corresponding to a subset A _t of some set S with rn . Then, a trioie consists of three disjoint subsets A ₆ , ^j ¾, ( , of cardinality m/3 each. The analytic construction is as follows: a<"> - (u, u, 0), b ^(u) = (0, u, u), c ^{¾) - («, 0, «) (V.9) where a triple is labeled by u £ F™' ^7'"' \ {0, 1 }. So, one has 2 ^ra '' ^s — 2 triples. Here, (u, u, 0) denotes the indicator vector of length m formed by concatenating three bit strings of length TO/3, and ΰ is the complement oi u so that ¾ — 1— «,·. By construction, one can verify that v 6^") V c ^[U > ¹¹¹¹ Ϊ for any « £ F™ ^/d . The case u ----- 0 and u - ---- I are excluded, for the triple to satisfy the other generalized triorthogonality conditions. Suppose that x, y, z are rows of

Gccz and are not all from the same triple. It is desirable to check that < m.

Any potential violation to this condition is when x = (u _x , ΰ _χ , 0) and y = (0, , ) and z— 0, M _j ) for some u _x , u _y , u _z because there is no way to have 1 ------- O V O V M G F^ ³ unless

«— onev, which cases have been excluded. But then, one must have that, u _x ~ u _y ----- u _z to

in the particular case 3, this construction gives kr<cz ~ 0. However, one can instead have fcccz = 1 with the triple of indicator vectors (1, 0, 0), (0, 1, 0), (0, 0, 1), corresponding to polynomials _x , a¾, ^3· The full generalized triorthogonai matrix is

where the part above the line is Gccz and that below the line is Go- This triorthogonai matrix is maximal in the sense that (G ^A2 )^ ---- G'o- The resulting distillation routine has error probability 28ρ ² + 0(jf) if input T-states have error probability p.

For TO = 6, one finds n— 64, kr;cz = 2 and distance 4, of which the triples in terms of polynomials are \ x\X , a¾a¼, a¾a¾} and {a¾a¾, 2:4^5, 2¾^ι}· The m = 6 instance was investigated further to see if there could be more logical qubits extending the two triples, but it was found that there does not exist any extra solution to the generalized triorthogonality equations. Instead, G'o were able to be extended. The resulting generalized triorthogonai matrix, denoting each row by a polynomial, is

Xi_X ₂

X ₃ X ₄

X ₅ X ₆ x ₄ x ₅

XQXI

1

x ₁

x ₂ iv.r x ₃

•'Ί

x ₅

x _e

- - X ₃ X ₅

X1X3X5

χ _Λ χ ₃ -f χ χ _η

1·¾ ÷

This triorthogonal matrix is also maximal in the sense that (G ^A2 V ^L — GQ . The leading term in the output error probability is 2944p ⁴ . The coefficient was obtained by brute-force weight enumeration and MacWil!iams identity.

These two instances of generalized triorthogonal codes give T-to-CCZ protocols similar to those of Bryan Eastin, "Distilling one-qubit magic states into toffoli states," Physical Review A 87, 032321 (2013), 1212.4872, and Cody Jones, "Low-overhead constructions for the fault- tolerant toffoh gate," Physical Review A 87, 022328 (2013), 1212.5069, but not identical; the 64T-to-2CCZ protocol here has a different coefficient in the output error probability.

For m = 9, n = 512, k-ccz = 6 and distance 8 was found. A numerical search was then performed to see if it would be possible to have a larger k-ccz, restricting to the case that the triples of Gccz are associated with triples of indicator vectors of weight m/3. kccz ^~ 0 was also found, and GQ further extended to make the resulting triorthogonal matrix maximal in the sense that fG ^A2 Y" ------ Gn.

X4X5X7, Χ2Χ& »,

3-4X5X9, ^2^7 X\ 3X6

x ₃ x ₄ x ₆ , X1 5XS, X2X7X9

XlX ₈ Xo, X3X4X7, X2X5X6

X2X5X9, X1X3X4, X _e X7X$

G -*CCZ (V.12)

X1X4X5, X2X3X8, X6X7X9

X ₃ X ₅ X ₆ , ΧΊΧ2Χ7, X ₄ X ₈ X ₉

χχχ ₃ χ ₈ , X2¾a¾, 5 0 7

X2X3X5, X1X7X9, 4X6 S

X ₃ X ₈ X ₉ , X1X5X7, X ₂ X4^6

Here, each line in G C _Z contains a triple of polynomials (actually monomials). The algorithm used was as follows. A version of the algorithm in the constructive proof of the Lovasz local lemma of Robin A Moser and Gabor Tardos, "A constr uctive proof of the general loviasz local lemma," Journal of the ACM (JACM) 57, 11 (2010)was used. A subroutine to "initialize a triple" was defined, which, for given i, sets a > , b^, c ^(l ) to be random indicator vectors of weight rrc/3 each, subject to the constraint that a ^%} V 6 ^W V = 1 (this is accomplished by choosing a > at random of weight TO/3, choosing random of weight ra/3 with its 1 entries only in the 0 entries of and then is fixed).

Then the following can be performed:

1. Pick kccz and initialize kccz different triples.

2, Check the trior thogonalitv conditions

If a violation of the conditions exists, initialize all triples in the first violation that found, and go to 2. (If vectors x, y, z are not all in the same triple and xVyVz ----- Ϊ, the the triples containing x, , z are found (there are either two or three such triples) and those triples initialized.) If no violation exists, exit the algorithm, reporting success.

. This algorithm was run until it reports success or until the algorithm is terminated or otherwise halted. A slight modification of the algorithm was also investigated, in which some random permutation of the triples was performed at various steps (this has an effect similar to randomizing the order in which the conditions are checked). c. Lovasz Local Lemma

The numerics above used an algorithm used in the constructive proof of the Lovasz local lemma. However, the algorithm was attempted to be run in a regime in which the local lemma does not guarantee a solution. However, it is interesting that the local lemma does imply something about the possible scaling of kr;cz for large m.

Suppose that there are n _Lrip i _e triples. Imagine choosing each triple at random, following the initialization routine of the above algorithm. Label the triples by an integer ranging 1, . . . , n _tr i _p i _e - Define a bad event to be the event that for three triples, labelled i, j, k, with 1 < i < j < K < n _triOi - _e , there is a violation of the triorthogonality conditions involving one indicator vector from each triple. Such events are termed "three triple events" . Define a bad event E ₃ to be the event that for two triples, labelled with 1 < i < j < n _tr i _p i _e , there is a violation of the triorthogonality conditions involving one indicator vector from one triple and two indicator vectors from the other triple. Such an event E . ₃ is termed "two triple events" .

The probability of can be estimated as follows: there are 3 ³ = 27 different choices of indicator vectors if one chooses one indicator vector from each triple. The vector from the first triple is random. The probability that the vector from the second triple has no overlap with the vector from the first triple is

Conditioned on the vectors from the first two triples having no overlap, the probability that the vector from the third triple has no overlap with either of the other two vectors is

I Thus, where H(p) ~—p log ₂ (p)— (1 -- p) log ₂ (l— p) is the binary entropy function and the approximate equality is up to subexponential factors. Note H(l/3) ~ 0.918 and 2H(l/3)— 2/3 i¾ 1.17.

The probability of can be estimated as follows: there are 36 ways to choose one indicator vector from i and two from j or two from i and one from j. Suppose one chooses two from i; they have no overlap by construction and the probability that the vector from j has no overlap with them is

Thus,

~ ₀ 2 -m il (1 /3)

The following statement of the Lovasz local lemma (see Noga Alon and Joel H Spencer, "The probabilistic method" (John Wiley and Sons, 2004) )is used. Define a dependency graph so that two events are adjacent iff they are dependent. For event , , let T(A) denote the set of neighbors of A in the dependency graph. Then, if one can choose a number x(A) for each event A, 0 < x(A ) < 1 , such that for all A one has

Ρτ(Α) < χ(Α) Jl (l - x(B)), (V.16) iJer(A)

then there is a nonzero probability that no event occurs.

The neighborhood of any event (either three triple or two triple) includes 0(n _riplP ) three triple events and 0(n _trip i _e ) two triple events. Let one simply choose x( A ) ----- 2 Pr(A) for all A. Then, to show Eq. (V.16), it suffices to show that Y\ _B ^ _A) (l ~-x(B)) > 1/2. So, it suffices to show that Ε _βρΓ(Λ) Pr(-B) < 1/4. So, - 0(1) . Thus, (ff(i/3)-- l/3 : ,' i 7 ^> , ' Hriple ,-Ο ^{' v} - ^{x 1} )

<; 20-5S...m D. Error Probabilities and Quantitative Values

The generalized triorthogonal matrix has distance d - ---- 2 ^{m i} . The number of error patterns of weight d which do not violate any stabilizer of the code is equal to the number of code words of RM(2m/Z, m) with weight d. This is known to equal

where μ ----- m— r with in this case r - ---- 2m/ 3 so μ - ---- m/3. For m ----- 3, A _d 28. For m = 6, A _d = 10416. For m = 9, A _d = 50434240 « 5 x 10 ⁷ . The leading coefficient in the output error rate is of course at most these numbers, since there could be ^-stabilizers of weight d. Further, in the m = 6 and m = 9 cases above, Go were extended so the number of error patterns of weight d is strictly smaller than A _d . Indeed, for the maximal rn ------- 6 code, a direct enumeration shows that there are 3248 error patterns that does not violate -stabiiizers, out of which 304 are -stabilizers.

Is it also known that all weights of RM {2m /Z, m) between d and 2d are of the form 2d— 2 ^l for some i, so that the next weight after d is equal to 3d/2.

TO give some numbers when using these codes in a distillation protocol, consider the m = 9 case with kccz = 10. Suppose one has an input error probability e _m = 10 ^~3 . Then, the probability that the protocol succeeds (that no stabilizer errors are detected ) is lower bounded by (1— e _»n ) ⁵¹² ~ 0.599. The average number of output CCZ magic states is then Jiccz « 5.99. One expects that for m - ---- 9 the contribution of errors with weight 3d/ 2 - ---- 12 will be negligible compared to the leading contribution. Thus, one can approximate that the output error probability by e _oui i¾ A _d e _n (l— e, _?l ) ^a04 ss 3.0 x 10 ^~17 . where the factor (1— e, _;ji ) ⁵⁰⁴ represents the requirement that none of the other input T gates have an error. One expects that this is an overestimate because, as mentioned above, not ail error patterns of weight d that do not violate a stabilizer will lead to a logical error and also additional stabilizers to G¾ were added. Thus, the ratio = « 85.5 T-gates per output CCZ magic state was used.

It requires 4 high-quality T-gates to produce a single high-quality CCZ state (see Guang Song and Andreas Klappenecker, "Optimal realizations of simplified toffoli gates," Quantum Information and Computation 4, 361372 (2004), and Cody Jones, "Low-overhead constructions for the fault-tolerant toffoli gate," Physical Review A 87, 022328 (2013), 1212.5069), so this protocol's efficiency is comparable (if the goal is to produce CCZ states) to a protocol that uses only 85.5/4 5» 21.4 input T-gates per output T-gate (and, since one uses 4 T-gates to make a CCZ state, the quality of those output T-gates must be four times better than the needed CCZ quality).

If one is able to improve the input error rate then the protocol becomes more efficient as the success probability becomes higher, asymptoting at 51.2 T-gates per output CCZ magic state, comparable to a protocol using 12.8 input T-gates to produce an output T-gate. Alternatively, one can also make the protocol more efficient by applying error correction as follows. Choose some integer m > 0. Then, modify the protocol; as usual, one encodes logical qubits in the |+) state into the error correcting code, applies a transversal T-gate, and then measures the stabilizers. However, while usually one would declare failure if any stabilizer errors occur, one can instead apply error correction: if the error syndrome can be caused by at most rn errors, then one corrects those errors by applying Pauli Z operators to the appropriate physical qubits. For example, at e _m - ---- 10 ^'" ", the probability that there are 0 or 1 input errors is equal to (1— e _iT ,) ⁵¹² + 512e _m (l— e _in ) ^a11 « 0.906, giving the acceptance probability for m = 1. Applying this error correction does reduce the quality of the output states: with m = 1, now seven input errors can cause a logical error. The number of such weight seven input error patterns that cause a logical error is at most 8 j, so that the output error per output logical qubit is approximately 8AjeJ _n /10 ~ 5 x 10 ^~14 .

E. Punctured Reed-Muller Codes

Motivated by the puncturing ideas of III B, puncturing a Reed-Muller code was considered. Instead of using RM(m/Z— l, rn) as before, now consider RM(m, 3m+l). This code is triorthogonal as before, and is maximal in the sense that (G ^A2 ) ^A - -------- GQ. This code was then randomly punctured. The codes found numerically are listed in Tables 1,11. Observe that the coefficients A _D in the output error probabilities are fairly small given the code lengths.

It was found that there is a unique d = 5 code that can be obtained by puncturing RM{2, 7); it is [[125, 3, 5]| . This can be checked as follows: Any three-puncture in RM(r, m > 1) is equivalent (e.g., a punctured code from a Reed-Muller code is determined by the isomorphism class under affine transformations of the set of points corresponding to the punctured coordinates in the Tridimensional unit hypercube, since an affine transformation corresponds to an automorphism of Reed-Muller codes. Any three-point set in the unit hypercube is afflnely independent.) and one can numerically verify that any four-puncture to HM (2, 7) gives d - - 4.

The numerical techniques can now be explained.

The number k of logical qubits in each case in the tables was calculated after the puncture; k is equal to the number of punctures only if the submatrix of the generating matrix of RM on the punctured coordinates is full rank. The Z-distance, which is relevant to the distillation purposes, is computed either by the MacWilliams identity applied to X-stabilizer weight enumerators that are computed by brute force enumeration, or by enumerating all Z-logical operators of a given weight. The computed Z-distance is in fact the true code distance since the Z-stabilizer group contains a subgroup associated with the bit strings of the X-stabilizer group. The MacWilliams identity was an effective method especially when the base code was RM{2, 7) where there are only 29 X-stabilizers prior to puncture. For this base code, a random search was performed, trying many different random punctures of the code, and good examples that were found selected.

When the base code was RM{Z, 10), there are 176 X-stabilizers to begin with, so the brute force enumeration of the X-stabilizer weight enumerator became prohibitive unless many coordinates were punctured. Also, at larger distances ( > 5), a guided search became more efficient than a random search among codes. To solve both these problems, an "un- puncturing" strategy was used based on the following observation. Let Go be a matrix whose rows represent X-stabilizers, and suppose G' is a matrix whose rows represent X-logical operators such that anv Z-logical operator of minimal weight d anticommutes with at least one X -logical operator of G' . Then, consider a new X-stabiiizer matrix

code does not have any Z-logical operator of weight < d. The proof is as follows: If the bit string v of a Z-logical operator of weight < d have nonzero substring on the columns of Go, then, by construction, that substring must have weight at least d, but such a substring has odd overlap with some row of G' which must be cancelled by the substring on the columns of J. This forces the weight to be larger than d. The construction of a new code by adding more stabilizers and qubits, is precisely the inverse of the puncturing procedure (up to permutations of qubits), hence the name "unpuncturing."

For small distances, e.g., d ----- 3, it is easy to enumerate all Z-logical operators of weight d. One can then select X-Iogical operators to "catch" those minimal weight -logical operators, and identify the punctured coordinates that gave rise to the chosen X-logical operators. One - logical operator X was chosen each time so that the number of the mimimal weight illogical operators that X anticommutes with is maximized. The codes in Table II were found by this unpuncturing.

A random puncturing was started giving a d = 3 code and then successively unpunctured to obtain distance 4. 5 codes. The d ------- 6 and d ------- 7 codes in Table II were obtained by unpuncturing the best rate code with d— 5. Note that for the code [|937, 87, 7|], it was prohibitively costly to enumerate all logical operators of weight 7, so an upper bound on the number of -logical operators was used. The bound was possible since the -stabilizer's weight enumerator of j [887, 137, 5j] was computed by brute force, unpuncturing which yielded [[937, 87, 7jJ; while in general this .X -stabilizer weight enumerator is very costly to compute as explained above, it was possible to compute it for a single code example (it would not be practical to compute this enumerator for all the codes tried in a random search).

VI. T-TO-CCZ PROTOCOLS USING HYPERBOLIC WEAKLY SELF-DUAL

CSS CODES

In Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl, weakly self-dual CSS codes on ¾ _ner qubits were classified into two types. If S is the self-orthogonal subspace of F corresponding to the stabilizers of the code, the distinction criterion is whether S contains all-1 vector 1. If 1 G S, the space of representing logical operators S ^~ -/S is hyperbolic, and the parameters ηι _ΏΒβΙ . ¾ _nner , and the code distance must be even numbers. For hyperbolic codes, the binary vector space corresponding to the logical operators is isomorphic to direct sum of hyperbolic planes. Here, only hyperbolic codes are considered. Choose a basis ( ... , £- ^¾ΐΓ · ^η«· '} of S^/S such that the dot product between TABLE I. Punctured Reed-Muller codes I. In this table, the base code prior to puncturing is RM(2, 7) = [128, 29, 32] , The decimal integers are short-hand notation for the binary coordinate that indexes bits in the Reed-Muller code; e.g., "3" in the first example means that one has to puncture the bit labelled by 0000011 € F . The number of -logical operators of weight d is obtained by the MacWilliams identity applied to the X-stabilizer weight enumerators. Since the Z stabilizer group in any case corresponds to a snbspace of dual of the pre-puncture Reed-Muller code, the minimal weight of a.ny Z stabilizer is at Ieast 8. Every X-stabilizer has weight a, multiple of 8, and every Xlogieal operator has weight 7 mod 8. Hence, the transversal T becomes on every logical qubit. As a distillation protocol, the output error probability is Ajp ^d at the leading order where p is the independent error probability of the input T states.

Code parameter [jn, k, d]\ and A _d # ( -logical operators of weight d) Decimal representation of binary coordinates to puncture

[[114, 14, 3]] , A ₃ = 30, n/k = 8.14

3, 10, 19, 20, 64, 66, 72, 96, 99, 104, 110, 114, 115, 124

[[112, 16, 3]] , Λ ₃ = 96, n/k = 7

6, 8, 13, 14, 17, 28, 29, 33, 44, 57, 65, 75, 79, 82, 106, 116

[[109, 19, 3]] , A ₃ = 324, n/k = 5.73

10, 15, 16, 17, 32, 39, 40, 41, 48, 59, 66, 69, 72, 81, 100, 102, 108, 120, 126

[[118, 10, 4]] , A ₄ = 210, n/k = 11.8

11 , 17, 19, 59, 74, 76, 91, 99, 105, 110

[[116, 12, 4]] , At = 495, n/k = 9.6

0, 31, 52, 61, 73, 94, 96, 112, 114, 115, 118, 120

the basis vectors satisfy

,(2a-l) . £(26-1) ₌ Q

0 Ι ν υ , l , . . . , fc _ianer /i

. ^(26) ₌ °

0 otherwise. TABLE II, Punctured Reed-Muller Codes II, continued from Table I. In this table, the base code prior to puncturing is R (3, 10) = [1024, 176, 128] , The bound on A ₇ of [[937, 87, 7]] is from the exact weight enumerator (not shown) of [[887, 137, 5]]; the true value of Aj is believed to be much smaller based on the previous examples.

[[863, 161 , 3]] , A = 3231, n/k = 5.36

3,4,7,10,15,39,42,44,45,49,59,66,68,70,72,74,9 V

183,186,200,208,214,233,236,237,248,270,278,288,294,295,296, 304,307,321,323,338,341 ,347,353, 356,359,360,365,374,377,404,411 ,414,425,443,447,455

509,511,513,517,525,528,539,543,550,555,567,577,581,598,599, 600,602,603,608,609,612,616,620, 621 ,628,638,646,652,659,660,669,678,681 ,687,714,728,738,739,741,743,744,745,748,750,758,768, 786,791,794,795,806,822,843,844,845,853,855,864,865,884,889, 891,892,902,907,913,916,921 ,939, 942, 943,944,945,951 ,953,961,965,971,978,980,984,985,992,1002,1005,1012, 1018

[[872, 152, 4]] , Α = 1514, n/k = 5.74

31,35,45,46,50,62,85,89,91 ,1 13, 118,119,122,127,140,144,157,168,169, 171 ,173, 186,190,210,218 228,230,237,244,249,254,263,271 ,281 ,282,308,336,352,353,398,404,405,411,412,441 ,444,455,456,460, 471 ,474,475,480,484,488,492,502,504,507,511 ,517,520,522,532,542,543,559,570,574,577,578,579,580, 583,592,598,601 ,602,605,608,612,615,618,620,637,643,644,653,658,667,688,690 ,694,714,717,724,727, 737,745,752,754,758,764,765,770,782,794,795,802,808,812,813, 814,815,823,824,838,847,849,850,852, 861 ,863,867,871 ,874,880,901,907,911,915,919,921 ,924,926,941,950,954,969,971,972,976,977,982,991,

995,999,1008,1013, 1014,1023

[[887, 137, 5]] , A _b = 709, n/k = 6.47

11 ,21,30,37,39,53,68,74,78,82,98,105,107,120,130,136,148,149, 152,161 ,162,163,181 ,194,209,210,21 1 , 233,234,243,244,267,269,274,277,281 ,284,298,317,324,325,329,341 ,361 ,362,375,389,399,400,405,412,415 423,425,449,480,487,495,507,511 ,522,538,542,557,563,578,579,584,593,600,609,610,619,622,623 ,635,638, 639,640,643,644,651,653,655,657,661,671 ,672,678,680,692,714,727,737,775,777,792,796,806,817,826,827 , 831,833,834,837,851,852,854,857,866,868,871 ,875,880,890,891,896,897,898,916,924,936,938,941,958,964,

965,966,973,975,983,984,990,996,997,1022

[[912, 112, 6]] , A ₆ = 1191, n/k = 8.14

11 ,21,37,39,68,74,78,82,98,107,130,148, 152,161 ,162,163,181 ,194,209,210,211 ,233,243,244,267,269,274, 277,298,317,324,325,329,341,361,362,399,405,412,415,423,425, 480,487,495,507,522,542,557,563,579,584, 593,600,609,610,619,622,623,635,639,640,653,655,657,661 ,671 ,672,678,680,692,714,727,737,775,777,792, 796,806,826,827,831 ,833,834,837,851 ,852,854,857,866,871 ,875,880,890,891,896,897,898,916,924,936,938,

941 ,958,965,966,983,984,990,996,997,1022 We call such a basis hyperbolic, and Gram-Schmidt procedure can be used to find a hyperbolic basis. Logical operators can be defined as

- Z _2a -i - Ζίβ ^2ώ ), (VL1)

X _2a = X (£ ^(2a> ), Zta = Z{^- for a - l, . . , 2.

Note that this is different from the magic basis of Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl, where a pair of logical qubits are swapped under the transversal Hadamard.

Next, the action of transversal S gate is investigated. Since SXS ¹ = Y ----—iZX , unless "-■inner is a multiple of 4, the transversal S is not logical. However, there is a simple way to get around this. Instead of applying S on every qubit, exponents ί,; = ±1 can be assigned to each qubit i, which depends on the code, and one can apply (X), S . can be chosen such that T vA - 0 mod 4 for any v £ {6 ⁽¹⁾ , . . . , & ^{(dim 5)} } _c S, (VI.2) o ⁾ t» = 0 mod 4 for a - 1, . . . , * _r , (VI.3) i

where it is implicit that the elements of F ₂ are promoted to usual integers by the rule that F ₂ 3 0 (-→· 0 e Z and F ₂ 3 1 1 G Z, and {6^} is a basis of the F ₂ -vector space S.

A solution t, to these conditions always exists, because the Gauss elimination for the system of equations over Z/4Z, never encounters division by an even number when applied to a full F ₂ -rank matrix. Once a valid is obtained, then it follows that , v- _L t, _L = 0 mod 4 for any vector v€ S. Since any vector is a sum of basis vectors, which are orthogonal with one another, this follows from the following identity. For any integer vector y (see, e.g., Harold N. Ward, "Weight polarization and divisibility," Discrete Mathematics 83, 315326 (1990), and Sergey Bravyi and Jeongwan Haah, "Magic-state distillation with low overhead," Physical Review A 86, 052329 (2012)),

_Vl mod 2 - vi - 2∑yiyj Π Η , ! ! · (VI.4) i 'i<7

ViVj + 4 _, yiVjVk mod. 8. (VI.5) i i<j z<j<k Likewise, for any vector £ G S ^~ and any s t S,∑ _f ifo ---- + s mod 2)& mod 4. t will now be shown that the action of (x) _¾ 5** on the logical state

control- Z on hyperbolic pairs of logical qubits:

- Χί,. ^inner ' mod 2)

= e mod 2}

(iT 2) (∑ _il0 ^a) ¾ - 2∑ _a<6 i ⁶⁾ ¾ ) I ,(1) ΙΓ _ί , _.

where in the third line (VI. ) was used and in the last line (VI.1 ) was used.

Therefore, if a control-,!? gate is used over a hyperbolic code, then a measurement routine was implemented for product of CZ operators. The control-,!? can be implemented using an identity

Since a hyperbolic CSS code contains Ϊ in the stabilizer group, one knows T\ ¾li — 0 mod 4. and the control-phase factor will either cancel out or become Z on the control. If T gates in this measurement routine are noisy with independent Z errors of probability p, then upon no violation of stabilizers of the hyperbolic code, the measurement routine puts 0(p ² ) error into the measurement ancilla, and 0(p ^d ) error into the state under the measurement where d is the code distance of the hyperbolic code.

A, Quadratic error reduction

The control- action on the logical level can be used to implement control-control- , whenever the hyperbolic code is encoding one pair of logical qubits. The smallest hyperbolic code that encodes one pair of logical qubits is the 4-qubit code of code distance 2, with stabilizers XX XX and ZZZZ. The choice of logical operators that conforms with the present hyperbolic conditions is

The exponents i, for S is thus

(VL9 )

' = o ¹ ) ·

Using this choice of the phase factor in VI.7) cancels out.

Every non- Clifford gates enters the circuit by (VI.7), and hence any single error will be detected. Since the ancilla that controls S inside the hyperbolic code can be contaminated by a pair of T gates acting on the same qubit, there is little reason to consider hyperbolic code of code distance higher than 2. When applied to | + ^Θ3 ) . the routine described here outputs one CCZ state using 8 T-gates, with output error probability 28j> ² + 0(ρ ³ ) where p is the independent error rate of T gates.

The overall circuit has a few simalarities to the quadratic protocol in Cody Jones, "Composite toffoii gate with two-round error detection," Physical Review A 87. 052334 (2013), 1303.6971, in which the same choice of logical operators are used, but control- (Τ Τ' J® is applied on the code, followed by syndrome measurement and then /2 rotation along -axis on the Bloch sphere. In contrast, contxo[-{TXT X) _X {XTXT*) ₂ {TXT X) _Z {XTXT , and then syndrome measurement, without any further Clifford correction.

B. Quart ic error reduction

For a higher order error suppression of CCZ states, the hyperbolic codes can be used to check the eigenvalue of the stabilizers of the CCZ state \ CCZ) - CCZ \+® ³ ) . The stabilizers are (CZ ^' j-^X^- (CZ) _\Z X ₂ , and {CZ) _2Z Xi - (These are obtained by conjugating Ai,2.3, the stabilizers of j -f® ) , by CCZ gate.) As there are three stabilizers, one can use three rounds of checks. By symmetry, it suffices to explain how to measure {CZ) _\2 X _Z .

Suppose one has a hyperbolic weakly self-dual CSS code of parameters ί [7¾ _ηη8Γ , 2k, 4]] . This is an inner code (see, e.g., Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl). For example, there is a quantum Reed-Muller code of parameters [2 ^m , 2 ^m — 2m— 2, 4] I for any m > 4. There are also Majorana codes which can be interpreted as hyperbolic codes on qubits. See, e.g., Sergey Bravyi, Bernhard Leemhuis, and Barbara M. Terhal, "Majorana fermion codes," New J.Phys. 12, 083039 (2010), 1004.3791; M. B. Hastings, "Small majorana fermion codes," 1703.00612; S Vijay and L. Fu. "Quantum error correction for complex and majorana fermion qubits," 1703.00459 Take k independent output ⁽ JCZ states from the quadratic protocol in the previous subsection, and separate a single qubit from each of the CCZ states. On these separated qubits, ^C X is acted on with a common control. The rest 2k qubits are then embedded into the hyperbolic code, with which ° (CZ) will applied on the logical qubits, using 2n T gates with independent error probability p. It is desirable that the control qubit is common for all controlled gates. This way, the product of k stabilizers on the k CCZ states are measured.

One can run this check routine three times for each of the three stabilizers of CCZ states. In total, the number of input T gates is 8k + 6n where 8k is from the protocol in the previous subsection, and 3 · 2n is inside the distance-4 hyperbolic inner code.

Upon no stabilizer violations of the inner code and outer code measurements, the protocol outputs k CCZ-st&tes. If the inner hyperbolic code does not have any error on T gates while implementing ^C (CZ), then the output CCZ states' error rate is quadratic in the input CCZ states' error rate. This being quadratic is due to the fact that an outer code of code distance 2 is used. (An outer code is one that specifies which input states to check. See Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low- space overhead and optimal asymptotic input count," 1703.07847vl , for detail.) Thus, the output error from this contribution is ₂ ) (28» ) ² at the leading order.

There could be a pair of errors in the T gate inside the inner code that flips the eigenvalue measurement of (CZ)X. In order for this type of error to be output error there must be an odd number of errors in the input CCZ states. Hence, the contribution to the output error probability is k ^■ 28p ^2■ 3np ² at leading order.

Finally, the inner code may have 4 errors leading to logical errors since the code distance is 4. An upper bound on this contribution to the output error probability is 3 · 2°A^p ⁴ , where A is the number of Z logical operators of the inner code of weight 4. The factor of 2 ³ is because one Z error on a qubit of the inner code can occur in one of two places, and the half of all such configurations lead to an accepted output. This is likely an overestimate because a logical error from a check out of three checks can be detected by a later check. In case of the Reed-Muller codes, one can see Ai([[16, 6, 4]]) - 140, A _t ([[32, 20, 4]]) = 620, and A ₄ ([[64, 50, 4j]) = 2604.

Using [[16, 6, 4] |, the output error probability has leading term at most 9744p ⁴ or e ^ou — 3.2 x 10 ³ f> ⁴ per output, and the input T count is f = 40 per output CCZ. This particular protocol is worse in terms of input T count, but better in terms of space footprint (< 25 qubits), than the protocol by a generalized triorthogonal code above or that of Cody Jones, "Composite toffoli gate with two-round error detection," Physical Review A 87, 052334 (2013), 1303.6971. Using [[32, 20, 4]] one sees ^ f» (7.7 x 10 ³ )p ⁴ and n - 27.2. Using Reed-Muller [[84, 50, 4]] , one sees e ^out = (4.3 x I0 ⁴ )p ⁴ and ηχ = 23.4. For large m, (encoding rate near 1) the input T count approaches 20 per output CCZ.

In this case, the acceptance probability has been ignored. Since the input CCZ states can be prepared independently using only 8 T gates, one may assume that the preparation is always successful. Termination of the protocol is due to nontrivial syndrome on the distance 4 code. Since there are 6n T gates, the overall acceptance probability is at least (1 ·— p) ⁶ⁿ .

In the next section, another family is presented that has even lower asymptotic input T count.

VII. Γ-ΎΟ-CCZ PROTOCOLS USING NORMAL WEAKLY SELF-DUAL CSS

CODES

As an extension of Jeongwan Haah. Matthew B. Hastings, D. Poulin, and D, Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," 1703.07847vl ., one can turn (three copies of) any normal weakly self-dual code (normal code) into a check routine of stabilizers of CCZ state, as follows.

Recall that a normal code is a weakly self-dual CSS code, defined by a self-orthogonal binary vector space S such that 1 S. In such a code the binary vector space S/S ^± corresponding to the logical operators, has a basis such that any two distinct basis vectors have even overlap (orthogonal) but each of the basis vector has odd weight. Associating each basis vector to a pair of X- and -logical operators, a code can be obtained where the transversal Hadamard induces the product of all logical Hadamards. Observe that in a normal code the transversal X anti-commutes with every Z logical operator, and hence is equal to, up to a phase factor, the product of all X logical operator. In the standard sign choice of logical operators where every logical X is the tensor product of Pauli X . the transversal X is indeed equal to the product of all X logical operators. Likewise, the transversal Z is equal to the product of all Z logical operators. Then, it follows that control- across a pair of identical normal code blocks is equal to the product of oontrol- operators over the pairs of logical qubits.

Therefore, given three copies, labeled A, B, C, of a normal code [nj _nner , A¾ _nner , d\\, if one applies (¾ !_"" ^er CZA _%, B _% XC^ then the action on the code space is equal to (g> _^ ^et CZ _{AJ B L} X _CY

Having a transversal operator that induces the action of the stabilizer (CZ)X of CCZ- state on the logical qubits, one can make a controlled version of this. The following identity can be used:

(CC ) ₁₂₃ ( ^c» i)( ^Cfc ¾)( ^Cc ¾)(CC ) ₁₂₃ = [ ^C » (CZ ₁₃ X ₂ )] (C' ₁₂ ¾)]

(VII.l) which is the product of three stabilizers of CCZ-state controlled by three independent anciilas. The transversaiity of the logical operator (CZ)X implies that if one applies (VII.l) transversally across a triple of normal codes, then the three anciilas will know the eigenvalue of the three stabilizers of CCZ, respectively. The non-Clifford gate CCZ in (VII.l) can be injected using 4 T-gates. See Guang Song and Andreas Klappenecker, "Optimal realizations of simpli

ed toffoli gates," Quantum Information and Computation 4, 361-372 (2004), and Cody Jones, "Low-overhead constructions for the fault-tolerant toffoli gate," Physical Review A 87, 022328 (2013), 1212.5069.

This method of measuring stabilizers of CCZ state, compared to that in the previous section using hyperbolic codes, has advantage that one does not have to repeat three times for each of three stabilizers, but has disadvantage that one needs roughly a factor of three space overhead. (The space overhead comparison is not completely fair, because a code cannot be simultaneously normal and hyperbolic. However, in the large code length limit this factor of 3 in the space overhead is appropriate.) In the large code length limit, this method also has an advantage in terms of Ί '-count. Using the hyperbolic codes, even if the encoding rate is near one, one needs 12 T gates per CCZ-st&te under the test. On the other hand, using (VII. l) on a normal code of encoding rate near one, one needs 8 T gates per CCZ-state under the test.

Now the protocol at quartic order is as follows. Prepare k _m - _aeT CCZ-stsAes from the quadratic protocol using 4-q bit code. This consumes 8k _iau , _3T 2 '-gates with independent error probability p. Embed them into the triple of normal code of parameter [ ! i _ni]er , fc _niier , 4]| with each qubit of the CCZ states into a different code block. Apply (VII.l); this step consumes 8¾ _me r T gates with independent error probability p. Upon no violation of code's stabilizers and ancillas, decode the logical qubits and output k _ianeT CCZ states.

This is a quartic protocol as the output is faulty only if i) an even number of input CCZ states are faulty, which happens at order (p ² ) ² , (ii) an odd number of input CCZ states are faulty but missed by a flipped ancilla outcome, which happens at order p ^2■ p ² , (iii) some error in the inner code is a logical error, which happens at order p ^d - ---- p ⁴ , or (iv) some other error of higher order occurred. The total number of T gates used is 8Α _½η6Γ + Sn _i - _lxam .

There are normal codes of encoding rate greater than 2/3 and code distance 4 or higher on tens of qubits. including quantum BCH codes [[63, 45, 4]] (see Markus Grassl and Thomas Beth, "Quantum bch codes," in Proceedings X. International Symposium on Theoretical Electrical Engineering, Magdeburg (1999) pp. 207-212, quant-ph/9910060) and "H-codes" of parameters [\k ² -f 4/e -÷- 4, k ² , 4] ! where k is even (see Cody Jones, "Multilevel distillation of magic states for quantum computing," Phys. Rev. A 87, 042305 (2013), 1210.3388v2).

Random constructions guarantee such codes of encoding rate near one in the limit of large code length. See A. R. Calderbank and Peter W. Shor, "Good quantum error-correcting codes exist," Phys. Rev. A 54, 1098-1105 (1996), quant-ph/9512032; Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," I703.07847vl,

The input T count in the current quartic protocol using a high rate inner code approaches 16 per output CCZ.

In terms of input T count, to the best of the authors' knowledge, this family is better than any previous T-to-CCZ protocol with quartic order of error reduction.

One can bootstrap the protocol to have a family of protocols for d = 2° , > 2. The construction is inductive in a. Fix an inner code [n _ilinei , k _ianei , 4] |. (This is for simplicity of presentation, and is not necessity.) The quartic protocol above is the base case in the induction. Suppose one has constructed a 2 ^a -th order protocol P _a and a 2° ^_1 -th order protocol P _a -i using n _a . n _a - _\ T gates per output CCZ, respectively. The protocol is then: (1) Run P _a many times to prepare independent input states at error rate p ² " . (2) Embed them into the triples of the inner code. (3) Apply (VII.1) where CCZ-gsAes are injected by outputs from Ρ _α ~χ. (4) Upon no violation of the code's stabilizers, output the logical qubits. The order of reduction in error can be seen by considering the cases (i), (ii), and (iii) above. In all cases, the order of the error is 2 · 2" = 2 ^a+1 , 2 ^a■ (2 ^■ 2 ^a~1 ) = 2 ^a+l , or 4 - 2° ^~l = 2° ⁺¹ . Step (1) takes n _a T-gates per CCZ state by induction hypothesis. For k _m - _aeT sufficiently close to τ¾ _ηηβΓ , step (3) takes 2η _α _ι T-gates per CCZ. Hence, n _a +i ~ n _a - - 2η _α _ι, and n„ ~ 4 · 2 ^Q: - 4(i (VIL2) since χ = 8 and 112 = 16.

It is possible to combine the technology presented here with that of Earl T Campbell and Mark Howard, "Unified framework for magic state distillation and multiqubit gate synthesis with reduced resource cost," Physical Review A 95, 022316 (2017), 1606.0190 v3 to reduce the input T-count at the expense of dealing with a larger batch. At d = 2, Earl T Campbell and Mark Howard, "Unified framework for magic state distillation and multiqubit gate synthesis with reduced resource cost," Physical Review A 95, 022316 (2017), 1606.01904v3 has asymptotic T-count n ----- 6. At d ----- 4, using a high encoding rate normal code, the input T-count approaches τ¾ = 8 + 6 = 14, instead of 16. At d = 8, the count becomes 14 + 2 · 6 = 26, instead of 32. At a larger d that is a power of 2, in the limit of large code length, the T-count approaches (2/3) (5 · 2 ^a ÷ (-1)") which is at most 3.33d + 0.67.

Note that this bootstrapping for large a must involve a quite large number of qubits to ensure the independence of the input CCZ states, and the CC -gates on the inner code. The usage of Earl T Campbell and Mark Howard, "Unified framework for magic state distillation and multiqubit gate synthesis with reduced resource cost," Physical Review A 95, 022316 (2017) , 1606.01904v3, further enlarges the necessary batch size.

Also of note is that for d ----- 2d' > 10 with d! odd, one can first use the protocol of Jeongwan Haah, Matthew B. Hastings, D. Poulin, and D. Wecker, "Magic state distillation with low space overhead and optimal asymptotic input count," I703.07847vl, to produce a T gate with error at d'-th order where d > 5 is odd using df - -o(l) T gates per output T, and then use T-to-CCZ protocol of Earl T Campbell and Mark Howard, "Unified framework for magic state distillation and multiqubit gate synthesis with reduced resource cost," Physical Review A 95, 022316 (2017), 1606.01904v3, to have CCZ states with error at id - 2d')-th order. This combination will give T count 3d per output CCZ.

VIII. CLIFFORD MEASUREMENTS TO CHECK MATRICES

Here, it is imagined that H-measurement routines are implemented sequentially to check n _out magic states. (They may operate on disjoint sets of qubits, in which case they can he implemented in parallel, but one can always regard them as a sequential application of H- measurements, one at a time.) Here, the entire protocol is expressed as a collection of parity checks on all T-gates/states including those that are used to implement the H-measurement routines. Here, only normal codes are considered, and thus each H-measurement routine a consumes 2r½ _me ^a ) T gates.

U nder the stochastic error model, any possi ble error is of V-type and hence corresponds to a bit string. Let y ^l0> = , . . . , yn _ut ) denote any error bit string on the magic states that are tested. Let ^a " ^! for = l , 2, . . . , ??, _c denote the error bit string inside the a-th H-measurement routine. Since there are two layers of T-gates on the inner code, ι/' ^α · with > 1 must have even length; for notationai convenience, we let the first half of y ^(a> to be the error pattern before the layer of ^C Z, and the second half to be that after ° ^' Z. Thus, the error pattern in the entire protocol is represented by a, bit vector y = (y(W -■ · (VIII.l) of length η = n _out -\- 2 "^ n _hmer ^, which is by definition equal to the total number of Ί -gates/states. The error bit vector will be regarded as a column vector (ητ-by-l matrix) .

The protocol specifies for each H-measurement routine a a set of magic states to be tested. This set can be viewed as a bit string of length n _out ; M- ^c ^ = 1 if and only if the qubit i is included in the test by the routine a. If an H-measurement routine was perfect, then it would read off the parity of the error in ^(Qf ) , which is equal to M ^(a > ^■ over F2. As M ⁽ ' ^a> will be used as a submatrix of a complete check matrix, regard as a 1 - by-n _out matrix.

To take the outer measurement error into account, one can regard that any error on the pre- ^c 'Z layer is moved to the post- ^c layer:

{ ^Ca Z _j )Y _j - Z ₀ Y _j { ^Co Z _j ) . (VIII.2) This convention allows us to consider only the pre- ⁶ Z errors in regards to the outer syndrome. That is, if the error pattern on magic states under the test is then the outer syndrome by an H-measurement routine a is given by ( ^o V ⁰⁾ · i ] ] . . . 1 0 0 · · · o) y ^(a) mod 2 (V1IL3)

The error pattern y^'-' is not necessarily the same as one proceeds from an H-measurement routine to the next. This is because there could be a logical error from the inner code that propagates to the magic states under the test. If a bit string

- L ^(Q) ('< ^(Q) ) (VII I.4) denotes the error on the n _out magic states, resulting from the logical error of t-th routine, then after ct-th measurement routine the error pattern is y (a) = y ^(0> (0) ÷ + ^■ · · + i! ^(a) mod 2 (VIIL5) and the outer syndrome by -t routine is given by < ^a y°> (0) + ^{"(a:) (1)} -4 - + ((10) ® l ) )y ^(a> ■ mod 2 (VIII.6)

The function I ^ that maps an error pattern inside the inner code to a logical error has not yet been determined. This function is well-defined only if the encoded state on the inner code remains in the code space. The condition for the zero inner syndrome is given by commutation relations between an error operator and the stabilizers. Since the errors are of Y type and the stabilizers are from a weakly self-dual CSS code, the commutation relation can be read off from ((Π) ® 5< ^e V> mod 2 (VIII.7) where each row of S' ^Q) corresponds to a stabilizer generator. The sum of two halves is to account for the fact that a pair of errors on a single qubit in the inner code is equal to no error on that qubit in regards to inner syndrome. Conditioned on the zero inner syndrome, the function can now be determined. An encoded qubit k is acted on by an F-logical operator if and only if the logical X and Z operators of the logical qubit k both anticommute with a given Pauli operator. Since X and Z logical operators are represented by the same bit string (L¾.,i, L _k ,2,■ ·■■, L _h ^ («> ) under the magic basis of logical operators that is chosen, the logical Y on logical qubit k is enacted if and only if

L _k ,2, L _{k lmnei (a)} ) ^■ (y^ _haif + y^ _{GIld half} ) - 1 mod 2. (VII 1.8)

Therefore, the function L ⁽ -" ^} is linear over F ₂ whose matrix has rows that correspond to logical operators. Since a routine may not act on the ail n _out qubits, the matrix L^ ^A which is ¾ut-b - ^'ri -iniier ' ^Q/ \ has nonzero rows only for the support of M ^{a In addition, the choice of the logical operators according to a normal magic basis ensures that the nonzero rows of L ^{i a>} are orthonormal.

n: >

L L - M >6 _W mod 2. (V1II.9)

3 = 1

Thus, the necessary ingredients for a complete check matrix have been collected: A representation of errors (VILL I), the outer syndrome (V1II.6), and the inner syndrome (VI 11.7) .

Co

(V1IL 10) where the blank entries are zero, and the vertical lines are to facilitate reading. In the outer syndrome block each displayed row is a single row, whereas in the inner syndrome block each displayed entry is a submatrix. The propagated error from the inner codes to the output magic states is inscribed in (VIII.5), which one can represent as a linear map (11) ø (H) ® L ⁽²⁾ ! (11) ® £ ⁽³⁾ (11) 0 L^> iVLl I.i l) The vertical lines are aligned with those of (£.3- The following theorem has been arrived at:

Theorem 2. When the error pattern of all T -gates and states is y, the protocol accepts the output if and only if <£(fy— 0, and the excepted output does not contain an error if and only

IX. ORTHOGONAL BASES AT LEVEL v

In this section, it is implicit that the element of F ₂ is promoted to an integer in Z. The association is such that F ₂ 9 0 Η· 0 G Z and F ₂ 3 1 H> 1 G Z. Likewise, any element of Z/2" ^' Z will be represented by an integer from 0 to 2 ^V — 1 of Z. Unless noted by "mod 2"," all arithmetics are over the usual integers Z. However, every vector space is over F ₂ . Here, a matrix is regarded as a set of rows. The r-th row of a matrix A is denoted as Α _γΛ .

Definition 2. Consider a vector space F% equipped with an odd integer vector t 6 (2Z - 1)". called a coefficient vector. Let v > 2. The norm at level u (u-norm) of v G F" is = J i ^v it _* ^m °d 2". Two vectors v and w are orthogonal at level u (v- orthogonal) if ViWiti = 0 mod 2" ^"1 . Two subspaces V, W are v- orthogonal if any v G V and w G W are v --orthogonal. A set of vectors . . . , g ^{{ K} ' } is -orthogonal if any two disjoint subsets span -orthogonal subspaces. A v- orthogonal set is j/-orthonormal if all members have u-norm 1. A 1/- orthogonal set or subspace is v-nnll if all members have u-norm 0. To emphasize the coefficient vector t, we will sometimes write [upt)- orthogonal, -norm (1 i - |!,, _f j, -null, - orthonormal.

The zz-orthogonality is a generalization of an existing notion that is considered for transversal T-gates (Aleksander Kubica and Michael E. Beverland, Universal transversal gates with color codes - a simplified approach, Phys. Rev. A 91, 032330 (2015), 1410.0069vl; Sergey Bravyi and Andrew Cross, Doubled color codes, 1509.03239vl); previously, a coefficient vector had components ±1. Being 2-orthogonal is equivalent to being orthogonal under the usual dot product over F ₂ . Being 2-null or 2-orthonormal is nontrivial, but is easily satisfied as Lemma 5 below shows. As will be seen shortly, an orthogonal matrix at level 3 is triorthogonal (Sergey Bravyi and Jeongwan Haah, Magic state distillation with low overhead, Phys. Rev. A 86, 052329 (2012), 1209.2426) since is odd, but one does not know whether every triorthogonal matrix is orthogonal at level 3 for some coefficient vector i. Examples of triorthogonal matrices in literature are believed to actually be orthogonal at level 3.

Now, equivalent conditions for the .v-orthogonaiity are given, as an application of a result by Harold N. Ward, Weight polarization and divisibility, Discrete Mathematics 83, 315326 (1990); see also Sergey Bravyi and Jeongwan Haah, Magic state distillation with low overhead, Phys, Rev. A 86, 052329 (2012), 1209.2426. It will be very convenient to introduce the following notation. It is customary to denote a matrix element as A _ai for a matrix , . One can write A ^* _ai for any unordered set of row labels o ^~ { si, . . . , a _rn } (whose cardinality !aj is equal to m), to denote

^ai ¹¹¹¹ -<4ai,»A¾,i ^' fIX.l

If |aj = 0, then A ^* ₇ = 1 by convention. By definition, jaj cannot be larger than the number of rows of .4.

Lemma 4. Let t be a coefficient vector of length n. Let A be a binary matrix with n columns where the rows are F2-linearly independent. The following are equivalent:

(i) The rows of A form a (//, i)- orthogonal set.

(ii) For any subset K of rows of A, mod 2j| _{i> t} ----- || - _* ||„ _t mod 2

(Hi) -- 0 mod for any o such thai 2 < !aj < v.

In particular, every vector in a subspace S C F has zero ( , t)~norm if and only if any spanning set for S is ( , t)-null.

As an example, if the rows of a binary matrix A is f-nuU with respect to t - ---- 1 , then any vector in the row F ₂ -span of A has weight divisible by 2 ^1' . More concretely, the rows of

1 0 1 0 1 0 1

0 1 1 0 0 1 1 (IX.2) 0 0 0 1 1 1 1 are 2-null with respect to t ----- 1 and span a doubly even subspace. Proof. If y is a binary vector of weight \y\, then the parity c(y) ---- 0, 1 of its weight can expressed as e(2/) = ^ (l - (l - 2) l ^f l) = y (-2) p-l ⁽ TX.3)

The binomial factor is equal to the number of ways to choose nonzero components of y. Hence,

⁼ -( ^y ) ⁼ ∑( ^~~2 ) ^#(G)~1?/ * ^{mod 2} " (IX.4) o≠0

where a vector y is treated as a column matrix. In other words, if a vector <j> is the sum of rows of B over F ₂ , then

-2) ^#(n)~1 ¾ mod 2 QX.5)

(? ^' ) =- (it) : It suffices to prove the claim when K consists of two rows, say A _\* and A _2* , since a more general case follows by induction in the cardinality of K, By (IX.5), \A + A2* mod 211,, - \\A _U + A _2i - 2A _li A _2i \\ _v = \\A \ + | *||„ - 2∑\ AuAaA mod 2". The last term vanishes because the rows of A are ^-orthogonal.

(ii) =» m): By (IX.5), one has

0 = mod 2 ^l iIX.6)

Taking K such that \K\ = 2, we see ( ) in the case of joj — 2. Using induction in \K\, one is done,

(Hi) (i): Let A ^' and A ^' ' be two disjoint sets of rows of A. We have to show that v ----- ^ _{r K} ·* niod 2 and -u— A _r* mod 2 are .v-orthogonai. Using (IX.5),

(~2) ^|c| - ,4! i ₇ = 0 mod 2" (IX.8)

0≠eCA UA' i

where the second equality is because a and b are disjoint.

Lemma 5. Let S and L be rectangular matrices of F -linearhj independent rows such that SS ¹ - ---- 0 mod 2, SL ^r ----- 0 mod 2. and LL ² ----- I mod 2. Then, there exists an odd integer is 2-orthogonal, L is 2-orthonormal, and

S is 2-null.

Proof. Only nontrivial is to claim that there exists a coefficient vector t such that S _a ti = 0 mod 4 and L^ = 1 mod 4 for any a, b. An odd integer solution t to these equations are found by Lemma 6 below, since these equations have solution t = 1 mod 2. □

Lemma 6. Let A be a binary matrix with linearly independent rows over I ^R ₂ . If an inhomo- geneous linear equation Ax v has a solution x ---- u'" ^l ' ^~l> over Z/2 ^{I ~1} Z where v > 2, then the same equation has a solution x— over Z/2 ^F Z such that — -Ϊ/' ^""1 * ¹ mod 2" ^'~i .

Proof. The proof is by induction in the number of rows of A. When there is only one row in A, the scalar (a one-dimensional column vector) Αη ^ν~ - ν mod is either 0 or ^"Λ . One can subtract this even number from the component of u^ ^" -' where A has the first nonzero entry. The matrix A must have such nonzero entry because the row is linearly independent over IF ₂ . This proves the claim in the base case.

To prove the induction step when A has more than one row, consider Gauss elimination over Z/2"Z to transform A into (1) Θ A' up to permutations of columns. Such Gauss elimination is possible because the rows of A are F ₂ -linearly independent, and any odd number is invertible in Z/'2 ^IY Z. One finds a solution «^ | ₂ .„. for the A' part over Z/2"Z by the induction hypothesis, and then fixes the first component, if necessary, as in the base case. □

X. LEVEL LIFTING

Theorem 3. Let G ^{a columns

for a = 1, 2, . . . , n _c , where S ^a> is (i , t )~null and consists of Wi-linearly independent rows, l ^a) has n _out rows, and the nonzero rows of l ^a > is , t^)-orihonormal. Assume thai

∑ ∑ ¾ ^σ) =∑*ϊ ^α) mod T. (X. l)

Let o _* be a row binary vector defined as _a & ----- 1 if and only if Lj ' is nonzero. Then, the following matrix £ is ( + 1) -orthogonal with respect to some coefficient vector t. €e is + l, t) -orthonormal, and £ _out and £ _∞ are ( + l, t)-null. Furthermore, $J_ ,· (<¾)»·***

iX.2)

Proof. We will find ί of form (written as a row vector modulo 2 ^V )

(-1 (- 1 1) C¾ i ^{2) (-1 1) 0 i ⁽³⁾ L) ¾ i ^{';'Bc )} (X.3)

It is clear that y) _{r i} {£e)rit _% — Tl _i , even without modulo reduction. It is also clear from the choice of t that the (// + 1. t)-norms of rows are one for those in and zero for those in This does not depend on t^ ^a ' . To calculate the norm of a row in £ _out , one can observe that

£≥¾¾ ^a) - M _ak 6 _kk > mod

-----Λ.

which, together with (X.1), implies any row in C _out has ( , t)-norm zero. To make the {u + l)-norm zero, apply Lemma 6 to€ _ollt since C _out is in a row echelon form which ensures F ₂ -iinear independence. It will add 2 ^V to some components of t, if necessary. One is left with the 1, t)-orthogonality, which is not affected by the modification to t by Lemma 6 since one will only need to evaluate sums modulo 2".

It is desirable to show that given 2 < m < v + 1 rows, the weighted sum of their overlap is zero modulo 2 ^{v÷ ~m} . Note that any part of the overlap that contains (11) tensor factor has no contribution to the weighted sum due to (X.3). Let a be a label set of chosen rows of e, b be that of <£ _out , and c be that of (¾ _n . If \b\ ---- 0, there is always a tensor factor (11). So, assume \h\ > 1. Except for the part with the tensor factor (11), we must show

2 ^+W+ - ¹ ∑,¼Ni _i S ^> > =0 mod 2 v+l iX.5) where L = £< ^« >, S = 5 ^(o) , N _bl =∑. _¾ mod 2 for some a such that b = {a} U b'. Note that |b| = 1 + |b'j. Expanding N^, using (IX.5), the left-hand side becomes a i-sum of terms

₂ ! ^« M ^b ' ^!+ ! ^c ! ₊ ∑^ iX.6)

From the assumption of i-orthogonality of G ^(a one has

2 ^|eu ^° ^')|+|fi · · · ¾>Ί>Α ^* Α· ^Ω) = ^{0 mod T+1 if} |o ^L ½ ^¾ω | + |c| > 2oro-b' = 0.

(X.7)

The condition jaU, O^i - - jcj > 2 or a = b' = 0 is always true in the present case. Comparing the exponent of 2 in (X.6) and that in (X.7), we see that (X.6) is zero modulo 2 ⁱ⁺ⁱ .

* O- ---- {a} and c- ---- 0:

Since one is choosing at least two rows, |b| > 1. Dropping the part with the tensor factor (11), one desirabij' shows

2 ^! ¾, - 2^ 1 _(ίϊ Νζ _' Λ ^λ) = 0 mod 2 ^V+' X.8) where L --- L ^(b ' N _bl -- ₍ M _bj L^ ^1} mod 2, and b - {b- \ . '. Expanding Ν ^* _τ using (IX.5), the second term becomes a i-sum of terms

From the assumption of ^-orthogonality of G^ ^0l one has > 2. (X.10)

Comparing the exponents of 2 of the last two expressions, one sees that only the terms with a U _j $W— a in (X.8) may survive. Hence, (X.8) is equivalent to mod 2", (X.ll) but one knows this is satisfied since \ L^ ^l, t ^ = Μ· _Βια mod 2 ^" by (X.4) and f -orthogonality of G ⁽ ^

® α W:

Except for the part with the tensor factor (11), one desirably shows

^{2i fc} ∑ ^M tk - ^ ^{1 '"1} ∑ Niiij ^bl) - 0 mod 2" ⁺¹ (X.12) where I = L ^(bl S' = S ^(a N = yL^ mod 2, and b = {b _x } U b'. By assumption, j b'j > 1. Expanding N ₆ % using (IX.5). the second term becomes a ±-sum of terms

From the assumption of ^-orthogonality of G ^(0l> , one has

^{2|UjDiJ> l 0 mod r÷1 if} i ^u ? *> ^ω !≥ ² - ( ^χ · ¹⁴ )

Comparing the exponents of 2 of the last two expressions, one sees that only the terms with ¾) - ^■ ' ^' '— {d} in (X.12) may survive. Hence, (X.12) is equivalent to

2' ⁶ ' ^! Γ Μζ _Η - 2 ⁱ 'S J M;, _d l _d Ji ⁾ (X.15) but one knows this is satisfied since T\ L^ ¹ ' t _l ~ M^ d mod 2^ by (X.4).

The orthogonality condition (iii) in Lemma 4 has thus been shown, and the proof is completed .

□

XL EXAMPLE COMPUTING ENVIRONMENTS

FIG. 1 illustrates a generalized example of a suitable computing environment 100 in which several of the described embodiments can be implemented. The computing environment 100 is not intended to suggest any limitation as to the scope of use or functionality of the disclosed technology, as the techniques and tools described herein can be implemented in diverse general-purpose or special-purpose environments that have computing hardware.

With reference to Fig. 1, the computing environment 100 includes at least one processing device 110 and memory 120. In FIG. 1 , this most basic configuration 130 is included within a dashed line. The processing device 110 (e.g., a CPU or microprocessor) executes computer- executable instructions. In a multi-processing system, multiple processing devices execute computer-executable instructions to increase processing power. The memory 120 may be volatile memory (e.g., registers, cache, RAM, DRAM, SRAM), non-volatile memory (e.g., ROM. EEPROM, flash memory), or some combination of the two. The memory 120 stores software 180 implementing tools for implementing the quantum circuit (e.g., the Magic state distillation protocols, circuits, and associated techniques) as described herein.

The computing environment can have additional features. For example, the computing environment 100 includes storage 140, one or more input devices 150, one or more output devices 160, and one or more communication connections 170. An interconnection mechanism (not shown), such as a bus, controller, or network, interconnects the components of the computing environment 100. Typically, operating system software (not shown) provides an operating environment for other software executing in the computing environment 100, and coordinates activities of the components of the computing environment 100.

The storage 140 can be removable or non-removable, and includes one or more magnetic disks (e.g., hard drives), solid state drives (e.g., flash drives), magnetic tapes or cassettes, CD-ROMs, DVDs, or any other tangible non- volatile storage medium which can be used to store information and which can be accessed within the computing environment 100. The storage 140 can also store instructions for the software 180 implementing the quantum circuits, prototocols, and techniques described herein.

The input device(s) 150 can be a touch input device such as a keyboard, touchscreen, mouse, pen, trackball, a voice input device, a scanning device, or another device that provides input to the computing environment 100. The output device(s) 160 can be a display device (e.g., a computer monitor, laptop display, smart-phone display, tablet display, netbook display, or touchscreen), printer, speaker, or another device that provides output from the computing environment 100.

The communication connection(s) 170 enable communication over a communication medium to another computing entity. The communication medium conveys information such as computer-executable instructions or other data in a modulated data signal. A modulated data signal is a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media include wired or wireless techniques implemented with an electrical, optical, RF, infrared, acoustic, or other carrier.

As noted, the various methods for generating the disclosed circuits (e.g., for compiling/synthesizing the circuits) can be described in the general context of computer-readable instructions stored on one or more computer-readable media. Computer-readable media are any available media (e.g., memory or storage device) that can be accessed within or by a computing environment. Computer-readable media include tangible computer-readable memory or storage devices, such as memory 120 and/or storage 140, and do not include propagating carrier waves or signais per se (tangibie computer-readable memory or storage devices do not include propagating carrier waves or signals per se).

Various embodiments of the methods disclosed herein can also be described in the general context of computer-executable instructions (such as those included in program modules) being executed in a computing environment by a processor. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, and so on, that perform particular tasks or implement particular abstract data types. The functionality of the program modules may be combined or split between program modules as desired in various embodiments. Computer-executable instructions for program modules may be executed within a local or distributed computing environment.

An example of a possible network topology 200 (e.g., a client-server network) for implementing a system according to the disclosed technology is depicted in Fig. 2. Networked computing device 220 can be, for example, a computer running a browser or other software connected to a network 212. The computing device 220 can have a computer architecture as shown in Fig. 1 and discussed above. The computing device 220 is not limited to a traditional personal computer but can comprise other computing hardware configured to connect to and communicate with a network 212 (e.g., smart phones, laptop computers, tablet computers, or other mobile computing devices, servers, network devices, dedicated devices, and the like). In the illustrated embodiment, the computing device 220 is configured to communicate with a computing device 230 (e.g., a remote server, such as a server in a cloud computing environment) via a network 212. In the illustrated embodiment, the computing device 220 is configured to transmit input data to the computing device 230, and the computing device 230 is configured to implement any of the quantum circuits or protocols disclosed herein (e.g., compiling/synthesizing the quantum circuit (for instance, a quantum circuit including circuit elements for implementing the magic state distillation procedures) from a higher-level circuit description) and outputting results to the computing device 220. Any of the data received from the computing device 2930 can be stored or displayed on the computing device 2920 (e.g., displayed as data on a graphical user interface or web page at the computing devices 220). In the illustrated embodiment, the illustrated network 212 can be implemented as a Local Area Network (LAN) using wired networking (e.g., the Ethernet IEEE standard 802.3 or other appropriate standard) or wireless networking (e.g. one of the IEEE standards 802.11a, 802.11b, 802. llg, or 802.11η or other appropriate standard). Alternatively, at least part of the network 212 can be the Internet or a similar public network and operate using an appropriate protocol (e.g., the HTTP protocol).

Another example of a possible network topology 300 (e.g., a distributed computing environment) for implementing a system according to the disclosed technology is depicted in Fig. 3. Networked computing device 320 can be, for example, a computer running a browser or other software connected to a network 312. The computing device 320 can have a computer architecture as shown in FIG. 1 and discussed above. In the illustrated embodiment, the computing device 320 is configured to communicate with multiple computing devices 330, 331, 332 (e.g., remote servers or other distributed computing devices, such as one or more servers in a cloud computing environment) via the network 312. In the illustrated embodiment, each of the computing devices 330, 331 , 332 in the computing environment 300 is used to perform at least a portion of any of the quantum circuits disclosed herein. In other words, the computing devices 330, 331, 332 form a distributed computing environment in which the quantum circuit implementation process is shared across multiple computing devices. The computing device 320 is configured to transmit input data to the computing devices 330, 331 , 332, which are configured to distributively implement any of the quantum circuit processes disclosed herein (e.g., compiling/ synthesizing the quantum circuit from a higher-level circuit description) and to provide results to the computing device 320. Any of the data received from the computing devices 330, 331, 332 can be stored or displayed on the computing device 320 (e.g., displayed as data on a graphical user interface or web page at the computing devices 320). The illustrated network 312 can be any of the networks discussed above with respect to Fig. 2.

With reference to Figure 4, an exemplary system for implementing embodiments of the disclosed technology includes computing environment 400. In computing environment 400, a compiled quantum computer circuit description, including a circuit description for one or more magic state distillation circuits as disclosed herein, can be used to program (or configure) one or more quantum processing units such that the quantum processing unit(s) implement the circuit described by the quantum computer circuit description. The quantum computer circuit description can implement any of the magic state distillation circuits discussed herein.

The environment 400 includes one or more quantum processing units 402 and one or more readout device(s) 408. The quantum processing unit(s) execute quantum circuits that are precompiled and described by the quantum computer circuit description. The quantum processing unit(s) can be one or more of, but are not limited to: (a) a superconducting quantum computer; (b) an ion trap quantum computer; c) a fault- tolerant architecture for quantum computing; and/or (d) a topological quantum architecture (e.g., a topological quantum computing device using Majorana zero modes). The precompiled quantum circuits, including any of the disclosed circuits or circuits for implementing the disclosed protocols, can be sent into (or otherwise applied to) the quantum processing unit(s) via control lines 406 at the control of quantum processor controller 420. The quantum processor controller (QP controller) 420 can operate in conjunction with a classical processor 410 (e.g., having an architecture as described above with respect to FIG. 1) to implement the desired quantum computing process. Further, the classical processor 410 can be programmed to implement any of the disclosed methods and/or protocols.

In the illustrated example, the QP controller 420 further implements the desired quantum computing process via one or more QP subcontroilers 404 that are specially adapted to control a corresponding one of the quantum processor(s) 402. For instance, in one example, the quantum controller 420 facilitates implementation of the compiled quantum circuit by sending instructions to one or more memories (e.g., lower-temperature memories), which then pass the instructions to low-temperature control unit(s) (e.g., QP subcontroiler(s) 404) that transmit, for instance, pulse sequences representing the gates to the quantum processing unit(s) 402 for implementation . In other examples, the QP controller (s) 420 and QP subcontroller(s) 404 operate to provide appropriate magnetic fields, encoded operations, or other such control signals to the quantum processo (s) to implement the operations of the compiled quantum computer circuit description. The quantum controller(s) can further interact with readout devices 408 to help control and implement the desired quantum computing process (e.g., by reading or measuring out data results from the quantum processing units once available, etc.)

With reference to FIG. 4, compilation is the process of translating a high-level description of a quantum algorithm into a quantum computer circuit description comprising a sequence of quantum operations or gates, which can include any of the magic state distillation circuits as disclosed herein. The compilation can be performed by a compiler 422 using- a classical processor 410 (e.g., as shown in FIG. 1) of the environment 400 which loads the high-level description from memory or storage devices 412 and stores the resulting quantum computer circuit description in the memory or storage devices 412.

In other embodiments, compilation can be performed remotely by a remote computer 400 (e.g., a computer having a computing environment, as described above with respect to FIG. 1) which stores the resulting quantum computer circuit description in one or more memory or storage devices 462 and transmits the quantum computer circuit description to the computing environment 400 for implementation in the quantum processing unit(s) 402. Still further, the remote computer 400 can store the high-level description in the memory or storage devices 462 and transmit the high-level description to the computing environment 400 for compilation and use with the quantum processor (s). In any of these scenarios, results from the computation performed by the quantum processor(s) can be communicated to the remote computer after and/or during the computation process. Still further, the remote computer can communicate with the QP controller(s) 420 such that the quantum computing process (including any compilation and/or QP processor control procedures) can be remotely controlled by the remote computer 460. in general, the remote computer 460 communicates with the QP controller (s) 420 and/or compiler/synthesizer 422 via communication connections 450.

In particular embodiments, the environment 400 can be a cloud computing environment, which provides the quantum processing resources of the environment 400 to one or more remote computers (such as remote computer 460) over a suitable network (which can include the internet).

XII. GENERAL EMBODIMENTS

This section describes several example embodiments for implementing embodiments of the disclosed technology. The disclosed tools and techniques are not to be construed as limiting in any way, as an one or more of the illustrated method acts can be performed alone or in various other combinations and subcombinations with one another. Further, any one or more of the disclosed method acts can be performed with one or more other method acts disclosed herein.

FIG. 5 is a flowchart of an example method 500 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

In some embodiments, the methods below are performed (at least in part) by a classical computer configured to communicate with and control a quantum computer. Still further, the method acts can be embodied as computer-executable instructions which when executed by a computer cause the computer to perform the methods.

At 510, a Reed-Muller magic state distillation protocol is generated for creating magic states in the quantum computing device. In particular implementations, the Reed-Muller magic state distillation protocol is for Toffoli gates or controlled-controlled-Z (CCZ) gates. In some implementations, logical vectors implemented by the protocol allow 10 CCZ magic states for 512 qubit code with eighth order error reduction. In certain implementations, the protocol uses R-M stabilizers as shown and described herein.

At 512, the quantum computing device is configured to implement the Reed-Muller magic state distillation protocol.

FIG. 6 is a flowchart of an example method 600 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 610, a magic state distillation protocol for T gates, controlled-S gates, or CCZ gates is generated using a randomized construction process. In certain implementations, the magic state distillation protocol has an asymptotic distillation efficiency 1

At 612, the quantum computing device is configured to implement the magic state dis- filiation protocol,

FIG. 7 is a flowchart of an example method 700 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 710, a magic state distillation protocol for T gates, controlled- S gates, or CCZ gates is generated, wherein the magic state distillation protocol includes level-lifted triorthogonal codes for reducing circuit depth. In certain implementations, the magic state distillation protocol is a protocol as disclosed herein (e.g., in Sections VII-X).

At 712, the quantum computing device is configured to implement the magic state distillation protocol.

FIG. 8 is a flowchart of an example method 800 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 810, a controlled- Z operator using a transversal T gate are measured to measure stabilizers of a CCZ magic state. In certain implementations, the stabilizers of the CCZ magic state achieve a second order error reduction. Further, the stabilizers of the CCZ magic state achieve a fourth order error reduction.

FIG. 9 is a flowchart of an example method 900 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 910, stabilizers of CCZ magic states using one or more transversal CCZ gates are simultaneously measured. In certain implementations, the stabilizers of the CCZ magic state achieve a fourth order error reduction. FIG. 10 is a flowchart of an example method 1000 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 1010, a magic state distillation protocol for T gates is generated, wherein the magic state distillation protocol includes punctured Reed-Muller codes. In particular implementations, the punctured Reed-Mu!ier codes comprise any of the Reed-Mu!ier codes as disclosed herein. In some implementations, the punctured Reed-Mul!er codes comprise any of the punctured higher-order Reed-Muller codes (above first-order) as disclosed herein. In certain implementations, the punctured Reed-Muller codes are selected based on Hamming distances.

At 1012, the quantum computing device is configured to implement the magic state distillation protocol.

FIG. 11 is a flowchart of an example method 1100 for distilling magic states in a quantum computing device in accordance with embodiments of the disclosed technology. The illustrated embodiment should not be construed as limiting, as the disclosed method acts can, in some cases, be performed alone, in different orders, or at least partially simultaneously with one another. Further, any of the disclosed methods or method acts can be performed with any other methods or method acts disclosed herein.

At 1110, a magic state distillation protocol is generated using only k + ηχ total qubits. In particular implementations, the magic state distillation protocol is based on a triorthogonai code.

At 1112, the quantum computing device is configured to implement the magic state distillation protocol.

XIII. CONCLUDING REMARKS

Having described and illustrated the principles of the disclosed technology with reference to the illustrated embodiments, it will be recognized that the illustrated embodiments can be modified in arrangement and detail without departing from such principles.