{"id":"78b950f8-ade9-4025-8634-85fde5b2d4b6","arxiv_id":"2504.15410","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"The paper presents a delegated variational quantum algorithm protocol in which a client verifiably and blindly delegates each gradient computation and the full optimization to a quantum server.","lead":"This paper proposes a protocol that lets a weak quantum client delegate a variational quantum algorithm to a powerful quantum server while keeping the input, output, and computation secret, and while detecting a cheating server with exponentially high probability. It is a step toward practical, verifiable quantum cloud computing because earlier delegated VQA proposals only verified single optimization steps, not the whole run.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma III.1's assumed gradient-norm lower bound ε0 cannot hold as the optimization approaches f*, so the step-level relative-error guarantee and Theorem III.3's verifiability claim are not established.","rationale":"The reader's weakest_assumption identifies exactly the load-bearing step: Lemma III.1's use of an assumed lower bound ε0 on the gradient norm. My stress-test sharpens this from 'unexamined' to 'cannot hold in the convergence regime.' Since Protocol 2 is designed to converge to f*, and strong convexity implies the gradient vanishes at the optimum, there is no positive ε0 that is valid at every accepted step unless the protocol aborts before reaching the optimum, which would defeat the purpose. The step-level verification then guarantees only a conditional bound: if ||g|| ≥ ε0, a bounded number of corrupted rounds gives bounded relative error; but when ||g|| < ε0, the same number of corrupted rounds can produce an arbitrarily large relative error while evading trap detection. Because the optimization's final steps are precisely the regime where this failure occurs, Theorem III.3's conclusion that a non-aborting run yields f* is not supported. The concern is concrete and testable with the quadratic example above. I do not move the verdict because the issue is addressable, for example by switching to absolute-error verification near the optimum or by making the convergence criterion explicitly depend on a known tolerance and aborting when the gradient estimate falls below a threshold. As written, however, the paper's central claim requires this missing condition, so the CONDITIONAL verdict remains appropriate.","tokens_in":11327,"tokens_out":14957,"duration_ms":142432,"concrete_test":"Implement Protocol 2 for a single-parameter quadratic f(θ) = θ² with N_s = 1000, e_th = 0.1, ε0 = 0.01, and Σ|c_i| = 1. At an iteration where θ_k = 0.0025 (so ||∇f|| = 0.005 < ε0), corrupt exactly δ_max = e_th ε0 N_s / Σ|c_i| computation rounds and no test rounds. Record whether Protocol 1 accepts, the true relative error, and the final f after N_iter steps. If the protocol does not abort and the final energy deviates from f* = 0 by more than the target tolerance, the ε0 assumption is load-bearing and the central verifiability claim fails in this regime.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Lemma III.1 replaces the unobservable denominator ||g(θ)|| with an assumed lower bound ε0 and concludes e ≤ (Σ|c_i|)/(N_s ε0) δ. Protocol 2 never states how the client obtains ε0, and Theorem III.3's hypotheses (Eq. 4) do not include it. For a μ-strongly convex cost, convergence to f* forces ||∇f(θ_k)|| → 0, so any fixed ε0 > 0 is violated in the final iterations. At such a step, an adversary can corrupt δ = δ_max = e_th ε0 N_s / Σ|c_i| computation rounds while leaving test rounds untouched; the protocol accepts because no trap fails, even though the true relative error is at least (ε0 / ||g||) · e_th, which can be arbitrarily large. The rerun mechanism only reacts to aborted steps, so this corrupted update is applied and can move θ away from the optimum. Hence a non-aborting execution can terminate far from f*, contradicting the end-to-end guarantee. The sentence 'we can assume a lower bound ε0' is therefore a load-bearing gap, not a harmless normalization.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework for delegated variational quantum algorithms (DVQAs) in the measurement-based quantum computing model. Protocol 1 delegates and verifies a single gradient-descent step computed via the parameter-shift rule, using interleaved computation and test rounds adapted from Leichtle et al. Protocol 2 composes these verified steps into a full optimization with re-runs of attacked steps and claims end-to-end verifiability: if the protocol does not abort, the client obtains the correct optimal value f* of the cost function. The central formal statements are Lemma III.1 (a bound relating the gradient relative error to the number of corrupted computation rounds), Theorem III.2 (exponentially small probability of accepting a highly corrupted step), and Theorem III.3 (end-to-end verifiability under strongly convex, Lipschitz-gradient assumptions). The paper also reports numerical simulations for the Transverse Field Ising Model using the Qrisp and Veriphix frameworks.","tokens_in":11500,"tokens_out":8654,"duration_ms":82035,"significance":"If the central claims were fully established, the paper would make a valuable contribution to delegated quantum computation and to practical verifiable quantum cloud services. The step-level trapification idea, the composition into an end-to-end protocol, and the public numerical demonstrations are promising and clearly relevant to the journal's readership. The paper builds on established primitives (blind MBQC, trapification) rather than on its own previous results, which is a strength. However, as argued below, the verification bound depends on an unstated and generally false uniform gradient-norm lower bound, the proof of Theorem III.2 contains a conditioning error that invalidates the claimed exponential decay, and the convergence result in the appendix only establishes convergence to a neighborhood of f* rather than exact recovery of f*. These issues are load-bearing for the paper's main claim, so the manuscript needs substantial revision.","major_comments":[{"comment":"Lemma III.1 derives e ≤ (Σ|c_i|)/(ε0 N_s) δ only after assuming a lower bound ε0 on ||g(θ)||. For a μ-strongly convex cost function, Lemma VI.2 gives ||∇f(θ)||^2 ≥ 2μ(f(θ)-f*), so along a successful optimization the gradient norm tends to zero and any fixed ε0 > 0 is violated in the final iterations. The parameter ε0 does not appear in Protocol 2's input list nor in the hypotheses (4) of Theorem III.3, and no client-side procedure is given for choosing or checking ε0. Consequently, at a step with ||g(θ_k)|| < ε0, an adversary can corrupt δ = δ_max computation rounds without triggering any trap failure, while the true relative error is amplified by the factor ε0/||g(θ_k)|| and can exceed e_th by an arbitrarily large amount. Because the rerun mechanism in Protocol 2 reacts only to aborted steps, such a corrupted update is accepted and can move the parameters away from the optimum, so the end-to-end guarantee of Theorem III.3 is not established.","section":"Lemma III.1 and Theorem III.3"},{"comment":"In the proof of Theorem III.2, the chain beginning with Pr(X_t < 1) ≤ Pr(X′ ≤ mt/n) + Pr(X_t = 0 | X′ > mt/n) is not exponentially small as written: for X′ ≈ Binomial(m, t/n), the probability Pr(X′ ≤ E[X′]) is typically bounded below by a constant (about 1/2), not by an exponentially decaying quantity. The displayed Hoeffding bound exp(-2ε1²τ²n²/m) can only apply to an event of the form X′ ≤ mt/n - ε1 (or a similar deviation from the mean), which is not what appears in the preceding line. In addition, the case-A statement that m > nw 'leads to Pr[X_d ≥ δ_max] = 1' confuses the expectation of a binomial with the probability of a tail event; the expectation exceeding the threshold does not make the event certain. The case-B expression also multiplies Pr(X_d ≥ δ_max) and Pr(X_t < 1) as if they were independent, although X_d and X′ are coupled as complementary splits of the m attacked rounds. The claimed exponential decay of the step-failure probability is therefore not proven as it stands.","section":"Theorem III.2"},{"comment":"The convergence analysis in Appendix VI B establishes E[f(θ_{k+1})] - f* ≤ γ(E[f(θ_k)] - f*) + B with B = α²L(1+e)²σ_g²/2, and the final error is only bounded by B/(1-γ), as stated in Eq. (11). Strict convergence to f* is obtained only in the limit σ_g² → 0, i.e., in the absence of shot noise. Since shot noise is inherent to the sampling-based parameter-shift evaluations used in Protocol 1, the abstract's claim that the client can be certain the computation outcome is the correct optimal value f*, and the analogous wording in Theorem III.3, are stronger than what the proof supports. Protocol 2's abort condition 'if the optimization hasn't converged' is not formalized in terms of the neighborhood B/(1-γ), and no verifiable stopping criterion is provided. The theorem and the protocol need to be reworked to state a concrete final-error guarantee, or the end-to-end claim must be weakened accordingly.","section":"Theorem III.3 and Appendix VI B"}],"minor_comments":[{"comment":"The notation Pr(fail) = Pr[X_d ≥ δ_max] ∧ Pr[X_t < 1] is informal; the intersection of events should be written explicitly, e.g., Pr(X_d ≥ δ_max and X_t < 1), to avoid ambiguity.","section":"Eq. (3)"},{"comment":"The parameter c appears in the Binomial detection probability and in the exponential expressions but is not defined in the proof; the reader must infer that it is the number of colors of the c-coloring used for the trapification scheme.","section":"Theorem III.2"},{"comment":"The acronym 'NTD' is not defined, and the phrase 'the number of test roundst' is ambiguous; please clarify that t is the fixed number of test rounds and NTD is the number of detected trap failures.","section":"Fig. 2 caption"},{"comment":"The concluding remark that the relative error threshold could in future be varied 'depending on the current gradient value' is precisely the dependence that would address the ε0 issue raised in Lemma III.1; the manuscript should at least state whether the present protocol permits such adaptation or whether ε0 is intended to be fixed for all steps.","section":"Conclusion"}],"recommendation":"major_revision","confidential_remarks":"The paper's main theorem is not currently supported: the ε0 assumption in Lemma III.1 is unverifiable and fails near the optimum for strongly convex objectives, and the proof of Theorem III.2 contains a conditioning error that invalidates the exponential bound. These are fixable in principle by adding explicit assumptions, a verifiable stopping rule, and a corrected probabilistic argument, but the required changes are substantial rather than editorial. The numerical simulations are a useful complement but do not exercise the trap-detection mechanics of Theorem III.2."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"End-to-end verifiability is a real step forward, but the main theorem leans on an assumption the protocol can't enforce: a fixed lower bound ε0 on the gradient norm at every iteration. Near a strongly convex optimum, the gradient norm goes to zero, so Lemma III.1's relative-error bound stops meaning anything exactly when the client needs it most. That's a load-bearing gap, not a normalization issue.\n\nThe new thing here is genuinely new: prior delegated VQA work verified single shots or single iterations, while Protocol 2 tries to verify the whole optimization with a rerun-tolerant gradient descent that reacts to aborted steps. The design is sensible, the dependence on known primitives (blind MBQC, trapification) is honest, and the TFIM simulations support the optimizer concept. Credit where it's due.\n\nThe soft spots, in proportion: the ε0 issue is the serious one. Protocol 2 never says where ε0 comes from or how the client checks it, and Theorem III.3 doesn't list it among the hypotheses. Since f is μ-strongly convex, ||∇f(θ_k)||→0 along any convergent run, so a fixed ε0>0 is eventually violated. At that point an adversary can corrupt the maximum allowed rounds, no trap fires, and the step is accepted with a relative error much larger than e_th. The rerun mechanism only helps when a step aborts, so a non-aborting execution can end far from f*. Theorem III.3's claim, as stated, isn't established.\n\nTheorem III.2's proof is also hard to verify as written; the conditioning on X'≤mt/n looks suspect, and the failure-probability bound doesn't cleanly separate regimes. That's a presentation problem that may be fixable. The strong-convexity assumption is restrictive but explicit, so it's a scope limitation rather than a flaw. Missing code and error bars in the simulations are minor.\n\nThis paper is for people working on delegated quantum computation and quantum verification. I'd send it to a serious referee: the core idea is salvageable, and the subfield would benefit from a version that either proves a verifiable gradient bound without ε0 or reframes the guarantee honestly, e.g., as conditional on a known gradient lower bound.","headline":"Promising end-to-end delegated VQA protocol, but the central verifiability theorem rests on an unexamined gradient-norm lower bound that fails near the optimum.","tokens_in":12061,"tokens_out":2395,"would_cite":false,"duration_ms":21695,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a delegated variational quantum algorithm can be verified end to end: if the protocol does not abort, the client is certain the returned optimal value is correct, with failure probability exponentially small in the…","keywords":["delegated quantum computing","blind quantum computing","verifiable quantum computation","variational quantum algorithms","measurement-based quantum computing","gradient descent","trapification","parameter-shift rule"],"falsifier":"Run Protocol 2 on a two-parameter $\\mu$-strongly convex quadratic with $L$-Lipschitz gradient, set $\\epsilon_0$ larger than the gradient norm at an iterate close to the optimum, and have an adversary corrupt more than $\\delta_{\\max}$ computation rounds at that single step; if the protocol accepts and returns a cost observably above $f^*$, the exponential-soundness claim of Theorem III.3 is refuted.","tokens_in":11064,"feed_emoji":"⚛️","tokens_out":10359,"duration_ms":85888,"temperature":0.7,"pith_summary":"The paper tries to establish that a client with limited quantum hardware can delegate the whole run of a variational quantum algorithm (VQA) to a more powerful quantum server and still certify the final answer. It does this at two levels: Protocol 1 verifies a single gradient-estimation step by interleaving computation rounds with test rounds full of traps, and Protocol 2 embeds that step in a gradient-descent loop that reruns any attacked iteration. The main result, Theorem III.3, states that for a $\\mu$-strongly convex cost function with an $L$-Lipschitz gradient, a non-aborting run returns the true optimum $f^*$, and the probability of accepting a wrong result decays exponentially in the number of rounds. This matters because practical near-term users of quantum cloud services will often need to delegate computation to stronger servers, and blindness alone does not guarantee that the whole optimization reached the right value.","feed_headline":"Delegated quantum optimization is now verifiable end to end","feed_subtitle":"A non-aborting run returns the true optimum, and attacks are caught exponentially often.","key_machinery":"The load-bearing mechanism is the trapification scheme of [13], adapted from verifying BQP computations to verifying expectation values: in each round the client sends either a computation round realizing one of the $2N_PN_s$ cost-function evaluations, or an indistinguishable test round made of traps and dummy qubits, so that any attack on computation rounds has a high probability of showing up in a test round. The identity that carries the argument is Lemma III.1, $e \\le (\\sum_i |c_i|)/(N_s\\epsilon_0)\\,\\delta$, which converts a count of corrupted computation rounds $\\delta$ into a bound on the relative error of the gradient estimate. For the full optimization, the decisive object is the gradient-descent contraction inequality of Appendix VI B, which shows $E[f_{k+1}] - f^* \\le \\gamma (E[f_k] - f^*)$ with $\\gamma<1$ exactly when the conditions in (4) hold; that contraction is what ties per-step verification to a final, end-to-end guarantee.","core_discovery":"The central discovery is that end-to-end verifiability for a delegated VQA can be reduced to a per-step relative-error certificate plus a convergence condition. Protocol 1 computes gradient estimates through the parameter-shift rule, executing $d = 2N_P N_s$ computation rounds and $t$ test rounds; because the server cannot distinguish the two, any attack that corrupts more than $\\delta_{\\max}$ computation rounds is detected with probability exponentially close to one, and Lemma III.1 turns a known lower bound $\\epsilon_0$ on the gradient norm into the error bound $e \\le (\\sum_i |c_i|)/(N_s \\epsilon_0)\\,\\delta$. Protocol 2 then runs gradient descent and re-executes rejected steps. The authors prove that whenever the learning rate and error threshold satisfy $\\mu\\alpha(1+e_{\\mathrm{th}})[2-\\alpha L(1+e_{\\mathrm{th}})]<1$ and $\\alpha L < 2/(1+e_{\\mathrm{th}})$, the expected distance to $f^*$ contracts geometrically, so the protocol either delivers $f^*$ or aborts. In the paper's formulation, the client can be certain a non-aborting computation outcome is correct.","pith_inferences":["Inference: the fixed threshold $\\epsilon_0$ could be made adaptive per step: a client who monitors the gradient estimates could spend more trap rounds at flat or near-optimal steps and fewer when gradients are large, reducing total delegation overhead.","Inference: a direct consequence of the proof structure is that the weakest point is the assumed lower bound $\\epsilon_0$; if a step's true gradient falls below it, a server could corrupt that step with impunity, and the final guarantee would then depend on the optimizer's stability rather than on verification.","Inference: the same relative-error bound applies to any expectation-value-based gradient computed by the parameter-shift rule, so the protocol's step-level verification generalizes beyond VQE ground-state search to delegated quantum machine learning and other variational tasks.","Inference: the simulation's attack model is an illustration, not a constraint; a stronger test would apply angle-shift attacks to individual measurement rounds and check whether trap detections still match the predicted exponential failure bound."],"forward_implications":["A run of Protocol 2 that does not abort certifies the final output itself, not just the last gradient: the client obtains the optimal value $f^*$ of the cost function.","The probability of accepting a corrupted computation undetected falls exponentially with the total number of rounds $n$, so the client can reach any desired confidence by increasing $t$ and $n$.","Attacked steps do not abort the whole optimization; Protocol 2 rejects and reruns only the failed step, so the overhead tracks the number of attacks rather than the number of iterations.","As the error threshold $e_{\\mathrm{th}}$ goes to zero, the convergence conditions reduce to the standard gradient-descent conditions, so the protocol degrades gracefully to the usual linear convergence of strongly convex optimization.","Because the step-level verification is independent of the optimizer, the protocol can be paired with other classical optimizers, at the cost of supplying an optimizer-specific convergence theorem."],"supporting_citations":[{"why":"Supplies the computation/test-round interleaving and c-coloring trapification scheme whose failure statistics Theorem III.2 adapts to gradient verification.","marker":"[13]"},{"why":"Establishes blindness of the delegated MBQC computation, which makes trap rounds indistinguishable from computation rounds.","marker":"[4]"},{"why":"Gives the underlying unconditionally verifiable blind computation framework from which the trapification idea is drawn.","marker":"[10]"},{"why":"Supplies the parameter-shift rule that turns 2NP cost evaluations into the gradient estimate the protocol verifies.","marker":"[25]"},{"why":"Provides the stochastic-gradient-descent inequality used in the convergence proof of Protocol 2.","marker":"[3]"},{"why":"Supplies the strong-convexity inequality that turns gradient-norm bounds into function-gap contraction.","marker":"[20]"},{"why":"Provides the VQE benchmark problem used in the simulations.","marker":"[19]"}],"fun_headline_variants":["Quantum delegation: verifiable, secret, or abort","If not aborted, delegated quantum run is correct","End-to-end verifiable quantum computing delegation","Delegated VQA: attacks caught with high probability","Secure and verifiable quantum cloud delegation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the client can name a positive lower bound $\\epsilon_0$ on the true gradient norm at every optimization step; if the true gradient ever dips below that bound, the relative-error guarantee of Lemma III.1 collapses and a heavily corrupted gradient could be accepted.","fun_headline_variants_meta":{"raw":{"variants":["Quantum delegation: verifiable, secret, or abort","If not aborted, delegated quantum run is correct","End-to-end verifiable quantum computing delegation","Delegated VQA: attacks caught with high probability","Secure and verifiable quantum cloud delegation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0006,"raw_usage":{"total_tokens":2851,"prompt_tokens":1038,"completion_tokens":1813,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":654,"completion_tokens_details":{"reasoning_tokens":1741}},"tokens_in":654,"tokens_out":1813,"duration_ms":15512,"temperature":1.0,"reasoning_tokens":1741,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:27:39.198134+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Protocol 2 on a two-parameter $\\mu$-strongly convex quadratic with $L$-Lipschitz gradient, set $\\epsilon_0$ larger than the gradient norm at an iterate close to the optimum, and have an adversary corrupt more than $\\delta_{\\max}$ computation rounds at that single step; if the protocol accepts and returns a cost observably above $f^*$, the exponential-soundness claim of Theorem III.3 is refuted.","supporting_citations":[{"cited_title":"C., Endo, S., Fujii, K., McClean, J","cited_arxiv_id":null,"evidence_quote":"Supplies the computation/test-round interleaving and c-coloring trapification scheme whose failure statistics Theorem III.2 adapts to gradient verification."},{"cited_title":"For each round: • if it is a test round, the client chooses a random graph coloring and sends the trap and dummy qubits to the server","cited_arxiv_id":null,"evidence_quote":"Establishes blindness of the delegated MBQC computation, which makes trap rounds indistinguishable from computation rounds."},{"cited_title":"F., Kashefi, E., and Walther, P","cited_arxiv_id":null,"evidence_quote":"Gives the underlying unconditionally verifiable blind computation framework from which the trapification idea is drawn."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the parameter-shift rule that turns 2NP cost evaluations into the gradient estimate the protocol verifies."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the stochastic-gradient-descent inequality used in the convergence proof of Protocol 2."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the strong-convexity inequality that turns gradient-norm bounds into function-gap contraction."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the VQE benchmark problem used in the simulations."}],"review_version":1}