Introduction

Reliable quantum information processing critically depends on our ability to verify that quantum processes behave as intended1. While quantum process tomography can accomplish this task for small-sized quantum devices, as quantum devices scale up in size and complexity for more sophisticated quantum information processing, this verification step becomes increasingly challenging2,3. Therefore, it is becoming essential to find an efficient way to certify a quantum process and ultimately to develop an optimal and practical scheme.

Quantum process certification-the task of verifying that a quantum process operates correctly−is therefore a central challenge in current quantum information processing. From an information-theoretic perspective, extensive research has investigated resources necessary for reliable certification2,3,4,5,6. Meanwhile, from a practical engineering perspective, protocols such as quantum process tomography7,8,9,10,11 and randomized benchmarking12,13,14,15 have been developed and implemented. More recently, quantum channel learning techniques have emerged as a promising approach, as they estimate key error observables without fully reconstructing the entire process, which can significantly reduce the required resources16,17,18,19,20,21,22,23.

In many practical applications, a desired quantum process to implement is often described by a unitary channel, which plays the role of quantum gates in quantum computing and the perfect transmission of quantum information in quantum communication, because a unitary channel represents a quantum process under ideal and closed-system conditions. Therefore, among the certification tasks, unitary channel certification-the problem of certifying a unitary channel−is particularly important and practically relevant. In addition, recent technological advances in quantum coherence have brought laboratory environments closer to ideal closed-system conditions, further underscoring the practical relevance of unitary channel certification24,25. However, somewhat surprisingly, unitary channel certification remains largely unexplored. Previous studies on quantum process certification have typically considered noisy environments and have shown that certifying completely positive and trace-preserving (CPTP) channels requires exponentially many channel queries2,3.

In this work, we investigate the unitary channel certification problem and characterize its query complexity. We first show that incoherent algorithms-those without quantum memory-require exponentially many queries for certification. We then show that coherent algorithms-general quantum algorithms with quantum memory-can achieve a quadratic speedup over incoherent algorithms through our query-optimal algorithm based on quantum singular value transformation (QSVT), although coherent algorithms still require exponentially many queries. On the other hand, we show that this exponential hardness arises only in worst-case scenarios and can be significantly reduced for average-case unitary channels. In particular, we show that there exists a simple algorithm that certifies almost all unitary channels drawn from a natural average-case ensemble using only a constant number of queries. These results demonstrate an exponential gap between worst- and average-case query complexities, suggesting that certification is substantially easier in practice than in the worst-case scenario.

We organize our work as follows. In section “Problem setup”, we provide a detailed definition of the problem setup for unitary channel certification, along with essential definitions. In section “Background and contributions”, we address relevant prior works and highlight our contribution. In section “Worst-case query complexity”, we establish the tight query complexity for unitary channel certification, showing that unitary channel certification requires exponentially many queries. Conversely, in section “Average-case query complexity”, we show that for almost all unitary channels sampled from an average-case ensemble, the query complexity significantly reduces to a constant number. Finally, we summarize our findings and discuss their implications in section “Discussion”.

Problem setup

We define unitary channel certification as the task of testing whether a given unitary channel is either identical to or ε-far from a target unitary channel2,3,5,6. We detail the problem setup below. Suppose one has black-box access to a given unitary channel \({{\mathcal{E}}}_{U}(\rho ):=U\rho {U}^{\dagger }\), where U is a d-dimensional unitary operator acting on an n-qubit system with d = 2n. The given unitary channel \({{\mathcal{E}}}_{U}\) is intended to match a target unitary channel \({{\mathcal{E}}}_{V}\). However, in practice, systematic imperfections such as cross-talk or gate miscalibration may introduce coherent errors, causing \({{\mathcal{E}}}_{U}\) to deviate from \({{\mathcal{E}}}_{V}\). Therefore, certification is required to guarantee that we are implementing a desired unitary circuit, using as few queries to \({{\mathcal{E}}}_{U}\) as possible.

We formally define the certification task as follows: testing whether the channel \({{\mathcal{E}}}_{U}\) is identical to \({{\mathcal{E}}}_{V}\) or ε-far from \({{\mathcal{E}}}_{V}\) using N queries to \({{\mathcal{E}}}_{U}\) with success probability at least 2/3. Here, by applying a unitary transformation of the form ρ ↦ V†ρV, we can simplify the task to certifying whether the unitary channel \({{\mathcal{E}}}_{U{V}^{\dagger }}\) is identical to the identity channel \({{\mathcal{E}}}_{I}\).Thus, without loss of generality, we set the target channel to be the identity channel and redefine the certification task as follows: testing whether the channel \({{\mathcal{E}}}_{U}\) is identical to \({{\mathcal{E}}}_{I}\) or ε-far from \({{\mathcal{E}}}_{I}\) using N queries to \({{\mathcal{E}}}_{U}\) with success probability at least 2/3. Thus, certification can be framed as a hypothesis-testing problem:

$${H}_{0}:{{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\quad \,\text{vs.}\,\quad {H}_{1}:D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon ,$$
(1)

with a suitable distance metric D( ⋅ , ⋅ ). Here, if \(0 < D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I}) < \varepsilon\), the algorithm is allowed to output either hypothesis. We employ the diamond distance as the distance metric:

$$D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{V})=\mathop{\max }\limits_{\rho }\parallel ({{\mathcal{E}}}_{U}\otimes {{\mathcal{E}}}_{I})(\rho )-({{\mathcal{E}}}_{V}\otimes {{\mathcal{E}}}_{I})(\rho ){\parallel }_{1},$$
(2)

where ∥ ⋅ ∥1 denotes the Schatten-1 norm defined by \(\parallel M{\parallel }_{1}={\rm{Tr}}(\sqrt{{M}^{\dagger }M})\). Note that the diamond distance captures the worst-case trace distance between output states over all possible input states26.

We consider two types of algorithms for certification: incoherent and coherent. Incoherent algorithms, illustrated in Fig. 1a, perform positive operator-valued measurements (POVMs) after each of the N queries. These algorithms can be adaptive using classical registers to select both input states and POVMs based on previous measurement outcomes. This approach is practically motivated as storing quantum states across multiple queries in quantum memory is technically challenging. In contrast, coherent algorithms, illustrated in Fig. 1b, maintain quantum coherence across queries by storing intermediate quantum states. More specifically, a single input state sequentially passes through N circuit layers, each consisting of the ancilla-coupled unitary channel \({{\mathcal{E}}}_{U}\) and an interleaved CPTP map \({{\mathcal{C}}}_{k}\) for 1≤k≤N. A final POVM is then performed for certification. In this work, we extend this conventional framework to cover a wider range of quantum algorithms. Specifically, we allow arbitrarily large ancillary systems for both types of algorithms. We also permit the use of the inverse channel \({{\mathcal{E}}}_{{U}^{\dagger }}\) in place of certain queries to \({{\mathcal{E}}}_{U}\), noting that such access is often feasible in practice when \({{\mathcal{E}}}_{U}\) is given as a quantum circuit, as reversing the gate sequence and inverting each gate suffices to implement \({{\mathcal{E}}}_{{U}^{\dagger }}\). Under these assumptions, coherent algorithms represent the most general class, encompassing incoherent algorithms as a special case.

Fig. 1: Incoherent and coherent algorithms.
figure 1

a Incoherent algorithm. The double line represents the classical registers. b Coherent algorithm. \({{\mathcal{C}}}_{k}\) for 1 ≤ k ≤ N represents a CPTP map that we apply at k-th step as part of the algorithm. We allow arbitrarily large ancillary systems for both algorithms.

Full size image

Background and contributions

Let us review prior works to highlight the key contributions of our work in comparison. The most relevant prior studies are the ones in refs. 2,3, which address the general channel certification problem: certifying whether a given CPTP channel is either identical to or ε-far from a target unitary channel in the diamond distance. Specifically, ref. 2 establishes a tight query complexity of Θ(d/ε2) for incoherent algorithms, while ref. 3 proves a lower bound of \(\Omega (\sqrt{d}/\varepsilon )\) for coherent algorithms but does not provide a matching upper bound. These results indicate that certifying a CPTP channel in a high-dimensional system is inherently a challenging task.

But is this hardness truly relevant in practice? Recent progress on preserving quantum coherence24,25 and achieving high gate fidelities27 suggests that nearly noiseless quantum processes may be feasible in the near term. This allows us to anticipate regimes in which incoherent errors, such as decoherence or dephasing, can be reasonably disregarded, thereby restricting the relevant family of CPTP channels for certification28. On the other hand, coherent errors, i.e., unitary-type errors, nevertheless remain, leading us to consider certification of unitary channels as the practically relevant setting.

Thus, it is natural and essential to ask whether the hardness of certification persists when the given CPTP channel is restricted to be unitary. Our first contribution is to show that the same lower bounds hold even under this unitary assumption, i.e., incoherent and coherent algorithms require Ω(d/ε2) and \(\Omega (\sqrt{d}/\varepsilon )\) queries for unitary channel certification, respectively, thereby strengthening the previous results. This result has two major implications: First, coherent (i.e., unitary) error is a fundamental source of the exponential hardness in quantum process certification. Second, despite the recent advances in reducing incoherent errors, the exponential hardness of certification remains unavoidable.

Nevertheless, finding an optimal quantum algorithm for certification remains an important challenge. Our second contribution is to develop a query-optimal certification algorithm for coherent strategies, achieving the tight complexity of \(\Theta (\sqrt{d}/\varepsilon )\) by employing QSVT. This implies that using quantum memory to combine multiple queries coherently can yield a quadratic speedup in certification.

Due to the high complexity of certification under the diamond distance, prior research has attempted to relax the task by considering alternative distance measures. In particular, these works have employed average-case distances to achieve constant query complexity by avoiding the hardness associated with worst-case instances. Reference 4 showed a constant query complexity \({\mathcal{O}}(1/{\varepsilon }^{2})\) for certification under a fidelity-based distance \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{V})=\sqrt{1-| {\rm{Tr}}({U}^{\dagger }V){| }^{2}/{d}^{2}}\), and more recently ref. 3 showed the same query complexity for an average-case imitation diamond distance \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{V})=\parallel ({{\mathcal{E}}}_{U}\otimes {{\mathcal{E}}}_{I})(\Phi )-({{\mathcal{E}}}_{V}\otimes {{\mathcal{E}}}_{I})(\Phi ){\parallel }_{1}\) where Φ is a maximally entangled state over two d-dimensional Hilbert spaces. Although these average-case results significantly ease the query complexity, their relevance to practical certification remains less clear.

As our last contribution, we show a constant query complexity \({\mathcal{O}}(1/{\varepsilon }^{2})\) for certification with the diamond distance by considering the average-case channels. We show that there exists a simple algorithm achieving this complexity for almost all unitary channels sampled from a natural average-case distribution. Here, the fraction of exceptional channels is on the order of \(\exp (-\Omega (d))\), which is exponentially small in the system dimension. This suggests that certification is significantly less challenging in practice than previously believed, offering a highly relevant framework for practical certification.

Worst-case query complexity

We now present our main result. We begin by establishing the query complexity of unitary channel certification in the standard worst-case scenario, i.e., the number of queries required to certify an arbitrary unitary channel.

Query complexity for incoherent algorithms

We prove that certifying unitary channels requires exponentially many queries for incoherent algorithms even when using arbitrarily large ancillary systems and adaptive strategies. Our result is stated as follows:

Theorem 1

Consider an adaptive, incoherent algorithm with an arbitrarily large ancillary system, which tests whether \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\) or \({{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) with success probability at least 2/3. For ε < 1/2 and d > 50ε2, the required number of queries to \({{\mathcal{E}}}_{U}\) (or \({{\mathcal{E}}}_{{U}^{\dagger }}\)) is N = Ω(d/ε2).

This result strengthens the established lower bound that incoherent algorithms require Ω(d/ε2) queries to certify general CPTP channels2. Specifically, it shows that the same bound applies even when the given CPTP channel is guaranteed to be unitary.

To prove Theorem 1, we consider a related hypothesis-testing task, which serves as a restricted version of the certification task. Let Eε be an ensemble of ε-perturbed unitary channels \({{\mathcal{E}}}_{U}\), each satisfying \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})=\varepsilon\). We consider testing whether \({{\mathcal{E}}}_{U}\) is the identity channel or is sampled from the ensemble Eε:

$${H}_{0}:{{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\quad \,\text{vs.}\,\quad {H}_{1}:{{\mathcal{E}}}_{U} \sim {E}_{\varepsilon }.$$
(3)

Since a channel \({{\mathcal{E}}}_{U}\) sampled from Eε always satisfies \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\) by construction, any algorithm that successfully certifies unitary channels must be able to distinguish these two hypotheses. Thus, the query complexity of this hypothesis test provides a lower bound on the complexity of the original certification task. Therefore, it is sufficient to analyze the query complexity of this problem to derive the lower bound of the unitary channel certification problem.

We now construct an ensemble Eε to which the corresponding hypothesis testing requires many queries. The ensemble we construct is given as follows:

$${E}_{\varepsilon }={\{{{\mathcal{E}}}_{{U}_{\psi }}\}}_{\left\vert \psi \right\rangle \sim \text{Haar}},$$
(4)
$${U}_{\psi }:=I+({e}^{2i{\sin }^{-1}(\varepsilon /2)}-1)\left\vert \psi \right\rangle \left\langle \psi \right\vert ,$$
(5)

where \(\vert\psi\rangle\) is a d-dimensional Haar-random state. Here, each unitary channel \({{\mathcal{E}}}_{{U}_{\psi }}\) in this ensemble induces a phase shift of \(2{\sin }^{-1}(\varepsilon /2)\) only on the basis \(\vert\psi\rangle\) and acts as the identity elsewhere (see Fig. 2). Reflecting this structure, we refer to \({{\mathcal{E}}}_{{U}_{\psi }}\) as the single-basis rotation channel and to the ensemble Eε as the single-basis rotation ensemble. To confirm that Eε forms an ensemble of ε-perturbed unitary channels from the identity channel, we examine the structure of the diamond distance \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\). The following lemma expresses it in terms of the eigenangles θ1, …, θd, the arguments of the complex eigenvalues \({e}^{i{\theta }_{1}},\ldots ,{e}^{i{\theta }_{d}}\) of the unitary operator U:

Fig. 2: Circuit implementation of a single-basis rotation channel \({{\mathcal{E}}}_{{U}_{\psi }}\).
figure 2

The unitary operator Vψ maps the basis state \(\left\vert \psi \right\rangle\) to the computational basis state \({\left\vert 1\right\rangle }^{\otimes n}\). The controlled-rotation gate applies a phase shift of \(2{\sin }^{-1}(\varepsilon /2)\) to this computational basis component. As a result, the entire circuit behaves as a phase-shifting channel for the \(\left\vert \psi \right\rangle\) basis and as an identity channel for all other bases.

Full size image

Lemma 1

(6,11) Let [θmin, θmax] be the shortest interval including all eigenangles of U. Then for ε < 2, \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})=\varepsilon\) is equivalent to \({\theta }_{{\rm{max}}}-{\theta }_{{\rm{min}}}=2{\sin }^{-1}(\varepsilon /2)\).

Applying this lemma to the channel \({{\mathcal{E}}}_{{U}_{\psi }}\), only one eigenangle corresponding to the \(\left\vert \psi \right\rangle\) basis is nonzero (equal to \(2{\sin }^{-1}(\varepsilon /2)\)), while the remaining eigenangles are all zero. Thus, we have \({\theta }_{\min }=0\) and \({\theta }_{\max }=2{\sin }^{-1}(\varepsilon /2)\), confirming that \({{\mathcal{E}}}_{{U}_{\psi }}\) is ε-perturbed as \(D({{\mathcal{E}}}_{{U}_{\psi }},{{\mathcal{E}}}_{I})=\varepsilon\); thus, Eε is an ensemble of ε-perturbed unitary channels from the identity channel.

Now, we conclude that testing the hypothesis-distinguishing an identity channel from a random channel from Eε-is exponentially hard for an incoherent algorithm, requiring Ω(d/ε2) queries. The rest of the proof is outlined in the following proof sketch:

Proof sketch of Theorem 1

We employ LeCam’s two-point method29 to analyze the hypothesis testing problem defined in Eq. (3). This method relates the testing error probability to the total variation distance (TVD) between the probability distributions of observables under the two hypotheses. More specifically, LeCam’s method implies that achieving a small testing error requires a sufficiently large TVD between these distributions. Thus, we show that a query complexity of Ω(d/ε2) is necessary to obtain such a large TVD. This directly implies that the same complexity is required for the certification task.

Our proof proceeds in two main steps. First, we define a suitable good set of the measurement outcomes and show that for arbitrary measurements, most outcomes lie within this set, except possibly for a small fraction. Next, we show that within this good set, the likelihood ratio between the distributions corresponding to the two hypotheses is concentrated around 1, i.e., the two hypotheses are informationally hard to distinguish. To quantify this concentration rigorously, we employ a martingale-based concentration inequality from ref. 19. This step yields an explicit upper bound on the achievable TVD as a function of the number of queries N. Together, these results establish the claimed complexity lower bound. The detailed proof is provided in Supplementary Material (SM) Sec. S1 (Supplemental material).□

Note that this lower bound is tight as there exists a matching upper bound established by ref. 2. Specifically, the following algorithm based on random state preparation and measurement achieves the matching upper bound of \({\mathcal{O}}(d/{\varepsilon }^{2})\):

Algorithm 1

Query-optimal incoherent algorithm for unitary channel certification2

Input: N copies of an d-dimensional unitary channel \({{\mathcal{E}}}_{U}\).

Output: Decide whether \({H}_{0}:{{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) or \({H}_{1}:D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\).

1: for i = 1 to N do

2:   Input Haar-random \(\left\vert \psi \right\rangle\) to \({{\mathcal{E}}}_{U}\).

3:   Measure output with POVM \(\{\left\vert \psi \right\rangle \left\langle \psi \right\vert ,I-\left\vert \psi \right\rangle \left\langle \psi \right\vert \}\).

4:   Obtain outcome Xi = 0 or Xi = 1, respectively.

5:   if Xi = 1 then

6:     return Decide H1.

7: return Decide H0.

Query complexity for coherent algorithms

In various quantum hypothesis-testing scenarios, jointly measuring multiple queries simultaneously-known as joint measurement-often yields substantial advantages compared to measuring each query individually30,31,32. Thus, it is valuable to extend our analysis beyond incoherent algorithms and consider general coherent algorithms.

We prove that unitary channel certification requires exponentially many queries, even for coherent algorithms with arbitrarily large ancillary systems. This result highlights the fundamental hardness of certification. Our result is stated as follows:

Theorem 2

Consider a coherent algorithm with an arbitrarily large ancillary system, which tests whether \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\) or \({{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) with success probability at least 2/3. For ε < 1/2, the required number of queries to \({{\mathcal{E}}}_{U}\) (or \({{\mathcal{E}}}_{{U}^{\dagger }}\)) is \(N=\Omega (\sqrt{d}/\varepsilon )\).

This strengthens the established lower bound that coherent algorithms require \(\Omega (\sqrt{d}/\varepsilon )\) queries to certify general CPTP channels3. Specifically, it shows that the same lower bound applies even when the channel is guaranteed to be unitary. This also generalizes the lower bound for Boolean function certification, which requires \(\Omega (\sqrt{d})\) queries4.

Proof sketch of Theorem 2

Consider the output states ρ0 and ρ1 corresponding to hypotheses H0 and H1 in Eq. (3), respectively. The hypothesis-testing error probability is bounded by the trace distance between these two states33. In coherent algorithms, each pair of an ancilla-coupled channel \({{\mathcal{E}}}_{U}\) and the CPTP map \({{\mathcal{C}}}_{k}\) can increase this trace distance by at most \({\mathcal{O}}(\varepsilon /\sqrt{d})\), due to the contractivity of trace distance under CPTP maps34. Therefore, achieving an error probability of at least 2/3 requires query complexity \(\Omega (\sqrt{d}/\varepsilon )\). The detailed proof is provided in SM Sec. S2 A (Supplemental material). We note that the proof is similar to the one given by ref. 3. □

Theorem 2 highlights the exponential hardness of certification. Meanwhile, we observe that if information about the basis state \(\left\vert \psi \right\rangle\) associated with each single-basis rotation channel \({{\mathcal{E}}}_{{U}_{\psi }} \sim {E}_{\varepsilon }\) is given, one can certify \({{\mathcal{E}}}_{{U}_{\psi }}\) using only constant queries of \({\mathcal{O}}(1/{\varepsilon }^{2})\) via the Hadamard test on the channel \({{\mathcal{E}}}_{{U}_{\psi }}\) and the state \(\left\vert \psi \right\rangle\). This indicates that the hardness given in Theorem 2 arises from the unknown information on the phase-rotating basis state \(\left\vert \psi \right\rangle\) of \({{\mathcal{E}}}_{{U}_{\psi }}\).

This type of issue is frequently referred to as finding a needle in a haystack, as one has to find a single basis state in a large-dimensional Hilbert space. A well-known solution to this is Grover’s algorithm, which achieves a quadratic speedup over the brute-force approach in a basis-search problem35,36. Motivated by this, we present a novel Grover-like algorithm achieving the optimal query complexity of \({\mathcal{O}}(\sqrt{d}/\varepsilon )\), thereby exhibiting a quadratic speedup compared to incoherent algorithms. Our result is stated as follows:

Theorem 3

There exists a coherent algorithm that tests whether \({{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) or \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\) with success probability at least 2/3 using \(N={\mathcal{O}}(\sqrt{d}/\varepsilon )\) queries to \({{\mathcal{E}}}_{U}\) and \({{\mathcal{E}}}_{{U}^{\dagger }}\).

Together with Theorem 2, this establishes a tight query complexity of \(\Theta (\sqrt{d}/\varepsilon )\) for unitary channel certification with coherent algorithms. This also implies that allowing quantum memory between queries leads to a quadratic speedup-by a factor of \(\Theta (\sqrt{d}/\varepsilon )\)-over incoherent algorithms. We note that access to the inverse channel \({{\mathcal{E}}}_{{U}^{\dagger }}\) is not a stringent assumption as U is often implemented as a quantum circuit composed of a known sequence of standard gates, in which case \({{\mathcal{E}}}_{{U}^{\dagger }}\) can be realized by simply reversing the gate sequence and replacing each gate with its inverse. In addition, the same assumption is also used in Theorems 1 and 2 for a fair comparison.

We provide an intuitive description of our algorithm by comparing it with Grover’s algorithm, leaving the full version to the end of the section. The goal of Grover’s algorithm is to search for the bit-flipping basis \(\left\vert m\right\rangle\) with an oracle \(I-2\left\vert m\right\rangle \left\langle m\right\vert\). To achieve this, Grover’s algorithm amplifies the overlap between an initial superposition state \(\left\vert s\right\rangle =(\left\vert 1\right\rangle +\cdots +\left\vert d\right\rangle )/\sqrt{d}\) and the target state \(\left\vert m\right\rangle\), using alternating rotations around \(\left\vert s\right\rangle\) and \(\left\vert m\right\rangle\). By precisely tuning the number of rotations, one can drive the input state towards the target state \(\left\vert m\right\rangle\), thus achieving the searching task. In contrast, our algorithm performs a process of amplitude deamplification, reducing the initially large overlap between two states-a Haar-random state \(\left\vert \psi \right\rangle\) and a slightly-rotated \(U\left\vert \psi \right\rangle\)-to near zero. More specifically, the algorithm takes a Haar-random input state \(\left\vert \psi \right\rangle\) and applies alternating rotations around \(\left\vert \psi \right\rangle\) and \(U\left\vert \psi \right\rangle\). Under H1, this drives the state toward a state orthogonal to \(\left\vert \psi \right\rangle\), while under H0, the rotations preserve the initial \(\left\vert \psi \right\rangle\). A POVM \(\{\left\vert \psi \right\rangle \left\langle \psi \right\vert ,I-\left\vert \psi \right\rangle \left\langle \psi \right\vert \}\) then distinguishes between H0 and H1, certifying the unitary channel.

A central challenge in adapting Grover’s approach lies in the uncertainty of the appropriate number of rotations. Grover’s algorithm requires a precise number of rotations, which is a fixed value depending on the initial overlap \(\langle s| m\rangle =1/\sqrt{d}\). In our case, the number of rotations depends on the overlap \(\left\langle \psi \right\vert {U}^{\dagger }\left\vert \psi \right\rangle\) between \(\left\vert \psi \right\rangle\) and \(U\left\vert \psi \right\rangle\), which is unknown and varies with both U and the randomly chosen \(\left\vert \psi \right\rangle\). Thus, we cannot directly adopt Grover’s iterative structure.

Therefore, we leverage QSVT, a powerful framework for designing quantum algorithms based on polynomial transformations of operators37,38. We briefly introduce the key concept of QSVT to fully construct our algorithm. Suppose one has black-box access to a unitary operator V and its inverse V†. Let Π and \(\tilde{\Pi }\) be orthogonal projections, and consider the sub-block \(S=\Pi V\tilde{\Pi }\) of V, which can be expressed in block-encoding form as:

$$\begin{array}{l} \,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\Pi \\ V=\begin{array}{l}\tilde{\Pi }\\ \,\end{array}\left[\begin{array}{ll}S&\cdot \\ \cdot &\cdot \end{array}\right].\end{array}$$
(6)

QSVT enables a polynomial transformation of the singular values of S using V, V†, and phase rotations controlled by the projectors Π and \(\tilde{\Pi }\). To illustrate, let \(S=W\Sigma {\tilde{W}}^{\dagger }\) be the singular value decomposition of the sub-block S. Then, QSVT yields a new operator \({P}^{(\text{SV})}(S)=WP(\Sigma ){\tilde{W}}^{\dagger }\) for a real polynomial P satisfying certain conditions. This leads to the following transformed block encoding:

$$\begin{array}{l} \,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\,\Pi \\ {V}_{\Phi }=\begin{array}{l}\tilde{\Pi }\,{\rm{or}}\,\Pi \\ \,\end{array}\left[\begin{array}{ll}{P}^{({\rm{SV}})}(S)&\cdot \\ \cdot &\cdot \end{array}\right],\end{array}$$
(7)

where VΦ is the result of a QSVT circuit. The procedure for constructing the QSVT circuit is formally stated in the following lemma:

Lemma 2

(37) Let Π and \(\tilde{\Pi }\) be orthogonal projections and define Πϕ: =eiϕ(2Π−I) as a projector-controlled phase-rotation gate with angle ϕ. Suppose P is a real polynomial satisfying:

  1. (1)

    deg(P) = n

  2. (2)

    P shares the same parity as n.

  3. (3)

    ∣P(x)∣ ≤ 1 for x ∈ [ −1, 1].

Then, for a given unitary operator V, there exist angles Φ = (ϕ1, …, ϕn) such that the unitary operator

$${V}_{\Phi }=\left\{\begin{array}{ll}{\tilde{\Pi }}_{{\phi }_{1}}V\mathop{\prod }\limits_{k = 1}^{(n-1)/2}{\Pi }_{{\phi }_{2k}}{V}^{\dagger }{\tilde{\Pi }}_{{\phi }_{2k+1}}V\quad &n\,{is\,odd}\,\\ \mathop{\prod }\limits_{k = 1}^{n/2}{\Pi }_{{\phi }_{2k-1}}{V}^{\dagger }{\tilde{\Pi }}_{{\phi }_{2k}}V\quad &n\,{is\,even}\,\end{array}\right.$$
(8)

satisfies

$${P}^{(\text{SV})}(\Pi V\tilde{\Pi })=\left\{\begin{array}{ll}\Pi {V}_{\Phi }\tilde{\Pi }\quad &n\,{is\,odd}\,\\ \Pi {V}_{\Phi }\Pi \quad &n\,{is\,even}\,\end{array}\right..$$
(9)

Details on determining the rotation angles Φ from the polynomial P can be found in ref. 37.

Collecting the results, we now present the full description of our algorithm. Our algorithm proceeds in three steps: prepare a Haar-random state \(\left\vert \psi \right\rangle\), apply a QSVT operator VΦ, and perform a POVM \(\{\left\vert \psi \right\rangle \left\langle \psi \right\vert ,I-\left\vert \psi \right\rangle \left\langle \psi \right\vert \}\). Following the notation in Lemma 2, we construct the operator VΦ using projections \(\Pi =\left\vert \psi \right\rangle \left\langle \psi \right\vert\) and \(\tilde{\Pi }=U\left\vert \psi \right\rangle \left\langle \psi \right\vert {U}^{\dagger }\), along with a real polynomial P chosen as a rescaled Chebyshev polynomial. Under this construction, VΦ corresponds to a sequence of alternating rotations around \(\left\vert \psi \right\rangle\) and \(U\left\vert \psi \right\rangle\) with rotation angles determined by the polynomial P. We show that for almost every Haar-random \(\left\vert \psi \right\rangle\), this transformation maps the initial singular value \(\left\vert \left\langle \psi \right\vert {U}^{\dagger }\left\vert \psi \right\rangle \right\vert\) to a transformed singular value \(\left\vert \left\langle \psi \right\vert {V}_{\Phi }\left\vert \psi \right\rangle \right\vert\) that is close to one under H0 and close to zero under H1, without requiring knowledge of the exact overlap between \(\left\vert \psi \right\rangle\) and \(U\left\vert \psi \right\rangle\). This ensures that the measurement outcome reliably distinguishes between the two hypotheses, therefore enabling certification of the given channel. Furthermore, we show that the QSVT circuit VΦ can be implemented using \({\mathcal{O}}(\sqrt{d}/\varepsilon )\) queries to \({{\mathcal{E}}}_{U}\) and \({{\mathcal{E}}}_{{U}^{\dagger }}\), thereby proving Theorem 3. The complete proof is provided in SM Sec. S2 B (Supplemental material), and we summarize the algorithm below:

Algorithm 2

Query-optimal coherent algorithm for unitary channel certification

Input: Unitary channel \({{\mathcal{E}}}_{{V}_{\Phi }}\) from QSVT, using N copies of \({{\mathcal{E}}}_{U}\) and \({{\mathcal{E}}}_{{U}^{\dagger }}\).

Output: Decide whether \({H}_{0}:{{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) or \({H}_{1}:D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\).

 1: Input Haar-random \(\left\vert \psi \right\rangle\) to \({{\mathcal{E}}}_{{V}_{\Phi }}\).

 2: Measure output with POVM \(\{\left\vert \psi \right\rangle \left\langle \psi \right\vert ,I-\left\vert \psi \right\rangle \left\langle \psi \right\vert \}\).

 3: Obtain outcome M = 0 or M = 1, respectively.

 4: if M = 0 then

 5:   return Decide H0.

 6: else

 7:   return Decide H1.

Average-case query complexity

So far, we have established the exponential hardness of unitary channel certification by showing that the identity channel is hard to distinguish from a randomly sampled single-phase rotation channel \({{\mathcal{E}}}_{{U}_{\psi }}\), where \(\left\vert \psi \right\rangle\) is sampled from the Haar measure. Here, the channel \({{\mathcal{E}}}_{{U}_{\psi }}\) can be viewed as a multiqubit-controlled phase rotating operation (see Fig. 2), which is highly nonlocal and unlikely to arise under standard local noise models. This naturally raises the question of whether the exponential hardness we established is overly pessimistic or rarely encountered in practical situations. Indeed, efficient algorithms for average-case scenarios commonly exist across various quantum testing frameworks, such as quantum channel learning39 and quantum state certification40. Motivated by these observations, we examine the following question: Can the hardness of certification be relaxed if we consider average-case unitary channels?

To address this question, we first need to clearly define what constitutes the average case for random unitary channels. A conventional and natural choice of a random unitary ensemble is the circular unitary ensemble (CUE), which corresponds to the Haar measure over the unitary group41,42. However, in our setting, the CUE itself is not an appropriate notion of average-case unitary channels because the CUE does not adequately represent ε-perturbed unitary channels, and thus fails to offer a fair comparison with the single-basis rotation ensemble Eε. For a fair comparison, we must instead consider an ensemble consisting exclusively of ε-perturbed unitary channels. Thus, we introduce the ensemble ε-CUE, defined as the marginal distribution of the CUE conditioned on the channel being ε-perturbed. Precisely, its corresponding measure με−CUE is given as:

$${\mu }_{\varepsilon -{\rm{CUE}}}(A):={\Pr }_{U \sim {\rm{CUE}}}(U\in A| D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})=\varepsilon )$$
(10)

for a set A.

We show that for almost every randomly chosen unitary U ~ ε−CUE, except for an exponentially small fraction, there exists a simple, nonadaptive, and ancilla-free algorithm capable of certifying the channel \({{\mathcal{E}}}_{U}\) using only a constant number of queries. Our result is stated as follows:

Theorem 4

Suppose a random unitary channel \({{\mathcal{E}}}_{U}\) is given with U ~ ε−CUE under ε < 1/2 and dimension d ≥ 4. There exists an algorithm that tests whether \(D({{\mathcal{E}}}_{U},{{\mathcal{E}}}_{I})\ge \varepsilon\) or \({{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\) with success probability at least 2/3 using \(N={\mathcal{O}}(1/{\varepsilon }^{2})\) queries, except for \(\exp (-\Omega (d))\) fraction of U.

In other words, this implies the existence of an efficient algorithm that can test the following hypotheses with high probability:

$${H}_{0}:{{\mathcal{E}}}_{U}={{\mathcal{E}}}_{I}\quad \,{\text{vs.}}\,\quad {H}_{1}:U \sim \varepsilon -{\rm{CUE}}.$$
(11)

Theorem 4 establishes an exponentially large gap between the query complexity of worst-case and average-case scenarios, as illustrated in Fig. 3. This emphasizes the importance and practical relevance of considering the average-case scenario in quantum process certification.

Fig. 3: Visualization of query complexities for ε-perturbed unitary channels.
figure 3

The spherical shell represents the set of ε-perturbed unitary channels sampled from ε−CUE. The green region represents average-case channels, which can be certified using \({\mathcal{O}}(1/{\varepsilon }^{2})\) queries. The red region represents the single-basis rotation ensemble Eε, which requires \(\Omega (\sqrt{d}/\varepsilon )\) queries for certification. The white region represents a small exceptional subset of measure \(\exp (-\Omega (d))\) with unknown complexity. Note that the colored regions do not correspond to genuine geometric relations in the space of ε−CUE.

Full size image

Algorithm 1 introduced in section “Query complexity for incoherent algorithms” achieves the query complexity stated in Theorem 4. We point out that the algorithm employs simple methods involving random state preparation and measurement, without requiring ancillas or adaptive operations. In addition, it can be efficiently simulated using a unitary 2-design, which can be implemented with shallow quantum circuits of depth \({\mathcal{O}}(\log \log \log d)\) composed of random Clifford gates43. These observations show that the optimal query complexity can be achieved by an algorithm with a simple structure.

The constant query complexity of Algorithm 1 in the average-case scenario stems from a structural property of Haar-random unitaries. The eigenvalues of the CUE can be modeled as interacting Brownian particles on a unit circle with inter-particle repulsion44. Thus, for ε−CUE, these eigenvalues behave as repulsive particles confined within an arc of length \(2{\sin }^{-1}(\varepsilon /2)\). Consequently, the eigenangles from ε−CUE are well-distributed within this region with high probability, leading to an eigenangle variance of order ε2. In contrast, worst-case channels from Eε channels have highly concentrated eigenangles; Only one eigenangle differs significantly, resulting in an exponentially smaller eigenangle variance of order ε2/d. Our proof of Theorem 4 leverages this observation, showing that Algorithm 1 can certify channels having well-distributed eigenangles with \({\mathcal{O}}(1/{\varepsilon }^{2})\) queries. A detailed proof is given in SM Sec. S3 (Supplemental material).

We numerically simulate Algorithm 1 on unitary channels sampled from ε−CUE and verify our theoretical results. To sample unitary channels from ε−CUE, we apply the rejection sampling method using the eigenvalue distribution of the 2-Jacobi ensemble45. Then, for each sampled channel, we simulate the corresponding error probability, as shown in Fig. 4. The average behavior of the error probability curves is independent of the dimension d, even for a low dimension such as d = 4. Additionally, the variance in error probability greatly decreases as the dimension d increases. This aligns with our theoretical prediction that the proportion of exceptional edge cases decays exponentially as \(\exp (-\Omega (d))\). The figure also indicates that the required query complexity lies within realistic experimental ranges. Algorithm 1 requires ~105 queries to certify unitary channels up to precision ε = 0.01, corresponding to a deviation of roughly 1% in the worst-case basis. This query count is comparable to the number of circuit executions reported in recent large-scale experiments, such as Google’s Willow processor, which performed up to 106 surface-code cycles with a 1.1 μs repetition time46.

Fig. 4: Simulated error probabilities from numerical experiments of Algorithm 1.
figure 4

We plot error probabilities for 200 randomly sampled unitary channels drawn from ε−CUE, with the error threshold ε = 0.01 and dimensions a d = 4, b d = 32, and c d = 256. Each blue curve represents the error probability of a single channel as a function of the number of queries N. The red horizontal line indicates the targeted error threshold of 1/3.

Full size image

We distinguish our result from those in refs. 3,4, which show that certification under average-case distance requires a constant query complexity of \({\mathcal{O}}(1/{\varepsilon }^{2})\). In our case, we show that the same query complexity suffices for certifying average-case channels under the more stringent diamond distance. Our approach is operationally meaningful, as certification under the diamond distance provides uniform performance guarantees across all input states, whereas certification under average-case distance ensures correctness only on a specific input state26. Accordingly, our result indicates that fully reliable certification is available for almost every unitary channel, offering a stronger and more practical contribution to reliable quantum information processing.

Discussion

In this work, we have investigated the query complexity for unitary channel certification. We proved that an exponential number of queries is required to certify all unitary channels, while coherent algorithms can achieve a quadratic speedup over incoherent algorithms. We then proved that exponential hardness can be significantly relaxed for average-case unitary channels, which can be certified with a constant number of queries.

We highlight a notable technical contribution from our proof of Theorem 1. In many quantum hypothesis testing problems, proofs establishing query lower bounds for incoherent algorithms use a common technique: reducing the problem to distinguishing between a target object and an ensemble of slightly perturbed target objects2,3,16,17,18,19,22,23,47. Due to technical challenges, previous works relied on ensembles containing mixedness, such as an ensemble of mixed states or noisy channels. Our proof overcomes this limitation by extending the technique to an ensemble consisting solely of unitary channels (see SM Sec. S1 for details (Supplemental material)). Thus, we anticipate further applications of our approach in future work, including potential extensions of this lower bound to continuous variable systems, where analogous certification challenges remain largely unexplored.

We suggest some intriguing directions for future research. Extending our average-case result to general CPTP channel would be a critical step for efficient certification in practice. In this case, defining an appropriate measure of average-case CPTP channel would be essential. One could also investigate the query-optimal coherent certification algorithm that does not rely on the inverse channel \({{\mathcal{E}}}_{{U}^{\dagger }}\).