Delegating quantum generative models to a remote server: the sampling protocol now estimates the corrupted-sample rate, not just accept or abort

Inference sampling for a quantum generative model can be delegated to a potentially malicious remote quantum server while the client still judges whether the returned samples came from the agreed circuit. Earlier verifiable blind sampling was based on the Mahadev protocol, so its security rested on computational assumptions and it was harder to run on near-term devices; accreditation protocols instead assume an honest device whose noise fits modelling assumptions. The protocol amortizes verification overhead across rounds rather than verifying each shot; on a 4-qubit IQP Born machine for the Bars&Stripes benchmark, trap detections correlate with wrong samples and the acceptance rate falls as the attack probability rises.

Beyond accept or abort, the protocol returns an estimate of the corrupted-sample ratio, linking verification to application-level benchmarking. Verification protocols usually return only a binary accept or abort decision and say nothing about output quality. In repeated experiments with larger parameters and a wider range of attack probabilities, the estimator recovers the true corruption rate, and its standard deviation decreases as the number of test rounds grows.

Delegated training is generalized to quantum generative models that do not meet expectation-value losses and Parameter-Shift-Rule gradients. Earlier verifiable end-to-end delegated variational quantum algorithms covered only expectation-value losses with Parameter-Shift-Rule gradients, so they could not be applied directly to generative models using sampling-based distance measures. Verifiable optimization holds when the loss error can be bounded as a function of the corrupted-round ratio and all circuit evaluations within a gradient step share the same MBQC graph; a QCBM with MMD loss and an MBQC-based generative model are given as examples satisfying this assumption.

The protocol targets clients who need to delegate inference of a quantum generative model to a remote quantum server, with security inherited from universal blind quantum computing and trapification at the information-theoretic level rather than under computational assumptions. The sampling protocol itself is not limited to quantum generative models and applies to any sampling-based quantum computation. The training generalization applies to models whose loss error can be bounded as a function of the corrupted-round ratio and whose circuit evaluations within a gradient step share the same MBQC graph. Numerical simulations use a 4-qubit IQP Born machine on the Bars&Stripes benchmark, with attacks demonstrated through a dephasing noise model.

The corruption-rate bound saturates in the limit of infinitely many shots, and finite shots introduce an additional variance term that the analysis treats as negligible by taking the shot count as sufficiently large. The training generalization requires all circuit evaluations within a gradient step to share the same MBQC graph, so quantum generative models whose gradient estimation relies on heterogeneous circuits fall outside this assumption. Numerical simulations cover only the inference phase, while training is presented at a high level. The protocol returns a corruption-rate estimate beyond accept or abort, but the accept or abort decision is taken after all rounds have been delegated.