#  $2$-Spinors via Linear Algebra

Roger Plymen  School of Mathematics, Southampton University, Southampton SO17
1BJ, England _and_ School of Mathematics, Manchester University, Manchester
M13 9PL, England<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract.

We give a streamlined account of $2$-spinors, up to and including the Dirac
equation, using little more than the resources of linear algebra. We prove
that the Dirac bundle is isomorphic to the associated bundles
$\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}S$ and
$\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\overline{S}$. A solution
of the Dirac equation determines a pair of conjugate $2$-spinor fields over
the mass shell $X_{m}$.

###### Contents

  1. 1 Introduction
  2. 2 $2$-spinors
    1. 2.1 $4$-spinors as a Clifford module
    2. 2.2 Momentum space
  3. 3 The Dirac Equation
    1. 3.1 The Dirac Bundle
    2. 3.2 The Dirac bundle as an associated vector bundle
    3. 3.3 Dirac equation
    4. 3.4 A pair of conjugate $2$-spinor fields
    5. 3.5 Comments
  4. 4 The transition to spinor fields on space-time

##  1\. Introduction

The classic work on spinors and space-time is by Penrose and Rindler [PR]. In
this magisterial work, the authors demonstrate that $2$-spinors are woven into
the very fabric of space-time. This point is further made in the books by
O’Donnell [O] and Wald [Chapter 13][W].

It is our aim in this Note to show that the basic theory of $2$-spinors, up to
and including the Dirac equation, can be formulated using little more than the
resources of linear algebra.

Throughout this Note, we define the vector space of $4$-spinors as

$\mathfrak{S}=S\oplus\overline{S}$

where $S$ is the vector space of $2$-spinors and $\overline{S}$ is the
conjugate vector space of $S$.

Our approach is canonical except at the moment in §2.2 when one has to
identify a real finite-dimensional vector space $V$ with its space of
characters.

The Dirac bundle is defined and studied in some detail in the the books by
Simms [Sim] and Varadarajan [Var]. Our new result is that the Dirac bundle as
an $\mathrm{SL}_{2}(\mathbb{C})$-bundle is isomorphic to the associated
bundles

(1) $\displaystyle\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}S$

and

(2)
$\displaystyle\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\overline{S}$

where $\mathrm{SU}_{2}$ acts on $S$ and $\overline{S}$ as the spin $1/2$
representation. As a consequence, a solution of the Dirac equation determines
a pair of conjugate $2$-spinor fields over the mass shell $X_{m}$.

In section 2, we present the basic theory of $2$-spinors via linear algebra.
In section 3, we define the Dirac bundle and prove that it is isomorphic to
the associated vector bundles (1) and (2). In section 4, we briefly discuss
the transition from the vector space of $2$-spinors to spinor fields on space-
time.

##  2\. $2$-spinors

Let $W$ be a complex vector space. Then $W$ comprises an abelian group $A$ and
a scalar-multiplication map

(3) $\displaystyle m:(\mathbb{C},A)\to A,\quad\quad(\lambda,v)\mapsto\lambda
v$

Each complex vector space $W$ has a companion vector space, the _conjugate
vector space_ denoted $\overline{W}$. Now $W$ and $\overline{W}$ share the
same underlying abelian group $A$, but the scalar-multiplication map for
$\overline{W}$ is given by

(4) $\displaystyle\overline{m}:(\mathbb{C},A)\to
A,\quad\quad(\lambda,v)\mapsto\overline{\lambda}v$

Let $v\in W$. This means that $v\in A$ equipped with the scalar-multiplication
(3).

The vector spaces $W$ and $\overline{W}$ enjoy a perfect duality, in the sense
that each is the conjugate of the other.

If we wish to refer to $v\in A$ equipped with the scalar-multiplication (4) we
shall write $\overline{v}$ instead of $v$. From a logical point of view, we
have $v=\overline{v}\in A$ but $v$ and $\overline{v}$ lie in the distinct
vector spaces $W$ and $\overline{W}$. From a practical point of view, it is
good to adopt the following convention: we shall always write

$v\in W\quad\textrm{and}\quad\overline{v}\in\overline{W}$

In that case, in accordance with (4), we have

$\overline{\lambda v}=\overline{\lambda}\overline{v}$

If $W$ is finite-dimensional with basis $\\{e_{1},\ldots,e_{n}\\}$ then
$\overline{W}$ admits the basis$\\{\overline{e_{1}},\ldots,\overline{e_{n}})$
so that $W$ and $\overline{W}$ have the same dimension.

Given $A\in\mathrm{GL}(W)$ define the _conjugate_ of $A$ as follows:

$\overline{A}\overline{v}:=\overline{Av}$

Then we have

$\displaystyle\overline{A}(\lambda\overline{v}+\mu\overline{w})$
$\displaystyle=$
$\displaystyle\overline{A(\overline{\lambda}v+\overline{\mu}w})$
$\displaystyle=$
$\displaystyle\overline{\overline{\lambda}Av+\overline{\mu}Aw}$
$\displaystyle=$ $\displaystyle\lambda\overline{Av}+\mu\overline{Aw}$
$\displaystyle=$
$\displaystyle\lambda\overline{A}\overline{v}+\mu\overline{A}\overline{w}$

so that $\overline{A}$ is a _linear_ map $\overline{W}\to\overline{W}$. We
have $\overline{A}\in\mathrm{GL}(\overline{W})$. The matrix of the conjugate
of $A$ is the conjugate of the matrix of $A$.

Now let $S$ denote a complex vector space of dimension $2$. Consider the
tensor product over $\mathbb{C}$

$S\otimes\overline{S}$

This is a complex vector space of dimension $4$. Note the standard tensor
product rule:

$\lambda(x\otimes\overline{y})=(\lambda
x)\otimes\overline{y}=x\otimes\overline{\lambda}\overline{y}$

This vector space admits a canonical involution $J$ defined on elementary
tensors as follows:

$J:S\otimes\overline{S}\to S\otimes\overline{S},\quad\quad
x\otimes\overline{y}\mapsto y\otimes\overline{x}$

We have $J^{2}=I$ the identity map on $S\otimes\overline{S}$. The map $J$
admits two eigenvalues, namely $+1$ and $-1$.

The $+1$-eigenspace of $J$ will be denoted $V$. We define

$V:=\\{v\in S\otimes\overline{S}:Jv=v\\}$

Then $V$ is a canonical subspace of $S\otimes\overline{S}$. We will view $V$
as a real vector space of dimension $4$.

Let $\bigwedge^{2}S$ denote the exterior square of $S$. Choose a basis
$\\{e_{1},e_{2}\\}$ for $S$. Then the $2$-vector $e_{1}\wedge e_{2}$ is a
basis for the $1$-dimensional vector space $\bigwedge^{2}S$. Define an
isomorphism $\varphi:\bigwedge^{2}S\simeq\mathbb{C}$ as follows:

$\varphi(\lambda e_{1}\wedge e_{2})=\lambda$

Next, define

$\varepsilon(x,y):=\varphi(x\wedge y)$

Then we have

$\displaystyle\varepsilon(x,y)$ $\displaystyle=$ $\displaystyle\varphi(x\wedge
y)$ $\displaystyle=$ $\displaystyle\varphi(-y\wedge x)$ $\displaystyle=$
$\displaystyle-\varphi(y\wedge x)$ $\displaystyle=$
$\displaystyle-\varepsilon(x,y)$

and also

$\varepsilon(e_{1},e_{2})=\varphi(e_{1}\wedge e_{2})=1$

so that $\varepsilon$ is a symplectic form on $S$ and $\\{e_{1},e_{2}\\}$ is a
symplectic basis, a _dyad_.

We emphasize that the symplectic form $\varepsilon$ _arises from, and is
determined by, a non-canonical choice of isomorphism_

$\varphi:{\bigwedge}^{2}S\simeq\mathbb{C}$

Define

$\mathrm{SL}(S):=\\{A\in\mathrm{GL}(S):\det(A)=1\\}.$

Once a basis in $S$ has been chosen, we have

$\mathrm{SL}(S)\simeq\mathrm{SL}_{2}(\mathbb{C})$

Let $A\in\mathrm{SL}(S)$. If $Ae_{1}=\alpha_{11}e_{1}+\alpha_{12}e_{2}$ and
$Ae_{2}=\alpha_{21}e_{1}+\alpha_{22}e_{2}$ then

$\displaystyle\varepsilon(Ae_{1},Ae_{2})$ $\displaystyle=$
$\displaystyle\varphi(Ae_{1}\wedge Ae_{2})$ $\displaystyle=$
$\displaystyle\varphi(\det(A)e_{1}\wedge e_{2})$ $\displaystyle=$
$\displaystyle\varphi(e_{1}\wedge e_{2})$ $\displaystyle=$
$\displaystyle\varepsilon(e_{1},e_{2})$ $\displaystyle=$ $\displaystyle 1$

so that $\mathrm{SL}(S)$ acts freely and transitively on the set of all
symplectic bases (dyads).

The basis $\\{\overline{e_{1}},\overline{e_{2}}\\}$ determines an isomorphism
$\overline{\varphi}:\bigwedge^{2}\overline{S}\simeq\mathbb{C}$ as follows:

$\overline{\varphi}(\lambda\overline{e_{1}}\wedge\overline{e_{2}})=\lambda$

and allows us to define

$\overline{\varepsilon}(\overline{x},\overline{y}):=\overline{\varphi}(\overline{x}\wedge\overline{y})$

as a symplectic form on $\overline{S}$.

We have

${\bigwedge}^{2}\overline{S}=\overline{{\bigwedge}^{2}S}$

and so

$\overline{\varepsilon}(\overline{x},\overline{y})=\overline{\varepsilon(x,y)}$

We have

$\displaystyle\overline{A}\overline{e_{1}}$ $\displaystyle=$
$\displaystyle\overline{Ae_{1}}$ $\displaystyle=$
$\displaystyle\overline{a_{11}e_{1}+a_{12}e_{2}}$ $\displaystyle=$
$\displaystyle\overline{a_{11}}\;\overline{e_{1}}+\overline{a_{12}}\;\overline{e_{2}}$

and

$\displaystyle\overline{A}\overline{e_{2}}$ $\displaystyle=$
$\displaystyle\overline{Ae_{2}}$ $\displaystyle=$
$\displaystyle\overline{a_{21}e_{1}+a_{22}e_{2}}$ $\displaystyle=$
$\displaystyle\overline{a_{21}}\;\overline{e_{1}}+\overline{a_{22}}\;\overline{e_{2}}$

so that

$\det(\overline{A})=\overline{\det(A)}=1$

and

$\overline{A}\in\mathrm{SL}(\overline{S})$

Then

$\overline{\varepsilon}(\overline{A}\overline{e_{1}},\overline{A}\overline{e_{2}})=1$

as above and $\mathrm{SL}(\overline{S})$ acts freely and transitively on the
set of dyads for $\overline{S}$.

######  Definition 2.1.

We now define

(5) $\displaystyle h(a\otimes\overline{b},c\otimes\overline{d}):$
$\displaystyle=$
$\displaystyle\varepsilon(a,c)\cdot\overline{\varepsilon}(\overline{b},\overline{d})$

This determines a bilinear form on $S\otimes\overline{S}$, thanks to the
bilinearity of $\varepsilon$ and $\overline{\varepsilon}$. Furthermore, this
is a _symmetric_ bilinear form, for $h$ is invariant under the simultaneous
interchanges $a\to c$ and $\overline{b}\to\overline{d}$.

We are especially interested in the restriction of $h$ to $V$. We denote this
restriction by $g$:

$g=h|_{V}$

This will be a symmetric bilinear form on $V$, and so will have an associated
quadratic form $Q$. We next determine the rank and signature of this quadratic
form.

Conceptually, $h$ is given by the following map:

$\displaystyle S\otimes\overline{S}\otimes S\otimes\overline{S}\cong S\otimes
S\otimes\overline{S}\otimes\overline{S}\to{\bigwedge}^{2}S\otimes{\bigwedge}^{2}\overline{S}\cong\mathbb{C}\otimes\mathbb{C}\cong\mathbb{C}$

Note that this map _depends only on_ $\varepsilon$.

######  Theorem 2.2.

Let $x\in S\otimes\overline{S}$. If $Jx=x$ then $g$, defined as

$g(x):=h(x,x)$

is a quadratic form of rank $4$ and signature $2$, i.e. a Lorentz quadratic
form.

###### Proof.

We will do this via an explicit diagonalization of $g$. Let
$\\{e_{1},e_{2}\\}$ be a basis of $S$. Then $e_{i}\otimes\overline{e_{j}}$ is
a basis of $S\otimes\overline{S}$ with $1\leq i,j\leq 2$. We will write

$e_{i}\cdot\overline{e_{j}}:=e_{i}\otimes\overline{e_{j}}$

Following [PR, 3.1.20], we define

(6) $\displaystyle u_{0}$ $\displaystyle=$
$\displaystyle(e_{1}\cdot\overline{e_{1}}+e_{2}\cdot\overline{e_{2}})/\sqrt{2}$
$\displaystyle u_{1}$ $\displaystyle=$ $\displaystyle
e_{1}\cdot\overline{e_{2}}+e_{2}\cdot\overline{e_{1}}/\sqrt{2}$ $\displaystyle
u_{2}$ $\displaystyle=$ $\displaystyle
i(e_{1}\cdot\overline{e_{2}}-e_{2}\cdot\overline{e_{1}})/\sqrt{2}$
$\displaystyle u_{3}$ $\displaystyle=$ $\displaystyle
e_{1}\cdot\overline{e_{1}}-e_{2}\cdot\overline{e_{2}}/\sqrt{2}$

Then we have

$Ju_{j}=u_{j}$

for all $j$ and so $u_{j}\in V$ for all $j$. We also have

$\displaystyle g(u_{0},u_{0})$ $\displaystyle=$ $\displaystyle
g(e_{1}\cdot\overline{e_{1}}+e_{2}\cdot\overline{e_{2}},e_{1}\cdot\overline{e_{1}}+e_{2}\cdot\overline{e_{2}})$
$\displaystyle=$
$\displaystyle\frac{\varepsilon(e_{1},e_{2})\overline{\varepsilon}(\overline{e_{1}},\overline{e_{2}})}{2}+\frac{\varepsilon(e_{2},e_{1})\varepsilon(\overline{e_{2}},\overline{e_{1}})}{2}$
$\displaystyle=$ $\displaystyle\frac{1}{2}+\frac{1}{2}$ $\displaystyle=$
$\displaystyle 1$

Similarly, we have

$\displaystyle g(u_{j},u_{j})$ $\displaystyle=$ $\displaystyle-1\quad\quad
1\leq j\leq 3$ $\displaystyle g(u_{i},u_{j})$ $\displaystyle=$ $\displaystyle
0\quad\quad i\neq j,\>0\leq i,j\leq 3$

so that $g$ determines a quadratic form $Q$ of rank $4$ and signature $2$,
which we will denote as follows:

$+---$

This is the Lorentz quadratic form. ∎

It is a truly remarkable fact that the Lorentz quadratic form emerges from an
apparently symmetrical situation.

The space $S\oplus\overline{S}$ is a complex vector space of dimension $4$. It
is called the space of $4$-_spinors_. We will write

$\mathfrak{S}:=S\oplus\overline{S}.$

###  2.1. $4$-spinors as a Clifford module

Thanks to Paul Robinson for help with this section.

Let $a,b,c\in S$. Since $S$ has dimension $2$, there must be a linear relation
among $a,b,c$. We make this precise.

######  Lemma 2.3.

[PR, 1.6.19]. Let $a,b,c\in S$. Then we have the cyclic identity

(7) $\displaystyle\varepsilon(b,c)a+\varepsilon(c,a)b+\varepsilon(a,b)c=0$

###### Proof.

Fix $s\in S$ and define

$f(a,b,c):=\varepsilon(s,\varepsilon(b,c)a+\varepsilon(c,a)b+\varepsilon(a,b)c).$

Then $f$ is a skew $3$-form on a $2$-space, hence vanishes for all $s\in S$.
Now invoke the non-singularity of $\varepsilon$. ∎

Define a map

$\phi:S\otimes\overline{S}\to\mathrm{End}(\mathfrak{S})$

as follows:

$\phi(p\otimes\overline{q})(a\oplus\overline{b}):=\sqrt{2}\left[\overline{\varepsilon}(\overline{b},\overline{q})p\oplus\varepsilon(p,a)\overline{q})\right]$

######  Lemma 2.4.

[PW, §2.3]. For all $X,Y\in S\otimes\overline{S}$, we have

$\phi(X)\phi(Y)+\phi(Y)\phi(X)=h(X,Y)I_{\mathfrak{S}}$

###### Proof.

We have

$\displaystyle\frac{1}{2}\phi(r\otimes\overline{s})\phi(p\otimes\overline{q})(a\oplus\overline{b})=$
$\displaystyle\frac{1}{\sqrt{2}}\phi(r\otimes\overline{s})\left[\overline{\varepsilon}(\overline{b},\overline{q})p\oplus\varepsilon(p,a)\overline{q}\right]$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\varepsilon(p,a)\overline{q},\overline{s})r\oplus\varepsilon(r,\overline{\varepsilon}(\overline{b},\overline{q})p)\overline{s}$
$\displaystyle=$
$\displaystyle\varepsilon(p,a)\overline{\varepsilon}(\overline{q},\overline{s})r\oplus\varepsilon(r,p)\overline{\varepsilon}(\overline{b},\overline{q})\overline{s}$

Next, we symmetrize and add:

$\displaystyle\frac{1}{2}\\{\phi(p\otimes\overline{q})\phi(r\otimes\overline{s})+\phi(r\otimes\overline{s})\phi(p\otimes\overline{q})\\}(a\oplus\overline{b})$
$\displaystyle=$
$\displaystyle\varepsilon(p,a)\overline{\varepsilon}(\overline{q},\overline{s})r\oplus\varepsilon(r,p)\overline{\varepsilon}(\overline{b},\overline{q})\overline{s}+\varepsilon(r,a)\overline{\varepsilon}(\overline{s},\overline{q})p\oplus\varepsilon(p,r)\overline{\varepsilon}(\overline{b},\overline{s})\overline{q}$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{q},\overline{s})[\varepsilon(p,a)r-\varepsilon(r,a)p]\oplus\varepsilon(p,r)[\overline{\varepsilon}(\overline{b},\overline{s})\overline{q}-\overline{\varepsilon}(\overline{q},\overline{b})\overline{s}]$

Applying the cyclic identity (7), we obtain

$\displaystyle\varepsilon(p,a)r-\varepsilon(r,a)p$ $\displaystyle=$
$\displaystyle\varepsilon(p,r)a$
$\displaystyle\overline{\varepsilon}(\overline{b},\overline{s})\overline{q}-\overline{\varepsilon}(\overline{q},\overline{b})\overline{s}$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{q},\overline{s})\overline{b}$

Our conclusion is that

$\displaystyle\frac{1}{2}\\{\phi(p\otimes\overline{q})\phi(r\otimes\overline{s})+\phi(r\otimes\overline{s})\phi(p\otimes\overline{q})\\}(a\oplus\overline{b})$
$\displaystyle=$
$\displaystyle\varepsilon(p,r)\overline{\varepsilon}(\overline{q},\overline{s})(a\oplus\overline{b})$

as required. ∎

In view of Lemma 2.4, the map $\phi$ will lift to a morphism of
$\mathbb{C}$-algebras

$\mathcal{C}\ell(V,Q)\otimes_{\mathbb{R}}\mathbb{C}\to\textrm{End}(\mathfrak{S})$

where $\mathcal{C}\ell(V,Q)$ is the Clifford algebra of $V$ with respect to
the quadratic form $Q$. Therefore, $\mathfrak{S}$ slots in as a pointwise
irreducible $\mathbb{Z}/2\mathbb{Z}$-graded Clifford module as in [ABS].

###  2.2. Momentum space

Let $x\in V$. The following equation defines a character of $V$:

$\widehat{x}(y)=\exp(ig(x,y))$

and the map

(8) $\displaystyle V\to\widehat{V},\quad\quad x\mapsto\widehat{x}$

secures a (non-canonical) isomorphism of the real vector space $V$ onto its
Pontryagin dual $\widehat{V}$. The vector space $\widehat{V}$ admits an
$\mathrm{SL}_{2}(\mathbb{C})$-action as follows:

$(A\cdot\widehat{x})(y)=\widehat{x}(A^{-1}y)$

The isomorphism $V\to\widehat{V}$ commutes with the action of
$\mathrm{SL}_{2}(\mathbb{C})$.

We recall the basis $\\{u_{0},u_{1},u_{2},u_{3}\\}$ determined by the
symplectic basis $\\{e_{1},e_{2}\\}$, see (6). A basis of $\widehat{V}$ now
presents itself, namely

$v_{j}:=\widehat{u_{j}}$

As explicit characters, we have

$v_{0}(x)=\exp(ix_{0}),\>v_{1}(x)=\exp(-ix_{1}),\>v_{2}(x)=\exp(-ix_{2}),\>v_{3}(x)=\exp(-ix_{3})$

The basis $\\{u_{o},u_{1},u_{2},u_{3}\\}$ determines an isomorphism

$V\to\mathbb{R}^{4},\quad\quad x\mapsto(x_{0},x_{1},x_{2},x_{3})$

and the basis $\\{v_{0},v_{1},v_{2},v_{3}\\}$ determines an isomorphism

$\widehat{V}\to\mathbb{R}^{4},\quad\quad p\mapsto(p_{0},p_{1},p_{2},p_{3}).$

We will write

$\mathbb{P}^{4}=\widehat{V}.$

Now $V$ equipped with its Lorentz quadratic form is isomorphic to
$\mathbb{P}^{4}$ with its quadratic form

$Q(p)=p_{0}^{2}-p_{1}^{2}-p_{2}^{2}-p_{3}^{2}$

We record this in the following

######  Lemma 2.5.

Thanks to the map (8), we have

$(V,Q)\simeq(\mathbb{P}^{4},Q)$

and this map commutes with the action of $\mathrm{SL}_{2}(\mathbb{C})$.

Lemma 2.5 allows us, by transport of structure, to obtain the following

######  Corollary 2.6.

For all $x,y\in\mathbb{P}^{4}$ we have a morphism

$\phi:\mathcal{C}\ell(\mathbb{P}^{4},Q)\to\textrm{End}(\mathfrak{S})$

for which

$\phi(x)\phi(y)+\phi(y)\phi(x)=2g(x,y)$

In particular, we have

$\phi(p)^{2}=Q(p)$

for all $p\in\mathbb{P}^{4}$.

######  Definition 2.7.

Let $A\in\mathrm{SL}_{2}(\mathbb{C})$. The canonical representation $\pi$ of
$\mathrm{SL}_{2}(\mathbb{C})$ on $S\otimes\overline{S}$ is defined, on
elementary tensors, by the equation

$\pi(A):=A\otimes\overline{A},\quad\quad\quad(x\otimes\overline{y})\mapsto
Ax\otimes\overline{A}\overline{y}$

The canonical representation $\tau$ of $\mathrm{SL}_{2}(\mathbb{C})$ on
$\mathfrak{S}=S\oplus\overline{S}$ is defined, on elementary tensors, by the
equation

$\tau(A):=A\oplus\overline{A},\quad\quad\quad(x\oplus\overline{y})\mapsto
Ax\oplus\overline{A}\overline{y}$

The representations $\pi$ and $\tau$ are intimately related to the Clifford
module map $\phi$ in the following way.

######  Theorem 2.8.

For all $A\in\mathrm{SL}_{2}(\mathbb{C}),X\in V$, we have

$\phi(\pi(A)(X))=\tau(A)\phi(X)\tau(A^{-1})$

###### Proof.

Let $X=p\otimes\overline{q}$. Then the LHS is

$\displaystyle\phi(\pi(A)(X))(a\oplus\overline{b})$ $\displaystyle=$
$\displaystyle\phi(Ap\otimes\overline{A}\overline{q})(a\oplus\overline{b})$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{b},\overline{A}\overline{q})Ap\oplus\varepsilon(Ap,a)\overline{A}\overline{q}$

We also have

$\displaystyle\phi(p\otimes\overline{q})\tau(A^{-1})(a\oplus\overline{b})$
$\displaystyle=$
$\displaystyle\phi(p\otimes\overline{q})(A^{-1}a\oplus\overline{A}^{-1}\overline{b})$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{A}^{-1}\overline{b},\overline{q})p\oplus(p,A^{-1}a)\overline{q}$

so that the RHS is

$\displaystyle\tau(A)\phi(p\otimes\overline{q})\tau(A^{-1})(a\oplus\overline{b})$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{A}^{-1}\overline{b},\overline{q})Ap\oplus(p,A^{-1}a)\overline{A}\overline{q}$
$\displaystyle=$
$\displaystyle\overline{\varepsilon}(\overline{b},\overline{A}\overline{q})Ap\oplus\varepsilon(Ap,a)\overline{A}\overline{q}$

which is the LHS. Note that we always have

$\varepsilon(Ax,Ay)=\det(A)\cdot\varepsilon(x,y)=\varepsilon(x,y)$

for all $A\in\mathrm{SL}_{2}(\mathbb{C})$. ∎

######  Lemma 2.9.

The restriction of $\pi$ to $V$ preserves the Lorentz quadratic form $Q$.

###### Proof.

The map $\pi(A)$ commutes with $J$:

$\displaystyle\pi(A)J(x\otimes\overline{y})$ $\displaystyle=$
$\displaystyle\pi(A)(y\otimes\overline{x})$ $\displaystyle=$ $\displaystyle
Ay\otimes\overline{A}\overline{x}$ $\displaystyle=$
$\displaystyle\pi(A)(y\otimes\overline{x})$ $\displaystyle=$
$\displaystyle\pi(A)J(x\otimes\overline{y})$

for all $A\in\mathrm{SL}_{2}(\mathbb{C})$ and all elementary tensors
$x\otimes\overline{y}$. The map $\pi(A)|_{V}$ is well-defined because

$Jv=v\implies\pi(A)v=\pi(A)Jv=J\pi(A)v$

for all $A\in\mathrm{SL}_{2}(\mathbb{C})$ and all $v\in V$. Finally, we have

$\displaystyle h(\pi(X),\pi(Y))$ $\displaystyle=$ $\displaystyle
h(Ap\otimes\overline{A}\overline{q},Ar\otimes\overline{A}\overline{s})$
$\displaystyle=$
$\displaystyle\varepsilon(Ap,Ar)\overline{\varepsilon}(\overline{A}\overline{q},\overline{A}\overline{s})$
$\displaystyle=$
$\displaystyle\varepsilon(p,r)\overline{\varepsilon}(\overline{q},\overline{s})$
$\displaystyle=$ $\displaystyle h(X,Y).$

∎

We have a commutative diagram

$\begin{CD}V@>{}>{}>S\otimes\overline{S}\\\
@V{{\pi(A)|_{V}}}V{}V@V{}V{{\pi(A)}}V\\\
V@>{}>{}>S\otimes\overline{S}\end{CD}$

in which the horizontal maps are canonical inclusions and the left vertical
map is a Lorentz transformation.

##  3\. The Dirac Equation

###  3.1. The Dirac Bundle

We consider one of the orbits of $\mathrm{SL}_{2}(\mathbb{C})$ acting on
$\mathbb{P}^{4}$. Let $m>0$ and let $v_{0}=(1,0,0,0)\in\mathbb{P}^{4}$.
Explicitly, $v_{0}$ is the character of $\mathbb{R}^{4}$ given by
$x\mapsto\exp(ix_{0})$. Define

$p_{0}=mv_{0}\in\mathbb{P}^{4}$

and define $X_{m}$ to be the orbit of $p_{0}$:

$X_{m}:=\mathrm{SL}_{2}(\mathbb{C})\cdot p_{0}\subset\mathbb{P}^{4}$

This orbit is _the mass shell_ associated with the positive mass $m$.

We recall that

$\mathfrak{S}=S\oplus\overline{S}.$

We begin with the following trivial vector bundle over $X_{m}$:

$X_{m}\times\mathfrak{S}\to X_{m},\quad\quad\quad(p,\Psi)\mapsto p$

With $A\in\mathrm{SL}_{2}(\mathbb{C})$, we define

$\displaystyle A\cdot p$ $\displaystyle=$ $\displaystyle\pi(A)p$
$\displaystyle A\cdot\Psi$ $\displaystyle=$ $\displaystyle\tau(A)\Psi$
$\displaystyle A\cdot(p,\Psi)$ $\displaystyle=$ $\displaystyle(A\cdot
p,A\cdot\Psi)$

We obtain a trivial $\mathrm{SL}_{2}(\mathbb{C})$-bundle of rank $4$, i.e. the
total space and the base space admit an action of
$\mathrm{SL}_{2}(\mathbb{C})$ which commutes with the projection.

We now construct the _Dirac bundle_ as a sub-bundle. The total space is

$\mathfrak{B}_{m}:=\\{(p,\Psi):p\in
X_{m},\;\Psi\in\mathfrak{S},\;\phi(p)\Psi=m\Psi\\}$

the base space is $X_{m}$, and the projection is

$\mathfrak{B}_{m}\to X_{m},\quad\quad(p,\Psi)\mapsto p.$

The fibre at $p\in X_{m}$ is the linear subspace of $\mathfrak{S}$ given by

$\\{(p,\Psi):\phi(p)\cdot\Psi=m\Psi\\}$

Now we have

$\displaystyle\phi(p)\Psi$ $\displaystyle=$ $\displaystyle m\Psi$
$\displaystyle\implies\tau(A)\phi(p)\Psi$ $\displaystyle=$ $\displaystyle
m\tau(A)\Psi$ $\displaystyle\implies\tau(A)\phi(p)\tau(A^{-1})\tau(A)\Psi$
$\displaystyle=$ $\displaystyle m\tau(A)\Psi$
$\displaystyle\implies\phi(Ap)(\tau(A)\Psi)$ $\displaystyle=$ $\displaystyle
m\tau(A)\Psi$

by Theorem (2.8). That is to say,

$\phi(p)\Psi=m\Psi\implies\phi(Ap)(A\cdot\Psi)=m(A\cdot\Psi)$

This shows that $\mathrm{SL}_{2}(\mathbb{C})$ sends, for each
$A\in\mathrm{SL}_{2}(\mathbb{C})$, the fibre at $p$ to the fibre at $A\cdot
p$. Therefore, the Dirac bundle $\mathfrak{B}_{m}\to X_{m}$ is an
$\mathrm{SL}_{2}(\mathbb{C})$-bundle.

We have $\phi(p_{0})=m\phi(v_{0})=m\gamma_{0}$ and so the fibre at $p_{0}$ is
given by

$\\{\Psi\in\mathfrak{S}:\gamma_{0}\Psi=\Psi\\}$

This is the eigenspace of $\gamma_{0}$ with eigenvalue $1$. Now
$\gamma_{0}^{2}=1$, so $\gamma_{0}$ has two eigenspaces
$\mathfrak{S}_{+},\mathfrak{S}_{-}$ of dimension $2$ with eigenvalues $+1,-1$.

Therefore, the Dirac bundle is an $\mathrm{SL}_{2}(\mathbb{C})$-bundle of rank
$2$.

The isotropy subgroup of $\mathrm{SL}_{2}(\mathbb{C})$ at $p_{0}$ is the
compact Lie group $\mathrm{SU}_{2}$. By Lemma 2.5 and Theorem 2.8, we have

$\tau(A)\gamma_{0}=\gamma_{0}\tau(A)$

for all $A\in\mathrm{SU}_{2}$. We have

$\Psi\in\mathfrak{S}_{+}\implies\gamma_{0}\Psi=\Psi\implies\tau(A)\gamma_{0}\Psi=\tau(A)\Psi\implies\gamma_{0}\tau(A)\Psi=\tau(A)\Psi\implies\tau(A)\Psi\in\mathfrak{S}_{+}$

so that $\tau|_{\mathrm{SU}_{2}}$ leaves $\mathfrak{S}_{+}$ invariant.

The vector space $\mathfrak{S}$ admits a natural basis, namely
$\\{e_{1},e_{2},\overline{e_{1}},\overline{e_{2}}\\}$. We calculate that

$\displaystyle\phi(v_{0})(e_{2}+\overline{e_{1}})$ $\displaystyle=$
$\displaystyle e_{2}+\overline{e_{1}}$
$\displaystyle\phi(v_{0})(e_{1}-\overline{e_{2}})$ $\displaystyle=$
$\displaystyle e_{1}-\overline{e_{2}}$
$\displaystyle\phi(v_{0})(e_{1}+\overline{e_{2}})$ $\displaystyle=$
$\displaystyle-(e_{1}+\overline{e_{2}})$
$\displaystyle\phi(v_{0})(e_{2}-\overline{e_{1}})$ $\displaystyle=$
$\displaystyle-(e_{2}-\overline{e_{1}})$

The $+1$-eigenspace of $\phi(v_{0})$ is therefore given by

$\mathfrak{S}_{+}=\textrm{span
of}\>\\{e_{1}-\overline{e_{2}},e_{2}+\overline{e_{1}}\\}$

Let

$A=\left(\begin{array}[]{cc}e^{it}&0\\\ 0&e^{-it}\end{array}\right)$

Then we have

$\tau(A)e_{1}=e^{it}e_{1},\quad\tau(A)e_{2}=e^{-it}e_{2},\quad\tau(A)\overline{e_{1}}=e^{-it}\overline{e_{1}},\quad\tau(A)\overline{e_{2}}=e^{it}\overline{e_{2}}$
$\displaystyle\tau(A)(e_{1}-\overline{e_{2}})$ $\displaystyle=$ $\displaystyle
e^{it}(e_{1}-\overline{e_{2}})$ $\displaystyle\tau(A)(e_{2}+\overline{e_{1}})$
$\displaystyle=$ $\displaystyle e^{-it}(e_{2}+\overline{e_{1}})$

The character of $\tau(A)$ is therefore $e^{it}+e^{-it}$ and so
$\tau|_{\mathrm{SU}_{2}}$ is the spin $1/2$ representation of
$\mathrm{SU}_{2}$ on $\mathfrak{S}_{+}$.

###  3.2. The Dirac bundle as an associated vector bundle

Let $p_{0}=(m,0,0,0)$ and note that

$\mathrm{SL}_{2}(\mathbb{C})/\mathrm{SU}_{2}\simeq X_{m},\quad\quad A\mapsto
Ap_{0}.$

We construct the associated vector bundle

$\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\mathfrak{S}_{+}$

where $\mathrm{SU}_{2}$ acts on $\mathfrak{S}_{+}$ via the spin $1/2$
representation $\tau|_{\mathrm{SU}_{2}}$. The elements of the associated
vector bundle are equivalence classes $[A,\Psi]$ with
$A\in\mathrm{SL}_{2}(\mathbb{C})$ and $\Psi\in\mathfrak{S}_{+}$, defined as

$[A,\Psi]:=\\{(AT,\tau(T)^{-1}\Psi):T\in\mathrm{SU}_{2}\\}$

######  Theorem 3.1.

There is an isomorphism of $\mathrm{SL}_{2}(\mathbb{C})$-bundles as follows:

$\beta:\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\mathfrak{S}_{+}\simeq\mathfrak{B}_{m}$
$[A,\Psi]\mapsto(Ap_{0},\tau(A)\Psi)$

###### Proof.

Note that $\mathfrak{S}_{+}\subset\mathfrak{S}$ and
$\tau(A)\Psi\in\mathfrak{S}$. The map $\beta$ is well-defined: replacing $A$
by $AT$ and $\Psi$ by $\tau(T^{-1})\Psi$, we have

$(AT,\tau(T)^{-1}\Psi)\mapsto(ATp_{0},\tau(AT)\tau(T)^{-1}\Psi)=(Ap_{0},\tau(A)\Psi).$

We have

$\displaystyle\phi(Ap_{0})\tau(A)\Psi$ $\displaystyle=$
$\displaystyle\tau(A)\phi(p_{0})\tau(A^{-1})\tau(A)\Psi\quad\textrm{by}\quad\textrm{Theorem}\;\ref{Cliff}$
$\displaystyle=$ $\displaystyle\tau(A)\phi(p_{0})\Psi$ $\displaystyle=$
$\displaystyle\tau(A)m\gamma_{0}\Psi$ $\displaystyle=$
$\displaystyle\tau(A)m\Psi\quad\textrm{since}\quad\Psi\in\mathfrak{S}_{+}$
$\displaystyle=$ $\displaystyle m\tau(A)\Psi$

so that $(Ap_{0},\tau(A)\Psi)\in\mathfrak{B}_{m}$ as required.

Conversely, given $(p,\Psi)\in\mathfrak{B}_{m}$. Choose $A$ such that
$p=Ap_{0}$ and set $\Phi=\tau(A)^{-1}\Psi$. Then we have

$\displaystyle\phi(p)\Psi$ $\displaystyle=$ $\displaystyle m\Psi$
$\displaystyle\implies\tau(A)\phi(p_{0})\tau(A)^{-1}\tau(A)\Phi$
$\displaystyle=$ $\displaystyle m\tau(A)\Phi$
$\displaystyle\implies\tau(A)\phi(p_{0})\Phi$ $\displaystyle=$ $\displaystyle
m\tau(A)\Phi$ $\displaystyle\implies\gamma_{0}\Phi$ $\displaystyle=$
$\displaystyle\Phi$ $\displaystyle\implies\Phi$ $\displaystyle\in$
$\displaystyle\mathfrak{S}_{+}$

Therefore, we have

$\beta:(A,\Phi)\mapsto(Ap_{0},\tau(A)\Phi)=(p,\Psi)$

as required.

Now $A$ is determined mod $\mathrm{SU}_{2}$. If we replace $A$ by $AT$ with
$T\in\mathrm{SU}_{2}$ then we must replace $(A,\Phi)$ by $(AT,y)$ with $y$
defined by

$y=\tau(AT)^{-1}\Psi=\tau(T)^{-1}\tau(A)^{-1}\Psi=\tau(T)^{-1}\Phi\in\mathfrak{S}_{+}$

This leads to the pair

$(AT,\tau(T)^{-1}\Phi)$

which is in the same equivalence class as $(A,\Phi)$. Therefore, the inverse
of the map $\beta$ is well-defined. ∎

######  Corollary 3.2.

The Dirac bundle is isomorphic as an $\mathrm{SL}_{2}(\mathbb{C})$-bundle to
the associated vector bundles

$\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}S$

and

$\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\overline{S}$

###### Proof.

There is a natural action of $\mathrm{SL}_{2}(\mathbb{C})$ on $S$. The action
on the conjugate vector space is defined as

$A\cdot\overline{v}=\overline{Av}$

with $A\in\mathrm{SL}_{2}(\mathbb{C})$ and $v\in S$. Now use the fact that
$\mathfrak{S}_{+},S$ and $\overline{S}$ are isomorphic as
$\mathrm{SU}_{2}$-modules. ∎

###  3.3. Dirac equation

The condition

$\phi(p)\Psi=m\Psi$

with $\Psi\in\mathfrak{S}$ is, written in full,

$\left(p_{0}\gamma_{0}+p_{1}\gamma_{1}+p_{2}\gamma_{2}+p_{3}\gamma_{3}\right)\Psi=m\Psi$

In the slashed notation [F, p.118], this equation appears as

(9) $\displaystyle\not{p}\Psi=m\Psi$

This is the Dirac equation. After Fourier transform of the variables
$p_{0},p_{1},p_{2},p_{3}$, the equation appears in the more familiar form

$\sum_{r=0}^{3}i\gamma_{r}\frac{\partial}{\partial x_{r}}\Psi=m\Psi$

where $\gamma_{\mu}:=\phi(v_{\mu})$ with $\mu=0,1,2,3,$ are $\gamma$-matrices
satisfying the conditions

$\displaystyle\gamma_{0}^{2}$ $\displaystyle=$ $\displaystyle 1$
$\displaystyle\gamma_{1}^{2}$ $\displaystyle=$
$\displaystyle\gamma_{2}^{2}\>=\>\gamma_{3}^{2}\>=-1$
$\displaystyle\gamma_{\mu}\gamma_{\nu}$ $\displaystyle=$
$\displaystyle-\gamma_{\nu}\gamma_{\mu}$

for all $\mu\neq\nu$.

###  3.4. A pair of conjugate $2$-spinor fields

Let $\Psi$ be a solution of the Dirac equation (9), i.e. $\phi(p)\Psi=m\Psi$.
To mark the dependence on $p$, we will write this equation as

$\phi(p)\Psi_{p}=m\Psi_{p}$

Then $\\{\Psi_{p}:p\in X_{m}\\}$ is a section of the Dirac bundle
$\mathfrak{B}_{m}$. By Corollary 3.2, $\mathfrak{B}_{m}$ is isomorphic to the
associated bundle

(10) $\displaystyle\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}S$

The section $\\{\Psi_{p}:p\in X_{m}\\}$ therefore determines a section of
(10), which is a $2$-spinor field over the manifold $X_{m}$. Now
$\mathfrak{B}_{m}$ is also isomorphic to the conjugate bundle

(11)
$\displaystyle\mathrm{SL}_{2}(\mathbb{C})\times_{\mathrm{SU}_{2}}\overline{S}$

and so the section $\\{\Psi_{p}:p\in X_{m}\\}$ determines a section of (11),
which is the conjugate $2$-spinor field. In this way, a solution of the Dirac
equation determines a pair of conjugate $2$-spinor fields over the manifold
$X_{m}$.

###  3.5. Comments

It is worth noting that the Clifford module structure of $\mathfrak{S}$
survives up to and including the Dirac equation, for $\phi(p)$ belongs to the
Clifford algebra $\mathcal{C}\ell(\mathbb{P}^{4},Q)$.

In the literature, in the mathematical accounts of the Dirac equation [Var,
Eqn.(136)], [Sim, p.72], [Jos, Eqn.1.3.52] one finds the map

$A\mapsto A\oplus(A^{*})^{-1}$

instead of our map

$\tau(A)=A\oplus\overline{A}$

From a conceptual point of view, the adjoint $A^{*}$ of $A\in\mathrm{SL}(S)$
is not defined, because $S$ is not equipped with a sesquilinear inner product.
The space $S$ is endowed only with the symplectic form
$(x,y)\mapsto\varepsilon(x,y)$.

##  4\. The transition to spinor fields on space-time

So far, we have dealt only with $2$-spinors. In order to apply this theory to
_spinor fields_ on space-time, we proceed as follows.

Let $\mathfrak{M}$ be a smooth real $4$-manifold. The first observation is
that we can view $S$ as a (smooth) complex $2$-plane bundle over the base
space $\mathfrak{M}$. The second observation is that the operations of
conjugation, direct sum and tensor product are as easy to apply to vector
bundles as to vector spaces. Then $\overline{S}$ is the conjugate of $S$,
$\varepsilon$ is a non-degenerate symplectic form on $S$, $V$ is the real part
of $S\otimes\overline{S}$, and $g$ is the Lorentz metric with signature $+---$
given by

$g=\varepsilon\otimes\overline{\varepsilon}.$

Then $V$ is a real $4$-plane bundle on $\mathfrak{M}$, equipped with the
Lorentz metric tensor. At this point, we have to identify $V$ with the tangent
bundle $T\mathfrak{M}$ of $\mathfrak{M}$:

$T\mathfrak{M}=V.$

In the terminology of [PR, p.211], we must identify the world-vectors in $V$
with the tangent vectors to the manifold $\mathfrak{M}$. In that case, we can
view $\mathfrak{M}$ as a model of curved space-time in general relativity. The
smooth sections of the vector bundle $S$ are called $2$-spinor fields; the
smooth sections of $\mathfrak{S}$ are called $4$-spinor fields.

The whole of §2 carries over, _at no extra cost_ , to the theory of spinor
fields on manifolds. In this formulation, the curved space-time $\mathfrak{M}$
of general relativity is _already equipped_ with spinor fields.

## References

  * [ABS] M. Atiyah, R. Bott, A. Shapiro, Clifford modules, Topology 3 (supplement 1) (1964) 3–38.
  * [F] R.P. Feynman, The Theory of Fundamental Processes, Benjamin / Cummings 1982.
  * [Jos] J. Jost, Geometry and Physics, Springer 2009.
  * [O] P. O’Donnell, Introduction to $2$-Spinors in General Relativity, World Scientific 2003.
  * [PR] R. Penrose, W. Rindler, Spinors and Space-Time, volume 1 and volume 2, Revised Edition, Cambridge University Press 2008.
  * [PW] R.J. Plymen, B.W. Westbury, Complex conformal rescaling and spin-structure, Bull. London Math. Soc. 19 (1987) 363–370.
  * [Sim] D.J. Simms, Lie Groups and Quantum Mechanics, Springer LNM 52 (1968).
  * [Var] V.S. Varadarajan, Geometry of Quantum Theory, Second Edition, Springer 2007.
  * [W] R.M. Wald, General Relativity, University of Chicago Press 1984.


# Blind Quantum Machine Learning with Quantum Bipartite Correlator

Changhao Li<EMAIL_ADDRESS>Global Technology Applied Research,
JPMorgan Chase, New York, NY 10017 USA  Research Laboratory of Electronics,
Massachusetts Institute of Technology, Cambridge, MA 02139, USA  Department of
Nuclear Science and Engineering, Massachusetts Institute of Technology,
Cambridge, MA 02139, USA  Boning Li  Research Laboratory of Electronics,
Massachusetts Institute of Technology, Cambridge, MA 02139, USA  Department of
Physics, Massachusetts Institute of Technology, Cambridge, MA 02139, USA  Omar
Amer  Global Technology Applied Research, JPMorgan Chase, New York, NY 10017
USA  Ruslan Shaydulin  Global Technology Applied Research, JPMorgan Chase, New
York, NY 10017 USA  Shouvanik Chakrabarti  Global Technology Applied Research,
JPMorgan Chase, New York, NY 10017 USA  Guoqing Wang  Research Laboratory of
Electronics, Massachusetts Institute of Technology, Cambridge, MA 02139, USA
Department of Nuclear Science and Engineering, Massachusetts Institute of
Technology, Cambridge, MA 02139, USA  Haowei Xu  Department of Nuclear Science
and Engineering, Massachusetts Institute of Technology, Cambridge, MA 02139,
USA  Hao Tang  Department of Materials Science and Engineering, Massachusetts
Institute of Technology, Cambridge, MA 02139, USA  Isidor Schoch  Department
of Nuclear Science and Engineering, Massachusetts Institute of Technology,
Cambridge, MA 02139, USA  Niraj Kumar  Global Technology Applied Research,
JPMorgan Chase, New York, NY 10017 USA  Charles Lim  Global Technology Applied
Research, JPMorgan Chase, New York, NY 10017 USA  Ju Li<EMAIL_ADDRESS>Department of Nuclear Science and Engineering, Massachusetts Institute of
Technology, Cambridge, MA 02139, USA  Department of Materials Science and
Engineering, Massachusetts Institute of Technology, Cambridge, MA 02139, USA
Paola Cappellaro<EMAIL_ADDRESS>Research Laboratory of Electronics,
Massachusetts Institute of Technology, Cambridge, MA 02139, USA  Department of
Nuclear Science and Engineering, Massachusetts Institute of Technology,
Cambridge, MA 02139, USA  Department of Physics, Massachusetts Institute of
Technology, Cambridge, MA 02139, USA  Marco Pistoia
<EMAIL_ADDRESS>Global Technology Applied Research, JPMorgan Chase,
New York, NY 10017 USA

###### Abstract

Distributed quantum computing is a promising computational paradigm for
performing computations that are beyond the reach of individual quantum
devices. Privacy in distributed quantum computing is critical for maintaining
confidentiality and protecting the data in the presence of untrusted computing
nodes. In this work, we introduce novel blind quantum machine learning
protocols based on the quantum bipartite correlator algorithm. Our protocols
have reduced communication overhead while preserving the privacy of data from
untrusted parties. We introduce robust algorithm-specific privacy-preserving
mechanisms with low computational overhead that do not require complex
cryptographic techniques. We then validate the effectiveness of the proposed
protocols through complexity and privacy analysis. Our findings pave the way
for advancements in distributed quantum computing, opening up new
possibilities for privacy-aware machine learning applications in the era of
quantum technologies.

##  I Introduction

Quantum computation that leverages the principles of quantum mechanics has the
potential to tackle problems that are beyond the reach of classical computers,
revolutionizing fields ranging from cryptography [1] to finance [2] and drug
discovery [3]. Distributed quantum computing has attracted a lot of attention
in recent years [4, 5, 6, 7, 8, 9, 10] due to the rapid progress in quantum
communication technologies. In distributed quantum computing, multiple quantum
processors are connected over a network, enabling collaborative computation
and resource sharing. This approach is crucial for scaling up quantum
computing power and overcoming the limitations of individual quantum systems.
Exploiting distributed quantum resources enables tackling larger and more
computationally complex problems in domains such as optimization, simulation
and quantum machine learning (QML). QML is especially suitable for distributed
computation due to the need to process large datasets.

Privacy in distributed computing plays a vital role in ensuring the
confidentiality and security of sensitive information processed by multiple
parties. Distributed quantum computation involves sharing and transmitting of
quantum states across multiple nodes, making it paramount to protect the
privacy of data and prevent unauthorized access. Furthermore, in practice,
addressing privacy concerns in distributed quantum computing is essential for
facilitating applications in fields such as finance and healthcare, where
preserving the privacy of sensitive data is of utmost importance.

A number of protocols have been proposed in recent years that aim to implement
private distributed quantum computing. For example, blind quantum computing
[11, 12, 13] enables the client to execute a quantum computation using one or
more remote quantum servers while keeping the structure of the computation
hidden. Meanwhile, reducing the overhead in communication over blind quantum
computation protocols has been an active research area since the first
proposal of universal blind quantum computation (UBQC) [11]. However, for
distributed quantum computing problems such as QML, ensuring the privacy of
data from a certain party while reducing the overhead in both quantum
communication and computation remains a challenge.

In this work, we introduce novel protocols for blind distributed quantum
machine learning based on quantum bipartite correlator algorithm that can
perform inner product estimation tasks. Our protocols are communication-
efficient compared with state-of-the-art classical and quantum blind
distributed machine learning algorithms. Particularly, for the task of
distributed inner product estimation, a core subroutine in machine learning
applications, the protocols involve a communication complexity $O(\log
N/\epsilon)$ with $N$ and $\epsilon$ being the size of the vectors and
standard estimation error, respectively. We demonstrate how our protocols
allow the client to conceal its data from the server, and vice versa. We
provide a detailed resource analysis for both communication and computation
costs of our methods. Our work paves the way for performing quantum machine
learning with an untrusted device, while maintaining the privacy and keeping
the resource overhead low.

##  II Formalism

We start by presenting the problem statement in distributed quantum
computation. The basic setting includes two parties, Alice and Bob. We assume
that Alice has more quantum computational resources than Bob, such as a larger
number of qubits. In many distributed quantum computation applications such as
a delegated computation setting, Alice can be considered as a quantum server
with Bob being a client. Furthermore, there is a quantum channel where qubits
can be transmitted between the two parties. For the distributed QML tasks
studied in this work, we assume that Alice holds the data $\boldsymbol{X}$ and
Bob holds $\boldsymbol{y}$. For example, in supervised learning,
$\boldsymbol{X}$ and $\boldsymbol{y}$ could be feature data and labels,
respectively [14], while in unsupervised learning, both $\boldsymbol{X}$ and
$\boldsymbol{y}$ can be feature data with the objective to cluster them based
on distance estimation [15].

We consider the task of blind quantum machine learning, such as linear
regression or classification [16, 17, 18, 19]. In machine learning, evaluating
the inner product between two vectors is an important algorithmic building
block. The server holds the data vector $\boldsymbol{X}$ of size $N$ and the
number of features for each data point is $M$, and the client holds a one-
dimensional bitstring $\boldsymbol{y}$ with the same size $N$. Note that
transmitting the data classically to the server would introduce $O(N)$
complexity in communication. Meanwhile, as we consider distributed quantum
computation, the data $\boldsymbol{X}$ and $\boldsymbol{y}$ are only held
locally by the server and client, respectively.

In classical settings, the goal of achieving distributed machine learning with
privacy can be approached using various techniques, such as homomorphic
encryption [20, 21], which allows computation over encrypted data.
Specifically, for distributed bipartite correlation estimation, many methods
could be employed, including linearly homomorphic encryption [22, 23], non-
interactive inner product protocols [24] and oblivious-transfer-based secure
computation [25]. However, it is important to note that these classical
methods often introduce considerable overhead in terms of computation and
communication complexity. Particularly, a communication cost of $\tilde{O}(N)$
would be a minimum requisite [24]. As a result, their practical applications
become limited, especially when dealing with large data sizes.

##  III Quantum bipartite correlator algorithm and its privacy

In this section, we briefly introduce the quantum bipartite correlator (QBC)
algorithm that can estimate the correlation between two bitstrings held by
remote parties [8]. The algorithm can be easily generalized to perform other
computation tasks, such as the Hamming distance estimation. We remark that
estimating bipartite correlation or Hamming distance serves as the building
block of a general class of machine learning problems, including least-square
fitting and classification of discrete labels [26, 27].

Without loss of generality, we consider binary floating point numbers. We take
the feature dimension $M$ to be one for simplicity hereafter unless specified.
For two vectors $\boldsymbol{X},\boldsymbol{y}\equiv[x_{1},\cdots
x_{N}]^{T},[y_{1},\cdots y_{N}]^{T}\in\\{0,1\\}^{N}$, we are interested in
evaluating $\overline{xy}=\frac{1}{N}\sum_{i=1}^{N}x_{i}y_{i}$ within a
standard deviation error $\epsilon$. To begin with, we assume that the two
parties Alice and Bob hold a local oracle that can encode their own data using
a unitary transformation. That is, for Alice, one has
$\hat{U}_{\vec{x}}:|i\rangle_{n}|0\rangle\mapsto|i\rangle_{n}|x_{i}\rangle$
that encodes the data $x_{i}$, where $|i\rangle_{n}$ is an
$n\equiv\lceil\log_{2}(N)\rceil$-qubit (called index qubit hereafter) state
$|i_{1}i_{2}\cdots i_{n}\rangle$, representing the index of the queried
component with $i_{k}\in\\{0,1\\}$, $k\in[N]$, and $|x_{i}\rangle$ is a
single-qubit state. Similarly, Bob has an oracle $\hat{U}_{\vec{y}}$ of the
same type that encodes his local data $y_{i}$. These oracle operators, as well
as the ones introduced later, could be implemented with various techniques
such as quantum random access memory [28].

QBC is based on the quantum counting algorithm, where Alice and Bob send
qubits via quantum channels and communicate with each other to realize the
phase oracle [29, 8], as shown in the top of Fig. 1. The quantum counting
algorithm consists of a Grover operator
$\hat{G}_{\vec{x},\vec{y}}\equiv\hat{H}^{\otimes n}(2|0\rangle_{n}\langle
0|_{n}-\hat{I})\hat{H}^{\otimes n}\hat{U}_{xy}$, where $\hat{U}_{xy}$ is a
unitary operator that encodes information of both parties as we will introduce
below, and inverse Quantum Fourier transform (QFT†) on register qubits
$\ket{\cdot}_{t}$. When measuring the $t$-register, one can project it into a
state $|j\rangle_{t}$ with phase $2\pi j\cdot 2^{-t}$ which encodes either
$\hat{\theta}$ or $2\pi-\hat{\theta}$, where
$\theta=2\arcsin{\sqrt{\overline{xy}}}$, with equivalent standard deviation:
$\Delta\hat{\theta}=2^{-t+1}$ [8].

During the phase oracle $\hat{G}_{\vec{x},\vec{y}}$, the following unitary
circuit is applied to achieve encoding of $x_{i}$ and $y_{i}$

$\hat{U}_{xy}\ket{i}_{n}\ket{00}_{o_{1}o_{2}}=(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{00}_{o_{1}o_{2}},$
(1)

where $o_{1}$, $o_{2}$ are two qubits locally held by Alice and Bob,
respectively. The above unitary operator can be implemented with the local
oracles that Alice and Bob hold, i.e., $\hat{U}_{\vec{x}}$ and
$\hat{U}_{\vec{y}}$.

Specifically, Alice encodes her local information $\boldsymbol{X}$ into qubit
$o_{1}$ via $\hat{U}_{\vec{x}}$ operator and sends the $(n+1)$-qubit state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{x_{i}}_{o_{1}}$ to Bob via a
quantum channel. After Bob applies his oracle and generates the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{x_{i}}_{o_{1}}\ket{y_{i}}_{o_{2}}$,
a controlled-Z (CZ) gate between qubit $o_{1}$ and $o_{2}$ is applied to
encode the correlation information into the phase of the quantum state. That
is, the bipartite quantum state is described by
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{x_{i}}_{o_{1}}\ket{y_{i}}_{o_{2}}$.
The following local oracles would then yield the desired state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}$ on which Alice
will apply the quantum counting algorithm to estimate
$\overline{xy}=\frac{1}{N}\sum_{i=1}^{N}x_{i}y_{i}$ with bounded error
$\epsilon$. We note that the CZ gate might be replaced with a different set of
gates to estimate other types of correlations between $\boldsymbol{X}$ and
$\boldsymbol{y}$. For example, to calculate their Hamming distance, one can
implement the XOR gate $x_{i}\oplus y_{i}$ by replacing the CZ gate with a Z
gate on $o_{2}$ sandwiched by two CNOT gates between $o_{1}$ and $o_{2}$ [8].

In the QBC algorithm, the communication complexity, i.e., the qubits
transmitted during the overall process, is given by the Grover operation’s
$2(n+1)$ qubits communication repeated for $2^{t}-1$ iterations:

$\mathcal{C}_{\rm
comm}=2(n+1)(2^{t}-1)=O\left(\frac{\log_{2}(N)}{\epsilon}\right),$ (2)

where the number of register qubits $t$ is chosen to satisfy the desired error
bound. We remark that the above communication complexity is advantageous
compared with the SWAP-test-based algorithm that has a scaling of
$O\left(\log_{2}(N)/\epsilon^{2}\right)$ [30] or LOCC-based algorithms with a
scaling of
$O\left(\log_{2}(N)\max\\{1/\epsilon^{2},\sqrt{N}/\epsilon\\}\right)$ [31].
This advantage is achieved by utilizing the distributed Grover operations.

The computational complexity, on the other hand, is the total number of oracle
calls by Alice and Bob:

$\mathcal{C}_{\rm comp}=4(2^{t}-1)=O\left(\frac{1}{\epsilon}\right).$ (3)

We next consider the privacy of data in the QBC algorithm discussed above.
From now on, we consider Alice as a server and Bob as a client. We first focus
on the privacy of the client’s information $\boldsymbol{y}$ to a semi-honest
adversary. In this type of adversary, the honest-but-curious server follows
the protocol and does not do any malicious behavior, but it tries to violate
the privacy of the client’s input by scrutinizing the messages transmitted in
the protocol. That is, the server tries to infer $\boldsymbol{y}$ from the
estimated $\frac{1}{N}\sum_{i}^{N}x_{i}y_{i}$.

In the trivial case when $x_{i}=0,\forall i\leq N$, we have $\overline{xy}=0$
no matter what $\boldsymbol{y}$ is and the protocol has the best privacy.
While in the worst case where the $x_{i}=1,\forall i\leq N$ and
$\overline{xy}=1$, the server could infer that $y_{i}=1,\forall i\leq N$. In
general, for $\boldsymbol{X}$ with Hamming weight $d_{x}$, the probability
that the server gets the exact $\boldsymbol{y}$ (that is, the Hamming distance
between extracted and exact bitstring is $d_{0}=0$) is given by

$\text{Pr}(d_{x})=\frac{1}{2^{N-d_{x}}}\frac{\prod_{i=1}^{d_{x}}i}{\prod_{i=1}^{N\overline{xy}}i\prod_{i=1}^{d_{x}-N\overline{xy}}i},$
(4)

where the factor $\frac{1}{2^{N-d_{x}}}$ comes from server having random guess
on the indices $j$ that satisfies $x_{j}=0$. For a honest server in the
original QBC protocol, however, the $\boldsymbol{y}$ information is always
hidden from the server and is private.

In addition to the semi-honest adversary scenario discussed above, we note
that in the original QBC algorithm, the preservation of privacy is not assured
when we consider a malicious server Alice. The server has the capability to
acquire, to a certain extent, Bob’s strings $\boldsymbol{y}$ by deviating from
the expected quantum operations. We next discuss the designed blind QBC
protocol with such an untrusted server.

Figure 1: Diagram for blind QBC with untrusted server. The upper diagram shows
the quantum counting algorithm consisting Grover phase oracles
$\hat{G}_{\vec{x},\vec{y}}$ and inverse QFT, while the lower box panel shows
the realization details of each phase oracle. Compared to the original QBC
algorithm, we introduce an ancillary qubit $o_{3}$ on client’s side to add a
phase $g_{i}$ during the computation process. The phase can be introduced via
applying a phase gate on qubit $o_{3}$, which encodes a bitstring that is
random and unknown to the server. The detailed phase encoding rule is
explained in the text. The quantum state at the star point is shown in the
inset of the figure. After the server finishes the quantum circuit, it sends
the extracted modified bipartite correlation
$\frac{1}{N}\sum_{i}^{N}(x_{i}y_{i}+g_{i})$ to the client via a classical
communication channel. We omit the $1/\sqrt{N}$ normalization factor for index
qubit states $\sum_{i}^{N}\ket{i}$ in the figures hereafter for simplicity.

##  IV Blind QBC with untrusted server

A malicious server can get the client’s information by deviating from the
established QBC protocol. One example is that the server could perform quantum
gate operations and measurements to extract the phase information instead of
following the expected Grover steps after receiving
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}|i\rangle_{n}|x_{i}\rangle_{o_{1}}$
from the client Bob. Alternatively, a malicious server could potentially
manipulate the state of qubit $o_{1}$ sent to the client, rather than
genuinely encoding the information of $\boldsymbol{X}$. In principle, for each
communication round, the server can acquire one bit of information of client’s
data $\boldsymbol{y}$. Then with the $2^{t}-1=O(\frac{1}{\epsilon})$ Grover
iterations, the server could get $O(\frac{1}{\epsilon})$ bits of information
in $\boldsymbol{y}$. Such an attack strategy might be implemented by preparing
the $o_{1}$ qubit in $\ket{+}$ state and sending
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{+}_{o_{1}}$ to the client
(Appendix A). Subsequent to the reception of the quantum state from the
client, the server undertakes an $X$ basis measurement on qubit $o_{1}$. The
server could perform the sampling procedure encompassing the bitstrings of the
index qubits during the $O(\frac{1}{\epsilon})$ communication rounds.

We note that the server could not manipulate the index qubit states
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}$ to amplify the amplitude of a specific
bistring of interest, as the client is capable of verifying the received
quantum state of index qubits by performing X basis measurements to check
whether they have the same amplitude. On the other hand, it is possible to
employ a redundant encoding strategy to further decrease the probability that
the server attains a specific $y_{i}$ corresponding to an intended index.
However, this comes at the expense of increased communication complexity, as
detailed in Appendix. B.

To counteract the aforementioned attack strategy, we need to devise a protocol
enabling the server to execute machine learning tasks while remaining unaware
of the exact label information $\boldsymbol{y}$, even when the malicious
server does not follow the designed protocol. In this case, we consider an
honest client, who is not interested in learning $\boldsymbol{X}$. This
assumption might be removed if we consider further encoding privacy in
$\boldsymbol{X}$ when sending information to the client. To implement remote
blind bipartite correlation estimation, a desired protocol should have 1) less
overhead in quantum communication, 2) less requirements in the computational
power of client, 3) a certified estimation result with error $\epsilon$.

We thus consider the revised QBC algorithm below (Fig. 1). Inspired by quantum
one-time pad [11], the protocol utilizes phase padding to preserve privacy.
The client Bob now has one or more qubits at hand, where he can encode a bit
string $\ket{g_{i}}$ that is blind to the server. That is, the client has an
oracle $\hat{U}_{\vec{g}}$ for the extra qubit (denoted as $o_{3}$ hereafter),
and the modified phase oracle of Eq. 1 reads as

$\hat{U}_{xyg}\ket{i}_{n}\ket{000}_{o_{1}o_{2}o_{3}}=(-1)^{x_{i}y_{i}+g_{i}}\ket{i}_{n}\ket{000}_{o_{1}o_{2}o_{3}}.$
(5)

To implement the above unitary $\hat{U}_{xyg}$, similar to the $\hat{U}_{xy}$,
the client performs $\hat{U}_{\vec{y}}$ and $\hat{U}_{\vec{g}}$ oracle after
receiving state from server to create the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{x_{i}}_{o_{1}}\ket{y_{i}}_{o_{2}}\ket{g_{i}}_{o_{3}}$,
followed by a controlled-Z gate between $o_{1}$ and $o_{2}$. Then a local Z
gate can be applied on qubit $o_{3}$ to add the phase $(-1)^{g_{i}}$ that is
random to server.

Since the phase term $(-1)^{x_{i}y_{i}+g_{i}}$ is binary here with modular
addition between $x_{i}y_{i}$ and $g_{i}$, we design the following rule for
the application of random phase $g_{i}$. For a given index $i$, when
$y_{i}=0$, the client chooses a random number from $\\{0,1\\}$; while when
$y_{i}=1$, the client sets $g_{i}=0$. Under this setting, the server cannot
get $y_{i}$ in general from direct measurement of the parity at each Grover
step, even if the server knows exactly the circuit that the client performs.

The above phase encoding rule on $g_{i}$ guarantees that
$x_{i}y_{i}+g_{i}\in\\{0,1\\}$. The quantum counting algorithm can then
estimate
$\frac{1}{N}\sum_{i}^{N}(x_{i}y_{i}+g_{i})=\frac{1}{N}\sum_{i}^{N}(x_{i}y_{i}+g_{i}\mod
2)$ with error bound $\epsilon$. Finally, after the measurement, the server
sends the estimated result back to the client via a classical channel, from
which the client can extract $\frac{1}{N}\sum_{i}^{N}x_{i}y_{i}$ using his
local information of $\frac{1}{N}\sum_{i}^{N}g_{i}$. Alternatively, depending
on the specific use cases, the client could directly share
$\frac{1}{N}\sum_{i}^{N}g_{i}$ with the server and let it extract the
bipartite correlation between $\boldsymbol{X}$ and $\boldsymbol{y}$.

We emphasize that in principle, the aforementioned protocol could still
inadvertently leak a portion of the information in $\boldsymbol{y}$ to the
server. As can be seen from the scheme, in the case where $x_{j}=1$ and the
final phase term is $x_{j}y_{j}+g_{j}=0$, if the server knows the above
application rule of $g_{i}$ and extracts the phase corresponding to the index
qubit $\ket{i}_{i=j}$, it could infer that $y_{j}=0$. We consider the worst
scenario where the malicious server picks $x_{i}=1,\forall i\leq N$ and has
client’s local phase encoding rule. The server’s attack strategy is to measure
the phase of a randomly picked index $\ket{i}$ to extract $x_{i}y_{i}+g_{i}$
at each Grover iteration. Then, for $\boldsymbol{y}$ with Hamming weight
$d_{y}$, the probability that the server extracts a bitstring
$\boldsymbol{y^{\prime}}$ that is $d_{0}$-close ($d_{0}\leq d_{y}$) to
$\boldsymbol{y}$ using the information of the measured phases and without
doing random guess is simply given by

$\begin{split}&\text{Pr}(d(\boldsymbol{y},\boldsymbol{y^{\prime}})=d_{0})=\\\
&\frac{C(d_{y},d_{0})C(N-d_{y},\min(2^{t}-1,d_{y})-d_{0})}{C(N,\min(2^{t}-1,d_{y}))}\end{split}$
(6)

where $C(\cdot,\cdot)$ denotes the binomial coefficient. As can be seen from
the analysis above, even in the worst case, the probability that the server
can successfully extract part of $\boldsymbol{y}$ information becomes
considerably low when the data size becomes large, particularly when $N\geq
2^{t}-1$, while in the original QBC a malicious server could get $2^{t}-1$
bits of information from the client during the communication round. Note that
the iteration number $2^{t}-1$ yields the standard deviation of the estimated
correlation, that is, $2^{t}-1=O(\frac{1}{\epsilon})$. A less tight error
bound $\epsilon$ will reduce the number of communication rounds between server
and client thus increasing the privacy of client’s data.

We remark that the quantum communication complexity of the aforementioned
algorithm for blind server is $\mathcal{C}_{\rm
comm}^{b_{s}}=O(\frac{\log_{2}(N)}{\epsilon})$, which is the same as the
original QBC as depicted in Eq. 2. Moreover, akin to the QBC algorithm, a
classical communication channel is needed at the end of QBC to deliver
estimation results to the client. In terms of computational overhead
experienced by the client, introducing the ancilla qubit $o_{3}$ only adds
$O(\frac{1}{\epsilon})$ number of two-qubit phase gates and as a result, does
not alter the inherent computational complexity. To this end, the blind QBC
protocol proposed here could enable communication-efficient blind distributed
machine learning tasks between a server and a client without presupposing
substantial quantum resources on the client.

##  V Blind QBC with untrusted client

Figure 2: Grover operator $\hat{H}^{\otimes n}(2|0\rangle_{n}\langle
0|_{n}-\hat{I})\hat{H}^{\otimes n}\hat{O}_{f}$ for blind quantum bipartite
correlator protocol to hide server data $\boldsymbol{X}$ from client. The
operator starts with an oracle held by server (Alice) that encodes
$\boldsymbol{X}$ with random basis (oracle $\hat{U}_{X_{1}}$). After receiving
the state returned by client (Bob), the server extracts the desired phase term
$(-1)^{x_{i}y_{i}}$ ($\hat{U}_{X_{2}}$) and return an encoded state back to
client ($\hat{U}_{X_{3}}$) to remove the phase in $o_{1}$ qubit that the
server does not know. Finally, the server reaches the target state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}$ by decoupling
$o_{1}$ qubit with index qubits ($\hat{U}_{X_{4}}$).

We now discuss the scenario where the server would like to estimate
$\frac{1}{N}\sum_{i}^{N}x_{i}y_{i}$ while keeping $\boldsymbol{X}$ hidden from
the client at all times during the process. In practical applications such as
model-as-a-service platforms [32, 33], the server’s information, including the
model’s parameters or training data, should remain hidden from the clients. By
hiding the server-side information, they can prevent the client from reverse-
engineering or extracting valuable information about the underlying model
architecture or training data. Under this setting, the protocol should be
secure against not only a honest-but-curious client, but also a malicious
client who tries to get $\boldsymbol{X}$ by deviating from the original
quantum algorithm.

Here we assume an honest server that follows the protocol exactly without
trying to get the label information $\boldsymbol{y}$. The goal is then to
encode $\boldsymbol{X}$ when the server sends qubits to the client while
running the QBC algorithm. That is, we are interested in designing a privacy-
preserving operator $\hat{O}_{f}$ such that

$\hat{O}_{f}\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{00}_{o_{1}o_{2}}=\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{00}_{o_{1}o_{2}}.$
(7)

Inspired by quantum key distribution protocols [34] such as BB84 [35], we
consider a modified local oracle operator $\hat{U}_{X_{1}}$ held by the
server, where the data information $\boldsymbol{X}$ is encoded in different
basis (Fig. 2). Specifically, at each iteration of quantum counting algorithm,
for a given index $i$, the server chooses a random number $R_{i}$ from
$\\{0,1\\}$. When $R_{i}=0$, the server encodes $x_{i}$ using the Z basis,
i.e., $\ket{i}_{n}\ket{0}_{o_{1}}$ or $\ket{i}_{n}\ket{1}_{o_{1}}$, depending
on whether $x_{i}$ being $0$ or $1$; if $R_{i}=1$, $x_{i}$ is encoded in the X
basis and now the state reads $\ket{i}_{n}\ket{+}_{o_{1}}$ or
$\ket{i}_{n}\ket{-}_{o_{1}}$. Here $\ket{+(-)}=\frac{1}{2}(\ket{0}\pm\ket{1})$
are the eigenstates of Pauli X operator. This oracle $\hat{U}_{X_{1}}$ can be
implemented with the original oracle $\hat{U}_{\vec{x}}$ with Hadamard gates
on $o_{1}$ conditioned on index $\ket{i}_{n}$.

Then, the state received by the client at each time reads as
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{X_{i}}_{o_{1}}$ with $X_{i}$
being $1(0)$ or $+(-)$. As the client does not know which basis the server
chooses for given $i$, at each Grover iteration, measurement of qubit $o_{1}$
on index $\ket{i}$ will have the probability of yielding both 0 or 1, hence
the client cannot infer the $x_{i}$ information from the single copy of the
received $\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{X_{i}}_{o_{1}}$ state.
Note that the server could pick different random numbers $R_{i}$ at different
communication rounds when executing the QBC algorithm.

As in the original QBC algorithm, the client performs CZ gate between the
received qubit $o_{1}$ and local qubit $o_{2}$ sandwiched by
$\hat{U}_{\vec{y}}$ operators. Then, the state received by the server from the
quantum channel is
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}$
where $a_{i}(b_{i})$ is decided by $x_{i}$ and the encoding basis $R_{i}$ thus
is known to the server. We next discuss how the server could perform
operations to reach the target state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}$ for running the
follow-up QBC algorithm. We consider a second oracle operator held by the
server $\hat{U}_{X_{2}}$:

$\begin{split}&\hat{U}_{X_{2}}\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}=\\\
&\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}.\end{split}$
(8)

This can be achieved via the help of an additional qubit $o_{a}$ held by the
server that encodes the $\boldsymbol{X}$ information in the normal Z basis
(see Appendix C for details of circuit implementation).

Note that the server cannot decouple the $o_{1}$ qubit with an unknown state,
as the honest server only has the information of $a_{i}$ and $b_{i}$ but
doesn’t have the information of $\boldsymbol{y}$. In order to reset the state
of qubit $o_{1}$, the server could return the state back to client to have the
client remove the phase $(-1)^{y_{i}}$. Before doing so, the server would like
to first hide its information by adding a random phase padding by applying
$\hat{U}_{X_{3}}$ which is defined as

$\begin{split}&\hat{U}_{X_{3}}\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}=\\\
&\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}+h_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}.\end{split}$
(9)

Here $h_{i}\in\\{0,1\\}$ is blind to the client and could change in different
communication rounds, therefore the client would not be able to extract
$x_{i}$ information. The client performs a controlled-Z gate again between its
local qubit $o_{2}$ and the received qubit $o_{1}$, after which the phase term
$(-1)^{y_{i}}$ becomes $(-1)^{y_{i}+y_{i}}=1$. Then, the server receives the
state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}+h_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}\ket{1})_{o_{1}}$
from client and performs oracle $\hat{U}_{X_{4}}$:

$\begin{split}&\hat{U}_{X_{4}}\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}+h_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}\ket{1})_{o_{1}}=\\\
&\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{0}_{o_{1}}.\end{split}$
(10)

It can be easily seen that to implement $\hat{U}_{X_{4}}$, the server could
simply perform $\hat{U}_{X_{3}}$ again to remove the added random phase term
$(-1)^{h_{i}}$ and then reset the qubit $o_{1}$ to $\ket{0}_{o_{1}}$ as the
server knows the all coefficients $a_{i}$ and $b_{i}$.

We remark that the random numbers $R_{i}$ and $h_{i}$ can change in different
Grover iterations. That is, the client will not get useful information by
performing measurements on each iteration and using the joint results from a
sequence of measurements to infer $\boldsymbol{X}$. The privacy of
$\boldsymbol{X}$ is guaranteed by the fact that measuring a single copy in a
given basis cannot reveal both the basis information $R_{i}$ and the data
information $x_{i}$. The probability that the client gets
$\boldsymbol{X^{\prime}}$ that is $d_{0}$-close to the true $\boldsymbol{X}$
would simply be the same as a random guess.

To this end, we have described a phase encoding oracle $\hat{O}_{f}$ that lets
the server acquire the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}$ for subsequent
operations without leaking the information of data $\boldsymbol{X}$ to an
untrusted client. The scheme is based on a random encoding of $\boldsymbol{X}$
and is information-theoretic secure against an untrusted client, with the
proof of security following directly from the corresponding proof for the BB84
protocol [35, 36]. The total number of oracle calls by server and client only
increases by a constant at each iteration, thus leading to the same
computation complexity $O(\frac{1}{\epsilon})$ as Eq. 3. The total
communication cost of this blind client scheme is given by

$\mathcal{C}_{\rm
comm}^{b_{c}}=4(n+1)(2^{t}-1)=O\left(\frac{\log_{2}(N)}{\epsilon}\right),$
(11)

which has the same complexity scaling as the original QBC algorithm. We
summarize the proposed algorithms here and above in Table. 1.

Table 1: Privacy and communication complexity of proposed distributed inner product estimation algorithms. Adversaries |  Protocol |  Privacy mechanism |  Privacy |  Communication complexity
---|---|---|---|---
Honest-but-curious server |  original QBC algorithm [8] |  - |  worst scenario in Eq. 4 |  $O((\log_{2}N)/\epsilon)$
Malicious server |  blind QBC for untrusted server (Sec. IV) |  random phase padding |  worst scenario in Eq. 6 |  $O((\log_{2}N)/\epsilon)$
Malicious client |  blind QBC for untrusted client (Sec. V) |  random basis encoding, random phase padding |  information-theoretic secure |  $O((\log_{2}N)/\epsilon)$

##  VI Generalization into multi-party settings

The algorithms discussed above can be generalized into multi-party settings
and find applications in secure multi-party computation and machine learning
[37, 38], where parties collaboratively perform computations on their combined
data sets without revealing the data they possess to untrusted parties. For
example, to perform model aggregation, an untrusted central server would like
to perform linear regression or classification using its local data as well as
labels that are distributed among multiple clients. Then, the protocol in Sec.
IV can be applied in which the server can interact with each client to extract
model parameters individually.

Here we provide an example of multi-party protocols. We consider a system
consisting of a central server and $m$ clients, where the server is untrusted
by the clients. The task is to have the server evaluate
$f_{m}=\frac{1}{N}\sum_{i}^{N}(\sum_{j}^{m}x_{i}y_{i}^{(j)}\mod 2)$ without
leaking individual information of clients. Similar to the phase pad technique
introduced in Sec. IV, one can protect each individual client’s information by
adding additional terms in the phase when running the QBC algorithm.
Specifically, we consider a cascaded protocol where each client encodes its
information into the phase of index qubits and passes the state into the next
client. In each communication round, the $k$-th client would receive the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}^{(1)}+x_{i}y_{i}^{(2)}+...+x_{i}y_{i}^{(k-1)}}\ket{i}_{n}\ket{x_{i}}$
from the $(k-1)$-th client. Then, by applying CZ gate between $o_{1}$ and its
local qubit, the $j$-th client sends the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}^{(1)}+x_{i}y_{i}^{(2)}+...+x_{i}y_{i}^{(k-1)}+x_{i}y_{i}^{(k)}}\ket{i}_{n}\ket{x_{i}}$
to the next client. The final $m$-th client will pass the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{\sum_{j}^{m}x_{i}y_{i}^{(j)}}\ket{i}_{n}\ket{x_{i}}$
to the server which can then perform the remaining part of the original QBC
algorithm to extract the desired $f_{m}$.

We note that a malicious server could only get the $\sum_{j}^{m}y_{i}^{(m)}$
and the individual $y_{i}^{(j)}$ information is not leaked, as the phase added
by each client servers as a random pad of other clients. For the same reason,
the $j$-th ($j\geq 3$) client cannot get previous clients’ information as it
can only extract $\sum_{k=1}^{j-1}y_{i}^{(k)}$. The first client ($j=1$) can
further add a random pad $g_{i}^{(1)}$ to protect its information against the
second client ($j=2$). The protocol here is similar to incremental learning
[39], where the model aggregation is performed while preserving privacy. We
remark that the total communication cost scales as
$O\left(\frac{m\log_{2}(N)}{\epsilon}\right)$ and the privacy mechanism does
not introduce additional communication cost. To this end, our work paves the
way for communication-efficient private machine learning for multi-party
system, such as quantum federated learning [40, 41, 42].

##  VII Discussion and conclusion

As mentioned above, the proposed blind distributed inner product estimation
protocols can be applied in distributed machine learning where a central task
is to evaluate correlations between remote matrices or vectors. Here we give
an example of such applications. In linear regression problems, one is
interested in finding the coefficient vector $\boldsymbol{\lambda}$ with
standard error $\epsilon$ that satisfies $\boldsymbol{X}_{N\times
M}\boldsymbol{\lambda}_{M\times 1}=\boldsymbol{y}_{N\times 1}$, where the
$N$-by-$M$ matrix $\boldsymbol{X}$ and $N$-by-1 vector $\boldsymbol{y}$ are
separately held by two remote parties, a server and a client, respectively. We
consider the case where the server would like to estimate
$\boldsymbol{\lambda}$ without letting the client extract its local
information $\boldsymbol{X}_{N\times M}$. The $l$-th component of
$\boldsymbol{\lambda}$ reads
$\lambda_{l}=\sum_{i=1}^{N}X_{li}^{\dagger}y_{i}$, where $l$ and $i$ labels
the index of the element in the matrix or vector. The problem can be reduced
to estimate product of distributed numbers $a_{li}=X^{\dagger}_{li}$ and
$b_{i}=y_{i}$. They can be expanded as binary floating point numbers using,
for example, $a_{li}=\sum_{k=0}^{\infty}2^{u-k}x^{(k)}_{li}$ and
$b_{i}=\sum_{k=0}^{\infty}2^{v-k}y^{(k)}_{i}$, for which $u$ and $v$ denote
the highest digits of $a$ and $b$, respectively [8, 43]. Then, the target
coefficient $\lambda_{l}$ can be written as
$\lambda_{l}=\sum_{i=1}^{N}a_{li}b_{i}=\sum_{r=0}^{\infty}2^{u+v-r}\sum_{k=0}^{r}\sum_{i=1}^{N}x^{(k)}_{li}y^{(r-k)}_{i}$,
where the blind QBC algorithm introduced in Sec. V can be directly applied. In
this case, the untrusted client can neither directly extract the information
of $\boldsymbol{X}_{N\times M}$ during the blind QBC communication, nor
indirectly have an estimation on $\boldsymbol{X}_{N\times M}$ from the
knowledge of coefficient $\boldsymbol{\lambda}_{M\times 1}$. To this end, our
proposed algorithms exhibit direct applicability within the domain of
distributed blind machine learning tasks, particularly in scenarios involving
matrix or vector multiplication operations.

We further remark that the proposed quantum algorithms offer many benefits for
practical applications with large data sizes. Notably, the quantum
communication cost in estimating the bipartite correlation scales as
$O(\frac{\log N}{\epsilon})$ and additionally, the discussed data privacy
mechanism does not impose any additional overhead in terms of communication
cost. Furthermore, the protocols eliminate the need for a trusted third party
and necessitate only a minimal quantum resource allocation from the
participating clients, encompassing the number of qubits and gate operations.

In summary, this study introduces novel blind quantum machine learning
protocols that utilize a quantum bipartite correlator estimation algorithm for
distributed parties. By addressing the potential threat of malicious parties
attempting to extract information from others, we propose two distinct
settings that ensure privacy preservation for each party in the QBC algorithm.
Leveraging the advantageous properties of quantum phases and the flexibility
of encoding data in various bases, our protocols can effectively safeguard
information. The developed blind QML algorithm offers notable advantages,
including low communication and computational complexity. This work
contributes to the advancement of secure and efficient QML protocols, thus
presenting an efficient pathway for distributed quantum computing.

###### Acknowledgements.

JL acknowledges support by DTRA (Award No. HDTRA1-20-2-0002) Interaction of
Ionizing Radiation with Matter (IIRM) University Research Alliance (URA).

## Disclaimer

This paper was prepared for informational purposes with contributions from the
Global Technology Applied Research center of JPMorgan Chase $\&$ Co. This
paper is not a product of the Research Department of JPMorgan Chase $\&$ Co.
or its affiliates. Neither JPMorgan Chase $\&$ Co. nor any of its affiliates
makes any explicit or implied representation or warranty and none of them
accept any liability in connection with this position paper, including,
without limitation, with respect to the completeness, accuracy, or reliability
of the information contained herein and the potential Legal, compliance, tax,
or accounting effects thereof. This document is not intended as investment
research or investment advice, or as a recommendation, offer, or solicitation
for the purchase or sale of any security, financial instrument, financial
product or service, or to be used in any way for evaluating the merits of
participating in any transaction.

##  Appendix A Extraction of $y_{i}$ information in QBC by malicious server

We discuss a feasible attack protocol for a malicious server to extract
information of $\boldsymbol{y}$ with the received state
$\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{x_{i}}$ in the original QBC
algorithm. In this protocol, the server prepares the $o_{1}$ qubit simple in
the $\ket{+}=\frac{1}{\sqrt{2}}(\ket{0}+\ket{1})$ state. The quantum state
sent to client would then be

$\frac{1}{\sqrt{2}}(\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{0}_{o_{1}}+\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}\ket{1}_{o_{1}})$
(12)

The honest client then encodes $y_{i}$ information in the phase with his own
local oracle, leading to state

$\begin{split}&\frac{1}{\sqrt{2N}}(\sum_{i}^{N}\ket{i}_{n}\ket{0}_{o_{1}}+\ket{1}_{o_{h}}\sum_{i}^{N}(-1)^{y_{i}}\ket{i}_{n}\ket{1}_{o_{1}})\\\
&=\frac{1}{\sqrt{2N}}\sum_{i}^{N}\ket{i}_{n}(\ket{0}_{o_{1}}+(-1)^{y_{i}}\ket{1}_{o_{1}})\end{split}$
(13)

that is sent back to server.

Then, it’s clear to see that to extract client’s information, the server could
perform measurement on qubit $o_{1}$ in the X basis and extract the $y_{j}$
information depending on the measured index qubit bitstring $j$. In this case,
by performing sampling on the N index qubit states during the
$2^{t}-1=O(1/\epsilon)$ communication rounds, the malicious server could get
$O(1/\epsilon)$ information of $\boldsymbol{y}$. Indeed, given the state Eq.
13 received by the server, the upper bound of information that the server
could get at each round by performing measurement on index qubits and qubit
$o_{1}$ is determined by the Holevo’s bound [44]:

$\begin{split}&H(C:S)\leq S(\rho)-\frac{1}{N}\sum_{i}^{N}S(\rho(i))=\log
2N,\end{split}$ (14)

where $S(\rho)$ denotes the von Neumann entropy for density matrix $\rho$ that
corresponds to Eq. 13, and $\rho_{i}=\ket{a_{i}}\ket{i}\bra{i}\bra{a_{i}}$
($a_{i}=+,-$) forms the POVM set that server performs.

One might argue that the server could amplify the probability of sampling a
particular index qubit bitstring $j$ by reducing the amplitude of other index
qubit bitstrings. That is, the quantum state sent to client could be

$\frac{1}{\sqrt{2}}(\sum_{i}^{N}A_{i}\ket{i}_{n}\ket{0}_{o_{1}}+\sum_{i}^{N}A_{i}\ket{i}_{n}\ket{1}_{o_{1}})$
(15)

where $|A_{i=j}|^{2}\gg|A_{i\neq j}|^{2}$ and $\sum_{i}^{N}|A_{i}|^{2}=1$.
However, the client can add an additional verification on the
$\lceil\log_{2}(N)\rceil$ index qubits upon receiving them by performing
measurements on X basis. This should yield $+1$ for all index qubits, as the
state $\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}$ can be rewritten as
$\frac{1}{\sqrt{2}}(\ket{0}+\ket{1})^{\otimes\lceil\log_{2}(N)\rceil}$. While
for the manipulated state outlined in Eq. 15, there exists a nonzero
probability of producing a measurement outcome of $-1$ for at least a portion
of the measurements.

##  Appendix B Redundant encoding against malicious server

We describe a redundant encoding approach aimed at reducing the probability
that a malicious server acquiring a specific $y_{i}$ information with $i$
being the pertinent index of interest using the attack strategy in Appendix.
A.

Given that the server is restricted to preparing the index qubits in a manner
where each index bitstring holds identical probability, after receiving the
state back from client, the probability that server samples a specific index
bitstring $\ket{i}_{n}$ is simply $\frac{1}{N}$. That is, in each iteration of
communication during the execution of QBC algorithm, the server is constrained
to attain a specific $y_{i}$ corresponding to the intended index with a
probability of $\frac{1}{N}$; and for $1/\epsilon$ iterations needed for QBC
algorithm, this will cause a total amount of information being extracted to be
$\frac{1}{N\epsilon}$. Following this, we can consider a protocol where both
the client and server encode their single bit local information ${y_{i}}$ and
${x_{i}}$ into bitstrings
${\left[y^{\prime}_{i,1},y^{\prime}_{i,2},\cdots,y^{\prime}_{i,M}\right]}^{\prime}$
and ${\left[x^{\prime}_{i,1},x^{\prime}_{i,2},\cdots,x^{\prime}_{i,M}\right]}$
with size $M$, where $M>1$. The total amount of bits increases from $N$ to
$MN$. The encoding rule is shown as follows:

$\begin{split}\boldsymbol{x}^{\prime}_{i,j}=x_{i};\quad
i=1,2,...,N;j=1,2,...,M;\end{split}$ (16)

which is a simply copy the bit $x_{i}$ for $M$ times. As for
$\boldsymbol{y}^{\prime}$, the client can hide the information $y_{i}$
randomly in one of the $M$ digits and let the other $M-1$ digits to be all
zero or one. That is, client chooses either

$\begin{split}&\boldsymbol{y}^{\prime}_{i,j}=\delta_{j,J_{i}}\cdot y_{i};\\\
i=1,2,...,N;&j=1,2,...,M,J_{i}\in\\{1,2,...,M\\}.\\\ \end{split}$ (17)

or

$\begin{split}&\boldsymbol{y}^{\prime}_{i,j}=(1-\delta_{j,J_{i}})\cdot
y_{i};\\\ i=1,2,...,N;&j=1,2,...,M,J_{i}\in\\{1,2,...,M\\}.\\\ \end{split}$
(18)

where $J_{i}$ is an random number and $\delta_{j,J_{i}}$ is the Kronecker
symbol. In these cases, the server would get
$\frac{1}{NM}\sum_{i}^{N}x_{i}y_{i}$ or
$\frac{1}{NM}\sum_{i}^{N}x_{i}y_{i}+\frac{M-1}{NM}\sum_{i}^{N}x_{i}$ by
executing the QBC algorithm, depending on whether the client chooses encoding
method Eq. 17 or Eq. 18. Afterwards, the client can send an one-bit message
via classical channel to the server and let server knows which one was used.

We remark that at each communication round, the probability that the server
samples a specific bit reduces from $\frac{1}{N}$ to $\frac{1}{NM}$. Even
though that $M$-times more communication round will be needed to achieve the
same error bound $\epsilon$ as in the original QBC case, the server would not
know which digit encodes the correct $y_{i}$ information as here $J_{i}$s are
random numbers. Therefore, using the attack strategy detailed in the Appendix.
A, the probability that the server successfully gets a specific bit $y_{i}$
would be
$\frac{1}{NM}\times\frac{M}{\epsilon}\times\frac{1}{M}=\frac{1}{NM\epsilon}$,
where the second term $\frac{M}{\epsilon}$ is the total number of
communication rounds and the third term is $\frac{1}{M}$ is due to the
randomness in $J_{i}$. It’s clear to see that a larger value of $M$
corresponds to a decreased probability for the server to successfully extract
valuable information from the client through the attack strategy. The
flexibility that the client can independently choose encoding method also
protects the majority information of $\boldsymbol{y}$, i.e., the client may
choose Eq. 17 to encode data if the majority of $\boldsymbol{y}$ is $1$ to
decrease the probability that $1$s are being detected. Nevertheless, the
trade-off for employing this redundant encoding approach manifests as an
augmented quantum communication complexity, which reads
$O(\frac{\log(NM)}{\epsilon})$.

##  Appendix C Construction of oracle operator $\hat{U}_{X_{2}}$ for blind QBC
with untrusted client

In this section, we give the details for the implementation of
$\hat{U}_{X_{2}}$ operator mentioned in Sec. V. Recall that $\hat{U}_{X_{2}}$
is applied to extract the phase term $(-1)^{x_{i}y_{i}}$, as shown in Eq. 8.
The quantum state before applying $\hat{U}_{X_{2}}$ is given by

$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}},$
(19)

where $a_{i}$ and $b_{i}$ depends on $x_{i}$ and the encoding basis $R_{i}$.
For the data $j$ encoded in Z basis, i.e., $R_{j}=0$, one has $a_{j}b_{j}=0$
and the phase $(-1)^{x_{i}y_{i}}$ naturally shows up as in the original QBC
algorithm. While for the data encoded in X basis, i.e., $R_{j}=1$, we target
to extract the $(-1)^{x_{i}y_{i}}$ term by transforming it back to Z basis.

Figure 3: Circuit diagram for implementing $U_{\vec{X_{2}}}$ with the help of
an ancilla qubit $o_{a}$. The first control line shows the classical control
decided by the random number $R_{i},i=1,...N$.

For this purpose, we consider the following protocol. Firstly,
$\hat{U}_{\vec{x}}$ oracle is called to generate the state
$\frac{1}{\sqrt{N}}\sum_{i}^{N}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}\ket{x_{i}}_{o_{a}}$
where the additional qubit $o_{a}$ encodes $x_{i}$ in Z basis. Secondly, a
Hadamard gate is applied on qubit $o_{1}$ conditioned on index qubit state
$\ket{i}_{n}=\ket{j}_{n}$ that satisfies $R_{j}=1$ (i.e., encoding in X
basis). This will transform the X basis encoding to Z basis. Then, a NOT gate
on qubit $o_{1}$ conditioned on those index qubit states followed by a
controlled-Z gate between $o_{1}$ and $o_{a}$ is applied. With the above
steps, a phase $(-1)$ is generated unless $x_{i}=y_{i}=1$. The state now
reads:

$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}\ket{m_{i}}_{o_{1}}\ket{{x_{i}}}_{o_{a}}.$
(20)

Here $m_{i}=x_{i}$ when $R_{i}=0$ or when $R_{i}=1$ and $y_{i}=0$.

Now that as the phase term $(-1)^{x_{i}y_{i}}$ has already been extracted, we
transform the $o_{1}$ qubit state $\ket{m_{i}}_{o_{1}}$ back to the initial
$(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}$ by applying the controlled
Hardmard and NOT gate again, and then decouple the ancillary qubit by calling
the $\hat{U}_{\vec{x}}$. The resulting quantum state reads
$\frac{1}{\sqrt{N}}\sum_{i}^{N}(-1)^{x_{i}y_{i}}\ket{i}_{n}(a_{i}\ket{0}+b_{i}(-1)^{y_{i}}\ket{1})_{o_{1}}$.

## References

  * Pirandola  _et al._ [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, Advances in Optics and Photonics 12, 1012 (2020).
  * Herman  _et al._ [2023] D. Herman, C. Googin, X. Liu, Y. Sun, A. Galda, I. Safro, M. Pistoia, and Y. Alexeev, Nature Reviews Physics 5, 450 (2023).
  * Cao  _et al._ [2018] Y. Cao, J. Romero, and A. Aspuru-Guzik, IBM Journal of Research and Development 62, 6:1 (2018).
  * Cuomo  _et al._ [2020] D. Cuomo, M. Caleffi, and A. S. Cacciapuoti, IET Quantum Communication 1, 3 (2020).
  * Caleffi  _et al._ [2022] M. Caleffi, M. Amoretti, D. Ferrari, D. Cuomo, J. Illiano, A. Manzalini, and A. S. Cacciapuoti, “Distributed quantum computing: a survey,” (2022), arXiv:2212.10609 [quant-ph] .
  * Beals  _et al._ [2013] R. Beals, S. Brierley, O. Gray, A. W. Harrow, S. Kutin, N. Linden, D. Shepherd, and M. Stather, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences 469, 20120686 (2013).
  * Cacciapuoti  _et al._ [2020] A. S. Cacciapuoti, M. Caleffi, F. Tafuri, F. S. Cataliotti, S. Gherardini, and G. Bianchi, IEEE Network 34, 137 (2020).
  * Tang  _et al._ [2023] H. Tang, B. Li, G. Wang, H. Xu, C. Li, A. Barr, P. Cappellaro, and J. Li, Phys. Rev. Lett. 130, 150602 (2023).
  * Montanaro and Shao [2023] A. Montanaro and C. Shao, “Quantum communication complexity of linear regression,” (2023), arXiv:2210.01601 [quant-ph] .
  * Gilboa and McClean [2023] D. Gilboa and J. R. McClean, “Exponential quantum communication advantage in distributed learning,” (2023), arXiv:2310.07136 [quant-ph] .
  * Childs [2005] A. Childs, Quantum Information and Computation 5, 456 (2005).
  * Fitzsimons [2017] J. F. Fitzsimons, npj Quantum Information 3 (2017), 10.1038/s41534-017-0025-3.
  * Giovannetti  _et al._ [2013] V. Giovannetti, L. Maccone, T. Morimae, and T. G. Rudolph, Phys. Rev. Lett. 111, 230501 (2013).
  * Verbraeken  _et al._ [2020] J. Verbraeken, M. Wolting, J. Katzy, J. Kloppenburg, T. Verbelen, and J. S. Rellermeyer, ACM Computing Surveys 53, 1 (2020).
  * Barlow [1989] H. B. Barlow, Neural computation 1, 295 (1989).
  * Lloyd  _et al._ [2013] S. Lloyd, M. Mohseni, and P. Rebentrost, “Quantum algorithms for supervised and unsupervised machine learning,” (2013), arXiv:1307.0411 [quant-ph] .
  * Rebentrost  _et al._ [2014] P. Rebentrost, M. Mohseni, and S. Lloyd, Phys. Rev. Lett. 113, 130503 (2014).
  * Li  _et al._ [2019] T. Li, S. Chakrabarti, and X. Wu, “Sublinear quantum algorithms for training linear and kernel-based classifiers,” (2019), arXiv:1904.02276 [quant-ph] .
  * Zhou and Qiu [2021] X. Zhou and D. Qiu, Quantum Information Processing 20 (2021), 10.1007/s11128-021-03301-y.
  * Fang and Qian [2021] H. Fang and Q. Qian, Future Internet 13, 94 (2021).
  * Wood  _et al._ [2020] A. Wood, K. Najarian, and D. Kahrobaei, ACM Computing Surveys 53, 1 (2020).
  * [22] P. Paillier, in  _Advances in Cryptology — EUROCRYPT ’99_ (Springer Berlin Heidelberg) pp. 223–238.
  * Cheon  _et al._ [2017] J. H. Cheon, A. Kim, M. Kim, and Y. Song, in  _Advances in Cryptology – ASIACRYPT 2017_ (Springer International Publishing, 2017) pp. 409–437.
  * Couteau and Zarezadeh [2023] G. Couteau and M. Zarezadeh, “Non-interactive secure computation of inner-product from lpn and lwe,” Cryptology ePrint Archive, Paper 2023/072 (2023), https://eprint.iacr.org/2023/072.
  * Boyle  _et al._ [2020] E. Boyle, G. Couteau, N. Gilboa, Y. Ishai, L. Kohl, and P. Scholl, in  _Advances in Cryptology – CRYPTO 2020_ (Springer International Publishing, 2020) pp. 387–416.
  * York [1966] D. York, Canadian Journal of Physics 44, 1079 (1966).
  * Tsoumakas and Katakis [2007] G. Tsoumakas and I. Katakis, International Journal of Data Warehousing and Mining 3, 1 (2007).
  * Giovannetti  _et al._ [2008] V. Giovannetti, S. Lloyd, and L. Maccone, Phys. Rev. Lett. 100, 160501 (2008).
  * Brassard  _et al._ [1998] G. Brassard, P. HØyer, and A. Tapp, in  _Automata, Languages and Programming_ (Springer Berlin Heidelberg, 1998) pp. 820–831.
  * Fanizza  _et al._ [2020] M. Fanizza, M. Rosati, M. Skotiniotis, J. Calsamiglia, and V. Giovannetti, Phys. Rev. Lett. 124, 060503 (2020).
  * Anshu  _et al._ [2022] A. Anshu, Z. Landau, and Y. Liu, in  _Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing_ (2022) pp. 44–51.
  * Hunt  _et al._ [2018] T. Hunt, C. Song, R. Shokri, V. Shmatikov, and E. Witchel, CoRR abs/1803.05961 (2018), 1803.05961 .
  * Hesamifard  _et al._ [2018] E. Hesamifard, H. Takabi, M. Ghasemi, and R. N. Wright, Proceedings on Privacy Enhancing Technologies 2018, 123 (2018).
  * Xu  _et al._ [2020] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Rev. Mod. Phys. 92, 025002 (2020).
  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Theoretical Computer Science 560, 7 (2014).
  * Renner  _et al._ [2005] R. Renner, N. Gisin, and B. Kraus, Phys. Rev. A 72, 012332 (2005).
  * Crepeau  _et al._ [2002] C. Crepeau, D. Gottesman, and A. Smith, “Secure multi-party quantum computing,” (2002), arXiv:quant-ph/0206138 [quant-ph] .
  * Knott  _et al._ [2021] B. Knott, S. Venkataraman, A. Y. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, CoRR abs/2109.00984 (2021), 2109.00984 .
  * Sheller  _et al._ [2020] M. J. Sheller, B. Edwards, G. A. Reina, J. Martin, S. Pati, A. Kotrotsou, M. Milchenko, W. Xu, D. Marcus, R. R. Colen, and S. Bakas, Scientific Reports 10 (2020), 10.1038/s41598-020-69250-1.
  * Li  _et al._ [2021] W. Li, S. Lu, and D.-L. Deng, Science China Physics, Mechanics & Astronomy 64 (2021), 10.1007/s11433-021-1753-3.
  * Larasati  _et al._ [2022] H. T. Larasati, M. Firdaus, and H. Kim, in  _2022 IEEE 9th International Conference on Cyber Security and Cloud Computing (CSCloud)/2022 IEEE 8th International Conference on Edge Computing and Scalable Cloud (EdgeCom)_ (IEEE, 2022).
  * Kumar  _et al._ [2023] N. Kumar, J. Heredge, C. Li, S. Eloul, S. H. Sureshbabu, and M. Pistoia, “Expressive variational quantum circuits provide inherent privacy in federated learning,” (2023), arXiv:2309.13002 [quant-ph] .
  * [43] “IEEE standard for floating-point arithmetic,” .
  * Holevo [1973] A. S. Holevo, Problemy Peredachi Informatsii 9, 3 (1973).