A Survey of Quantum Property Testing

The area of property testing tries to design algorithms that can efficiently handle very large amounts of data: given a large object that either has a certain property or is somehow"far"from having that property, a tester should efficiently distinguish between these two cases. In this survey we describe recent results obtained for quantum property testing. This area naturally falls into three parts. First, we may consider quantum testers for properties of classical objects. We survey the main examples known where quantum testers can be much (sometimes exponentially) more efficient than classical testers. Second, we may consider classical testers of quantum objects. This is the situation that arises for instance when one is trying to determine if quantum states or operations do what they are supposed to do, based only on classical input-output behavior. Finally, we may also consider quantum testers for properties of quantum objects, such as states or operations. We survey known bounds on testing various natural properties, such as whether two states are equal, whether a state is separable, whether two operations commute, etc. We also highlight connections to other areas of quantum information theory and mention a number of open questions.


Introduction
In the last two decades, the amounts of data that need to be handled have exploded: think of the massive amounts of data on the web, or the data warehouses of customer information collected by big companies. In many cases algorithms need to decide whether this data has certain properties or not, without having sufficient time to trawl through all or even most of the data. Somehow we would like to detect the presence or absence of some global property by only making a few "local" checks. The area of property testing aims to design algorithms that can efficiently test whether some large object has a certain property, under the assumption that the object either has the property or is somehow "far" from having that property. An assumption like the latter is necessary for efficient property testing: deciding the property for objects that are "just on the boundary" typically requires looking at all or most of the object, which is exactly what we are trying to avoid here. In general, different property testing settings can be captured by the following "meta-definition": Property testing Let X be a set of objects and d : X × X → [0, 1] be a distance measure on X . A subset P ⊆ X is called a property. An object x ∈ X is ǫ-far from P if d(x, y) ≥ ǫ for all y ∈ P; x is ǫ-close to P if there is a y ∈ P such that d(x, y) ≤ ǫ.
An ǫ-property tester for P is an algorithm that receives as input either an x ∈ P or an x that is ǫ-far from P, and that distinguishes these two cases with success probability at least 2/3.
The value of 2/3 for the success probability is arbitrary and can equivalently be replaced with any other constant in (1/2, 1) since we can efficiently reduce the error probability by repeating the test a few times and taking the majority outcome. We say that the tester has perfect completeness if it accepts every state in P with certainty. The distance parameter ǫ is usually taken to be some positive constant. We will often just speak of a "tester," leaving the value of ǫ implicit.
Clearly, this meta-definition leaves open many choices: what type of objects to consider, what property to test, what distance measure to use, what range of ǫ to allow (the larger ǫ, the easier it should be to test P), and how to measure the complexity of the testing algorithm. A lot of work has gone into the study of efficient testers for various properties, as well as proofs that certain properties are not efficiently testable, see for instance [33,71,62,134,70]. Typically, X will be the set of all N -element strings over some finite alphabet, where we think of N as being very large. The distance will usually be normalized Hamming distance d(x, y) = |{i : x i = y i }|/N , though also more sophisticated metrics such as "edit distance" have been used. The complexity of the tester is typically measured by the number of queries it makes to entries of its input x, and a tester is deemed efficient if its number of queries is much less than the length of the input N , say polylog(N ) or even some constant independent of N . This captures the goal that a tester is able to efficiently handle huge amounts of data.
In this survey paper we will be concerned with quantum property testing. There are several natural ways in which one can generalize property testing to the quantum world: • Quantum testing of properties of classical objects. In this setting we would like to achieve provable quantum speed-ups over any possible classical algorithm, or to prove limitations on property testers, even if they are allowed to be quantum. By their very nature, efficient quantum query algorithms rely on extracting global information about the input, by querying in superposition; property testing is thus a plausible place to find significant quantum speedups.
• Classical testing of properties of quantum objects. Here we imagine we are given a blackbox device which is claimed to implement some quantum process, and we would like to test whether it does what is claimed. However, our access to the device is classical: all we can do is feed classical inputs to the device, and receive classical measurement outcomes.
• Quantum testing of properties of quantum objects. In this most general scenario, we are given access to a quantum state or operation as a black box, and apply a quantum procedure to it to determine whether it has some property.
We will discuss each of these settings in turn. We usually concentrate on describing the intuition behind prior work, without giving detailed proofs. Some of the results we present have not appeared in the literature before; these are largely based on combining, generalizing or improving existing works. Various open questions are pointed out throughout the survey.
A vast amount of work in quantum computing can be interpreted through the lens of property testing. Indeed, taken to extremes, any efficient quantum algorithm for a decision problem could be seen as an efficient property tester, and any measurement scheme that tries to learn properties of a quantum state or channel could be seen as a quantum property tester. We therefore concentrate on covering those algorithms which can clearly be understood as distinguishing objects with some property from those "far" from that property, and we make no attempt to be completely comprehensive. Also, our focus is on the computer-science aspects of the field, rather than work which primarily takes a physics perspective, such as the study of interaction-free measurement and the flourishing field of quantum metrology. Finally, we do not attempt to cover the (now very extensive) field of classical testers for classical properties. For much more on these, see the references given earlier.

Quantum testing of classical properties
In the first part of this paper we will consider quantum testing of classical properties. Again, X will typically be the set of all N -element strings over some finite alphabet, the distance will be normalized Hamming distance, and the complexity of both quantum and classical property testers will be measured by the number of queries to the input x.
One of our goals is to survey examples of quantum speed-up, i.e., describe properties where the complexity of quantum testers is substantially less than the complexity of classical testers. Most known quantum speed-ups for testing classical properties were derived from earlier improvements in query complexity: they rely on quantum algorithms such as those of (in chronological order) Bernstein and Vazirani [30], Simon [141], Shor [140], Grover [76], and Ambainis [15]. In Section 2.1 we describe these quantum property testers and the improvements they achieve over classical testers. Some of the properties considered are very natural, and some of the improvements achieved are quite significant.
In Section 2.2 we describe some lower -bound methods for quantum property testing, i.e., methods to show query complexity lower bounds for quantum algorithms that want to test specific properties. The main lower bounds in this area have been obtained using the polynomial method. We also describe the adversary method, which-when applied properly-proves optimal lower bounds. And we ask whether the recent classical property testing lower bounds of Blais et al. [32], based on communication complexity, can be applied to quantum testers as well.

Classical testing of quantum properties
In the second part we will consider classical testing of quantum properties. At first sight, this scenario might make no sense-how could a classical algorithm, without the ability to perform any quantum operations, be able to test quantum objects? But suppose someone gives us a quantum state and claims it is an EPR-pair. Or someone builds a quantum device to implement a Hadamard gate, or to measure in a specific basis. How can we test that these quantum objects conform to their specifications? These are questions often faced for instance by experimentalists who try to check that their quantum operations work as intended, or by parties who run quantum cryptographic hardware provided by an untrusted supplier. We do not want to assume here that we already have the ability to implement some other quantum operations reliably, because that would lead to an infinite regress: how did we establish that those other quantum objects are reliable? Accordingly, we somehow would like to test the given quantum object while only trusting our classical devices. Of course, in order to test a quantum object there has to be at least some interaction with the quantum object-to-be-tested. In the testers we consider, the only quantum involvement is with that object itself in a black-box fashion (whence the name "self-testing"): we can only observe its classical input-output behavior, but not its inner quantum workings.
This notion of quantum self-testing was introduced by Mayers and Yao [114,115], who described a procedure to test photon sources that are supposed to produce EPR-pairs. Since then quite a lot of work has been done on self-testing. Recently self-testing has found many applications in the area of device-independent quantum cryptography, where parties want to run cryptographic protocols for things like key distribution or randomness generation, using quantum states or apparatuses (photon sources, measuring devices, etc.) that they do not fully trust. Self-testing the states or apparatuses makes device-independent cryptography possible in some cases. See, e.g., [23,56,9,145,146] for references to this fast-growing area.

Quantum testing of quantum properties
In the final part of the paper we will consider cases where X is a set of quantum objects and our tester is also quantum, which is a setting of both theoretical and experimental interest.
As experimentalists control ever-larger quantum systems in the lab, the question of how to characterize and certify these systems becomes ever more pressing. Small quantum systems can be characterized via a procedure known as quantum state tomography [127,124]. However, completely determining the state of a system of n qubits necessarily requires exponentially many measurements in n. This is already a daunting task for fairly small experiments; for example, Häffner et al. [79] report tomography of a state of 8 ions requiring 656,100 experiments and a total measurement time of 10 hours. One way of reducing this complexity is to start with the assumption that the state is of a certain form (such as a low-rank mixed state [75,64] or a matrix product state [57]), in which case the number of parameters required to be estimated can be dramatically reduced. The viewpoint of property testing suggests another approach: the direct determination of whether or not something produced in the lab has a particular property of interest, under the assumption that it either has the property or is far away from it.
One can view classical property testing algorithms in two ways: either as testing properties of data (such as graph isomorphism), or properties of functions (such as linearity). If one wishes to generalize property testing to the quantum realm, one is thus naturally led to two different generalizations: testing properties of quantum states, and properties of quantum operations. One can divide each of these further, according to whether the state is pure or mixed, and whether the operation is reversible or irreversible; this classification is illustrated in Table 1. We discuss each of these possibilities in Sections 4 and 5. Within some of these categories there are natural generalizations of properties studied classically. For example, testing properties of mixed states is analogous to the classical idea of testing properties of probability distributions. Some quantum properties, however, have no simple classical analog (such as properties relating to entanglement).

Coherent Incoherent Static
Pure state ( §4.1) Mixed state ( §4.2) Dynamic Unitary operator ( §5.1) Quantum channel ( §5.2) Table 1: The taxonomy of quantum properties Classically, there are many connections known between property testing and computational complexity. In Section 5.3 we explore the link between quantum property testing and quantum computational complexity, including the use of property testers to prove results in computational complexity, and the use of computational complexity to prove limitations on property testers.

Quantum testing of classical properties
When considering (quantum or classical) testers for classical objects, those classical objects are usually strings, X = [m] N , and the complexity of testers is measured by the number of queries they make to their input x. Here we briefly define the quantum query model, referring to [45] for more details. We assume some basic familiarity with quantum computing [124].
Informally, a query allows us to "read" x i for any i of our choice. Mathematically, to make this correspond to a quantum operation, it is modeled by the unitary map Here the first register has dimension N and the second has dimension m. The answer x i is added into this second register mod m. Part of the power of quantum query algorithms comes from their ability to apply a query to a superposition of different is, thus globally "accessing" the input x while using only one query.
If m = 2, then putting the state |− = 1 √ 2 (|0 − |1 ) in the second register has the following effect: We will sometimes call this a "phase-query," because the answer x i to the query is inserted in the state as a phase (+1 if x i = 0, and −1 if x i = 1).
A T -query quantum algorithm is described by an initial state, say 0 k , and T + 1 fixed k-qubit unitaries U 0 , . . . , U T . The final state when the algorithm runs on input x is obtained by interleaving these unitaries with queries to x (O x may be tensored with the identity operation on the remaining workspace qubits), This final state depends on x via the T queries. A measurement of the final state will determine the classical output of the algorithm.

Upper bounds
In this section we will survey the main speed-ups that have been obtained using quantum testers for classical properties.

Using amplitude amplification
A simple but very general way that quantum computers can speed up many classical property testers is via the powerful primitive of amplitude amplification, which was introduced by Brassard et al. [36] and can be seen as a generalization of Grover's quantum search algorithm [76]. We assume we are given access to some function f (w) (treated as a black box), and have a quantum algorithm which, with probability p, outputs w such that f (w) = 1. Then the result of Brassard et al. is that, for any p > 0, we can find a w such that f (w) = 1 with O(1/ √ p) uses of f , with success probability at least 2/3. This algorithm can be immediately applied to speed up classical property testers which have perfect completeness. Here we think of w as the internal randomness of the algorithm, and f (w) as the test which is applied to the unknown object, based on the random bits w. We let f (w) = 0 if the test accepts, and f (w) = 1 if the test rejects. Assuming that the test has perfect completeness, finding w such that f (w) = 1 is equivalent to determining whether we should reject. Given that the original test used q queries to find such a w with probability p > 0, we therefore obtain a test which uses O(q/ √ p) queries and rejects with constant probability.
For example, consider the well-studied classical property of Linearity [33]. A function f : .) A simple and natural test for linearity is to pick x, y ∈ {0, 1} n uniformly at random and accept if and only if f (x)⊕f (y) = f (x⊕y). This test uses only 3 queries, has perfect completeness, and can be shown [28] to reject functions f which are ǫ-far from linear with probability at least ǫ. Applying amplitude amplification to this tester, we immediately get a quantum tester for Linearity which uses O(1/ √ ǫ) queries. Another simple example is Symmetry, where f : {0, 1} n → {0, 1} is said to be symmetric if f (x) depends only on |{i : x i = 1}|. A classical tester for this property has been given by Majewski and Pippenger [113]. The tester uses 2 queries, has perfect completeness and rejects functions with are ǫ-far from symmetric with probability at least ǫ. Therefore, we again obtain a quantum tester which uses O(1/ √ ǫ) queries.
Hillery and Andersson [87] gave different quantum testers for these two properties (though also based on amplitude amplification), each of which uses O(ǫ −2/3 ) queries, which is worse. Very recently, Chakraborty and Maitra [46] gave an alternative quantum linearity tester which uses O(1/ √ ǫ) queries.

Using the Bernstein-Vazirani algorithm
One of the first quantum algorithms was the Bernstein-Vazirani algorithm [30]. If x i = s ·i for all i ∈ {0, 1} n , then it is easy to see that the measurement yields s with probability 1.
Buhrman et al. [43] showed this can be turned into an unbounded quantum speed-up for testing most subsets of Hadamard codewords. Proof. Quantum upper bound. We run the Bernstein-Vazirani algorithm on input x, which takes one quantum query. The algorithm will output some s, and if x equals some h(s) ∈ P A BV then this will be the corresponding s with certainty. Hence if s ∈ A we can reject immediately. If s ∈ A then choose i ∈ [N ] at random, query x i , and test whether indeed x i = s · i. If x is ǫ-far from P A BV then this test will fail with probability ǫ. Using amplitude amplification, we can detect any x that is ǫ-far from P A BV with success probability at least 2/3 using O(1/ √ ǫ) queries.

Bernstein-Vazirani property for
Classical lower bound. Choose the set A ⊆ {0, 1} n uniformly at random. Consider the uniform input distribution over the set H of all N Hadamard codewords. Note that the Hadamard codewords that are not in P A BV are 1/2-far from P A BV , because any two distinct Hadamard codewords have relative Hamming distance exactly 1/2. Hence if P A BV can be tested with T queries, then there exists a deterministic decision tree that is correct on at least 2/3 of the x ∈ H. Fix a deterministic decision tree T of depth T . For each x ∈ H, the probability (over the choice of A) that x ∈ P A BV is 1/2, irrespective of the output that T gives on x, so the probability that T correctly decides x is 1/2. Then the probability that T correctly decides at least 2/3 of the x ∈ H is 2 −Ω(N ) by a Chernoff bound. The total number of deterministic decision trees of depth T is at most 2 2 T N 2 T −1 , because for each of the (at most) 2 T − 1 internal nodes we have to choose an index to query, and for each of the (at most) 2 T leaves we have to choose a binary output value. Hence by the union bound, the probability (over the choice of A) that there exists a depth-T decision tree that correctly decides at least 2/3 of the x ∈ H is at most For T = (log N )/2 this quantity is negligibly small. This shows that for most choices of A, there is no classical tester for P A BV with (log N )/2 queries.

Testing juntas
Let f : {0, 1} n → {+1, −1} be a Boolean function (such an f can also be viewed as a string x of N = 2 n bits, with x i = f (i)), and J be the set of variables on which f depends. If |J| ≤ k then f is called a k-junta.
"Essentially" in the attribution of the above theorem refers to the fact that [17] prove an O(k/ǫ) bound. We observe here that the dependence on ǫ can easily be improved by a square root using amplitude amplification.
Proof. The basic quantum subroutine is the same as in Section 2.1.2: 1. Start with |0 n and apply Hadamard gates to each qubit to form the uniform superposition Apply a phase-query to obtain 1 3. Apply Hadamard transforms to each qubit and measure.
Let us analyze this by means of some Fourier analysis on the Boolean cube (see [125,151] for background). For every s ∈ {0, 1} n , let be the corresponding Fourier coefficient. Going through the steps of the quantum subroutine, it is easy to see that the final state before the measurement is Accordingly, the final measurement will sample an s ∈ {0, 1} n from the distribution given by the squared Fourier coefficients f (s) 2 . This procedure is known as Fourier Sampling [30]. It costs one query to f .
Let J be the set of variables on which the input f depends. The goal of the tester is to decide whether |J| ≤ k or not. Note that f (s) = 0 only if the support of s lies within J, so each Fourier Sample gives us a subset of J. The tester will keep track of the union W of the supports seen so far. We will always have W ⊆ J, so if f is a k-junta then W will never have more than k elements. On the other hand, below we show that if f is ǫ-far from any k-junta, then with high probability after O(k/ √ ǫ) queries W will end up having more than k elements.
For a subset W ⊆ [n] of size at most k, define g(i) = s⊆W f (s)(−1) i·s , where we identify sets s ⊆ [n] with their characteristic vectors s ∈ {0, 1} n . This function g need not be a Boolean function, but we can consider the Boolean function h that is the sign of g. This h only depends on the variables in W , so it is a k-junta and hence ǫ-far from f . Now we have where the first equality is Parseval's identity. But this means that with probability at least ǫ, Fourier Sampling will output an s that is not fully contained in W . Now we use amplitude amplification to find such an s, using an expected number of O(1/ √ ǫ) queries. Repeating this at most k + 1 times, after an expected number of O(k/ √ ǫ) queries the set W (which was initially empty) will contain more than k variables and we can reject the input.
However, the best known classical lower bound is only Ω(k) [51] (for fixed ǫ), so there might even be a classical tester that is as efficient as the quantum one. It is open whether this quantum tester is optimal. Atıcı and Servedio [17] prove an Ω( √ k) lower bound for testers that use Fourier Sampling as a black box, but no non-trivial general lower bound seems to be known. Question 1. What is the quantum complexity of testing juntas?

Using Simon's algorithm
The first exponential speed-up for quantum property testing was also obtained by Buhrman et al. [43]. It is inspired by Simon's algorithm [141]. This was the first algorithm to have a provable exponential speed-up over classical algorithms in the black-box model; it also inspired Shor's factoring algorithm [140] which we will see in the next section. Again let N = 2 n and identify [N ] with {0, 1} n . Consider an input x ∈ [N ] N for which there exists an s ∈ {0, 1} n \{0 n } such that x i = x j if and only if (j = i or j = i ⊕ s). Simon's algorithm finds s with high probability using O(log N ) queries. The core of the algorithm is the following quantum subroutine: 1. Start with |0 n |0 n and apply Hadamards to the first n qubits to form 1 √ N i∈{0,1} n |i |0 n 2. Apply a query to obtain 1 √ N i∈{0,1} n |i |x i 3. Measure the second register. This yields some z = x i and collapses the first register to the two indices with value z: 1 √ 2 (|i + |i ⊕ s ) 4. Apply Hadamards to the first n qubits and measure the state, obtaining some y ∈ {0, 1} n .
It is easy to calculate that the measured state is (up to phases) a uniform superposition over all 2 n−1 strings y ∈ {0, 1} n that satisfy s · y = 0 (mod 2). Each such y gives us a linear constraint (mod 2) on the bits of s. Repeating this subroutine O(n) times gives, with high probability, n − 1 linearly independent y (1) , . . . , y (n−1) all orthogonal to s. From these, s can be calculated classically by Gaussian elimination. Brassard and Høyer [35] subsequently gave an exact version of this algorithm, where each new y is guaranteed to be linearly independent from the previous ones.
Again, this algorithm can be used to obtain a strong quantum speed-up for testing a specific property.
Simon property: Note that, compared with Simon's original problem, the 'if and only if' has been replaced with an 'if.' Hence x i and x j can be equal even for distinct i, j for which j = i ⊕ s. However, also for such more general inputs, Simon's quantum subroutine only produces y such that s · y = 0 (mod 2).
"Essentially" in the attribution of the above theorem refers to the fact that Buhrman et al. [43] devised a property of binary strings of length N . In our presentation it will be more convenient to consider a property consisting of strings over alphabet [N ]. As remarked by Aaronson and Ambainis [3], Theorem 3 has an interesting interpretation in terms of when we can hope to achieve exponential quantum speed-ups. In order to obtain a super-polynomial quantum speed-up for computing some function f in the query complexity model, it is known that there has to be a promise on the input, i.e., f has to be a partial function [27]. The Simon property indeed involves a promise on the input, namely that it is either in or far from P Simon ; however, this promise is in some sense very weak, as the algorithm has to output the right answer on a 1 − o(1) fraction of [N ] N .
Proof. Quantum upper bound (sketch). We run the Brassard-Høyer version of Simon's subroutine n − 1 times. We then classically compute a non-zero string s that is orthogonal to all the n − 1 strings y produced by these runs (there may be several such s, in which case we just pick any). We then randomly choose i ∈ [N ], query x i and x i⊕s , and check if these two values are equal. If x ∈ P Simon then s will have the property that x i = x i⊕s for all i. On the other hand, if x is 1/4-far from P Simon , then there exist at least N/4 (i, i ⊕ s)-pairs such that x i = x i⊕s (for otherwise we could put x into P Simon by changing one value for each such pair, making fewer than N/4 changes in total). Hence in this case we reject with constant probability. Testing a few different (i, i ⊕ s)-pairs reduces the error probability to below 1/3.  Proof. Let S = {y : y is not 1/4-far from P Simon } be the elements that are not in the support of D 0 . We will upper bound the size of S. Each element of P Simon is specified by giving an s ∈ {0, 1} n \{0 n } and giving for each of the N/2 (i, i ⊕ s)-pairs the value x i = x i⊕s . Hence For each x, the number of y that are 1/4-close to x is at most N N/4 N N/4 . Hence the total number of elements 1/4-close to P Simon is Since U is uniform over [N ] N and D 0 is uniform over [N ] N \S, the total variation distance between these two distributions is O(|S|/N N ) = o(1).
To finish the proof, below we slightly adapt the proof in [141] to show that a T -query classical algorithm distinguishing distributions D 1 and U has advantage O(T 2 /N ) over random guessing. Since D 0 and U are o(1)-close, a T -query classical algorithm distinguishing distributions D 1 and D 0 has advantage O(T 2 /N ) + o(1) over random guessing. A classical tester for the Simon property can distinguish D 1 and D 0 with success probability at least 2/3, so it needs T = Ω( √ N ) queries.

Claim 5.
A T -query classical algorithm for distinguishing distributions D 1 and U has advantage O(T 2 /N ) over random guessing.
Proof. By the Yao principle it suffices to prove this for an arbitrary deterministic T -query algorithm. The proof will show that both under D 1 and U the T queries are likely to yield a uniformly random sequence of T distinct values. Suppose the algorithm queries the indices i 1 , . . . , i T (this sequence depends on x) and gets outputs x i 1 , . . . , x i T . Call a sequence of queries i 1 , . . . , i T good if it shows a collision, i.e., x i k = x i ℓ for some k = ℓ. Call the sequence bad otherwise. We will now show that the probability of a bad sequence is O(T 2 /N ), both under input distribution U and under D 1 .
First, suppose the input x is distributed according to U . Then each output x i k is uniformly distributed over [N ], independent of the other entries of x. The probability that i k and i ℓ form a collision is exactly 1/N , so the expected number of collisions among the T queries is T 2 /N = O(T 2 /N ). Hence, by Markov's inequality, the probability that i 1 , . . . , i T form a good sequence is O(T 2 /N ).
Second, suppose the input x is distributed according to D 1 . Then there exists a nonzero s ∈ {0, 1} n , unknown to the algorithm, such that x i = x j whenever j = i ⊕ s. Initially, all such s are equally likely under D 1 (the probability that there are two distinct such s for x is negligibly small, and we will ignore this here). If i 1 , . . . , i k−1 is bad, then we have excluded k−1 2 of the N − 1 possible values of s, and all other values of s are equally likely. Let i k be the next query and S = {i k ⊕ i j : j < k}. S has only k − 1 members, so the probability (under D 1 ) that S happens to contain the string s is . If S does not contain s, then the only way to make the sequence good is if the uniformly random value x i k equals one of the k − 1 earlier values, which has probability (k − 1)/N . Hence the probability that the bad sequence i 1 , . . . , i k−1 remains bad, after query i k is made, is very close to 1. In formulas: Here we used the fact that The latter sum is O(T 2 /N ), so the probability (under D 1 ) that i 1 , . . . , i T form a good sequence is O(T 2 /N ).
In both cases (U and D 1 ), conditioned on seeing a bad sequence, the sequence of outputs is a uniformly random sequence of T distinct values. Accordingly, the advantage (over random guessing) of the algorithm trying to distinguish these two distributions is upper bounded by the probability of seeing a good sequence, which is O(T 2 /N ) in both cases.

Using Shor's algorithm
Probably the most famous quantum algorithm to date is Shor's polynomial-time algorithm for factoring integers [140]. Its quantum core is an algorithm that can find the period of a periodic sequence. Chakraborty et al. [47] used this to show that testing periodicity exhibits a constant-versuspolynomial quantum-classical separation. Note that the Bernstein-Vazirani property (Section 2.1.2) exhibits a constant-versus-logarithmic separation, while the Simon property (Section 2.1.4) exhibits a logarithmic-versus-polynomial separation. Periodicity-testing thus exhibits a separation that is in some ways stronger than either of those.
Periodicity: x ∈ [m] N is 1-1-p-periodic if it satisfies that x i = x j if and only if i = j mod p (equivalently, the elements in the sequence x 0 , . . . , x p−1 are all unique, and after that the sequence repeats itself). For integers and q ≤ p ≤ r and m ≥ p, such that N ≥ 2r 2 , define the property P q,r period = {x ∈ [m] N : x is 1-1-p-periodic for some p ∈ {q, . . . , r}} Note that for a given p it is easy to test whether x is p-periodic or far from it: choose an i ∈ [N ] uniformly at random, and test whether x i = x i+kp for a random positive integer k. If x is p-periodic then these values will be the same, but if x is far from p-periodic then we will detect this with good probability. However, r − q + 1 different values of p are possible in P q,r period , and this makes the property hard to test for classical testers. On the other hand, in the quantum case the property can be tested efficiently.
Theorem 6 (Chakraborty et al. [47]). For every even integer r ∈ [2, √ N ) and constant distance ǫ, there is a quantum property tester for P r/2,r period using O(1) queries, while every classical property tester for P r/2,r period makes Ω( r/ log r log N ) queries. In particular, for r = √ N testing can be done with O(1) quantum queries but requires Ω(N 1/4 /(log N ) 2 ) classical queries.
The quantum upper bound is obtained by a small modification of Shor's algorithm: use Shor to find the period p of input x (if there is such a period) and then test this purported period with another O(1) queries. 2 The classical lower bound is based on modifying proofs from Lachish and Newman [107], who showed classical testing lower bounds for more general (and hence harder) periodicity-testing problems.
In an attempt to construct oracles to separate BQP from the Polynomial Hierarchy, Aaronson [2] analyzed the problem of "Fourier checking": roughly, the input consists of two ℓ-bit Boolean functions f and g, such that g is either strongly or weakly correlated with the Fourier transform of f (i.e., g(x) = sign(f (x)) either for most x or for roughly half of the x). He proved that quantum algorithms can decide this with O(1) queries, while classical algorithms need Ω(2 ℓ/4 ) queries. Viewed as a property testing problem on an input of length N = 2 · 2 ℓ bits, this was the first constant-vs-polynomial separation between quantum and classical testers. However, neither his separation nor periodicity-testing fully answers the following question from Buhrman et al. [43].
Is there a property of N -element strings (on a moderately-sized alphabet) that can be tested with O(1) quantum queries but needs Ω(N ) classical queries?
An unpublished result of Aaronson and Ambainis [4] is relevant here: they showed that if a (total or partial) function on x ∈ {0, 1} N can be computed with bounded error probability using k quantum queries, then the same function can be computed by a classical randomized algorithm using O(N 1−1/2k ) queries. Hence for binary alphabets the answer to the above question is negative: everything that can be tested with k = O(1) quantum queries can be tested with O(N 1−1/2k ) = o(N ) classical queries. This can be extended to small alphabets, but the question remains open for instance when the alphabet size is N .

Using quantum counting
Grover's quantum search algorithm [76] can be used to find the index of a 1-bit in x ∈ {0, 1} N with high probability, using O( √ N ) queries. We will not describe the algorithm here, but just note that it can be generalized to also estimate, for given S ⊆ [m], the number of occurrences of elements from S in a string x ∈ [m] N , using a number of queries that is much less than would be needed classically. More precisely, we have the following "quantum approximate counting" lemma, which follows from the work of Brassard et al. [36,Theorem 13]: Lemma 7. There exists a constant C such that for every set S ⊆ [m] and every positive integer T , there is a quantum algorithm that makes T queries to input x ∈ [m] N and, with probability at least 2/3, outputs an estimate p ′ to p = |{i : We now describe an application of this to property testing, namely to testing whether two probability distributions are equal or ǫ-far from each other in total variation distance. Each distribution will be given as an input x ∈ [m] N , which naturally induces a probability distribution D x on [m] according to the relative frequencies of the different elements: We can obtain a sample according to D x by just querying x on a uniformly random index i. Assuming the distribution is given in this way is quite natural in the setting of property testing, where our input is usually a very long string x, much too long to inspect each of its elements. Note that D x does not change if we permute the elements of x; it just depends on the relative frequencies.
Also note that Lemma 7 can be used to estimate the probability of S ⊆ [m] under D x .
Suppose we are given two distributions D x and D y on [m] (the distributions are given in the form of two inputs x, y ∈ [m] N ), and we want to test whether these two distributions are equal or ǫ-far in total variation distance (i.e., 1 2 j∈[m] |D x (j) − D y (j)| ≥ ǫ). Batu et al. [25] exhibited classical testers for this using O((m/ǫ) 2/3 log m) queries 3 , and Valiant [144] proved an almost matching lower bound of Ω(m 2/3 ) for constant ǫ. These bounds have both recently been improved by Chan et al. [48] to a tight Θ(m 2/3 /ǫ 4/3 ) (for ǫ = Ω(m −1/4 )). Bravyi et al. [38] showed that quantum testers can do better in terms of their dependence on m: Theorem 8 (Bravyi et al. [38]). There is a quantum tester to test if two given distributions on [m] are equal or ǫ-far using O( √ m/ǫ 8 ) queries.
Proof. (sketch) Bravyi et al. [38] actually showed something stronger, namely that the total variation distance between two distributions can be estimated up to small additive error ǫ using O( √ m/ǫ 8 ) quantum queries; this clearly suffices for testing. We sketch their idea here. Consider the following random process: It is easy to see that the expected value of the output of this process is exactly the total variation distance between D x and D y , so it suffices to approximate that expected value. We sample j according to D (which costs just one query), use the quantum algorithm of Lemma 7 with S = {j} and T = O( √ m/ǫ 6 ) queries to approximate both D x (j) and D y (j), and output the absolute difference between these two approximations divided by their sum. Bravyi et al. [38] show that repeating this O(1/ǫ 2 ) times and taking the average gives, with probability at least 2/3, an ǫapproximation of the expected value of the above random process.
A second problem is where we fix one of the two distributions, say to the uniform distribution on [m] (assume m divides N so we can properly "fit" this distribution in x ∈ [m] N ). Goldreich and Ron [72] showed a classical testing lower bound of Ω( √ m) queries for this, and Batu et al. [24] proved a nearly tight upper bound of O( √ m) queries. Bravyi et al. [38], and independently also Chakraborty et al. [47], showed that testing can be done more efficiently in the quantum case: Theorem 9 (Bravyi et al. [38], Chakraborty et al. [47]). There is a quantum tester to test if a given distribution on [m] equals or is ǫ-far from the uniform distribution on [m], using O(m 1/3 /ǫ 2 ) quantum queries.
Proof. (sketch) Pick a set T ⊆ [N ] of t = m 1/3 indices uniformly at random, and query its elements.
If D x is uniform then it is very likely that all values {x i } i∈T are distinct, so if there is some collision then we can reject immediately. Otherwise, let S = {x i : i ∈ T } be the t distinct results, and define p = |{i : Lemma 13] shows that if D x is ǫ-far from uniform then with high probability p ≥ (1 + cǫ 2 )t/m for some constant c > 0. Now we use the quantum algorithm of Lemma 7 with T = O(m 1/3 /ǫ 2 ) queries to obtain an estimate p ′ of p within additive error (cǫ 2 /2)t/m. We accept if p ′ ≤ (1 + cǫ 2 /2)t/m, and reject otherwise.
Both Bravyi et al. [38] and Chakraborty et al. [47] showed that Ω(m 1/3 ) quantum queries are also necessary, so the above result is essentially tight; the lower bound follows from a reduction from the collision problem [7]. Bravyi et al. [38] also exhibited a quantum tester for whether two distributions are equal or of disjoint support (i.e., orthogonal), using O(m 1/3 ) quantum queries. Chakraborty et al. [47] extended Theorem 9 to testing equality to any fixed distribution, at the expense of a polylog factor in the number of queries. They in turn used this to obtain better quantum testers for graph isomorphism.

Using Ambainis's algorithm
Ambainis's element distinctness algorithm [15] acts on an input x ∈ [m] N , and finds (with high probability) a pair of distinct indices such that x i = x j if such a pair exist, and reports "no collision" otherwise. It uses O(N 2/3 ) queries, which is optimal [7]. This algorithm spawned a large class of algorithms based on quantum walks (see [139] for a survey).
Ambainis et al. [16] use the element distinctness algorithm to give better quantum testers for certain graph properties. Graph properties have some amount of symmetry: they are invariant under relabelling of vertices. Problems with "too much" symmetry are known not to admit exponential quantum speed-up in the query complexity model [3], and the symmetry inherent to graph properties makes them an interesting test case for the question of how symmetric the problems can be for which we do obtain a significant quantum advantage. Ambainis et al. [16] use the element distinctness algorithm to give O(N 1/3 )-query quantum testers for the properties of bipartiteness and being an expander in bounded-degree graphs. It is known that for classical testers, Θ( √ N ) queries are necessary and sufficient to test these properties. Together with the graph isomorphism tester mentioned briefly at the end of Section 2.1.6, these are the only quantum results we are aware of for testing graph properties. In contrast, graph properties have been one of the main focuses in classical property testing.
Let us describe the results of [16] a bit more precisely. The object to be tested is an N -vertex graph G of degree d, so each vertex has at most d neighbors. We think of d as a constant. The input is given as an adjacency list. Theorem 10 (Ambainis et al. [16]). There exist quantum testers for Bipartite and Expander Proof. (sketch) At a high level, the optimal classical testers for both properties look for collisions in a set of roughly √ N elements. Using Ambainis's algorithm, this can be done in roughly N 1/3 queries.
A bipartite graph has no odd cycles. In contrast, for a graph that is far from bipartite one can show that among √ N short (O(log N )-step) random walks, there is likely to be a pair forming an odd cycle. Hence, fixing the randomness of the classical tester, it suffices to detect collisions in a string x ∈ [m] c In the case of expanders, a short random walk will quickly converge to the uniform distribution. In contrast, for a graph that is far from any expander, such a walk will typically not be very close to uniform. If we sample k times from the uniform distribution over some s-element set, the expected number of collisions is k 2 /s. In particular, for k ≈ √ 2s we expect to see one collision. In contrast, k samples from a non-uniform distribution give a higher expected number of collisions. Hence if we do c √ N short random walks, for some constant c, then the expected number of collisions among the c √ N endpoints is likely to be significantly smaller in the case of an expander than in the case of a graph that is far from every expander. Again we use a variation of Ambainis's algorithm, this time to approximately count the number of collisions in an input x ∈ [m] c √ N , consisting of the endpoints of the c √ N random walks. If this number is too high, we reject. This uses O(N 1/3 ) queries to the graph. The technical details are non-trivial, but we will skip them here.
Ambainis et al. also proved an Ω(N 1/4 ) quantum lower bound for testing expanders, using the polynomial lower bound method (see Section 2.2.1). They were not able to show N Ω(1) lower bounds for testing bipartiteness. This all leaves the following very interesting question open: Question 3. Is there any graph property which admits an exponential quantum speed-up?

Quantum speed-ups for testing group-theoretic properties
Finally, a number of authors have considered quantum testers for properties of groups; we list these here without explaining them in detail.
• Friedl et al. [67] give efficient quantum testers for the property of periodic functions on groups (the testers are even time-efficient for Abelian groups), as well as a few other group-theoretic properties. The testers are based on the use of the (Abelian and non-Abelian) quantum Fourier transform.
• Friedl et al. [66] exhibit an efficient (poly(log N, 1/ǫ)-query) classical tester for the property of N × N multiplication tables corresponding to N -element Abelian groups, which is based on "dequantizing" a quantum tester. The distance used is the so-called "edit distance." • Inui and Le Gall [92], extending [66], exhibit an efficient (poly(log N, 1/ǫ)-query) quantum tester for the property of N × N multiplication tables corresponding to N -element solvable groups. In this case, no efficient classical tester is known.
• Le Gall and Yoshida [108] give classical lower bounds on various group testing problems, which in particular demonstrate an exponential separation between the classical and quantum complexities of testing whether the input is an Abelian group generated by k elements (where k is fixed).

The polynomial method
The first lower bounds for quantum property testing were proven by Buhrman et al. [43]. They were based on the polynomial method [27], which we now briefly explain. The key property is: The acceptance probability of a T -query quantum algorithm on input x ∈ {0, 1} N can be written as an N -variate multilinear polynomial p(x) of degree ≤ 2T .
Note that if we have a T -query quantum tester for some property P ⊆ {0, 1} N , then its acceptance probability p is a degree-2T polynomial p such that p( x is far from P, and p(x) ∈ [0, 1] for all other x. The polynomial method derives lower bounds on the query complexity T from lower bounds on the minimal degree of such polynomials.
Our first application of this method is a result which is essentially from [43]. It says the following: if we have a property P such that a (not necessarily uniform) random x ∈ P is indistinguishable from a random N -bit string if we only look at up to k bits, then the quantum query complexity of testing P is Ω(k).
Theorem 11 (Buhrman et al. [43]). Let P ⊆ {0, 1} N be a property such that the number of elements . Then every quantum ǫ-property tester for P must make at least (k + 1)/2 queries.
Proof. Suppose there is a quantum algorithm which tests P using T queries, where T < (k + 1)/2. Then by the polynomial method, its acceptance probability is given by a polynomial p(z) of degree at most 2T ≤ k. Assume towards a contradiction that the algorithm has success probability at least 2/3 on every input z that is in or ǫ-far from P. Then and, letting P close be the set of z that are ǫ-close to P, We have obtained a contradiction, which completes the proof.
A variant of Theorem 11, which generalizes the claim to an underlying set [m] N (m > 2) but does not consider the property testing promise, was independently shown by Kane and Kutin [98]. It is apparently quite hard to satisfy the uniformity constraint of Theorem 11; however, it can sometimes be achieved. For example, consider any property which can be expressed as membership of a linear code C ⊆ {0, 1} N . A linear code is described as the set As Alon et al. [13] observe, it is well-known in coding theory that if C has dual distance d, then any subset of at most d − 1 of the bits of C are uniformly distributed. For completeness, we include a proof. Thus, if C has dual distance d, taking D to be uniform over C in Theorem 11 gives an Ω(d) lower bound on the quantum query complexity of testing membership in C. A natural example for which this result gives a tight lower bound is the Reed-Muller code R(d, ℓ). Each codeword of this code is a binary string of length N = 2 ℓ obtained by evaluating a function f : {0, 1} ℓ → {0, 1}, which can be written as a degree-d polynomial in ℓ variables over F 2 , at every element z ∈ {0, 1} ℓ . R(d, ℓ) is known to have dual distance 2 d+1 [111, Chapter 13], so Theorem 11 implies that any quantum algorithm testing the set of degree-d polynomials in ℓ variables over F 2 must make Ω(2 d ) queries. In particular, this means that quantum algorithms obtain no asymptotic speed-up, in terms of their dependence on d, over the best classical algorithm for testing this property [13]. One can generalize this whole argument to derive quantum lower bounds for testing membership of various interesting properties corresponding to codes over F q , for q > 2; we omit the details.
Buhrman et al. also applied the polynomial method to show, by a counting argument, that most properties do not have an efficient property tester. Informally speaking, there are too many properties, and too few low-degree polynomials.
Theorem 13 (Buhrman et al. [43]). Let P ⊂ {0, 1} N be chosen at random subject to |P| = 2 N/20 , and fix ǫ to be a small constant. Then, except with probability exponentially small in N , any quantum ǫ-property tester for P must make Ω(N ) queries.
A more involved application of the polynomial method is the tight Ω(log N ) lower bound that Koiran et al. [104] proved for the quantum query complexity of Simon's problem. With a bit of work, their proof also works to show that the property tester presented in Section 2.1.4 is essentially optimal.
Another highly non-trivial application of the polynomial method is the Ω(N 1/4 ) lower bound of Ambainis et al. [16] for testing the property of a bounded-degree graph being an Expander (see Section 2.1.7). Their lower bound is inspired by the one for the collision problem [7], and at a high level works as follows. They give an input distribution D ℓ over N -vertex d-regular graphs with ℓ components, and show that the acceptance probability of a T -query quantum tester can be written as an O(T log T )-degree bivariate polynomial p(ℓ, M ) in ℓ and another parameter M ≈ N . A random graph of ℓ = 1 components is very likely to be an expander, so p(1, M ) ≈ 1; on the other hand, every graph with ℓ > 1 components will be far from an expander, so p(ℓ, M ) ≈ 0 for integers ℓ > 1. They then use results about polynomial approximation to show that such polynomials need degree Ω(N 1/4 ).

The adversary method
The two main lower bound methods that we know for quantum query complexity are the above polynomial method, and the so-called adversary method, introduced by Ambainis [14]. For a long time this adversary method faced the so-called "property testing barrier" [91]: for every N -bit partial Boolean function where 0-inputs and 1-inputs have Hamming distance Ω(N ), the method can prove only a constant lower bound on the query complexity. Note that all testing problems for classical properties fall in this regime, since the 0-inputs are required to be far from all 1-inputs (i.e., elements of the property).
However, Høyer et al. [91] generalized Ambainis's method to something substantially stronger, which can prove optimal bounds for quantum property testing. We now describe their "negative weights" adversary bound. Let F : D → {0, 1}, with D ⊆ [m] N , be a Boolean function. An adversary matrix Γ for F is a real-valued matrix whose rows and columns are indexed by all x ∈ D, satisfying that Γ xy = 0 whenever f (x) = f (y). Let ∆ j be the Boolean matrix whose rows and columns are indexed by all x ∈ D, such that ∆ j [x, y] = 1 if and only if x j = y j . The (negative-weights) adversary bound for F is given by the following expression: where Γ ranges over all adversary matrices for F , '•' denotes entry-wise product of two matrices, and ' · ' denotes operator norm (largest singular value) of the matrix.
Høyer et al. [91] showed that this quantity is a valid lower bound: every quantum algorithm that computes F with error probability ≤ ǫ needs to make at least 1 2 (1 − ǫ(1 − ǫ))ADV ± (F ) queries. Subsequently, Reichardt et al. [132,109] showed this lower bound is actually essentially tight: for every Boolean function F there is a quantum algorithm computing it with error ≤ 1/3 using O(ADV ± (F )) queries. Since property testing is just a special of this (the 1-inputs of F are all x ∈ P, and the 0-inputs are all x that are far from P), in principle the adversary bound characterizes the quantum complexity of testing classical properties. However, in practice it is often hard to actually calculate the value of ADV ± (F ), and we are not aware of good quantum property testing lower bounds that have been obtained using this method.

A communication complexity method?
Recently, a very elegant lower bound method for classical property testing was developed by Blais et al. [32], based on communication complexity. In the basic setting of communication complexity [154,106], two parties (Alice with input x and Bob with input y) try to compute a function F (x, y) that depends on both of their inputs, using as little communication as possible. This is a very wellstudied model with many applications, particularly to lower bounds. Blais et al. [32] showed for the first time how to get property testing lower bounds from communication complexity. Their idea is to convert a T -query property tester for some property P into a protocol for some related communication problem F , by showing that 1-inputs (x, y) for F somehow correspond to elements of P, while 0-inputs (x, y) for F correspond to elements that are far from P. The more efficient the tester, the less communication the protocol needs. Communication complexity lower bounds for F then imply lower bounds on the complexity T of the tester. This is best explained by means of an example. A k-linear function f : {0, 1} n → {0, 1} is a linear function that depends on exactly k of its input bits: there exists a weight-k x ∈ {0, 1} n such that f (i) = i · x mod 2 for all i ∈ {0, 1} n . Let P be the set of k-linear functions, and assume k is even. Suppose we have a randomized T -query tester T for P. We will show how such a tester induces an efficient communication protocol for the communication complexity problem of deciding whether weight-k/2 strings x and y are disjoint or not (i.e., whether x ∧ y = 0 n ). Alice, who received input x, forms the function f (i) = i · x and Bob forms the function g(i) = i · y. Consider the function h(i) = i · (x ⊕ y). Since |x ⊕ y| = |x| + |y| − 2|x ∧ y| and |x| + |y| = k, the function h is a (k − 2|x ∧ y|)-linear function. In particular, h is a k-linear function if x and y are disjoint, and 1/2-far from any k-linear function if x and y intersect. Now Alice and Bob use a shared random coin to jointly sample one of the deterministic testers that make up the property tester T . Note that they can simulate a query i to h by 2 bits of communication: Alice sends i · x to Bob and Bob sends i · y to Alice. Hence a T -query tester for P implies a 2T -bit communication protocol for disjointness on k-bit inputs x and y. Plugging in the known communication lower bound of Ω(k) bits for multi-round disjointness on weight-k/2 inputs implies that every classical tester for k-linear functions needs Ω(k) queries, which is nearly tight [31]. And plugging in a better Ω(k log k) lower bound for one-way communication complexity gives T = Ω(k log k) for non-adaptive classical testers (i.e., testers where the next index to query is independent of the outcomes of the earlier queries), which is tight [60,44].
Can we use the same idea to prove lower bounds on quantum testers? In principle we can, but notice that the overhead when converting a quantum tester into a communication protocol is much worse than in the classical case. In the classical case, thanks to the fact that Alice and Bob can use shared randomness to fix a deterministic tester, they both know at each point in the protocol which query i will be made next. Hence they only need to communicate the constant number of bits corresponding to the answer to that query, so the overall communication is O(T ). In the quantum case, the queries can be made in superposition, so the conversion will have an overhead of O(n) qubits of communication: each query will be "simulated" by an n-qubit message (superposition over is) from Alice to Bob, and another such message from Bob to Alice. Now a T -query quantum tester induces an O(T n)-qubit quantum protocol for disjointness. But the best lower bound one can hope for on communication complexity problems with n-bit inputs is Ω(n), which gives only a trivial T = Ω(1) lower bound! This, however, is not because we did the reduction in a suboptimal way: for example, testing k-linear functions can be done with O(1) quantum queries, similarly to Section 2.1.2.
Question 4. Can some modification of the ideas of Blais et al. [32] be used for non-trivial lower bounds on quantum testers?

Classical testing of quantum properties
In this section we will survey what is known about classical testing of two kinds of quantum objects: implementations of basic unitary operations, and implementations of quantum protocols for certain games.
Before we go there, let us mention that there is another way in which one can consider classical testing of quantum properties: by imagining that we are given classical access to a quantum object which is too large for an efficient classical description. For example, we might be given access to an unknown pure state |ψ of n qubits by being allowed to query arbitrary amplitudes in the computational basis at unit cost. This then becomes an entirely classical property testing problem. Some natural properties of quantum states in this context have indeed been studied classically; one example is the Schmidt rank. A bipartite state |ψ on systems AB is said to have Schmidt rank r if it can be written as |ψ = r i=1 √ λ i |v i |w i for pairwise orthonormal sets of states {|v i }, {|w i } and non-negative λ i ; this is known as the Schmidt decomposition of |ψ . A tester for this property follows from work of Krauthgamer and Sasson [105], who have given an efficient tester for low-rank matrices. Their algorithm distinguishes between the cases that a d × d matrix M is rank at most r, or at least an ǫ-fraction of the entries in M must be changed to make M rank at most r, and queries only O((r/ǫ) 2 ) elements of the matrix. If we think of M as the amplitudes of a bipartite pure quantum state |ψ ∈ (C d ) ⊗2 (i.e., M ij = i| j|ψ ), this is equivalent to a tester for the property of |ψ having Schmidt rank at most r.

Self-testing gates
When experimentalists try to implement a quantum computer in the usual circuit model, they will have to faithfully implement a number of basic quantum operations, called elementary gates. Suppose we can implement some superoperator 5 G. How can we test whether it indeed implements the gate it is supposed to implement? We can prepare a computational basis state, apply G to it a number of times, and measure the resulting state in the computational basis. Say G is supposed to implement the Hadamard gate. If we prepare |0 , apply G once and measure in the computational basis, the probability to see a 0 should be 1/2. Similarly, if we prepare |0 , apply G twice and measure, the probability to see 0 should be 1. These are so-called experimental equations that a self-tester can test by repeatedly performing the corresponding experiments. It should be noted that such equations cannot fully determine a gate. For example, if G is the Hadamard gate in a basis where |1 is replaced with e iφ |1 , then no experiment as described above can detect this: H and its cousin satisfy exactly the same experimental equations. Still, van Dam et al. [59] showed that such experimental equations are surprisingly powerful and can essentially characterize many gate sets, including some universal sets. 6 For concreteness we will focus below on a specific universal set, namely the one consisting of the Hadamard gate H, the π/4-phase gate T = 1 0 0 e iπ/4 , and the controlled-NOT operation. This set has the added benefit that it supports fault-tolerant quantum computing: implementing these gates up to small error suffices for universal quantum computing.
Let us first define experimental equations a bit more precisely. Following van Dam et al. [59], we use Pr c [ρ] to denote the probability that measuring the (pure or mixed) state ρ in the computational basis gives outcome c. Then an experimental equation in one superoperator variable G is of the form Pr c [G k (|b b|)] = r, for b, c ∈ {0, 1}, positive integer k, and r ∈ [0, 1]. Note that we assume here that we can apply exactly the same superoperator G more than once. An experimental equation in two variables F and G is of the form Pr 0 [F k 1 G ℓ 1 · · · F kt G ℓt (|b b|)] = r, for b ∈ {0, 1}, integers k 1 , . . . , k t , ℓ 1 , . . . , ℓ t , and r ∈ [0, 1] (concatenation of superoperators here denotes composition). We can similarly write experimental equations in more than two operators, and on systems of more than one qubit. Such experimental equations are all the things a self-tester can test.
Suppose one-qubit operators H and T are intended to be the Hadamard gate H and the π/4phase gate T , respectively, and two-qubit operator C is supposed to be CNOT (with slight abuse of notation we identify unitary gates with the corresponding superoperators here). Let us see to what extent we can test this. To start, the following experimental equations are clearly necessary for H: Van Dam et al. [59,Theorem 4.2] showed that these equations characterize the Hadamard gate up to the one remaining degree of freedom that we already mentioned, in the following sense: H satisfies the above three equations if and only if there exists φ ∈ [0, 2π) such that H equals (the superoperator corresponding to) H φ , which is the Hadamard gate where |1 is replaced with e iφ |1 . The unknown phase φ cannot be ignored, because it might interact with the effects of other gates.
The following two experimental equations are clearly necessary for T: These two equations are far from sufficient for characterizing the T gate; for example, every diagonal unitary will satisfy these two equations, as would the superoperator that fully decoheres a qubit in the computational basis. However, by introducing some additional equations involving both H and T we can do better: To complete our self-test, consider the superoperator C. The following experimental equations are clearly necessary for C to equal CNOT: These equations ensure that C implements the same permutation of basis states as the CNOT gate. This is still far from sufficient. We add the following experimental equations, which describe the desired interaction between CNOT and H: where C φ denotes (the superoperator corresponding to the) controlled-NOT gate with |1 replaced with e iφ |1 .
Because our apparatuses are never perfect, we cannot hope to implement the elementary gates exactly. Fortunately, thanks to quantum fault-tolerant computing it suffices if we can implement them up to small error (in fact different applications of the same superoperator can have different errors and need not all be identical). Hence we also cannot expect the gates that we are testing to exactly satisfy all of the above experimental equations. Furthermore, even if they did satisfy these equations exactly, we would never be able to perfectly test this with a finite number of experiments. Accordingly, we would like the test consisting of these experimental equations to be robust, in the sense that if H, T, and C approximately satisfy these equations, then they will be close to the gates they purport to be. We say that superoperators ǫ-satisfy a set of experimental equations if for each of the equations, the left-and right-hand sides differ by at most ǫ. Closeness between superoperators is measured in the superoperator norm induced by the trace norm: G ∞ = sup{ G(V ) 1 : V 1 = 1}. Van Dam et al. [59,Theorem 6.5,last item] indeed showed that the above equations constitute a robust self-test: Theorem 14 (van Dam et al. [59]). There exists a constant c such that for all ǫ > 0 the following holds. If superoperators H, T, C ǫ-satisfy the above 16 experimental equations, then there exists φ ∈ [0, 2π) such that: Each triplet H, T, C that passes the above test is a universal (and fault-tolerant) set of elementary gates, so can in principle be used to realize any quantum circuit. The fact that we do not know φ is not important when implementing a circuit using this triplet of gates: since φ cannot be detected by any experimental equations, it cannot affect the classical input-output behavior of a quantum circuit built from these superoperators. We also do not know whether T approximately equals T or its inverse T −1 . Using Hadamard and CNOTs cannot help distinguish these two cases, because they only differ in a minus sign for the imaginary unit (something gates with real entries cannot pick up). However, precisely because such a change is undetectable experimentally, we can just build our circuit assuming T is close to T ; if it is close to T −1 instead, that will incur no observable differences in the input-output behavior of our circuit.
In addition to the above result, van Dam et al. [59] also showed a number of other families of gates to be robustly self-testable, and proved more general robustness results. In follow-up work, Magniez et al. [112] study self-testing of quantum circuits together with measurement apparatuses and sources of EPR-pairs, introducing notions of simulation and equivalence.

Self-testing protocols
In addition to quantum gates and circuits, a large area of application of quantum self-testing is in multi-party quantum protocols. Here typically two or more parties share an entangled state (in the two-party case these are often EPR-pairs) on which they operate locally. Experimentalists often need to test that their apparatuses produce the required entangled state, or at least something close to it, and that the local operations and measurements act as required. Unless we somehow already have some other trusted quantum objects available, we are in the self-testing regime: we would like to test a quantum object by classically interacting with it, without making assumptions about the measurement apparatuses, the states used, or even the dimension of the Hilbert spaces that are involved.
Again, for concreteness we will focus on testing protocols for one specific example in the twoparty setting 7 , namely the famous CHSH game [55]. This is defined as follows.
Alice and Bob receive uniformly distributed inputs x, y ∈ {0, 1}, respectively. They output a, b ∈ {0, 1}, respectively. They win the game if the XOR of the outputs equals the AND of the inputs: a ⊕ b = xy.
Alice and Bob want to maximize their probability of winning this game, without communication between them. It is known that classical protocols can win with probability 0.75, but not more, even when they use shared randomness. In contrast, there exists a quantum protocol that wins the game with probability cos(π/8) 2 ≈ 0.854, which is optimal even if the players are allowed to share much larger entangled states [54]. This "Bell inequality violation" has been confirmed by many experiments, albeit with a few remaining experimental "loopholes," suggesting that Nature does not behave according to classical physics (see the recent survey by Brunner et al. [40] for much more on such nonlocality).
The specific quantum protocol P * that achieves the optimal winning probability cos(π/8) 2 uses one EPR-pair as starting state. Depending on their respective inputs x and y, Alice and Bob do the following specific projective measurements (defined in terms of the Pauli matrices, see Eq. (3) below): Alice measures the observable 1 √ 2 (Z + (−1) x X), and Bob measures the observable Z if y = 0 and X if y = 1. How much freedom do we have in such "good" quantum protocols for the CHSH game? Popescu and Rohrlich [130] and Braunstein et al. [37] independently showed that any protocol that wins CHSH with maximal probability needs to start with an EPR-pair 8 , or something that can be turned into an EPR-pair (possibly in tensor product with another state shared between Alice and Bob) using local unitary operations. The correct attribution of this result is not completely clear, see also the work of Summers and Werner [142] and Tsirelson [143, p. 11].
However, as in the previous section, robustness is important: we expect that if a protocol wins the CHSH game with close-to-maximal probability, then its entangled state must be close to an EPR-pair. 9 Such a robust result was proved independently in [117,118]: Theorem 15 ( [117,118]). If a protocol wins CHSH with probability at least cos(π/8) 2 − ǫ, then (up to local operations on Alice and Bob's side) its starting state must be O( √ ǫ)-close to an EPR-pair, and its measurements must be O( √ ǫ)-close to the measurements of protocol P * .
Accordingly, we can use this to test whether given states are close to EPR-pairs: run the CHSH protocol on them and see if the winning probability is close to the optimal value cos(π/8) 2 . McKague et al. [117] give a more general framework for bipartite robust self-testing that subsumes the CHSH inequality, the Mayers-Yao self-test (simplifying [112]), as well as others. Yang and Navascués [152] give robust self-tests for any entangled two-qubit states, not just maximally entangled ones; the noise-resistance was further improved in [153]. McKague [116] and Miller and Shi [118] give results about self-testing of states shared by more than two parties.
Recently, Reichardt et al. [133] proved a robustness result for playing many instances of CHSH: every quantum protocol that wins roughly 85% of a sequence of k given instances of the CHSH game, must have a block of m = k Ω(1) instances where it start essentially (up to local operations and small differences) from m EPR-pairs and runs m instances of protocol P * . This is an important step towards the goal of having a classical system "command" an untrusted quantum system, in the sense of forcing that system to either use the states and operations that you want it to use, or be detected if it deviates too much from those states and operations. Such control enables various kinds of device-independent quantum cryptography, as well as the ability to offload general quantum computation to untrusted devices.

Quantum testing of quantum properties
In the third part of this survey we discuss quantum testers for quantum properties. The first decision we have to take in this setting is how the quantum object which we wish to test is presented to us. The two options are a quantum presentation (i.e., we are given access to the object as a black box, which can be used in a quantum algorithm), or a classical presentation (i.e., we are given an efficient classical description of the object, such as a quantum circuit). We concentrate on the former option (Sections 4.1-5.2), as this seems to be the most natural generalization of ideas from classical property testing. However, in Section 5.3 we also discuss the latter option, which turns out to be important in quantum computational complexity.
Our focus in this survey is on quantum tests for quantum properties which generalize the idea of classical property testing. That is, tests which are designed to distinguish quantum states (or operations) with some property from those far from having that property, given access to the state (or operation) as a black box. We also mention here two related and well-studied areas elsewhere in quantum information theory. The first is quantum state discrimination, which can be seen as a quantum generalization of classical hypothesis testing. The archetypal problem in this setting is as follows: given the ability to create copies of an unknown quantum state ρ picked from a known set S of quantum states, identify ρ. See the surveys [22,49] for detailed reviews of this area. The second is the question of directly estimating some quantity of interest about a completely unknown quantum state ρ, given access to multiple copies of the state, without performing full tomography. Results of this form include direct estimation of the spectrum of ρ [100], estimation of polynomials in the entries of ρ [39], and estimation of quantities related to entanglement (e.g., [77]).
We begin our discussion of quantum properties by considering properties of quantum states.

Pure states
A pure state |ψ of a d-dimensional quantum system is described by a d-dimensional complex unit vector (technically, a ray; that is, e iθ |ψ is equivalent to |ψ for all real θ). A property of d-dimensional, pure quantum states is therefore a set P ⊆ C d . One can naturally generalize this to properties of pairs of quantum states, where P ⊆ C d × C d , etc.
There is a natural measure of distance between quantum states |ψ and |φ : the trace distance Here · 1 is the trace norm (Schatten 1-norm) M 1 := tr |M |. If two states have trace distance ǫ, the optimal worst-case success probability of distinguishing them via a measurement is exactly (1 + ǫ)/2 [86,124]. We therefore say that |ψ is ǫ-close to having property P if and similarly that |ψ is ǫ-far from having property P if D(|ψ , P) ≥ ǫ. If |ψ is ǫ-close to having property P, there is no hope of certifying that |ψ / ∈ P with worst-case bias larger than ǫ.
The complexity of algorithms for testing pure quantum states is measured by the number of copies of the test state |ψ required to distinguish between the two cases that a) |ψ ∈ P, or b) |ψ is ǫ-far away from having property P. We therefore say that P can be ǫ-tested with q copies if there exists a quantum algorithm which uses q copies of the input state to distinguish between these two cases, and fails with probability at most 1/3 on any input. As with classical property testers, we say that a tester has perfect completeness if it accepts every state in P with certainty. Crucially, we look for algorithms where the number of copies used scales only in terms of ǫ, and there is no dependence on the dimension d, making this a fair analog of the classical concept. If we cannot find such an algorithm, we attempt to minimize the dependence on d.

Equality
The first property we consider is extremely basic, but a useful building block for more complicated protocols: whether the input state is equal to some fixed state. We say that a state |ψ satisfies the Equality to |φ property if |ψ = e iθ |φ for some real θ; it is necessary to allow an arbitrary phase θ in the definition of this property, as |ψ cannot be distinguished from e iθ |ψ by any measurement. A natural test for Equality to |φ is simply to perform the measurement {|φ φ|, I − |φ φ|} on |ψ , and accept if and only if the first outcome is obtained. The probability of acceptance is precisely | ψ|φ | 2 , so if |ψ satisfies the property, the test accepts with certainty. On the other hand, if D(|ψ , |φ ) = ǫ, the test rejects with probability ǫ 2 . Via repetition, we find that for any |φ , Equality to |φ can be tested with O(1/ǫ 2 ) copies.
We remark that this immediately generalizes to the problem of testing whether |ψ ∈ C d is contained in a known subspace S ⊆ C d . Here the prescription is to perform the measurement {Π S , I − Π S } O(1/ǫ 2 ) times, where Π S is the projector onto S, and accept if and only if the first outcome is obtained every time. For example, this allows the property Permutation Invariance to be tested efficiently, where |ψ ∈ (C d ) ⊗n satisfies the property if it is invariant under any permutation of the n subsystems. As |ψ is permutation-invariant if and only if it is contained in the symmetric subspace of (C d ) ⊗n , projecting onto this subspace gives an efficient test for this property. This procedure, which is known as symmetrization, has been studied in the context of quantum fault-tolerance and can be performed efficiently [21]; see Section 4.2.2 below for a description of how this can be achieved via the powerful primitive of generalized phase estimation.
Another immediate generalization of Equality to |φ is the question of testing whether two unknown states are the same. We say that two states |ψ , |φ satisfy the Equality property if |ψ = e iθ |φ for some real θ. In order to test this property, we will use a simple but important procedure known as the swap test. This was used by Buhrman et al. [42] to demonstrate an exponential separation between the quantum and classical models of simultaneous message passing (SMP) communication complexity, and has since become a standard tool in quantum algorithm design. In the test, we take two (possibly mixed) states ρ, σ as input and attach an ancilla qubit in state |0 . We then apply a Hadamard gate to the ancilla, followed by a controlled-SWAP gate (controlled on the ancilla), and another Hadamard gate. We then measure the ancilla qubit and accept if the answer is 0. This is illustrated by the following circuit.

|0
H One can show [42,103] that the swap test accepts with probability which for pure states |ψ , |φ is equal to (1 + | ψ|φ | 2 )/2 = 1 − D(|ψ , |φ ) 2 /2. In particular, if this test is applied to two pure states which satisfy the Equality property then the test accepts with certainty. On the other hand, if the states are ǫ-far away from equal, then by definition where the inequality follows by taking |ξ = |φ . Thus the test rejects with probability at least ǫ 2 /2, so O(1/ǫ 2 ) repetitions suffice to detect states ǫ-far away from equal with constant probability; in other words, Equality can be tested with O(1/ǫ 2 ) copies. The swap test is in fact optimal among all testers for this property which have perfect completeness and use one copy of each of the input states. To see this, observe that the swap test is precisely the operation of projecting onto the symmetric subspace of (C d ) ⊗2 . Any tester which accepts every pair of equal states |ψ ⊗2 must accept every state in this subspace, so the swap test is the most refined test of this type. One can generalize this to prove that the swap test is also optimal (in some sense) among tests which are allowed two-sided error [97].
The property of Equality can be generalized further, to the question of testing whether n pure states |ψ 1 , . . . , |ψ n are equal. The natural tester for this property, generalizing the swap test, is to project onto the symmetric subspace of (C d ) ⊗n , i.e., to perform symmetrization [21]. Kada et al. [97] have studied this procedure under the name of the permutation test, and show that the test accepts n-tuples where at least one pair of states is orthogonal with probability at most 1/n, and that this is optimal among tests with perfect completeness. They also study a related tester, called the circle test, and prove that this test is also optimal for prime n.

Productness
A pure state |ψ ∈ (C d ) ⊗n of n d-dimensional subsystems is said to be product (i.e., satisfy the Product property) if it can be written as |ψ = |ψ 1 |ψ 2 . . . |ψ n for some local states |ψ 1 , . . . , |ψ n ∈ C d . A state which is not product is called entangled. Entanglement is a ubiquitous phenomenon in quantum information theory (see for example [90] for an extensive review), so the property of being a product state is an obvious target to test.
Given just one copy of |ψ , our ability to test whether it is product is very limited. Indeed, as every quantum state can be written as a linear combination of product states, any tester which accepts all product states with certainty must accept all states with certainty. However, if we are given two copies of |ψ , there are non-trivial tests we can perform. In particular, consider the following procedure, which was first discussed by Mintert et al. [120] and is called the product test [83]: apply the swap test across each corresponding pair of subsystems of |ψ ⊗2 , and accept if and only if all of the tests accept. The overall procedure is illustrated in Figure 1.
If |ψ is indeed product, then all of the swap tests will accept. On the other hand, if |ψ is far from product, the intuition is that the entanglement in |ψ will cause at least some of the tests to reject with fairly high probability. This intuition can be formalized to give the following result.
Theorem 16 (Harrow and Montanaro [83]). If |ψ is ǫ-far from product, the product test rejects with probability Ω(ǫ 2 ). Thus the property of productness can be tested with O(1/ǫ 2 ) copies. We will not give the full, and somewhat technical, proof of Theorem 16 here, but merely sketch the proof technique; see [83] for details.
Proof. (sketch) Let P test (|ψ ) denote the probability of the product test accepting when applied to two copies of |ψ , and let the distance of |ψ from the nearest product state be ǫ. The proof is split into two parts, depending on whether ǫ is low or high. For S ⊆ [n], let ψ S be the mixed state obtained by tracing out (discarding) the qubits not in S. Then the starting point is the observation that i.e., that the probability that the test passes is equal to the average purity of the reduced state obtained by a random bipartition of the n systems. Writing |ψ = √ 1 − ǫ 2 |0 n +ǫ|φ (without loss of generality), for some product state |0 n and arbitrary orthogonal state |φ , Eq. (2) allows an explicit expression for tr ψ 2 S in terms of ǫ and |φ to be obtained. Expanding |φ = x∈{0,...,d−1} n α x |x and summing over S, we get an expression containing terms of the form x∈{0,...,d−1} n |α x | 2 c |x| for some c < 1, where |x| := |{i : x i = 0}|. In order to obtain a non-trivial bound from this, the final step of the first part of the proof is to use the fact that |0 n is the closest product state to |ψ to argue that |φ cannot have any amplitude on basis states |x such that |x| ≤ 1. A bound is eventually obtained that is applicable when ǫ is small, namely that In the case where ǫ is large, this does not yet give a useful upper bound, so the second part of the proof finds a constant upper bound on P test (|ψ ). This quantity can be shown to be upper bounded by the probability that a relaxed test, for being product across any partition of the n subsystems into k ≤ n parties, passes. If |ψ is far from product across the n subsystems, the proof shows that one can find a partition into k parties such that the distance from the closest product state (with respect to this partition) falls into the regime where the first part of the proof works. The eventual result is that if ǫ 2 ≥ 11/32 > 0.343, then P test (|ψ ) ≤ 501/512 < 0.979; combining these two bounds completes the proof.
We mention two implications of Theorem 16. First, by the characterization (2), the content of Theorem 16 can be understood as: if a pure state of n systems is still fairly pure on average after discarding a random subset of the systems, it must in fact have been close to a product state in the first place. In the classical property testing literature, one of the motivations for analysing tests for combinatorial properties is to obtain some insight into the structure of the property being tested; Theorem 16 can be seen as achieving something similar in a quantum setting.
Second, by allowing one to efficiently certify productness given two copies of |ψ , this test can be used to show that quantum Merlin-Arthur proof systems with multiple provers can be simulated efficiently by two provers, or in complexity-theoretic terminology that QMA(k) = QMA(2) [83]. Via a previous result of Aaronson et al. [5] giving a multiple-prover quantum proof system for 3-SAT, this in turn allows one to prove hardness of various tasks in quantum information theory, conditioned on the hardness of 3-SAT [83]. This is again analogous to the classical literature, where efficient property testers are used as components in hardness-of-approximation results.
Although the product test itself is natural, the detailed proof of Theorem 16 given in [83] is a lengthy case analysis which does not provide much intuition and gives suboptimal constants. For example, the lower bound obtained on the probability of the product test rejecting does not increase monotonically with ǫ, which presumably should be the case for an optimal bound. We therefore highlight the following open question.

Question 5.
Can the analysis of the product test be improved?

Arbitrary finite or infinite sets
The following algorithm of Wang [147] gives a tester for any finite property P ⊂ C d . However, the tester cannot necessarily be implemented efficiently in general. Given access to copies of an input state |ψ , the tester proceeds as follows: 1. Create the state |ψ ⊗T , for some T to be determined. Theorem 17 (Wang [147]). Let P ⊂ C d be such that min |φ =|φ ′ ∈P D(|φ , |φ ′ ) = δ. Then it suffices to take T = O(log |P| max{ǫ −2 , δ −2 }) to obtain a tester which accepts every state in P with certainty, and rejects every state |ψ such that D(|ψ , P) ≥ ǫ with probability at least 2/3.
The intuition behind Theorem 17 is that, if all the states in P have large pairwise distances, {|φ ⊗T } is an approximately orthonormal basis for S, so if |ψ is ǫ-far from P, the probability of incorrectly accepting is which is sufficiently small when T = O((log |P|)/ǫ 2 ). It is an interesting question whether the dependence on δ can be improved or removed, either by better analysis of the above test or by designing a new tester. Question 6. Does there exist a tester for arbitrary finite properties P ⊂ C d whose parameters have no dependence on min |φ =|φ ′ ∈P D(|φ , |φ ′ )?
The above tester is a general algorithm for testing any property P, and for some properties P it is possible to prove better bounds than Theorem 17. For example, the product test is a particular case of this algorithm (with T = 2), and Theorem 16 gives non-trivial bounds on its performance, even though it is applied to the infinite set of product states. We also remark that an alternative algorithm to the above tester would be to produce |ψ ⊗T , and for each |φ ∈ P in turn, perform the measurement {|φ φ| ⊗T , I − |φ φ| ⊗T }, and accept if and only if the first outcome is obtained from any measurement. This algorithm would achieve similar scaling in terms of ǫ and δ (as can be shown using the "quantum union bound" of Aaronson [1], or the "gentle measurement lemma" of Winter [150] and Ogawa and Nagaoka [126]) but would not have perfect completeness.
We finally observe that any (even infinite) property P ⊆ C d can be tested using O(d/ǫ 2 ) copies of the input state |ψ ; it suffices to obtain an estimate |ψ ′ such that D(|ψ ′ , |ψ ) < ǫ/2, and accept if and only if D(|ψ ′ , P) ≤ ǫ/2. In order to produce such an estimate one can use a procedure known as quantum state estimation, which needs O(d/ǫ 2 ) copies of |ψ to achieve the required accuracy with success probability at least 2/3 [41].

Open questions
There are a number of interesting sets of pure states for which an efficient tester is not known. One such set is the stabilizer states. The Pauli matrices on one qubit are defined to be the set They form a basis for the space of single-qubit linear operators, and by tensoring form a basis for the space of linear operators on n qubits; for s ∈ {I, X, Y, Z} n , we write σ s for the corresponding operator on n qubits. We call each such tensor product operator a (n-qubit) Pauli matrix, and use P n to denote the set of all n-qubit Pauli matrices, together with phases ±1, ±i, which forms a group under multiplication.
A state |ψ of n qubits is said to be a stabilizer state if there exists a maximal Abelian subgroup G of P n such that U |ψ = |ψ for all U ∈ G. Stabilizer states are important in the study of quantum error-correction [73] and measurement-based quantum computation [131], as well as many other areas of quantum information. It is known that, given access to copies of an unknown stabilizer state |ψ of n qubits, |ψ can be learned with O(n) copies [6]; there is a matching Ω(n) lower bound following from an information-theoretic argument [88]. However, it might be possible to test whether |ψ is a stabilizer state using far fewer copies. Question 7. Is there a tester for the property of being a stabilizer state whose parameters do not depend on the number of qubits n?
Other sets of pure states for which it would be interesting to have an efficient tester are matrix product states (see, e.g., [128]) and states of low Schmidt rank. See Section 4.2 below for evidence for a lower bound on the complexity of testing the latter property.

Mixed states
A mixed state ρ is a convex combination of pure states. Mixed states are described by density matrices, which are positive semidefinite matrices with unit trace; we let B(C d ) denote the set of d-dimensional density matrices. The concept of property testing can easily be generalized from pure states to mixed states. We retain the same, natural distance measure which is called the trace distance between ρ and σ. As before, say that ρ is ǫ-far from having and ǫ-close to having property P if D(ρ, P) ≤ ǫ. Another important distance measure for mixed states is the fidelity, which is defined as F (ρ, σ) := √ ρ √ σ 1 . The fidelity and trace distance satisfy the inequalities [124, Eq. 9.110] In a mixed-state property testing scenario, we are given k copies of ρ, for some unknown ρ, and asked to perform a measurement on ρ to determine whether ρ ∈ P, or ρ is ǫ-far away from P. Some properties of mixed states can indeed be tested efficiently. A simple example is the property Purity, where ρ satisfies the property if and only if it is a pure state. A natural way to test purity is to apply the swap test to two copies of ρ. This accepts with probability (1 + tr ρ 2 )/2, which is equal to 1 if and only if ρ is pure. On the other hand, if we let ρ = i λ i |ψ i ψ i | be the eigendecomposition of ρ, where eigenvalues are listed in non-increasing order, a closest pure state to ρ is |ψ 1 . If ρ is ǫ-far away from pure, then λ 1 = 1 − ǫ. Note that For ǫ ≤ 1/2, tr ρ 2 ≤ (1 − ǫ) 2 + ǫ 2 and hence the test accepts with probability at most 1 − ǫ + ǫ 2 = 1 − Θ(ǫ); for ǫ ≥ 1/2, tr ρ 2 ≤ 1/2. Thus Purity can be tested with O(1/ǫ) copies of ρ.
On the other hand, consider the "dual" property of Mixedness, where ρ ∈ B(C d ) satisfies the property if and only if it is the maximally mixed state I/d. A strong lower bound has been shown by Childs et al. [50] on the number of copies required to test this property.
Theorem 18 (Childs et al. [50]). Let d and r be integers such that r divides d. Any algorithm which distinguishes, with probability of success at least 2/3, between the two cases that ρ = I/d or ρ is maximally mixed on a uniformly random subspace of dimension r must use Ω(r) copies of ρ. Further, there exists an algorithm which solves this problem using O(r) copies.
Childs et al. call the problem which they consider the quantum collision problem. To see how their result can be applied to Mixedness, consider the space of n qubits, whose dimension is d = 2 n . As a state ρ which is maximally mixed on a dimension-r subspace of C 2 n satisfies D(ρ, I/2 n ) = 1 − r/2 n , taking r = 2 n−1 implies that any algorithm distinguishing between the cases that ρ = I/2 n and ρ is 1/2-far from I/2 n must use Ω(2 n ) copies of ρ. This result also puts strong lower bounds on a number of other property testing problems which one might wish to solve. For example, consider the following three properties: • Equality of pairs of mixed states, where the pair (ρ, σ) satisfies the property if ρ = σ. This can be seen as the quantum generalization of the classical question of testing whether two probability distributions on d elements are equal or ǫ-far from equal (with respect to the total variation distance), given access to samples from the distributions. A sublinear tester for the classical problem has been given by Batu et al. [25], and recently improved by Chan et al. [48]; for constant ǫ the tester uses O(d 2/3 ) samples. By fixing σ = I/d, the result of [50] implies that the quantum generalization of this problem is more difficult.
• Whether a mixed state ρ has rank at most r. Theorem 18 immediately implies that this requires Ω(r) copies of ρ, which has an interesting implication for testing pure states. Recall that a bipartite state |ψ on systems AB is said to have Schmidt rank r if it can be written as |ψ = r i=1 √ λ i |v i |w i for pairwise orthonormal sets of states {|v i }, {|w i } and nonnegative λ i . If one looks only at the A subsystem, the rank of the reduced state is precisely the Schmidt rank of |ψ . Therefore, Theorem 18 implies that any algorithm which tests whether a pure state |ψ has Schmidt rank r by producing k copies of |ψ and acting only on the first subsystems A 1 , . . . , A k of |ψ ⊗k must satisfy k = Ω(r).
• Separability of mixed states. A bipartite quantum state ρ ∈ B((C d ) ⊗2 ) is said to be separable if it can be written as a convex combination of product states, and is said to be entangled otherwise. Determining separability up to accuracy which is inversely polynomial in the dimension d is known to be NP-hard [78,68], and there is some evidence for intractability of the problem even up to constant accuracy [83]. This does not preclude the existence of a tester for separability which is efficient in terms of the number of copies of ρ used; however, Theorem 18 can be used to show that such a tester cannot exist.
The idea is to show that the maximally mixed state on a random subspace of dimension r is far from separable, if r is picked suitably. This can be achieved by combining some previously known results. The entanglement of formation of a bipartite state ρ, is defined by where S(ρ) = − tr ρ log 2 ρ is the von Neumann entropy. Of course, if ρ is separable, E F (ρ) = 0. Let ρ be the maximally mixed state on a random subspace of C d ⊗C d of dimension r = ⌊Bd 2 ⌋, for some fixed 0 < B < 1. Hayden et al. [84] have shown that there exists a universal constant A > 0 such that, for any choice of B with 0 < B ≤ A, there exists C > 0 such that E F (ρ) ≥ C log 2 d, except with probability exponentially small in d. Also, Nielsen [123] has shown a continuity property for the entanglement of formation: Combining these two properties, and relating the fidelity to the trace distance using (4), we have that ρ is distance Ω(1) from the set of separable states with high probability. On the other hand, the maximally mixed state I/d 2 is clearly separable. Therefore, any tester which distinguishes separable states from states a constant distance from any separable state can be used to distinguish the maximally mixed state from a random dimension-r subspace; by Theorem 18, this task requires Ω(d 2 ) copies of the input state.
We remark that the theory of entanglement witnesses takes an alternative approach to the direct detection of entanglement (see for example [77,90] for extensive reviews). An entanglement witness for a state ρ is an observable corresponding to a hyperplane separating ρ from the convex set of separable states; measuring the observable allows one to certify that ρ is entangled. Each such witness will only be useful for certain entangled states, however, so this approach does not provide a means of certifying entanglement of a completely unknown state ρ.
Conversely to the above lower bounds, and similarly to the case of pure states, any property P ⊆ B(C d ) can be tested with O(d 4 /ǫ 2 ) copies. To distinguish between the two cases that ρ ∈ P or ρ is ǫ-far from P, it suffices to use an estimate ρ such that D( ρ, ρ) < ǫ/2, and accept if and only if D( ρ, P) ≤ ǫ/2. Producing such an estimate can be achieved using quantum state tomography [127,124]; in order to achieve the required accuracy with success probability 2/3, O(d 4 /ǫ 2 ) copies suffice [64]. If one knows in advance that ρ is rank r, compressed sensing techniques allow this bound to be improved to O((rd/ǫ) 2 log d) [64].
There is still a gap between the best known lower and upper bounds for testing Equality and Separability. We therefore highlight the following open question: Question 8. What is the complexity of testing Equality and Separability?

Testing equality to a fixed pure state
We have seen that testing whether ρ ∈ B(C d ) is the maximally mixed state I/d can require Ω(d) copies of ρ. By contrast, testing whether ρ is a fixed pure state |ψ ψ| is easy: the obvious test is to perform the measurement {|ψ ψ|, I − |ψ ψ|}, and to accept if the first outcome is returned. The probability of acceptance is ψ|ρ|ψ , which is upper bounded by 1 − D(ρ, |ψ ψ|) 2 [124], so this property can be tested with O(1/ǫ 2 ) copies of ρ.
However, there is a more interesting related question of relevance to experimentalists. Imagine we have some experimental apparatus which is claimed to produce a state |φ of n qubits, and we would like to certify this fact. In this setting, the above test does not seem to make sense; being able to measure |φ is essentially precisely what we wish to certify! We further imagine that n is too large for full state tomography to be efficient. In order to solve this self-certification problem, we would therefore like a procedure which makes a small number of measurements, can easily be implemented experimentally, and certifies that the state produced is approximately equal to |φ . This question has been considered by da Silva et al. [58], and independently Flammia and Liu [65], who show that certain states |φ can be certified using significantly fewer copies of |φ than would be required for full tomography, and indeed that any state |φ can be certified using quadratically fewer copies (O(2 n ) rather than O(2 2n )). The measurements used are also simple: Pauli measurements.
The works [58,65] propose the following scheme. First, pick s ∈ {I, X, Y, Z} n with probability 2 nφ2 s ; orthonormality of the Pauli matrices implies that this is indeed a valid probability distribution. Then repeatedly measure copies of ρ in the eigenbasis of σ s , and take the average of the eigenvalues corresponding to the measurement results to produce an estimate ρ s of 2 nρ s = tr ρσ s . Finally, output ρ s /φ s as our guess for the squared fidelity. The expectation of ρ s is precisely tr ρσ s , and if we assume that this estimate is exact (i.e., ρ s = tr ρσ s ), the expected value of the output is s∈{I,X,Y,Z} n (2 nφ2 s )ρ ŝ φ s = tr ρφ.
Of course, in general we cannot produce an exact estimate without using an infinite number of copies of ρ. However, to estimate the fidelity up to constant additive error with constant success probability, it suffices to use a finite number of copies. The number of copies required turns out to depend on the quantity min s,φs =0 |φ s |; for certain classes of states |φ (such as stabilizer states), the number of copies used does not depend on n.

Unitarily invariant properties
Generalizing the properties Purity and Mixedness, one can consider properties P of mixed quantum states which are unitarily invariant, in the following sense: If ρ ∈ P, then (U ρU † ) ∈ P for all U ∈ U (d), where U (d) denotes the unitary group in d dimensions. Observe that this implies that, if ρ is ǫ-far from P, then so is U ρU † , for all ǫ and all U ∈ U (d). For any ρ, D(ρ, P) must necessarily be a symmetric function of the spectrum of ρ. We can see unitarily invariant properties as quantum analogs of symmetric properties of classical probability distributions [144].
In order to take advantage of the unitary symmetry, one can use a concept known as Schur-Weyl duality. We will only briefly summarize this beautiful theory here, and sketch the consequences for property testing; for much more detailed introductions, see the theses [53,82]. Schur-Weyl duality implies that any linear operator M on (C d ) ⊗k which commutes with permutations of the k subsystems, and also with local unitaries on each subsystem (i.e., U ⊗k M (U −1 ) ⊗k = M for all U ∈ U (d)) can be written as M = λ⊢k α λ P λ for some coefficients α λ and projectors P λ , where the sum is over partitions λ of k (e.g., the partitions of 4 are (4), (3, 1), (2, 2), (2, 1, 1), (1, 1, 1, 1)). Each partition λ corresponds to an irreducible representation (irrep) of S k , the symmetric group on k elements; one important irrep is the trivial irrep (k) which maps π → 1 for all π ∈ S k . The operators P λ are defined by In the above expression, d λ is the dimension of the corresponding irrep V λ of S k , which associates a d λ -dimensional square matrix with each permutation π ∈ S k . Then χ λ is the corresponding character tr V λ and U π is the operator which acts by permuting k d-dimensional systems according to π: U π |i 1 . . . |i k = i π −1 (1) . . . i π −1 (k) .
One can show that each operator P λ is indeed a projector, that P λ P µ = δ λµ P λ , and that λ⊢k P λ = I. These operators therefore define a measurement (POVM), and performing this measurement is known as weak Schur sampling [50]. This can be implemented efficiently via a procedure which is known as generalized phase estimation [82,50] and generalizes the swap test [42] (cf. Section 4.1.1) and symmetrization [21]. Generalized phase estimation is based on the quantum Fourier transform (QFT) over S k [26], which is a unitary operation that performs a change of basis from It follows from basic representation theory that this makes sense, i.e., that λ⊢k d 2 λ = k!. The generalized phase estimation procedure proceeds as follows: 1. Start with a quantum state σ ∈ B((C d ) ⊗k ).
3. Apply the inverse quantum Fourier transform over S k to the ancilla to produce the state 4. Apply the controlled permutation operation π∈S k |π π| ⊗ U π , controlled on the ancilla.

5.
Apply the quantum Fourier transform over S k to the ancilla and measure it, receiving outcome (λ, i, j).

Output λ.
One can show [20,82] that, on input σ, generalized phase estimation does indeed output λ with probability tr P λ σ. 10 It turns out that any test for a unitarily invariant property can, essentially, be taken to consist of performing weak Schur sampling and classically post-processing the results. This provides a kind of quantum analog of the classical notion of a canonical tester for properties of probability distributions [144].
Lemma 19. Let P ⊆ B(C d ) be a unitarily invariant property. Assume there exists a tester which uses k copies of the input state ρ, and accepts all states ρ ∈ P with probability at least 1 − δ, but accepts all states which are ǫ-far from P with probability at most 1 − f (ǫ) for ǫ > 0. Then there exists a tester with the same parameters which consists of performing weak Schur sampling on ρ ⊗k and classically postprocessing the results.
Proof. Let M be the measurement operator corresponding to the tester accepting, and for each ǫ, let ρ ǫ be the state which is distance ǫ from P and achieves the worst-case probability of acceptance (so ρ 0 is the state in P with the lowest probability of acceptance, and for ǫ > 0, ρ ǫ is the state with the highest probability of acceptance such that D(ρ ǫ , P) = ǫ). Then, by the permutation invariance of ρ ⊗k ǫ , we have tr M ρ ⊗k where we define M = 1 k! π∈S k U π M U −1 π , and by the unitary invariance of P, where the integral is taken according to Haar measure on U (d), and similarly tr M ρ ⊗k ǫ ≥ tr M ρ ⊗k ǫ for ǫ > 0. Therefore, it suffices to implement M to achieve the same parameters as M . But M commutes with local unitaries and permutations of the k systems, so by Schur-Weyl duality we can write M = λ α λ P λ for some coefficients α λ ; as M is a measurement operator, for each λ it holds that 0 ≤ α λ ≤ 1. So we can implement M by performing weak Schur sampling, obtaining outcome λ, then accepting with probability α λ .
Further, one can write down the probability of obtaining each outcome λ as follows: if the input state ρ has eigenvalues (x 1 , . . . , x d ), then where s λ is a Schur polynomial (see, e.g., [18] for a discussion). In principle, this allows one to calculate the parameters of the optimal test for any unitarily invariant property; in practice, the calculations required are somewhat daunting. Nevertheless, a careful analysis of the output distributions resulting from weak Schur sampling was the approach taken by Childs et al. [50] to prove their bounds on the quantum collision problem. Indeed, their approach is an example of how one can prove lower bounds on quantum property testers more generally: first use symmetry arguments to prove that the optimal test must be of a certain form, then analyse the optimal test directly.
5 Testing properties of quantum dynamics

Unitary operators
We continue to let U (d) denote the unitary group in d dimensions, and let M (d) denote the set of d × d matrices. A property of unitary operators is simply a (discrete or continuous) subset P ⊆ U (d). Properties of unitary operators display some interesting similarities to and differences from properties of states.

Distance measures
As compared with the case of pure states, it is less obvious which distance measure between unitary operators is the right one to choose to obtain interesting property testing results. For quantum states, the distinguishability of any two states is controlled by their trace distance. A natural way to generalize this to unitary operations would be to maximize the distinguishability of the output states over all input states 11 , to produce Unfortunately, there are extremely simple properties which are hard to test with respect to this distance measure. One such example is the Identity property: does an input unitary U satisfy U = e iθ I? (Note that, as with the case of pure state properties, we allow an arbitrary phase θ in the definition, as U cannot be distinguished from e iθ U .) Consider the family of n-dimensional unitary operators U i , i ∈ [n], where U i |j = (−1) δ ij |j . Each of these has maximal distance from I, according to the distance measure D max . However, a quantum algorithm which uses the input operator U k times and distinguishes between the case where U is equal to the identity, and the case where U = U i for some i, would imply a quantum algorithm which computes the OR function of n input bits, promised to have Hamming weight at most 1, using O(k) queries. As this problem is known to require Ω( √ n) quantum queries [29], it follows that k = Ω( √ n). This is a lower bound on the complexity of identity-testing in an oracular setting; we discuss a lower bound based on computational complexity arguments in Section 5.3.
It is perhaps not surprising that D max is not the right measure of distance to choose for property testing problems, as it is a "best-case" rather than "average-case" measure. A suitable such alternative measure can be defined as follows. For any d-dimensional operators A, B ∈ M (d), let A, B denote the normalized Hilbert-Schmidt inner product 11 One might wonder whether distinguishability could be improved further by allowing the unknown unitary operator to act on part of an entangled state; it turns out that this is not the case [149].  • D(A, B) can alternatively be defined as [110]. Observe that this representation shows that D(·, ·) satisfies the triangle inequality. The following justifies the claim that D(·, ·) is indeed an "average-case" measure of distance.
Proposition 20. Fix d-dimensional unitary operators U and V . Then where the integral is taken according to Haar measure on U (d).
Proof. We have In the third equality we use the fact that |ψ ψ| ⊗2 dψ = (I + F )/(d(d + 1)), where F is the flip (or swap) operator which interchanges two d-dimensional systems. The fourth equality follows from the facts that, for any d-dimensional operators A, B, tr(A ⊗ B) = (tr A)(tr B) and tr((A ⊗ B)F ) = tr(AB).
The quantity dψ | ψ|U † V |ψ | 2 appearing in the proof was previously introduced by Acín [8] as an average-case variant of the fidelity.

Controlled and inverse unitaries
As well as being given access to a unitary operator U , we may be given access to the inverse U −1 and/or the controlled unitary c-U , or in other words the operator |0 0| ⊗ I + |1 1| ⊗ U . This may be a reasonable assumption if we would like to apply our property testing algorithm to a unitary operator given in the form of a quantum circuit; on the other hand, it may not be reasonable in an adversarial scenario where we only assume access to U as a black box.
Recalling that D(U, V ) ≤ U − V 2 , we therefore have the inequalities Thus, given access to controlled unitaries, one can hope to design tests which are sensitive to the 2-norm distance U − V 2 . For example, if we are allowed access to controlled unitaries we can distinguish U from −U , whereas this is impossible given access to U alone.
Being given access to U −1 can also be powerful. In particular, it allows us to apply the important primitive of amplitude amplification [36] to property testing algorithms. Imagine we have a test for a property P ⊆ U (d) which uses q copies of the input unitary U , and such that for U ∈ P the test always accepts (it has perfect completeness), and for U ǫ-far from P, the test accepts with probability at most f (ǫ). Then amplitude amplification allows us to test P with O(q/ f (ǫ)) copies of U , rather than the O(q/f (ǫ)) copies that would be required by simple repetition. For example, we will see below that this gives a square-root speed-up for testing equality of unitary operators. In the complexities we quote below, we assume that amplitude amplification has not been applied.

From properties of states to properties of unitaries
There is a correspondence between pure quantum states and unitary operators, which is known as (a special case of) the Choi-Jamio lkowski isomorphism [52,95] and will sometimes allow us to translate tests for properties of states to tests for analogous properties of unitaries. Given access to U ∈ U (d), we first prepare the maximally entangled state of two d-dimensional systems |i |i and then apply U to the first system. We obtain the state U ji |j |i .
The state |U faithfully represents the original operator U ; in particular, it is easy to see that U |V = U, V and hence D(U, V ) = D(|U , |V ). So, if we have a tester for some property P of d 2 -dimensional quantum states, by applying the test to |U we obtain a tester with the same parameters for an analogous property P ′ of d-dimensional unitary operators.
On the other hand, one sometimes has to be careful. Imagine we have a tester which accepts states with property P with certainty, and accepts states which are ǫ-far away from having property P with probability at most δ. Then, via the Choi-Jamio lkowski isomorphism, this translates into a tester which accepts unitary matrices with property P ′ with certainty, and accepts, with probability at most δ, unitaries which are ǫ-far away from any matrix M with M, M = 1 such that M has property P ′ . Therefore, in principle it could be the case that U is far from any unitary matrix with property P ′ , but is close to some non-unitary matrix M which has property P ′ . In this situation the tester might incorrectly accept. Nevertheless, in various cases of interest one can show that this situation does not arise. In particular, we have the following lemma (which generalizes similar claims in [83,147]). Proof. We have A simple special case of this is the previously discussed Identity property.
• The Equality property for unitary operators, where U and V satisfy the property if U = e iθ V , for some θ. This can be tested by applying the swap test to |U and |V ; again, the analysis of the Equality property for states goes through unchanged, implying that this property is testable with O(1/ǫ 2 ) uses of U and V .
• The Inverses property, where U, V ∈ U (d) satisfy the property if U = e iθ V −1 , for some θ.
The test is to create the state |U V with one use of each of U and V , then to test for equality to |Φ . The probability of rejection is D(U V, I) 2 = D(U, V −1 ) 2 , so if D(U, V −1 ) = ǫ, the test rejects with probability ǫ 2 . Note that there is no need to have access to U −1 or V −1 .
• The Product property for unitary operators, where an operator U ∈ U (d n ) satisfies the property if U = U 1 ⊗ U 2 ⊗ · · · ⊗ U n for some U 1 , . . . , U n ∈ U (d). This can be tested by applying the product test described in Section 4.1.2 to |U [83]. One also needs to show that, if U is close to an operator A ∈ M (d n ) such that A = A 1 ⊗ · · · ⊗ A n , U is in fact close to a unitary operator of this form; this claim follows from Lemma 21. The eventual result is that if U is product the test accepts with certainty, whereas if U is ǫ-far from product, the test rejects with probability Θ(ǫ 2 ).

Membership of the Pauli and Clifford groups
Let B = {B 1 , . . . , B d 2 } be a unitary operator basis for the set of d-dimensional square matrices which is orthonormal with respect to the Hilbert-Schmidt inner product, i.e., B i , B j = δ ij . Then the set |B i forms an orthonormal basis for C d 2 with respect to the standard inner product, implying that one can test membership of a unitary operator U in B with the following procedure, which we call the operator basis test.
1. Create two copies of |U .
3. Accept if both measurements give the same result.
The probability of getting outcome i from each measurement is independent and equal to | U, B i | 2 . Thus, if U = e iθ B i for some i, then the test will accept with certainty. On the other hand, if min V ∈B D(U, V ) = ǫ, the probability of getting the same measurement outcome twice is Therefore, by repeating the operator basis test and rejecting if any of the individual tests reject, the property of Membership in B can be tested with O(1/ǫ 2 ) uses of U .
A natural operator basis to which this test can be applied is the set of Pauli matrices on n qubits [122,147], which form a basis for the space of linear operators on n qubits. This basis is orthonormal with respect to the Hilbert-Schmidt inner product. We call the corresponding basis for C 2 2n obtained via the Choi-Jamio lkowski isomorphism the Pauli basis. The operator basis test can be immediately applied to test whether an n-qubit operator is proportional to an n-qubit Pauli matrix, or is far from any such matrix; we call this special case the Pauli test. As pointed out in [122], this is a natural quantum generalization of the important classical property of linearity of Boolean functions [33] This implies that the Pauli test can be used to test linearity of Boolean functions, recovering the O(1) complexity of Section 2.1.1.
The Pauli test can also be used as a subroutine in an algorithm for testing membership in the Clifford group. The Clifford group C n on n qubits is the normalizer of the Pauli group P n , or in other words the set {C ∈ U (2 n ) : ∀P ∈ P n , CP C −1 ∈ P n }. The Clifford group plays an important role in many areas of quantum information theory, including quantum error-correction and simulation of quantum circuits [73,124]. Wang [147] has shown that, given access to a unitary U and its inverse U −1 , whether U is a member of the Clifford group can be tested with O(1/ǫ 2 ) uses of U and U −1 ; this result improves a previous test of Low [110] by removing any dependence on n, and can in turn be improved to O(1/ǫ) using amplitude amplification [36].
Wang's test is very natural: pick a Pauli matrix P ∈ P n uniformly at random, and apply the Pauli test to the operator U P U −1 . If U ∈ C n , this test will always accept. Intuitively, if U is far from any Clifford operator, then we expect that for most Pauli operators P , U P U −1 will be far from being a Pauli operator, so repeating this test a constant number of times would suffice to detect this. Making this intuition precise requires some work; see [147] for the details.

Question 9.
Is there an efficient test for the property of membership in the Clifford group which does not require access to U −1 ?

Testing commutativity
Say that U, V ∈ U (d) satisfy the Commuting property if U V = V U . Assuming that we are given access to the controlled operators c-U and c-V , consider the following tester for this property: 1. Create the states |c-U c-V , |c-V c-U by applying controlled-U and controlled-V operations to the first half of each of two maximally entangled states.
2. Apply the swap test to these states and accept if the test accepts.
If U and V commute, then c-U and c-V also commute, so |c-U c-V = |c-V c-U and hence the swap test accepts with certainty. On the other hand, if U V − V U 2 = ǫ, then by (5) the test rejects with probability at least ǫ 2 /8. In order for this to be a good test for commutativity, we therefore need to show that, if U V − V U 2 = ǫ, U and V are close to a pair of unitary operators U , V such that U and V commute. Precisely this result has recently been shown by Glebsky [69] in the form of the following theorem, whose proof we omit.
The consequence is that the above tester rejects pairs (U, V ) such that U and V are ǫ-far from a pair of commuting matrices with probability Ω(ǫ 18 ). By repeating the test poly(1/ǫ) times, we obtain a tester which rejects such pairs with constant probability. Question 10. Is there an efficient test for commutativity which does not require access to the controlled unitaries c-U , c-V , but just uses U and V ?

Testing quantum juntas
Analogously to the classical case of Boolean functions f : {0, 1} n → {0, 1}, a unitary operation on n qubits is said to be a k-junta if it acts non-trivially on at most k of the qubits, or in other words is of the form U S ⊗ I S c , where U ∈ U (2 k ) and S is a k-subset of [n]. Wang [147] has given a tester for whether a unitary operator U is a k-junta, which turns out to be a direct generalization of the tester of Atıcı and Servedio [17] for the classical property of a Boolean function being a k-junta (Section 2.1.3). The work [122] had previously studied a different tester for being a 1-junta ("dictator"), but did not prove correctness. Wang's tester proceeds as follows: 2. Repeat the following procedure T times, for some T to be determined: (a) Create the state |U and measure in the Pauli basis, obtaining outcome s ∈ {I, X, Y, Z} n .

Accept.
To show correctness of this test, it suffices to prove the following claim: Theorem 23 (Wang [147]). If U is ǫ-far from any k-junta, and T = Θ(k/ǫ 2 ), the above procedure accepts with probability at most 1/3. The result originally shown by Wang [147] was a somewhat worse bound of T = Θ(k log(k/ǫ)/ǫ 2 ), but the bound can be improved to Θ(k/ǫ 2 ) via a straightforward generalization of the analysis of Atıcı and Servedio [17], as we now show (cf. Section 2.1.3). If we are given access to U −1 as well, the bound can be improved further to T = Θ(k/ǫ) via amplitude amplification.
Proof. As the Pauli matrices form a basis for the space of n-qubit operators, we can expand where σ s is the n-qubit Pauli operator corresponding to the string s, and U s ∈ C. Pauli matrices are orthonormal with respect to the Hilbert-Schmidt inner product, hence s∈{I,X,Y,Z} n | U s | 2 = 1. Assume that U is ǫ-far from any unitary operator V that is a k-junta, and for s ∈ {I, X, Y, Z} n , let supp s = {i : s i = I}. Then, for any subset W ⊆ [n] of size at most k, To see this, assume the opposite and consider the operator M W = s,supp s⊆W U s σ s . Then D(U, M W ) = (1 − w 2 W ) 1/2 < ǫ/2. M W is clearly a k-junta, but is not necessarily unitary; however, by Lemma 21, there must exist some unitary operator V such that V is a k-junta and D(U, V ) ≤ ǫ, contradicting that U is ǫ-far from any unitary k-junta.
For each measurement, the probability that a string s is returned such that supp s W is therefore at least ǫ 2 /8. Thus the expected number of new indices learned on which U acts nontrivially is at least ǫ 2 /8, so the expected number of measurements required to find k + 1 such indices is at most 8(k + 1)/ǫ 2 . The theorem then follows from Markov's inequality.

Other properties of unitary matrices
We finish this section by mentioning a few other properties of unitary matrices which have fairly straightforward testers. Say that a unitary matrix U satisfies the Diagonality property if U ij = 0 for i = j. Consider the following easy tester for this property: Apply U to a uniformly random computational basis state |i , measure in the computational basis, and accept if and only if the outcome is i. Writing U kk = r k e iγ k for r k ≥ 0 and 0 ≤ θ k < 2π, we have On the other hand, the probability of accepting is precisely Thus, if the test accepts with probability 1 − ǫ, U is distance at most √ 2ǫ from a diagonal unitary matrix D, implying that Diagonality can be tested with O(1/ǫ 2 ) uses of U . This tester is simple, but can be applied to the following more general problem: Given a basis B for C d , is every vector in B an eigenvector of U ? This is equivalent to asking whether V U V −1 is diagonal, where V is the change of basis matrix for B. This problem can be solved by applying the test for diagonality to V U V −1 , noting that the distance of V U V −1 from the nearest diagonal matrix is the same as the distance of U from the nearest matrix U such that every vector in B is an eigenvector of U . For example, this allows us to test U for being a Circulant matrix (i.e., a matrix of the form U xy = f (x − y) for some f :

Properties of quantum channels
Not all physical processes which occur in quantum mechanics are reversible. The mathematical framework in which the most general physically realizable operations are studied is the formalism of quantum channels. A quantum channel (or "superoperator") is a completely positive, tracepreserving linear map E : B(C d in ) → B(C dout ). Here "completely positive" means that the operator E ⊗ id preserves positivity, where id is the identity map on some ancilla system of arbitrary dimension. A comprehensive introduction to the world of quantum channels is provided by lecture notes of Watrous [149].
There has been less work on testing properties of quantum channels than the other categories of property considered above, although the problem of discriminating between quantum channels has been considered by a number of authors (e.g. [138,61,129]).

Distance measures
In the context of property testing, the first task when considering quantum channels is to define a suitable measure of distance. One approach is to use the same idea as for unitary operators, and take the distance induced by the Choi-Jamio lkowski isomorphism [52,95]. In the case of channels, this isomorphism states that there is a bijection between the set of quantum channels E : B(C d in ) → B(C dout ) and the set of bipartite density matrices ρ on a (d out × d in )-dimensional system such that applying the partial trace to the first subsystem of ρ leaves the maximally mixed state I/d in . The bijection can be explicitly given as Then one distance measure that can be put on quantum channels E, F is As with the correspondence between unitary operators and pure states, this distance measure allows one to translate tests for properties of mixed states to properties of channels.
The first inequality holds because the trace norm does not increase under partial trace [124, Theorem 9.2], and the second is (4). Therefore, if the test accepts with probability 1 − δ, implying that Unitarity of a quantum channel can be tested with O(1/ǫ 2 ) uses of the channel.

Testing quantum measurements
An important special case of quantum channels is the case of quantum measurements. In full generality, a measurement on a d-dimensional quantum mechanical system is defined by a sequence of linear operators M = (M 1 , . . . , M k ) such that k i=1 M † i M i = I. If M is performed on the state ρ, the probability of receiving outcome i is tr M i ρM † i , and the resulting state of the system, given that outcome i occurred, is The quantum channel corresponding to performing the measurement M and storing the outcome in a new register is the map M where so the Choi-Jamio lkowski state is which, by reordering subsystems, is equivalent to For any two measurements M and N with at most k outcomes, we can therefore compute the distance between the corresponding channels as where if M (resp. N ) has ℓ < k outcomes, we set M i = 0 (resp. N i = 0) for ℓ < i ≤ k. Observe that, using this measure of distance, we take into account the distance of the post-measurement states as well as the distance between the probability distributions corresponding to the measurement outcomes. One can explicitly calculate that, for any (potentially unnormalized) vectors |ψ , |φ , which implies that Recent work by Wang [148] has given efficient tests for a number of properties of quantum measurements, but with respect to a measure of distance which appears somewhat different to the measure D(·, ·). Given two measurements M and N with at most k outcomes, Wang's distance measure is Wang demonstrates that ∆(·, ·) has a number of desirable properties, including satisfying the triangle inequality and being an "average-case" measure of distance [148]. It turns out that ∆(·, ·) is in fact closely related to D(·, ·), which we encapsulate as the following lemma. Proof. To prove the upper bound part of the lemma, it suffices to show that, for each i, and rearranging terms, we get the claimed inequality which holds because y i ≤ x i by Cauchy-Schwarz. For the lower bound, we need to show By Cauchy-Schwarz, Lemma 24 implies that Wang's results with respect to the distance measure ∆(·, ·) can be translated into results with respect to D(·, ·). In particular, Wang [148] gives efficient testers for the following properties of quantum measurements: • The property of being a Pauli measurement (called "stabilizer measurement" in [148]): M is a Pauli measurement if it is a two-outcome projective measurement onto the ±1 eigenspaces of an n-qubit Pauli operator σ s , for some s ∈ {I, X, Y, Z} n . Wang shows that this property can be tested with O(1/ǫ 4 ) measurements.
• The property of being a k-local measurement of n qubits, i.e., acting non-trivially on at most k qubits. Wang gives a tester for this property which uses O(k log(k/ǫ)/ǫ 2 ) measurements.
• The property of being a Permutation invariant measurement of n d-dimensional systems, i.e., a measurement which is unchanged when the n systems are permuted arbitrarily. This property can be tested with O(1/ǫ 2 ) measurements.
• Being contained within any finite set of measurements S = {M i } with k outcomes on a ddimensional system. If ∆(M i , M j ) ≥ γ for all i = j, and we set δ = min{γ, ǫ}, membership in S can be tested with O(k 2 (log k)/δ 8 + (log |S|)/δ 2 ) measurements.
• Equality of measurements, which can be tested with O(k 5 (log k)/ǫ 12 ) measurements. This is based on a more general algorithm for estimating the distance between measurements.
All of the above testers are based on constructing multiple copies of the Choi-Jamio lkowski state corresponding to the measurement to be tested, and performing some measurements on the states. As remarked in [148], it is an interesting question whether efficient testers can be designed in a setting where one is not allowed access to entanglement. Question 11. Can testers for the properties of unitary operators and quantum channels discussed above be designed which do not require entanglement with an ancilla system?

Quantum properties and computational complexity
A different perspective from which to study the question of testing properties of quantum systems is to consider problems where, instead of being given access to a quantum object, we are given a concise classical description of that object (for example, a quantum circuit on n qubits with poly(n) gates), and aim to determine whether the corresponding quantum object has some property, or is far from having that property. Here we generally assume we have full knowledge of this description, and aim to test the corresponding object for having some property in time polynomial in the size of the description. This type of problem turns out to be naturally addressed via the framework of computational complexity.
A classic and important example is the local Hamiltonian problem. Here we are given as input a Hamiltonian H on n qubits, described by a set of Hermitian operators H i such that H = m i=1 H i , with each operator H i acting non-trivially on at most k = O(1) qubits and satisfying H i = O(1). We are also given two real numbers a and b such that b − a ≥ 1/ poly(n). We are promised that the lowest eigenvalue of H is either smaller than a, or larger than b; our task is to determine which of these is the case.
This problem was proven QMA-complete 12 for k = 5 by Kitaev [101], which was later improved to k = 2 by Kempe et al. [99] (the case where k = 1 is easily seen to be in P). One way in which this hardness result could potentially be improved is in the scaling of the gap between b and a. Indeed, it could be the case that the local Hamiltonian problem remains QMA-hard if we have the promise b − a ≥ cm for some constant 0 < c < 1. This is (one formulation of) the quantum PCP conjecture; see a recent survey of Aharonov et al. [10] for much more on this conjecture and its implications. Classically, one version of the famous PCP Theorem states that there exist constraint satisfaction problems for which it is hard to distinguish between there existing an assignment to the variables that satisfies all of the constraints, and there being no assignment that satisfies more than a constant fraction of them; the quantum PCP conjecture would be a direct quantization of this result. One way of looking at this is as the conjecture that the local Hamiltonian problem remains hard in a "property-testing-type" scenario where there is a large gap between "yes" and "no" instances.

Question 12. Is there a quantum PCP theorem?
Classically, the proof of the PCP Theorem relied on efficient property testers, so it seems plausible that property testing could be useful in proving a quantum generalization. Indeed, the analysis of a classical property tester in a quantum setting has recently been central to establishing a quantum complexity-theoretic result. MIP is the class of languages decided by multiple-prover interactive proof systems, which was shown to be equal to NEXP by Babai et al. [19]. Recently Ito and Vidick [93] have shown that the quantum generalization MIP * , where the provers are allowed to share entanglement, is at least as powerful: MIP ⊆ MIP * . Their proof is based on proving soundness of the classical multilinearity test of Babai et al. [19] in the presence of entanglement. Another application of quantum property testing to quantum complexity is the use of the analysis of an efficient quantum property tester to prove the complexity class equality QMA(k) = QMA(2) [83], as discussed in Section 4.1.2.
Yet another connection is explored in very recent work of Aharonov and Eldar [11] on a quantum generalization of locally testable codes (LTCs). Classically, LTCs are codes for which the property of being a codeword can be tested efficiently by means of a few local checks; such codes played a crucial role in the proof of the PCP Theorem. The "qLTCs" studied in [11] are zero eigenspaces of k-local Hamiltonians H = i H i , such that containment of a state in the eigenspace can be tested with good accuracy by performing measurements corresponding to only a few of the individual k-local terms H i . Aharonov and Eldar [11] prove some surprising upper bounds on the soundness for qLTCs that are stabilizer codes, showing that in some regimes these behave quite differently from classical LTCs.

Properties of quantum circuits
When studied through the prism of computational complexity, many problems related to testing quantum circuits turn out to be QMA-complete (see [34] for a recent survey). These hardness results provide an interesting counterpoint to the largely positive results obtained in the "averagecase" scenarios considered by property testing. A prototypical example of this phenomenon is "non-identity-check," which was proven to be QMA-complete by Janzing et al. [96]. Here the input is a quantum circuit implementing a unitary U , and two numbers a, b such that b − a ≥ 1/ poly(n), and the problem is to distinguish between the two cases that min θ∈R U − e iθ I ≤ a and min θ∈R U − e iθ I ≥ b. Observe that, if we replace the operator norm with the normalized 2-norm in this definition, this problem is in BQP by the efficient tester for the Equality to V property discussed in Section 5.1.3.
If one generalizes to quantum circuits acting on mixed states, where each elementary gate is a quantum channel, some natural problems even become PSPACE-complete. In particular, Rosgen and Watrous [137] showed that this holds for the problem of testing whether two mixed-state quantum circuits are distinguishable, which remains hard when the quantum circuits are restricted to be logarithmic depth [135], degradable or anti-degradable [136]. In this case, distinguishability is measured in the so-called diamond norm for quantum channels [101]; the diamond norm of an linear operator Φ : B(C d in ) → B(C dout ) is defined to be where id is the identity map acting on an ancilla system, which may be taken to be of dimension at most d in . Then the Quantum Circuit Distinguishability problem is to determine, given two mixedstate quantum circuits Q 0 , Q 1 and constants a < b, whether Q 0 − Q 1 ⋄ ≤ a or Q 0 − Q 1 ⋄ ≥ b.
These distinguishability problems were originally shown to be hard for the complexity class QIP of languages decided by quantum interactive proof systems, but this class was later proven to equal PSPACE [94]. The proof technique of [137] starts by using a result of Kitaev and Watrous [102], which states that all quantum interactive proofs can be parallelized to three rounds. A mathematical reformulation of this result is that the Close Images problem is QIP-hard. This problem is defined as follows: given two quantum circuits Q 0 , Q 1 and constants a < b, distinguish between the cases that there is an input ρ such that F (Q 0 (ρ), Q 1 (ρ)) ≥ b, or that for all inputs ρ, F (Q 0 (ρ), Q 1 (ρ)) ≤ a. Hardness of Quantum Circuit Distinguishability is then shown by a reduction from Close Images [137].
On the other hand, recent work by Hayden et al. [85] demonstrates that quantum property testers can be used to prove positive results regarding the complexity of testing properties of quantum circuits. The problem considered by these authors is a variant of the separability-testing problem (cf. Sections 4.1.2 and 4.2). In this variant the input is the description of a mixed-state quantum circuit Q on n qubits, and one considers the output of the circuit as a bipartite state by dividing these qubits into two disjoint sets. The problem is to distinguish between the two cases that: a) the output of Q, when applied to the input |0 n , is close to separable; b) the output is far from separable. Hayden et al. [85] show that this problem can be solved by a quantum interactive proof system with two messages (i.e., a message from verifier to prover, followed by a reply from prover to verifier), and hence sits in the complexity class QIP (2). The protocol is based on the verifier applying the permutation test discussed in Section 4.1.1. In this result "close" and "far" are defined asymmetrically (the former in terms of the trace distance, the latter in terms of the so-called "1-way LOCC" distance); see [85] for details.
Very recently, Milner et al. [119] have generalised this work to give entanglement detection problems which are complete for a variety of quantum complexity classes. Some of these results are based on property testers too; for example, they use the product test of [83] (see Section 4.1.2) to show that testing whether the output of a pure-state quantum circuit is a product state is in BQP.

Conclusion
The goal of property testing is to design efficient algorithms ("testers") to decide whether a given object has a property or is somehow "far" from that property. When the objects that need to be tested are very large, exact algorithms that are also required to work for objects that "almost" have the property become infeasible, and property testing is often the best we can hope for. Classical property testing is by now a very well-developed area, but quantum property testing is just starting out. In this paper we surveyed what is known about this: 1. Quantum testers for classical properties (Section 2).

Quantum testers for quantum properties (Sections 4 and 5).
We hope the overview given here, as well as the open questions mentioned along the way, will give rise to much more research in this area. As well as the properties mentioned previously, there are many other properties which have been of great interest in the classical property testing literature, and whose quantum complexity is unknown. Examples include monotonicity of Boolean functions, membership of error-correcting codes, and almost all properties of graphs. In the case of quantum properties, natural targets include testing whether a unitary operator is implemented by a small circuit, and whether a Hamiltonian is k-local (which would be yet another variant of junta testing).
Another very broad open question not discussed previously is to what extent one could characterize the properties (classical or quantum) that have efficient quantum testers. This may seem a hopelessly ambitious goal; nevertheless, in the case of classical algorithms it has already been achieved in some important cases, such as graph properties [12] and symmetric properties of probability distributions [144]. Such a characterization could have importance far beyond property testing, by shedding light on the structure of problems that have efficient quantum algorithms.