Quantum interactive proofs and the complexity of entanglement detection

,


Introduction
Certain families of decision problems have proven to be particularly versatile and expressive in complexity theory, in the sense that slightly varying their formulation can tune the difficulty of the problems through a wide range of complexity classes. Adding quantifiers to the problem of evaluating a Boolean formula, for example, brings the venerable satisfiability problem up through the levels of the polynomial hierarchy [Sto76] all the way up to PSPACE [Sip96], at each level providing a decision problem complete for the associated complexity class. Moreover, adding limitations to the format of the Boolean satisfiability problem gives decision problems complete for a variety of more limited classes. 1 Likewise, in the domain of interactive proofs [Bab85, GMR85, BM88, GMR89, Wat03, KW00,Wat09a], problems based on distinguishing probability distributions or quantum states, depending on the setting, arise very naturally.
In the domain of quantum information theory, quantum mechanical entanglement is responsible for many of the most surprising and, not coincidentally, useful potential applications of quantum information [HHHH09], including quantum teleportation [BBC + 93], super-dense coding [BW92], enhanced communication capacities [BSST99,BSST02,CLMW10], device-independent quantum key distribution [Eke91,VV12], and communication complexity [CB97]. Thus, deciding whether the correlations in a given state represent true quantum entanglement is a prominent and longstanding question that frequently resurfaces in different forms. The complexity of determining whether a given mixed quantum state is separable or entangled therefore arose early and was resolved: the problem is NP-complete with respect to Cook reductions when the state is specified as a density matrix and one demands an error tolerance no smaller than an inverse polynomial in the dimension of the matrix [Gur03,Gha10].
From a physics or engineering perspective, however, it is often more natural to specify a quantum state as arising from a sequence of specified operations or the application of a local Hamiltonian. This formulation of the quantum separability problem is more general and solving it is more difficult: it is known to be hard for the complexity class quantum statistical zero-knowledge (QSZK) as well as NP-hard with respect to Cook reductions, while lying inside the class QIP(2) of promise problems decidable by a two-message quantum interactive proof system [HMW13].
In this paper we explore several variations on the complexity of determining whether or not a state specified by a quantum circuit is entangled. We vary, for example, whether we allow general mixed states or restrict to pure states. We also compare the difficulty of deciding whether entanglement is present (separable versus entangled states) with the difficulty of identifying any correlation whatsoever (product versus non-product states). One of the most subtle and interesting variations is to alter the metric used to measure distance between quantum states: we show that the complexity of detecting entanglement produced by an isometry is either QMA(2)-complete or QMA-complete according to whether one measures distance using the familiar trace distance or the more forgiving "one-way LOCC" distance of Ref. [MWW09].
We consider all problems in terms of general multipartite states, though only bipartite states are required for the hardness results-this indicates that in general, detecting multipartite entanglement or correlation may be no more difficult than the detection of bipartite entanglement or correlation. We also consider these problems for quantum channels, asking whether there exists an input to the channel with the specified properties. In most cases, the resulting problem proves to be complete for a complexity class of quantum interactive proofs, providing characterizations of BQP, QMA, QMA(2), and QSZK [Wat09a]. (We will define these classes below for those unfamiliar with them.) 2 Overview of Results Figure 1 provides a concise summary of our results. Refer to this table for a brief description of the promise problems. Below we give more details of our results along with their relation to prior results in the literature: • QPROD-PURE-STATE is complete for the class BQP for any inverse polynomial gap in completeness and soundness parameters, as stated in Theorem 10. We demonstrate that this problem is in BQP by employing the "product test" introduced in [MCKB05] along with the analysis of its success probability from [HM10]. We also provide a simple reduction of a general BQP quantum circuit to the problem of pure-state entanglement detection.
• QSEP-ISOMETRY 1,1-LOCC is complete for the class QMA for any inverse polynomial gap in completeness and soundness parameters. We show that this problem is in QMA by building Problem Summary Complexity Circuit

QPROD-PURE-STATE
Is the state generated by the pure-state quantum circuit close to a product state?

QSEP-ISOMETRY 1,1-LOCC
Is there an input to the isometry such that the output is close to a separable state in the trace distance, or does every input lead to an output that is far from separable in 1-LOCC distance?

QPROD-ISOMETRY QSEP-ISOMETRY
Is there an input to the isometry such that the output is close to a product/separable state?

QMA(2)-complete QPROD-STATE
Is the state generated by the mixed-state circuit close to a product state?
QSEP-STATE 1,1-LOCC Is the state generated by the mixed-state circuit close to a separable state?
In QIP(2), QSZKhard, NP-hard QSEP-CHANNEL 1,1-LOCC Is there an input to the channel such that the output is close to a separable state in trace distance or does every input lead to an output that is far from separable in 1-LOCC distance?
Channel Input Figure 1: The collected results of entanglement detection problems and their complexity. The leftmost column gives the name of the promise problem. Problem names subscripted with "1, 1-LOCC" indicate that the distance measure for yes-instances is the trace distance while the distance measure for no-instances is the one-way LOCC distance. The second column gives a question to which the problem corresponds. The third column states our complexity-theoretic characterization of the problem. The final column depicts a quantum circuit corresponding to the promise problems.
(Some of us used a similar approach in previous work to place QSEP-STATE 1,1-LOCC in QIP(2) [HMW13].
2 ) The QMA proof system requires the prover to provide: 1) a quantum input to the isometry such that the output is close to some product state |ψ A ⊗|φ B and 2) k copies of |φ B . The verifier then checks whether the prover is being honest by performing phase estimation over the symmetric group on all of the B systems [Kit95] (also called the "permutation test" [BBD + 97, KNY08]). This proof system extends naturally to the multipartite case as well. We prove QMA-hardness of QSEP-ISOMETRY 1,1-LOCC by reusing the BQP reduction technique mentioned above.
• QPROD-ISOMETRY and QSEP-ISOMETRY are complete for the class QMA(2) for any inverse polynomial gap in completeness and soundness parameters. We give a QMA(2) proof system in which the verifier performs the product test mentioned above, and we can employ the QMA(k)amplification results of Harrow and Montanaro to reduce the completeness and soundness errors to become negligible [HM10]. We then show that these problems are QMA(2)-hard by reducing a general QMA(2) verifier circuit to one for which the output can be made product if and only if there exist two product inputs that would cause the verifier to accept the output of the original general QMA(2) circuit.
• QPROD-STATE is complete for the class QSZK for a wide range of completeness and soundness parameters. This problem differs from the BQP-complete problem QPROD-PURE-STATE in that it allows for a mixed-state quantum circuit to generate the state rather than a unitary circuit. We show that QPROD-STATE is in QSZK by specifying a statistical zero-knowledge proof system that decides it, and we show QSZK-hardness by giving a reduction from the QSZKcomplete promise problem QUANTUM-STATE-DISTINGUISHABILITY [Wat02, Wat09b] to QPROD-STATE.
• QSEP-STATE 1,1-LOCC is in the class SQG-a class introduced in [GW05] and shown to be equal to PSPACE in [GW13]. Some of us have shown in prior work that QSEP-STATE 1,1-LOCC is in QIP(2) [HMW13], which is already known to be contained in SQG and is believed to be a strict subset of it. 3 Thus, this new bound is not a complexity-theoretic improvement over prior work.
However, it is interesting that QSEP-STATE 1,1-LOCC can be decided by a very natural protocol with only a single message from the prover-a witness-provided that the verifier is granted the additional ability to query a second, competing prover in his effort to check the veracity of the first prover's purported witness. By contrast, the two-message single-prover quantum interactive proof for QSEP-STATE 1,1-LOCC of Ref. [HMW13] depends critically upon the ability of the verifier to exchange two messages with the prover.
The contributions of the present paper along with those in [HMW13] give a variety of entanglement or correlation detection promise problems that are complete for BQP, QMA, QMA(2), QSZK, and QIP, along with a problem that is in QIP(2). The present paper is structured around this hierarchy of correlation detection problems, beginning with preliminary concepts related to quantum information and the quantum interactive proof hierarchy. In the subsequent sections, we give detailed definitions and justify our aforementioned claims that these various entanglement and correlation detection problems are in one-to-one correspondence with BQP, QMA, QMA(2) and QSZK. For completeness, Section 9 reviews the results presented in [HMW13]. In Section 10, we briefly mention how our various proof systems provide operational interpretations for several geometric measures of entanglement (see Refs. [WG03,CAH13] and references therein). Finally, we conclude in Section 11 with a summary of our results and a discussion of directions for future research.

Preliminaries
In this section, we review concepts and complexity classes that will be used throughout the paper, though general background knowledge of both quantum information theory and quantum computational complexity theory is assumed. For more in depth overviews of these fields, consult [NC00,Wil11,Wil13] and [Wat09a,Aar13], respectively.

Distance measures
A quantum state is a positive semidefinite, unit-trace operator (referred to as the density operator) acting on some Hilbert space H. Let D(H) denote the set of density operators acting on a Hilbert space H.
One distance measure often used in quantum information theory to quantify the distance between quantum states is the trace distance, induced by the trace norm. The trace norm of an The trace distance has an important operational interpretation as the bias in distinguishing two states ρ and σ, each elements of D(H), so that the maximum probability p succ of successfully discriminating them is given by A variational characterization of the trace distance is as follows: where the measurement {Λ, I − Λ} that achieves this maximum is known as the Helstrom measurement [Hel69,Hol72,Hel76]. This also leads to the following useful inequality that holds for all Γ such that 0 ≤ Γ ≤ I: The quantum fidelity F (ρ, σ) between two quantum states ρ and σ is another measure of distinguishability, defined as follows: Uhlmann proved that the fidelity is the optimal squared overlap between any two purifications of ρ and σ [Uhl76]: Uhlmann's characterization gives the fidelity an operational interpretation as the optimal probability with which a purification of ρ would pass a test for being a purification of σ. Since all purifications are related by unitary transformations acting on the purifying system, it follows that for any fixed purifications |φ ρ and |φ σ of ρ and σ, respectively. The equivalence between (2) and (3) is commonly known as Uhlmann's theorem. The fidelity and trace distance for general states are related by the Fuchs-van-de-Graaf inequalities [FvdG99]: with the following equality holding for pure states The final relevant distance measure that we require is based on the maximum distinguishability of two states when restricting to local operations and one-way classical communication between the systems of the two states. This distance measure is known as the one-way LOCC distance (1-LOCC), induced by a 1-LOCC norm [MWW09]: for two bipartite states ρ AB , σ AB ∈ D(H A ⊗ H B ) and where the maximization on the RHS is over all quantum-to-classical channels with Λ x ≥ 0 for all x ∈ X , x∈X Λ x = I, and {|x } some orthonormal basis. (Note that we could also define the 1-LOCC distance with respect to measurement maps on the A systems, which generally gives a different value). This distance is the natural distance measure in the setting of Bell experiments [Bel64] or quantum teleportation. It is also clear from the definitions that because a 1-LOCC protocol to distinguish states cannot do any better than a general protocol. The 1-LOCC distance measure has been extended to multipartite quantum states in [LW12,BaC12,BaH13]. On an l-partite system, the l-partite 1-LOCC distance is given by where each of Λ 2 , . . . , Λ l are quantum-to-classical channels. The interpretation here is that the last l − 1 parties each perform a local measurement on their system and communicate the results to the first party, who then does her best to distinguish the two states.

Separability and k-extendibility
A multipartite state ρ A 1 ···A l ∈ H A 1 ⊗ · · · ⊗ H A l is said to be separable if it admits a decomposition of the following form: for collections {σ 1,y A 1 }, . . . , {σ l,y A l } of quantum states and some probability distribution p Y (y) over an alphabet Y [Wer89b]. By applying the spectral theorem to each density operator, we can always find a decomposition of any separable state in terms of pure product states: States which cannot be written in this form are entangled. Let S denote the set of separable states. Throughout this work we refer to states in S as states that are separable across all named systems unless a specific cut is indicated. States of the form σ 1 A 1 ⊗· · ·⊗σ l A l (such that the distribution p Y (y) in (8) is degenerate) are known as product states. Let P denote the set of product states. P is not a convex set, and the convex closure of P is the set S. Operationally, product states are those that are completely uncorrelated between systems and so can be prepared on systems in complete isolation, while separable states can be prepared by means of classical communication between the systems. Furthermore, the correlation exhibited in separable states may be simulated by classical systems in a non-locality, Bell-like test [Wer89b].
Separability has a close connection with the notion of k-extendibility.
2. The state ω AB 1 ···B k is invariant under permutations of the systems B 1 through B k . That is, where S k is the symmetric group on k elements and W π B 1 ···B k is a unitary transformation that implements the permutation π on the B systems.
3. The state ω AB 1 ···B k is an extension of ρ AB : Let E k denote the set of k-extendible states. Every separable state is k-extendible for all k ≥ 2, because the following state On the other hand, if a state is not separable, there always exists some k for which the state is not k-extendible, and furthermore, for every l > k, the state is also not l-extendible [DPS02,DPS04]. This forms a hierarchy of approximations to the set of separable states, becoming exact in the limit as k → ∞.
The bipartite notion of k-extendibility has been further expanded in [DPS05,BaH13] to multipartite states, which requires that every system is extendible according to the conditions above. Specifically, a multipartite state ρ C ∈ D(H A 1 ⊗ · · · ⊗ H A l ) (we abbreviate the combined systems A 1 · · · A l as C for simplicity) is k-extendible if there exists a state ω C 1 ···C k ∈ D(H C 1 ⊗ · · · ⊗ H C k ) such that 1. Each Hilbert space H C i,j is isomorphic to H A j for all i ∈ {1, . . . , k} and j ∈ {1, . . . , l}, where the notation C i,j refers to the j th subsystem of C i .
2. For all parties j ∈ {1, . . . , l}, the state ω CC 2 ···C k is invariant under permutations of the systems C 1,j through C k,j . Note that there are l · k! such permutations.
3. The state ω CC 2 ···C k is an extension of ρ C : The following lemma is essential for some of our quantum interactive proof systems and expands Theorem 2 of [BaH13] to establish a notion of approximate k-extendibility. The proof of Lemma 1 is straightforward and can be found in Appendix A.1.
Lemma 1 Let ρ A 1 ···A l be ε-far in one-way LOCC distance from the set of fully separable states, for some ε > 0: min Then the state ρ A 1 ···A l is δ-far in trace distance from the set of k-extendible states: for δ < ε and where

Quantum interactive proofs
We now formally introduce the quantum interactive proof complexity classes that are relevant to this work. Quantum interactive proof systems involve multiple parties who exchange quantum information: a verifier who has access to a computationally bounded quantum computer and one or more untrustworthy provers who have access to powerful quantum computers bounded only by the laws of quantum mechanics (these provers can perform any unitary operation). The verifier aims to decide whether one of two promises is true-he can receive help from the provers by exchanging quantum messages with them, but he must perform tests to make sure that the provers are not trying to fool him. QMA(2) and SQG are the only multi-prover quantum interactive proof complexity classes that we consider in this work. All others that we consider (BQP, QMA, QIP(2), QIP(3), and QSZK) have just one prover.

BQP
The least powerful class within the quantum interactive proof hierarchy consists of a verifier who does not exchange any quantum messages with a prover. Bounded error quantum polynomial time (BQP) includes all promise problems that can be decided by a quantum verifier in polynomial time, and it is the most natural quantum extension of BPP and P, the classical probabilistic and deterministic verifier regimes, respectively. (The term verifier is used for consistency with what follows. However, in this case, there is no proof being verified-the verifier is simply working on his own.) Definition 2 (BQP) Let A = (A yes , A no ) be a promise problem, and let c, s : N → [0, 1] be polynomial-time computable functions such that the gap c − s is at least an inverse polynomial in the input length. Then A ∈ BQP(c, s) if there exists a polynomial-time generated family of circuits U = {U n : n ∈ N} that satisfies the following properties: 1. Completeness: For all input strings x ∈ A yes , the probability of acceptance is at least c(|x|).

Soundness
: For all input strings x ∈ A no , the probability of acceptance is at most s(|x|).

QMA
Giving the verifier access to a quantum proof, also called a quantum witness state, seems to greatly expand the set of problems that the verifier can decide in polynomial time. This class is known as Quantum Merlin-Arthur (QMA) [Kit99,Wat00], after the analogous probabilistic verifier class, Merlin-Arthur (MA), in which a computationally bounded verifier (Arthur) wishes to solve a problem with the help of a computationally unbounded but potentially dishonest prover (Merlin). This class is the most natural fully quantum extension of the famous deterministic class NP.
Definition 3 (QMA) Let A = (A yes , A no ) be a promise problem, and let c, s : N → [0, 1] be polynomial-time computable functions such that the gap c − s is at least an inverse polynomial in the input length. Then A ∈ QMA(c, s) if there exists a polynomial-time generated family of circuits U = {U n : n ∈ N} that satisfies the following properties: 1. Completeness: For all input strings x ∈ A yes , there exists a witness state on a polynomial number of qubits such that the probability of acceptance is at least c(|x|).

Soundness: For all input strings
x ∈ A no and all witness states, the probability of acceptance is at most s(|x|).
Note that it suffices for the prover to provide a pure quantum witness state rather than a mixed one. By a simple convexity argument, one can see that for every mixed quantum witness state there exists a pure quantum witness state which has an acceptance probability that is only larger than or equal to that for the mixed witness state.
It is conventional to define QMA = QMA(2/3, 1/3), but note that, as in the case of BQP, one can amplify the gap between c and s such that they become exponentially close to their extremes and thus QMA = QMA(1 − 2 −p(n) , 2 −p(n) ) for any polynomial function p(n). To obtain this result, one can exploit the QMA amplification technique of Marriott and Watrous in [MW05] or the more recent fast amplification procedure of Nagaj et al. in [NWZ09].

QMA(2)
Although we organize the quantum interactive proof hierarchy according to the number of interactions between the prover and verifier, we can also consider a natural extension of QMA in which the verifier has access to unentangled quantum proofs from multiple quantum provers. It is clear that entanglement is a powerful tool in quantum information, and the ways in which the prover can fool the verifier in QMA are directly related to his ability to entangle the witness state. The class QMA(k) consists of all promise problems that can be decided with the help of k unentangled quantum witness states.
Definition 4 (QMA(k)) Let A = (A yes , A no ) be a promise problem, and let c, s : N → [0, 1] be polynomial-time computable functions such that the gap c−s is at least an inverse polynomial in the input length. Then A ∈ QMA(k, c, s) if there exists a polynomial-time generated family of circuits U = {U n : n ∈ N} that satisfies the following properties: 1. Completeness: For all input strings x ∈ A yes , there exist k unentangled quantum witness states on a polynomial number of qubits each, such that the probability of acceptance is at least c(|x|).

Soundness: For all input strings
x ∈ A no and all possible witness states, the probability of acceptance is at most s(|x|).
Note that allowing classical communication between the provers does not change this complexity class. Indeed, by coordinating with classical communication, they could prepare a separable state to send to the verifier. However, it suffices for the provers to provide a pure, product quantum witness state rather than a mixed separable state. Again, by a simple convexity argument and the decomposition in (9), one can see that for every separable quantum witness state there exists a pure product quantum witness state which has an acceptance probability that is only larger than or equal to that for the separable state. So classical communication does not help them to cheat.
This family of classes was originally defined in [KMY01]. We define QMA(k) = QMA(k, 2/3, 1/3), though Harrow and Montanaro recently showed in [HM10] that QMA(k) = QMA(2) for k no larger than a polynomial in the input length, and further that QMA(2) = QMA(2, 1 − 2 −p(n) , 2 −p(n) ) for any polynomial function p(n). It remains unclear exactly how powerful QMA(2) is in relation to the single-prover quantum interactive proof hierarchy, but there is evidence that the guarantee of unentangled proofs is a very powerful resource [ABD + 09]. Estimating the minimum energy of a sparse Hamiltonian over all bipartite product states is a non-trivial promise problem that is complete for QMA(2) [CS12]. The present paper gives another non-trivial promise problem that is complete for QMA(2).

QIP(m)
We now formally define the family of classes that constitute the quantum interactive proof hierarchy. The class QIP(m) is defined as the class of problems that a verifier can decide if he is allowed to exchange at most m messages with the prover, and it is analogous to the class IP(m) in the classical probabilistic verifier regime.
Definition 5 (QIP) Let A = (A yes , A no ) be a promise problem, and let c, s : N → [0, 1] be polynomial-time computable functions such that the gap c − s is at least an inverse polynomial in the input length. Let m be a positive integer no larger than a polynomial in the input length. Then A ∈ QIP(m, c, s) if there exists an m-message quantum interactive proof system with the following properties: 1. Completeness: For all input strings x ∈ A yes , there exists a prover that causes the verifier to accept with probability at least c(|x|).
2. Soundness: For all input strings x ∈ A no , every prover causes the verifier to accept with probability at most s(|x|).
We also note that any promise problem in BQP and QMA can be decided by a quantum interactive proof system, as QIP(0) = BQP and QIP(1) = QMA. This gives rise to a four-level quantum interactive proof hierarchy, ranging from the verifier alone to a verifier who exchanges no more than three messages with the prover. This hierarchy is shown in Figure 2 along with related classes. For more information about properties of QIP(2) and QIP(3) useful in the analysis of QSEP-STATE 1,1-LOCC and QSEP-CHANNEL 1,1-LOCC , refer to Section 3.4 of [HMW13], as they are not directly applicable in our work here.

QSZK
Classical zero-knowledge proof systems were first considered by Goldwasser et al. in the same paper that introduced the classical interactive proof hierarchy [GMR89]. In their work they also introduced knowledge complexity as a measure of the amount of knowledge that the prover must transfer to the verifier in order to convince him of the truth of some statement. An interactive proof system for a language is said to be zero-knowledge if for every x ∈ A yes , the prover can convince the verifier to accept without the verifier learning anything that he could not have computed himself. In statistical zero knowledge, this means that in a YES instance, the interaction with the prover has to be below some constant in trace distance (traditionally 1/10) to a distribution corresponding to a computation that the verifier could have performed himself.
Quantum statistical zero-knowledge extends this definition to apply to a quantum interactive proof system instead [Wat02,Wat09b], with the requirement being that in a YES instance a computationally bounded quantum computer could simulate the verifier's state at any point to within some constant trace distance.
Definition 6 (QSZK) A promise problem A = (A yes , A no ) is in QSZK(c, s) if there exists a statistical zero-knowledge quantum interactive proof system that satisfies the following properties: 1. Completeness: For all input strings x ∈ A yes , the prover can convince the verifier to accept with probability at least c(|x|). A line denotes inclusion of the lower class in the higher class. For example, P is a subset of NP. Classes for which there is an entanglement detection problem proven to be complete are in bold type.
2. Soundness: For all input strings x ∈ A no , the prover can convince the verifier to accept with probability at most s(|x|).

SQG
After considering quantum interactive proofs with a single prover, it is natural to consider some variations on that theme. Short quantum games are one such variation in which two provers compete with each other. One prover-the yes-prover -attempts to convince the verifier to accept while the other prover-the no-prover -attempts to convince the verifier to reject. A short quantum game is a very restricted protocol of the following form: Figure 3: Quantum circuit for a short quantum game. The yes-prover first sends a quantum message to the verifier, and the verifier performs some check (a unitary operation) on the transmitted quantum state. The verifier then sends a quantum message to the no-prover. The no-prover responds, and the verifier finally performs a unitary and a measurement to decide whether to accept or reject.
1. The verifier receives a single message from the yes-prover.
2. After processing the message from the yes-prover, the verifier prepares a message for the no-prover.
3. The no-prover replies to the verifier. After processing this response, the verifier decides whether to accept or reject.
A graphical depiction of a short quantum game is given in Figure 3. Short quantum games were first studied in [GW05], and the associated complexity class SQG was shown to collapse to PSPACE in [GW13].
Definition 8 (SQG) Let A = (A yes , A no ) be a promise problem, and let c, s : N → [0, 1] be polynomial-time computable functions. Then A ∈ SQG(c, s) if there exists a verifier for a short quantum game satisfying the following properties: 1. Completeness: There exists a yes-prover such that, for all no-provers and for all input strings x ∈ A yes , the yes-prover convinces the verifier to accept with probability at least c(|x|).
2. Soundness: There exists a no-prover such that, for all yes-provers and for all input strings x ∈ A no , the no-prover convinces the verifier to reject with probability at least 1 − s(|x|).
Every other complexity class discussed in this section is known to be robust with respect to the choice of completeness and soundness parameters c, s, meaning that any protocol for which c is larger than s plus an inverse polynomial in the input length can be amplified into a new protocol with c exponentially close to one and s exponentially close to zero. However, the class SQG is not known to have such a property. Only a partial, "one-sided" amplification result is known, whereby (c, s) can be amplified if c is already exponentially close to one or s is already exponentially close to zero [GW05]. It is an interesting open question whether the "logical-AND-of-majorities" error reduction technique [JUW09] for two-message quantum interactive proofs can be adapted to the competing provers setting.

QPROD-PURE-STATE is BQP-Complete
We begin with the simplest of our entanglement detection promise problems, that of determining if a quantum circuit generates a state close to a product state, in order to set the stage for the problems in the upcoming sections. Unlike the problems in the subsequent sections, the analysis of QPROD-PURE-STATE does not require the help of a prover, and as such, it is a straightforward application of the prior results of Harrow and Montanaro [HM10] combined with a reduction from a general BQP circuit.
Problem 9 (QPROD-PURE-STATE(δ c , δ s )) Given is a description of a quantum circuit to generate the n-qubit pure state |ψ A 1 ···A l , along with a labeling of the output qubits for systems A 1 , . . . , A l . Decide whether 1. Yes: There is a product state |φ 1 A 1 ⊗· · ·⊗|φ l A l that is δ c -close to |ψ A 1 ···A l in trace distance: 2. No: Every product state is at least δ s -far from |ψ A 1 ···A l in trace distance: Theorem 10 QPROD-PURE-STATE(δ c , δ s ) is BQP-complete if there are polynomial-time computable functions δ c , δ s : N → [0, 1] such that the difference 11 2048 δ 2 s − 1 2 δ 2 c is larger than an inverse polynomial in the circuit size.
Proof. We first show that QPROD-PURE-STATE(δ c , δ s ) ∈ BQP. The BQP algorithm for deciding QPROD-PURE-STATE(δ c , δ s ) is to generate two copies of the state |ψ A 1 ···A l by running the circuit twice, then to perform SWAP tests over each of the pairs of l systems separately, and to accept if and only if all SWAP tests pass. This procedure is known as the product test [MCKB05,HM10].
The promise in (11) implies that Harrow and Montanaro have determined bounds on the success probability of the product test in Theorem 1 of [HM10]. The verifier accepts if every swap test passes, the probability of which is no smaller than 1 − δ 2 c 2 in a YES case, while in a NO case the probability of every swap test passing is no larger than 1 − 11δ 2 s 2048 . Thus, so long as 11 2048 δ 2 s − 1 2 δ 2 c is larger than an inverse polynomial in the circuit size, repetition of this procedure no more than a polynomial number of times is sufficient to place the problem in BQP.
We now show that QPROD-PURE-STATE is BQP-hard. Let U denote a quantum circuit for an arbitrary promise problem in BQP acting on p(n) qubits with completeness and soundness error each less than ε, where the decision to accept or reject is based on a measurement of one of the output qubits (the decision qubit) in the computational basis.
We reduce this circuit to QPROD-PURE-STATE by appending three qubits in the state |0 A 1 |Φ + to the output of the BQP circuit U . We perform a bit flip on the decision qubit and a controlled-SWAP from the decision qubit to the qubits in systems A 1 and A 2 . The resulting state is as follows: where |φ DG denotes the state U |0 ⊗p(n) . This reduction is shown in Figure 4. We could then feed the result of this computation into an instance of QPROD-PURE-STATE and use an algorithm that decides QPROD-PURE-STATE to determine whether the state is product (or close to product) with respect to the bipartite cut DGA 1 : A 2 A 3 . Given an arbitrary problem in BQP with completeness and soundness error ε, then in a YES instance the following acceptance probability is high: (|1 1| D ⊗ I G )|φ DG 2 2 ≥ 1 − ε. Thus, after performing the additional steps mentioned above, the resulting state |ψ DGA 1 A 2 A 3 has a high fidelity with By the Fuchs-van-de-Graaf inequalities, it then follows that so that the state is approximately product with respect to the bipartite cut DGA 1 : A 2 A 3 , and thus min |ζ ,|θ So a YES instance of any promise problem in BQP reduces to a YES instance of QPROD-PURE-STATE.
On the other hand, in the case of a NO instance, the following rejection probability is high: Thus, after performing the additional steps mentioned above, the resulting state |ψ DGA 1 A 2 A 3 has a high overlap with Since the first state is pure, the fidelity takes the special form and it is clear that a pure product state optimizes (14). Furthermore, it is clear that we can take the state σ on the systems DG and A 2 to be |φ DG |0 A 2 since this state is product with respect to the cut DGA 1 : A 2 A 3 . We find that (14) is equal to where the equality follows from [Wat04]. Exploiting the Fuchs-van-de-Graaf inequalities once again, we find that Using the triangle inequality, we end up with min |ζ ,|θ so that a NO instance of any promise problem in BQP reduces to a NO instance of QPROD-PURE-STATE. Since the gap between the lower bound in (15) and the upper bound in (13) is equal to a positive constant 1/2−4 √ 2ε for small enough ε, it follows that QPROD-PURE-STATE is BQP-hard.
5 QSEP-ISOMETRY 1,1-LOCC is QMA-Complete In this section, we give a proof of the QMA-completeness of QSEP-ISOMETRY 1,1-LOCC , the problem of determining if an isometry can generate a state close to some separable state in the trace distance or if all inputs to the isometry lead to a state far from all separable states in the one-way LOCC distance. There are many other problems known to be QMA-complete, including the problem of testing whether a quantum channel (specified by a mixed-state quantum circuit) is not close to an isometry [Ros11], estimating the ground state of a k-local Hamiltonian [KKR06,KŠV02] and many more (see [Boo12] for an overview). Nonetheless, it is of interest to note that this problem is QMA-complete when the soundness condition is defined in terms of the one-way LOCC distance, in comparison to the result in the subsequent section that QSEP-ISOMETRY, which is defined in terms of the trace distance when there are no subscripts, is QMA(2)-complete.
Problem 11 (QSEP-ISOMETRY 1,1-LOCC (δ c , δ s )) Given is a description of a quantum circuit to implement a unitary U acting on an n-qubit input and m ancilla qubits, as well as a labeling of the systems A 1 , . . . , A l . Decide whether 1. Yes: There is an input ρ S such that the output of U is δ c -close in trace distance to a separable state: min 2. No: For all inputs ρ S , the output of U is at least δ s -far in 1-LOCC distance from a separable state: min Theorem 12 QSEP-ISOMETRY 1,1-LOCC (δ c , δ s ) is QMA-complete if there are polynomial-time computable functions δ c , δ s : N → [0, 1] such that the difference δ 2 s /8 − 4 √ δ c is larger than an inverse polynomial in the circuit size.
Proof. We first show that QSEP-ISOMETRY 1,1-LOCC (δ c , δ s ) ∈ QMA by adapting the k-extension testing method from [HMW13]. First, note that by Lemma 26 in Appendix A.2, the condition in (16) implies the existence of pure states |ψ , |φ 1 , . . . , |φ l such that In a YES instance, the prover can provide the state |ψ and k copies of the states |φ 1 ,. . . ,|φ l to the verifier. The verifier then runs U on |ψ S ⊗|0 ⊗m to generate a state close to |φ 1 A 1 ⊗· · ·⊗|φ l A l and performs a permutation test over all copies on each of the systems (see Section 8 of [HMW13] for details of the permutation test). The promise in (16) implies that the permutation test will succeed with probability at least 1 − 4 √ δ c for any k. This follows from applying (1) to (18). In a NO instance, we can employ the promise in (17) and Lemma 1 by requiring k to be larger than in order to guarantee that for δ s strictly less than δ s , which can be enforced by setting δ s = δ s / √ 2. By an analysis similar to that in Section 8 of [HMW13], we find the following bound on the probability that the permutation test succeeds: max Note that l cannot be larger than the total number of qubits acted upon, and thus the promise that δ 2 s /8 − 4 √ δ c is larger than an inverse polynomial is sufficient to place the problem in QMA.
The QMA-hardness of QSEP-ISOMETRY 1,1-LOCC follows similarly to how we proved BQPhardness of QPROD-PURE-STATE, by swapping a Bell state across the output systems controlled on the decision qubit being equal to |0 . This reduction is shown in Figure 5. This reduction creates a unitary for which the analysis in a YES instance proceeds identically to the analysis in Section 4, so that a YES instance of a general QMA problem becomes a YES instance of QSEP-ISOMETRY 1,1-LOCC with δ c = 2 √ 2ε. In a NO instance, we wish to show that the one-way LOCC distance from the output of the circuit in Figure 5 to the nearest separable state is larger than an appropriate constant. To show this, we proceed by using the A 1 and A 3 systems in the CHSH game (a reformulation of a Bell experiment as a nonlocal game [CHTW04]), so that we can distinguish the output of the circuit from all separable states by means of a one-way LOCC protocol. In such a protocol, we imagine that Alice has system A 1 and flips a coin x to choose one of two binary-outcome measurements to perform on her qubit. She sends both x and the measurement outcome a to Bob who we imagine has system A 3 . Bob then flips a coin y and performs one of two binary outcome measurements on his qubit, naming the measurement result b. Bob declares the state to be a Bell state in the case that x ∧ y = a ⊕ b and otherwise declares that it is not. It is well known that the probability of winning such a game with a Bell state is equal to cos 2 (π/8) ≈ 0.85, while the maximum probability of winning such a game with any separable state is equal to 0.75 [CHTW04]. From this, we can easily lower bound the one-way LOCC distance of the final state from the reduction: where V denotes the transformation realized by U and the controlled-SWAP and 1 − ε is a lower bound on the fidelity between the state of the decision qubit and |0 as in the BQP reduction. The second inequality follows from the fact that the fidelity of V (ρ S ⊗|0 0| ⊗m )V † with Φ + over the A 1 : A 3 system is equal to the fidelity of the decision qubit with |0 (due to the controlled swap). After the reduction, then, this becomes an instance of QSEP-ISOMETRY 1,1-LOCC with δ s = 0.2 − 2 √ ε. Thus, as long as ε is small enough (so that 0.2 − (2 + 2 √ 2) √ ε > 0), there is an appropriate gap between the completeness and soundness errors, and QSEP-ISOMETRY 1,1-LOCC is thus QMA-hard.

QPROD-ISOMETRY and QSEP-ISOMETRY are QMA(2)-Complete
In this section, we show that QPROD-ISOMETRY, the problem of determining if an isometry can produce a state close to a product state (in the trace distance), is QMA(2)-complete. We also demonstrate that it is equivalent to the problem QSEP-ISOMETRY, the trace distance version of QSEP-ISOMETRY 1,1-LOCC from the previous section. It is clear that being able to detect productness in the trace distance is of considerable use; for one, it allows a verifier to force two unentangled provers to simulate k unentangled provers as shown in the proof that QMA(2) = QMA(k) [HM10]. It seems intuitive then that these problems in the trace distance can neatly capture the power of "unentanglement," an intuition that we make precise in what follows.
Problem 13 (QPROD-ISOMETRY(δ c , δ s )) Given is a description of a quantum circuit to implement a unitary U acting on an n-qubit input and m ancilla qubits, as well as a labeling of the systems A 1 , . . . , A l . Decide whether 1. Yes: There is an input ρ such that the output of U is δ c -close in trace distance to a product state: min 2. No: For all inputs ρ, the output of U is at least δ s -far in trace distance from a product state: Theorem 14 QPROD-ISOMETRY(δ c , δ s ) is QMA(2)-complete if there are polynomial-time computable functions δ c , δ s : N → [0, 1] such that the difference 11δ 2 s 4096 − 8δ c is larger than an inverse polynomial in the circuit size.
Proof. We first show that QPROD-ISOMETRY is in QMA(l + 1), from which it follows by [HM10] that it is in QMA(2). Our proof system has l + 1 provers send the minimizing input and each part of the minimizing product state, followed by the verifier performing the unitary U on the input and then the product test on the provided product state.
Let ω A 1 ···A l denote the state that results after the verifier performs the unitary U on the input ρ S received from the first prover, and let σ A 1 ···A l denote the product state received from the other l provers. Lemma 2 of [HM10] establishes the following formula for the success probability of the product test: In particular, it is clear by a convexity argument that it is optimal for the last l provers to send pure quantum states to the verifier. That is, for every set of mixed states that they could send, there exists a set of pure states that gives the same or higher probability of passing the product test. So we can assume without loss of generality that the last l provers send pure states. We now analyze the YES instance. By Lemma 26, the condition in (19) implies that there exist pure states ψ, φ 1 , . . . , φ l such that Thus, in a YES instance, the l + 1 provers can provide the states ψ, φ 1 , . . . , φ l , respectively, so that running the product test between U (ψ ⊗ |0 0| ⊗m )U † and φ 1 ⊗ · · · ⊗ φ l will succeed with probability no smaller than 1 − 8δ c . We now analyze the NO instance. The promise in (20) then gives the following upper bound on δ s : The second inequality is an application of the Fuchs-van-de-Graaf inequalities. The third inequality The final inequality follows from a convexity argument (for every set of mixed states, there is a set of pure states that can achieve the same or higher value, so that it suffices to maximize over pure states). We can rewrite the above bound as follows: By Theorem 1 of [HM10], we can then conclude that the probability of the product test succeeding is no greater than 1 − 11δ 2 s 4096 . Thus, the promise in Theorem 14 is sufficient for the verifier to decide this instance. We have now placed QPROD-ISOMETRY in QMA(l + 1) and further in QMA(2) by applying the exponential amplification result of [HM10].
To show that QPROD-ISOMETRY is QMA(2)-hard, consider an arbitrary QMA(2) circuit acting on p(n) qubits with completeness and soundness error at most ε. On an input x, we describe the verifier's corresponding unitary as V x : ABW → DG, which takes two product inputs from the provers on the A and B systems respectively along with ancilla qubits in the |0 state on the W system, and outputs a decision qubit (labeled as D) along with a reference system G. Note that any QMA(2) verifier can be expressed in this way. The circuit V x is depicted in Figure 6(a).
We reduce any QMA(2) proof system to QPROD-ISOMETRY by constructing a circuit U : DGCC → A 1 A 2 shown in Figure 6(b) as follows: 1. Prepare a Bell state across the ancilla registers C, C .
2. Prepare the D register in the state |1 and perform V † x on the registers DG to obtain the registers ABW . After V † x is applied, the register W controls whether the Bell states are swapped in to cause the output to be entangled.
3. Perform the following "controlled swap" gate: 4. Label the A register as A 1 and the CC BW registers as A 2 .
We begin by showing that such a circuit can produce a state close to product if there is an accepting input to V x , and then that the circuit can only produce states that are far from separable if no such accepting input exists. (Note that the state is far from being product if it is far from being separable because P ∈ S.) In the case of a YES instance of the QMA(2) problem, by a convexity argument, we know that there are pure states |φ A and |ψ B such that By Uhlmann's theorem, this means that there also exists a pure state |ζ G such that Thus, there exists an input |ζ G to the circuit U such that the output will have a large overlap with the state |φ A ⊗ |ψ B ⊗ |Φ + CC ⊗ (|0 ⊗m ) W (1 − ε of the weight of the state after V † x acts is on (|0 ⊗m ) W , so that the controlled-SWAP acts almost as the identity). The state |φ A ⊗ |ψ B ⊗ |Φ + CC ⊗ (|0 ⊗m ) W is product across the cut A : BCC W , so that we map a YES instance of a general QMA(2) proof system to a YES instance of QPROD-ISOMETRY. Now, let x be a NO instance. Beginning with the pure case, we have a promise that there is no product input to V x such that the probability of measuring |1 on the decision qubit is larger than ε: max By Uhlmann's theorem, the above is equivalent to To show that the output of the circuit U is far from a product state for any input on the system G, we will bound the following quantity: where |σ is product across the A : CC BW cut. To do so, note that the state |σ can be written as the following superposition: where |α 0 | 2 + |α 1 | 2 = 1. (In the above, we are now modeling the system W as a qubit in which |0 represents the projection onto the all-zeros state of m qubits and |1 represents the projection onto the complementary space. It suffices for us to do since we are only interested in these two subspaces.) Also, note that both |σ 0 ACC B and |σ 1 ACC B are product across the bipartite cut A : CC B since |σ ACC BW is. Substituting (30) into (29), we find that max |ζ ,|σ A:CC BW ∈P The first inequality follows from the triangle inequality and the fact that |α i | ≤ 1 since |α i | 2 ≤ 1. The second inequality follows from the monotonicity of fidelity under the tracing out of registers (C and C for the first term and C , B, and W for the second term). Restricting the optimization in the first term to be over pure product states follows by another simple convexity argument. Performing the optimization in the second term over all separable states can achieve only the same or a higher value for the fidelity since P ∈ S. The final inequality follows from (28) and from the fact that the maximum fidelity of a separable state with |Φ + is 1 2 [Wat04]. The analysis above easily generalizes to mixed states by observing that the maximization in (27) can be performed over mixed states and the rest of the analysis can proceed with the purification.
Using the Fuchs-van-de-Graaf inequality in (5), we can bound the trace distance as and so for a sufficiently small ε there is an appropriate gap between the completeness and soundness errors. Thus, we have shown that under the stated promise QPROD-ISOMETRY is both in QMA(2) as well as QMA(2)-hard, and thus QMA(2)-complete. Proof. The main reason that this result follows easily is that allowing classical communication between the provers does not change QMA(2). QSEP-ISOMETRY is defined identically to QPROD-ISOMETRY except that the minimizations in conditions (19) and (20) are over the set of separable states rather than the set of product states. To see that this problem is also in QMA(2), note that the analysis for the inclusion of QPROD-ISOMETRY in a YES instance applies to QSEP-ISOMETRY as well, since Lemma 26 holds for separable states. The analysis of the NO instance proceeds identically.
Indeed, QSEP-ISOMETRY is QMA(2)-hard by means of a very similar reduction as we used for QPROD-ISOMETRY. We proved that in a YES instance there is an input so that the output state close to product (and thus close to separable), while in a NO instance, a very similar analysis demonstrates that all inputs will lead to an output state that is far from separable.

QPROD-STATE is QSZK-Complete
In this section, we examine QPROD-STATE, which extends QPROD-PURE-STATE to allow for quantum circuits that output mixed states (that is, the circuit outputs a reference system and another one but traces over the reference system). This addition of a reference system thwarts our ability to use the product test since (as noted in Section 4) the product test fails very quickly on mixed state inputs. In contrast to the BQP-complete pure-state version and the QMA(2)-complete isometry version, we show that this problem is QSZK-complete. This new result also leads to the rather surprising conclusion that QSEP-STATE 1,1-LOCC -even though it is stated with respect to the 1-LOCC distance-is at least as hard as QPROD-STATE despite the fact that QPROD-ISOMETRY is harder than QSEP-ISOMETRY 1,1-LOCC (if there is a strict separation between QMA and QMA(2)).
Problem 16 (QPROD-STATE(δ c , δ s )) Given is a quantum circuit U to generate the state |ψ RC , along with a labelling of the qubits in the reference system R and the output qubits for each system A 1 , A 2 , . . . , A l ∈ C. We define the n-qubit state ρ C = Tr R {|ψ ψ| RC }. Decide whether 1. Yes: There exists a product state such that ρ C is δ c -close in trace distance to it: 2. No: Every product state is at least δ s -far in trace distance to ρ C : Theorem 17 QPROD-STATE(δ c , δ s ) is QSZK-complete if there are polynomial-time computable functions δ c , δ s : N → [0, 1] such that the difference δ 2 s /4 − δ c is greater than an inverse polynomial in the circuit size.
Proof. We begin by giving a quantum statistical zero-knowledge proof system to decide QPROD-STATE. Recall that a product state is of the form ρ C = ρ 1 A 1 ⊗ · · · ⊗ ρ l A l . In the case that a state on C is exactly product, by Uhlmann's theorem there exists an isometry that the prover can perform on the purifying system R to separate the purifications of each of the subsystems. Indeed, there exists some unitary P RR →R 1 ...R l acting on R and the prover's system R such that where R 1 purifies A 1 and so on. Since these purifications are arbitrary, we can take them such that R 1 ∼ = RA 2 A 3 . . . A l , R 2 ∼ = RA 1 A 3 . . . A l and so on. For the proof system, the verifier need only send the reference system R to the prover, and if the state is close to product, the prover should be able to provide the purification systems R 1 , . . . , R l as above. The verifier then performs U † on each system pair R 1 A 1 , . . . , R l A l and measures the output, accepting if every measurement outcome is |0 . This proof system is depicted in Figure 7. Note also that it is statistical zero-knowledge because, in the case of a YES instance, the verifier could have simply performed U exactly l times to create l copies of the state |ψ RC .
For the following analysis, we first note a useful fact about product states: In the case of a YES instance, the fidelity is guaranteed to be at least (1 − δ c /2) 2 ≥ 1 − δ c by the condition in (31) and the Fuchs-van-de-Graaf equality in (5). Thus, the prover can perform the P RR →R 1 ...R l that achieves this maximum. This gives probability at least 1 − δ c of accepting (the verifier should perform the l inverse unitaries and accept if he measures the all zero state on the output qubits).
In the case of a NO instance, the fidelity in (33) is no larger than 1 − δ 2 s /4 by (32). Thus, it is impossible for the prover to perform any unitary P RR →R 1 ...R l that convinces the verifier to accept with probability greater than 1 − δ 2 s /4. So, for an inverse polynomial gap δ 2 s /4 − δ c , there exists a QSZK proof system that decides QPROD-STATE(δ c , δ s ).
To show QSZK-hardness, we can adapt the reduction used for QSEP-STATE 1,1-LOCC in [HMW13] by modifying it slightly to reduce co-QSD to QPROD-STATE. Recall that for co-QSD [Wat02], we are given a description of circuits U ρ 0 and U ρ 1 that generate mixed states ρ 0 and ρ 1 on the system S as well as a reference system R that is traced over, and we are promised that either ρ 0 − ρ 1 1 ≤ ε in a YES instance or that ρ 0 − ρ 1 1 ≥ 2 − ε in a NO instance. As in the QSEP-STATE 1,1-LOCC reduction, let Figure 7: Our QSZK proof system for deciding QPROD-STATE. The figure depicts the case in which the task is to decide if a general bipartite mixed state is product or not, but this easily extends to l-partite states (see the main text). The proof system begins with the verifier sending the reference system R to the prover, who should be able to transform it into two separate purifications of each system of the original state. The verifier then performs the inverse of the original circuit on each pair R 1 A 1 and R 2 A 2 and measures to verify that the purifications sent by the prover are of the proper form. If the measurement outcomes are all zeros, then the verifier accepts that the original state is close to a product state and otherwise rejects. for i ∈ {0, 1} so that From the description of the circuits U ρ 0 and U ρ 1 , one can efficiently generate a description of the circuit in Figure 8 which takes as input a Bell state across the AB systems and performs the controlled unitary to generate the state The output qubits are divided into three sets: the qubits in the systems BR that are traced over, the half of a Bell state on system A, and one of the states ρ 0 or ρ 1 on system S. The resulting state after tracing out BR is In a YES instance, we wish to show that this state is close to product by giving a product state close to ω A:S . To do this, we consider the state for which the distance to ω A:S is given by: Thus, in a YES instance of co-QSD, our reduction results in a YES instance of QPROD-STATE with δ c = ε 2 . In a NO instance, we must show that ω A:S is far from any product state. Recall that trace distance is equal to the maximum probability of distinguishing states over all possible measurements [Fuc96], so we can lower bound the distance to the nearest product state by considering a particular protocol to distinguish ω A:S from any product state. In this protocol, we begin by measuring the first qubit in the computational basis and by performing the Helstrom measurement {Π 0 , Π 1 } on the second qubit, storing the two measurement outcomes in classical registers.
Recall that the Helstrom measurement distinguishes two states ρ 0 and ρ 1 with the following success probability: 1 2 Tr{Π 0 ρ 0 } + 1 2 Tr{Π 1 ρ 1 } = 1 2 1 + 1 2 ρ 0 − ρ 1 1 , and the following error probability: Using this fact, it is straightforward to establish that the trace distance between ω A:S and the perfectly correlated state Φ A:S , defined as is no larger than In the case of a product state, the two measurement outcomes must be uncorrelated, and so we can write the result of applying the above protocol to any product state using the probability p of measuring |0 0| and the probability q of measuring Π 0 : From the monotonocity of trace distance under quantum operations, it follows that Due to symmetry, we can take p ≤ 1 2 without loss of generality. We can then bound the minimum distance of σ p,q to ω A:S : where the first line follows from the triangle inequality, and the fourth through last lines follow from the fact that 0 ≤ p ≤ 1 2 and 0 ≤ q ≤ 1. Thus in a NO instance of co-QSD, our reduction results in a NO instance of QPROD-STATE with δ s ≥ (1 − ε)/2.
We have given a QSZK proof system to decide QPROD-STATE, as well as a reduction from the QSZK-hard problem co-QSD. This completes the proof.
Remark 18 Theorem 17 constitutes a different proof that the promise problem known as Error Correctability from [HH13] is QSZK-complete (with a proof preceding this one being given in [HS12]). Indeed, Error Correctability is the task of deciding whether it is possible to decode a maximally entangled state from systems R and B when a unitary specified as a quantum circuit acts on systems R, B, and E, such that systems R and B are initialized to the maximally entangled state and system E is initialized to the all-zeros state. In this problem, there is a promise that it is either possible to decode maximal entanglement (approximately) or impossible to do so. Due to the "decoupling theorem" often used in quantum information theory [HHWY08], the question of whether it is possible to decode maximal entanglement between systems R and B is equivalent to the question of whether systems R and E are in a product state. Thus, it follows from Theorem 17 that Error Correctability and QPROD-STATE are reducible to one another and that Error Correctability is QSZK-complete. 8 A short quantum game for QSEP-STATE 1,1-LOCC In Ref. [HMW13], it was shown that the QSEP-STATE 1,1-LOCC problem can be decided by a twomessage quantum interactive proof system, so that the problem lies inside QIP(2). In this section, we show that this problem also admits a short quantum game, putting it inside SQG, too. As mentioned in Section 2, this result is not a complexity-theoretic improvement over prior work, but it is interesting that QSEP-STATE 1,1-LOCC admits a natural, single-message quantum proof provided that the verifier has help from a second competing prover.
Recall the multipartite definition of the QSEP-STATE 1,1-LOCC problem from Ref. [HMW13]: Problem 19 (QSEP-STATE 1,1-LOCC (δ c , δ s )) Given is a mixed-state quantum circuit to generate the n-qubit state ρ C , along with a labeling of the qubits in the reference system R and the output qubits for each system A 1 , A 2 , . . . , A l ∈ C. Decide whether 1. Yes: There is a separable state σ C ∈ S that is δ c -close in trace distance to ρ C : 2. No: Every separable state is at least δ s -far in 1-LOCC distance to ρ C : Theorem 20 QSEP-STATE 1,1-LOCC (δ c , δ s ) is in SQG(c, s) for completeness c = 1/2 − δ c /4 and soundness s = 1/2 − δ s /8.
Proof. The short quantum game witnessing membership of QSEP-STATE 1,1-LOCC inside SQG(c, s) is as follows: 1. The yes-prover sends the verifier a state σ C 1 ···C k where the number of systems k is chosen to be (Intuitively, the state σ C 1 ···C k is a purported k-extension of ρ C .) 2. The verifier performs a permutation test on the systems C 1 , . . . , C k received from the yesprover in step 1. If the test fails, the verifier rejects. The verifier then discards all but one of the k C systems, leaving a state which we denote σ C = Tr C 2 ···C k {σ C 1 ···C k }.
3. The verifier prepares a copy of the state ρ C using the input circuit and chooses a random bit b ∈ {0, 1}. If b = 0 he sends the no-prover the state ρ C . Otherwise, he sends σ C .
(Intuitively, the no-prover is challenged to identify whether the state he receives from the verifier is ρ C or σ C .) 4. The no-prover replies with a single bit b . The verifier rejects if and only if b = b.
Let us argue that this protocol is correct. For YES instances, an optimal strategy for the yes-prover is to select a separable state σ C that is δ c -close in trace distance to ρ C and send the verifier a kextension σ C 1 ···C k of σ C . As σ C is separable, such a k-extension must exist for every choice of k and so the permutation test passes with certainty. The no-prover is then faced with the task of distinguishing σ C from ρ C , which he can do with probability no larger than 1/2 + δ c /4, implying that the verifier accepts with probability at least 1/2 − δ c /4 as desired.
For NO instances, an optimal strategy for the no-prover is to perform a measurement that distinguishes ρ C from the convex set E k of k-extendable states with probability at least (The existence of such a measurement was first shown in Ref. [GW05] and a very simple proof can be found in Yu, Duan, and Xu [YDX12].) To see that the yes-prover cannot win, observe that if the permutation test of step 2 passes, then the state σ C 1 ···C k received from the yes-prover is projected into each symmetric subspace of C 1,i · · · C k,i (where i indexes each party of the multipartite state). We know from Lemma 1 that choosing k as in (36) given the condition (35) implies that It then follows from (37) and the fact that all states in such a symmetric subspace are contained in the set of permutation invariant states (the set of k-extendible states) that the no-prover convinces the verifier to reject with probability at least 1/2 + δ s /8. This implies that the verifier accepts with probability at most 1/2 − δ s /8 as desired. 9 Prior Results 9.1 QSEP-STATE 1,1-LOCC and QIP(2) Problem 21 (QSEP-STATE 1,1-LOCC (δ c , δ s )) Given is a mixed-state quantum circuit to generate the n-qubit state ρ AB , along with a labeling of the qubits in the reference system R and the output qubits for A and B. Decide whether 1. Yes: There is a separable state σ AB ∈ S such that ρ AB is δ c -close in trace distance to it: Figure 9: A two-message quantum interactive proof system for QSEP-STATE 1,1-LOCC . The proof system begins with the verifier executing the circuit U ρ that generates the state ρ C . He sends the reference system to the prover. In the case that ρ C is fully separable, the prover should be able to act with a unitary on the reference system and some ancillas in order to generate a multipartite k-extension of ρ C to the systems C 2 through C k . The prover sends all of the extension systems back to the verifier, who then performs phase estimation over the symmetric group (a quantum Fourier transform followed by a controlled permutation and measurement) in order to test if the state sent by the prover is a multipartite k-extension.
2. No: Every separable state is at least δ s -far in 1-LOCC distance to ρ AB : For a proof of this theorem refer to Sections 4-6 of [HMW13]. Section 8 of [HMW13] extends the theorem to the multipartite version. The QIP(2) proof system is depicted in Figure 9.
9.2 QSEP-CHANNEL 1,1-LOCC is QIP-Complete Problem 23 (QSEP-CHANNEL 1,1-LOCC (δ c , δ s )) Given is a mixed-state quantum circuit to generate the channel N S→AB , having an n-qubit input and an m-qubit output, along with a labeling of the qubits in the environment system R and the output qubits for A and B. Decide whether 1. Yes: There is an input to the channel ρ S such that the channel output N S→AB (ρ S ) is δ c -close in trace distance to a separable state σ AB ∈ S: 2. No: For every channel input ρ S , the channel output N S→AB (ρ S ) is at least δ s -far in 1-LOCC distance to a separable state: Theorem 24 QSEP-CHANNEL 1,1-LOCC (δ c , δ s ) is QIP-complete if there are polynomial-time computable functions δ c , δ s : N → [0, 1] such that the difference δ 2 s /8 − 2 √ δ c is larger than an inverse polynomial in the circuit size.
For a proof of this theorem refer to Section 7 of [HMW13]. The protocol can be extended to the multipartite case via the same method used to extend QSEP-STATE 1,1-LOCC .

Operational interpretations of geometric measures of entanglement
Our work has a close connection to several entanglement measures known collectively as the geometric measure of entanglement (see [WG03,CAH13] and references therein). This is also the case with the work in [HM10], and we comment on this connection briefly. The original definition of the geometric measure of entanglement was for a pure bipartite state |ψ AB and defined in terms of the following quantity: Clearly, this quantity has an operational interpretation as the maximum probability with which the state |ψ AB would pass a test for being a pure product state. By taking the negative logarithm of this quantity, one recovers an entropic-like quantity that is equal to the geometric measure of entanglement and satisfies a list of desirable requirements that should hold for an entanglement measure. It is straightforward to extend the above definition and any of the ones below to the multipartite case. If one has a promise that the quantity in (39) is larger or smaller than 1 − ε or ε, respectively, (as in our specification of QPROD-PURE-STATE) then the product test and analysis of Harrow and Montanaro [HM10] demonstrate that it is easy to decide which is the case if one has access to a quantum computer. However, this does not directly give an operational intepretation to the quantity in (39). Rather, it is our QSZK proof system for QPROD-STATE that has its maximum acceptance probability equal to the quantity in (39). More generally, this QSZK proof system has its maximum acceptance probability equal to a generalization of the quantity in (39) defined as follows for mixed states: max As such, it gives a direct operational interpretation to the above quantity. In prior work [HMW13], some of us demonstrated a QIP(2) proof system which had the following tight upper bound on its maximum acceptance probability: which holds in the limit of large k, where k is the number of systems sent by the prover in a purported k-extension of the state ρ AB . The above quantity is again related to a geometric measure of entanglement defined in prior work (see [CAH13] and references therein). Thus, the QIP(2)-proof system for QSEP-STATE 1,1-LOCC gives an operational interpretation to the quantity in (41) as the maximum probability with which a prover could convince a verifier that a state ρ AB is separable if the verifier sends a purification of ρ AB to the prover and then performs a check on what the prover sends back. Finally, our work has unveiled and provided operational interpretations for other quantifiers of entanglement that fall within the geometric class. Indeed, the maximum acceptance probability for our proof system for QSEP-ISOMETRY 1,1-LOCC is upper bounded by max ρ, σ AB ∈S F (U (ρ S ⊗ |0 0|)U † , σ AB ), again a bound that holds in the large k limit. Clearly, this quantity is related to the so-called "entangling power" of the unitary U [ZZF00], that is, its ability to take a product state input to an entangled output no matter what the input is. Furthermore, the proof system for QSEP-CHANNEL 1,1-LOCC given in [HMW13] has the following upper bound on its maximum acceptance probability: max where N S→AB is a quantum channel with input system S and output systems AB. Again, this bound holds in the limit of large k. The above measure is related to the entangling capabilities of a quantum channel no matter what the input is, and our proof system for QSEP-CHANNEL 1,1-LOCC provides an operational interpretation for the above quantity as well.

Conclusion
We have proved that several entanglement or correlation detection problems are complete for BQP, QMA, QMA(2), and QSZK, building on prior work in [HMW13] that gives an entanglement detection promise problem in QIP(2) and a promise problem complete for QIP. The completeness of these promise problems for a wide range of complexity classes illustrates an important connection between entanglement and quantum computational complexity theory. In hindsight, it is perhaps natural that these problems related to entanglement can capture the expressive power of these classes since entanglement seems to be the most prominent feature which distinguishes classical from quantum computational complexity theory. It is interesting to note the connection between these problems, and the differences that give rise to problems complete for different classes in the hierarchy. The differences are sometimes intuitive: a single-prover proof system for QSEP-ISOMETRY would allow unentangled provers to be simulated with a single one, so, under the assumption that QMA is strictly contained in QMA(2), it seems natural that it should not be possible to place QSEP-ISOMETRY in QMA. Some patterns between classes also emerge-it seems as though mixed state separability requires two messages to be added onto a proof system for pure state separability, in order to allow the prover to work with the purification of the mixed state (as is the case for both the "state" and "channel" versions of these problems).
Two-message quantum interactive proof systems continue to be somewhat mysterious. Intuitively, QSEP-STATE 1,1-LOCC has the qualities that one would expect for a QIP(2)-complete problem by extrapolating from these results. Despite this, we do not know whether it is QIP(2)-complete or even QMA-hard. However, our work here gives evidence for why QSEP-STATE 1,1-LOCC should not be either QSZKor QMA-complete-there are are other problems very different from it that are complete for these classes (QPROD-STATE and QPROD-ISOMETRY, respectively). This work can be expanded in a number of directions. A trace-distance version of QSEP-CHANNEL 1,1-LOCC may help to understand the relation between QMIP and QMIP ne , and similarly a trace-distance version of QSEP-STATE 1,1-LOCC may provide further insights. Additionally, it would be worthwhile to characterize the channel version of QPROD-STATE in order to map out more of the space of entanglement detection problems. Such an extension may also help to provide a tighter characterization of classes that rely on "unentanglement," such as QMA(2).
It is satisfying that each of the entanglement detection problems, with the exception of QSEP-STATE 1,1-LOCC , is complete for a different complexity class. Perhaps by visiting the remaining related problems in terms of the trace distance and mixed product state cases, one may find two different types of entanglement detection problems that are reducible to each other.
Proof. Let σ C be the state that achieves the minimum in (42). Since this state is k-extendible, we have from Theorem 2 of [BaH13] that Let σ * C be the state achieving the minimum on the left in (43). From the premise of the theorem, it follows that