Quantum Merlin-Arthur (QMA)
Quantum Merlin–Arthur is what you get when you take NP — the class of problems whose "yes" answers admit a short, checkable proof — and let both the proof and the checker go quantum. In NP an all-powerful but untrusted prover (Merlin) writes down a polynomial-length classical string, and a deterministic polynomial-time verifier (Arthur) reads it and decides. MA relaxes Arthur to a randomized checker. QMA takes the final step: Merlin sends a quantum state on polynomially many qubits, and Arthur runs a polynomial-size quantum circuit that measures one output qubit and accepts or rejects. The defining structure is one-sided trust with a two-sided guarantee — for a genuine "yes" instance there must exist a witness that Arthur accepts with high probability, and for a "no" instance no state, however cleverly entangled, may pass except with small probability. The class sits between BQP and PSPACE. Arthur can ignore the witness and run a plain BQP computation, so ; he can check a classical witness with a randomized test, so . The nontrivial ceiling (Kitaev–Watrous, sharpened by Vyalyi and Marriott–Watrous) says QMA is not absurdly strong. The crown jewel is its complete problem: Kitaev's quantum Cook–Levin theorem shows the -Local Hamiltonian problem — deciding whether the ground-state energy of a sum of local Hermitian terms is low or high — is QMA-complete, welding complexity to condensed-matter physics. Two quantum subtleties run underneath: acceptance probability is spectral (the top eigenvalue of a positive operator), and no-cloning forbids naive error reduction, forcing the in-place amplification of Marriott and Watrous.
- QMA (Quantum Merlin–Arthur) is the class of decision problems whose "yes" answer can be certified by a quantum proof — a witness state — that a polynomial-time quantum verifier (Arthur) checks with bounded error.
- A language is in QMA if yes-instances admit a witness accepted with probability while for no-instances every witness is accepted with probability ; these constants amplify to exponentially close to and .
- QMA is the natural quantum analogue of MA/NP and obeys the chain .
- The -Local Hamiltonian problem is QMA-complete (Kitaev's quantum Cook–Levin theorem) — it plays the role SAT plays for NP, and links complexity to ground-state physics.
- No-cloning blocks naive repetition of the check; Marriott–Watrous in-place amplification drives the error to using a single witness register of fixed size, via Jordan's lemma.
- Key idea: a QMA verifier is a uniform family of poly-size quantum circuits acting on a witness register and ancilla; is a yes-instance iff is large, and this maximum is the top eigenvalue of a positive semidefinite operator built from the circuit — turning "does a proof exist?" into a spectral question.
A QMA verifier is a uniform family of polynomial-size quantum circuits acting on a witness register and ancilla; is a yes-instance iff is large, and this maximum is the top eigenvalue of a positive semidefinite operator built from the circuit — turning proof verification into a spectral question.
Where this lives today
QMA is the backbone of the modern theory of the hardness of physics. Because -Local Hamiltonian is QMA-complete, estimating the ground-state energy of a generic interacting quantum system is QMA-hard — strong evidence that no efficient algorithm, classical or quantum, solves every instance, which is why variational quantum eigensolvers and tensor-network methods succeed only on structured, physically nice Hamiltonians and cannot beat the worst case. A steady stream of concrete problems is now known QMA-complete: the -representability problem in quantum chemistry, the consistency of local density matrices, and ground-energy questions for realistic 2-local and even geometrically-local spin lattices (Kempe–Kitaev–Regev and later work). On the verification side, QMA anchors whether a skeptical party can check a quantum computation given a quantum proof, feeding the interactive-proof hierarchy () and the astonishing result on entangled multi-prover systems. The variant landscape stays open: (perfect completeness), (classical witness), and with two unentangled provers, where the collapse for constant (Harrow–Montanaro, 2013) sits beside a still-unknown relationship to QMA itself.
The physical picture
Picture a skeptical quantum verifier, Arthur, facing an omniscient but untrusted prover, Merlin. Arthur announces a question — "convince me this Hamiltonian has a low-energy state" — and Merlin hands over a quantum register he claims is the answer. Arthur cannot trust it, so he runs a fixed poly-size circuit on the witness together with some fresh ancilla qubits, measures a single designated output qubit, and reads accept or reject. The entire content of the class lives in a promise about that one measurement outcome: on a genuine yes-instance some honest witness makes Arthur accept with probability at least ; on a no-instance the promise flips to a guarantee — no register Merlin could ever prepare, however entangled with hidden systems, pushes the acceptance probability above . The first figure draws exactly this protocol and its two thresholds.
Why is the "yes" case an existential and the "no" case a universal? Because a proof system must be sound against a cheating prover: on a no-instance, Merlin will try every trick, so the guarantee has to hold against the single best possible witness. That best witness is not mysterious — Arthur's circuit followed by the output measurement collapses to a positive operator on the witness register, and the acceptance probability of is the quadratic form . Maximizing a quadratic form over unit vectors is an eigenvalue problem, so the best Merlin can do is send the top eigenvector of , and the whole question "does a good proof exist?" becomes "is above threshold?". The QMA-complete embodiment of this spectral picture is the Local Hamiltonian problem, whose energy spectrum the second figure lays out.
No-cloning guards the door to error reduction. Classically Arthur would re-run a weak check with fresh randomness and take a majority vote — but he cannot copy an unknown quantum witness, and measuring it disturbs it, so parallel repetition would demand many independent copies a cheating Merlin could secretly entangle. The resolution, developed in Derivation 3 below, is one of the field's elegant surprises: Marriott and Watrous extract an exponentially sharp estimate of the acceptance probability from a single witness copy, by alternately projecting onto "the ancilla is fresh" and "the verifier accepts."
The core equations
The definition is a promise about one measured qubit. Merlin's witness is fed with fresh ancilla into Arthur's circuit , and the acceptance probability is the chance the designated output qubit reads . A language is in QMA when yes-instances admit a witness that clears and no-instances cap every witness at .
where:
| symbol | meaning |
|---|---|
| uniform poly-size quantum verification circuit for input | |
| quantum witness on qubits, sent by Merlin | |
| probability the designated output qubit is measured as |
Reading it: the asymmetry between (yes) and (no) is the whole engine of a proof system — a real proof must exist for true statements, and no fake proof may work for false ones. The constants are placeholders; the real requirement is any inverse-polynomial gap. Arthur's circuit and final measurement, viewed from the witness register alone, collapse to a single positive operator. Push the output-qubit projector back through and evaluate the ancilla in its fixed initial state ; what remains acting on is , and the acceptance probability is a quadratic form in the witness.
where:
| symbol | meaning |
|---|---|
| positive semidefinite operator on the witness register | |
| projector onto "output qubit equals " | |
| initial state of the ancilla qubits |
Reading it: because is a quadratic form with , maximizing over normalized witnesses returns the top eigenvalue, . Deciding membership is deciding whether or — a spectral question. This is the single most important reformulation in the theory. The class is bracketed from below by the two ways Arthur can waste his extra power. Ignore the witness entirely and is just a BQP computation; check a classical string with a randomized test and subsumes MA.
where:
| symbol | meaning |
|---|---|
| bounded-error quantum polynomial time (no witness used) | |
| Merlin–Arthur: classical witness, randomized verifier | |
| probabilistic polynomial time, unbounded error |
Reading it: the lower bounds are trivial by construction; the upper bound is the substantive one (derived below) and certifies that QMA, for all its quantum machinery, still lives inside classical polynomial space. The complete problem is physical. A -local Hamiltonian is a sum of Hermitian terms, each touching at most qubits and normalized to unit operator norm; the decision problem asks on which side of a promise gap its smallest eigenvalue lies.
where:
| symbol | meaning |
|---|---|
| Hermitian -local term | |
| number of terms, | |
| locality; is already QMA-complete |
Reading it: the promise gap is essential — it is what makes the problem verifiable with an inverse-polynomial acceptance margin. Kitaev's theorem is that this problem is QMA-complete: membership is easy (energy sampling, Derivation 2), hardness is the quantum Cook–Levin theorem. Hardness runs through the history state, which packs an entire computation into one superposition indexed by a clock register, so that a local Hamiltonian can penalize any inconsistency in the computation's steps.
where:
| symbol | meaning |
|---|---|
| the -th gate of the verifier's circuit | |
| unary clock register encoding time step | |
| number of gates, |
Reading it: the propagation Hamiltonian annihilates exactly when consecutive time slices are related by the correct gate. Together with input, clock, and output penalties, has a low-energy state iff the computation can accept — turning acceptance into a ground-energy question. No-cloning forbids naive repetition, but the error still collapses in place. Marriott–Watrous amplification alternates two projective measurements on a single witness register and reads off the acceptance probability to exponential precision, leaving the witness size untouched.
where:
| symbol | meaning |
|---|---|
| amplified completeness and soundness | |
| any polynomial fixed in advance |
Reading it: classically, amplification is a triviality (re-read the string); here it is a theorem, and its proof (Derivation 3) is a small gem of operator geometry — Jordan's lemma reduces the two projectors to a pile of blocks.
The goal is to prove the substantive containment , and through it , by converting the existential quantum proof into a purely spectral quantity and then into a signed sum of amplitudes of exactly the shape a probabilistic machine can weigh. The route is: (i) collapse Arthur's circuit to the operator ; (ii) recognize the best witness as its top eigenvector, so membership is a threshold test on ; (iii) express powers of as sums over computation paths of gate-amplitude products; and (iv) hand that unbounded-error signed sum to a PP machine.
Step 1. Reduce the whole class to one operator. By equation (2), the acceptance probability of any witness is with , so the largest acceptance probability over all witnesses is . A yes-instance has ; a no-instance has . Why: this discards Merlin entirely — the prover's continuum of possible states is compressed into a single number, the top eigenvalue of a fixed positive operator, and there is a constant-size gap to detect.
Step 2. Convert the top eigenvalue into a trace. For a positive operator on the -dimensional witness space ( witness qubits), is dominated by the largest eigenvalue as grows, so compared against a suitable threshold separates the case from the case once (the smaller eigenvalues cannot catch up across a constant ratio in polynomially many powers). Why: a trace is a basis-independent sum a machine can attack term by term, and raising to a power sharpens the constant gap into a decisive one.
Step 3. Expand the trace as a signed sum over paths. Each matrix entry of (and hence of and its powers) is built from a poly-size product of gate amplitudes, each a rational number with polynomially many bits and a sign. Therefore is a sum of exponentially many efficiently computable terms, some positive and some negative — a signed sum with cancellation. Why: quantum interference is exactly the appearance of negative (and complex) amplitudes, and it is that cancellation that a bounded-error class like NP cannot handle but PP can.
Step 4. Decide with an unbounded-error machine. PP is precisely the class of languages decided by a probabilistic poly-time machine that accepts iff a signed sum of exponentially many poly-time-computable terms is positive. Feeding it minus the threshold gives , and since , also . Why: this is the tightest standard ceiling on QMA — it shows the quantum proof buys no more than unbounded-error counting power, and in particular nothing outside polynomial space.
Go deeper · Derivation B · 2 minLocal Hamiltonian energy estimation lands in QMA
The goal is the easy half of Kitaev's completeness theorem: that the -Local Hamiltonian problem is in QMA, exhibited by a concrete verifier who never touches more than qubits at once. The construction is the archetype of a QMA protocol — Merlin sends a claimed ground state, Arthur samples one local term, estimates its energy, and accepts with a probability tuned so that a low total energy means high acceptance. We track how the inverse-polynomial promise gap becomes an inverse-polynomial gap in acceptance probability, which the amplification theorem then lifts to constants.
Step 1. Fix the witness and normalize the terms. Merlin sends a state he claims is at or below the ground energy. Shift and rescale each term so ; then and the energy of the witness is . Why: normalizing each local term to lie between and lets Arthur treat directly as a probability, which is what a measurement returns.
Step 2. Sample one local term. Arthur draws uniformly from , so the expected sampled energy is . Only the qubits in the support of are involved. Why: a single local term acts on a constant number of qubits, so measuring it is efficient — this is exactly where the "local" in Local Hamiltonian earns its keep.
Step 3. Estimate the term's energy and accept accordingly. Using a Hadamard test on (or a direct measurement, since is local and can be diagonalized on its few qubits), Arthur produces an accept bit with probability . Why: pinning acceptance to makes low energy mean high acceptance, exactly aligning the physical ground-state question with the proof-system promise.
Step 4. Read off completeness versus soundness. If , the true ground state gives . If , then for every , . The completeness-minus-soundness gap is . Why: soundness holds against all witnesses at once because no state can have energy below — the spectrum itself enforces the guarantee, and the inverse-poly gap is amplifiable to the textbook .
Go deeper · Derivation C · 2 minIn-place amplification without cloning via Jordan's lemma
The goal is to explain how QMA error is driven to using only a single copy of the witness, sidestepping no-cloning. The idea is geometric: Arthur's protocol is governed by two projectors — one for "the ancilla is still fresh," one for "the verifier accepts" — and any two projectors carve the Hilbert space into orthogonal blocks of dimension at most two. Inside each block the pair meets at a fixed angle whose cosine-squared is a local acceptance probability, so alternating the two measurements is a random walk whose statistics reveal that probability to exponential precision, all without ever re-supplying the witness.
Step 1. Name the two projectors. Let project onto states whose ancilla is the fresh (so a valid witness sits in its range), and let project onto the "accept" subspace pulled back to the input. The witness's acceptance probability lives entirely in the relative geometry of and . Why: reducing a full circuit to two projectors is what exposes the hidden two-dimensional structure — everything about acceptance is an angle between these subspaces.
Step 2. Block-diagonalize by Jordan's lemma. Any two projectors simultaneously decompose the Hilbert space into invariant subspaces of dimension one or two; in each two-dimensional block they meet at an angle with equal to a local acceptance probability, and 's expectation in the witness state is the corresponding average. Why: a block is a single qubit's worth of geometry, where alternating projections have a clean, analyzable transition rule instead of an intractable many-body evolution.
Step 3. Walk between the projectors. Alternately measure and , recording the outcome bits: . Within a block the probability of staying is and of flipping is , so the bit sequence is a Markov chain whose transition rates encode . Crucially, each measurement re-uses the same register — no fresh witness is ever needed. Why: this is the exact point where no-cloning is defeated — information about the acceptance probability is harvested by re-measuring one copy, not by consuming many.
Step 4. Estimate to exponential precision. Tallying the outcomes over rounds estimates finely enough to separate completeness from soundness with error for any prescribed polynomial , while the witness register keeps its original size. Why: this delivers the strong-amplification claim of equation (6) — polynomially many measurement rounds, one fixed-size witness, exponentially small error — which classical intuition would have said requires many independent proofs.
Limiting cases
How does the class respond as the completeness and soundness parameters are pushed to their edges? Robustness under these limits is precisely what makes "QMA" a well-defined object rather than an artifact of chosen constants.
| Case | Result | Meaning |
|---|---|---|
| Constant gap | the canonical textbook definition of QMA | |
| Inverse-poly gap | same class — any gap no smaller than inverse-polynomial amplifies to constants | |
| Strong amplification | achievable for any polynomial via Marriott–Watrous, single fixed-size witness | |
| Perfect completeness | defines ; whether is open in general | |
| No witness | witness empty | the class collapses to |
| Classical witness | a basis string | the class becomes ; , separation open |
Worked examples
1 · Energy sampling on a Local Hamiltonian (fully worked)
A -local Hamiltonian on qubits is a sum of terms, each normalized to . The promise is that either (yes) or (no). Arthur uses the energy-sampling verifier of Derivation 2. Find the completeness and soundness acceptance probabilities, the raw verification gap, and how many amplification rounds put the error below .
Step 1. Set up the acceptance rule. Arthur draws a term uniformly and accepts with probability , because . Acceptance is high exactly when the witness has low energy.
Step 2. Completeness (yes-instance). Merlin sends the true ground state, with energy . Then .
Step 3. Soundness (no-instance). Now every state has , so no matter what Merlin sends, . The spectrum itself caps the cheat.
Step 4. Raw gap and amplification. The verification gap is , an inverse-polynomial margin, not yet the textbook versus . Marriott–Watrous amplification turns a fixed gap into error using measurement rounds on one witness; to reach error below we need roughly rounds — polynomially many, and the witness register never grows. Completeness 0.96, soundness 0.90, raw gap 0.06, amplified below in a few thousand in-place rounds.
2 · The optimal witness is a top eigenvector
For some input , Arthur's acceptance operator on a single-qubit witness register works out to in the computational basis. What is the best witness Merlin can send, what acceptance probability does it achieve, and does look like a yes- or no-instance under the standard thresholds?
Step 1. Confirm is a legal acceptance operator. It is Hermitian, and its eigenvalues (next step) lie in , so as equation (2) requires. Acceptance probability of a witness is the quadratic form .
Step 2. Diagonalize. For the eigenvalues are , here , giving and , with eigenvectors and .
Step 3. Read off the best strategy. Maximizing the quadratic form over unit vectors is solved by the top eigenvector, so Merlin's optimal witness is , achieving . Any other witness does strictly worse; the worst, , accepts with only .
Step 4. Classify the instance. Since , a witness clearing the completeness bar exists, so is consistent with being a yes-instance. Had come out at or below , no witness could pass and would be a no-instance — the entire decision is "is the top eigenvalue above threshold?". Best witness , : a yes-instance, decided purely spectrally.
Physics of the portrait
QMA is a young idea with a clear parent. Its definition, its complete problem, and the history-state trick that welds complexity to physics all trace to one person, working at the seam between quantum computation and condensed matter.
Origins · 1 minAlexei Kitaev and how this was discovered
Alexei Yurievich Kitaev, trained in the Landau tradition of theoretical physics, has spent his career finding computation hidden inside physical systems and physics hidden inside computation. In the late 1990s, working at the Landau Institute and then at Microsoft and Caltech, he introduced the complexity class he called BQNP — now universally QMA — as the honest quantum analogue of NP: a quantum verifier checking a quantum proof. His masterstroke was the quantum Cook–Levin theorem, which shows the Local Hamiltonian problem is QMA-complete by encoding an entire quantum computation as the ground state of a local Hamiltonian through the "history state" and its clock construction, so that verifying a proof becomes finding a low-energy state of a spin system. The argument, written up with Alexander Shen and Mikhail Vyalyi in Classical and Quantum Computation (2002), turned an abstract complexity class into a statement about the physics of interacting matter — deciding ground-state energies is as hard as the hardest quantum proof. Kitaev is equally famous for the toric code and topological quantum computation, for the phase-estimation algorithm at the heart of Shor's algorithm's modern presentation, and for the Kitaev chain of Majorana physics. The through-line is unmistakable: he reads the theory of computation and the theory of quantum matter as one subject, and QMA is where that reading first crystallized into a class.
Going further
Texts. Kitaev, Shen, Vyalyi — Classical and Quantum Computation (2002), Ch. 14 (the definitive source for QMA and the completeness proof) · Watrous — The Theory of Quantum Information (2018), chapter on quantum interactive proofs · Aharonov, Naveh — Quantum NP: A Survey (2002) · Marriott, Watrous — Quantum Arthur–Merlin Games (2005) · Bookatz — QMA-complete Problems (2014), a catalogue of the physical complete problems · Preskill — Lecture Notes on Quantum Computation, complexity chapter · Nielsen & Chuang — Quantum Computation and Quantum Information for the circuit and measurement background. The key checkpoints for this article are: is positive with and (equation 2); the containment chain ; the history-state and propagation-Hamiltonian forms of the quantum Cook–Levin theorem; Marriott–Watrous in-place amplification via Jordan's lemma; and the worked numbers — completeness , soundness , gap for , and for the operator.
Prerequisites. The Complexity Class BQP · BQP versus P, NP, and PSPACE · BQP is Contained in PP and PSPACE. Leads to. The Local Hamiltonian Problem · The Quantum Cook–Levin Theorem · QMA Variants and Related Classes · Quantum Interactive Proofs (QIP).
Ask the tutor: Ask me to walk through the history-state construction of the quantum Cook–Levin theorem, or to show step by step why alternating two projectors amplifies QMA error without ever cloning the witness.
Is QMA just NP with a quantum computer?
Not quite — it is the quantum analogue of MA, which is itself the randomized version of NP. Three things go quantum at once: the proof (a state , not a string), the verifier (a quantum circuit, not a deterministic or randomized classical test), and the error model (two-sided bounded error). The cleanest slogan is "QMA is to BQP as NP is to P." The parts that have no classical shadow are that the witness ranges over a continuum of entangled states and that acceptance is a spectral quantity — the top eigenvalue of a positive operator — rather than a syntactic yes/no on a certificate.
What makes the Local Hamiltonian problem the "SAT of QMA"?
Just as SAT is NP-complete — every NP problem reduces to it — the -Local Hamiltonian problem is QMA-complete: it is in QMA (a candidate ground state is a checkable witness, via energy sampling) and every QMA problem reduces to it (Kitaev's quantum Cook–Levin theorem). The reduction is the history-state construction, which encodes an entire verification circuit as a local Hamiltonian whose ground energy is low iff the circuit can accept. Its punch is physical: because generic ground-state energy estimation is QMA-hard, there is complexity-theoretic evidence that no method solves all instances efficiently, which frames the limits of quantum chemistry and condensed-matter simulation.
Why is the containment QMA ⊆ PP, and not the tidier QMA ⊆ NP?
Deciding membership tests whether clears a threshold, and is captured by traces that expand into signed sums of exponentially many gate-amplitude products. Quantum interference makes those amplitudes carry signs and phases, so the decision is an unbounded-error counting problem with cancellation. PP is exactly the class built to weigh such signed sums; NP cannot, because guess-and-check has no way to account for negative-amplitude paths cancelling positive ones. The containment is tight enough to also give .
How can error be reduced if the witness cannot be cloned?
Classically you would run the check many times on independent copies of the proof, but no-cloning forbids duplicating an unknown quantum witness, and measuring it disturbs it. Marriott and Watrous found an in-place route: the protocol is governed by two projectors — "ancilla is fresh" and "verifier accepts" — and Jordan's lemma splits the space into blocks where alternately measuring the two projectors is a random walk whose statistics reveal the acceptance probability. Tallying outcomes over polynomially many rounds on a single witness register estimates that probability to exponential precision, so the error shrinks to without any extra witness qubits.
What is the difference between QMA, QCMA, and QMA(2)?
All three are quantum-verifier proof systems that differ in the proof. In QMA the witness is a general quantum state. In QCMA it is a classical string (the verifier still quantum); QCMA sits inside QMA, and whether the inclusion is strict is a well-known open problem tied to how much a quantum proof really buys you. In QMA(2) two provers send states promised to be unentangled, which counterintuitively can help because Arthur can exploit the product structure; remarkably for any constant , yet its relationship to plain QMA is unresolved. These variants probe how the form and entanglement of a proof affect what can be verified.
Do the constants 2/3 and 1/3 matter, or are they arbitrary?
They are conventions, not essential. Any completeness and soundness with an inverse-polynomial gap define the same class QMA, because Marriott–Watrous amplification lifts such a gap to and with a fixed-size witness. What does matter is that the gap not shrink faster than any inverse polynomial (then the class may change), and that completeness of exactly is a genuinely different constraint — it defines , whose equality with QMA is open. So treat as a convenient normalization, and remember the real content is "some inverse-poly gap."