Worst-case Fidelity Certification

• Worst-case fidelity certification is a method to rigorously lower-bound the fidelity between a quantum state or process and a target, even under adversarial conditions.
• It employs statistical tests, convex optimization, and self-testing protocols to certify performance with minimal, device-independent assumptions.
• Experimental and theoretical studies show that small classical admixtures (around 5%) can substantially reduce certified fidelity, emphasizing the need for conservative performance thresholds.

Worst-case fidelity certification is the process of determining rigorous lower bounds on the fidelity between an unknown quantum state or process and a prescribed target, regardless of the particular adversarial or statistical scenario. This notion is central to quantum device benchmarking, quantum cryptography, and quantum algorithm robustness, as it provides device- and attack-agnostic guarantees that are essential for practical security and reliability. The field spans explicit protocols for pure states, mixed states, quantum channels, multi-photon states in optical networks, and adversarial scenarios such as eavesdropping or coherent errors. Theoretical frameworks and experimental methods employ statistics, convex optimization, self-testing, and adversarial modeling, and must often operate under minimal and device-independent assumptions.

1. Conceptual Foundations: Definition and Adversarial Context

Worst-case fidelity certification seeks the minimal guaranteed fidelity $F_{\min}$ (or related figure of merit) between a prepared state (or implemented operation) $\rho$ and a desired target $\sigma$, across all possibilities consistent with observed data or imposed constraints. Unlike average-case or pointwise methods, worst-case certification addresses the strongest adversarial scenarios, including adaptive eavesdropping, coherent systematic errors, and device-internal imperfections unknown to the experimenter.

A canonical adversarial scenario, relevant in quantum key distribution (QKD), is formalized as an admixture model:

$\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$

where $\rho_Q$ is the ideal quantum object, $\rho_C$ is a classical (e.g., local hidden variable) mimic constructed by an adversary, and $\mu$ quantifies nonquantum admixture. The certified fidelity is then

$F(\mu) = 1 - \mu(1 - F_C),$

where $F_C = \mathrm{Tr}[\rho_C \rho_Q]$; with worst-case $F_C=0$, the bound is $\rho$0 (Tasar, 4 Dec 2025).

Empirical data show that for QKD protocols, the presence of merely $\rho$1 classical admixture ($\rho$2) suffices for complete detector failure (ROC AUC $\rho$3), entailing a worst-case certified fidelity bound $\rho$4 (Tasar, 4 Dec 2025). Thus, security claims must treat observed fidelities $\rho$5 with extreme caution.

2. Theoretical Bounds and Sample Complexity

The cost of worst-case fidelity certification is determined by the dimensionality of the state or channel, the distance parameter $\rho$6, and, for channels, the allowed measurement and memory model.

For quantum states, given a $\rho$7-dimensional target $\rho$8, certification up to infidelity $\rho$9 requires

$\sigma$0

copies—provably optimal up to constants—with explicit protocols based on Bures–$\sigma$1-observables and depolarization (Bădescu et al., 2017). For trace distance certification, the cost is $\sigma$2.

When adaptive/incoherent quantum memory is available, coherent certification of $\sigma$3-dimensional unitary channels up to diamond distance $\sigma$4 costs

$\sigma$5

while incoherent algorithms require $\sigma$6. This quadratic quantum-memory advantage reflects an exponential worst-versus-average-case gap, with typical-channel certification requiring only $\sigma$7 queries (Jeon et al., 23 Jul 2025). For quantum state certification with entangled measurements, the instance-optimal copy complexity is

$\sigma$8

where $\sigma$9 is the fidelity to the maximally mixed state (O'Donnell et al., 8 Jul 2025).

3. Protocols and Certification Techniques

A. Stabilizer and Structured Pure-State Certification

Targeted stabilizer states admit efficient schemes measuring $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$0 local Pauli generators. The worst-case fidelity bound from empirical expectation values $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$1 is:

$\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$2

Samples $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$3 suffice to $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$4-relax the bound with high confidence (Kalev et al., 2018).

Parent-Hamiltonian methods produce a variational worst-case bound: for a nondegenerate, gapped Hamiltonian $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$5 with $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$6 as unique ground state,

$\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$7

where $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$8 is the spectral gap (Nadon et al., 4 Mar 2026). Local expectation values of $\rho_{\text{mix}} = (1-\mu)\,\rho_Q + \mu\,\rho_C,$9's terms are measured; classical post-processing yields the certified lower bound.

B. Device-Independent, Bell-Test–Based Certification

Device-independent protocols leverage observed statistics $\rho_Q$0 and self-testing theory. The swap-based semidefinite programming (SDP) hierarchy can lower-bound the fidelity to a target from the measurement data alone, with no trust in the device internals (Yang et al., 2014). For example, any observed CHSH value $\rho_Q$1 certifies a worst-case fidelity $\rho_Q$2 obtainable as the minimum feasible swap-ancilla fidelity under the SDP constraints imposed by $\rho_Q$3.

Statistical protocols using martingale-based or prediction-based-ratio (PBR) hypothesis testing allow certification at prescribed confidence level $\rho_Q$4 without i.i.d. assumptions. Certification proceeds by rejecting the null $\rho_Q$5 ("fidelity $\rho_Q$6") at significance $\rho_Q$7 for the best achievable $\rho_Q$8 (Chang et al., 2024).

C. Photonic and Linear-Optical State Certification

For linear optical platforms, the worst-case LOQC fidelity $\rho_Q$9 is defined as the maximum overlap between the prepared state and the entire equivalence class of "ideal" outputs under mode-insensitive measurements. Witnesses using photon-reversibility and permutation-symmetry, particularly via the discrete Fourier transform (DFT) suppression laws, allow tight, sample-efficient bounds:

$\rho_C$0

where $\rho_C$1 is photon-reversibility and $\rho_C$2 the forbidden-output probability after the DFT (Schadow et al., 12 Feb 2026).

4. Channel and Quantum Circuit Certification

For quantum operations (channels or circuits), certification requires bounding the worst-case (minimal) fidelity over all possible input states, which is tightly connected to the diamond distance:

$\rho_C$3

and

$\rho_C$4

Statistically tight formulas relate diamond distance and spectral characteristics of error unitaries, with average fidelity $\rho_C$5 and fidelity deviation $\rho_C$6 jointly bounding the worst case:

$\rho_C$7

where $\rho_C$8 is a function of the spectral moments inferred directly from measurement (Cho et al., 8 Mar 2026).

Robust quantum algorithm design in noisy settings proceeds by computing worst-case fidelity bounds for arbitrary coherent or Markovian error models, including set-based (uncertainty-constrained) formulations. For an $\rho_C$9-qubit circuit of depth $\mu$0 with gate errors of norm $\mu$1 and robustness parameter $\mu$2, the certified bound is (Berberich et al., 10 Sep 2025):

$\mu$3

Algorithm compilation and pulse-sequence optimization can then minimize $\mu$4 to enhance worst-case robustness.

5. Experimental and Adversarial Limits

Practical hardware validation highlights the limitations of conventional certification. Adversarial machine-learned attacks (e.g., Eve-GAN) can bypass all tested detectors with as little as $\mu$5 classical admixture, even exceeding the CHSH value attainable on real quantum hardware ($\mu$6 vs $\mu$7) (Tasar, 4 Dec 2025). Calibration strategies using same-distribution train-test splits systematically overestimate detector reliability; rigorous cross-distribution protocols yield correct, lower bounds.

Empirical photonic experiments using DFT witnesses routinely obtain worst-case certified fidelities $\mu$8 for random unitaries at photon overlaps $\mu$9 (Schadow et al., 12 Feb 2026). In device-independent self-testing, CHSH violations $F(\mu) = 1 - \mu(1 - F_C),$0 guarantee singlet fidelities $F(\mu) = 1 - \mu(1 - F_C),$1, and state-of-the-art solid-state memory experiments have certified $F(\mu) = 1 - \mu(1 - F_C),$2 under weak fair-sampling assumptions (Sekatski et al., 2023).

6. Methodological Pitfalls and Best Practices

Certification protocols can exhibit systematic loopholes when adversarial scenarios are not included, particularly when detection models are calibrated on nonindependent data distributions. Recommendations include:

• Always employ cross-distribution calibration and adversarial (GAN-style) mimicry in the test suite (Tasar, 4 Dec 2025).
• For quantum key distribution, conservatively require certified fidelities $F(\mu) = 1 - \mu(1 - F_C),$3 in routine operation.
• Device-independent confidence intervals must be constructed using explicit hypothesis-rejection strategies (martingale or PBR) and semidefinite programming formulations, optimized to the statistic of interest (Chang et al., 2024).
• Worst-case bounds, not mean or typical-case values, must be reported for cryptographic and fault-tolerant applications.

7. Comparative Summary of Protocol Classes

Scenario	Figure of Merit	Sample Complexity / Cost	Methodology	Canonical Reference
State (pure, known)	$F(\mu) = 1 - \mu(1 - F_C),$4	$F(\mu) = 1 - \mu(1 - F_C),$5	Stabilizer/parent Hamiltonian	(Kalev et al., 2018, Nadon et al., 4 Mar 2026)
State (arbitrary, mixed)	$F(\mu) = 1 - \mu(1 - F_C),$6	$F(\mu) = 1 - \mu(1 - F_C),$7	Bures-$F(\mu) = 1 - \mu(1 - F_C),$8 observable	(Bădescu et al., 2017)
State (fully general)	$F(\mu) = 1 - \mu(1 - F_C),$9 under statistics	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$0	SDP-based self-testing, martingale/PBR	(Yang et al., 2014, Chang et al., 2024)
Channel/unitary	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$1, diamond distance	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$2 incoh., $F_C = \mathrm{Tr}[\rho_C \rho_Q]$3 coh.	QSVT, spectral-moment estimation	(Jeon et al., 23 Jul 2025, Cho et al., 8 Mar 2026)
Linear optical	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$4 (max. overlap with LOQC equiv. class)	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$5 samples (DFT witness)	DFT-based indistinguishability witness	(Schadow et al., 12 Feb 2026)
QKD/adversarial	$F_C = \mathrm{Tr}[\rho_C \rho_Q]$6 below adversarial threshold	-	GAN-simulated attacks, cross-distribution	(Tasar, 4 Dec 2025)

Worst-case fidelity certification thus forms a backbone for reliable assessment of quantum experiments, cryptography, and computation, enabling principled claims of correctness and robustness even in the presence of unknown or malicious imperfections.