BACKGROUND

[0001] A quantum computer is a physical machine configured to execute logical operations based on or influenced by quantum-mechanical phenomena. Such logical operations may include, for example, mathematical computation. Current interest in quantum-computer technology is motivated by analysis suggesting that the computational efficiency of an appropriately configured quantum computer may surpass that of any practicable non-quantum computer when applied to certain types of problems. Such problems include computer modeling of natural and synthetic quantum systems, integer factorization, data searching, and function optimization as applied to systems of linear equations and machine learning.

SUMMARY

[0002] One aspect of this disclosure relates to a method to build a lookup decoder for mapping error syndromes based on quantum-stabilizer code to corresponding error corrections. The method comprises (A) enumerating a subset of error syndromes up to a maximum error weight based on the quantum-stabilizer code; (B) iterating through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset, where the error state defines error in a qubit register of a quantum computer; and (C) for each error syndrome of the subset of error syndromes, storing in classical computer memory an error correction based on the error state of highest probability and mapped to that error syndrome.

[0003] Another aspect of this disclosure relates to a computer system coupled operatively to a quantum computer. The computer system comprises a processor and, operatively coupled to the processor, computer memory holding instructions that cause the processor to build a lookup decoder for mapping error syndromes based on quantum-stabilizer code to corresponding error corrections. The instructions comprise: instructions (A) for enumerating a subset of error syndromes up to a maximum weight based on the quantum-stabilizer code; instructions (B) for iterating through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset, where the error state defines error in a qubit register of a quantum computer; and instructions (C) for storing in the computer memory, for each error syndrome of the subset of error syndromes, an error correction based on the error state of highest probability and mapped to that error syndrome, wherein the error correction mapped to a given error syndrome reverses the error state of highest probability computed for that error syndrome.

[0004] This Summary is provided to introduce in simplified form a selection of concepts that are further described in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. The claimed subject matter is not limited to implementations that solve any or all disadvantages noted in any part of this disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

[0005] FIG. 1 shows aspects of an example quantum computer.

[0006] FIG. 2 illustrates a Bloch sphere, which graphically represents the quantum state of one qubit of a quantum computer.

[0007] FIG. 3 shows aspects of an example signal waveform for effecting a quantum-gate operation in a quantum computer.

[0008] FIG. 4 shows aspects of a comparative example algorithm for building a lookup decoder for quantum-stabilizer code.

[0009] FIG. 5 shows aspects of an example method to build a lookup decoder for quantum-stabilizer code.

[0010] FIG. 6 shows aspects of an example run-time method for using a lookup decoder for quantum error correction.

[0011] FIG. 7 shows aspects of an example algorithm for building a lookup decoder using Pauli information sets.

[0012] FIG. 8 shows aspects of an example algorithm for construction of a Pauli error with a given error syndrome.

[0013] FIG. 9A shows an intersection graph of the generators of a five-qubit code.

[0014] FIG. 9B shows an intersection graph of the generators of a Steane code.

[0015] FIG. 10 shows aspects of an example algorithm for finding the frame of a rotated Calderbank-Shor-Steane (CSS)code. [0016] FIG. 11 shows aspects of an example classical computer system.

DETAILED DESCRIPTION

1. Overview of quantum error correction

[0017] This disclosure relates to error correction in quantum computing. In any quantum computer the quantum state held in a qubit register may be to some degree corrupted. Potential sources of corruption include measurement error, quantum-gate implementation error, and dccohcrcncc of the quantum state over time. The term ‘error’ refers herein to corruption from any of these sources. Quantum error correction seeks to limit the error so that the quantum state retains its computational value. Typically the high-level strategy of quantum error correction borrows somewhat from error correction in classical information theory — viz., the data to be protected from error is made redundant to a certain degree via an ‘encoding’ process. Then, subsequent to processing, transmission, or prolonged storage, a ‘decoding’ process is used to recover the uncorrupted data. In the present context, ‘stabilizer code’ is program code that appends redundant data, in the form of ancillary qubits, to a register state to enable quantum error correction. A ‘decoder’ is program code that processes the appended and possibly corrupted register state after a quantum operation, or after prolonged storage, to recover the uncorrupted register state. More specifically, a ‘lookup decoder’ is map stored in classical computer memory, which pairs an error syndrome to the appropriate correction.

2. Quantum-computer architecture

[0018] In order to provide a context for quantum-error correction, some aspects of an example quantum-computer architecture will first be described. Turning now to the drawings, FIG. 1 shows aspects of an example quantum computer 10 configured to execute quantum-logic operations {vide infra). Whereas conventional computer memory holds digital data in an array of bits and enacts bit-wise logic operations, a quantum computer holds data in an array of qubits and operates quantum-mechanically on the qubits in order to implement the desired logic. Accordingly, quantum computer 10 of FIG. 1 includes a set of qubit registers 12 — e.g., state register 12S and ancillary register 12A. Each qubit register includes a series of qubits 14. The number of qubits in a qubit register is not particularly limited but may be determined based on the complexity of the quantum logic to be enacted by the quantum computer.

[0019] Qubits 14 of qubit register 12 may take various forms, depending on the desired architecture of quantum computer 10. Each qubit may comprise: a superconducting Josephson junction, a trapped ion, a trapped atom coupled to a high-finesse cavity, an atom or molecule confined within a fullerene, an ion or neutral dopant atom confined within a host lattice, a quantum dot exhibiting discrete spatial- or spin-electronic states, electron holes in semiconductor junctions entrained via an electrostatic trap, a coupled quantum-wire pair, an atomic nucleus addressable by magnetic resonance, a free electron in helium, a molecular magnet, or a metal-like carbon nanosphere, as non-limiting examples. A qubit may be implemented in the plural processing states corresponding to different modes of light propagation through linear optical elements (e.g., mirrors, beam splitters and phase shifters), as well as in states accumulated within a Bose-Einstein condensate. More generally, each qubit 14 may comprise any particle or system of particles that can exist in two or more discrete quantum states that can be measured and manipulated experimentally.

[0020] FIG. 2 is an illustration of a Bloch sphere 16, which provides a graphical description of some quantum mechanical aspects of an individual qubit 14. In this description, the north and south poles of the Bloch sphere correspond to the standard basis vectors |0) and |1), respectively — up and down spin states, for example, of an electron or other fermion. The set of points on the surface of the Bloch sphere comprise all possible pure states |^) of the qubit, while the interior points correspond to all possible mixed states. A mixed state of a given qubit may result from decoherence, which may occur because of undesirable coupling to external degrees of freedom.

[0021] Returning now to FIG. 1, quantum computer 10 includes a controller 18. The controller may include at least one processor 20 and associated computer memory 22. Processor 20 may be coupled operatively to peripheral componentry, such as network componentry, to enable the quantum computer to be operated remotely. Processor 20 may take the form of a central processing unit (CPU), a graphics processing unit (GPU), or the like. As such, controller 18 may comprise classical electronic componentry. The terms ‘classical’ and ‘non-quantum’ are applied herein to any component that can be modeled accurately without considering the quantum state of any individual particle therein. Classical electronic components include integrated, microlithographed transistors, resistors, and capacitors, for example. Computer memory 22 may be configured to hold program instructions 24 that cause processor 20 to execute any function or process of controller 18. The computer memory may also be configured to hold additional data 26. In some examples, data 26 may include a register of classical control bits 28 that influence the operation of the quantum computer during run time — e.g., to provide classical control input to one or more quantum-gate operations. In examples in which qubit register 12 is a low-temperature or cryogenic device, controller 18 may include control componentry operable at low or cryogenic temperatures — e.g., a field-programmable gate array (FPGA) operated at 77K. In such examples, the low-temperature control componentry may be coupled operatively to interface componentry operable at normal temperatures.

[0022] Controller 18 of quantum computer 10 is configured to receive a plurality of inputs 30 and to provide a plurality of outputs 32. The inputs and outputs may each comprise digital and/or analog lines. At least some of the inputs and outputs may be data lines through which data is provided to and/or extracted from the quantum computer. Other inputs may comprise control lines via which the operation of the quantum computer may be adjusted or otherwise controlled.

[0023] Controller 18 is operatively coupled to qubit registers 12 via quantum interface 34. The quantum interface is configured to exchange data (solid lines) bidirectionally with the controller. The quantum interface is further configured to exchange signal associated with the data (dashed lines) bidirectionally with the qubit registers. Depending on the physical implementation of qubits 14, such signal may include electrical, magnetic, and/or optical signal. Via signal conveyed through the quantum interface, the controller may interrogate and otherwise influence the quantum state held in any, some, or all of the qubit registers, as defined by the collective quantum state of the qubits therein. To that end, the quantum interface includes qubit writer 36 and qubit reader 38. The qubit writer is configured to output a signal to one or more qubits of a qubit register based on write-data received from the controller. The qubit reader is configured to sense a signal from one or more qubits of a qubit register and to output read-data to the controller based on the signal. The read-data received from the qubit reader may, in some examples, be an estimate of an observable to the measurement of the quantum state held in a qubit register. Taken together, controller 18 and interface 34 may be referred to as a ‘controller system’.

[0024] In some examples, suitably configured signal from qubit writer 36 may interact physically with one or more qubits 14 of a qubit register 12, to trigger measurement of the quantum state held in the one or more qubits, qubit reader 38 may then sense a resulting signal released by the one or more qubits pursuant to the measurement, and may furnish read-data corresponding to the resulting signal to controller 18. Stated another way, the qubit reader may be configured to output, based on the signal received, an estimate of one or more observables reflecting the quantum state of one or more qubits of a qubit register, and to furnish the estimate to controller 18. In one nonlimiting example, the qubit writer may provide, based on data from the controller, an appropriate voltage pulse or pulse train to an electrode of one or more qubits, to initiate a measurement. In short order, the qubit reader may sense photon emission from the one or more qubits and may assert a corresponding digital voltage level on a quantum-interface line into the controller. Generally speaking, any measurement of a quantum-mechanical state is defined by the operator O corresponding to the observable to be measured; the result R of the measurement is guaranteed to be one of the allowed eigenvalues of O. In quantum computer 10, R is statistically related to the qubit-register state prior to the measurement, but is not uniquely determined by the qubit-register state.

[0025] Pursuant to appropriate input from controller 18, quantum interface 34 may be configured to implement one or more quantum-logic gates to operate on the quantum state held in a qubit register 12. The term ‘state vector’ refers herein to the quantum state held in the series of qubits 14S of state register 12S of quantum computer 10. The state vector is a convenient representation that may be used to interpret measurement outcomes. Whereas the function of each type of logic gate of a classical computer system is described according to a corresponding truth table, the function of each type of quantum gate is described by a corresponding operator matrix. The operator matrix operates on (?.e., multiplies) the complex vector representing a qubit register state and effects a specified rotation of that vector in Hilbert space.

[0026] For example, the Hadamard gate H is defined by

The H gate acts on a single qubit; it maps the basis state |0) to (|0) + |l))/-\/2 _; and maps |1) to (|0) — 11))/\/2- Accordingly, the H gate creates a superposition of states that, when measured, have equal probability of revealing |0) or |1).

[0027] The phase gate S is defined by

The S gate leaves the basis state |0) unchanged but maps |1) to e ^t7r / ² |1). Accordingly, the probability of measuring either |0) or |1) is unchanged by this gate, but the phase of the quantum state of the qubit is shifted. This is equivalent to rotating if} by 90 degrees along a circle of latitude on the Bloch sphere of FIG. 2.

[0028] Some quantum gates operate on two or more qubits. The SWAP gate, for example, acts on two distinct qubits and swaps their values. This gate is defined by

1 0 0 0

0 0 1 0

SWAP =

0 1 0 0

0 0 0 1

[0029] A ‘Clifford gate’ is a quantum gate that belongs to the Clifford group — viz., , a set of quantum gates that effect permutations of the Pauli operators. For the n-qubit case the Pauli operators form a group where <7Q, ...<73 are the single-qubit Pauli matrices. The Clifford group is then defined as the group of unitaries that normalize the Pauli group,

[0030] The foregoing list of quantum gates and associated operator matrices is non- exhaustive, but is provided for ease of illustration. Other quantum gates include Pauli— X, —Y, and —Z gates, the \/NOT gate, additional phase-shift gates, the \/SWAP gate, controlled cX, cY, and cZ gates, and the Toffoli, Fredkin, Ising, and Deutsch gates, as non-limiting examples.

[0031] Continuing in FIG. 1, suitably configured signal from qubit writer 36 of quantum interface 34 may interact physically with one or more qubits 14 of a qubit register 12 so as to assert any desired quantum-gate operation. As noted above, the desired quantumgate operations include specifically defined rotations of a complex vector representing a qubit register state. In some examples, in order to effect a desired rotation O, the qubit writer may apply a predetermined signal level Si for a predetermined duration 7}. In some examples, plural signal levels may be applied for plural sequenced or otherwise associated durations, as shown in FIG. 3, to assert a quantum-gate operation on one or more qubits of a qubit register. In general, each signal level S _t and each duration Ti is a control parameter adjustable by appropriate programming of controller 18.

[0032] The terms ‘oracle’ and ‘quantum algorithm’ are used herein to describe a predetermined sequence of elementary quantum-gate and/or measurement operations executable by quantum computer 10. An oracle may be used to transform the quantum state of a qubit register 12 to effect a classical or non-elementary quantum-gate operar tion or to apply a density operator, for example. In some examples, an oracle may be used to enact a predefined ‘black-box’ operation /(a;), which may be incorporated into a complex sequence of operations. To ensure adjoint operation, an oracle mapping n input qubits |.'r) to m output or ancilla qubits \y — fix)) may be defined as a quantum gate O(|rzr) ® |y)) operating on the (n + m) qubits. In this case, O may be configured to pass the n input qubits unchanged but combine the result of the operation fix) with the ancillary qubits via an XOR operation, such that O( \x} ® |y}) = \x) ® \y © fix)}.

[0033] Implicit in the description herein is that each qubit 14 of any qubit register 12 may be interrogated via quantum interface 34 so as to reveal with confidence the standard basis vector |0) or |1) that characterizes the quantum state of that qubit. In some implementations, however, measurement of the quantum state of a physical qubit may be subject to error. Accordingly, any qubit 14 may be implemented as a logical qubit, which includes a grouping of physical qubits measured according to an error-correcting oracle that reveals the quantum state of the logical qubit with abovethreshold confidence.

3. Lookup decoder introduction

[0034] A decoder is an important feature of any quantum error correction scheme. It is a classical subroutine whose goal is to identify the error which occurs in a quantum system based on the outcome of the syndrome extraction circuit — i.e., the ‘syndrome’. Discussed herein are different strategies to build decoders for small stabilizer codes based on lookup tables or hash maps. More specifically, a correction corresponding to each syndrome is pre-computed and stored in memory. Given a syndrome, the decoding comprises returning the stored correction. The term ‘lookup decoder’ is applied herein to any such decoder.

[0035] Lookup decoders, which return a pre-computed correction for each syndrome, are not efficient because the pre-computation time grows exponentially with the code length. They are useful for small codes, however, because they can be executed with low latency. A lookup decoder can also be used as a pre-decoder which corrects only the most common error patterns to reduce the resource requirements of a more sophisticated decoder. In order to extend the practical range of lookup decoders, classical information set decoding techniques are applied herein to the case of stabilizer codes, resulting in a faster construction for lookup decoders. This disclosure also addresses the decoding of Calderbank-Shor-Steane (CSS) codes and rotated CSS codes, which are obtained by applying single-qubit Clifford gates to CSS codes. The CSS decoder is extended to rotated CSS codes by exploiting a graphical characterization of rotated CSS codes. Finally, construction of lookup decoders for stabilizer codes is discussed — codes whose stabilizer group contains a large rotated CSS subgroup. This disclosure proves that the problem of computing a maximal rotated CSS subgroup of a stabilizer group is nondeterministic polynomial-time (NP) complete.

[0036] Efficient decoding of a general stabilizer code may not be possible using this approach because the memory cost of storing all the corrections is exponential in the code length, and because the construction of the decoder runs in exponential time. However, once built, a lookup decoder can be executed extremely fast because it only requires memory reads, lookup decoders are well suited to providing fast decoding for quantum error correction with small codes [Ref. 1], A field-programmable gate array (FPGA) implementation of a lookup table decoder for small surface codes was proposed in [Ref. 2] . A lookup decoder may also be used as a pre-decoder to speed-up another decoder or to reduce the resources consumed by a more sophisticated decoder [Ref. 3] .

[0037] One of the objectives herein is to design a lookup decoder that can be used to correct errors with an arbitrary small stabilizer code. Naively, one can build a lookup decoder for a stabilizer code by computing the syndromes of all Pauli errors with weight up to M and storing a minimum weight error for each syndrome. This requires enumer- ating over all Pauli errors with weight up to M. Proposed herein is a construction that produces the same decoder using fewer syndrome computations for many codes. This construction is obtained by applying information set decoding [Ref. 4] . Information set decoding is a standard tool in code-based cryptography [Ref. 5], [Ref. 6] and is also used to compute the minimum distance of classical linear codes [Ref. 7].

[0038] The problem of designing quantum algorithms for information set decoding was considered previously in the literature [Ref. 8] to design quantum attacks on code-based cryptosystems. The present work is not related to this question and is based on different techniques. The objective here is to construct a decoder for quantum stabilizer codes using a classical computer.

[0039] To apply information set decoding to the setting of stabilizer codes, a notion of information set for subgroups of the Pauli group is introduced. As in the classical case, an information set for a Pauli group can be computed by Gaussian elimination. The main difference in the case of linear codes is that a single column in a Pauli matrix can have rank two. This disclosure shows that information sets containing a minimum number of rank-two columns are advantageous to minimize the cost of the construction of the lookup decoder for stabilizer code.

[0040] A subclass of stabilizer codes called CSS codes [Ref. 9], [Ref. 10] which are defined by stabilizer generators in {1, X}” or {/, Z} ⁿ is also addressed. As a result, one can build a lookup decoder for X and Z errors independently which leads to a faster decoder construction than for general stabilizer codes. CSS codes behave like classical codes, and one can immediately port the classical information decoders from linear codes to CSS codes.

[0041] Discussed also are rotated CSS codes — i.e., CSS codes whose stabilizer generators have been conjugated by a product of single-qubit Clifford operations. A graphical characterization of rotated CSS codes is provided, as well as an algorithm that computes the rotation that maps them back to a CSS code. These codes have the same advantage of CSS codes in terms of decoding. Namely, one can split Pauli errors on each qubit into two types of error that can be corrected independently.

[0042] The structure of CSS codes and rotated CSS codes is exploited to reduce the cost of constructing a lookup decoder for these codes. More generally, it is natural to expect that a more efficient decoder construction can be designed for a stabilizer code that contains large rotated CSS subgroup. Such a construction is proposed for stabilizer codes that contain only a small number of non-CSS generators (or non-rotated-CSS generators). Given a stabilizer code, a maximum rotated CSS subgroup of the stabilizer group can be determined and exploited in order to speed-up the lookup decoder construction. It is shown, however, that the problem of finding a maximum rotated subgroup of a stabilizer group is NP-complete.

[0043] In the remainder of this disclosure, the formalism of stabilizer codes is reviewed, in Section 4. Then, in Section 5, information sets for Pauli groups is introduced and applied to the decoding of stabilizer codes. CSS codes and rotated CSS codes are studied in Section 6.

4. Technical context

[0044] Reviewed first is the formalism of stabilizer codes and the decoding problem for these codes [Ref. 11],

4.1. Pauli operators

[0045] Throughout this disclosure, the notation P _n is used for the group of zz-qubit Pauli operators aPi ® . . . P _n with a G {±1, ±i} and Pi G {I , X, Y, Z}. The quotient of the Pauli group by the subgroup of phase operators {±/, HI] is denoted P _n . Px,n = {/j X}®" denotes the set of X operators of P _n , and P _Zn — {I, Z}® ⁿ is the set of Z operators of P _n .

4.2. Stabilizer codes

[0046] A stabilizer code with length n is defined by a set of n- qubit commuting Pauli operators Si , . . . , S _r G P _n such that the group generated by the Si does not contain —I. The operators Si are called the stabilizer generators and the group they generate is the stabilizer group. Pauli errors are considered to be operators of the phase-free Pauli group P _n because phase errors have no effect on quantum states. Operators of the stabilizer group up to a phase ±1 are referred to as the stabilizers. In what follows, S denotes the set {Si, . . . , of stabilizer generators and (<S) is the stabilizer group. The syndrome of a Pauli error E G P _n for the stabilizer code C(5) is defined to be the vector <7 = cfB) e Zj such that = 1 iff E anti-commute with Si. The minimum distance of a stabilizer code is the minimum weight of a Pauli error with trivial syndrome which is not a stabilizer. A Pauli error that has trivial syndrome is referred to as a logical operator of the code. It is a non-trivial logical operator if it is a logical operator which is not a stabilizer. The minimum distance of a stabilizer code is the minimum weight of a non-trivial logical operator of the code.

4.3. Lookup decoder

[0047 for a stabilizer code with length n and with r stabilizer generators is a map _n that sends a syndrome onto a correction. A decoder corrects an error E if s a stabilizer. Otherwise, the correction fails. Lookup decoder refers to a pre-computed decoder D. This map can be stored in memory as a lookup table or as a hash map. A hash map may be preferable in term of space cost when Z)(<r) is constant over large subsets of syndromes. Because it is pre-computed and stored in memory the decoder returns a correction is constant time. However, it generally occupies a large amount of memory and the pre-computing time is significant. This is not a scalable solution but can be useful to explore the performance of small codes or as a partial decoder or a pre-decoder.

4-4- Pauli matrix and Gaussian elimination

[0048] A r x n Pauli matrix is defined to be a matrix with r rows and n columns with coefficients in {I, X. Y, Z}. Bold-face letters M, G, H, . . . denote Pauli matrices. For i = 1, . . . , r, the z-th row of a Pauli matrix M is a n-qubit Pauli operator denoted Mi e P _n .

[0049] In what follows, a Pauli matrix is used to represent a subgroup of the Pauli group. A generator matrix for a subgroup Q of P _n is a Pauli matrix G with n columns whose rows Gh, . . . , G _r form a set of generators of the group Q. Recall that Pauli operators herein are defined up to a phase. As a result, a generator matrix is a complete description of a subgroup of P _n .

[0050] The rank of a subgroup Q of P _n is defined to be the minimum number of generators of Q and the rank of a Pauli matrix is the rank of the subgroup generated by its rows. [0051] One can compute the rank of a Pauli matrix using Gaussian elimination — i.e., by a sequence of O(r ² ) row operations. For a Pauli matrix, a row operation is either swapping two rows or multiplying a row by another row. These operations preserve the group generated by the rows of the matrix.

[0052] A standard form convenient for the purpose of this disclosure is now introduced. A Pauli matrix G is said to be in standard form if it satisfies the following: (a) the matrix is in row echelon form; (b) each row is non-trivial: (c) the leading entry of each row is either X, Y or Z; and (d) each column containing a leading entry contains either only one non-trivial coefficient X, Y or Z or it contains two non-trivial coefficients X and Z.

[0053] For example, the following matrix is in standard form

The leading entries of the rows of this matrix are included in column 1, 3, 6 and 7. As requested in the definition of the standard form, the four columns 1, 3, 6 and 7 contain either a single non-trivial Pauli matrix or they contain a X and Z. The following Proposition is a straightforward application of Gaussian elimination.

[0054] Proposition 1. Let G be a subgroup of P _n with r generators. Using Gaussian elimination, one can produce a generator matrix for Q in standard form by applying a sequence of O(rn) row operations to the matrix G.

[0055] The cost of producing a generator matrix in standard form is O(rn ² ) bit operations. One can read some properties of a Pauli matrix in its standard form.

[0056] Lemma 1. The rank of a Pauli matrix is given by the number of rows of its standard form.

Proof. The number of rows is clearly an upper bound on the rank. Moreover, inspecting the leading terms of non-trivial rows, it can be seen that no non-trivial relation can exist between these rows. 5. Information set decoders for stabilizer codes

[0057] Reviewed in this section is the basic strategy to build lookup decoders for stabilizer codes. A more economical way to build these decoders is described here, which can be seen as a generalization of classical information set decoders [Ref. 4]. The key ingredient is a notion of information set for subgroups of the Pauli group introduced in this section.

5.1. Stabilizer codes

[0058] FIG. 4 shows aspects of a comparative example algorithm for building a lookup decoder LUD[5, £, Af] for quantum-stabilize code. More specifically, Algorithm 1 describes a naive construction of a lookup decoder for stabilizer codes. The algorithm loops over all errors with weight up to M, from lower weight to higher weight errors and stores a minimum weight correction for each syndrome observed. In the remainder of this disclosure, LUD[5, £. M] denotes the lookup decoder returned by Algorithm 1.

[0059] Proposition 2. Let (7(5) be a stabilizer code with minimum distance d. Let D = LUD[5, P _n , M] be the lookup decoder returned by Algorithm 1. If M > (d — l)/2 then the decoder D corrects all Pauli errors with weight up to (d — l)/2. Moreover, the construction of D requires syndrome computations.

Proof. The objective here is to prove that D corrects any Pauli error E with weight < (d — l)/2. By construction of the lookup decoder, for all errors E with weight up to M, D(cr(E))| < |.E|. As a result, the residual error after correction satisfies

\ED{a{E))\ < |5| + \D(a(Ef)\ < 2|E| < (d - 1)- (8)

Moreover, the syndrome of £>(a’(£')) is c(L’) which implies that the residual error ED(a(Ey) has trivial syndrome. Therefore, by definition of the minimum distance, the residual error must be a stabilizer, proving that the decoder achieves the code distance. The number of syndrome computation corresponds to the number of non-trivial Pauli errors with weight up to M. [0060] The number of syndrome computations can be used as a proxy to the complexity of the construction of a lookup decoder. It is also an upper bound on the number of pairs (syndrome, correction) stored in memory by the lookup decoder. Proposed in the rest of this section is a different strategy to construct LUD[<S, 'P _ri . M], which, in many cases, allows the same lookup table to be constructed using significantly fewer syndrome computations.

5.2. Information set for Pauli groups

[0061] Information sets of classical codes are used in attacks on code-based cryptography [Ref. 4] or in algorithms to compute the minimum distance of classical codes [Ref. 7]. An information set for a r x n Pauli matrix G is defined herein as a minimal subset T c. {1, . . . , n} such that the sub-matrix G|j of G induced by the columns indexed by I satisfies rank Gp = rank G. This definition is an immediate generalization of the classical notion of information sets. By definition, if I is an information set, any Pauli operator of the group generated by the rows of G is fully determined by its restriction to the qubits of I.

[0062] One could use the isomorphism between P _n and Z;]” to import the classical notion of information set to this setting. However, the notion of weight of Pauli operators does not match with the binary weight in Z^". To avoid to adjust the notion of weight, the notion of information set, as introduced above, is preferred.

[0063] Proposition 3. Let Q be a subgroup of P _n . If G is a generator matrix for Q in standard form, then the set of columns supporting the leading entries of the non-trivial rows of G is an information set for G.

[0064] Proof. The submatrix Gp of G is in standard form. Based on Lemma 1 this shows that rank G = rankGp.

[0065] A classical information set for a linear code is defined similarly. It is a minimal subset T of columns of a generator matrix with maximum rank. However, the structure of the Pauli group leads to some technical differences between these two cases. For instance, the size of a classical information set is always equal to the dimension of the classical code. For Pauli groups, a single column of G may have rank two and therefore the size of an information set can be any integer between [rank G/2] and rank G. 5.3. Weight-increasing encoding for a Pauli group

[0066] Proposed here is a representation of the operators of a group Q as the image of Pauli operators acting on an information set of Q. In the subsequent sections, this map is used for a rapid enumeration of all Pauli operators of G with weight up to w.

[0067] Let Q be a subgroup of P _n with a generator matrix G in standard form and let I be its information set. With each row with index i = 1, 2, . . . of the Pauli matrix G, two operators, Gi G P _n and G. _t of Pi, are associated. Here Pi denotes the set of phase-less Pauli operators acting on qubits indexed by the elements of I. The generator Gi is the Pauli operator corresponding to row i of G. The pivot operator Gi is the weight-one Pauli operator defined by the leading entry of row i of G. The operators G _lf . . . , G _s form a generating set of the group Q and the pivot operators form a generating set for the restriction Q\% of Q to T.

[0068] For example, the generators and the pivot operators associated with the matrix given in Eq. (6) arc G ₂ = X ₃ Z ₄ Z ₅ and G?, = X ₃ . The encoding map associated with the matrix G in standard form is defined as where a, G Z ₂ . It encodes an operator of the restricted group Q\i into a element of Q.

[0069] Proposition 4- [weight-increasing encoding] The encoding map y>Q associated with a Pauli matrix in standard form is a group isomorphism. Moreover, for any Pauli operator P G Q\i, |PG(-P)| > l-P|-

[0070] Proof. This is clearly a group morphism. By definition of the standard form, it is easy to check that its kernel is trivial which proves the injectivity. Moreover, by definition of information sets, the two groups G and Gi have the same cardinality. Therefore this is an isomorphism. Its inverse is the restriction to the qubits of T, which implies that is weight-increasing.

5.4- Construction of lookup decoder based on information sets

[0071] This section revisits the construction of the lookup decoder. FIG. 5 shows aspects of an example method 46 to build a lookup decoder for quantum-stabilizer code that executes on a quantum computer. The resulting lookup decoder is configured to map error syndromes based on quantum-stabilizer code to corresponding error corrections. The detailed nature of the quantum-stabilizer code is not particularly limited in method 46. In some examples the quantum-stabilizer code may be a CSS code. In some examples the quantum-stabilizer code may be a rotated CSS code. Various ranges of density or sparsity of the lookup decoder are envisaged; in some examples the lookup decoder may comprise a hash map.

[0072] At 48 of method 46, a subset of error syndromes based on the quantum-stabilizer code is enumerated. The enumerated subset of error syndromes extends to a maximum error weight M. Typically, when the subset of error syndromes is enumerated, another subset within the parent set of error syndromes for the quantum-stabilizer code is omitted.

[0073] At 50 the method iterates through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset. Here and elsewhere, the error state defines error in a qubit register of the quantum computer. In some examples the error state includes at least one classical bit string with each bit corresponding to a different qubit of the qubit register. More particularly, the at least one classical bit string may include a classical bit string of A-type quantum errors and a classical bit string of Z-type quantum errors.

[0074] In some examples, iterating through the subset of error syndromes comprises stepping through a weight-increasing encoding map and generating a complete set of Pauli errors up to a predetermined weight for each error syndrome. In some examples, iterating through the subset of error syndromes comprises iterating through a set of products of pivot operators g = . . . G"' with weight w. More particularly, the pivot operators may be selected based on an information set with a minimum number of rank-one elements. In some examples, iterating through the subset of error syndromes comprises, when the maximum weight M is small relative to code length n, iterating in order of increasing weight of the error states of each syndrome.

[0075] At 52, for each error syndrome of the subset of error syndromes, an error correction based on the error state of highest probability is stored in a classical computer and mapped to that error syndrome. Typically the error correction mapped to a given error syndrome reverses the error state of highest probability computed for that error syndrome.

[0076] Operationally, method 46 may be enacted on a classical computer system coupled operatively to a quantum computer. As described hereinafter, the classical computer system comprises one or more processors and, operatively coupled to the one or more processors, computer memory holding instructions corresponding to method 46. Such instructions may include instructions (A) corresponding to step 48, instructions (B) corresponding to step 50, etc. In examples in which the classical computer memory is coupled to plural processing cores, iteration at 50 and storage at 52, as applied to different error syndromes, may be enacted in parallel via the plural processing cores.

[0077] The manner of utilizing a lookup table built according to method 46 is not particularly limited. In some examples, a classical computer system coupled operatively to a quantum computer may hold, in computer memory, instructions (D) to recognize a runtime error syndrome generated via operation of the quantum computer. It may hold instructions (E) to retrieve the error correction stored for the runtime error syndrome, and optional instructions (F) to adjust operation of the quantum computer based on the error correction retrieved. Thus, in some examples error correction may be applied to an intermediate stage of quantum computation, and the corrected intermediate may be fed back to the quantum computer for a subsequent stage of quantum computation. In other examples, the error correction may be used to dynamically tune one or more operating parameters of the quantum computer for improved (less error-prone) operation. In still other examples, the error correction may be applied to the final stage of the quantum computation, such that no feedback is required.

[0078] In view of the foregoing description, FIG. 6 shows aspects of an example run-time method 54 for using a lookup decoder for quantum error correction. The illustrated run-time method includes steps 56 through 60, corresponding to instructions D through F hereinabove.

[0079] By generalizing information set decoders, a construction of the same lookup decoder as in Algorithm 1 is obtained, but the construction here uses fewer syndrome computations. A significant ingredient is the weight increasing encoding map, introduced in Section 5.3, and the following coset enumeration lemma which facilitates the generation of all Pauli errors with a given syndrome with weight up to w.

[0080] For any subset A of P„, denote by A[w] the set of operators of A with weight < w. The following result is an immediate application of Proposition 4.

[0081] Lemma 2. Coset enumeration lemma Let r > 0. Let G be a Pauli matrix in standard form with r rows and let Q' = (Gi, . . . , G _r _i). If T is the information set associated with G, then for all w = 0, 1, . . . ,

A[w] C p _G (A[w]) where A = G _r G' and A = G _r Q' _x .

[0082] This lemma is used in Algorithm 2. To produce all the errors with syndrome a and weight up to w, Lemma 2 is applied, where Q' is the group of errors with trivial syndrome and G _r is an arbitrary error with syndrome <7.

[0083] FIG. 7 shows aspects of an example Algorithm 2 for building a lookup decoder using Pauli information sets. To obtain an arbitrary error with a given syndrome, a set of Pauli operators E^, . . . E _r is precomputed, such that Ei commute with all the stabilizer generators Sj except Si. The syndrome of Ei is the i th vector of the standard basis of Z™ . It is possible, then to build an error E with syndrome a = (<TI, . . . , a _r ) as For simplicity, this step is omitted in the description of Algorithm 2.

[0084] The core subroutine of Algorithm 2 is a loop over the set of products of pivot operators of the form g — G“ ^x . . . G“ ^r with weight w. It is easy to generate all these products with a given weight because each pivot operator Gj has weight one.

[0085] The cost of Algorithm 2 depends on the structure of the pivot group of the matrix G. The signature of a Pauli matrix G in standard form is defined to be the pair (si, S2) where Sj is the number of columns c G I such that rank G| _c = j. By definition, the signature of a Pauli matrix H satisfies Si + s ₂ = |Z| and s _x + 2s ₂ = rank G.

[0086] Proposition 5. Let G(<S) be a stabilizer code with minimum distance d and with r stabilizer generators. Let D = LUD[5, P _n , M] be the lookup decoder returned by Algorithm 2. If M > (d — l)/2 then the decoder D corrects all Pauli errors with weight up to (d — l)/2. Moreover, if the matrix G ^z in Algorithm 2 has signature (si, s ₂ ), the construction of D requires at most syndrome computations.

[0087] Proof. The decoder D returns a minimum weight error E with syndrome a for all syndrome a which is reached by an error with weight < M . Therefore, by the same argument as in the proof of Proposition 2, the decoder D corrects all Pauli errors with weight up to (d — l)/2 if M > (d — l)/2.

[0088] Let (si(cr), s ₂ (cr)) be the signature of the extended matrix G corresponding to the syndrome a. The number of syndrome computation is upper bounded by

Moreover, (si(tr), s ₂ (<r)) = (si + l, s ₂ ) or ($i — l, s ₂ + 1) which means that for all cr, Si(<r) < «i + 1 and s ₂ (<r) < s ₂ + 1. Plugging in the bounds on Si(<r) and S ₂ (<T) in Eq. 12, the expected bound is obtained.

5.5. Information sets minimizing the number of syndrome computations

[0089] Constructed in this section are information sets that minimize the upper bound on the number of syndrome computation in Algorithm 2. The following lemma demonstrates that in order to minimize Eq 11, information sets containing a minimum number of rank-two elements should be used. The notation may be used so that the upper bound on the number of syndrome computations in Proposition 5 is given by 2 ^r c(si + 1, s ₂ + 1).

[0090] Lemma 3. Let I and I' be two information sets for the same group with respective signatures then c(s' _{1 ;} s ₂ ) < c(si, s ₂ ).

[0091] Proof. Let P(a, b) = Px,a ^x Pb and let P(a, b)[w] be the set of Pauli operators of P{a, b) with weight w = 0, 1, . . . , a + b. The cardinality of this set is c(a, b) = |P(a, b)[w] |- (14)

The objective here is to prove that s ₂ )[w] | < |P(si , s ₂ ) [w] |. Because they correspond to the same group, the two signatures (si, s ₂ ) and (s' _1; s ₂ ) satisfy SI+2S ₂ = s' _L -l-2s ₂ which is the rank of the group. Let m = s ₂ — s ₂ . Then, — Si = 2(s ₂ — s ₂ ) = 2m > 0. [0092] Define the group morphism f : Pts^, s ₂ ) — >• P(si, s ₂ ) by

The map f is a bijection that replaces 2m copies of {I, A"} in P^, ^ ₂ ) by m copies of {I, X, Y, Z}. Because this transformation can only decrease the weight of Pauli operators, it induces an injective map P(s' ₁ , s ₂ )[w] P(si, s ₂ )[w] for all w. This map is not surjective when m > 0, that is when s' _x > si. This yields |P(s _x , s' ₂ ) [w]| < 1^(51, Sa) [m] | which, together with Eq. (14), concludes the proof of the lemma.

[0093] Proposed now is a construction of an information set maximizing si. Based on the previous lemma, this results in minimizing the bound of Eq. (11). The basic idea is to permute the columns of the generator matrix to put the rank-one columns first. The permuted matrix is then put in standard form. Given a permutation 7r of the qubit set {1, . . . , 71} and a Pauli matrix G, TT(G) denotes the matrix obtained by applying the permutation 7r to the columns of G.

[0094] Proposition, 6. Let Q be a subgroup of P _n with generator matrix G and let 7T be a permutation of {1, . . . , n}. Let G' be the matrix obtained by putting TT(G) in standard form. If I is the information associated with G' , then 7r ^-1 (Z) is an information set for Q. Moreover, if TV is such that all the rank-one columns of TF(G) are placed before the rank-two columns of TT(G), then TT ^-1 (Z) has signature (si, s ₂ ) with maximum si.

[0095] Proof. If I is the information associated with G ^z , then TT ^_1 (Z) is an information set for Q because a permutation of the column does not affect the rank.

Denote by ?r(G) = [G _x , G _z ] the two blocks of the matrix TT(G) where G _x contains the columns of G with rank < 1 and G ₂ contains the rank-two columns. The maximum value of si is upper bounded by the rank of the submatrix of G containing the rank-one columns, that is si < rank Gi.

[0096] Assertion. After putting TT(G) in standard form, one obtains a matrix G' — M - The matrix G _x coincides with the matrix obtained by putting Gi in standard form, up to additional trivial rows.

[0097] Based on the assertion, rankG _x = rank Gi, which is the maximum value of si. It remains to be shown that the information set T contains rank G _x columns of G with rank one.

[0098] Using the assertion again and Proposition 3, it can be seen that the intersection of Z with the columns of G' is an information set for G], Moreover, its signature is of the form (si, 0) for some sp Because for all information sets si + 2s2 is equal to the rank of the matrix, Si = rank G] which is the maximum possible value for Si.

5. 6. Computation of an error with a given syndrome

[0099] FIG. 8 shows aspects of an example Algorithm 3 for construction of a Pauli error with a given error syndrome. The construction is useful in connection to Algorithm 2 above, which makes use of error h with syndrome a.

[0100] Proposition 7. Given a generator matrix S in standard form for a stabilizer group, Algorithm 3 returns an error h with syndrome <7. Moreover, h satisfies | h\ < min(|cr|, |Z| ) where Z is the information set corresponding to S.

[0101] Proof. By construction, the error h is constructed in such a way that it anticommutes with row Sj of S iff — 1. This proves that the syndrome of h is a. Moreover, |/i| < |cr| because the error h constructed in the Algorithm is a product a |cr | weight-one operators. Also, |h| < |Z| because the support of h is included in Z.

[0102] Assume that an error h with syndrome <r and with weight is used in Algorithm 2. Then, the loop over all weight w = 1, . . . , M terminates in the worst case once it reaches w = Wh, because the breaking condition is triggered. Therefore, this loop requires at most (Z) syndrome computations.

[0103] To minimize the bound on the weight of h and the number of syndrome computations in Algorithm 2, it is possible to use a permutation of the columns like in Section 5.5. However, instead of generating an information set containing a maximum of rank-one columns, it is desirable to produce a minimum size information set. This is equivalent to maximizing the number of rank-two columns in the information set and this can be achieved by permuting the columns of S to place the rank-two columns before the rank-one columns. 5.7. Other possible improvements

[0104] Several improvements of Algorithm 2 are possible. First, when M is small compared to the code length n, many syndromes are not reached by errors with weight < M. In this case, instead of running over all possible syndromes, one loop over all syndromes of errors with weight w for w = 1, 2, . . . , M. Second, naively, generating a product of w generators G ₂ costs w — 1 multiplications of Pauli operators. This number can be reduced to a single multiplication of Pauli operators per iteration using a monotone Gray code [Ref. 12], [Ref. 13]. Third, to further reduce the number of syndrome computations used to build a lookup decoder, it is possible to leverage other ideas developed in the context of classical information set decoding such as the use of multiple information sets [Ref. 7] or the use of incomplete information sets [Ref. 14]. Fourth, one can use the code symmetry. This is especially useful in the case of cyclic codes [Ref. 4] or BOH codes [Ref. 15]. More generally, one could exploit the automorphism group of the stabilizer code to cut down the construction cost and the memory requirements. Fifth, the construction of the lookup decoder proposed in Algorithm 2 may be parallelized by splitting the work corresponding to different syndromes.

6. CSS codes and rotated CSS codes decoders

[0105] The CSS construction [Ref. 9], [Ref. 10] is one of the most popular constructions of quantum codes. A CSS code is a stabilizer code defined by stabilizer generators which are either X Pauli operators or Z Pauli operators. As a result the decoding problem can be decomposed into two independent problems: correction of X errors using the syndrome of Z stabilizer generators and correction of Z errors using the syndrome of X stabilizer generators.

[0106] In this section, CSS codes are reviewed. Introduced then is the class of rotated CSS codes which are CSS codes rotated by a product of local Clifford operations. Proposed next is a graphical characterization of rotated CSS codes; their decoding problem is then discussed. Finally, a way to reduce the cost of the construction of a decoder is explained for a stabilizer code containing a large rotated CSS subcode. It is shown, however, that finding a maximum rotated CSS subcode of a stabilizer code is NP-complete. 6.1. CSS decoder

[0107] In what follows, the subscript X is used to denote the objects associated with the X stabilizer generators. The set of X stabilizer generators is denoted S _x , the number of X stabilizer generators is denoted r _x , the syndrome of an error relative to the X stabilizer generators is a vector of Z^ denoted a _x . Similarly, the notation Sz is used for the set of Z stabilizer generators, r _x for the number of Z stabilizer generators and az for the corresponding syndrome. The whole stabilizer group of the CSS code is S = Sx U Sz, and the full syndrome is a = (a _x , oz)-

[0108] A standard strategy to correct Pauli errors with a CSS code is to correct separately its X part and its Z part. This leads to the following standard result.

[0109] Proposition 8. Let C'(S) be a CSS code with minimum distance d. Let D _x = LUD[<Sx, Pz, _n , M] and Dz = computed with Algorithm 1 and let D(cr) = Dx^x^Dziaz). If M > (d — l)/2 then the decoder D corrects all Pauli errors with weight up to (d — l)/2. Moreover, the construction of D requires syndrome computations.

[0110] Proof. Let E be a Pauli error with weight \E\ < (d — l)/2. E = E _X E _Z where E _x is a X error and E _z is a Z error and each of the components has weight at most |S|. The syndrome (y _x (E) depends only on the component E _z of E and Dx(px(E)) = Dx[ox(Ezy) is a Z error with syndrome a _x (E) = <r _x (Ez) such that IZ>X(<TX(EZ))I < l-E'zl- Therefore, the residual Z error has trivial syndrome and it has weight at most

\E _Z DX(CTX(E))\ < 2|^| < (d - 1) (19) which proves that it is a stabilizer. By swapping the role of X and Z, one can show with the same argument that the X residual error after correction E _x D _z (,<Jz(E)) is a stabilizer. This proves that the combined decoder D corrects E.

[0111] Like in the case of stabilizer codes, it is possible to speed-up the construction of the decoder using information sets. Using Algorithm 2, it is possible to build this decoder using at most syndrome computations. This is because the signature of a subgroup of Vx,n or ?z,n is of the form (si, 0). In the case of CSS codes, all the techniques developed for classical information set decoding [Ref. 4], [Ref. 15], [Ref. 7] can directly be imported to build the decoders D _x and D _Z -

[0112] The decoder obtained does not return a minimum weight correction. Instead, it minimizes the weight of the X component and the weight of the Z component of the correction. However, it still achieves the code distance, i.e., it corrects all errors with weight up to (d — l)/2. The main advantage of building a decoder by correcting separately X error and Z errors is that it reduces the complexity of the construction of the decoder.

6.2. Rotated CSS codes

[0113] A rotated CSS code is defined to be the image of a CSS code under a product of single-qubit Clifford operations. Equivalently, it is a stabilizer code with stabilizer generators gS.^ for i = 1, . . . ,r where the Si are the stabilizer generators of a CSS code and g is a product of single-qubit Clifford operations, g refers to the frame of the rotated CSS code.

[0114] The motivation to introduce rotated CSS codes is that one can build a satisfying lookup decoder for these codes with fewer syndrome computations than for general stabilizer codes like in the case of CSS codes. The first difficulty is to identify a rotated CSS code. Proposed herein is a graphical characterization of rotated CSS codes.

[0115] Two Pauli operators are said to be parallel if they coincide on the intersection of their support. Otherwise, it is said that these operators intersect. For example, (IX XI) and (XXIZ) are parallel whereas (YYXI) and (XXIZ) intersect. The intersection graph of a set <S — {Si, . . . , S _r } of Pauli operators, denoted G _n (S), is defined to be the graph with vertex set V = {1, 2, . . . , r} such that i and j are connected by an edge iff Si and Sj intersect.

[0116] FIG. 9A shows an intersection graph of the generators of a five-qubit code. FIG. 9B shows an intersection graph of the generators of a Steane code. The Steane code’s intersection graph is bipartite as proven in Proposition 9.

[0117] Proposition 9. A stabilizer code C(S) is a rotated CSS code iff the intersection graph G _n («S) is bipartite. [0118] Proof. Assume first that C(S) is a rotated CSS code. Let g be a Clifford rotation and let C'(S') be the CSS code such that g maps C(S') onto C(<S). The intersection graph of C'(5') is bipartite because two X operators or two Z operators do not intersect. Moreover, the intersection property is preserved by local Clifford operations, which proves that the intersection graphs G _n («S>) and G _n (<S') are equal. Therefore G _n (<S) is bipartite.

[0119] Assume now that G _n (<S) is bipartite. Then, each qubit is acted on by at most two non-trivial Pauli matrices in the set <S. Indeed, if there exists a qubit q and three operators Si, Sj, Sk of S acting on q as X, Y and Z respectively, then the intersection graph contains the triangle {i,j, k} which contradict the assumption that G _n (<S) is bipartite.

[0120] Let V = be the partition of the vertices of G _n (5). Define 5® = {Si G

S |« = {Si G <S|z G 0 ¹ )} Let q be one of the n qubits. By definition of the intersection graph, all the operators of acts on qubit q as either I or A _q where Ag is a Pauli matrix X. Y or Z. Similarly, the operators of acts on qubit q as either I or Bg where B _q where Pauli matrix X, Y or Z such that B _q A _q . By transitivity of the action of the Clifford group onto the Pauli group there exists a single-qubit Clifford operation g _q that maps A _q onto X and B _q onto Z. The product of these single-qubit Clifford operations g _q for all the qubits q maps the stabilizer code C(S) onto a CSS code, proving that this code is a rotated CSS code.

6.3. Rotated decoder

[0121] FIG. 10 shows aspects of an example Algorithm 4 for finding the frame of a rotated CSS code. The bipartite structure of the intersection graph is used in Algorithm 4 to split Pauli errors into two components, generalizing the X/Z decomposition used for CSS codes.

[0122] Proposition 10. Let C(S) be a rotated CSS code with minimum distance d > 1. If g is the operation returned by Algorithm 4, then g(C'(<S)) is a CSS code.

[0123] Proof. It suffices to see that the operation g computed by Algorithm 4 is the transformation that maps CAS] onto a CSS code in the proof of Proposition 9. The two-coloration constructed in step 2 is guaranteed to exist by Proposition 9. Moreover, because d > 1, the matrix A® and A^ are two distinct non-trivial Pauli matrices . [0124] This result extends the CSS decoder of Proposition 8 to rotated CSS codes. Given g, it is possible to compute a CSS decoder D for the code gC'(S) as in Proposition 8 and a decoder for the rotated CSS code C(S) = gDta^g ^-1 was obtained. The number of syndrome computations required to build this decoder is the same as for CSS code.

6-4- Decoder based on a large rotated CSS subcode

[0125] The structure of CSS codes and rotated CSS codes can be exploited to build a lookup decoder faster than for general stabilizer codes. It is reasonable to expect that it is possible also speed-up the construction of a lookup decoder for stabilizer codes that are almost CSS in the sense that their stabilizer group contains a large rotated CSS subgroup. Described in this section is a decoder for a stabilizer code that contains a small number of non-CSS stabilizer generators. The same strategy immediately generalizes to the case of a stabilizer code containing a large rotated CSS subcode, but this is described for CSS subcode in order to keep the notation simple.

[0126] Consider a stabilizer code defined by rx stabilizer generators in Px.n, ^r z stabilizer generators in P _z ,n and r* stabilizer generators which are arbitrary operators in P _n - The set of stabilizer generators is partitioned as 5 = <SxU«SxU5* where the subscript X, Z, * indicate the type of the generators.

[0127] Denote by ox G ZJ* the component of the syndrome associated with the X stabilizer generators. The syndrome components <r _z are defined similarly. One cannot split the syndrome into a syndrome that corresponds to X errors and a syndrome that corresponds to Z errors because the two types of errors contribute to cr*. A correction is obtained by considering all possible values for the contribution of the X part and the Z part of the error to c, .

[0128] To build a decoder for a stabilizer code with stabilizer generators 5 = SxUSxUS*, Dx = LUD[<Sx U<S«, Pz,n, Af] and D _z = LUD^ U&jj Px.n, Af] are constructed. Then, _D(<T) is defined to be a minimum weight error of the form DX(<TX, ax,*)Dx{a _z , cz,*) satisfy ox,* + az,* = «*.

[0129] As in the case of CSS code, it is possible to build this decoder using the classical information set decoding techniques. Once the two components D _x and D _z of the decoder are constructed, to find a correction for a given syndrome, one may loop over the 2 ^r * possible pairs a _x ,*, <r _z ,* € Ef that sum to cr* to find a minimum weight correction. This leads to an efficient decoder only if r* is small.

6.5. NP-completeness of the maximum rotated CSS subcode problem

[0130] The maximum rotated CSS subcode problem is now considered: Given a set of stabilizer generators <S = {Si, . . . , S _r } for a stabilizer code, return a maximum subset of S that generates a rotated CSS code.

[0131] Proposition 11. The maximum rotated CSS subcode problem is NP-hard and the corresponding decision problem is NP-complete.

[0132] Proof. To prove that the problem is NP-hard, a reduction of the following maximum bipartite subgraph problem is used: given a graph G, return a maximum bipartite subgraph of G. That problem is NP-complete because it is a node deletion problem for a hereditary property [Ref. 16].

[0133] Let G be a graph with r vertices. The basic idea to reduce the maximum bipartite subgraph to the maximum CSS subcode problem is to construct a stabilizer code G(<S) whose intersection is G and whose size is polynomial in the size of G. Then, by Proposition 9, finding a maximum bipartite subgraph of G is equivalent to finding a maximum rotated CSS subcode of C(<S).

[0134] The stabilizer group <S associated with G is defined as follows. Associate two qubits denoted q _e and q _e ' with each edge e of the graph G. To construct the stabilizer generators Si, . . . , S _r of S, initialize them to the identity and apply the following procedure. Denote by S'j(g) the component of Si on qubit q. Loop over all the edges e and if e connects vertices i and j with i < j, set Si^qf) = S^qf') = X and Sj(q _e ) = Sj^qf') = Z. [0135] The resulting family generates a stabilizer group acting on O(|V| ² ) qubits and its intersection graph is the input graph G. Based on Proposition 9, this proves that the maximum rotated CSS subcode is NP-hard. The decision problem is clearly in NP which concludes the proof.

[0136] If the rotation g that maps the rotated CSS subcode onto a CSS code is known, then the problem becomes simpler. This is because the problem of finding a maximum CSS subgroup of a stabilizer group can be solved in polynomial time. 7. References, classical computer system, and additional description

[0137] For additional context, the interested reader is referred to the following references.

[Ref. 1] Yu Tomita and Krysta M. Svore. Low-distance surface codes under realistic quantum noise. Physical Review A, 90(6):062320, 2014.

[Ref. 2] Poulami Das, Aditya Locharia, and Cody Jones. LILLIPUT: A Lightweight low-latency lookup-table based decoder for near-term quantum error correction. arXiv preprint, arXiv:2108.06569, 2021.

[Ref. 3] Nicolas Delfosse. Hierarchical decoding to reduce hardware requirements for quantum computing. arXiv preprint, arXiv:2001.11427, 2020

[Ref. 4] Eugene Prange. The use of information sets in decoding cyclic codes. IRE Transactions on Information Theory, 8(5) :5 -9, 1962.

[Ref. 5] Robert J. McEliece. A public-key cryptosystem based on algebraic. Coding Thv, 4244:114-116, 1978

[Ref. 6] Raphael Overbeck and Nicolas Sendrier. Code-based cryptography. In Post-quantum cryptography, 95-145, Springer, 2009.

[Ref. 7] Markus Grassl. Searching for linear codes with large minimum distance. In Discovering mathematics with magma, 287-313, Springer, 2006.

[Ref. 8] Ghazal Kachigar and Jean-Pierre Tillich. Quantum information set decoding algorithms. In International Workshop on Post- Quantum Cryptography, 69-89, Springer, 2017.

[Ref. 9] A. Robert Calderbank and Peter W. Shor. Good quantum error-correcting codes exist. Physical Review A, 54(2):1098, 1996.

[Ref. 10] Andrew Steane. Multiple-particle interference and quantum error correction. Proceedings of the Royal Society of London. Series A: Mathematical, Physical and Engineering Sciences, 452(1954) :2551— 2577, 1996.

[Ref. 11] Daniel Gottesman. Stabilizer codes and quantum error correction. California Institute of Technology, 1997.

[Ref. 12] Carla D. Savage and Peter Winkler. Monotone Gray codes and the middle levels problem. Journal of Combinatorial Theory, Series A, 70(2):230-248, 1995. [Ref. 13] Torsten Miitze. Combinatorial Gray codes — an updated survey. arXiv preprint, arXiv:2202.01280, 2022.

[Ref. 14] Stefka Bouyuklieva and Iliya Bouyukliev. An Extension of the Brouwer- Zimmermann Algorithm for Calculating the Minimum Weight of a Linear Code. Mathematics, 9(19):2354, 2021.

[Ref. 15] Anne Canteaut and Florent Chabaud. A new algorithm for finding minimum-weight words in a linear code: Application to McEliece’s cryptosystem and to narrow-sense BCH codes of length 511. IEEE Transactions on Information Theory, 44(l):367-378, 1998.

[Ref. 16] John M. Lewis and Mihalis Yannakakis. The node-deletion problem for hereditary properties is NP-complete. Journal of Computer and System Sciences, 20(2) :219 -230, 1980.

[0138] The methods herein may be tied to a computer system of one or more computing devices. Such methods and processes may be implemented as an application program or service, an application programming interface (API), a library, and/or other computerprogram product.

[0139] FIG. 11 provides a schematic representation of a classical computer 102 configured to provide some or all of the classical computer system functionality disclosed herein. Classical computer 102 may take the form of a personal computer, application-server computer, or any other computing device.

[0140] Classical computer 102 includes a logic system 104 and a computer-memory system 106. Classical computer 102 may optionally include a display system 108, an input system 110, a network system 112, and/or other systems not shown in the drawings.

[0141] Logic system 104 includes one or more physical devices configured to execute instructions. For example, the logic system may be configured to execute instructions that are part of at least one operating system (OS), application, service, and/or other program construct. The logic system may include at least one hardware processor (e.g., microprocessor, central processor, central processing unit (CPU) and/or graphics processing unit (GPU)) configured to execute software instructions. Additionally or alternatively, the logic system may include at least one hardware or firmware device configured to execute hardware or firmware instructions. A processor of the logic system may be single-core or multi-core, and the instructions executed thereon may be configured for sequential, parallel, and/or distributed processing. Individual components of the logic system optionally may be distributed among two or more separate devices, which may be remotely located and/or configured for coordinated processing. Aspects of the logic system may be virtualized and executed by remotely-accessible, networked computing devices configured in a cloud-computing configuration.

[0142] Computer-memory system 106 includes at least one physical device configured to temporarily and/or permanently hold computer system information, such as data and instructions executable by logic system 104. When the computer-memory system includes two or more devices, the devices may be collocated or remotely located. Computer-memory system 106 may include at least one volatile, nonvolatile, dynamic, static, read/write, read-only, random-access, sequential-access, location-addressable, file- addressable, and/or content-addressable computer-memory device. Computer-memory system 106 may include at least one removable and/or built-in computer-memory device. When the logic system executes instructions, the state of computer-memory system 106 may be transformed — e.g., to hold different data.

[0143] Aspects of logic system 104 and computer-memory system 106 may be integrated together into one or more hardware-logic components. Any such hardware-logic component may include at least one program- or application-specific integrated circuit (PASIC / ASIC), program- or application-specific standard product (PSSP / ASSP), system-on-a-chip (SOC), or complex programmable logic device (CPLD), for example.

[0144] Logic system 104 and computer-memory system 106 may cooperate to instantiate one or more logic machines or engines. As used herein, the terms ‘machine’ and ‘engine’ each refer collectively to a combination of cooperating hardware, firmware, software, instructions, and/or any other components that provide computer system functionality. In other words, machines and engines are never abstract ideas and always have a tangible form. A machine or engine may be instantiated by a single computing device, or a machine or engine may include two or more subcomponents instantiated by two or more different computing devices. In some implementations, a machine or engine includes a local component (e.g., a software application executed by a computer system processor) cooperating with a remote component (e.g., a cloud computing service provided by a network of one or more server computer systems). The software and/or other instructions that give a particular machine or engine its functionality may optionally be saved as one or more unexecuted modules on one or more computer-memory devices. [0145] Machines and engines may be implemented using any suitable combination of machine learning (ML) and artificial intelligence (Al) techniques. Non-limiting examples of techniques that may be incorporated in an implementation of one or more machines include support vector machines, multi-layer neural networks, convolutional neural networks (e.g., spatial convolutional networks for processing images and/or video, and/or any other suitable convolutional neural network configured to convolve and pool features across one or more temporal and/or spatial dimensions), recurrent neural networks (e.g., long short-term memory networks), associative memories {e.g., lookup tables, hash tables, bloom filters, neural Turing machines and/or neural random-access memory) unsupervised spatial and/or clustering methods (e.g., nearest neighbor algorithms, topological data analysis, and/or k-means clustering), and/or graphical models (e.y., (hidden) Markov models, Markov random fields, (hidden) conditional random fields, and/or Al knowledge bases)).

[0146] When included, display system 108 may be used to present a visual representation of data held by computer-memory system 106. The visual representation may take the form of a graphical user interface (GUI) in some examples. The display system may include one or more display devices utilizing virtually any type of technology. In some implementations, display system may include one or more virtual-, augmented-, or mixed reality displays.

[0147] When included, input system 110 may comprise or interface with one or more input devices. An input device may include a sensor device or a user input device. Examples of user input devices include a keyboard, mouse, or touch screen.

[0148] When included, network system 112 may be configured to communicatively couple classical computer 102 with one or more other computer systems. The network system may include wired and/or wireless communication devices compatible with one or more different communication protocols. The network system may be configured for communication via personal-, local- and/or wide-area networks.

[0149] In conclusion, one aspect of this disclosure is directed to a method to build a lookup decoder for mapping error syndromes based on quantum-stabilizer code to corresponding error corrections, the quantum-stabilizer code executing on a quantum computer. The method comprises: enumerating a subset of error syndromes up to a maximum error weight based on the quantum-stabilizer code; iterating through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset, the error state defining error in a qubit register of the quantum computer; and for each error syndrome of the subset of error syndromes, storing in classical computer memory an error correction based on the error state of highest probability and mapped to that error syndrome. Enumerating error syndromes at the outset instead of computing them based on error states provides the technical benefit of faster construction of the lookup decoder table. Enumerating error syndromes up to a maximum error weight provides the additional technical benefit of avoiding wasted processor time on unlikely error states, for faster construction of the lookup decoder table. Storing error correction provides the additional technical benefit of improved reliability of quantum computer — greater accuracy of quantum computation. [0150] In some implementations the error state includes at least one classical bit string with each bit corresponding to a different qubit of the qubit register. In some implementations the at least one classical bit string includes a classical bit string of A -type quantum errors and a classical bit string of Z-type quantum errors. In some implementations the error correction mapped to a given error syndrome reverses the error state of highest probability computed for that error syndrome. This provides the additional technical benefit of end-to-end quantum error correction. In some implementations enumerating the subset of error syndromes includes omitting another subset of error syndromes within a parent set of error syndromes based on the quantum-stabilizer code. This provides an additional technical benefit of reducing the total number of error syndromes enumerated, for greater efficiency of construction of the lookup table and reduced comsumption of runtime resources. In some implementations the lookup decoder comprises a hash map. In some implementations iterating through the subset of error syndromes comprises stepping through a weight-increasing encoding map and generating a complete set of Pauli errors up to a predetermined weight for each error syndrome. In some implementations iterating through the subset of error syndromes comprises iterating through a set of products of pivot operators g — G?' ¹ . . . G" ^r with weight w. In some implementations the pivot operators are selected based on an information set with a minimum number of rank-one elements. This feature provides an additional technical benefit of leveraging linear-algebraic techniques to improve processing efficiency. In some implementations iterating through the subset of error syndromes comprises, when the maximum weight M is small relative to code length n, iterating in order of increasing weight of the error states of each syndrome. In some implementations the classical computer memory is coupled to plural processing cores, and the iterating and storing for different error syndromes is enacted in parallel via the plural processing cores. This feature provides an additional technical benefit of leveraging state-of-the-art computer architecture to increase the efficiency of lookup-decoder construction. In some implementations the quantum-stabilizer code is a Calderbank- Shor-Steane (CSS) code. In some implementations the quantum-stabilizer code is a rotated Calderbank-Shor-Steane (CSS) code.

[0151] Another aspect of this disclosure is directed to a computer system coupled operatively to a quantum computer. The computer system comprises a processor and, operatively coupled to the processor, computer memory holding instructions that cause the processor to build a lookup decoder for mapping error syndromes based on quantumstabilizer code to corresponding error corrections. The quantum-stabilizer code executes on the quantum computer, and the instructions comprise: instructions (A) for enumerating a subset of error syndromes up to a maximum weight based on the quantumstabilizer code; instructions (B) for iterating through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset, the error state defining error in a qubit register of the quantum computer; and instructions (C) for storing in the computer memory, for each error syndrome of the subset of error syndromes, an error correction based on the error state of highest probability and mapped to that error syndrome, wherein the error correction mapped to a given error syndrome reverses the error state of highest probability computed for that error syndrome. Enumerating error syndromes at the outset instead of computing them based on error states provides the technical benefit of faster construction of the lookup decoder table. Enumerating error syndromes up to a maximum error weight provides the additional technical benefit of avoiding wasted processor time on unlikely error states, for faster construction of the lookup decoder table. Storing error correction provides the additional technical benefit of improved reliability of quantum computer — greater accuracy of quantum computation.

[0152] In some implementations iterating through the subset of error syndromes comprises stepping through a weight-increasing encoding map and generating a complete set of Pauli errors up to a predetermined weight for each error syndrome. In some implementations iterating through the subset of error syndromes comprises iterating through a set of products of pivot operators g — G" ¹ . . . G°' with weight w. In some implementations the pivot operators are selected based on an information set with a minimum number of rank-one elements. This feature provides an additional technical benefit of leveraging linear-algebraic techniques to improve processing efficiency. In some implementations iterating through the subset of error syndromes comprises, when the maximum weight M is small relative to code length n, iterating in order of increasing weight of the error states of each syndrome. In some implementations the quantum-stabilizer code is a Calderbank-Shor-Steane (CSS) code or a rotated CSS code. In some implementations the lookup decoder is a pre-decoder arranged operationally upstream of another decoder.

[0153] Another aspect of this disclosure is directed to a computer system coupled operatively to a quantum computer, the computer system comprises a processor and, operatively coupled to the processor, computer memory holding instructions that cause the processor to build a lookup decoder for mapping error syndromes based on quantumstabilizer code to corresponding error corrections. The quantum-stabilizer code executes on the quantum computer, and the instructions comprise: instructions (A) for enumerating a subset of error syndromes of highest probability based on the quantum-stabilizer code, instructions (B) for iterating through the subset of error syndromes to compute an error state of highest probability for each error syndrome of the subset, the error state defining error in a qubit register of the quantum computer, instructions (C) for storing in the computer memory, for each error syndrome of the subset of error syndromes, an error correction based on the error state of highest probability and mapped to that error syndrome, instructions (D) to recognize a runtime error syndrome generated via operation of the quantum computer, instructions (E) to retrieve the error correction stored for the runtime error syndrome, and instructions (F) to adjust operation of the quantum computer based on the error correction retrieved. Enumerating error syndromes at the outset instead of computing them based on error states provides the technical benefit of faster construction of the lookup decoder table. Enumerating error syndromes up to a maximum error weight provides the additional technical benefit of avoiding wasted processor time on unlikely error states, for faster construction of the lookup decoder table. Storing error correction provides the additional technical benefit of improved reliability of quantum computer — greater accuracy of quantum computation.

[0154] This disclosure is presented by way of example and with reference to the at- tached drawing figures. Components, process steps, and other elements that may be substantially the same in one or more of the figures are identified coordinately and described with minimal repetition. It will be noted, however, that elements identified coordinately may also differ to some degree. It will be further noted that the figures are schematic and generally not drawn to scale. Rather, the various drawing scales, aspect ratios, and numbers of components shown in the figures may be purposely distorted to make certain features or relationships easier to see.

[0155] It will be understood that the configurations and/or approaches described herein are exemplary in nature, and that these specific embodiments or examples are not to be considered in a limiting sense, because numerous variations are possible. The specific routines or methods described herein may represent one or more of any number of processing strategies. As such, various acts illustrated and/or described may be performed in the sequence illustrated and/or described, in other sequences, in parallel, or omitted. Likewise, the order of the above-described processes may be changed.

[0156] The subject matter of the present disclosure includes all novel and non-obvious combinations and sub-combinations of the various processes, systems and configurations, and other features, functions, acts, and/or properties disclosed herein, as well as any and all equivalents thereof.