Computational Complexity of Learning Efficiently Generatable Pure States

Our technical contribution is, given $\mathbf{PP}$ oracle, showing how to efficiently implement Chung and Lin’s algorithm (Given in Section4 in [CL21]). First, let us briefly recall their strategy in our language.

Description of CL algorithm $\mathcal{A}$:

1. 1.

   As a setup, $\mathcal{A}$ receives a quantum algorithm $\mathcal{C}$ that takes $x\in\mathcal{X}_{n}=\{0,1\}^{{\mathrm{poly}}(n)}$ and outputs $\ket{\psi_{x}}$.

2. 2.

   $\mathcal{A}$ receives $\{\ket{\psi_{x}}_{i}\}_{i\in[T]}$ with sufficiently large $T$ and an unknown $x\in\mathcal{X}_{n}$.

3. 3.

   For all $i\in[T]$, $\mathcal{A}$ measures $\ket{\psi_{x}}_{i}$ with Haar random POVM measurements $\mathcal{M}$, and obtains $z_{i}$. Note that this process is possibly inefficient. Let $\mathcal{C}^{*}(\cdot)$ be a quantum algorithm that takes $x$, generates $\ket{\psi_{x}}$, measure it with $\mathcal{M}$, and outputs the measurement outcome.

4. 4.

   $\mathcal{A}$ outputs $h\in\mathcal{X}_{n}$ such that

   $\displaystyle\max_{x\in\mathcal{X}_{n}}\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(x)]\}=\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(h)].$

   (1)

   Note that this step is possibly inefficient.

Let us explain an intuitive reason why this algorithm works. First, it is known that Haar random measurements do not decrease the trace distance between quantum states if measured states are pure states [Sen06]. From this property, the measurements in the third step of $\mathcal{A}$ does not decrease the trace distance between quantum states. In other words, there is a constant $c$ such that, for all $a,b\in\mathcal{X}_{n}$,

$\displaystyle\norm{\mathcal{C}^{*}(a)-\mathcal{C}^{*}(b)}_{1}\geq c\norm{\ket{\psi_{a}}-\ket{\psi_{b}}}_{1}.$

(2)

This implies that, for finding $h$ such that $\norm{\ket{\psi_{h}}-\ket{\psi_{x}}}_{1}$ is small, it is sufficient to find a $h\in\mathcal{X}_{n}$, such that $\norm{\mathcal{C}^{*}(h)-\mathcal{C}^{*}(x)}_{1}$ is small, given polynomially many copies of $z\leftarrow\mathcal{C}^{*}(x)$. In the fourth step, $\mathcal{A}$ finds a maximum-likelihood $h\in\mathcal{X}_{n}$ such that $\mathcal{C}^{*}(h)$ is most likely to output $\{z_{i}\}_{i\in[T]}$. It is natural to expect that a maximum-likelihood algorithm $\mathcal{C}^{*}(h)$ seems to approximate $\mathcal{C}^{*}(x)$ well with high probability. [CL21] shows that if $T\geq O(\epsilon^{2}\cdot(\log(\absolutevalue{\mathcal{X}_{n}})+\log(\delta)))$, then we have $\norm{\mathcal{C}^{*}(h)-\mathcal{C}^{*}(x)}_{1}\leq 1/\epsilon$ with probability $1-1/\delta$, where the probability is taken over $\{z_{i}\}_{i\in[T]}\leftarrow\mathcal{C}^{*}(x)$.

Although their algorithm learns pure states, their algorithm does not work efficiently. The first bottleneck is the third step of $\mathcal{A}$. In the third step, $\mathcal{A}$ needs Haar random measurements, which is hard to implement. Fortunately, it is shown that we have the same property if we implement $4$-design measurements instead of Haar random measurements [AE07]. Therefore, we can efficiently implement the third step by running $4$-design measurements instead of Haar random measurements. The second bottleneck is the fourth step of $\mathcal{A}$. In the fourth step, given $\{z_{i}\}_{i\in[T]}$, $\mathcal{A}$ needs to find a maximum-likelihood $h\in\mathcal{X}_{n}$ such that

$\displaystyle\max_{x\in\mathcal{X}_{n}}\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(x)]\}=\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(h)],$

(3)

which we currently do not know how to implement efficiently. In our work, we show that we can achieve an approximated version of the task by querying $\mathbf{PP}$ oracle. More precisely, we show that for arbitrary quantum polynomial-time algorithms $\mathcal{C}^{*}$ with classical inputs and classical outputs, there exists a language $\mathcal{L}\in\mathbf{PP}$ and an oracle-aided PPT algorithm $\mathcal{A}^{\mathcal{L}}$ that can find an approximated maximum-likelihood $h\in\mathcal{X}_{n}$ such that

$\displaystyle\frac{\max_{x\in\mathcal{X}_{n}}\left\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(x)]\right\}}{\left(1+1/\epsilon(n)\right)}\leq\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(h)]\leq\max_{x\in\mathcal{X}_{n}}\left\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}(x)]\right\},$

(4)

where $\epsilon$ is arbitrary polynomial.

A subtle but important point is that an “approximated” maximum-likelihood algorithm $\mathcal{C}^{*}(h)$ might not statistically approximate $\mathcal{C}^{*}(x)$ even if we take $T$ sufficiently large. Actually, we do not know how to prove an approximated maximum-likelihood algorithm $\mathcal{C}^{*}(h)$ approximates $\mathcal{C}^{*}(x)$ for sufficiently large $T$. To overcome the issue, inspired by [AW92], we slightly modify the learning algorithm $\mathcal{A}$ as follows. In a modified learning algorithm $\mathcal{B}$, instead of $\mathcal{C}^{*}(\cdot)$, $\mathcal{B}$ considers a quantum algorithm $\mathcal{C}^{*}_{1/2}(\cdot)$, where $\mathcal{C}^{*}_{1/2}(\cdot)$ takes as input $x\in\mathcal{X}_{n}$, and outputs the output of $\mathcal{C}^{*}(x)$ with probability $1/2$, and outputs a uniformly random string $z$ with probability $1/2$. Given many copies of $\ket{\psi_{x}}_{i}$, $\mathcal{B}$ measures $\ket{\psi_{x}}_{i}$ with Haar random measurement and sets the measurement outcome as $z_{i}$ with probability $1/2$, and uniform random string as $z_{i}$ with probability $1/2$. $\mathcal{B}$ outputs $h$ such that

$\displaystyle\frac{\max_{x\in\mathcal{X}_{n}}\left\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}_{1/2}(x)]\right\}}{\left(1+1/\epsilon(n)\right)}\leq\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}_{1/2}(h)]\leq\max_{x\in\mathcal{X}_{n}}\left\{\Pi_{i\in[T]}\Pr[z_{i}\leftarrow\mathcal{C}^{*}_{1/2}(x)]\right\}$

(5)

This modification makes it possible to prove that for sufficiently large $T$, $\norm{\mathcal{C}^{*}_{1/2}(x)-\mathcal{C}^{*}_{1/2}(h)}_{1}$ is small with high probability. Furthermore, we have

$\displaystyle\norm{\mathcal{C}^{*}_{1/2}(x)-\mathcal{C}^{*}_{1/2}(h)}_{1}=\frac{1}{2}\norm{\mathcal{C}^{*}(x)-\mathcal{C}^{*}(h)}_{1}\geq c\norm{\ket{\psi_{x}}-\ket{\psi_{h}}}_{1}.$

(6)

This means that $\ket{\psi_{h}}$ statistically approximates $\ket{\psi_{x}}$. Therefore, the remaining part is showing how to find an approximated maximum-likelihood algorithm $\mathcal{C}^{*}(h)$ given $\mathbf{PP}$ oracle.

In the rest of the section, we explain how to solve the following quantum maximum-likelihood problem using $\mathbf{PP}$ oracle.

Quantum Maximum-Likelihood Problem (QMLH).

• Input:

  A classical string $z$ and a quantum algorithm $\mathcal{C}$, which takes as input $1^{n}$ and a classical string $x\in\mathcal{X}_{n}=\{0,1\}^{{\mathrm{poly}}(n)}$, and outputs a classical string $z\in\mathcal{Z}_{n}$. (In the following, we often omit $1^{n}$ of $z\leftarrow\mathcal{C}(1^{n},x)$.)

• Output:

  Output $h\in\mathcal{X}_{n}$ such that

  $\displaystyle\frac{\max_{x\in\mathcal{X}_{n}}\{\Pr[z\leftarrow\mathcal{C}(x)]\}}{\left(1+1/\epsilon(n)\right)}\leq\Pr[z\leftarrow\mathcal{C}(h)]\leq\max_{x\in\mathcal{X}_{n}}\{\Pr[z\leftarrow\mathcal{C}(x)]\}.$

  (7)

As explained later, a PPT algorithm $\mathcal{A}$ with $\mathbf{PP}$ oracle can exactly simulate an arbitrary probability distribution generated by a quantum polynomial-time algorithm even if it does post-selection. Therefore, it is sufficient to construct a quantum algorithm $\widehat{\mathcal{Q}}[z]$ with post-selection, which solves the quantum maximum likelihood problem. Let us explain how $\widehat{\mathcal{Q}}[z]$ works.

1. 1.

   For sufficiently large $T$, $\widehat{\mathcal{Q}}[z]$ generates the following quantum state

   	$\displaystyle U_{Q}\ket{0}_{W,Y_{1}V_{1}\cdots,Y_{T}V_{T}}$	$\displaystyle\coloneqq\frac{1}{\sqrt{\absolutevalue{\mathcal{X}_{n}}}}\sum_{x\in\mathcal{X}_{n}}\ket{x}_{W}\bigotimes_{i\in[T]}\ket{\mathcal{C}(x)}_{Y_{i}V_{i}}$		(8)
   		$\displaystyle=\frac{1}{\sqrt{\absolutevalue{\mathcal{X}_{n}}}}\sum_{x\in\mathcal{X}_{n}}\ket{x}_{W}\bigotimes_{i\in[T]}\left(\sum_{y\in\mathcal{Z}_{n}}\sqrt{\Pr[y\leftarrow\mathcal{C}(x)]}\ket{y}_{Y_{i}}\ket{\phi_{x,y}}_{V_{i}}\right).$		(9)

   Here, we write $\ket{\mathcal{C}(x)}_{Y_{i}V_{i}}$ to mean a quantum state generated by a quantum algorithm $\mathcal{C}(x)$ before measuring the state with the computational basis, where the $Y_{i}$ register corresponds to the outcome register and the $V_{i}$ register corresponds to the auxiliary register.

2. 2.

   It post-selects all of $Y_{1}\cdots Y_{T}$ registers to $z$. Let $\ket{\psi[z]}_{WY_{1}V_{1}\cdots Y_{T}V_{T}}$ be the post-selected quantum state.

3. 3.

   It measures the $W$ register of $\ket{\psi[z]}_{WY_{1}V_{1}\cdots Y_{T}V_{T}}$ in the computational basis, and outputs the measurement outcome $h$.

From the construction of $\widehat{\mathcal{Q}}[z]$,$\ket{\psi[z]}_{WY_{1}V_{1}\cdots Y_{T}V_{T}}$ satisfies

$\displaystyle\ket{\psi[z]}_{WY_{1}V_{1}\cdots Y_{T}V_{T}}=\frac{1}{\sqrt{\sum_{x\in\mathcal{X}_{n}}(\Pr[z\leftarrow\mathcal{C}(x)]^{T})}}\sum_{h\in\mathcal{X}_{n}}\sqrt{\Pr[z\leftarrow\mathcal{C}(h)]^{T}}\ket{h}_{W}\bigotimes_{i\in[T]}\ket{z}_{Y_{i}}\ket{\phi_{h,z}}_{V_{i}}.$

(10)

Therefore, it is natural to expect that, if we measure the $W$ register of $\ket{\psi[z]}_{WY_{1}V_{1}\cdots Y_{T}V_{T}}$, then, we obtain a measurement outcome $h$ such that $\Pr[z\leftarrow\mathcal{C}(h)]$ is high. We can prove the intuition by taking $T$ sufficiently large as follows. If $h$ is not a good answer for the quantum maximum likelihood problem (i.e. $\Pr[z\leftarrow\mathcal{C}(h)]<\frac{\max_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]}{\left(1+1/\epsilon(n)\right)}$), then

$\displaystyle\Pr[h\leftarrow\widehat{\mathcal{Q}}[z]]=\frac{\Pr[z\leftarrow\mathcal{C}(h)]^{T}}{\sum_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]^{T}}\leq\frac{\Pr[z\leftarrow\mathcal{C}(h)]^{T}}{\max_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]^{T}}<\left(\frac{1}{1+1/\epsilon}\right)^{T}.$

(11)

This implies that

$\displaystyle\Pr_{h\leftarrow\widehat{\mathcal{Q}}[z]}\left[\Pr[z\leftarrow\mathcal{C}(h)]<\frac{\max_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]}{\left(1+1/\epsilon(n)\right)}\right]\leq\absolutevalue{\mathcal{X}_{n}}\cdot\left(\frac{1}{1+1/\epsilon}\right)^{T}.$

(12)

Therefore, by taking $T$ sufficiently large, $\widehat{\mathcal{Q}}[z]$ outputs $h$ such that

$\displaystyle\frac{\max_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]}{1+1/\epsilon}\leq\Pr[z\leftarrow\mathcal{C}(h)]\leq\max_{x\in\mathcal{X}_{n}}\Pr[z\leftarrow\mathcal{C}(x)]$

(13)

with high probability.

Although $\widehat{\mathcal{Q}}[z]$ solves the quantum maximum likelihood problem with high probability, it is possibly inefficient since it does post-selection. In the following, we explain how a PPT algorithm $\mathcal{A}$ with $\mathbf{PP}$ oracle exactly simulates the probability distribution of $\widehat{\mathcal{Q}}[z]$. As shown in [FR99], even a deterministic polynomial time algorithm $\mathcal{B}$ with $\mathbf{PP}$ oracle can compute $\Pr[z\leftarrow\mathcal{C}]$ for an arbitrary QPT algorithm $\mathcal{C}$ and a classical string $z$. Our PPT algorithm $\mathcal{A}^{\mathbf{PP}}$ simulates $\widehat{\mathcal{Q}}[z]$ by using $\mathcal{B}^{\mathbf{PP}}$ as follows:

• •

  For each $i\in[\absolutevalue{x}]$, $\mathcal{A}^{\mathbf{PP}}$ sequentially works as follows:

  1. 1.

     For each $b\in\{0,1\}$, it computes the probability $\Pr[b,x_{i-1},\cdots,x_{1},z]$ and $\Pr[x_{i-1},\cdots,x_{1},z]$. Here,

     $\displaystyle\Pr[x_{i-1},\cdots,x_{1},z]\coloneqq\Tr(\left(\ket{x_{i-1}\cdots x_{1}}\bra{x_{i-1}\cdots x_{1}}_{W[i-1]}\bigotimes_{i\in[T]}\ket{z}\bra{z}_{Y_{i}}\right)U_{\mathcal{Q}}\ket{0}_{W,Y_{1}V_{1},\cdots,Y_{T}V_{T}}),$

     (14)

     where $W[i-1]$ is the register in the first $(i-1)$-bits of $W$. Note that, in this step, $\mathcal{A}^{\mathbf{PP}}$ uses $\mathcal{B}^{\mathbf{PP}}$ given in [FR99].

  2. 2.

     Set $x_{i}\coloneqq b$ with probability

     $\displaystyle\frac{\Pr[b,x_{i-1},\cdots,x_{1},z]}{\Pr[x_{i-1},\cdots,x_{1},z]}.$

     (15)

• •

  Output $h\coloneqq x_{\absolutevalue{x}},\cdots,x_{1}$.

From the construction of $\mathcal{A}^{\mathbf{PP}}$, we have

$\displaystyle\Pr[x\leftarrow\mathcal{A}^{\mathbf{PP}}]\coloneqq\frac{\Pr[x_{\absolutevalue{x}},\cdots,x_{1},z]}{\Pr[z]}.$

(16)

for all $x\in\mathcal{X}_{n}$. From the definition, $\frac{\Pr[x_{\absolutevalue{x}},\cdots,x_{1},z]}{\Pr[z]}$ is exactly equal to the probability that $\widehat{Q}[z]$ outputs $x$. This means that the output distribution of $\mathcal{A}^{\mathbf{PP}}$ is equivalent to that of $\widehat{Q}[z]$.

Ji, Liu, and Song [JLS18] introduce a notion of PRSGs, and show that it can be constructed from OWFs. Kretchmer [Kre21] shows that PRSGs exist relative to an oracle $\mathcal{O}$ such that $\mathbf{BQP}^{\mathcal{O}}=\mathbf{QMA}^{\mathcal{O}}$, and that PRSGs does not exist if its adversary can query $\mathbf{PP}$ oracle. The subsequent works [ZLK⁺23, CLS24] observe that the existence of PRSGs implies that there exists a quantum state, which can be generated by quantum algorithms but hard to learn. Morimae and Yamakawa [MY22b] introduce the notion of OWSGs, and show how to construct them from PRSGs. In their original definition of OWSGs, the output quantum states are restricted to pure states, and its definition is generalized to mixed states by [MY22a]. In this work, we focus on the original pure-state version. Based on [KT24], Cavalar et. al. [CGG⁺23] shows that OWSGs with pure state outputs can be broken if its adversary can query $\mathbf{PP}$ oracle. As pointed out in our work, the existence of OWSGs with pure state outputs is equivalent to the average-case hardness of learning pure states generated by a quantum polynomial-time algorithm. Therefore, to rephrase their results in terms of learning, a quantum polynomial-time algorithm with $\mathbf{PP}$ oracle can learn an arbitrary pure state generated by quantum polynomial-time algorithms in the average sense. Remark that their algorithm works only for average-case learning, and it is unclear whether their QPT algorithm with PP oracle can learn pure states in the worst-case sense.

Brakerski, Canetti, and Qian [BCQ23] introduce the notion of EFI. (See also [Yan22]). It is shown that the existence of EFI is equivalent to that of quantum bit commitments, oblivious transfer, and multi-party computation [GLSV21, BCKM21, Yan22, BCQ23]. It is conjectured that EFI may exist relative to a random oracle and any classical oracle [LMW24].

Valiant [Val84] introduced the PAC (probabilistically approximately correct) learning model to capture the notion of computationally efficient learning. It is shown that PAC learning is equivalent to Occam learning [BEHW87, BP92, Sch90], which can be formulated as a search problem in NP. Inspired by Valiant’s formalization, Kearns et. al. [KMR⁺94] formalizes a distributional learning model. Note that our quantum state learning model can be seen as a quantum generalization of the distributional learning model. It is shown that a polynomial time learnability of a class of probabilistic automata $\mathcal{C}$ with respect to Kullback–Leibler divergence is equivalent to that of the maximum likelihood problem for the same class $\mathcal{C}$ [AW92].

Valiant observed that the existence of pseudorandom functions, which is equivalent to the existence of OWFs [GGM86, HILL99], implies the hardness of learning for P/poly in the PAC model [Val84]. Impagliazzo and Levin [IL90] initiate the study of the reverse direction, i.e. from the average-case hardness of learning to cryptography. Subsequent work [BFKL94, NR06, OS17, NE19, HN23] studies how to construct cryptographic primitives from the average-case hardness of learning in more general learning models. Among them, our result (i.e. the equivalence between OWSGs and average-case hardness of learning pure states) can be seen as a quantum analog of [HN23] in the following sense. In one of their results, they show the equivalence between the existence of OWFs and the average-case hardness of distributional learning [KMR⁺94]. In our work, we observe that the existence of OWSGs with pure state outputs is equivalent to the average case hardness of learning pure states.

In quantum state tomography, a learner is given many independent copies of an unknown $n$-qubit quantum state $\rho$, and outputs a classical description $\widehat{\rho}$ such that $\mathsf{TD}(\rho,\widehat{\rho})\leq 1/\epsilon$. It is known that a learner needs $O(2^{2n}\cdot\epsilon^{2})$-copies if there is no promise on the unknown quantum state [OW16, HHJ⁺16]. Given the negative results, a natural question is which subclass of quantum states can be learned using only polynomially many copies of unknown quantum states. [CL21, BO21] shows that if given quantum states $\rho_{k}$ are promised contained in some restricted families $\mathcal{C}$ of quantum states, then a learner can find $\rho_{h}\in\mathcal{C}$ such that $\mathsf{TD}(\rho_{k},\rho_{h})\leq 1/\epsilon$ with probability $1-1/\delta$ given only ${\mathrm{poly}}(\log(\absolutevalue{\mathcal{C}}),\log(\delta),\epsilon)$-many copies of $\rho_{k}$. This means that all quantum states generated by quantum polynomial-time algorithms can be learned in a sample-efficient way.

Beyond sample efficiency, these lines of work ([Mon17, GIKL23a, GIKL23b, HLB⁺24]) study which subclass of quantum states can be learned in polynomial-time. It is shown that stabilizer quantum circuits can be learned in a time-efficient way [Mon17]. Grewal, Iyer, Kretschmer, and Liang [GIKL23a, GIKL23b] generalize their results and show that low-rank stabilizer pure states can be learned in a time-efficient way. Huang, Liu, Broughton, Kim, Anshu, Landau, and McClean [HLB⁺24] show that a family of pure states generated by geometrically local shallow quantum circuits can be learned in a time-efficient way. Compared to their unconditional results, although our learning algorithm needs to query $\mathbf{PP}$ oracle, our learning algorithm can learn a classical description of arbitrary efficiently generatable pure states.

These lines of work ([Aar07, CHY16, Roc18, ACH⁺19, GL22, CHL⁺22, BJ95, AS07, AdW17, GKZ19, SSG23, CL21, Aar18, HKP20, BO21]) study how to learn quantum processes in other learning models. Aaronson [Aar07] considers one of quantum generalization of the PAC learning model [Val84], and the subsequent works [Roc18, ACH⁺19, GL22, CHL⁺22] study the learning model. In their model, a learner is given examples $(E_{i},\Tr(E_{i}\rho))$, where $\rho$ is an unknown quantum state and $E_{i}$ is a POVM operator sampled according to some distribution $D$, to output a quantum state $\sigma$ such that $\Pr_{E\leftarrow\mathcal{D}}[\Tr(E\rho)-\Tr(E\sigma)\leq\epsilon]\geq 1-\gamma$ for small $\epsilon$ and $\gamma$. Bshouty and Jackson [BJ95] consider another quantum generalization of the PAC learning model. Roughly speaking, the model is the same as standard Valiant’s PAC model except that the learner can receive $\sum_{x}\sqrt{D(x)}\ket{x}\ket{c(x)}$ instead of $(x,c(x))$, where $x$ is sampled according to the distribution $D$. The subsequent works [AS07, AdW17, GKZ19, SSG23] study the learning model. Aaronson introduces another learning model called shadow tomography [Aar18]. In the model, a learner is given many copies of $\rho$, and POVM operators $E_{1},\cdots,E_{m}$. The learner needs to estimate $\Tr(\rho E_{1}),\cdots\Tr(\rho E_{m})$ up to additive error $\epsilon$. The subsequent works [HKP20, BO21] also study the model.

We show that $\mathbf{PP}$ oracle helps to properly learn pure states generated by quantum polynomial time algorithms. We leave the reverse direction as an open problem. In other words, can we decide any language in $\mathbf{PP}$ efficiently assuming that we can properly learn arbitrary pure states generated by quantum polynomial-time algorithms?

Remark that in the classical learning theory, the hardness of proper PAC learning is characterized by $\mathbf{NP}$. It is shown that PAC learning can be reduced to Occam learning [BEHW87, BP92, Sch90], which can be formulated as a search problem in $\mathbf{NP}$. Hence, $\mathbf{NP}$ oracle is sufficient to achieve proper PAC learning for arbitrary classical polynomial time algorithms. On the other hand, it is shown that if we can properly learn arbitrary classical polynomial-time algorithms in the proper PAC model [PV88], then we can decide any language in $\mathbf{NP}$. Does a similar relationship hold between $\mathbf{PP}$ and proper pure state learning as the relationship between $\mathbf{NP}$ and proper PAC learning?

In this work, we observe that the existence of EFI implies that there exist mixed states generated by quantum polynomial-time algorithms, which is hard to properly learn. This implies that it is unlikely to reduce proper mixed-state learning to classical language because it is conjectured that any classical oracles do not help to break the security of EFI [LMW24]. Note that the argument cannot be applied to improper mixed-state learning, and there exists the possibility that we can reduce improper mixed-state learning to classical language. We leave as an open problem whether we can reduce improper mixed-state learning to classical language or not. We also leave as an open problem whether we can characterize the hardness of proper mixed-state learning in terms of unitary complexities [RY22, MY23, BEM⁺23] instead of classical languages.

We say that a family of distributions $\mathcal{D}=\{\mathcal{D}_{n}\}_{n\in\mathbb{N}}$ is efficiently sampleable distribution if there exists a uniform QPT algorithm $D$ such that, for each $n\in\mathbb{N}$, the distribution of $D(1^{n})$ is statistically identical to $\mathcal{D}_{n}$.

We consider the following security experiment $\mathsf{Exp}_{\Sigma,\mathcal{A}}(1^{\lambda})$.

1. 1.

   The challenger samples $k\leftarrow\mathsf{KeyGen}(1^{\lambda})$.

2. 2.

   $\mathcal{A}$ can receive arbitrary polynomially many copies of $\ket{\psi_{k}}$.

3. 3.

   $\mathcal{A}$ outputs $k^{*}$.

4. 4.

   The challenger measures $\ket{\psi_{k}}$ with $\{\ket{\psi_{k^{*}}}\bra{\psi_{k^{*}}},I-\ket{\psi_{k^{*}}}\bra{\psi_{k^{*}}}\}$.

5. 5.

   The experiment outputs $1$ if the result is $\ket{\psi_{k^{*}}}\bra{\psi_{k^{*}}}$, and $0$ otherwise.

We say that an OWSG with pure state outputs satisfies security if, for any uniform QPT adversaries $\mathcal{A}$,

$\displaystyle\Pr[\mathsf{Exp}_{\Sigma,\mathcal{A}}(1^{\lambda})=1]\leq{\mathsf{negl}}(\lambda).$

(18)

For any $(k,k^{*})$ with $k\neq k^{*}$,

$\displaystyle\mathsf{TD}(\psi_{\lambda,k},\psi_{\lambda,k^{*}})\geq 1-{\mathsf{negl}}(\lambda).$

(19)

For any uniform QPT adversaries $\mathcal{A}$ and any polynomials $t$,

$\displaystyle\Pr[k\leftarrow\mathcal{A}(\psi_{\lambda,k}^{\otimes t(\lambda)}):k\leftarrow\mathsf{KeyGen}(1^{\lambda}),\psi_{\lambda,k}\leftarrow\mathsf{StateGen}(1^{\lambda},k)]\leq{\mathsf{negl}}(\lambda).$

(20)

Note that [MY22a] shows that the existence of EFI is equivalent to that of SV-SI-OWSG.