Verifiable End-to-End Delegated Variational Quantum Algorithms

Anna Pappa; Matteo Inajetovic; Petros Wallden

REVIEW 3 major objections 4 minor 39 references

Verifiable End-to-End Delegated Variational Quantum Algorithms

T0 review · 3 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a delegated variational quantum algorithm can be verified end to end: if the protocol does not abort, the client is certain the returned optimal value is correct, with failure probability exponentially small in the…

desk verdict Promising end-to-end delegated VQA protocol, but the central verifiability theorem rests on an unexamined gradient-norm lower bound that fails near the optimum. read the letter →

arxiv 2504.15410 v4 pith:I22R7VV4 submitted 2025-04-21 quant-ph

Matteo Inajetovic , Petros Wallden , Anna Pappa This is my paper · ORCID

classification quant-ph

keywords delegatedquantumcomputingblindverifiablecomputationvariationalalgorithmsmeasurement-basedgradientdescenttrapificationparameter-shiftrule

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a client with limited quantum hardware can delegate the whole run of a variational quantum algorithm (VQA) to a more powerful quantum server and still certify the final answer. It does this at two levels: Protocol 1 verifies a single gradient-estimation step by interleaving computation rounds with test rounds full of traps, and Protocol 2 embeds that step in a gradient-descent loop that reruns any attacked iteration. The main result, Theorem III.3, states that for a $\mu$-strongly convex cost function with an $L$-Lipschitz gradient, a non-aborting run returns the true optimum $f^*$, and the probability of accepting a wrong result decays exponentially in the number of rounds. This matters because practical near-term users of quantum cloud services will often need to delegate computation to stronger servers, and blindness alone does not guarantee that the whole optimization reached the right value.

What carries the argument

The load-bearing mechanism is the trapification scheme of [13], adapted from verifying BQP computations to verifying expectation values: in each round the client sends either a computation round realizing one of the $2N_PN_s$ cost-function evaluations, or an indistinguishable test round made of traps and dummy qubits, so that any attack on computation rounds has a high probability of showing up in a test round. The identity that carries the argument is Lemma III.1, $e \le (\sum_i |c_i|)/(N_s\epsilon_0)\,\delta$, which converts a count of corrupted computation rounds $\delta$ into a bound on the relative error of the gradient estimate. For the full optimization, the decisive object is the gradient-descent contraction inequality of Appendix VI B, which shows $E[f_{k+1}] - f^* \le \gamma (E[f_k] - f^*)$ with $\gamma<1$ exactly when the conditions in (4) hold; that contraction is what ties per-step verification to a final, end-to-end guarantee.

What would settle it

Run Protocol 2 on a two-parameter $\mu$-strongly convex quadratic with $L$-Lipschitz gradient, set $\epsilon_0$ larger than the gradient norm at an iterate close to the optimum, and have an adversary corrupt more than $\delta_{\max}$ computation rounds at that single step; if the protocol accepts and returns a cost observably above $f^*$, the exponential-soundness claim of Theorem III.3 is refuted.

Watch

Extended reading notes

Core claim

The central discovery is that end-to-end verifiability for a delegated VQA can be reduced to a per-step relative-error certificate plus a convergence condition. Protocol 1 computes gradient estimates through the parameter-shift rule, executing $d = 2N_P N_s$ computation rounds and $t$ test rounds; because the server cannot distinguish the two, any attack that corrupts more than $\delta_{\max}$ computation rounds is detected with probability exponentially close to one, and Lemma III.1 turns a known lower bound $\epsilon_0$ on the gradient norm into the error bound $e \le (\sum_i |c_i|)/(N_s \epsilon_0)\,\delta$. Protocol 2 then runs gradient descent and re-executes rejected steps. The authors prove that whenever the learning rate and error threshold satisfy $\mu\alpha(1+e_{\mathrm{th}})[2-\alpha L(1+e_{\mathrm{th}})]<1$ and $\alpha L < 2/(1+e_{\mathrm{th}})$, the expected distance to $f^*$ contracts geometrically, so the protocol either delivers $f^*$ or aborts. In the paper's formulation, the client can be certain a non-aborting computation outcome is correct.

Load-bearing premise

The load-bearing premise is that the client can name a positive lower bound $\epsilon_0$ on the true gradient norm at every optimization step; if the true gradient ever dips below that bound, the relative-error guarantee of Lemma III.1 collapses and a heavily corrupted gradient could be accepted.

Editorial extensions

If this is right

A run of Protocol 2 that does not abort certifies the final output itself, not just the last gradient: the client obtains the optimal value $f^*$ of the cost function.
The probability of accepting a corrupted computation undetected falls exponentially with the total number of rounds $n$, so the client can reach any desired confidence by increasing $t$ and $n$.
Attacked steps do not abort the whole optimization; Protocol 2 rejects and reruns only the failed step, so the overhead tracks the number of attacks rather than the number of iterations.
As the error threshold $e_{\mathrm{th}}$ goes to zero, the convergence conditions reduce to the standard gradient-descent conditions, so the protocol degrades gracefully to the usual linear convergence of strongly convex optimization.
Because the step-level verification is independent of the optimizer, the protocol can be paired with other classical optimizers, at the cost of supplying an optimizer-specific convergence theorem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Inference: the fixed threshold $\epsilon_0$ could be made adaptive per step: a client who monitors the gradient estimates could spend more trap rounds at flat or near-optimal steps and fewer when gradients are large, reducing total delegation overhead.
Inference: a direct consequence of the proof structure is that the weakest point is the assumed lower bound $\epsilon_0$; if a step's true gradient falls below it, a server could corrupt that step with impunity, and the final guarantee would then depend on the optimizer's stability rather than on verification.
Inference: the same relative-error bound applies to any expectation-value-based gradient computed by the parameter-shift rule, so the protocol's step-level verification generalizes beyond VQE ground-state search to delegated quantum machine learning and other variational tasks.
Inference: the simulation's attack model is an illustration, not a constraint; a stronger test would apply angle-shift attacks to individual measurement rounds and check whether trap detections still match the predicted exponential failure bound.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

End-to-end verifiability is a real step forward, but the main theorem leans on an assumption the protocol can't enforce: a fixed lower bound ε0 on the gradient norm at every iteration. Near a strongly convex optimum, the gradient norm goes to zero, so Lemma III.1's relative-error bound stops meaning anything exactly when the client needs it most. That's a load-bearing gap, not a normalization issue.

The new thing here is genuinely new: prior delegated VQA work verified single shots or single iterations, while Protocol 2 tries to verify the whole optimization with a rerun-tolerant gradient descent that reacts to aborted steps. The design is sensible, the dependence on known primitives (blind MBQC, trapification) is honest, and the TFIM simulations support the optimizer concept. Credit where it's due.

The soft spots, in proportion: the ε0 issue is the serious one. Protocol 2 never says where ε0 comes from or how the client checks it, and Theorem III.3 doesn't list it among the hypotheses. Since f is μ-strongly convex, ||∇f(θ_k)||→0 along any convergent run, so a fixed ε0>0 is eventually violated. At that point an adversary can corrupt the maximum allowed rounds, no trap fires, and the step is accepted with a relative error much larger than e_th. The rerun mechanism only helps when a step aborts, so a non-aborting execution can end far from f*. Theorem III.3's claim, as stated, isn't established.

Theorem III.2's proof is also hard to verify as written; the conditioning on X'≤mt/n looks suspect, and the failure-probability bound doesn't cleanly separate regimes. That's a presentation problem that may be fixable. The strong-convexity assumption is restrictive but explicit, so it's a scope limitation rather than a flaw. Missing code and error bars in the simulations are minor.

This paper is for people working on delegated quantum computation and quantum verification. I'd send it to a serious referee: the core idea is salvageable, and the subfield would benefit from a version that either proves a verifiable gradient bound without ε0 or reframes the guarantee honestly, e.g., as conditional on a known gradient lower bound.

Referee Report

3 major / 4 minor

Summary. The paper proposes a framework for delegated variational quantum algorithms (DVQAs) in the measurement-based quantum computing model. Protocol 1 delegates and verifies a single gradient-descent step computed via the parameter-shift rule, using interleaved computation and test rounds adapted from Leichtle et al. Protocol 2 composes these verified steps into a full optimization with re-runs of attacked steps and claims end-to-end verifiability: if the protocol does not abort, the client obtains the correct optimal value f* of the cost function. The central formal statements are Lemma III.1 (a bound relating the gradient relative error to the number of corrupted computation rounds), Theorem III.2 (exponentially small probability of accepting a highly corrupted step), and Theorem III.3 (end-to-end verifiability under strongly convex, Lipschitz-gradient assumptions). The paper also reports numerical simulations for the Transverse Field Ising Model using the Qrisp and Veriphix frameworks.

Significance. If the central claims were fully established, the paper would make a valuable contribution to delegated quantum computation and to practical verifiable quantum cloud services. The step-level trapification idea, the composition into an end-to-end protocol, and the public numerical demonstrations are promising and clearly relevant to the journal's readership. The paper builds on established primitives (blind MBQC, trapification) rather than on its own previous results, which is a strength. However, as argued below, the verification bound depends on an unstated and generally false uniform gradient-norm lower bound, the proof of Theorem III.2 contains a conditioning error that invalidates the claimed exponential decay, and the convergence result in the appendix only establishes convergence to a neighborhood of f* rather than exact recovery of f*. These issues are load-bearing for the paper's main claim, so the manuscript needs substantial revision.

major comments (3)

[Lemma III.1 and Theorem III.3] Lemma III.1 derives e ≤ (Σ|c_i|)/(ε0 N_s) δ only after assuming a lower bound ε0 on ||g(θ)||. For a μ-strongly convex cost function, Lemma VI.2 gives ||∇f(θ)||^2 ≥ 2μ(f(θ)-f*), so along a successful optimization the gradient norm tends to zero and any fixed ε0 > 0 is violated in the final iterations. The parameter ε0 does not appear in Protocol 2's input list nor in the hypotheses (4) of Theorem III.3, and no client-side procedure is given for choosing or checking ε0. Consequently, at a step with ||g(θ_k)|| < ε0, an adversary can corrupt δ = δ_max computation rounds without triggering any trap failure, while the true relative error is amplified by the factor ε0/||g(θ_k)|| and can exceed e_th by an arbitrarily large amount. Because the rerun mechanism in Protocol 2 reacts only to aborted steps, such a corrupted update is accepted and can move the parameters away from the optimum, so the end-to-end guarantee of Theorem III.3 is not established.
[Theorem III.2] In the proof of Theorem III.2, the chain beginning with Pr(X_t < 1) ≤ Pr(X′ ≤ mt/n) + Pr(X_t = 0 | X′ > mt/n) is not exponentially small as written: for X′ ≈ Binomial(m, t/n), the probability Pr(X′ ≤ E[X′]) is typically bounded below by a constant (about 1/2), not by an exponentially decaying quantity. The displayed Hoeffding bound exp(-2ε1²τ²n²/m) can only apply to an event of the form X′ ≤ mt/n - ε1 (or a similar deviation from the mean), which is not what appears in the preceding line. In addition, the case-A statement that m > nw 'leads to Pr[X_d ≥ δ_max] = 1' confuses the expectation of a binomial with the probability of a tail event; the expectation exceeding the threshold does not make the event certain. The case-B expression also multiplies Pr(X_d ≥ δ_max) and Pr(X_t < 1) as if they were independent, although X_d and X′ are coupled as complementary splits of the m attacked rounds. The claimed exponential decay of the step-failure probability is therefore not proven as it stands.
[Theorem III.3 and Appendix VI B] The convergence analysis in Appendix VI B establishes E[f(θ_{k+1})] - f* ≤ γ(E[f(θ_k)] - f*) + B with B = α²L(1+e)²σ_g²/2, and the final error is only bounded by B/(1-γ), as stated in Eq. (11). Strict convergence to f* is obtained only in the limit σ_g² → 0, i.e., in the absence of shot noise. Since shot noise is inherent to the sampling-based parameter-shift evaluations used in Protocol 1, the abstract's claim that the client can be certain the computation outcome is the correct optimal value f*, and the analogous wording in Theorem III.3, are stronger than what the proof supports. Protocol 2's abort condition 'if the optimization hasn't converged' is not formalized in terms of the neighborhood B/(1-γ), and no verifiable stopping criterion is provided. The theorem and the protocol need to be reworked to state a concrete final-error guarantee, or the end-to-end claim must be weakened accordingly.

minor comments (4)

[Eq. (3)] The notation Pr(fail) = Pr[X_d ≥ δ_max] ∧ Pr[X_t < 1] is informal; the intersection of events should be written explicitly, e.g., Pr(X_d ≥ δ_max and X_t < 1), to avoid ambiguity.
[Theorem III.2] The parameter c appears in the Binomial detection probability and in the exponential expressions but is not defined in the proof; the reader must infer that it is the number of colors of the c-coloring used for the trapification scheme.
[Fig. 2 caption] The acronym 'NTD' is not defined, and the phrase 'the number of test roundst' is ambiguous; please clarify that t is the fixed number of test rounds and NTD is the number of detected trap failures.
[Conclusion] The concluding remark that the relative error threshold could in future be varied 'depending on the current gradient value' is precisely the dependence that would address the ε0 issue raised in Lemma III.1; the manuscript should at least state whether the present protocol permits such adaptation or whether ε0 is intended to be fixed for all steps.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the protocol derives from external verification primitives; the ε0 assumption is an unproven hypothesis and correctness gap, not a circular reduction.

full rationale

I walked the derivation chain in Sections III.A and III.B and Appendix VI.B. Protocol 1 imports blindness from Broadbent et al. [4] and interleaved trapification from Leichtle et al. [13], both external works with no author overlap, and Theorem III.2 is a standard Hoeffding-type concentration argument; no step is justified by a self-citation. Lemma III.1 contains the sentence "Since we cannot access the real value ∥g∥, we can assume a lower bound ϵ0 leading to the Lemma's result." This is a missing hypothesis rather than a circular reduction: the bound e ≤ (Σ|c_i|)/(N_s ϵ0) δ is a conditional inequality that would be valid if ϵ0 ≤ ∥g(θ)∥ held, and it does not reintroduce the theorem's conclusion as an input. The gap is real and load-bearing for Theorem III.3 because near a μ-strongly convex optimum ∥∇f(θ)∥→0, so a fixed ε0 cannot be guaranteed; however, that is a soundness and completeness concern, not an instance of a prediction being equivalent to its inputs by construction. The convergence analysis in Appendix VI.B relies on external standard lemmas (Polyak, Bottou et al.) and derives the conditions in Eq. (4) from them; no fitted parameter is renamed as a prediction, and no ansatz is smuggled in via a citation to the authors' own prior work. I therefore find no significant circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The protocol depends on standard cryptographic primitives (blind MBQC, trapification) and on two strong assumptions about the optimization landscape: a lower bound on the gradient norm and strong convexity. No new physical entities are postulated.

free parameters (2)

epsilon_0 = not specified; assumed by the client
Lower bound on the gradient norm introduced in Lemma III.1 to convert absolute gradient error into relative error. If the actual gradient norm drops below this value, the step-level relative error bound fails.
e_th = not specified; e.g., 0.2 used in Fig. 2
Target relative error threshold for accepting a gradient step. The client must choose it to balance abort rate against tolerance to corrupted steps, and it is not derived from the problem.

assumptions (4)

domain assumption Blindness of the underlying MBQC protocol (Broadbent et al., 2009): the server cannot distinguish computation rounds from test rounds or identify trap qubits.
Protocol 1 relies on this to ensure the server cannot selectively attack computation rounds without risking trap detection. This is inherited from prior work.
domain assumption The c-coloring trapification scheme (Leichtle et al., 2021) gives a detection probability of at least 1/c per attacked test round.
Used in the proof of Theorem III.2 to bound the probability that no trap fires despite attacks on test rounds.
domain assumption The cost function f is μ-strongly convex with L-Lipschitz continuous gradient.
Assumed in Theorem III.3 for convergence-to-optimum guarantees. Typical VQA cost landscapes, including TFIM, need not satisfy this.
ad hoc to paper The gradient norm is bounded below by ϵ0 at every optimization step.
Introduced in Lemma III.1 without a procedure for choosing a valid ϵ0. It is violated at stationary points and small-gradient regions.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Verifiable End-to-End Delegated Variational Quantum Algorithms." pith.science (2026). https://pith.science/paper/I22R7VV4

@misc{pith2026250415410,
  author       = {Pith},
  title        = {Pith review of: Verifiable End-to-End Delegated Variational Quantum Algorithms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I22R7VV4}},
  note         = {Machine review of arXiv:2504.15410}
}

read the original abstract

Variational quantum algorithms (VQAs) have emerged as promising candidates for solving complex optimization and machine learning tasks on near-term quantum hardware. However, executing quantum operations remains challenging for small-scale users because of several hardware constraints, making it desirable to delegate parts of the computation to more powerful quantum devices. In this work, we introduce a framework for delegated variational quantum algorithms (DVQAs), where a client with limited quantum capabilities delegates the execution of a VQA to a more powerful quantum server. In particular, we introduce a protocol that enables a client to delegate a variational quantum algorithm to a server while ensuring that the input, the output and also the computation itself remain secret. Additionally, if the protocol does not abort, the client can be certain that the computation outcome is indeed correct. This work builds on the general verification protocol introduced by Fitzimons and Kashefi (2017), tailoring it to VQAs. Our approach first proposes a verifiable Protocol for delegating the quantum computation required at each optimization step of a VQA, and then combines the iterative steps into an error-resilient optimization process that offers end-to-end verifiable algorithm execution. We also simulate the performance of our protocol tackling the Transverse Field Ising Model. Our results demonstrate that secure delegation of variational quantum algorithms is a realistic solution for near-term quantum networks, paving the way for practical quantum cloud computing applications.

Figures

Figures reproduced from arXiv: 2504.15410 by the authors.

**Figure 2.** FIG. 2. Plot of relative error [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 37 canonical work pages

[1]

We show how to verify one step of an MB-DVQA (Protocol 1) by using a trapification scheme that alternates computation and test rounds [13], and prove that it succeeds with probability that grows exponentially with the number of total rounds (Theorem III.2)

work page
[2]

We propose a new MB-DVQA using a custom gradient-descent optimizer (Protocol 2) that reruns highly attacked iterations without aborting the full optimization and show that it is verifiable (Theo- rem III.3)

work page
[3]

We benchmark the custom optimizer outlined in Protocol 2 through numerical simulations of a Vari- ational Quantum Eigensolver (VQE) [19] that finds the ground state energy of the Transverse Field Ising Hamiltonian, incorporating simulated gradi- ent perturbations that mimic adversarial attacks. II. BACKGROUND A central component in VQAs is a Parametrized ...

work page
[4]

For each round: • if it is a test round, the client chooses a random graph coloring and sends the trap and dummy qubits to the server

Suppose n = d +t the number of rounds, where d = 2 NPNs are the computation and t are the test rounds and the Client chooses at random which round belongs in each set. For each round: • if it is a test round, the client chooses a random graph coloring and sends the trap and dummy qubits to the server. • if it is a computation round, the client sends the q...

work page
[5]

• otherwise, she accepts, obtaining g(θ) with a relative error up to eth

The client gathers and decodes the server’s output: • in case she detects a trap failure, she aborts. • otherwise, she accepts, obtaining g(θ) with a relative error up to eth. In order to prove verifiability for our protocol, we first establish a connection between the relative error in the gradient approximation and the adversarial attacks, rep- resented...

work page
[6]

• If it aborts: θk+1 = θk (i.e

For k∈ [1,...,N iter], run Protocol 1 to compute ˆg(θk): • If it accepts: θk+1 =θk−αˆg(θk). • If it aborts: θk+1 = θk (i.e. re-run the same step)

work page
[7]

Set the final angles: θ∗←θNiter

work page
[8]

Theorem III.3

If the optimization hasn’t converged, aborts; other- wise accepts returning ˆf ∗. Theorem III.3. Given aµ-strongly convex cost function f with L-Lipschitz continuous gradient and a global op- timum f∗, Protocol 2 ensures verifiability, provided that the learning rate α and error bound on the gradient eth satisfy the following conditions: µα(1 +eth)[2−αL(1...

work page

Show all 39 references

[9]

Abdul Sater, S., Garnier, M., Martinez, T., and Ollivier, H. (2024). Veriphix. https://github.com/qat-inria/ veriphix

2024
[10]

F., Kashefi, E., and Walther, P

Barz, S., Fitzsimons, J. F., Kashefi, E., and Walther, P. (2013). Experimental verification of quantum computa- tion. Nature Physics, 9(11):727–731

2013
[11]

E., and Nocedal, J

Bottou, L., Curtis, F. E., and Nocedal, J. (2018). Opti- mization methods for large-scale machine learning. SIAM Review, 60(2):223–311

2018
[12]

Broadbent, A., Fitzsimons, J., and Kashefi, E. (2009). Universal blind quantum computation. In 2009 50th An- nual IEEE Symposium on Foundations of Computer Sci- ence, pages 517–526

2009
[13]

C., Endo, S., Fujii, K., McClean, J

Cerezo, M., Arrasmith, A., Babbush, R., Benjamin, S. C., Endo, S., Fujii, K., McClean, J. R., Mitarai, K., Yuan, X., Cincio, L., and Coles, P. J. (2021). Vari- ational quantum algorithms. Nature Reviews Physics , 3(9):625–644

2021
[14]

F., Portmann, C., and Ren- ner, R

Dunjko, V., Fitzsimons, J. F., Portmann, C., and Ren- ner, R. (2014). Composable Security of Delegated Quan- tum Computation, page 406–425. Springer Berlin Heidel- berg

2014
[15]

R., Dellantonio, L., Jansen, K., Balushi, A

Ferguson, R. R., Dellantonio, L., Jansen, K., Balushi, A. A., D¨ ur, W., and Muschik, C. A. (2021). A measurement-based variational quantum eigensolver. Physical Review Letters , 126(22):220501

2021
[16]

T., McKay, D., and Datta, A

Ferracin, S., Merkel, S. T., McKay, D., and Datta, A. (2021). Experimental accreditation of outputs of noisy quantum computers. Physical Review A , 104(4)

2021
[17]

Fitzsimons, J. (2016). Private quantum computation: an introduction to blind quantum computing and related protocols. npj Quantum Information , 3

2016
[18]

Fitzsimons, J. F. and Kashefi, E. (2017). Unconditionally verifiable blind quantum computation. Phys. Rev. A , 96:012303

2017
[19]

Gheorghiu, A., Kapourniotis, T., and Kashefi, E. (2019). Verification of Quantum Computation: An Overview of Existing Approaches. Theory of Computing Systems , 63(4):715–808

2019
[20]

Kapourniotis, T., Kashefi, E., Leichtle, D., Music, L., and Ollivier, H. (2024). Unifying quantum verification and error-detection: theory and tools for optimisations. Quantum Science and Technology , 9(3):035036

2024
[21]

Leichtle, D., Music, L., Kashefi, E., and Ollivier, H. (2021). Verifying BQP Computations on Noisy Devices with Minimal Overhead. PRX Quantum , 2(4):040302

2021
[22]

Li, Q., Quan, J., Shi, J., Zhang, S., and Li, X. (2023). Delegated variational quantum algorithms based on quantum homomorphic encryption. arXiv:2301.10433 [quant-ph]

2023 arXiv
[23]

Li, W., Lu, S., and Deng, D.-L. (2021). Quantum feder- ated learning through blind quantum computing. Science China Physics, Mechanics & Astronomy , 64(10):100312

2021
[24]

J., Nautrup, H

Majumder, A., Krumm, M., Radkohl, T., Fiderer, L. J., Nautrup, H. P., Jerbi, S., and Briegel, H. J. (2024). Varia- tional measurement-based quantum computation for gen- erative modeling. Physical Review A , 110(6)

2024
[25]

Marqversen, F. K. and Zinner, N. T. (2023). Appli- cations and resource reductions in measurement-based variational quantum eigensolvers. Quantum Science and Technology, 8(4):045001

2023
[26]

Mitarai, K., Negoro, M., Kitagawa, M., and Fujii, K. (2018). Quantum circuit learning. Physical Review A , 98(3)

2018
[27]

J., Aspuru-Guzik, A., and O’Brien, J

Peruzzo, A., McClean, J., Shadbolt, P., Yung, M.-H., Zhou, X.-Q., Love, P. J., Aspuru-Guzik, A., and O’Brien, J. L. (2014). A variational eigenvalue solver on a photonic quantum processor. Nature Communications, 5(1)

2014
[28]

Polyak, B. (1963). Gradient methods for the minimi- sation of functionals. Ussr Computational Mathematics and Mathematical Physics , 3:864–878

1963
[29]

Proietti, M., Cerocchi, F., and Dispenza, M. (2022). A native measurement-based QAOA algorithm, applied to the MAX K-CUT problem. Physical Review A , 106(2):022437

2022
[30]

Qin, Z., Li, X., Zhou, Y., Zhang, S., Li, R., Du, C., and Xiao, Z. (2024). Applicability of measurement-based quantum computation towards physically-driven varia- tional quantum eigensolver. New Journal of Physics , 26(7):073040

2024
[31]

and Briegel, H

Raussendorf, R. and Briegel, H. J. (2001). A One- Way Quantum Computer. Physical Review Letters , 86(22):5188–5191

2001
[32]

Schroeder, A., Heller, M., and Gachechiladze, M. (2023). Deterministic ans¨ atze for the Measurement-based Vari- ational Quantum Eigensolver. arXiv:2312.13241 [quant- ph]

2023 arXiv
[33]

Schuld, M., Bergholm, V., Gogolin, C., Izaac, J., and Killoran, N. (2019). Evaluating analytic gradients on quantum hardware. Phys. Rev. A , 99:032331

2019
[34]

Seidel, R., Bock, S., Zander, R., Petriˇ c, M., Steinmann, N., Tcholtchev, N., and Hauswirth, M. (2024). Qrisp: A framework for compilable high-level programming of gate-based quantum computers. arXiv:2406.14792 [quant-ph]

2024 arXiv
[35]

Shingu, Y., Takeuchi, Y., Endo, S., Kawabata, S., Watabe, S., Nikuni, T., Hakoshima, H., and Matsuzaki, Y. (2022). Variational secure cloud quantum computing. Physical Review A , 105(2):022603

2022
[36]

and Hadfield, S

Stollenwerk, T. and Hadfield, S. (2024). Measurement- Based Quantum Approximate Optimization . In 2024 IEEE International Parallel and Distributed Process- ing Symposium Workshops (IPDPSW) , pages 1115–1127. IEEE Computer Society

2024
[37]

and Fukushima, M

Sunami, S. and Fukushima, M. (2022). Graphix: optimizing and simulating measurement-based quan- tum computation on local-Clifford decorated graph. arXiv:2212.11975 [quant-ph]

2022 arXiv
[38]

Wang, Y., Quan, J., and Li, Q. (2022). A delegated quantum approximate optimization algorithm. In 2022 14th International Conference on Wireless Communica- tions and Signal Processing (WCSP) , pages 804–808

2022
[39]

Yang, J., Wang, B., Quan, J., and Li, Q. (2025). Verifi- able cloud-based variational quantum algorithms. Optics Communications, 578:131474. 8 VI. APPENDIX A. Useful Lemmas Lemma VI.1. (Hoeffding’s inequality) Given a binomial distribution X ≈ Binomial(n,p ) an upper bound to ...

2025

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

We show how to verify one step of an MB-DVQA (Protocol 1) by using a trapification scheme that alternates computation and test rounds [13], and prove that it succeeds with probability that grows exponentially with the number of total rounds (Theorem III.2)

work page

[2] [2]

We propose a new MB-DVQA using a custom gradient-descent optimizer (Protocol 2) that reruns highly attacked iterations without aborting the full optimization and show that it is verifiable (Theo- rem III.3)

work page

[3] [3]

We benchmark the custom optimizer outlined in Protocol 2 through numerical simulations of a Vari- ational Quantum Eigensolver (VQE) [19] that finds the ground state energy of the Transverse Field Ising Hamiltonian, incorporating simulated gradi- ent perturbations that mimic adversarial attacks. II. BACKGROUND A central component in VQAs is a Parametrized ...

work page

[4] [4]

For each round: • if it is a test round, the client chooses a random graph coloring and sends the trap and dummy qubits to the server

Suppose n = d +t the number of rounds, where d = 2 NPNs are the computation and t are the test rounds and the Client chooses at random which round belongs in each set. For each round: • if it is a test round, the client chooses a random graph coloring and sends the trap and dummy qubits to the server. • if it is a computation round, the client sends the q...

work page

[5] [5]

• otherwise, she accepts, obtaining g(θ) with a relative error up to eth

The client gathers and decodes the server’s output: • in case she detects a trap failure, she aborts. • otherwise, she accepts, obtaining g(θ) with a relative error up to eth. In order to prove verifiability for our protocol, we first establish a connection between the relative error in the gradient approximation and the adversarial attacks, rep- resented...

work page

[6] [6]

• If it aborts: θk+1 = θk (i.e

For k∈ [1,...,N iter], run Protocol 1 to compute ˆg(θk): • If it accepts: θk+1 =θk−αˆg(θk). • If it aborts: θk+1 = θk (i.e. re-run the same step)

work page

[7] [7]

Set the final angles: θ∗←θNiter

work page

[8] [8]

Theorem III.3

If the optimization hasn’t converged, aborts; other- wise accepts returning ˆf ∗. Theorem III.3. Given aµ-strongly convex cost function f with L-Lipschitz continuous gradient and a global op- timum f∗, Protocol 2 ensures verifiability, provided that the learning rate α and error bound on the gradient eth satisfy the following conditions: µα(1 +eth)[2−αL(1...

work page