Introduction

Quantum many-body dynamics represents a forefront of our modern understanding of quantum mechanics with profound implications across fields such as quantum information science1,2,3,4, thermodynamics5,6,7, condensed matter physics8,9,10, and high-energy physics11,12,13. However, due to the hardness of simulating the dynamics, their properties are still not fully understood. One area of particular interest is quantum chaotic dynamics, with prototypical examples including the Sachdev-Ye-Kitaev (SYK) model14,15 and random quantum circuits16. A defining characteristic of chaos, both in classical and quantum systems, is the butterfly effect17,18,19, which asserts that local information in an initial state quickly scrambles across an exponentially large space. Since tracking this scrambled information requires exponential resources, simulating such quantum dynamics using classical computers is generally intractable. This challenge has spurred the use of quantum devices to study quantum chaos4,20,21 with potential applications in quantum supremacy tasks22,23,24,25. Discovering new classes of quantum many-body dynamics could similarly yield unexpected insights across these fields.

A deep connection between quantum chaos and randomness offers a promising route for generating ensembles of quantum states26,27,28,29 close to uniformly random (i.e., Haar-random) quantum ensembles. As a quantum cryptographic primitive, Haar-random quantum ensembles have crucial applications in quantum information science including quantum cryptography30,31, quantum estimation theory32,33,34, and quantum complexity theory35. However, preparing a genuine Haar-random ensemble of quantum states demands exponentially deep circuits36, which current technology struggles to achieve. The recent formulation of pseudorandom quantum states37 has shed light on this problem by considering an ensemble of quantum states that even quantum computers cannot distinguish from Haar-random states within limited computation time, i.e., computationally indistinguishable, but are preparable with lower circuit depth. The pseudorandomness in quantum states and associated computational indistinguishability of various quantum resources like entanglement38, magic39, and coherence40, have found a wide range of applications in quantum information processing41,42,43,44,45.

Motivated by these previous developments, we introduce a new class of quantum many-body dynamics for quantum simulations, called ‘pseudochaotic dynamics,’ capable of generating pseudorandom states. Although pseudochaotic dynamics are not chaotic and thus fundamentally distinct from conventional chaotic dynamics, we demonstrate that they are surprisingly indistinguishable within limited computation time from chaotic ones through the defining metric of chaos, namely out-of-time-ordered correlators (OTOCs)46, which quantify the butterfly effect.

In this work, we provide a systematic construction of these dynamics by embedding the unitary dynamics of a k-qubit subsystem into the entire n-qubit quantum system. Remarkably, this approach is feasible even with a very small subsystem size with \(k=\omega (\log n)\) and a circuit depth of \(\omega (\log n)\). This depth without any conditions almost touches the shallowest depth for generating pseudorandom states made by assuming cryptographic assumptions38,47. Moreover, the subsystem’s dynamics need not be inherently chaotic, which contrasts strongly with our common understanding of quantum chaos. We also discuss how the properties of pseudochaos are related to coherence generated by the subsystem dynamics40, and other quantum resources studied in the context of pseudorandom quantum states, such as entanglement38, magic39.

Results

Pseudochaotic dynamics

We define pseudochaotic dynamics as a non-chaotic unitary time evolution with i. computational indistinguishability from chaotic time evolution via OTOCs, and ii. capability to generate pseudorandom states. The latter implies that the pseudochaotic dynamics loses its initial information over a certain time scale as like the former does.

Computational indistinguishability via OTOC

The OTOC of a unitary operator U with Pauli like local operators V and W, V2 = W2 = 1, at infinite temperature is46

$${O}_{VW}(U)=\frac{1}{{2}^{n}}{{{\rm{tr}}}}\left(VUW{U}^{{{\dagger}} }VUW{U}^{{{\dagger}} }\right).$$
(1)

This can be estimated in experiments by reverse time evolution or interferometric measurements48,49. OVW(U) can be thought of as an observable when we replace the trace operation by the inner product with the Bell pair state in the double copy space, and thus it can be estimated by measurements in that space.

In quantum chaotic systems, OVW(U) converges to zero as the time interval increases for any local operators V and W. In addition, the values of these converged OTOCs decrease exponentially with the system size19. Detecting this characteristic exponential decay in system size requires the uncertainties in the estimated OTOCs to also decay exponentially. However, if the number of realizable copies is limited to a polynomial in the system size, the uncertainties in estimating the OTOCs by a poly-time quantum algorithm scale at best as Ω(1/poly(n)) when the algorithm saturates the Heisenberg limit, making it impossible to observe the exponential decay of the OTOCs. Consequently, any dynamics with OTOCs scaling negligibly, i.e., OVW ~ o(1/poly(n)), for all time t ≥ t* for some constant t* > 0 becomes computationally indistinguishable from chaotic one by OTOCs. We take this indistinguishability as one criterion for U to be pseudochaotic.

Capability to generate pseudorandom states

An ensemble of chaotic unitary operators can generate Haar-random states50. We require that pseudochaotic dynamics produces a pseudorandom state ensemble37 in the same way. This capability of generating pseudorandom states is another manifestation of the indistinguishability of pseudochaotic dynamics from chaotic ones. For this, we note that a pseudorandom state ensemble is an ensemble that cannot be distinguished from a truly random ensemble using only a polynomial number of measurements and a poly-time quantum algorithm. This immediately implies that an ensemble of states generated through pseudochaotic dynamics as we explained above should be indistinguishable from one generated by fully chaotic dynamics within polynomial copies by any polynomial time (quantum) algorithm. Figure 1a illustrates this concept of the pseudochaotic dynamics.

Fig. 1: Overview.
figure 1

a A quantum computer simulates dynamics either from a chaotic ensemble or a pseudochaotic ensemble. Any poly-time quantum algorithm \({{{\mathcal{A}}}}\) on a polynomial number of copies with poly-time classical post-processing fails to pin down whether the dynamics is chaotic or not by measuring OTOC. An example of pseudochaotic dynamics is obtained by conjugating the dynamics in a subspace by a random permutation. To make this dynamics pseudochaotic, the dimension of the subspace 2k should be given by \(k=\omega (\log n)\) with the number of qubits n, which is much smaller than the entire space dimension 2n. A circuit implementation of this dynamics requires \({{{\rm{polylog}}}}(n)\) depth with all-to-all connectivity. b We can schematically classify how the late-time 1/OVW scales with n into three different regimes. In a chaotic system (orange color), this scaling is exponential in n. For a system with local scrambling (blue color), the scaling is at most polynomial in n. Pseudochaotic dynamics (peach color) exhibits the scaling which falls between these two. c The 2k-dimensional subspace is mapped to the entire space by isometries {Oa}. \({{{{\mathcal{V}}}}}_{{{{\rm{sub}}}}}\) is the space spanned by an ensemble of unitary operators {u} in the subspace, which could be non-chaotic. Through the action of Oa, \({{{{\mathcal{V}}}}}_{{{{\rm{sub}}}}}\) is mapped to \({{{\mathcal{V}}}}\) within the entire Hilbert space, preserving its dimension. Remarkably, even if the subspace dimension is negligibly smaller than the entire space dimension, its ensemble average over random isometries cannot be distinguished from chaotic dynamics by any poly-time quantum algorithms with access to polynomially many copies of evolved states.

Full size image

Explicit construction

We introduce a systematic construction for pseudochaotic dynamics, which we term ‘random subsystem-embedded dynamics (RSED)’. The RSED consists of two components: a random subset isometry Oa and an embedded unitary operator u in the subsystem. The random subset isometry is defined as

$${O}_{a}={\sum}_{b\in {\{0,1\}}^{k}}{(-1)}^{f(ba)}\left\vert p(ba)\right\rangle \left\langle ba\right\vert,$$
(2)

where k ≤ n represents a subsystem of size k within the total system of size n, and p and f are random permutation and function, respectively. Our key observation is that \(k=\omega (\log n)\) is necessary for RSED to be pseudochaotic. Below we always set \(k=\omega (\log n)\). The term a ∈ {0, 1}n−k serves as the seed for these random mappings. This isometry embeds a unitary operator u, acting on the 2k-dimensional subsystem Hilbert space, into the 2n-dimensional Hilbert space of the entire system.

The full unitary evolution of RSED is given by

$$U={\sum}_{a\in {\{0,1\}}^{n-k}}{O}_{a}u{O}_{a}^{{{\dagger}} }.$$
(3)

Figure 2b illustrates how dynamics in the subsystem is embedded into the entire system by an isometry Oa. The effect of the conjugation by {Oa} is equivalent to applying random permutation with random sign factors on the unitary operator in the entire space, u ⊗ I⊗(n−k). The time evolution operator with an evolution time t is

$${U}^{t}={\sum}_{a\in {\{0,1\}}^{n-k}}{O}_{a}{u}^{t}{O}_{a}^{{{\dagger}} },$$
(4)

because of \({O}_{a}^{{{\dagger}} }{O}_{{a}^{{\prime} }}={\delta }_{a,{a}^{{\prime} }}\). In principle, arbitrary u is allowed. However, for a RSED to be pseudochaotic, it is sufficient for ut to have negligibly small elements for all time t ≥ t* for some positive constant t* as we explain below. More details on the RSED can be found in Supplementary Note 1.

Fig. 2: Time dependence of OTOCs.
figure 2

Here we compute the OTOCs of OVW of (a, b) the Pauli SYK model and (c, d) H⊗kP with V = Zi and W = Zj with i ≠ j. a, c OVW of independent realizations. b, d Averaged OVW over random subset isometries and random realizations of the embedded u’s for various system sizes n. \({{\mathbb{E}}}_{p,f}{O}_{VW}\) in the caption denotes that the averaged OTOCs are computed using the closed formula in Method Eq. (12). For all cases, the subspace dimension is 2k with k = 10.

Full size image

Interestingly, the level statistics of a pseudochaotic RSED differ drastically from those of conventional chaotic systems due to exponential degeneracies in its energy spectrum. Thus, even when a chaotic u is chosen, the level statistics of the corresponding RSED deviate from the standard Wigner-Dyson distribution51,52. In contrast, the spectral form factor of the RSED closely follows the behavior of that of u. Further details can be found in Supplementary Note 10.

Negligible OTOC

We first show that if elements of u have negligible magnitudes in the computational basis, i.e., the diagonalizing basis of Oa, then an individual realization of the RSED has negligible OTOCs and thus cannot be distinguished from chaotic unitary evolutions via OTOC. Here, negligible, or negl(n) appeared below, means the magnitude of a quantity decays faster than inverse of any polynomial function of n.

Theorem 1

OTOCs with local operators are negligible with probabilities higher than 1 − negl(n) in the system size n for an individual realization of the RSED with an embedded unitary operator u of the dimension 2k with \(k=\omega (\log n)\) (sampled from an ensemble) if the maximum (averaged) magnitude of elements of the embedded operator u is O(2−k/2).

Proof

Details are in Theorem 5 of Supplementary Note 3.

Such u naturally includes general chaotic dynamics following the random matrix theory, whose time evolution operators have the matrix elements of order O(2−k/2) for all time t ≥ t* for some constant t* > 0. In literature, such t* is called the intermediate time regime for chaotic dynamics53.

Notably, non-chaotic u can also have such property. An example is the product of Hadamard gates H⊗k with a random sign operator P in the subsystem, namely u = H⊗kP. The matrix elements of ut are on average order of 2−k/2 for t ≥ t* ≈ 1 (See Supplementary Note 7). Thus, this RSED is expected to demonstrate negligible OTOCs for all t ≳ 1, according to Theorem 1. Indeed, we numerically confirm that individual realizations of the RSED exhibit negligibly small OVW as shown in Fig. 2a, b. By passing, we mention that without the sign randomization P, u = H⊗k alone cannot produce pseudochaotic dynamics and OTOCs are not suppressed as the matrix elements of ut do not persistently scale with 2−k/2 (Supplementary Note 8).

We also compute OTOCs of the RSED by embedding the Pauli SYK model54, which is chaotic. As expected, this RSED demonstrates vanishing OTOCs, see Fig. 2c, d. Importantly, the late-time saturated values of OVW for u = H⊗kP scale as negl(n), as clearly demonstrated in the log-log plot of OVW versus system size n (Fig. 3). Minor numerical details and additional data are available in Supplementary Note 7. By passing, we note that OTOCs at finite temperatures and those with non-local Pauli operators are also negligible (Supplementary Notes 4, 8).

Fig. 3: Scaling of late-time OTOCs OVW for random-phase Hadamard gates u = H⊗kP.
figure 3

In evaluating OTOCs Eq. (1), we chose V = Zi, W = Zj, i ≠ j, and \(k={(\log n)}^{2}\). The OTOCs are averaged over random isometries and random phase gates P. The time t at which the OTOC values are extracted is fixed to t = 4 for all system sizes n. Since the OTOCs approaches to the infinite-time values for t ≳ 1, any such value of t is sufficient to capture the late-time behavior. If the OTOCs scaled as an inverse polynomial in n, the data would appear as straight lines in the log-log plot. However, the observed curve (red solid line) is concave, indicating that the OTOCs decay faster than any inverse polynomial. The linear function fit with the numerical data (blue straight line) has the slope  ≈ −2.85 in this log-log plot.

Full size image

The exponential decay of OTOCs in evolution time and their associated exponents, known as Lyapunov exponents, are also well-established signatures of quantum chaotic systems13,53. However, for systems governed by nonlocal Hamiltonians, such as the pseudochaotic dynamics considered here, a well-defined Lyapunov exponent does not exist. Further details on this issue are provided in Supplementary Note 6.

Pseudorandom State Generator

We first demonstrate that RSED with chaotic u is a pseudorandom state generator. More precisely, we show that if an ensemble of u generates a pseudorandom state ensemble in the subsystem, then the corresponding ensemble of U in Eq. (3) produces a pseudorandom state ensemble in the entire Hilbert space.

Theorem 2

RSEDs with an ensemble of embedded unitary operators that generate a pseudorandom state ensemble in the subspace with a negligible error generate a pseudorandom state ensemble in the entire space.

Proof

This is proven in Theorem 6 of Supplementary Note 9.

Such an ensemble of chaotic u can be constructed by sampling time evolution operators from a single, fixed chaotic u, provided that the time interval exceeds its relaxation time. This immediately implies that the corresponding U produces a pseudorandom state ensemble by sampling states in time. This is nicely parallel to the generation of the Haar random state ensemble by sampling states in the time trajectory of a state under chaotic dynamics at a sufficiently long time interval50.

Next, we consider an ensemble of u with negligibly small elements with the unbiased mean magnitude of 2−k/2, e.g., ut for t ≥ t* ≈ 1 with u = H⊗kP, and show that the corresponding ensemble of RSED can also produce a pseudorandom state ensemble. Hence, such RSED serves as another example of pseudochaotic dynamics. We highlight that the subspace dynamics u does not need to be ergodic, as illustrated in Fig. 1c.

Theorem 3

Let \({{{{\mathcal{E}}}}}_{k}\) be an ensemble of unitary operators in a k-qubit subsystem with dimension K = 2k. Let us assume that for all \(u\in {{{{\mathcal{E}}}}}_{k}\), there exists ϵ > 0 such that

$$\Pr \left[{\left\vert {u}_{b,{b}^{{\prime} }}\right\vert }^{2}\ge {K}^{-\epsilon }\right]\le {{{\rm{negl}}}}(n)$$
(5)

for all b and \({b}^{{\prime} }\). In addition, let us assume that \({{\mathbb{E}}}_{u \sim {{{{\mathcal{E}}}}}_{k}}\left[{\left\vert {u}_{b,{b}^{{\prime} }}\right\vert }^{2}\right]={K}^{-1}\) holds for all b and \({b}^{{\prime} }\). Then, an ensemble of RSEDs with \({{{{\mathcal{E}}}}}_{k}\) generates an ensemble of pseudorandom states.

Proof

Let us consider an initial computational state \(\left\vert p(ba)\right\rangle\). This evolves under the subsystem embedded dynamics U with an embedded dynamics u as

$$U\left\vert p(ba)\right\rangle={\sum}_{{b}^{{\prime} }\in {\{0,1\}}^{k}}{u}_{{b}^{{\prime} },b}{(-1)}^{f(ba)+f({b}^{{\prime} }a)}\left\vert p({b}^{{\prime} }a)\right\rangle .$$
(6)

Let ρ be Hybrid 3 of ref. 38, and σ be the ensemble average of \(U\left\vert p(ba)\right\rangle\) over \({{{{\mathcal{E}}}}}_{k}\), random permutations p, and random functions f. Then, the triangular inequality gives

$${{{\rm{TD}}}}\left(\sigma,{\rho }_{{{{\rm{Haar}}}}}\right)\le {{{\rm{TD}}}}\left(\rho,{\rho }_{{{{\rm{Haar}}}}}\right)+{{{\rm{TD}}}}(\rho,\sigma )$$
(7)

with \({\rho }_{{{{\rm{Haar}}}}}=\int\,d{\psi }_{{{{\rm{Haar}}}}}\left\vert \psi \right\rangle {\left\langle \psi \right\vert }^{\otimes t}\). The first term on the right-hand side is negligible due to Lemma 3 of ref. 38. In addition, the second term TD(ρ, σ) is is negligible due to the assumption of \({{\mathbb{E}}}_{u \sim {{{{\mathcal{E}}}}}_{k}}\left[{\left\vert {u}_{b,{b}^{{\prime} }}\right\vert }^{2}\right]={K}^{-1}\) as shown in the proof of Theorem 7 of Supplementary Note 9.

While unitary operators in a general random ensemble have unbiased elements, it is not a necessary condition for a pseudochaotic dynamics. Indeed, even when elements are biased, RSED is pseudochaotic if u generates maximal relative entropy of coherence55 in computational basis with a negligible deviation. This sufficient condition is consistent with the necessary condition of \(\omega (\log n)\) coherence introduced in ref. 40. More details can be found from Theorem 8 of Supplementary Note 11.

Quantum circuit and its resources

We present an explicit quantum circuit for pseudochaotic RSED and the resources required to implement it.

The circuit consists of three steps, as shown in Fig. 4. The first and last steps apply quantum secure pseudorandom function and permutation in the entire system with \({{{\rm{polylog}}}}(n)\) depth circuits under the assumption of the sub-exponential hardness of the Learning with Errors (LWE) problem56,57,58,59. In the middle, only the subsystem evolves under dynamics generating nearly maximal coherence in the computational basis. The generation of maximal coherence can be achieved by products of Hadamard gates, so the time complexity for the middle step is Ω(1).

Fig. 4: Schematic circuit for RSED.
figure 4

Coherent evolution in (a) refers to unitary dynamics generating nearly maximal coherence in the subsystem. The sum of subsystem dynamics conjugated by random isometries in (b) can be implemented by pseudorandom function and permutation in the entire space in (a). This identity can be derived by inserting a resolution identity operator in the computational basis at the straight lines of the middle step in (a). See Supplementary Note 1 for details.

Full size image

The pseudochaotic RSED can be turned into a truly chaotic dynamics by increasing the number of entangling and non-Clifford gates in random permutation and function (the first and last steps in Fig. 4a), coherent gates in the subsystem dynamics, and the size of the subsystem (the middle step in Fig. 4a), which brings the ensemble of resulting states closer to Haar random states. More explicitly, the exponential decay of OTOC in system size, which is expected for general quantum chaotic systems, can be achieved once pseudorandom isometries are replaced by truly random unitaries by using exponentially many non-Clifford and entangling gates and embedding Ω(n) Hadamard gates60. On the other hand, using only one of these resourceful gates cannot decrease OTOCs and the trace distance with Haar random states. Thus, such a process cannot turn the RSED into chaotic dynamics.

Theorem 4

Each of entanglement, magic, and coherence of a pseudochaotic RSED can be increased independently without changing other resources and making the RSED chaotic.

Proof

Entanglement, magic, and coherence can be controlled independently by attaching random Clifford gates, random T-gates, and random Hadamard gates, respectively, to the end of the circuit in Fig. 4. Details can be found in Supplementary Note 12.

Discussion

In this work, we propose a new concept called pseudochaotic dynamics, which is a non-chaotic dynamics that cannot be distinguished from the maximally chaotic dynamics using polynomial resources. We further introduce the RSED as a systematic way to construct pseudochaotic dynamics and pseudorandom states. This dynamics can be implemented by pseudorandom permutation and function, which can be implemented by polylogarithmic depth circuits56,57,61,62, for example in Rydberg atoms or ion-trapped qubits63,64. Using this, we expect that pseudochaotic dynamics can be realized in near-term devices with a few dozens of qubits (Supplementary Note 13). Although it is not the primary focus of this work, an RSED can generate an approximate state t-design with the shallowest circuit depth among currently known protocols26,27,28,29,65,66,67, which will be detailed separately in ref. 60. These together make our RSED highly efficient for tasks such as classical shadow tomography33, benchmarking quantum circuits68, and even studying black holes69,70,71,72.

Let us highlight the distinctions between our work and previous studies38,39,73,74. First, our approach clearly contrasts with prior investigations of pseudorandom quantum states38,39, which primarily focused on quantum resource requirements. Instead, we emphasize the dynamical properties such as OTOCs of quantum circuits that generate pseudorandom states. Second, our construction of a pseudorandom state generator is distinct from prior work based on random gates74, which exhibit suppression of OTOCs on average by the operator mean field theory73. In contrast, our pseudochaotic RSED exhibit suppression of OTOCs for each individual realization. Additionally, we assume the hardness of the LWE problem which is believed to be secure against quantum attacks38,58,59, while ref. 74 relies on the assumption that security against a classical adaptive chosen-plaintext and chosen-ciphertext attack implies quantum security. Third, our work introduces a Hamiltonian-based RSED for generating pseudorandom states, opening the door to their realization in analog quantum simulators. This stands in sharp contrast to previous works38,39,74, which rely on quantum circuits implemented on digital quantum computers. Lastly, our pseudochaotic RSED achieves the known lower bound on circuit depth for generating pseudorandom states38,74.

We finish by discussing interesting future research directions. First, it will be interesting to clarify the relation between the two properties, having negligible OTOCs and generating pseudorandom states, of the pseudochaotic dynamics are related. Second, it would be also interesting to study dynamical properties of RSEDs with various embedded Hamiltonians including integrable ones, which could potentially lead to the discovery of a new class of quantum many-body dynamics. Another interesting question is to investigate whether typical pseudochaotic dynamics can be used to construct pseudorandom unitaries and whether these dynamics are difficult to simulate with classical algorithms. If both are true, the quantum advantage in random circuit sampling, which relies on typical circuits being close to Haar-random unitaries35,45,75, could be demonstrated with significantly lower circuit depth by replacing them with pseudochaotic dynamics. Answering these questions could, therefore, provide a new perspective on the connection between quantum computational advantage and quantum chaos26,76. Finally, we note a recent related work that introduces a similar concept of pseudochaos77. While our definition of pseudochaotic dynamics only requires negligible OTOCs and the generation of a pseudorandom state ensemble, ref. 77 imposes an additional constraint on the definition of pseudochaos to avoid producing states with high entanglement and magic. Notably, our construction of RSED encompasses the pseudo-Gaussian unitary ensemble introduced in ref. 77, by embedding an ensemble of unitaries whose eigenvalues follow Wigner’s semicircle distribution without level repulsions. Clarifying the precise relationship between the two definitions of pseudochaos remains an important direction for future work.

Methods

Out-of-time ordered correlators

A Poisson-bracket out-of-time ordered correlator quantifies how a local operator W spreads under a unitary evolution U by measuring the magnitude of parts of UWU† commuting with another local operator V. Formally, it is defined as

$${C}_{VW}(U)=\frac{1}{{2}^{n+1}}\,{{{\rm{tr}}}}\left({[UW{U}^{{{\dagger}} },V]}^{{{\dagger}} }[UW{U}^{{{\dagger}} },V]\right).$$
(8)

If U does not spread W much, then V at almost everywhere commutes with UWU†. Thus, CVW(U) is vanishing. On the other hand, if U is chaotic so makes UWU† be a sum of arbitrary non-local Pauli strings, then CVW saturates to unity. When local operators satisfy V2 = W2 = I like as Pauli operators, then it becomes

$${C}_{VW}(U)=1-\Re [{O}_{VW}(U)].$$
(9)

Here, OVW(U) is the OTOC used in the main text. Any chaotic U makes OVW(U) vanishingly small.

Calculation of OTOCs

Estimation of OVW(U) of a chaotic system is generally challenging as it requires to simulate the system. However, for the RSED, it is possible to calculate OVW(U) both analytically and numerically. Here, we compute OVW(U) with V = Zi and W = Zj with i ≠ j.

Let p and f be a random permutation and function, respectively. Then, OVW(U) is given by

$${O}_{VW}(U)= \frac{1}{{2}^{n}}\sum\limits_{{\{{a}_{i}\}}_{i=1}^{4},{\{{b}_{i}\}}_{i=1}^{8}}{(-1)}^{{\sum }_{i=1}^{8}f({b}_{i}{a}_{i})}\\ \times {V}_{p({b}_{8}{a}_{4}),p({b}_{1}{a}_{1})}{U}_{{b}_{1},{b}_{2}}{W}_{p({b}_{2}{a}_{1}),p({b}_{3}{a}_{2})}{U}_{{b}_{3},{b}_{4}}^{{{\dagger}} }\\ \times {V}_{p({b}_{4}{a}_{2}),p({b}_{5}{a}_{3})}{U}_{{b}_{5},{b}_{6}}{W}_{p({b}_{6}{a}_{3}),p({b}_{7}{a}_{4})}{U}_{{b}_{7},{b}_{8}}^{{{\dagger}} }.$$
(10)

Here, {bi} and {ai} are summed over {0, 1}k and {0, 1}n−k, respectively. Since V = Zi and W = Zj, this can be simplified as

$${O}_{VW}(U)= \frac{1}{{2}^{n}}{\sum}_{a,{\{{b}_{i}\}}_{i=1}^{4}}{U}_{{b}_{1},{b}_{2}}{U}_{{b}_{2},{b}_{3}}^{{{\dagger}} }{U}_{{b}_{3},{b}_{4}}{U}_{{b}_{4},{b}_{1}}^{{{\dagger}} }\\ \times {(-1)}^{{[p({b}_{1}a)]}_{i}+{[p({b}_{2}a)]}_{j}+{[p({b}_{3}a)]}_{i}+{[p({b}_{4}a)]}_{j}}.$$
(11)

Numerically, this can be approximately computed by the importance sampling on a ∈ {0, 1}n−k. The ensemble average of OVW(U) over f is given by

$${{\mathbb{E}}}_{f}[{O}_{VW}(U)]=\frac{1}{{2}^{k}}\,{{{\rm{tr}}}}\left((U. * U. * U){U}^{{{\dagger}} }\right),$$
(12)

since that of \({(-1)}^{{[p({b}_{1}a)]}_{i}+{[p({b}_{3}a)]}_{i}}\) is \({\delta }_{{b}_{1},{b}_{3}}\). Here, A. *B is the element-wise multiplication of A and B. More details are deferred to Supplementary Notes 2 and 3.

Pseudorandom state ensemble

A pseudorandom state ensemble \({{{\mathcal{E}}}}\) is an ensemble of states that cannot be distinguished by any polynomial copies of states and any poly-time quantum algorithms. For any t = poly(n), there is no poly-time quantum algorithm \({{{\mathcal{A}}}}\) that satisfies

$$\left\vert {{{\mathcal{A}}}}(\rho )-{{{\mathcal{A}}}}(\sigma )\right\vert \ge \frac{1}{O({{{\rm{poly}}}}(n))}$$
(13)

with \(\rho={{\mathbb{E}}}_{\phi \sim {{{\mathcal{E}}}}}\left[\left\vert \phi \right\rangle {\left\langle \phi \right\vert }^{\otimes t}\right]\) and \(\sigma={{\mathbb{E}}}_{\psi \sim {{{\rm{Haar}}}}}\left[\left\vert \psi \right\rangle {\left\langle \psi \right\vert }^{\otimes t}\right]\).