Tools for the analysis of quantum protocols requiring state generation within a time window

Quantum protocols commonly require a certain number of quantum resource states to be available simultaneously. An important class of examples is quantum network protocols that require a certain number of entangled pairs. Here, we consider a setting in which a process generates a quantum resource state with some probability $p$ in each time step, and stores it in a quantum memory that is subject to time-dependent noise. To maintain sufficient quality for an application, each resource state is discarded from the memory after $w$ time steps. Let $s$ be the number of desired resource states required by a protocol. We characterise the probability distribution $X_{(w,s)}$ of the ages of the quantum resource states, once $s$ states have been generated in a window $w$. Combined with a time-dependent noise model, the knowledge of this distribution allows for the calculation of fidelity statistics of the $s$ quantum resources. We also give exact solutions for the first and second moments of the waiting time $\tau_{(w,s)}$ until $s$ resources are produced within a window $w$, which provides information about the rate of the protocol. Since it is difficult to obtain general closed-form expressions for statistical quantities describing the expected waiting time $\mathbb{E}(\tau_{(w,s)})$ and the distribution $X_{(w,s)}$, we present two novel results that aid their computation in certain parameter regimes. The methods presented in this work can be used to analyse and optimise the execution of quantum protocols. Specifically, with an example of a Blind Quantum Computing (BQC) protocol, we illustrate how they may be used to infer $w$ and $p$ to optimise the rate of successful protocol execution.


I. INTRODUCTION
It is common for quantum computing and quantum network protocols to require the simultaneous availability of a certain number of high quality quantum resource states.In the domain of quantum networks, such resource states are typically entangled pairs of qubits, where the execution of protocols such as entanglement distillation and many quantum network applications require multiple entangled pairs to be available at the same time [1]- [3].Another example of a resource state can be found in the domain of quantum computing, where magic state distillation relies on the presence of multiple initial magic states [4].
Here, we study the setting in which resource states are generated using a probabilistic process.In each time step, this process succeeds in generating one resource state with probability p.If the state is prepared successfully, it is immediately stored in a quantum memory that is subject to time-dependent noise.The process is repeated until all s states required by a protocol are in memory.Such a setting is ubiquitous in quantum networking, and (photonic) quantum computing.A prime example is heralded entanglement generation [5], [6] that is commonly used in present-day quantum networks (see e.g.[7], [8]).
If the noise is time-dependent, this means that when a state is placed in a quantum memory its quality will degrade over time.In practice then, in order to deliver states of sufficient quality, one often imposes a window of w time steps within which all s states must be produced.If the states are produced within the desired window, the quality of the states is high enough for the application to succeed.Otherwise, the states are typically discarded (see Figure 1).In the context of quantum repeater protocols, such a window size is also often referred to as a 'cut-off time', and the analysis across multiple nodes is generally non-trivial [9]- [14].If a protocol FIGURE 1. Setup.In each time step, a probabilistic process generates a resource state, where p is the probability of success (tick) and 1 − p the probability of failure (cross).After generation the resource state is immediately placed into a quantum memory subject to time-dependent noise.To ensure the states have sufficient quality to enable a quantum protocol, states that are older than a specific window w of time steps are discarded (bin).
requires s quantum resource states of sufficiently high quality to exist simultaneously, this translates to a requirement of s successful generation events within the window of w time steps.
When analysing the performance of protocols that rely on such a generation of resource states, we are interested in a number of performance metrics.For example, one may be interested in the rate at which we can execute a protocol, the probability that the overall quantum protocol will be successful, or a combined metric that considers the number of successful executions of the quantum protocol per time unit.To understand and optimise such performance metrics, we are interested in understanding a number of quantities related to the system's ability to prepare the resource states required by the protocol.
Firstly, one may consider the waiting time τ (w,s) until there are s successes within a window of w time steps.We remark that for fixed parameters (w, s, p) this provides us also with information about the rate at which a protocol can be carried out, when executed multiple times.Secondly, we look at the ending pattern X (w,s) (see Figure 2), which contains the ages of the s quantum resources at time τ (w,s) .Combined with a model of decoherence, this can be used to compute the quality (fidelity) of the resources immediately after the last state has been produced, which is when the quantum protocol may be executed.
The goal of this work is to provide tools that may be used to analyse the performance of a given quantum protocol for specific choices of w, s and p, as well as to choose a combination of these parameters to optimise its performance.

A. RESULTS
Our main contributions are summarised below.
• For all values of w, s and p, we provide formulae for the first and second moments of τ (w,s) , and the full distribution of X (w,s) .For (w, s) = (∞, s), these are in a simple closed form, and similarly for (w, s) = (w, 2).
For all other values of (w, s) we present general formulae, which are in the form of a linear system that may be solved numerically.The dimension of the system scales FIGURE 2. Ending patterns.At the first instance τ (w,s) when a window of w time steps contains s successes, we are interested in how long ago each of the s links were generated.This allows one to quantify the quality of the corresponding resource states.The information of when the s resource states were produced is contained in the ending pattern X (w,s) .
as w s−1 .For large w and s, it is therefore difficult to obtain closed-form expressions from these systems.• We provide an efficient method to find bounds on the range of w and p for which E(τ (w,s) ) and X (w,s) may be approximated by E(τ (∞,s) ) and X (∞,s) to an arbitrary degree of accuracy.In a practical context, this allows one to quickly compute thresholds on the window size such that increasing w further provides no improvement for a protocol rate.Moreover, for appropriate parameter regimes, this approximation is desirable due to the fact that the dimension of the linear system to solve for the expected waiting time E(τ (w,s) ) and X (w,s) scales with w and s, as described above.This is in contrast to the simple closed-from expressions that can be found for the corresponding quantities in the case w = ∞.• We characterise the behaviour of E(τ (w,s) ) and X (w,s) in the limit of a small probability of success.In particular, we show that as p → 0, E(τ (w,s) ) scales as p −s , and that the distribution of X (w,s) becomes uniform.This result may be used to gain intuition about the performance of a quantum application when the resource generation success probability is small, without needing to perform (potentially lengthy) numerical computations.• We provide a demonstration of how these methods may be used in practice.We consider a Blind Quantum Computation protocol [15].In our model, entanglement is consumed in the transmission of qubits from a client device to a server device.The model includes noise due to imperfect entangled links and memory decoherence.For a set-up involving a computation on four qubits, we provide an example of how the methods from the first sections may be used to choose architecture parameters that optimise the rate of the protocol.

B. RELATED WORK
To obtain our results, we draw on methods used in the mathematical literature known as scan statistics.Scan statistics is typically concerned with patterns and clusters in a sequence of random events.This is a field that incorporates techniques from multiple different areas of mathematics.In the quantum context, the problem is different from other areas in caring about the ending pattern distribution.In this work, we therefore use the approach that makes use of martingales, because this allows one to obtain both E(τ (w,s) ) and the distribution of X (w,s) [16].It is possible to obtain the same quantities with embedded Markov chains [17], but we continue here with the martingale method; firstly because the resulting formula has a smaller dimension, and secondly because it has a regular structure that allows us to derive asymptotic results for small p, which is an experimentally relevant regime.We note that there exist other methods to obtain E(τ (w,s) ), and also in principle the full distribution of τ (w,s) -see e.g.[18] or [19] which give formulae to obtain the probability generating function of τ (w,s) .To our knowledge, however, these also result in a large system of equations, and moreover do not give the ending pattern distribution.Other closely related quantities to τ (w,s) have been explored in great depth in the scan statistics literature, which may also have relevance to the quantum domain.For example, there exist a number of bounds and approximations for P(τ (w,s) ≤ n) (see e.g.[20] for an overview of results), which may prove useful in allocating time for entanglement generation in a quantum network schedule.By contrast, in this work, we focus on the behaviour of E(τ (w,s) ) and X (w,s) , and their implications for the performance of quantum protocols.To our knowledge, this work is the first to characterise the behaviour of the ending pattern distribution in certain parameter regimes, and demonstrate an explicit example of the application of results from scan statistics to a quantum protocol.

C. OUTLINE
The rest of the paper is organised as follows.In Section II, the quantities τ (w,s) and X (w,s) are formally defined.In Sections III-A and III-B, we give formulae for the first and second moments of τ (w,s) , and the distribution of X (w,s) .In Sections III-C and III-D, we present results that aid the understanding and approximation of these quantities.In Section IV-A, the behaviour and practical relevance of the results of Section III are outlined, specifically looking at E(τ (w,s) ).In Section IV-B, we give an example of how one may use the results of Section III to choose architecture parameters that optimise the performance of BQC protocol.Finally, further directions are summarised in Section V.

II. PRELIMINARIES
We view quantum resource generation attempts as a sequence of i.i.d.Bernoulli trials (Z i ) ∞ i=1 with success probability p = P(Z 1 = 1) > 0.Then, if a protocol requires s ≤ w quantum resources to coexist, the time taken to complete the application is dependent on the waiting time τ (w,s) to produce s successes within a window of size w.We are also interested in the ending pattern X (w,s) which completes the process, because this contains the ages of the s quantum resources present at time τ (w,s) .We denote the set of possible ending patterns as Ω(w, s).This contains every possible configuration of the s successes within the scanning window, so that X (w,s) ∈ Ω(w, s).A visualisation of how an ending pattern realises the end of the process is given in Figure 2.More specifically, we define to be the set of all length-l binary strings x = (x 1 , ..., x l ) that contain s successes, two of which occur at either end of the string.Then, is the set of ending patterns.The set Ω(w, s) can be thought of as containing all clusters of s successes that were produced within a time less than or equal to w time steps.Note that the number of possible ending patterns is given by To see this, consider the fact that each ending pattern in Ω(w, s) corresponds uniquely to an ending scenario where the s successes are distributed within the window of w time steps.Since the final quantum resource must always have been prepared at the most recent time step and therefore is fixed, it remains to distribute the remaining s − 1 successes within w − 1 time steps, meaning that the number of possible ending patterns is restricted to (3).The waiting time τ (w,s) is then defined by τ (w,s) := min x∈Ω(w,s) i.e. this is the time until we see the first ending pattern in the sequence of Bernoulli trials.Here, τ x is the time taken until one particular ending pattern x is first seen, so that for x ∈ Ω l (s) ⊂ Ω(w, s) We note that τ (w,s) is well-defined because it is bounded above by a geometric random variable (see Appendix B-1).
There is also a relationship between τ (w,s) and the distribution of X (w,s) given by recalling that X (w,s) takes the value of the ending pattern that completes the process.No two ending patterns can realise the end of the process at the same time since no element of Ω(w, s) contains another, and so X (w,s) is well-defined.

III. FORMULAE AND APPROXIMATIONS
In the following two sections, we provide exact solutions for the first and second moments of τ (w,s) , and the full distribution of X (w,s) .Formulae are provided for all possible values of w and s.In Section III-C, we look at approximating the solutions for a large w.In Section III-D, we characterise the solution behaviour for small p.

A. INFINITE WINDOW
Here, we consider the case where no resource states are discarded (or equivalently when w = ∞) and give solutions for the first and second moments of τ (∞,s) , and the distribution of X (∞,s) .This serves as a useful initial study of the problem, providing intuition for the case where w is large and finite.When no states are discarded, the waiting time to see all of the successes simply becomes a sum of s i.i.d.geometric random variables with parameter p.This is known as a negative binomial distribution, and has an exact distribution given by and expectation Note that for w > w, it is always the case that τ (w ,s) ≤ τ (w,s) , and so In particular, the waiting time for a finite w will always be greater than or equal to the infinite case.Then, (8) gives a simple lower bound in terms of s and p The variance of τ (∞,s) is given by from which we can see that the standard deviation is reciprocal in p.
It is also possible to derive a simple expression for the distribution of X (∞,s) .For a binary string x ∈ Ω l that lives in the (now infinite) set of ending patterns Ω(∞, s), which can be seen by considering the probability of generating the remaining l − 1 entries of B after the first success has been generated.We see that when the window size is infinite, the probability of generating ending patterns of the same length is constant.
When s = 2, it is possible again to derive closed-form solutions for the first and second moment of τ (w,s) and the distribution of X (w,s) .We present below the formulae for E(τ (w,s) ) and the ending pattern distribution.In this case, the ending patterns are determined by the time between the two states, i.e. |Ω l (2)| = 1.We separate the process of resource generation into two parts: generation of the first state, and generation of the second state.Generation of the first link occurs when there is no state stored in memory.This is not limited by the window, and has a generation time described by a geometric distribution with parameter p.To finish the process, the generation of the second state must happen within w − 1 time steps of the first link being generated.When the process is finished, the time between the two states is then a geometric distribution conditional on this event, which occurs with probability 1 − (1 − p) w−1 .Then, letting L ∈ {1, ..., w − 1} be the number of attempts after the first state to generate the second, which gives the full ending pattern distribution, where L = n corresponds to X (w,s) ∈ Ω n+1 (2).Now, let M be the number of times a first state must be generated until the process is finished.Since this is determined by the success of the second state within the time window, we have The total time is then given in terms of M and L by where the random variables T j ∼ Geom(p) describe the number of attempts to generate the first state.Now, as shown in Appendix A, and The expected waiting time may then be computed as from which we obtain The variance of τ (w,2) may also be computed by making use of (15).The computation is given in Appendix A.
2) s > 2 We now give a formula to exactly compute E(τ (w,s) ) and the full distribution {P(X (w,s) = x) : x ∈ Ω(w, s)}, for a finite w.This is derived using the method from [16], which makes use of martingales.For completeness, we include an outline of the derivation in Appendix B-2, where a gambling analogy is introduced to aid understanding.The resulting formula is in the form of a linear system of size |Ω(w, s)| + 1 that can be solved exactly.Each matrix element defining the linear system can be computed simply and efficiently.Further, in Appendix B-4 we give a formula for the second moment of τ (w,s) , which now involves two linear systems of size |Ω(w, s)|.A martingale method is also used for its derivation, and for this we refer to [21].The second moment of τ (w,s) can then be used to calculate the variance and standard deviation of τ (w,s) .Before stating the first formula, we introduce some notation.We define a function * that maps two binary strings x = (x 1 , ..., x k ) and y = (y 1 , ..., y m ) to a scalar value, given by where for a, b ∈ {0, 1}, the quantity δ a,b is given by where p 1 := p and p 0 := 1 − p. From (20), we see that the value of x * y is obtained by comparing the overlap of successive substrings of x and y.If two substrings match exactly, then the corresponding term is included in the sum, and it is weighted by an amount that is dependent on the Bernoulli parameter p. Informally, then, x * y measures how similar the structures of x and y are.A simple example of the action of * is given as follows.We consider the action of * on two ending patterns, recalling (1).Letting s = 3 and w ≥ 7, suppose that x = (1, 0, 1, 0, 0, 0, 1) and y = (1, 0, 0, 0, 1, 1).Computing (20) then yields Since all elements of Ω(w, s) start and finish with a success, the same initial 1/p term will be present for any pair of ending patterns.Whether or not there are higher order terms depends on the overlap of the successive substrings.In particular, for two ending patterns x, y ∈ Ω(w, s), the quantity x * y will be of order 1/p s if and only if x = y.
Equipped with these definitions, we now give the formula for the expected waiting time and the ending pattern distribution.
Theorem 1.Let N := |Ω(w, s)|.After enumerating the ending patterns as Ω(w, s) ≡ {x (i)  (2)  . . . . . . Then where e 1 := (1, 0, ..., 0) T is a vector of length N + 1, and The matrix A is invertible since no element of Ω(w, s) contains another [16].The solution for v therefore always exists and is unique.The matrix A is fully determined by the success probability p and the parameters w and s.As discussed above, each entry of the submatrix formed by removing the first row and column is greater than or equal to 1/p.Entries that do not take this exact value contain higher-order terms in 1/p, due to the fact that there is a greater overlap of the ending patterns corresponding to the row and column indices of such an entry.The entries of the highest power in 1/p are exactly the diagonal elements and are of order s, because a string overlaps completely with itself and contains s successes.In principle, the solutions for v can be computed analytically as functions of p by inverting A directly.Noting that the dimension of the system is |Ω(w, s)| + 1 = O(w s−1 ), this is in practice computationally laborious for large w and s.In the following sections, we derive results that aid the understanding and computation of the corresponding results in the two characteristic regimes of large w, and small p.

C. APPROXIMATING WITH AN INFINITE WINDOW
Now, one might ask: how large must the window size be for the approximation w = ∞ to be accurate?This is desirable due to the simple analytical form of the results for the distributions of τ (∞,s) and X (∞,s) , as seen in Section III-A.This is in contrast to the solutions presented in Section III-B for the case of a finite w, which scale with w and s.The approximation becomes valid when the window size has 'saturated' the process, so that increasing the window size does not provide any significant improvement for the rate.Alternatively, the approximation becomes accurate when P(τ (w,s) > w) is small.This intuition is formalised with the following theorem.
Theorem 2. Let τ (w,s) be the waiting time for s successes in a w-window.Let X (w,s) be the corresponding ending pattern.Let p denote the success probability of each trial.Let (w, s, p) := P(τ (w,s) > w).Suppose that 0 < p < 1 and w < ∞.Then and We now look to evaluate (w, s, p).Looking back at the identity (7) for the distribution of τ (∞,s) , we have To evaluate the right-hand side of ( 25) it is convenient to rewrite this as a finite sum, as provided by the following lemma.The proof of this is given in Appendix C-1.
Lemma 1.Let τ (w,s) be the waiting time for s successes in a w-window, as defined in (4).Suppose that 0 < p < 1 and w < ∞.Then This sum is simple and efficient to evaluate for constant s, and can then be used to find a range of w for which the two expectations are close.For example, if one is interested in evaluating E(τ (w,s) ), when in fact w is large enough such that it may be reasonably approximated by E(τ (∞,s) ) = s/p, it is possible avoid solving a large system of equations with the following method.Demanding some desired error δ, one may quickly compute w * = min w : (w, s, p) < δ .
Then, for all w ≥ w * , one may approximate E(τ (w,s) ) with E(τ (∞,s) ) = s/p with accuracy on the order of δ.The same can be done with the ending pattern distribution: if one is interested in the expectation of some fidelity quantity F (X (w,s) ), one may also approximate E(F (X (w,s) )) with E(F (X (∞,s) )) with the same accuracy.

D. ASYMPTOTIC BEHAVIOUR OF THE EXPECTATION
From ( 9), an upper bound for E(τ (w,s) ) is given by E(τ (s,s) ), which can be written in a simple analytical form.In the case w = s, there is only one ending pattern x, which corresponds to the case of s consecutive successes.From ( 23), we then have which for small p satisfies E(τ (s,s) ) ∼ 1/p s .In comparison, from (8), the scaling of the expectation for w = ∞ is reciprocal in p. Further, from the form of A given in (24), all entries of v will be ratios of polynomials in 1/p.Looking at the first component of v, which is the waiting time expectation, this tells us that there is some integer value α s (w) which dominates the scaling for small p, so that where c(w, s) is a constant.Now, recalling from ( 9) that E(τ (w,s) ) is a decreasing function of w, we therefore expect the same of α s (w), which satisfies α s (s) = s and α s (∞) = 1.Below we show that for w < ∞, α s (w) is always equal to s, and also derive the scaling factor c(w, s).
Theorem 3. Let τ (w,s) be the waiting time for s successes in a w-window, as defined in (4).Let X (w,s) be the corresponding ending pattern.Let p be the success probability of the process.Then, in the limit p → 0, and for all x ∈ Ω(w, s) where |Ω(w, s)| = w−1 s−1 is the number of possible ending patterns.
A proof of Theorem 3 is given in Appendix C-2.It is interesting future work to quantify the speed of convergence of ( 33) and (34).
As intuition for (34), note that for very small p, the probability of having w failures preceding the ending pattern is high.In this case, the ending pattern distribution is equivalent to the ending pattern distribution given we succeed in w attempts, which in the limit of small p converges to the uniform distribution.
The behaviour captured by Theorem 2 and 3 may be viewed as two limiting behaviours of the problem in the regimes of small and large p, respectively.In particular, we expect that the formula provided by Theorem 1 becomes useful in neither regime, i.e. when p is neither too small or too large to apply either approximation.Moreover, it is important to keep in mind that such a regime will depend on the choices of w and s.

IV. ILLUSTRATION AND APPLICATION
We expect the methods presented in the above sections to be useful in choosing the optimal window size for a quantum protocol.To this end, we firstly analyse in more detail the behaviour of E(τ (w,s) ).We then demonstrate how these methods may be used to optimise the performance of a BQC protocol.

A. ILLUSTRATION
We fix s = 4 as an example to showcase the characteristic behaviours of the expected waiting time.From our investigations, the solutions for other values of s display the same qualitative behaviour.The value s = 4 is small enough that  E(τ (w,4) ) varies with w.We see that E(τ (w,4) ) (red line) converges to the lower bound E(τ (∞,4) ) = 4/p (blue line) as w becomes large.The grey region is one standard deviation of τ (w,4) above and below its expectation (for w < ∞).All quantities are evaluated with a success probability p = 0.5.E(τ (w,4) ) varies with w and p We see that for larger p, E(τ (w,4) ) (solid line) approaches the lower bound E(τ (∞,4) ) = 4/p (dashed line) at a higher rate.

FIGURE 4. How
the complexity of the problem is not too large to be solved on a laptop.
In Figure 3, E(τ (w,4) ) is plotted against w, with the success probability set to p = 0.5.We notice the convergence to the w = ∞ lower bound.The grey region is that given by one standard deviation above and below the expectation.Note that one also expects the standard deviation to converge to that of τ (∞,4) , which is given in closed form by (11).
In Figure 4, E(τ (w,4) ) is again plotted against w, but this time for three different values of the success probability.In each case, the solution again approaches the corresponding w = ∞ lower bound.Each line starts at E(τ (4,4) ) = (1/p s − 1)/(1 − p), corresponding to w = s, and converges FIGURE 5. How E(τ (w,4) ) varies with p.We see that E(τ (w,4) ) (solid lines) demonstrates the reciprocal scaling as p → 0, as encapsulated by Theorem 3.There is convergence to E(τ (w,4) ) (dashed line).This plot was made by discretising p into 100 points, evenly spaced in the range (0, 1). to the w = ∞ limit.This convergence is an important feature, because at some point increasing w provides no significant improvement for the protocol rate.As one would expect intuitively, the convergence occurs more quickly for a larger p, as increasing the window size effectively saturates the problem more easily.To quantify this, we can use the arguments of Section III-C.For example, taking the desired margin of error to be 2%, define where (w, s, p) is given by (29).By Theorem 2 and Lemma 1, the approximation E(τ (w,s) ) ≈ E(τ (∞,s) ) is then valid to the same margin of error for all w > w * .It is interesting to see how this compares to the smallest window size w * true for which the same approximation can be made, which is defined formally as w * true = min w : The value w * is then an upper bound for w * true .For example, letting p = 0.5 and s = 4 yields w * = 15, and checking with the exact solutions gives w * true = 12.These are plotted for more values of p in Figure 6.We see from the plot that as p increases, the bound appears to become tighter.The value w * true was plotted for only a few select values of p because its calculation is computationally intensive.
In Figure 5, E(τ (w,4) ) is plotted against p for five different values of the window size.One can see that the scaling of E(τ (w,4) ) occurs more slowly for a larger w.This indicates the reciprocal behaviour as given in (33), where E(τ (w,4) ) ∼ 1/|Ω(w, 4)|p 4 , and in the case of a larger w the constant |Ω(w, 4)| suppresses the scaling.As p → 1, all plots simply converge to s = 4, because in this case the process is deterministic.Further, we see again the convergence of the expectation to the infinite window limit.If p becomes large, we expect the problem to 'saturate' in the same sense as before, so that E(τ (w,s) ) ≈ E(τ (∞,s) ).The speed of this convergence can again be quantified using the results of Section III-C.Demanding the same error of 2%, we take the p * that satisfies or equivalently, p * is the unique value of p such that (w, s, p * ) = 0.02.The value p * is an upper bound for the true threshold p * true , p * true := inf p : (38) where we now include dependence of the expectations on the success probability p.In Figure 7, p * and p * true are plotted against w.The value p * true is computationally intensive to find for large values of w, and has therefore only been plotted for selected small values of w.The bound p * , however, is efficient to compute.We observe that the bound appears to be tighter for smaller w.

B. APPLICATION TO A BQC PROTOCOL
In the following, we provide an example of how the results from Section III may be used in the performance analysis of a quantum network application.We consider a verifiable Blind Quantum Computation (BQC) protocol [15].This involves a client, who uses a more powerful server device to carry out a bounded-error quantum polynomial-time (BQP) computation [22], which is specified in the measurement-based formalism [23].In this formalism, the computation is defined with respect to a graph G = (V, E), where V is the set of vertices and E the set of edges.The computation is performed by firstly creating a graph state corresponding to G, and then applying a series of measurements ('measurement flow') to a subset of qubits.The BQC protocol is designed such that the server remains ignorant of the client's desired computation (blindness).Further, it ensures that the client can validate that the outcome is correct, even in the presence of some amount of noise or a malicious server (veriability).These properties are stated precisely in terms of the composable security properties of the protocol [24].For the protocol in full detail, we refer to [15].Here, we provide a short outline of the BQC protocol, and a simple model of how it is carried out.We then apply the results of Section III to study the performance of the protocol.

1) Protocol feasibility
The BQC protocol involves a series of rounds.In each round, the client sends |V | qubits to the server, and also a description of the measurement flow it should carry out.If the server is honest, it will then create a graph state by applying entangling gates corresponding to edges in E, carry out the corresponding measurement flow, and send the measurement outcomes back to the client.
The protocol involves interweaving two types of rounds: computation and test rounds.The computation rounds are used to carry out the client's desired computation.In these rounds, the computation measurement flow is encrypted in order to maintain blindness.The function of the test rounds is to check for deviations from the client's specified operations.Deviations could be due to noise, or the server being malicious.Each test round has the outcome of either pass or fail, and the protocol is aborted if the ratio of failed test rounds lies above a certain threshold.
Assuming the test round outcomes are i.i.d., the sufficient condition for verifiability that we will consider is given by as shown in [25].Here, p av is the average probability of failure of a test round, and γ is the inherent error probability of the BQP computation.The value k is an integer and is corresponding to the k-colouring chosen by the client.This is a partition of the set of vertices into k subsets, known as colours, such that there is no edge between two vertices of the same colour.For the relevance of this to the BQC protocol, see Appendix E-1 for a description of test rounds.
For deterministic computations (γ = 0), (39) simplifies to When the server is honest, the quantity p av is determined on the amount by noise, which could for example arise from imperfect local operations and measurements, or imperfect memory in the server.Further, in a networked setting where the client and server are distantly separated, the client may send its qubits to the server by making use of entanglement that has been established between the two parties.In this way, the performance of the protocol is directly dependent on properties of the quantum network architecture connecting client and server.In such architectures, however, there is in general a trade-off between rate and quality.In the case of this BQC protocol, demanding that the condition (39) is met then effectively places an upper bound on the rate of the protocol.
In the following, we consider a simple model of the network and device architectures, and provide a demonstration of how the methods presented in Section III may be used to find architecture parameters that maximise the protocol rate, given the constraint (39).

2) Model of network architecture
Our model of the quantum network architecture on which the BQC protocol is carried out is summarised in the bullet points below.A depiction is in Figure 8.
• The server is honest, meaning that it carries out all tasks specified by the client.The BQC protocol protects against malicious server activity, as well as being robust to noise.Here, we solely aim to quantify the effect of noise on the protocol.• Entanglement generation between client and server is performed with sequential attempts.Each attempt succeeds with probability p. • Upon entanglement success, a qubit transmission procedure takes place.We assume that each qubit comes into existence in the server memory at the end of the corresponding time step.
where I d is the d-dimensional identity matrix and t is the number of time steps for which ρ has existed at the server.For the case of a qubit, i.e. d = 2, the fidelity then decays as • To reduce decoherence, the server discards a qubit once it has been in memory for w time steps.• All local operations and measurements by the client and server devices are perfect and instantaneous.In particular, once all qubits required for the round are present in the server, it immediately and perfectly applies the measurement flow that has been specified by the client.• Before each round, the client chooses an element of V uniformly at random.The corresponding qubit is the first one sent.The client then cycles through the qubits from V in some pre-defined order.With this added randomness, the resulting order of the qubit ages will appear completely random.We continue with this assumption because it simplifies the resulting calculation of p av , by removing any dependence of the qubit ages on events that occurred beyond the last w time steps.More details of protocol test rounds are given in Appendix E. In our model, then, the fidelity of a qubit in the server depends only on the amount of time it has been stored there, and the entanglement generation success probability p.Notice that our set-up consists of the sequential attempted establishment of qubits at the server, and the discarding of these qubits after they have existed for a pre-defined number of time steps.We then have a situation analogous to that considered in the first part of this work, where the qubits function as the corresponding quantum resources.The methods given in Section III can then be applied to study this situation: the time taken to complete a round is τ (w,s) time steps, where s = |V | is the number of qubits required to produce a graph state, and τ (w,s) is the waiting time as defined in Section II.Furthermore, the qubit fidelities at the time when the server applies its entangling gates and measurements are determined by the ending pattern X (w,s) which finishes the process.More specifically, it is possible to calculate p av exactly using the ending pattern distribution.We briefly describe this now.
Suppose that during a particular test round, at the time the server will carry out its local operations and measurements, the fidelities of the server qubits are Then, given the model described in the previous section, it is possible to find a function that tells us the probability of error of a test round, P G ( F ).This is a polynomial in the values F i , and has a form dependent on the graph G and the choice of kcolouring.The details of how to obtain this function are given in Appendix E. An expression for the average probability of error of a test round is then where P( F ) is the probability of obtaining the particular fidelity vector F .Note that in the model introduced in the previous section, the qubit fidelities F are determined by the amount of time for which the qubits have been stored in the server.Moreover, recall that the ages of the links are contained exactly in the ending pattern X (w,s) .Writing this dependence as we then rewrite (43) to obtain an expression for the average probability of test round failure, This is a quantity that we can now evaluate using the methods introduced in Section III.In this way, the tools from Section III allow for the direct connection between the feasibility of the BQC protocol, as determined by p av , to its rate.Since the above formula for p av is dependent on the graph structure and k-colouring, some parameter regimes may be sufficient for some calculations but not others.For example, for more complicated graphs that require a larger k, the condition (39) is more strict.Further, if one chooses a different graph or kcolouring for the calculation, the polynomial P G may differ.

3) Numerical evaluation
We now aim to find optimal values of the architecture parameters p and w for one round of the protocol.By optimality, we mean that the expected time taken to carry out a round is minimised, while ensuring that the protocol is still feasible.Note that this does not necessarily mean optimality for the full protocol, which is comprised of multiple rounds.To optimise over the full protocol, one would to do a further optimisation over more protocol parameters (for example, the ratio of computation and test rounds), which we not not consider in this work.
There is a combination of trade-offs between rate and fidelity present in our scenario: firstly due to varying the success probability, and secondly due to varying the window size.An increase in p increases the rate at which successful links are generated, but decreases the initial fidelity of qubits in the server by an amount determined by F est (p).We would therefore expect that a smaller value of w is required to minimise decoherence at the server, to ensure that the condition (39) is met.This in turn increases the expected time taken to generate all necessary entangled links within the time window.More formally, given a fixed p, we may find the minimal expected time for one round with the following procedure.
1) Find the maximum value of w such that the protocol is still feasible for this value of p, w max (p) := max w : 2) Compute E τ (wmax(p),s) p .This is the minimum expected time for one round.As an example of this method put into practice, we consider the case where the client would like to perform a BQP calculation on a square graph, so that |V | = 4.This requires s = 4 entangled pairs to be produced within the time window.For simplicity we will consider deterministic computations, so that the requirement on the probability of error is p av < 1/2k.In this case, k can be chosen to be 2 (see Appendix E for an example of a 2-colouring of a square graph), and the sufficient condition becomes p av < 1/4.
In Figure 9, the minimum expected time to carry out a round is plotted against p for three different values of the memory lifetime parameter T , and F 0 (p) = 1 − λp.We choose λ = 1 2 in order to best display the behaviour of the solution, given our computational resources.In particular, the range of p that we plot is chosen to clearly show the region of the optimal combination of the two trade-offs.For small p, the expected waiting time is high due to the small entanglement generation probability.For large p, it is high due to the small window size required due to the decrease in F est .We therefore see a region in the middle of the plot where the average waiting time is minimal, or equivalently, the rate at which rounds can be carried out is maximal.For larger T , the decoherence of qubits in memory is reduced, and so it is possible to have a larger window size without disrupting the condition on p av .We thus see that the expected time for one round decreases with T .Further, there are sharp peaks in the plots for each T , which are due to the discrete nature of w.This can be explained as follows: in the middle of two peaks, it is possible to increase the value of p without disrupting the condition (39).However, there will come a point where this condition is in fact an equality, which is when the window cut-off must be made smaller.This causes a discrete jump to a higher expected time.We assume calculations on a square graph, which requires four entangled links to be produced within a time window.

FIGURE 10. Minimum expected time for one round of a BQC calculation vs. window size.
For each window size 4 ≤ w ≤ 15, we find the maximum success probability (47), and then use this to compute the expected waiting time.We assume calculations on a square graph, which requires four entangled links to be produced within a time window.
One can do something similar when varying the window size.Given a fixed w, we find the minimum expected time for one round with the following steps.
1) Find the maximum value of p such that the protocol is still feasible, 2) Compute E τ (w,s) pmax(w) .In Figure 10, the minimum expected time to carry out a round is plotted against the window size.This is again in the case of a square graph, for the same three values of the memory lifetime parameter T .We see a similar behaviour as when varying the success probability: a smaller w induces a larger expected time.When s is larger, qubits are subject to more decoherence, and in order to keep condition (39) it is necessary to decrease the success probability.This is what induces a larger waiting time for larger w.We therefore again see an optimal region of w for which the expected time to carry out one round of the protocol is minimised.
Finally, we note that in practice, in order to optimise the full BQC protocol, one would need to consider how other aspects of the set-up, such as hardware, architecture and protocol, affect the performance.The simple scenario chosen in this work was to highlight the application of the results of Section III.We see from Figures 9 and 10 that for such values of T and s, the methods from Section III enable one to make a careful choice of (w, p) that can improve the rate of rounds of the protocol by two or three times, in comparison to other non-optimal choices of (w, p) that are also sufficient for protocol feasibility.

V. FURTHER DIRECTIONS
With the methods presented in this work, we focus on computing both the first and second moments of τ (w,s) , and the full distribution of X (w,s) .We have seen that for w finite and s > 2, the formulae given here to compute E(τ (w,s) ) and the distribution of X (w,s) are in the form of linear systems that scale as |Ω(w, s)| + 1.If one would like to compute the full ending pattern distribution, then this seems to be a good scaling, since the outcome is comprised of |Ω(w, s)| probabilities.However, if one is for example only interested in E(τ (w,s) ) (e.g. for computing a protocol rate), then for certain regimes of w and p it may be useful to consider a continuous approximation, where the time between successful resource generation attempt is exponentially distributed.Such a case is often considered in the scan statistics literature (for example, see [20]).However, the computation of the ending pattern in the continuous case is not immediately clear.
We also note that a useful tool of approximation would be to further understand the asymptotic scaling hightlighted by Theorem 3.More specifically, it would be interesting to know exactly how fast is the approach of (33) and (34), in terms of s and w.
In the set-up of the problem, one could also consider a more realistic model of a quantum network architecture.For example, there may be parameter drift, when the success probability decreases over time due to increased noise.Further, in the more general case where the sequential attempts are not necessarily independent but Markovian, methods similar to those used in this paper may again be applied to the problem -see [19], for example.modo award (SW).BD, TB, and SW acknowledge support from the Quantum Internet Alliance (EU Horizon Europe grant agreement No. 101102140).GV was supported in part by the NWO ZK QSC Ada Lovelace Fellowship. .

APPENDIX A (IDENTITIES FOR THE CASE OF TWO RESOURCE STATES)
1) Evaluation of E(τ (w,2) ) Evaluation of E(L).Recalling from ( 13) the distribution of L, we have where to evaluate the sum we have used the identity for a geometric series.
Proof that E M j=1 T j = E(M )E(T 1 ).This is used to evaluate the expectation E(τ (w,2) ).The random variables M and {T j } are independent, and since the {T j } are identically distributed, 2) Evaluation of Var(τ (w,2) ) Recall M , T j and L, as given in Section III-B1.These are independent, M and T have distributions M ∼ Geom(1 − (1 − p) w−1 ), T j ∼ Geom(p), and L has distrbiution as given in (13).From (15), we have where we have used the identity Var(X + Y ) = Var(X) + Var(Y ) + 2 • Cov(X, Y ).We now evaluate (49) term by term.Firstly, Thirdly, It now remains to evaluate Var(L).We firstly calculate We are now equipped to compute the full variance of τ (w,2) , where one may find a closed-form expression by inputting the standard identities for a geometric random variable, which are

APPENDIX B (ENDING PATTERN DISTRIBUTION AND WAITING TIME MOMENTS IN THE CASE OF A FINITE WINDOW SIZE)
1) The waiting time is well-defined We show here that τ x can be bounded above by a geometrically distributed random variable.Using the notation p 1 = p, p 0 = 1 − p for an ending pattern x ∈ Ω l (s), this exact sequence will appear in any given l consecutive trials Z i−l+1 , ..., Z i with probability Each Y n is then Bernoulli with parameter γ x .It takes the value 1 if the nth segment of l trials exactly matches with x.There is then an associated waiting time random variable τx that is geometric with parameter γ x , Moreover, the waiting time to see x satisfies τ x ≤ τx • l.
Taking expectations yields which completes our proof.We note that the same method can be used to show that all moments of τ (w,s) are finite.
2) The expected waiting time of a simple pattern Using the theory of martingales and a helpful gambling analogy to aid understanding, we now derive a way to numerically compute the ending pattern distribution {P(x) : x ∈ Ω(w, s)}, and the first and second moments of the waiting time τ (w,s) , in the case of a finite window size.The result of this is Theorem 1 in the main text.The method was introduced in [26], where they consider the more abstract case of a general sequence of discrete i.i.d random variables, and a general set of ending patterns.Here, due to its relevance to the subject of the main text, we continue with the case of i.i.d.Bernoulli trials.
It will be useful to first of all consider the case where we wait for an instance of a single pattern x = (x 1 , ..., x l ) ∈ {0, 1} l , instead of waiting for any instance of the set Ω(w, s).The former case is referred to as a simple pattern and the latter as a compound pattern.In this section we will find an exact expression for E(τ x ).Here, τ x refers to the waiting time until seeing the pattern x, and is defined in (5).
To provide intuition, we introduce the following scenario of gamblers in a casino.Suppose that just before the first trial is realised, a gambler, hereinafter referred to as Gambler 1, bets 1 on the outcome {Z 1 = x 1 }.We also suppose that the odds are fair, so that if this is the case then she wins Moreover, if she wins, then she straight away bets all of these winnings on the outcome {Z 2 = x 2 }.If not, the casino keeps her 1 and she doesn't place any more bets.For a general n, Gambler 1 then proceeds at the nth trial in a similar way: if she has yet to lose, she bets all of her winnings on the outcome {Z n = x n }, and if not, she doesn't place any bet.Furthermore, at every trial we introduce a new gambler who behaves in exactly the same way, so that Gambler 2 bets 1 on the outcome {Z 2 = x 1 }, and continues betting all of her winnings on the subsequent rounds being equal to the next entry of x, up until she loses a round.Gambler j bets 1 on the outcome {Z j = x 1 } and continues with exactly the same strategy.The game stops when the sequence x first appears, which by definition is at the τ x th trial.
Our aim now is to write down an expression for the combined net gain of the gamblers after the nth trial, for a general n.In order to do this concisely, we recall the definition (21) of the quantities δ (a,b) .Given a realisation C n := (c 1 , ..., c n ) of the first n trials, the winnings of Gambler j after the nth round can then be written as Here, we see that the functions δ (a,b) allow us to elegantly write down a Gambler's winnings.With this in mind, the combined winnings of the gamblers after the n'th trial is where we have introduced the function * that was defined in (20), and that maps two binary strings to a scalar value.From (67), we see that the net gain of the jth gambler after the nth time-step is simply and similarly, the total net gain of the gamblers after the nth trial is We can now define a sequence of random variables (G n ) n≥0 , which take the value of the total net gain of the gamblers after each round.In particular, after the game ends, the total net gain is Note that x * x is a quantity that is only dependent on the pattern x.Since the game is defined to be fair at every round, the expected total net gain when the game finishes would intuitively be equal to zero, i.e.
A neat expression for the expected waiting time to see the sequence B follows by making use of the linearity of expectation, To prove (73), we make use of the fact that (G n ) n≥0 is a martingale, for which the following properties must hold: To show (i), we use the definition (72), and see that since the waiting time τ x is well-defined, and x * C n is bounded.To show condition (ii), we use the fact that the game is fair at each round.Suppose that we have the maximum amount of information about what has happened in the first n trials, i.e. we know that they have taken the values (c 1 , ..., c n ).Then, the conditional expectation of G n+1 satisfies where to go to the final line, we have made use of the definition of G (j) .Since the realisations of (Z 1 , ..., Z n ) completely determine the values of G 1 , ..., G n , this also shows (ii).
We now know that (G n ) n≥0 is a martingale.However, this is not quite enough to show (73), which is what is required to obtain the final simple form for E(τ x ).In particular, some extra machinery is needed, in the form of Doob's optional stopping theorem, a proof of which can be found in [27].A version of this is stated below.
Theorem 4 (Optional stopping).Let G n be a martingale and τ a stopping time.Suppose that there exists a constant K All that remains to be done is to show that the martingale defined in (72) satisfies the required properties to satisfy Theorem 4. Firstly, we have where Secondly, we see that since τ x is bounded above by a geometric random variable, it is a.s.finite.This gives us (73).

3) Starting from another pattern
We now adapt the results above in order to find the expected time to see x, given that we start already with some pattern y.We extend the gambling analogy in order to illustrate this concept, and suppose that we want to calculate the expected time until seeing y only after some number of rounds, m, say, have been realised.In particular, after the mth round we know the first m realisations of the i.i.d Bernoulli sequence, and we call these y = (y 1 , ..., y m ).At this point, the net gain of the gamblers is thus G m = x * y − m.We will evaluate the net gain of the gamblers compared to this point after each of the n trials, which for n ≥ m we denote by Gn .This is simply given by where C n is no longer completely general as its first m entries must correspond to y.Using the same reasoning as before, one can show that ( Gn ) n≥0 is a martingale.Then, defining τ xy as the waiting time to see x given that we have already seen pattern y, it is again possible to use Theorem 4 to show that and so by the linearity of expectations, We may now use the results derived above to derive a formula for E(τ (w,s) ) and the distribution of X (w,s) .Given x ∈ Ω(w, s), we write Where we have noticed that E(τ x − τ (w,s) |X (w,s) = y) = E(τ xy ).Applying Theorem 4 and enforcing the condition that the ending pattern probabilities must sum to one then yields the formula (23).
4) Formula for the second moment of the waiting time An extension to the gambling analogy given above can be used to derive the formula for the second moment of the waiting time, for which we refer to [19].Here, we will only state the formula.We first of all define a new operation † that maps two elements x, y ∈ Ω(w, s) to a real number.If x = (x 1 , ..., x k ) and y = (y 1 , ..., y m ), Letting Ω ≡ Ω(w, s), the second moment of τ (w,s) can be found through solving the following systems Theorem 5. Let {u j } 1≤j≤|Ω| and {v j } 1≤j≤|Ω| solve the linear systems with W ij := x (i) * x (j) and N ij := x (i) † x (j) .Then, Code that makes use of this formula to compute E τ 2 (w,s) is provided in [28].

1) Infinite window size approximation
Proof of Theorem 2. Letting ≡ (w, s, p) = P(τ (w,s) > w), the expectation of τ (w,s) can be rewritten as Now, note that for n ≤ w i.e. for this range of n the distributions of τ (w,s) and τ (∞,s) exactly match.We can thus rewrite (85) as where to obtain the last equality we have expanded E(τ (∞,s) ) in the same way as (85).Now, if one considers starting the whole process again after the first w time steps, we see that E τ (w,s) |τ (w,s) > w ≤ w + E(τ (w,s) ).Combining this with the fact that E(τ (∞,s) |τ (∞,s) > w) > w, we find that from which (25) follows.
Proof of Lemma 1.Here, we show the identity ( 29) for (w, s, p).Letting q = 1 − p, we have 2) Asymptotic behaviour of the expected waiting time and ending pattern Proof of Theorem 3.For conciseness, here we take Ω ≡ Ω(w, s).A formula for the inverse of A is given in terms of its adjugate matrix adj A [29], where M ij is the |Ω| × |Ω| matrix obtained by removing row i and column j from A. Since A is invertible, the inverse is Now consider the system (23).If we consider solving for v by multiplying through by A −1 , we see that its first element is where B is the |Ω| × |Ω| matrix obtained by removing the first row and column from A, so that B ij = x i * x j .Since all the entries of A are polynomials in 1/p and 1/q, so are det B and det A.
To proceed with showing (33), we characterise the scaling of det B and det A for small p.Since q = 1 − p is close to 1 for small p, it suffices to only consider the powers of 1/p for the analysis of the asymptotic scaling as p → 0 (recalling the definition of the star product (20)).We firstly consider det B. With the observation that the higher-order terms in 1/p are given by the star products on the diagonal, and moreover that these each have leading order term given by 1/p s .The form of det B, then, is a polynomial of maximum degree 1/p s|Ω| .In fact, this is exactly the degree.One can compute this contribution by considering the matrix B of highest powers: letting r ≡ 1/p s , we have det B ∼ det B, where and hence, det B ∼ r |Ω| = 1/p s|Ω| .We then do the same with A. In this case, det A ∼ det Ã, where where the existence of a 0 in the top left-hand corner now disrupts the evaluation of det Ã by multiplying along the diagonal, as we did above.Our next step is to evaluate det Ã by expanding along the top row, where Ãk is the |Ω|×|Ω| matrix formed by removing the first row and the kth column from Ã, In Ãk , the r's are placed above the diagonal in rows 1, ..., k − 1, and on the diagonal in rows k + 1, ..., |Ω|.The determinant of Ã1 may be calculated by simply multiplying the diagonal elements, to obtain We then notice that any Ãk can be transformed into Ã1 by moving the kth row to the top row.This can be achieved by performing k − 1 row operations, if it is moved by successively exchanging with the row above it k − 1 times.Then, since each row operation incurs a factor of (−1) k , With (92), we then see that and so det A ∼ |Ω|/p s(|Ω| −1) .Substituting into (89), we find To show (34), we employ a similar method.We have from (88) that where C k is obtained by removing the first column and kth row from A, where in C k the x-entries are placed below the diagonal in columns 1, ..., k − 1, and on the diagonal in columns k +1, ..., |Ω|.We note that C k is the transpose of B k , with the first column multiplied by a scaling factor of −1.Therefore, det C k = − det B k = (−1) k+1 r |Ω|−1 , and making use again of (96), from which the result follows.

APPENDIX D (TRADE-OFF FUNCTION DUE TO ENTANGLEMENT GENERATION SCHEME)
In this appendix, we motivate the linear trade-off function F est = 1 − λp used in the BQC analysis, which describes the fidelity of qubits in the server immediately after transmission.Let σ denote the noisy two-qubit entangled state that is produced between the client and server when there is a successful attempt.When there is a success, the client and server perform some qubit transmission procedure Λ σ , which could for example be teleportation, or a remote state preparation protocol.We assume that this protocol establishes all qubits in the server with the same fidelity F est .For example, this is the case if the noisy entangled state is depolarised and the standard teleportation protocol from [30] is applied.
Here, F 0 = Φ + | σ |Φ + is the fidelity of σ to the target state.This involves performing a full measurement in the Bell basis {|Φ ij } and applying the corresponding Pauli corrections.If |ψ is the qubit state to be teleported, its action is given by Λ st , (103) where the Bell measurement acts on the registers containing the qubit state |ψ and the first qubit of σ.Suppose that the entangled state and qubit transmission procedure are given by ( 102) and (103).Then after transmitting any qubit |ψ , the resulting fidelity is [31] Now, one can incorporate a general rate-fidelity trade-off inherent to the entanglement generation protocol by specifying that F est is a decreasing function of p.In particular, we draw here on an example from the single-photon scheme for entanglement generation.When implementing a singlephoton scheme [6], the fidelity of generated states is where p suc is the success probability of a physical entanglement attempt, and p det is the probability of detecting an emitted photon.In the case of a very small p suc , one might want to perform entanglement attempts in batches in order to minimise overhead due to communication with higher layers of the software stack (which must be notified when there is, or is not, a success).This scheme has been implemented with NV centres in diamond, where typically p suc 1 [32].If this is the case, choosing one time step to correspond to a batch of M 1/(p suc ) 2 attempts, the probability of producing at least one entangled link in a time step is Substituting this into (104) and (105), we obtain a trade-off function of where λ := 1/(3M p det ).Since M is a freely adjustable parameter, then so is λ.The simple relationship (107) is also a general first-order behaviour for a decreasing function in p such that F est (0) = 1, which justifies the choice as potentially applicable to other hardware and entanglement generation protocols.

APPENDIX E (COMPUTING THE ERROR PROBABILITY OF A BQC TEST ROUND) 1) Test rounds
As mentioned previously, the protocol involves interweaving test rounds at random with computation rounds.It is the test rounds that provide verifiability of the protocol, because they allow the client to check for deviations from the ideal measurement outcomes.Recall that the goal of the client in the BQC protocol is to perform a BQP computation, which is defined in the measurement-based formalism with respect to a graph G = (V, E).In one round of the protocol, the client transmits |V | qubits to the server, which (if it is honest) creates a graph state by applying CZ-gates to pairs of qubits as given in the set of edges E. Before carrying out the protocol, the client chooses some k-colouring {V j : j = 1, ..., k}, which is a partition of the set of vertices V into different subsets, known as colours, such that there is no edge between two vertices of the same colour.This k then corresponds to the k in the feasibility condition (39).Before each test round, the client chooses a colour V j uniformly at random to be the trap colour.A qubit corresponding to vertices from this set is then referred to as a trap qubit.Any other qubit is referred to as a dummy qubit.Each trap qubit v ∈ V j will be |+ θv := (|0 + e iθv |1 )/ √ 2, for some angle θ v that is chosen uniformly at random from Θ = { kπ 4 : k = 0, 1, ..., 7}.Each dummy qubit v ∈ V \ V j will be |d v , where d v ∈ {0, 1} is chosen uniformly at random.Then, the effect of the server applying its entangling gates is to flip each trap qubit to the orthogonal basis vector a number of times that corresponds to the sum (modulo 2) of the neighbouring dummies.This is a quantity that the client can compute.After constructing the graph state, the server measures its qubits and sends the outcome to the client.The trap qubit measurement basis that is specified by the client is {|± δv }, for each trap v ∈ V j , where δ v = θ v + r v π, and r v ∈ {0, 1} is chosen uniformly at random.The client compares the outcomes of the trap qubits to what is expected if all states and local operations are perfect, declaring the test round to be a failure if there is at least one trap measurement that is incorrect.A depiction of a graph state, a choice of kcolouring, and a choice of qubits for a test round is given in Figure 11, for the case of a square graph.

2) Error probability for a general graph
We suppose that the client would like to know the outcome of a BQP calculation, which has corresponding graph G = (V, E), and that the client has chosen a k-colouring {V j } k j=1 .Then, given that the vector of fidelities at the time the server applies its operations is F = (F 1 , ..., F |V | ), here we obtain a general form for the probability of error of the test round, P G ( F ).This is a generalisation of what can be found in [25], where BQC with two qubits is considered.
We firstly find the probability of error, given that the client has chosen trap colour V j .Call this P Vj .The client thus chooses to send the trap qubits v ∈ V j as states |+ θv .Then, at the time when the test round is carried out, the trap qubits corresponding to vertices v ∈ V j are each in a state ρ v , where where we use (o.d.1) to write the off-diagonal elements (with respect to the basis {|+ θv , |− θv }).We don't write them out in full because these end up making no contribution to P Vj ( F ), as we will see later.Similarly, the dummy qubits v ∈ V \ V j will be in the state where here we use (o.d.2) to write the off-diagonal elements, this time with respect to the computational basis.The state of the server is then given by the tensor product of all of these states where we have defined W j ⊂ V \ V j to be the set of all vertices that share an edge with a trap qubit.The server then proceeds with the next step of the BQC protocol, and applies CZ gates to all pairs of qubits corresponding to edges in E, resulting in the state where U := (w,v)∈E CZ (w,v) .Recall that we are interested in the probability P Vj ( F ) that the this results in an error.In fact, is it simpler to find a form for the success probability Q Vj ( F ) = 1 − P Vj ( F ).An error occurs when at least one of the trap qubit measurements does not match the result that would be obtained if all states were perfect.In particular, if everything were perfect, then the client would expect the measurement outcome corresponding to the trap qubit v to be r v ⊕ D v , where i.e. the sum (modulo 2) of all the dummy variables d v that surround the trap qubit.The success probability is then given by we see that the qubit registers corresponding to vertices v ∈ V \ (V j ∪ W j ) will make no contribution to this quantity, so that where we have defined σ server := v∈Vj ρ v w∈Wj ρ w and Ũ := (w,v)∈Ej CZ (w,v) , and E j := {(v, w) ∈ E : v ∈ V j } to be the set of all edges between any element of V j and any other vertex.Recalling the states of our qubits as given in ( 108) and (109), and defining F (0) := F , F (1) := 1 − F to be used as a more concise way to write some of the terms, we can then write where in (116) we have rewritten the sum to be over all length-|W j | binary strings y ≡ (y w ) w∈Wj ∈ {0, 1} |Wj | .We have also stored the dummy variables in a vector d, so that ( d + y) w = d w + y w .Again, we are not writing out the off-diagonal terms because these all disappear when we take the trace, and therefore make no contribution to the final expression.Applying the unitary operator Ũ yields This is a polynomial in the fidelities F = (F 1 , ..., F |V | ), with a form that is completely determined by the graph structure and choice of trap colour V j .The same thus holds for the error probability P Vj ( F ).In our model as given in Section IV-B2, it is further necessary to incorporate the fact that the first qubit to be sent is chosen at random.The probability of error is then effectively symmetrised over the |V | possible starting qubits in the following way.Without loss of generality, letting the order in which the qubits are sent to be lexicographical, the probability of error is then where σ is the permutation that moves the vector elements one place to the left, i.e. σ(F 1 , ..., F |V | ) = (F 2 , ..., F |V | , F 1 ).
To obtain the final probability of error, it remains to average over the choice of trap colour, recalling that this is chosen uniformly at random.This gives us a final expression for P G ( F ), 3) Error probability for a square graph An example of such a polynomial for the case of a square graph is as follows.Consider the k-colouring as in Figure 11, with red as the choice of trap colour.Suppose that when the server applies its gates and measurements, the qubits have fidelities F = (F 1 , F 2 , F 3 , F 4 ).Then, according to (118), the success probability is given by and the error probability is then By symmetry of the square graph, the error probability P yellow ( F ) is obtained by exchanging the indices 1 ↔ 2, 3 ↔ 4 in (121).In the case of the square graph, the symmetrisation maps P red ( F ) → Pred ( F ), where Pred ( F ) = 1 4 P red (F 1 , F 2 , F 3 , F 4 ) + P red (F 2 , F 3 , F 4 , F 1 ) + P red (F 3 , F 4 , F 1 , F 2 ) + P red (F 4 , F 1 , F 2 , F 3 ) .
Note that the symmetries of the error functions P red and P yellow reflect the symmetries of the graph, i.e. they are symmetric under the interchange of 1 ↔ 3 or 2 ↔ 4.Then, The other error function P yellow maps to the same after the symmetrisation (119), i.e.Pyellow ( F ) = Pred ( F ).The probability of error, then, is given by This is the function that we use with (45) to calculate p av for our model, and compute the results for an example of a square graph in Section IV-B3.

FIGURE 6 .
FIGURE 6.Comparison of thresholds on w for the infinite window approximation.One may use w * (green line) as a threshold, which is more easily computable than w * true (red cross).See (35) and (36) for the definition of these quantities.Here we assume a desired error of 2%.

FIGURE 7 .
FIGURE 7. Comparison of thresholds on p for the infinite window approximation.One may use p * (green line) as a threshold, which is more easily computable than p * true (red cross).See (37) and (38) for the definition of these quantities.Here we assume a desired error of 2%.

FIGURE 8 .
FIGURE 8.The scenario considered for the model of BQC.Generation of the entangled link is attempted sequentially, with success probability p. Upon success, the entangled link is immediately used to transmit qubits from the client to the server.While in the server, qubits (numbered grey circles) undergo decoherence (brown clock).Qubits are discarded from the server after they have existed for w time steps.

FIGURE 9 .
FIGURE 9. Minimum expected time for one round of a BQC calculation vs. success probability of entanglement generation.For a given value of p, we find the maximum window size (46), and then use that to compute the minimum expected waiting time.Here, p is discretised into 100 values of p that are evenly spaced in the range [0.04, 0.1].We assume calculations on a square graph, which requires four entangled links to be produced within a time window.

FIGURE 11 .
FIGURE 11.Test rounds in the BQC protocol.Here we choose an example where the computation is performed on a square graph.The client chooses a k-colouring: here k = 2, and the two sets are coloured in yellow and red.In this case, the red vertices correspond to trap qubits, and the yellow vertices correspond to dummy qubits.

F
(yw)   w |d w + y w d w + y w | trap v ∈ V j , we have defineds v ( y) := w∈Wj :(w,v)∈Ej y w ,(117)which is the sum of the binary variables y w over all vertices neighbouring v.We can now start to trace out registers in order to find a final expression for Q Vj ( F ) in terms of the qubit fidelities.Taking the inner product (−1) Dv δv |...|(−1) Dv δv for all trap qubits v ∈ V j and tracing out W j yields our final expression for the success probability as introduced in Equation (113),Q Vj ( F ) = y∈{0,1} |W j | w∈Wj F (yw) w v∈Vj

•
Immediately after transmission, each qubit is established with fidelity F est (p), where F est : [0, 1] → [0, 1] is a decreasing function.In this way, we include a trade-off between rate and fidelity that is inherent to the entanglement generation process occurring between client and server.In the following, we choose this to be F est (p) = 1 − λp.Motivation for this choice of F est is given in Appendix D.
• While they are stored in the server, qubits are subject to depolarising noise with a memory lifetime of T time steps.For a d-dimensional density matrix ρ ∈ D(H d ), this has action