Heralded photonic graph states with inefficient quantum emitters

Abstract

Quantum emitter-based schemes for the generation of photonic graph states offer a promising, resource-efficient methodology for realizing distributed quantum computation and communication protocols on near-term hardware. We present a heralded scheme for making photonic graph states that is compatible with the typically poor photon collection from state-of-the-art coherent quantum emitters. We demonstrate that the construction time for large graph states can be polynomial in the photon collection efficiency, as compared to the exponential scaling of current emitter-based schemes, which assume deterministic photon collection. The additional overhead here consists of an extra spin qubit plus one additional spin-spin entangling gate per photon added to the graph. While the proposed scheme requires both non-demolition measurement and efficient storage of photons in order to generate graph states for arbitrary applications, we show that many useful tasks, including measurement-based quantum computation, can be implemented without these requirements. As a use case of our scheme, we construct a protocol for secure two-party computation that can be implemented efficiently on current hardware. Estimates of the fidelity to produce graph states used in the computation are given assuming current and near-term fidelities for highly coherent quantum emitters.

Introduction

The vast promise of quantum information technologies for faster and more secure computational and information systems relies on entanglement as a primary resource. Traditional gate-based quantum computing requires the ability to perform sequences of joint operations across multiple qubits. An alternative paradigm, known as measurement-based quantum computation (MBQC), realizes universal computation through sequences of single-qubit measurements made on an initially prepared entangled resource state¹. This is an appealing approach for photonic quantum systems as single photon rotations and measurements are straightforward using commercial optical elements, and fast, efficient routing solutions are readily available². Furthermore, the sequential nature of photon emission allows entangled states to be built from photons emitted at different times by the same emitter³. By using entangled emitters, it then becomes possible to simulate entangling gates between photons and overcome the difficulty of realizing direct photon-photon interactions⁴. Indeed, it is known that computationally useful graph states of photons can be generated using either a small number of coherent quantum emitters^5,6, a combination of a single emitter and fusion gates^7,8,9,10,11, or a single quantum emitter in a feedback scheme¹².

All of these aforementioned schemes assume a photon is successfully added to the graph every time an emitter is excited, and we thus term this class of schemes as being “deterministic”. For realistic systems with less than perfect emission and collection efficiency, the time to make a graph thus scales exponentially in the size of the graph because any failure to detect a photon triggers a restart of the whole protocol. In general, highly efficient collection from individual quantum emitters is a challenge that remains largely out of reach today, making such deterministic schemes impractical for generating even moderately sized graph states (10–100 photons) on near-term hardware^13,14,15,16.

In Results, we introduce a method for photonic graph generation based on coherent emitters that uses an “emit-then-add” approach, where each photon is attached to the graph only following confirmation of its emission and collection. In this way, a lost photon does not truncate the rest of the graph, and the time to produce a photonic graph state scales polynomially in the size of the graph. In addition to this improved scaling in construction time, our scheme is tolerant to arbitrary loss with only a linear reduction in rate, unlike other deterministic schemes, which have loss-tolerant thresholds in the 1–10% range^{10,11,17,18,19,20,21,22}. Compared to deterministic protocols²³, one additional spin is required in order to allow the emitter to be disconnected from the graph until photon collection is confirmed. Furthermore, for each photon added to the graph, our scheme requires one additional spin-spin entangling operation plus one mid-circuit measurement and reset (MCMR) of the emitting spin. (Note that these only occur upon heralding of successful photon emission; they are not required on every attempt).

Typically, confirming the presence of a photon in a particular optical mode requires destructive measurement of the photon. For arbitrary applications of photonic graph states where the photons are measured in any order and in any basis, one would thus require quantum non-demolition (QND) measurements^24,25,26, in order to determine successful collection of the photon before adding it to the larger graph, plus storage of the photon until it can be measured in the desired basis. Such a scheme is largely out of reach today, though we discuss in Supplementary Note 1 a detailed method for its implementation on current hardware, based on entanglement swapping with a separately produced entangled photon pair.

Importantly, we show here that a large class of graph state protocols (including MBQC) admit projective measurements of each photon before adding it to the larger graph. In this way, we show how to build a heralded virtual graph state of photons that never exist at the same time. Large virtual graph states can be built quickly with high fidelity in this way. We also introduce in Results an example use case for our scheme: A particular protocol that uses multiple copies of a small virtual graph state to implement secure two-party classical computation on arbitrarily large inputs and requires just a single quantum emitter and two auxiliary spin qubits. We demonstrate how this protocol can include classical error correction to mitigate experimental errors, including entangling gate infidelities and decoherence in state-of-the-art to near-term trapped ion and trapped neutral atom systems.

Results

Emit-then-add: overview

Given the generally poor collection efficiency shown by highly coherent quantum emitters that can be entangled with additional spin qubits, we propose a general methodology, dubbed “emit-then-add,” for constructing photonic graph states to circumvent this issue. A single emitter is initialized into an unentangled state and excited to produce a single photon that is entangled with its long-lived internal spin state and collected with some overall efficiency η_e. This can be implemented with a wide variety of quantum emitters, including laser-cooled atoms or ions, quantum dots, and defects or dopants in wide-bandgap semiconductors^{3,16,27,28,29,30}. Photons can be encoded in various degrees of freedom, including polarization, time-bin, and frequency^{31,32,33,34,35}. In addition to the single emitter, we require a set of auxiliary spin qubits that can be controllably entangled in a pairwise way (with the emitter and with each other) via local and deterministic two-qubit spin-spin entangling gates. We note that these auxiliary spins are never used for emission of photons for the graph and can be different physical qubits from the emitter (i.e., a different atomic species in an atom or ion system or nearby nuclear spins coupled to a defect or dopant emitter in solid-state)^36,37,38.

Deterministic schemes for constructing photonic graph states, such as those in refs. ^6,23, center their building operations on the emitting spin itself, while the central feature of our method is to add a photon to the graph only following a logical herald of its successful emission and collection. Successfully adding each photon to the graph state requires entangling the emitter with an auxiliary spin, and then measuring it out of the graph and reinitializing it to prepare for the next attempted photon emission. Following a correction to the photon and auxiliary spin based on the outcome of this measurement, the state of the system is as if the auxiliary spin had directly emitted the photon itself. In this sense, we construct a graph state of only heralded photons, where we have split the role of the emitter in deterministic schemes into an emitting spin that generates the photons and an auxiliary spin that stores the quantum information. Thus, we see that emit-then-add admits the construction of arbitrary photonic graph states using the same methods described in ref. ⁶ with minimal additional overhead. Namely, the graph state itself is built using a sequence of two-qubit and local Clifford gates on the spins and only local Clifford gates on the photons. The local gates on each photon can all be combined and applied as a single rotation prior to using the graph state in subsequent applications.

The key improvement of our scheme is that uncollected photons do not disturb the state of the graph that is being built. When successive photon collection is required for building a graph on a single emitter, any failed detection traces the photon out of the system and truncates the graph, which can necessitate restarting construction from scratch. In typical deterministic quantum emitter-based schemes, any inefficiency in collection therefore leads to exponentially poor scaling with graph size. Given current hardware, this severely limits the size and rate of generation for photonic graph states, particularly those that require multiple spin qubits. We note that there are loss tolerance and percolation thresholds that improve this scaling, but they require much better collection efficiency than is feasible with near-term systems^{10,11,17,18,19,20,21,22}. In our scheme, any failed detection simply results in the reinitialization of the emitting spin without any disturbance to the overall graph under construction. This ultimately trades photonic loss as the primary constraint on generating arbitrarily large graph states for emitter and spin properties such as coherence times and spin-spin entangling fidelities, which is why our scheme is particularly well-suited for state-of-the-art to near-term trapped ion and trapped neutral atom systems.

For general-purpose applications, we require a method to detect the presence of a photon that is non-destructive. This can be met with any form of QND measurement that heralds spin-photon entanglement. In Supplementary Note 1 we provide an example for implementing such a scheme on current hardware, utilizing entanglement swapping and a separately produced entangled photon pair. Here, a pair of entangled photons is probabilistically produced, which can be implemented via standard nonlinear optical processes, such as spontaneous parametric down conversion (SPDC)^39,40. The pair production probability can be controlled by the pump power. One member of the photon pair, the signal photon, is wavelength and bandwidth matched to the emitter photon, and the entangled pair is encoded in the same degree of freedom as the emitter photon. The emitter photon and signal photon are sent to a joint measurement apparatus, which, upon a successful measurement outcome, projects the emitter spin and the unmeasured photon, the idler photon, onto an entangled Bell state⁴¹. Since only certain measurement outcomes correspond to entanglement between the emitter spin and the idler photon, the procedure is repeated until a successful herald is flagged. While this procedure works in principle, it has some major drawbacks, including a significant reduction in rate due to the probabilistic nature of generating entangled photon pairs as well as the introduction of additional infidelities due to factors including multi-pair production and imperfect heralding efficiency.

Instead, we show that for many applications, including MBQC, non-destructive measurement is not required. For these applications, the nodes in the graph are measured sequentially, with the choice of measurement basis on one node depending on the outcomes of previous ones. It is, thus, not necessary to build the full graph state before beginning these measurements, as an emitter photon can be destructively measured as soon as the correct basis for measurement is determined⁴². This measurement thus serves doubly as a prescribed step in the MBQC protocol and as a herald for the emitter photon. Upon failure to detect the photon, we reinitialize the emitter and attempt generation again, as we would with some QND measurement. Upon successful detection, we perform all required logic on the emitter and auxiliary spins, measure the emitter out of the graph, and reinitialize the emitter to attempt generation of the next photon. This simpler emit-then-add scheme is shown in Fig. 1, and it has the advantage that it requires no storage of the emitter photon prior to measurement. The graph state being constructed is therefore “virtual” in the sense that not all photons within the graph need to exist at the same time.

Fig. 1: A construction scheme for heralding virtual graph states, with emit-then-add.

A quantum emitter (red) is repeatedly excited until a single photon (orange) is successfully detected. Upon detection, logic is executed, which passes the conditional phase information written onto the emitter to an auxiliary memory spin (black), which encodes a virtual graph state (represented by dashed boundaries).

However, there are limitations on when this scheme can be employed. Namely, a photon can be destructively measured immediately upon generation provided that two conditions are satisfied: (1) the correct measurement basis for that photon, as set by the protocol, is determined prior to its emission, and (2) this measurement is either Pauli Z or of the form $\cos \phi X+\sin \phi Y$. Condition (1) can be met for MBQC, as the emission order can be chosen to match the measurement order of the computation, albeit at the cost of using extra auxiliary spins and two-qubit gates in some cases²³. The second condition can also be met in principle, since the specified gate sets are sufficient for universal MBQC^1,43.

To understand condition (2) in more detail, note that if the full graph state were built such that the emitter is measured before its emitted photon, then each photon would have a local Clifford error of the form UZ^m, where U is a fixed Clifford and m ∈ {0, 1} is determined by the decoupling measurement on the emitter spin. If M is the measurement to be subsequently performed on the photon in the MBQC protocol, then when correcting for the Clifford error, the effective measurement would be ${M}^{{\prime} }=U{Z}^{m}M{Z}^{m}{U}^{\dagger }$. When M = Z, then ${M}^{{\prime} }=UM{U}^{\dagger }$; or when $M=\cos \phi X+\sin \phi Y$, then ${M}^{{\prime} }={(-1)}^{m}UM{U}^{\dagger }$. In the first case, the dependence on m is completely removed, and the photon can be equivalently measured with UMU^† immediately after it is emitted in this simpler scheme. In the second case, it can also be immediately measured with UMU^†, but now one must perform a bit flip on the classical measurement outcome if m = 1; this is because an overall −1 factor on a spin observable simply flips the spin-up/spin-down outcomes. In total, the correct computation can still be attained, because protocols admitting only measurements of this form write their outcomes as a conditional phase on their neighbors in the graph. In our scheme, this conditional phase information is imparted on the emitter with each successful single photon detection, and subsequently passed into memory on one of the auxiliary spins. Computation is then achieved by passing conditional phases into memory in a specific pattern, performing logic between auxiliary spins, and classical post-processing for observables of the specified form.

While satisfying conditions (1) and (2) above is sufficient for universal MBQC using virtual graph states, this is often not the most efficient method in terms of the overall number of photons used to drive the computation. For example, building out the graph to a certain depth and measuring in a different sequence than the emission order can lead to more compact gate implementations⁴³. Also, using MBQC measurements outside of the x–y plane allows for more general forms of information flow⁴⁴. Nevertheless, as we show below, this simpler scheme can enable dramatically faster construction and higher fidelity with no photon storage required. For emit-then-add schemes incorporating some form of QND measurement instead, photon storage is required for at least the time to perform the spin-spin entangling gates and the decoupling measurement on the emitter. For the remainder of this section, we discuss in more detail the advantages of emit-then-add, specifically in the context of this simplified construction scheme for heralding virtual graph states that contain n_p photons.

Emit-then-add: overhead

It is known that the sequential nature of photon emission imposes nontrivial resource requirements when constructing graph states, specifically in terms of the number of required emitters and two-qubit spin-spin entangling gates needed to build out the graph. As discussed in the introduction, constructing graph states with emit-then-add further adds to this overhead. The total number of spins we require is only one more than the deterministic case, as each auxiliary spin in our scheme replaces an emitter in deterministic schemes, and only a single emitting spin is required. A consequence of this is that the total number of auxiliary spins required in our scheme scales equivalently to ref. ²³ (see the “Methods” section for further details). In practice, more emitting spins can be employed in parallel to speed up the construction. As the emitting spin in our scheme must remain disjoint from the graph for each excitation, an additional two-qubit spin-spin entangling gate and MCMR operation are required per successfully heralded virtual photon, in order to entangle the emitter with the larger graph and subsequently disconnect it for the next emission. In the “Methods” section, we also demonstrate efficient construction subroutines for building certain graph states that directly employ the methods of ref. ⁶.

Emit-then-add: fidelity

We make a simple estimate of the final state fidelity for graph states generated with emit-then-add, as the probability that no error occurs when building the state. In this way, our estimates reflect a similarity with the deterministic case, where detected failures require discarding the state and restarting. Hence, these fidelities represent a binary, such that we assume a lower bound F ≥ 1/2. Notably, failure to collect an emitted photon does not require restarting, unlike typical deterministic schemes.

In addition to overhead, there are infidelities that affect the final graph state with emit-then-add that are not present in the deterministic scheme, namely any infidelity in the additional two-qubit spin-spin entangling gate and mid-circuit measurement and reset of the emitter. We capture all of this, plus the initial fidelity of the emitter-photon entanglement, in a parameter, F_add, for the total fidelity of the process to add a photon to the graph. Note that photon detection inefficiency does not affect the fidelity because failing to detect a photon simply triggers a reset. Any infidelity in measuring the state of the photon does affect F_add, but this can be minimal for photons (and has the same effect as for the deterministic schemes for photonic graph state production).

Importantly for our scheme, when building a graph, all auxiliary spins must remain coherent for the entire time they are a part of the graph, which is much longer than the n_p repetition cycles over which the graph is generated in the deterministic scheme. Thus, in practice, our scheme can be limited by spin coherence (denoted τ). In modeling the effects of this dephasing, we note that the emitter is reinitialized with each attempt to add a new photon to the larger graph, and hence, it is only required to remain coherent for time to add it to the larger graph, denoted t_add. For the auxiliary spins, on the other hand, the average time for the successful addition of a new photon to the larger graph goes as t_rep/η_e, where ${t}_{\text{rep}}^{-1}$ is the experimental repetition rate. Hence, the contribution to the state fidelity from the emitter and any auxiliary spins as a result of decoherence is

$${F}_{D}^{(e)}({n}_{p})={\left(\frac{1}{2}(1+{e}^{-({t}_{\mathrm{rep}}+{t}_{\mathrm{add}})/\tau })\right)}^{{n}_{p}},$$

(1)

$$\langle {F}_{D}^{(s)}({n}_{p})\rangle =\frac{1}{2}\left(1+{e}^{-{n}_{p}({t}_{\mathrm{rep}}/{\eta }_{e}+{t}_{\mathrm{add}})/\tau }\right),$$

(2)

where we include a superscript to denote the emitter (e) and auxiliary spins (s), respectively. For simplicity in the above, we have used the same coherence time τ for the emitter and auxiliary spins in the system, though this may not be the case for hybrid systems^36,37.

Putting the above equations together with the fidelity to add a photon to the graph, the final fidelity to generate an n_p-photon graph state with an emitter and a single auxiliary spin (n_s = 1) is

$${F}_{{n}_{s}=1}({n}_{p})={({F}_{\text{add}})}^{{n}_{p}}{F}_{D}^{(e)}({n}_{p})\langle {F}_{D}^{(s)}({n}_{p})\rangle,$$

(3)

assuming our variation of emit-then-add that does not rely on QND measurements. In total, moving from the deterministic scheme to one proposed here effectively means moving from a scheme limited by photon collection efficiency to one limited by dephasing and the fidelities of entangling and MCMR operations.

Given typical photon collection efficiencies, experimental repetition rates, and entangling gate and MCMR speeds, we expect to be in the regime of t_rep ≪ t_add ≲ t_rep/η_e ≪ τ. Here, the emitting spin must have a coherence time longer than the time to add a single photon to the graph, while the auxiliary spins must have much longer coherence times that account for all the failed attempts as well as repeated entangling gates and MCMR operations. Thus, a realistic implementation of this scheme requires auxiliary spins that have exceedingly large coherence times, with the requirement increasing for increasing graph size. Trapped ion and neutral atom systems have been shown to host second-scale coherence times^45,46, which should allow the generation of moderately sized graph states (10–100 photons), even with the relatively slow ( ≲ ms) entangling gate and MCMR times that are typical of these systems.

Our generalized scheme (outlined in Supplementary Note 1) involving entanglement swapping using a photon pair source incurs an additional infidelity through false heralds during the swapping process.

Emit-then-add: scaling

Finally, the most significant advantage of emit-then-add comes in scaling up the size of graph states using state-of-the-art to near-term hardware. The average time to successfully generate an n_p-photon graph via the deterministic scheme, by directly collecting photons from an emitter in n_p subsequent excitation events, is ${\mathcal{O}}({\eta }_{e}^{-{n}_{p}})$, where η_e is the emitter collection efficiency, because any failed detection event truncates the graph. For our emit-then-add scheme, a failed detection of the emitter photon simply triggers reinitialization of the emitter and another attempt at photon emission, while the graph under construction remains unaffected. Therefore, an n_p-photon graph state will be created over a time that is ${\mathcal{O}}({n}_{p}{\eta }_{e}^{-1})$. Our generalized scheme has additional factors affecting the scaling, but also demonstrates dramatic improvement over the deterministic schemes at large graph sizes.

As a comparison to the experimental schemes motivated by ref. ⁶, the time to make an n_p-photon graph state (in units of the repetition period for exciting the emitter) is shown in Fig. 2 for η_e ∈ {0.1, 0.5, 0.9} for deterministic (red), and emit-then-add (blue) schemes. We do not include the time to perform gates and MCMR operations of the spins for these estimates, and we assume that the emitter coherence does not limit the graph size for either scheme (i.e., τ/n_p ≫ t_rep/η_e + t_add). We include cutoffs where the additional infidelity, captured by F_add defined above, precludes the construction of larger graph states. Given the current state-of-the-art for trapped ion and neutral systems^{47,48,49,50,51}, the vertical gray lines in Fig. 2 depict the cutoffs where ${({F}_{\text{add}})}^{{n}_{p}} < 1/2$.

Fig. 2: Time to make photonic graph states of size n_p in units of the repetition period.

Principal deterministic schemes (red) and our emit-then-add (blue) scheme are compared. The three curves of each color represent emitter photon collection efficiencies η_e ∈ {0.1, 0.5, 0.9}. The polynomial scaling in our schemes allows for the construction of larger photonic graphs. Cutoffs (gray, vertical) are depicted where the additional infidelities associated with emit-then-add (such as contributions from spin-spin entangling gates and MCMR operations) preclude the construction of larger graph states with fidelities better than 1/2, for F_add ∈ {0.99, 0.999, 0.9999}, comparing results from refs. ^{47,48,49,50,51}. Despite these cutoffs, graph states of 10–100 photons are achievable on realistic timescales, with only moderate requirements on F_add.

Two-party computation with graph states: overview

As one application of our emit-then-add scheme, we describe a method for securely computing an arbitrary Boolean function f: {0, 1}^×n → {0, 1} of either two parties or a restricted class of multi-party functions. As a special type of MBQC, our protocol, ${\mathcal{P}}$, performs the calculation through a sequence of measurements on distributed graph states, followed by classical broadcasting and local processing. Only Pauli measurements are needed, which are performed adaptively without any communication. Therefore, ${\mathcal{P}}$ can be implemented without any need for photonic memory, utilizing our variant of emit-then-add for building virtual graph states, where the generation of the requisite resource state happens in parallel with the computation. Furthermore, the size of each graph state required for ${\mathcal{P}}$ is fixed at 12 photons, regardless of the number of parties or the size of their inputs, which bodes well for state-of-the-art to near-term hardware.

Secure multi-party computation (MPC) is a task in which two or more parties compute some function on their individually held variables without revealing the values of the variables to each other^52,53. For example, in Yao’s famous millionaire problem, two parties want to determine whose bank account has the most money without actually revealing how much money is in each account. MPC is a deeply studied topic in both classical and quantum cryptography, and a variety of MPC protocols have been proposed, achieving different levels of security and relying on different operational assumptions⁵⁴.

We propose a method for restricted MPC that includes all two-party computations and requires only two rounds of public communication in the form of broadcasting, or openings, regardless of the size of the computational input. Our protocol follows a well-known approach of decomposing an MPC into offline and online phases^55,56,57. In the offline phase, a universal computational resource is distributed to all the parties. Crucially, this resource does not depend on the particular function being computed, other than its input size. Then, in the online phase, this resource is used to compute some chosen function of the parties’ inputs. For example, in the classical setting, one well-known computational resource is a special form of shared randomness known as “Beaver triples,” which can be used to efficiently compute logical AND gates in the online phase⁵⁸. The problem of MPC then reduces in part to secure and efficient offline methods for distributing shared randomness, such as Beaver triples, which directly enable secure online computation. In a similar spirit, our protocol involves distributing certain quantum graph states in the offline phase, which then enable the computation of a logical AND in the online phase, through quantum measurement and classical post-processing.

Beyond its relatively low communication costs, a significant advantage of our protocol is that the parties can, in principle, use graph state certification protocols to unconditionally verify that some untrusted Source is faithfully distributing the correct graph state^59,60, an ability that does not exist for classical sources of shared randomness. Furthermore, we prove that our online phase offers unconditional privacy against an arbitrary malicious adversary, with access to a general quantum instrument⁶¹, in the sense that honest participation reveals no information about a party’s input, other than what can be inferred from the evaluation of the final computed function.

Note that in our discussion of the protocol here, we do not offer any means of ensuring fairness, such as security with abort or guaranteed output delivery. We do not claim that the full MPC here is unconditionally secure in this sense, and a classical means of ensuring fairness for the broadcasts in our online phase can be employed with computational security guarantees^62,63. Instead, the novelty of this work is in the ability to disseminate a specific online correlation with unconditional security. In a similar vein to quantum key distribution, we demonstrate how quantum states offer the ability to distribute information-theoretic secure shared randomness, in our case, in a form that directly enables MPC.

Two-party computation with graph states: protocol

Suppose that N parties P₁, ⋯, P_N wish to compute some Boolean function f(x₁, ⋯, x_N), where x_k is a string of bits representing the input for party P_k. In addition to correctness, the evaluation of f should be done securely such that the parties learn no more information about the individual x₁, ⋯, x_N beyond their own input and what is revealed in the function value f(x₁, ⋯, x_N). To achieve this task, we propose a method of delegated computation in which a non-collaborating Referee, R, is introduced to assist in the computation of f(x₁, ⋯, x_N). To maintain privacy, R also should not learn any more information about the x_k beyond what is implied by the computed value f(x₁, ⋯, x_N), nor does R reveal any more information to the other parties, other than what is necessary to evaluate f securely.

We utilize the fact that every Boolean function f can be expressed in an algebraic normal form (ANF), which presents f as a sum (mod 2) of different variable conjunctions. That is, we can write $f={\sum }_{i=1}^{{\mathfrak{R}}}{{\mathfrak{c}}}_{i}$, where each ${{\mathfrak{c}}}_{i}$ is the logical AND of a certain group of input variables. By combining variables belonging to the same party, every ${{\mathfrak{c}}}_{i}$ becomes the conjunction of at most N variables, each one belonging to a different party. In this work, we restrict attention to functions f that admit an ANF whose conjunctions involve no more than two variables. This covers the entire class of two-party functions, but also includes certain multi-party functions, such as the three-party majority function ${\varphi }_{3}(x,y,z)=xy+xz+yz\,({\rm{mod}}\,{2})$, which outputs the majority value among inputs x, y, z ∈ {0, 1}. In general, the functions we consider have the form $f={\sum }_{i=1}^{{\mathfrak{R}}}{a}_{i}{b}_{i}+{\sum }_{k=1}^{N}{z}_{k}$, where a_i and b_i are the input bits of each quadratic conjunction, belonging to different parties, and z_k is the input bit of the linear part of f, belonging to party P_k. We let ${\widetilde{{\bf{x}}}}_{k}\subset {\{{a}_{i},{b}_{i},{z}_{k}\}}_{i=1,k=1}^{{\mathfrak{R}},N}$ denote all the inputs of f belonging to P_k. Furthermore, if each ${\widetilde{{\bf{x}}}}_{k}$ is no more than M bits, then ${\mathfrak{R}}\le (\begin{array}{l}N\\ 2\end{array}){(M-1)}^{2}$.

The offline phase of ${\mathcal{P}}$ calls for the distribution of ${\mathfrak{R}}$ copies of the graph state $| G\rangle$ depicted in Fig. 3, one copy for each conjunction a_ib_i in f. A key detail for experimental implementation is that the generation of each copy of $| G\rangle$ requires only two auxiliary spins in the scheme we propose, given the depicted emission order²³. We denote the i^th copy as $| {G}_{i}\rangle$, and their distribution can be conducted in parallel. The specific qubits in each $| {G}_{i}\rangle$ are given to the parties {A_i, B_i} ⊂ {P₁, ⋯, P_N} who, respectively, have inputs {a_i, b_i} to the conjunction a_ib_i. We assume without loss of generality that each party receives qubits belonging to at least one $| {G}_{i}\rangle$, an assumption that can be trivially ensured by adding conjunctions to f of inputs that are identically zero. This is a technical requirement of our protocol since the $| {G}_{i}\rangle$ will ultimately be used to generate one-time pad bits, and each party needs at least one. In practice, the $| {G}_{i}\rangle$ can be generated by an untrusted quantum Source, and its correctness can be certified^59,60. Specific steps for building $| G\rangle$ in utilizing emit-then-add are presented in the “Methods” section.

Fig. 3: For each requisite bit conjunction in Stage I, the 12-qubit graph state $| G\rangle$ is distributed to R (the Referee) and a pair of parties labeled A_i (Alice), B_i (Bob).

When the measurement sequence detailed by the protocol is implemented honestly, a correlation is generated between the parties, such that a_ib_i = m_i,12 + α_i + β_i, where α_i and β_i are locally computed by Alice and Bob, respectively, from openings made in Stage II. Hence, we utilize each copy of the state to achieve a homomorphic encryption of a bit conjunction a_ib_i, where Alice, Bob, and the Referee each possess an additive share. The numeric script above each qubit reflects an example photon emission order for the generation of the graph state.

The online phase of ${\mathcal{P}}$ thereafter is split into two stages. Stage I involves measuring Pauli observables, X, Y, Z, on ${\mathfrak{R}}$ copies of the graph state $| G\rangle$, depicted in Fig. 3, following the sequence below.

Stage I

Obtaining correlations from quantum states

Input: For $i\in \{1,\cdots \,,{\mathfrak{R}}\}$, the following measurement sequence is performed by {A_i, B_i} ⊂ {P₁, ⋯, P_N}, along with R, on copy $| {G}_{i}\rangle$. A inputs a_i.

(I.1). B_i and A_i measure Z on qubits 1 and 5, respectively, obtaining measurement outcomes m_i,1 and m_i,5.

(I.2). A_i, B_i, and R measure X on qubits 2, 6, and 9, respectively, obtaining measurement outcomes m_i,2, m_i,6, and m_i,9.

(I.3). R measures Z on qubits 3 and 7, and B_i likewise measures Z on qubit 10. They obtain measurement outcomes m_i,3, m_i,7, and m_i,10.

(I.4). A_i applies ${Z}^{{m}_{i,2}}$ to qubit 4 and measures ${W}^{{a}_{i}}Z{({W}^{\dagger })}^{{a}_{i}}$ on qubits 4 and 11 thereafter, where W ≡ (iX)^1/2. She obtains measurement outcomes m_i,4 and m_i,11. Note that WZW^† = Y.

(I.5). B_i applies ${Z}^{{m}_{i,6}}$ to qubit 8 and measures ${W}^{{m}_{i,10}}Z{({W}^{\dagger })}^{{m}_{i,10}}$ thereafter, obtaining measurement outcome m_i,8.

(I.6). R measures ${V}^{{m}_{i,9}}X{({V}^{\dagger })}^{{m}_{i,9}}$ on qubit 12, where V ≡ (−iZ)^1/2, obtaining measurement outcome m_i,12. Note that VXV^† = Y.

When all the measurements through step (I.3) are made as specified, the parties obtain correlated measurement outcomes satisfying the relationships

$${m}_{i,1}+{m}_{i,2}+{m}_{i,3}=0,$$

(4)

$${m}_{i,5}+{m}_{i,6}+{m}_{i,7}=0,$$

(5)

$${m}_{i,9}+{m}_{i,10}=0,$$

(6)

where we define s_i ≡ m_i,9 = m_i,10. When the subsequent measurements through step (I.6) are made as specified, the Referee’s final outcome satisfies

$${a}_{i}{b}_{i}={m}_{i,12}+{\alpha }_{i}+{\beta }_{i},$$

(7)

where

$${\alpha }_{i}={a}_{i}({m}_{i,1}+{b}_{i}+1)+({m}_{i,4}+{m}_{i,11})$$

(8)

$${\beta }_{i}=({m}_{i,5}+{a}_{i}){s}_{i}+{m}_{i,8}.$$

(9)

The end result of each iteration i of the measurement sequence leaves Alice, Bob, and the Referee with additive homomorphic shares of the bit conjunction a_ib_i. The only temporal restrictions on the sequence are that measurements in steps (I.1)–(I.3) need to be performed prior to those in steps (I.4)–(I.6). Furthermore, we can understand both α_i and β_i as two layers of data that are nested together by one-time pads. For α_i, the bit (m_i,4 + m_i,11) serves as a pad (known only to Alice) for the two multipliers a_i and (m_i,1 + b_i + 1); while within the latter multiplier, the bit m_i,1 serves as a pad (known only to Bob) for b_i + 1. A similar interpretation holds for β_i.

The padded structure of the bit values obtained in Stage I enables the calculation of each α_i and β_i using public communication (i.e., “openings”) and local processing in Stage II of ${\mathcal{P}}$, without revealing any information about the corresponding a_i or b_i. A second round of communication thereafter opens only the collective sum ${\sum }_{i=1}^{{\mathfrak{R}}}{a}_{i}{b}_{i}$ of the bit conjunctions encrypted in Stage I, while also adding the linear term ${\sum }_{k=1}^{N}{z}_{k}$, thereby allowing the secure evaluation of f.

Stage II

Public communication and classical post-processing

Input: Let ${{\mathcal{A}}}_{k}\subset \{1,\cdots \,,{\mathfrak{R}}\}$ denote the set of conjunctions in which P_k played the role of A_i, and similarly, let ${{\mathcal{B}}}_{k}\subset \{1,\cdots \,,{\mathfrak{R}}\}$ denote the set of conjunctions in which P_k played the role of B_i. P_k inputs their bits from ${\{{\alpha }_{i}\}}_{i\in {{\mathcal{A}}}_{k}}$ and ${\{{\beta }_{i}\}}_{i\in {{\mathcal{B}}}_{k}}$, along with their bit z_k. R inputs their bits from ${\{{m}_{i,12}\}}_{i=1}^{{\mathfrak{R}}}$.

(II.1). For each $i\in \{1,\cdots \,,{\mathfrak{R}}\}$,

(a). A_i opens c_i,A ≡ m_i,5 + a_i and B_i opens c_i,B ≡ m_i,1 + b_i + 1.

(b). A_i locally computes α_i = c_i,Ba_i + (m_i,4 + m_i,11) and B_i locally computes β_i = c_i,Am_i,10 + m_i,8.

(II.2). For each k ∈ {1, ⋯, N}, P_k opens ${\Gamma }_{k}\equiv {z}_{k}+{\sum }_{i\in {{\mathcal{A}}}_{k}}{\alpha }_{i}+{\sum }_{i\in {{\mathcal{B}}}_{k}}{\beta }_{i}$. Concurrently, R opens ${\Gamma }_{{\bf{R}}}\equiv {\sum }_{i=1}^{{\mathfrak{R}}}{m}_{i,12}$.

(II.3.) All the parties locally compute $f={\Gamma }_{{\bf{R}}}+{\sum }_{k=1}^{N}{\Gamma }_{k}$.

It should be noted that by parallelization, Stage II can be performed using just two rounds of simultaneous communication between the parties. Indeed, each P_k needs to broadcast at most two public messages, the first being no more than $\log {{\mathfrak{R}}}_{1}$ bits, and the second being just one bit. When run in parallel, all the step (II.1) messages can be broadcast concurrently, and likewise for the step (II.2) messages. Moreover, this classical communication can be done after all quantum measurements are performed since the choice of local measurement at each step in ${\mathcal{P}}$ does not depend on the classical message of any other party. Experimentally, this is very desirable since it means that ${\mathcal{P}}$ can be implemented in three parts: (i) entanglement distribution (offline phase), (ii) local measurement of qubits (online phase Stage I), and (iii) classical post-processing (online phase Stage II). Without the use of quantum memory, it is not possible to cleanly separate parts (i) and (ii), and in practice, each state $| {G}_{i}\rangle$ can be measured in a streaming manner. This type of implementation does not affect the performance or security of the protocol.

Two-party computation with graph states: security

We now turn to analyze the security of ${\mathcal{P}}$. At a high level, our security claim is that if R plays honestly, then ${\mathcal{P}}$ reveals no more information about ${\widetilde{{\bf{x}}}}_{k}$ of an honest party P_k, beyond what can be inferred from the function values $f({\widetilde{{\bf{x}}}}_{1},\cdots \,,{\widetilde{{\bf{x}}}}_{N})$. Here, an honest party is anyone who executes the steps of ${\mathcal{P}}$ faithfully. Our protocol also offers some security against a cheating R. Namely, if all N parties follow ${\mathcal{P}}$ honestly, then R is also unable to infer any information about the inputs beyond what can be computed from $f({\widetilde{{\bf{x}}}}_{1},\cdots \,,{\widetilde{{\bf{x}}}}_{N})$.

Note that for N parties P₁, ⋯, P_N, these claims allow for the possibility that any subset of N − 1 parties is colluding against a single party. The colluding parties are allowed to share an unlimited amount of classical and quantum communication over side channels, and they can thus collectively be viewed as a single party S. In this case, the task essentially reduces to a problem between the two parties P and S, and R. We let $\widetilde{{\bf{x}}}$ denote the input of P and $\widetilde{{\bf{y}}}$ as the total input of all the colluding parties constituting S. The goal, then, is to securely compute $f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ with an honest majority in {P, S, R}.

In this work, we adopt a simulation-based notion of security. Consider first an ideal world in which there exists some device f_ideal that privately receives inputs $\widetilde{{\bf{x}}}$ and $\widetilde{{\bf{y}}}$ from P and S, respectively, and then outputs $f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ to P, S, and R. Intuitively, we want the ideal world to reveal at least as much information about the inputs $(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ than what is revealed to any dishonest party acting maliciously in the real world.

This intuition is made precise through the notion of a simulator. A simulator, ${\mathbb{S}}$, in this setting is some device that can take the place of a party X ∈ {P, S, R} and interact with the ideal functionality f_ideal from the viewpoint of party X. Consider now any action taken by a potentially dishonest party in ${\mathcal{P}}$. Our security definition is that there must exist a simulator ${\mathbb{S}}$ interacting with f_ideal that exactly reproduces what the dishonest party obtains from ${\mathcal{P}}$. This operationally captures the idea that the adversary learns no more information about an honest party’s input, other than what can be inferred directly from an ideal evaluation of f. Figure 4 depicts the two forms of malicious attacks for which we prove that ${\mathcal{P}}$ is secure. A formal theorem for security is given in the “Methods” section, and a full proof is provided in Supplementary Note 2.

Fig. 4: Malicious attacks on ${\mathcal{P}}$ by S and R.

Real (left) vs. ideal (right) instantiations of the attacks are depicted, where boxes (red, blue, green) indicate local processing by a given party (P, S, R). a General attack by S. The attack is described by a quantum instrument ${\mathcal{I}}$ that acts on the qubits of ${| G\rangle }^{\otimes {\mathfrak{R}}}$ distributed to S, with possible dependence on some side information λ. For every $\widetilde{{\bf{x}}}$ of P, the attack will generate for S a classical-quantum state ${\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )$ that depends on all public communication in the protocol. We show there exists a simulator ${\mathbb{S}}$ in place of party S in the ideal world that submits some input $\widetilde{{\bf{e}}}$ to f_ideal and then uses the output $f(\widetilde{{\bf{x}}},\widetilde{{\bf{e}}})$ to generate the same ${\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )$ achieved in the real world. b General attack by R. We again show there exists a simulator ${\mathbb{S}}$ that takes the place of R in the ideal world, receiving just the function output $f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ and outputting the classical-quantum state ${\rho }_{\text{cq}}^{{\bf{R}}}(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ achieved in the real world, as shown to the right.

Two-party computation with graph states: performance

To handle experimental errors in the above protocol, we can employ a simple repetition code to suppress the effects of any infidelity in our ability to make each copy of $| G\rangle$ in the offline phase of ${\mathcal{P}}$. By determining the total bit error probability associated with each share of a_ib_i, an arbitrarily small total bit error probability ϵ_f on the output f can be chosen to set the number of repetitions required for Stage I. We use this information to estimate the lower bound rate of computation at which N parties can compute f on their M-bit inputs.

Functionally, our protocol allows for the secure implementation of any two-party Boolean function, f, by repeatedly generating and distributing copies of the 12-qubit state $| G\rangle$. The number of required copies depends (polynomially) on the size of the input, M, and the desired final error probability, ϵ_f. A pair of auxiliary spins can be employed to generate each copy constructed in parallel, and additional emitters can be employed to speed up the construction. Furthermore, these spins need only remain coherent for at most the time to make each copy of $| G\rangle$, a requirement easily met with current trapped ion or atom array systems. We can conservatively estimate the maximum possible bit error probability associated with each copy by computing the complement of the probability that no bit error occurs, that is, the complement of the fidelity to produce an ideal copy of $| G\rangle$ in our proposed emit-then-add scheme. In Fig. 5, we plot the lower bound rate of computation at which our protocol can operate with this form of error correction, in units of R_rep, against the size of each party's input, M, for total acceptable error probabilities ϵ_f ∈ {10⁻³, 10⁻¹²}. This rate is given in the “Methods” section. We assume that M here is the number of bits each party needs to perform a conjunction on, neglecting the single linear bit they each input as well.

Fig. 5: Error corrected two-party computation rate versus the number of required conjunctions in f, shown for two acceptable error probabilities on the computation (ϵ_f).

We assume the use the our scheme with destructive measurements and no photonic memory. The rate is expressed in units of the repetition rate of excitation of the chosen quantum emitter, ${t}_{\text{rep}}^{-1}$, which can be in the range of 10⁶–10⁹s⁻¹ for highly coherent emitters. The individual bit error probability for each copy of $| G\rangle$ is a pessimistic 0.157, assuming η_e = 0.1, and F_add = 0.99. We see that even these parameters allow virtually unlimited reduction in the total error probability with minimal change in the overall rate.

Discussion

We have introduced a new paradigm for the generation of photonic graph states using coherent quantum emitters, using an emit-then-add approach. This enables the generation of such states without requiring near unity generation, collection, and detection efficiency of the photons. Many state-of-the-art quantum emitter platforms display excellent performance in the other required metrics, including coherence time, gate fidelity, and MCMR fidelity, but exhibit poor ( ≲ 10%) overall photon emission and detection probability due to fundamental challenges. Our scheme is thus much better suited to current and near-term hardware than other deterministic schemes in the literature that rely on the detection of all emitted photons. It is a toolbox for making large entangled photonic states for MBQC and other applications that are limited by spin decoherence rather than photon collection efficiency. We demonstrated this advantage in scaling and introduced an application of our scheme for secure two-party computation. The lack of interaction in the measurement-based stage of this protocol, along with the minimal overhead for constructing each resource state, makes this an ideal use case for virtual graph states constructed with emit-then-add.

Furthermore, the scheme introduced here naturally lends itself to various extensions and modifications to increase functionality. First, adding multiplexing, such as between many arrays of atoms or ions, would increase the generation rate with a linear factor in the degree of multiplexing. Other hybrid approaches that combine the virtual graph states discussed here with more traditional graph states can add additional functionality. Further theoretical work remains to be done to determine more applications that are suited to this scheme.

Methods

Graph states

For an arbitrary graph G = (V, E) with vertices V = {a₁, ⋯, a_n} and edge set E ⊂ V × V, consider the n-qubit operator obtained by performing a controlled − Z gate, CZ_a,b, between every (a, b) ∈ E. We denote this global operator by

$${U}_{G}=\mathop{\prod }\limits_{(a,b)\in E}C{Z}_{a,b}.$$

(10)

The graph state associated with the graph G is the n-qubit state

$$| G\rangle ={U}_{G}{| +\rangle }^{\otimes V}.$$

(11)

Note that ${| +\rangle }^{\otimes n}$ is stabilized by n commuting operators ${\{{X}_{a}\}}_{a\in V}$. Hence, the stabilizer of $| G\rangle$ can be understood by examining how the X_a transform under U_G. Since CZ_a,b(X_a)CZ_a,b = X_aZ_b, it follows that the stabilizer of $| G\rangle$ is generated by the operators $\langle {\{{K}_{a}\}}_{a\in V}\rangle$, where

$$\begin{array}{rcl}{K}_{a} & = & {U}_{G}{X}_{a}{U}_{G}\\ & = & {X}_{a}\mathop{\prod }\limits_{b\in {N}_{a}}{Z}_{b}\\ & = & {X}_{a}\mathop{\prod }\limits_{b\in V}{Z}_{b}^{{\Gamma }_{a,b}}\,\,\forall a\in V,\end{array}$$

(12)

and Γ_a,b are elements of the adjacency matrix of G.

When discussing the construction of graph states, a local complementation describes an important involution on a graph, which can be accomplished efficiently in practice through only single-qubit rotations. We define τ_a(G) as the graph (V, EΔE(N_a, N_a)), where Δ is the symmetric difference and $E({N}_{a},{N}_{a})=\{\{b,{b}^{{\prime} }\}| b,{b}^{{\prime} }\in {N}_{a},b\ne {b}^{{\prime} }\}$, such that

$$| {\tau }_{a}(G)\rangle ={(-i{X}_{a})}^{1/2}(\mathop{\prod }\limits_{b\in {N}_{a}}{(i{Z}_{b})}^{1/2})| G\rangle,$$

(13)

We will refer to this equation in the next section when discussing the additional overhead associated with emit-then-add.

Additional overhead in emit-then-add

Building graph states with our emit-then-add scheme necessitates additional experimental overhead from typical deterministic quantum emitter-based schemes, in both the number of qubits required and entangling operations between them. We demonstrate through an inductive argument that these additional resource costs scale at worst linearly. In what follows, a superscript (p), (s), or (e) denotes the kind of physical qubit associated with the relevant subspace on which an operator acts, as a photon, auxiliary spin, or emitter, respectively.

Let $| G\rangle$ define an existing graph state in which there is at least a single edge between an auxiliary spin and the set of photons previously added to the graph. We label each of these photons by an emission order 1, ⋯, m − 1. Let V_m define the additional vector space describing the emitter and the next photon, m, to be added to the graph, both of which start in $| 0\rangle$. The set of generators which stabilizes the collective vector space V_G + V_m, consisting of the graph and subsequent emitter-photon pair, has the form

$${S}_{{V}_{G}+{V}_{m}}=\langle \cdots \,,\cdots {Z}_{k}^{(p)}\cdots {X}^{(s)},{Z}^{(e)},{Z}_{m}^{(p)}\rangle,$$

(14)

where ⋯ denotes other generators and the notation $\cdots {Z}_{k}^{(p)}\cdots$ is used to keep track of an arbitrary edge between the auxiliary spin and a photon previously added to the graph at some emission step k < m. The subcircuit depicted in Fig. 6 demonstrates an example of how to transfer entanglement (or conditional phase information) from the emitter-photon subsystem to $| G\rangle$, with a single two-qubit spin-spin entangling gate and local complementation. In implementing the example, we transform the stabilizer of the combined vector space in Eq. (14) as

$${S}_{{V}_{G}+{V}_{m}}^{{\prime} }=\langle \cdots,\,{(-1)}^{{c}_{m}}\cdots {Z}_{k}^{(p)}\cdots {X}_{m}^{(p)}{X}^{(s)},\,{(-1)}^{{c}_{m}}{Z}_{m}^{(p)}{Z}^{(s)},\,{(-1)}^{{c}_{m}}{Z}^{(e)}\rangle,$$

(15)

where c_m ∈ {0, 1} is a classical bit value conditioned on the measurement of the emitter.

Fig. 6: A subcircuit equivalent to a CX_s,p gate, up to a conditional phase correction, for transferring entanglement in our proposed scheme.

This example “emit-then-add” step replaces every pumping gate in typical deterministic schemes for generating arbitrary photonic graph states. Entanglement between a photon (p) and a coherently pumped emitter (e) (represented by a red CX_e,p gate) is exchanged to an auxiliary spin (s) via a two-qubit entangling CZ_e,s gate and local complementation. The emitter is measured out thereafter and reinitialized for the next iteration of the procedure. Rotations about X and Z are by π/2 and −π/2, respectively, as noted in Eq. (13). The measurement of the emitter is with respect to the Z basis. All previously added photons at iterations k < m are unaffected.

The result of these operations produces the same stabilizer we would have arrived at had we instead pumped the auxiliary spin itself. With these additional operations, any graph state accessible in the deterministic scheme can be constructed with emit-then-add. As we restrict those auxiliary spins already entangled with any previously added photons from being pumped, it follows that one additional spin, the emitter, and one two-qubit spin-spin entangling gate per photon in G are the minimum additional overhead in our proposed schemes for making arbitrary graph states. Furthermore, we can define a new vector space ${V}_{{G}^{{\prime} }}$, containing the existing graph state and a newly entangled photon, with a dimension that increases by one with each new photon. The new space ${V}_{{G}^{{\prime} }}$ is stabilized by a unique set of generators that can be rotated back to a graph state basis of the same general form as Eq. (14), now defined by a new graph state $| {G}^{{\prime} }\rangle$.

Construction subroutines

We also offer a pair of subroutines that simplify the construction and overhead for the graph state $| G\rangle$, employed in our MPC protocol ${\mathcal{P}}$. Representations of the graph transformations associated with the two subroutines, along with example circuits, are depicted in Figs. 7 and 8. These transformations can be performed successively with no additional operations, transforming the previous graph G built on the auxiliary spin to a new graph ${G}^{{\prime} }$ with any new photons sharing an edge to the auxiliary spin. Despite their intended application in our MPC, we make no assumptions about the measurement of the photons in these subroutines, such that they can be applied generally across experimental implementations.

Fig. 7: Passing-subroutine for adding new photons to an existing graph, G.

a A graph transformation of passing a new photon (green) from the emitter (red) to an auxiliary spin (black), which is connected to one or more previously added photons (white, denoted with a double edge for the multiplicity). This subroutine consists of two variations: (left) leaving all previously added photons invariant, (right) transplanting those edges to the newly added photon. b An example of how local complementations on a target qubit (magenta circle) can be used to add or remove edges. c A quantum subcircuit which implements the graph transformation. The right variation of the graph transformation above is achieved with the additional two local complementations (blue dashed line, depicting the deviation). Rotations and measurements follow the same notation as in Fig. 6.

One “passing”-subroutine, shown in Fig. 7, consists of two variations: “join” and “extend”. The join-subroutine adds a new photon to an existing graph and leaves all previously existing edges invariant. The extend-subroutine transfers all edges from the auxiliary spin to the new photon. The two are achieved without or with the additional two local complementations depicted at the end of the example circuit, respectively. Both variations only act on previously added photons in the neighborhood of the auxiliary spin, N_s. Repeatedly applying the join-subroutine or extend-subroutine on a single auxiliary spin produces a star graph or linear cluster state, respectively, for each variation. Additionally, either variation of this subroutine can be appropriately implemented between auxiliary spins to connect subgraphs.

We note briefly that in practice with each implementation of the passing-subroutine, the newly added photon to the graph and the auxiliary spin each carry a conditional phase that is a byproduct of the decoupling measurement made on the emitter, as shown in Eq. (15). This byproduct phase determines the precise basis state of the graph and may require correction for general MBQCs. In the implementation of our scheme without photonic memory, photons are measured before they are decoupled from the emitter, and hence, any requisite phase corrections need to be commuted after each measurement. The Clifford nature of the measurements employed in our MPC simplifies all of these corrections to bit flips that can be handled classically. Furthermore, correction of this phase is not always necessary, as certain measurements made by the parties destroy this phase information, while other measurements allow the parties to absorb this phase information into their own pad. Conversely, conditional measurements, such as the ones made by Alice in step (I.4) of Stage I of ${\mathcal{P}}$, couple these byproduct phases to the phase information input into the computation. Therefore, classical communication is required here between Alice and the Source. A simple solution is for the Source to make public the outcomes of each of these decoupling measurements.

The other “patching”-subroutine, shown in Fig. 8, serves to attach two subgraphs G₁ and G₂ by a common edge between photons. This process requires an additional two-qubit spin-spin entangling gate from the passing-subroutine. For further simplicity, we only consider the case where G₁ and G₂ each have a single edge to all previously added photons in their respective subgraphs, though in general, this subroutine fully connects all of the photons at the first layer in each subgraph. Operations in this subroutine are restricted locally to only the emitter, spin, and the photons we ultimately require to share an edge, labeled in the figure by arbitrary emission steps j, k in 1, ⋯, n_p. This subroutine mirrors the one employed in the production of large 2D cluster states in ref. ⁶, and can be applied in either scheme we propose for the same purpose.

Fig. 8: Patching-subroutine for attaching two subgraphs G₁ and G₂ by a common edge between photons.

a The graph transformation depicting the patching. b The corresponding circuit diagram. An additional two-qubit spin-spin entangling gates are required for this subroutine, over the passing-subroutine. Rotations follow the same notation as in Fig. 6. c A 2D cluster state built on an array of auxiliary spins. Edges can be generated between photons in the layer neighboring the array of spins with this patching.

Application of these subroutines to the construction of the graph state discussed in Results is straightforward. The state $| G\rangle$, consisting of n_p = 12 photons, labeled by an emission ordering depicted in Fig. 3, can be built following the sequence of steps in the Build below. This procedure requires 17 two-qubit spin-spin entangling gates in total: 13 from passing operations, and 4 from a single patching step. It is known that the sequential nature of photon emission events imparts an ordering on the graph state, limiting the kinds of photonic graphs accessible by construction on a single quantum emitter⁶⁴. As ${\mathcal{P}}$ involves conditioning measurement bases on previous outcomes (steps (I.5) and (I.6)), this sets a nontrivial emission ordering on $| G\rangle$, which, following the results of ref. ²³, requires at least two auxiliary spins to construct.

Build$| G\rangle :$

Input: A photon emission order labeling photons (p₁), ⋯, (p₁₂), corresponding to the n_p = 12 photons in $| G\rangle$, an emitting spin, and two auxiliary spins, labeled (s₁) and (s₂).

• 1. Pass photons (p₁) through (p₄) to (s₁). Apply the join-subroutine for (p₄) and the extend-subroutine for the rest.

• 2. Pass photons (p₅) through (p₈) to (s₂). Apply the join-subroutine for (p₅) and the extend-subroutine for the rest.

• 3. Pass the subgraph on (s₂) to (s₁) with the join-subroutine.

• 4. Pass photons (p₉) through (p₁₂) to (s₂). Apply the join-subroutine for (p₉) and the extend-subroutine for the rest.

• 5. Patch the subgraph on (s₂) with (s₁). Measure out both (s₁) and (s₂).

Graph state construction fidelity

In modeling infidelity from decoherence, we consider two spin states of an emitter and auxiliary spin and some dephasing map that introduces a Pauli Z error on the respective qubit (while neglecting spin-lattice relaxation). That is, we consider the following transformation of the density matrix for the emitter or auxiliary spin,

$$\widehat{\rho }\to \frac{1}{2}(1+{e}^{-t/\tau })\widehat{\rho }+\frac{1}{2}(1-{e}^{-t/\tau })Z\widehat{\rho }Z,$$

(16)

where τ is the coherence time of the emitter or auxiliary spin and t is a timescale for the dephasing process. $\widehat{\rho }$ remains invariant with probability $\frac{1}{2}(1+{e}^{-t/\tau })$. In arriving at Eqs. (1) and (2), t = t_rep + t_add for the emitter, where we assume an emitter dephases at most for a time t_rep + t_add for every photon added before the emitter is disentangled from the graph and reset, and 〈t〉 = t_rep/η_e + t_add for the auxiliary spin for a single iteration, with n_p iterations. F_add in our model includes the effects of additional gate infidelities. See Supplementary Note 1 for additional details.

Utilizing the build discussed above for the resource state $| G\rangle$ in Fig. 3, we utilize these estimates of fidelity in Fig. 5 to determine a bit error rate on each round of our protocol ${\mathcal{P}}$. There, we neglect the effect of dephasing, in assuming t_rep ≪ τ, and let F_add = F_CZ for simplicity. Hence, we take $F={({F}_{\text{add}})}^{17}$, incorporating the additional spin-spin entangling gates utilized in the build of $| G\rangle$.

Graph state construction scaling

The construction time shown in Fig. 2 can be modeled by considering a series of Bernoulli trials that describe the success or failure of detecting a photon, with P = η_e being the probability of a success. As protocols using deterministic schemes require a restart upon a failure to detect a photon, the expected value in the total time to successfully detect n_p consecutive photons is ${t}_{\text{rep}}({P}^{-{n}_{p}}-1)/(1-P)$. In contrast, our emit-then-add scheme requires no restart, as a photon is added to the graph only after it is heralded. Thus, the expected total time for emit-then-add is instead (t_rep/P + t_add)n_p (we neglect t_add in our simulation). The scaling of the generalized scheme involving entanglement swapping is discussed in Supplementary Note 1.

Security theorem for ${\mathcal{P}}$

We return to the security of our protocol ${\mathcal{P}}$, introduced in Results, and give a formal theorem. In this paper, we address two forms of malicious attacks, depicted in Fig. 4, where we assume without loss of generality that P is the party playing honestly. To clarify further, first consider when S potentially deviates from the protocol. The most general physical action can be formally described by a quantum instrument ${\mathcal{I}}$ that might depend on some classical side information λ⁶¹. For every $\widetilde{{\bf{x}}}$ of P, the instrument will generate for S a classical-quantum (cq) state ${\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )$, which contains all of S’s quantum registers along with classical registers recording all of the public communication (c_tot, Γ_P, Γ_S, Γ_R). To maintain consistency with the protocol, we assume S still broadcasts some classical message when called for in the honest protocol, although this message can be generated in an arbitrary way. On the other hand, consider a case when R deviates from the instruction of ${\mathcal{P}}$. Whenever P and S follow the protocol honestly on any pair of inputs $(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$, they will generate for R the cq state ${\rho }_{\text{cq}}^{{\bf{R}}}(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$, from which any operation could be performed by R to extract information.

Theorem 1

(Security of ${\mathcal{P}}$) For any two-party function $f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})={z}_{{\bf{P}}}+{z}_{{\bf{S}}}+{\sum }_{i=1}^{{\mathfrak{R}}}{a}_{i}{b}_{i}$, the protocol ${\mathcal{P}}$ satisfies the following security conditions.

• 1. (Correctness.) If all the parties are honest, then for every input $(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ the output of the ideal protocol can be locally computed from the outputs of ${\mathcal{P}}$.

  $$f(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})={\Gamma }_{{\bf{P}}}+{\Gamma }_{{\bf{S}}}+{\Gamma }_{{\bf{R}}}$$

  (17)

• 2. (Secure if only S cheats.) Suppose P and R follow ${\mathcal{P}}$ honestly, but S potentially deviates. Let ${\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )$ denote the total cq state held by S at the end of ${\mathcal{P}}$, given input $\widetilde{{\bf{x}}}$ of P and side information λ. Then, there exists a simulator ${\mathbb{S}}$ for S interacting with the ideal functionality f_ideal that exactly reproduces ${\rho }_{\text{cq}}^{{\bf{S}}}(\widetilde{{\bf{x}}},\lambda )$ for all $\widetilde{{\bf{x}}}$ and λ.

• 3. (Secure if only R cheats.) Suppose P and S follow ${\mathcal{P}}$ honestly, but R potentially deviates. Let ${\rho }_{\text{cq}}^{{\bf{R}}}(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ denote the total cq state held by R at the end of ${\mathcal{P}}$, given inputs $(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ of P and S, respectively. Then, there exists a simulator ${\mathbb{S}}$ for R interacting with the ideal functionality f_ideal that exactly reproduces ${\rho }_{\text{cq}}^{{\bf{R}}}(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$ for all $(\widetilde{{\bf{x}}},\widetilde{{\bf{y}}})$.

Further details and a formal proof are given in Supplementary Note 2.

Including error correction in ${\mathcal{P}}$

In practice, each bit conjunction computed in Stage I of ${\mathcal{P}}$ will have some error. We can utilize a basic method of classical error correction to alleviate these bit errors. Let ϵ_* denote the largest probability of a bit error in each iteration of Stage I, and let ϵ_f denote the desired final bit error probability on the output f of ${\mathcal{P}}$. Suppose that N parties wish to compute an f on each party’s M-bit input, utilizing ${\mathcal{P}}$. This can be implemented with error correction at a unit rate of R/R₀ lower bounded by

$${\left(6{(M-1)}^{2}{N}^{2}\lceil \frac{{\text{ln}}\,((M-1)N/\sqrt{2{\epsilon }_{f}})}{{\left(\frac{1}{2}-{\epsilon }_{* }\right)}^{2}}\rceil \right)}^{-1},$$

(18)

where R₀ is the scheme-dependent average rate to add a new photon to a graph state. For the simpler emit-then-add scheme we propose, employing only destructive photon measurements, R₀ = η_eR_rep. This rate is plotted in Fig. 5 to depict how benchmarks of the state-of-the-art for highly coherent quantum emitters enable virtually unlimited correction in these bit errors. Further details on Eq. (18) can be found in Supplementary Note 2.