Approaching the Quantum Singleton Bound with Approximate Error Correction

It is well known that no quantum error correcting code of rate R can correct adversarial errors on more than a (1−R)/4 fraction of symbols. But what if we only require our codes to approximately recover the message? In this work, we construct efficiently-decodable approximate quantum codes against adversarial error rates approaching the quantum Singleton bound of (1−R)/2, for any constant rate R. Specifically, for every R ∈ (0,1) and γ>0, we construct codes of rate R, message length k, and alphabet size 2O(1/γ5), that are efficiently decodable against a (1−R−γ)/2 fraction of adversarial errors and recover the message up to inverse-exponential error 2−Ω(k). At a technical level, we use classical robust secret sharing and quantum purity testing to reduce approximate quantum error correction to a suitable notion of quantum list decoding. We then instantiate our notion of quantum list decoding by (i) introducing folded quantum Reed-Solomon codes, and (ii) applying a new, quantum version of distance amplification.


Introduction
There are several models of noise in quantum error correction. One of the weakest noise models is erasures, where some known subset of symbols are removed. The number of erasure errors that a code can tolerate is the distance of the code. At the other extreme there are adversarial errors, where an adversary is allowed to tamper arbitrarily with a subset of symbols (and the decoder doesn't know which symbols were corrupted). The number of symbols that an adversary can be allowed to corrupt without sacrificing correctness of the decoded message is the decoding radius.
The quantum Singleton bound imposes an information-theoretic limit on the distance of a quantum code: No code of rate R can correct from more than a (1 − R)/2 fraction of erasures. But how far can we push the decoding radius? For the case of exact quantum error correction, it is a well-known consequence of the KL conditions [KL97] that any code of distance d has decoding radius at most d/2. Combined with the quantum Singleton bound, it follows that quantum codes cannot achieve decoding radius beyond a (1 − R)/4 fraction of the block length.
However, in [CGS05] it was shown that, by relaxing the definition of quantum error correction to allow even exponentially-small error in the recovered state, one can design certain codes where the decoding radius essentially matches the quantum Singleton bound for very small (asymptotically decaying) rates. Unfortunately, that construction requires an exponentially large alphabet and is therefore unlikely to be useful for communicating over a noisy channel.
Still, the codes of [CGS05] indicate that the distance and the decoding radius might not be inherently far apart in approximate quantum error correction! This is in stark contrast to the classical setting, where it is impossible to build codes with decoding radius nearly matching the classical Singleton bound of 1 − R for small rates 1 . Whether the quantum phenomenon was an artefact of the non-standard exponential alphabet used by [CGS05], or an exciting possibility for practical quantum error correcting codes, has essentially remained open.
In this work we construct the first efficiently-decodable approximate quantum error correcting codes over constant-sized alphabets with decoding radius approaching the quantum Singleton bound for all rates. Our codes have error that decays exponentially with the message size, and conclusively show that even a slight relaxation of standard quantum error correction permits the design of codes where the the distance and decoding radius are nearly identical.

Our Contributions
Main results. Our main results are constructions of efficient approximate quantum error-correcting codes (AQECCs) approaching the quantum Singleton bound. We present two constructions, one in Corollary 4.8 and the other in Corollary 7.6, based on different approaches and with qualitatively slightly different guarantees. Either construction yields the following main result. We use the notation [[n, k]] q to refer to a quantum code which has block length n, message length k, and alphabet size (i.e., local dimension) q.
All of the codes we construct come with efficient algorithms for encoding and decoding. In Section 4 we present a general compiler that builds AQECCs from • quantum list-decodable codes, • purity testing codes, and

Approximate Quantum Error Correction
An approximate quantum error correcting code should encode message states into (possibly mixed) codestates, with the guarantee that the original messages are recoverable up to a high fidelity even when an adversary is allowed to tamper with a bounded number of registers. First, we define the syntax of a quantum code.
Definition 1.1. An [[n, k]] q quantum code is a pair (Enc, Dec) of quantum channels on qudits of local dimension q such that 1. Enc encodes a k qudit message register M into an n qudit code-state register C, and 2. Dec decodes a received code-state registerĈ into a k qudit message registerM .
The code is said to be efficient if (Enc, Dec) can be implemented in polynomial time in n. If the code-state register C is defined on n qudits, then the weight of an error channel acting on C is the number of qudits of C which the channel acts non-trivially on.
Definition 1.2 ( [CGS05]). A quantum code (Enc, Dec) is said to be a (δ, ε)-AQECC (Approximate Quantum Error Correcting Code) if, for all adversarial channels A of weight δ · n, We refer the reader to Section 2 for a review of distance measures between quantum states and channels.
While the ordinary quantum Singleton bound only applies to exact quantum error correcting codes, more robust versions for AQECCs also hold. Specifically, [MW22, Theorem 5] provides a general quantum Singleton bound for hybrid quantum/classical/entanglement-assisted codes with approximate or exact recovery.

Defining Quantum List-Decodable Codes
Recall that stabilizer codes [Got97] are a subspace of n-qudit states, defined as the joint eigenspace of a set of commuting operators called the stabilizer generators. Given a corrupted code-state, the syndrome measurement is the projective measurement of the eigenvalues of the stabilizer generators. The measurement outcome (a list of eigenvalues) is referred to as the syndrome, and is the quantum analogue of a classical parity check syndrome.
In classical coding theory, a code C ⊂ Σ n is said to be (τ, L) list-decodable [Woz58,Eli57] if there are at most L codewords of C in any hamming ball of radius τ · n in Σ n . To understand our quantum analogue, observe that for linear codes this classical notion is exactly equivalent to requiring that there are at most L errors of weight at most τ · n consistent with each possible parity check syndrome.
Perhaps the most direct quantum translation would be the following: A stabilizer code Q could be (τ, L) quantum list-decodable if for every possible syndrome s, there are at most L Pauli operators of weight at most τ ·n that are consistent with the syndrome s. However, if the code has many low-weight stabilizers (such as concatenated codes) then the list of errors consistent with a given syndrome could contain exponentially many logically-equivalent Pauli operators. Since such logically-equivalent errors by definition have the same action on codewords, we instead use a slightly relaxed definition where we only count logically-distinct operators in the list.

Definition 1.3 (Restatement of Definition 3.2).
A stabilizer code Q is (τ, L) quantum list-decodable (QLD) if for every possible syndrome s, there are at most L logically-distinct Pauli operators of weight at most τ · n that are consistent with the syndrome s.
Therefore, after measuring the syndrome, quantum list-decoding is the entirely classical task of computing the list of possible corrections for the given syndrome.

Constructions of Quantum List-Decodable Codes
Our main tool for designing these quantum list-decodable codes is a reduction to classical list-decoding via CSS codes.
Claim 1.7. If C 1 , C 2 ⊂ (F m q ) n are two F q -linear classical codes which are (τ, L) list-decodable and C ⊥ 2 ⊂ C 1 , then there exists a CSS code CSS(C 1 , C 2 ) which is (τ, L 2 ) quantum list-decodable. Moreover, if the classical codes are efficiently list-decodable, then the CSS code is as well.
This follows from the fact that correcting errors on a code-state of a CSS code simply consists of correcting the X and Z errors. 2 The central insight behind our quantum code construction -and later the quantum distance amplification in Section 1.2.5 -is that syntactic or physical operations on the registers of a quantum code are not only well-defined, but behave similarly to their classical counterparts. For instance, folding a quantum CSS code (i.e., bundling together m consecutive qudits into a larger qudit) induces folded component classical codes: Claim 1.8 (Informal statement of Claim 3.7). If Q is the CSS code of two linear classical codes C 1 , C 2 ⊂ F n q , then the m-folded quantum code Q (m) is a CSS code of the two F q -linear m-folded classical codes C (m) 1 , C (m) 2 ⊂ (F m q ) n/m . This follows from the fact that folding operation automatically bundles the qudits in both bases, so error correction in each basis can leverage folding. Instantiating Claim 1.8 with the folded Reed-Solomon codes of [GR08], we obtain explicit quantum list-decodable codes tolerating errors up to the quantum Singleton bound: Theorem 1.9 (Restatement of Theorem 3.8). For any γ > 0 and 0 < R < 1, there exists a family of quantum [[n, R · n]] q stabilizer codes with alphabet size q = n O(1/γ 2 ) which is ((1 − R − γ)/2, n O(1/γ) ) quantum list-decodable.
Unfortunately, these folded quantum codes have alphabet size n O(1/γ 2 ) rather than constant. [GR08] reduce the alphabet size by showing that their codes can be used for the related task of list-recovery, and combining their ideas with the distance amplification and alphabet reduction techniques of [AEL95]. The main technical component of this work is to show that an analogous quantum list-recovery task can be used in combination with a quantum analog of the distance amplification techniques by [AEL95]. We outline quantum distance amplification in Section 1.2.5.
Using quantum distance amplification, we present a randomized construction of quantum stabilizer codes on constant sized alphabets, with list decoding radius approaching the quantum Singleton bound.

Construction of AQECCs from Quantum List-Decodable Codes
Quantum list decoding enables us to find a short list of possible errors which match a syndrome measurement. If we had some way of tagging valid messages, then we could filter through the list for the true error and obtain unique decoding.
We find that purity testing codes (PTCs) [BCG + 02] are well-suited for this task. A PTC is a collection {Q k } k∈K of stabilizer codes which is able to faithfully detect a Pauli error with high probability over keys k ← K. They were originally introduced to construct quantum authentication schemes, but it turns out that we do not need full quantum authentication for our purposes.
Definition 1.4 (Purity testing codes, [BCG + 02]). A stabilizer purity testing code with error ε (ε-PTC) is a set of stabilizer codes {Q k } k∈K such that, for all Pauli errors E, We construct private AQECCs by first encoding the message in a PTC Q k , and subsequently encoding in a quantum list-decodable code Q LD . As long as the keys are kept secret from the channel, the probability that an undetectable error appears in the list is at most ε · L by a union bound. Therefore a recipient who knows k can uniquely recover the message with probability 1 − ε · L.
Of course, this construction gives a collection of codes {Q LD • Q k } k∈K rather than a single code. Since the channel cannot be allowed to see the keys k, we only obtain a relaxed version of AQECCs where the sender and receiver have shared private randomness (unknown to the error channel). We call such codes private AQECCs in analogy to the classical private codes of [Lan04,Gur03b].
By using k ← K as the shared private randomness, we obtain the following theorem.
Lemma 1.11 (Restatement of Lemma 4.1). Let {Q k } be an ε-PTC where each Q k is an [[n P T C , m]] q stabilizer code, and let Q LD be a [[n, n P T C ]] q stabilizer code which is (δ, L) quantum list-decodable. Then Q LD • Q k is a (δ, 2 · L · ε) private AQECC.
In this construction, it becomes important that the adversary cannot choose the error according to the key k. The local indistinguishability of Q LD protects against such attacks, by ensuring that the adversary's view consisting of fewer than dist(Q LD ) components of a code-state of Q LD • Q k is the same regardless of the value of k.
To convert a private AQECC into an AQECC, we incorporate the classical key information into the quantum registers. The key tool for this conversion is a classical robust secret sharing schemes (RSSs) [CDD + 99, CDF01, CDF + 08, CDD + 15] 3 , which ensures that the hidden secret key looks uniformly random to the adversary while still allowing the receiver to reconstruct the key with high probability. [CGS05] used a combination of classical secret sharing and classical authentication from [CDF01] to construct such an RSS. We need to be more careful with our choice of classical secret sharing scheme, in order to ensure that the resulting quantum code still lies roughly on the quantum Singleton bound and maintains constant alphabet. In Section 4, we use a more recent RSS construction of [CDD + 15] to prove the following theorem.

Distance Amplification for Quantum Codes
In order to decrease the alphabet size of our quantum code constructions and improve on their encoding/decoding efficiency, we develop a quantum analog of the seminal distance amplification techniques for classical error correcting codes by Alon, Edmonds and Luby [AEL95]. Their ideas hinged on using code concatenation and a careful redistribution (or permutation) of the symbols of the code, in order define a new code with a larger distance and/or smaller alphabet (and slightly lower rate). These techniques have found extensive use in classical coding theory, such as the construction of linear time encodable/decodable codes [GI02], the construction of list-decodable codes from list-recoverable codes [GI03,GR08], high-rate locally testable codes [KMRZS15, GKO + 18, HRZW19], and many other applications.
The simplest formulation of the quantum analog we study can be understood as physically permuting and re-grouping the qudits of a concatenated quantum code [KL96] 4 . Starting with an outer [[n, k, n · ∆ out ]] q m stabilizer code Q out , and an inner [[n ′ , m, n ′ · ∆ in ]] q stabilizer code Q in , their quantum code concatenation is the [[n · n ′ , k · m]] q stabilizer code Q ⋄ = Q out ⋄ Q in . Consider a physical depiction of Q ⋄ as a n × n ′ table of q-ary qudits. The final step is to use an n ′ -biregular expander graph G = (L ∪ R, E) on two partitions of |L| = |R| = n nodes, to redistribute the qudits of Q ⋄ into another [[n, km/n ′ ]] q n ′ stabilizer code Q G . To do so, if the ith edge incident to u ∈ L equals the jth edge incident to v ∈ R, then the ith q-ary qudit of the uth inner block of Q ⋄ is placed into the jth q-ary qudit of the vth inner block of Q G . In other words, the table associated to Q ⋄ is permuted into another n by n ′ table for Q G , and each of its rows represents a q n ′ -ary qudit. Qualitatively, this qudit redistribution ensures that any q n ′ -ary Pauli E (represented as a tensor product of q-ary Pauli's) supported on roughly a < ∆ in /2 fraction of the rows of Q G , after unpermuting G, is then almost uniformly spread out among the inner blocks/rows of Q ⋄ such that most inner blocks have less than ∆ in /2 fraction of errors. If the fraction of the 'high weight' inner blocks is less than ∆ out /2, then E is a perfectly correctable error for Q G , and thus Q G has relative distance roughly ∆ in .
In Section 5 we argue that the insights from [AEL95] translate remarkably well into the quantum setting. We analogously adapt these ideas, and the intuition above to decrease the alphabet of our quantum codes, construct quantum list decodable codes from a suitable analog of quantum list recoverable codes, and to construct private AQECC's which are LDPC and encodable/decodable in linear time.

Private LDPC AQECCs with Linear-Time Decoding
Recall that the construction of efficient private AQECCs described in Section 1.2.4 first constructs efficient quantum list-decodable codes using AEL amplification with inefficient but small quantum list-decodable inner codes, and then composes these AEL-amplified codes with PTCs to obtain the desired private AQECCs. Therefore while this construction provides a general recipe for AQECCs, as mentioned previously the outer code of the AEL concatenation must satisfy an appropriate form of quantum list-recoverability, which we only know how to achieve with folded quantum Reed-Solomon codes.
In Section 7, we present a construction of efficient private AQECCs that permits more flexibility in the code properties by combining the same ingredients described above in an alternative manner. Specifically, if we instead apply AEL amplification with a certain class of inefficient but small private AQEC inner codes, the outer code may be chosen to be any asymptotically good efficient quantum code Q out . The resulting construction will be an efficient private AQECC that inherents some of the properties of Q out , such as its locality and decoding time. Thus choosing the outer code from a family of good quantum LDPC codes [PK22,LZ22c,LZ22a,DHLV22,GPT22,LZ22b], we obtain the efficient private LDPC AQECCs of Theorem 1.5.

Related Work
The idea of using approximate quantum error correction to build better quantum codes goes back to [LNCY97], who construct a 4-qubit AQECC encoding one qubit that tolerates a specific noise model.
A more closely related result is that of [CGS05], who construct AQECCs with a decoding radius of ⌊(n−1)/2⌋ for codes of block length n. Their construction is based on a combination of quantum error correction, quantum message authentication, and classical secret sharing. However, the code in [CGS05] has asymptotically decaying rate, and is defined on qudits with exponentially large local dimension. To go beyond the exponential-alphabet regime we use quantum list decoding.
A related notion of quantum list decoding was introduced by [LS08], who show that random stabilizer codes on qubits are quantum list-decodable with high probability. They use these codes to construct private AQECCs on qubits with rates up to 1 − H(δ) − δ log 3 (where δ · n is the decoding radius).
Compared to this work, [LS08] have a slightly different definition of quantum list decoding and do not construct codes with efficient decoding procedures. In fact, we expect that an efficient decoding algorithm for random stabilizer codes should not exist. Moreover, their codes do not approach the quantum Singleton bound because they restrict to binary alphabets. While extending their results to larger (but still constant) alphabets would yield codes that do approach the quantum Singleton bound, the problem of efficient decoding would remain.
Several works have studied conditions in which approximate quantum error correction is possible [BK00, SW02, Dev05, KSW08, Bén09, NM10, MN12, BO10, HP17]. For instance, [SW02,KSW08,Bén09,BO10] were interested in characterizing when information can be sent over a noisy quantum channel, with or without prior knowledge of the input state and the noise model. [NM10,MN12] studied the efficacy and optimality of the transpose channel as a recovery map, when the noise process is known. [Dev05,HP17] studied applications of approximate quantum error correction to quantum and classical communication, including to the tasks of state merging, entanglement distillation, quantum identification and remote state preparation. [BDH06] introduced the concept of an entanglement-assisted quantum error correcting code (EAQECC), when the sender and receiver have access to an unbounded supply of pre-shared EPR pairs. A number of results [LBW13, LB13, WHB11] studied properties of EAQECCs, and discussed their construction from classical linear codes. While no pure quantum code can bypass the quantum Singleton bound, quite remarkably, recently EAQECCs were shown to be able to transmit quantum information up to the classical Singleton bound [Gra20] in certain parameter regimes. [DS03,HW08,GHW22,MW22] proved Singleton bounds and other upper bounds on the capacity of entanglement-assisted and private quantum codes.

Discussion and Open Problems
The folded Reed-Solomon codes [GR08] are a family of deterministic, polynomial-time constructible classical codes which approach the information-theoretic list-decoding limit. Since their result, a number of (explicit) codes have improved on their alphabet and list sizes [Gur10,GX20,GRZ22], without the need of expanderbased distance amplification [AEL95]. However, it seems unclear how to use these codes to design quantum codes, as their duals aren't necessarily explicit, or they require pre-encoding with certain subspace-evasive sets [DL12,GXY17] to reduce their list sizes. We leave for future work the design of explicit quantum codes approaching the list-decoding capacity at small qudit local dimensions.
We note that the techniques in this work can be used to formalize a quantum analog of list-decoding from erasures, where the receiver is tasked with producing a list of correction operators to a reduced density matrix of some code-state. This task has been extensively studied in the classical setting [GI01, Gur03a, GI03, GI04, RZWZ20], where it is well known that random binary linear codes are efficiently erasure list-decodable even when all but a small fraction of symbols have been erased. One could ask an analogous question for quantum codes on qubits: For fixed rate R, what is the maximum number of erasures for which one can still efficiently list-decode (or approximately unique-decode) the quantum state?

Organization
We organize the rest of this work as follows. In Section 2 we review the necessary background on quantum error correction. In Section 3 we present our definition of quantum list decoding and our results on listdecodable CSS codes, including our explicit construction of folded quantum Reed-Solomon codes. In Section 4 we show how to reduce approximate quantum error correction to quantum list decoding. In Section 5 we describe our quantum distance amplification and alphabet reduction techniques. We apply this AEL amplification in Section 6 to construct efficient quantum list-decodable codes approaching the quantum Singleton bound over constant alphabets. We apply AEL in an alternative manner in Section 7 to construct private LDPC AQECCs with linear-time decoders, which as a byproduct gives another construction of efficient AQECCs.
In Appendix A we discuss the list decodability and other simple properties of random CSS codes, which follow easily from their classical counterparts. For completeness, in Appendix B we introduce a quantum notion of list recoverability and a "fully-quantum" proof of the construction of quantum list decodable codes on smaller alphabets from quantum list recoverable codes and distance amplification.

Notation
Norms and Distances We use three notions of distance between quantum states and quantum channels. The trace distance ρ − σ 1 between two mixed states ρ, σ ∈ D(H) captures their distinguishability, and is defined in terms of the trace norm (or Shatten 1-norm) , and can be written simply as ψ| ρ |ψ when σ = |ψ ψ| is a pure state. Finally, the diamond norm distance between two quantum channels M, N : L(H A ) → L(H B ), quantifies their distinguishability even in the presence of entanglement Finite Fields Let q = p m be a power of a prime p, and denote by F q to be the Galois field of p m elements. We refer to the F p functional tr Fq/Fp : F q → F p as the trace function, where tr Fq/Fp (a) = m−1 i=0 a p i . If α 1 , · · · , α m is a basis of F q over F p , then one can express a ∈ F q as a = m i=1 a i α i for a i ∈ F p . We refer to a pair of bases α = α 1 , · · · , α m , β = β 1 · · · β m of F q as dual bases if tr Fq/Fp (α i β j ) = δ i,j . If a, b ∈ F q is expressed as (a 1 , · · · , a m ), (b 1 , · · · , b m ) in the dual bases α, β respectively, then the inner product over the basis representation becomes the trace: Error Basis To connect these notions to quantum codes, we define an explicit error basis for q = p m -ary quantum systems. Fix ω = e 2πi/p . Let T, R be the 'shift' and 'phase' operators on C p , defined by The operators T i R j , i, j ∈ F p form the Weyl-Heisenberg operators, an orthonormal basis of operators over C p . If a, b ∈ F q , with representations (a 1 , · · · a m ), (b 1 , · · · b m ) in the dual bases α, β respectively, then one can define an o.n. basis of operators over C q : Finally, if a = (a (1) , a (2) · · · a (n) ), b = (b (1) , b (2) · · · b (n) ) ∈ F n q , then one can define operators acting on C ⊗n . The error group P n q is the group generated by the E a,b and the phase ω · I q n ×q n . The weight wt(E a,b ) is the number of locations j ∈ [n] where either a (j) , b (j) are non-zero, and P n q,δ ⊂ P n q is the set of operators in the error group of weight less than δ · n.

Quantum Error Correction
Definition 2.1 ( [KL97]). An [[n, k, d]] q QECC (quantum error correcting code) is a subspace Q ⊂ (C q ) ⊗n of dimension q k . Let Π be the projection onto Q. If for all operators E of weight ≤ d, we have where η E ∈ C only depends on E, then Q is said to have distance d.
Quantum stabilizer codes are a class of QECCs defined as the joint eigenspace of a set S of commuting operators, the stabilizers. We discuss a presentation of stabilizer codes over finite fields by [AK01].
Definition 2.2 (Stabilizer Codes over Finite Fields, [AK01]). Let q = p m be a prime power. Let the set of operators {S 1 , · · · , S r } ⊂ P n q generate a commutative subgroup S of P n q . Then the subspace Q ⊂ C ⊗n q defined by forms a [[n, n − r m ]] q QECC. We refer to the stabilizer group of a code Q as S(Q). Associated to a stabilizer group is the normalizer group N (Q), the set of operators in the error group P n q which commute with all the elements of S(Q). The elements of N (Q) − S(Q) 5 are the 'undetectable errors' on Q, as they map code-states to distinct code-states, and the quotient group N (Q)/S(Q) are the logical operators on Q. The distance of Q is the lowest weight of any operator in N (Q) − S(Q). The class of 'detectable' errors of Q are the operators outside N (Q), which we detect by measuring the syndrome vector: Definition 2.3. For any operator E ∈ P n q , we refer to the syndrome s E = (s 1 , s 2 · · · , s r ) ∈ F r p of the operator E on the stabilizer code Q as the phases s i defined by Note that if E ∈ N (Q), then the syndrome is 0, s E = 0 r . Moreover, the syndrome is additive: if E, E ′ ∈ P n q , then s EE ′ = s E + s E ′ , and s E † = −s E mod p.
We instantiate most of our constructions in this work using the CSS codes introduced by [CS96,Ste96], and their extensions to non-binary fields [KKKS06, RGB04, KW08].
Theorem 2.1 (Galois-qudit CSS codes). Fix two linear classical codes C 1 , C 2 ⊂ F n q of dimension k, where C ⊥ 2 ⊂ C 1 and C 1 , C 2 both have distance at least d. Let CSS(C 1 , C 2 ) ⊂ C ⊗n q be the stabilizer code defined by the stabilizers E a,b ∈ P n q , a ∈ (C 2 ) ⊥ , b ∈ (C 1 ) ⊥ . Then CSS(C 1 , C 2 ) is a [[n, 2k − n, d]] q QECC. Moreover, the normalizer group of CSS(C 1 , C 2 ) are (up to a global phase) the operators E a,b ∈ P n q , a ∈ C 1 , b ∈ C 2 . While a seemingly minor modification, it will later be relevant to discuss CSS codes over vector spaces as well. As the authors haven't found such a pre-existing definition in the literature, we discuss a short self-contained proof below, which follows immediately from the techniques by [AK01].
Theorem 2.2. Fix two F q -linear [n, k] q m classical codes C 1 , C 2 ⊂ (F m q ) n of dimension k, where C ⊥ 2 ⊂ C 1 and C 1 , C 2 both have distance at least d. Let CSS(C 1 , C 2 ) ⊂ (C ⊗m q ) ⊗n be the stabilizer code defined by the stabilizers E a,b ∈ P n·m q , a ∈ (C 2 ) ⊥ , b ∈ (C 1 ) ⊥ . Then CSS(C 1 , C 2 ) is a [[n, 2k − n, d]] q m QECC.
Proof. We view the codewords of a ∈ C ⊥ 1 , b ∈ C ⊥ 2 as elements of (F q ) n·m , and define the set of operators E a,b ∈ P n·m q using the same expansion as the Galois-qudit construction. By design, these operators are commuting and thus define a stabilizer code Q over C ⊗n·m q , which we view as a code Q ′ over (C ⊗m q ) ⊗n .

Composition and Concatenation of Quantum Codes
If Q is a [[n, k]] q stabilizer code, then let Enc Q : C ⊗k q → C ⊗n q be the isometry which encodes into Q. Recall that Enc Q is a Clifford circuit, such that if X ∈ P k q is a operator in the Pauli group on k qudits, then we let refer to the encoding of X on Q.
Since Q 1 , Q 2 are stabilizer codes, Q • can alternatively be characterized in terms of its stabilizers: ⊂ P m q are the stabilizer generators of Q 1 , Q 2 respectively, then the stabilizer generators of Q • are those of Q 1 together with those of Q 2 encoded into Q 1 : The notion of concatenated (classical) codes was developed in a seminal work by Forney in 1966 [For09], and later introduced into a quantum setting by Knill and Laflamme [KL96] and Gottesman [Got97].
Enc in Enc out (|ψ ) That is, each qudit of the outer code is encoded into the inner code. Much like the case of code composition, the stabilizer generators of a concatenated quantum code can be expressed in terms of the stabilizers of the inner code Q in , and the encoding of stabilizers of the outer code Q out .
Fact 2.2. If {S out i } i∈[rout] ⊂ P n q m and {S in j } j∈[rin] ⊂ P n ′ q are the stabilizer generators of Q out , Q in respectively, then the stabilizer group of Q ⋄ is generated by the following set of operators: where the second set above corresponds to applying the jth stabilizer of S in to the ith inner block of the concatenated code.
CSS codes have a particular nicely behaved form of concatenation. Recall that concatenation requires specifying an encoding function for the inner code; we now describe how this can be done while preserving the CSS structure. Let Q out = CSS(C out 1 , C out 2 ) and Q in = CSS(C in 1 , C in 2 ) be [[n out , k out ]] qout and [[n in , k in ]] qout CSS codes respectively. Assume that q out = q kin in , and that all four classical codes C out 1 , C out 2 , C in 1 , C in 2 are F q -linear for some q. Letting q in = q m , so that q out = q mkin , then observe that (F mkin q , F mkin q ) and (C in 1 /C in 2 ⊥ , C in 2 /C in 1 ⊥ ) are both dual pairs of mk in -dimensional vector spaces over F q . Thus there exists a pair of F q -linear isomorphisms (Enc in 1 : F mkin that are duality-preserving in the sense that x, y = Enc in 1 (x), Enc in 2 (y) for all x, y. Claim 2.3. Let Q out = CSS(C out 1 , C out 2 ) and Q in = CSS(C in 1 , C in 2 ) be as above. Then there is a well defined [[n out n in , k out k in ]] qin CSS concatenation given by We will show the first equality above; the proof of the second is analogous.
Therefore c belongs to the (coset specified by the) encoding under (Enc in 2 ) ⊕nout of a vector that is orthogonal to all elements of C 1 , that is, c ∈ (Enc in 2 ) ⊕nout (C out

Quantum List Decodable Codes
Let Q be a stabilizer code of distance d, defined with respect to a basis of operators on single-qudits P q . Consider any adversarial quantum channel A acting on a (unknown) set of τ · n qudits of a code-state |ψ of Q. If the support of the attack has size τ · n < d, then, by measuring the syndrome of Q, one collapses A(ψ) into a mixture of single errors in the basis: Informally, this occurs since if any two distinct n-qudit operators σ, σ ′ ∈ P n q had the same small support < d and the same syndrome, then their product σ † σ ′ must be a stabilizer of Q. But if σ † σ ′ is a stabilizer, then σ, σ ′ corrupt code-states in essentially the same way: For any |ψ ∈ Q, σ |ψ = ησ ′ |ψ for some phase η ∈ C.
In this fashion, to decode A(ψ) it suffices to identify σ s from the syndrome measurement s. When the support of A is ≤ d/2, then there in fact exists a single σ (up to a stabilizer of Q) which matches the syndrome, and one can unique-decode. When the support of A is larger, all bets are off: In this sense, the notion of list-decoding for stabilizer codes we consider is simply the number of operators which match the measured syndrome s -and are all distinct up to a stabilizer of Q.
Definition 3.1. If S ⊂ P n q is a stabilizer group, then any pair of operators O, O ′ ∈ P n q is said to be S-stabilizer equivalent if O = O ′ S for some S ∈ S, and stabilizer-distinct otherwise.
In other words, O is in the coset O ′ S. When the set of stabilizers is implicit, we simply refer to the pair of operators as 'stabilizer-equivalent' or 'stabilizer-distinct'. We note that this relation defines equivalence classes over the Pauli group P n q , since if A, B and B, C are both stabilizer equivalent, then so are A and C. More importantly, if Q is the quantum code stabilized by S, then stabilizer-equivalent operators acting on the code-space give rise to the same state: where η S ∈ C is some global phase. Moreover, given a description of the stabilizer generators and O, O ′ , one can test stabilizer-equivalence efficiently via row reduction.
Equipped with this notion, we discuss the following definition of list decoding for stabilizer codes. Conceptually, after measuring the syndrome of the quantum code, we consider enumerating all the operators E 1 , E 2 · · · in a given class of errors E which agree with the syndrome measurement. However, note that many of these operators could be stabilizer-equivalent, corresponding essentially to the same state. The definition we study filters out this degeneracy, by considering the size of any list L s of stabilizer-distinct operators which agrees with s.
] q stabilizer QECC with stabilizer group S, and let E ⊂ P n q be a set of errors. Q is said to be ℓ-QLD (Quantum List Decodable) for E if, for every error E ∈ E, there exists at most ℓ stabilizer-distinct operators which agree with the syndrome s of E.
Of particular attention is the class of qudit Pauli errors E = P n q,τ of bounded weight τ · n, and we refer to a quantum code as (τ, ℓ)-QLD if it is an ℓ-QLD for P n q,τ . The immediate reason that this particular definition of list-decoding for quantum codes is useful is that the list L s can be viewed as a list of "correction operators." For instance, if |ψ ∈ Q is a code state of an ℓ-QLD Q, and an adversary corrupts it with an error E ∈ E of syndrome s, let the list of operators F 1 , · · · , F ℓ ⊂ E be those guaranteed by Definition 3.2. We note that by applying F † 1 on the corrupted code state E |ψ , we return it to the code space Q: F † 1 E |ψ ∈ Q. In fact, we can produce a next candidate code state by applying and so on. Naturally, we won't know which code state we are in, but by definition at least one correction F † i E |ψ ∝ |ψ recovers the original state. This description of list-decoding in terms of the syndrome measurements can alternatively be characterized through the normalizers and logical operators on the stabilizer code.
Claim 3.1. If Q is a stabilizer code with stabilizer group S(Q) and normalizer group N (Q), then for any E ∈ E of syndrome s, any list L s of operators in E which agrees with s satisfies Proof. If two operators A, E have the same syndrome, then A † E has null syndrome vector and thus A † E ∈ N (Q). In this manner, A can be written as the product of E and an element of the normalizer.
While the characterization above is a structural constraint on the stabilizers and normalizers of the quantum error correcting code, perhaps its main advantage is that one can cast the list-decoding task as an entirely classical process, without any modification to the encoding of the quantum code. As we will see shortly, this description allows us to draw a connection between CSS codes which are QLD and classical codes which are (classically) LD. Beforehand, we need to describe what it means to efficiently list-decode these stabilizer codes.
We refer to an [[n, k, d]] q ℓ-QLD code Q as efficiently list decodable for E if, given the syndrome s, one can produce in time polynomial in n, log q, l a classical description of a list L s ⊂ P n q of ≤ ℓ operators with the following stipulations: L s contains only stabilizer distinct operators with syndrome s; and moreover, for each element of E of syndrome s, there is an operator in L s stabilizer-equivalent to it. That is, the list-decoding algorithm is allowed to output extraneous list elements that are not stabilizer-equivalent to any error in E, as long as they still act as corrections, and the overall list size is ≤ ℓ. We emphasize that these "unpruned" lists arise because it can be intractable to determine if a given Pauli operator is stabilizer-equivalent to an element of E.
The main contribution of this section is a recipe to construct quantum list-decodable codes from classical list-decodable codes. For conciseness and to fit our applications, we present a discussion for CSS codes based on the Galois-qudit construction, which we review in Theorem 2.1.
there exist at most L cosets in C/C ′ that intersect the Hamming ball B τ n (x) of radius τ n centered at x.
We say that C/C ′ is efficiently (τ, L) list-decodable if there exists a poly(nm log q) time algorithm that outputs a list consisting of a representative of each coset in C/C ′ that intersects B τ n (x).
By definition if C is (efficiently) (τ, L) list-decodable then so is C/C ′ , as we may remove redundant list elements differing by an element of C ′ using row reduction.
Proof. Fix an error E a,b on the CSS code, of syndrome s = (s x , s z ). The normalizers of the CSS code are the operators E c 1 ,c2 , c 1 ∈ C 1 , c 2 ∈ C 2 . Recall from the definition in Theorem 2.2 that we implicitly view x ∈ (F m q ) n as an element x ∈ F nm q . From the previous claim, any list L s is contained in the set of operators It follows that the total number of pairs (a ′ , b ′ ) in the list is at most ≤ L 2 .
It remains to be shown that efficiency of the classical list-decoding for C 1 /C ⊥ 2 and C 2 /C ⊥ 1 implies efficiency for the quantum list-decoding of Q. Let E ′ = E ex,ez be any Pauli operator with the syndrome s = (s x , s z ), so that s x and s z are the parity check syndromes of e x and e z for C 1 and C 2 respectively. One can find such a pair e x , e z ∈ (F m q ) n by finding any solution to the underlying linear system in polynomial time via Gaussian elimination (note that here, we don't restrict e x , e z to be low weight). We call the classical list decoding algorithm for C 1 on e x , and for C 2 on e z , obtaining lists a 1 · · · a L and b 1 · · · b L ∈ (F m q ) n of classical errors of weight ≤ τ n. We claim that any stabilizer distinct operator of weight ≤ τ n that matches s is stabilizer equivalent to an operator E ai,bj , i, j ∈ [L], output by this algorithm. Indeed, for every operator E a ′ ,b ′ of weight ≤ τ n and of syndrome s, then a ′ and b ′ both have weight ≤ τ n and have parity check syndromes s x and s z for C 1 and C 2 respectively, so by definition the list-decoding algorithm must output an operator that is stabilizer-equivalent to E a ′ ,b ′ .

Explicit Constructions and Folded Quantum Codes
In this subsection we discuss explicit constructions of quantum list-decodable codes from classical list decodable codes, using Theorem 3.2. We use the well known classical Reed-Solomon codes, and the Folded Reed-Solomon codes from the breakthrough result of [GR08], to construct quantum codes which are efficiently list decodable up to the quantum Singleton bound (Theorem 3.8). While in principle we could approach the quantum Singleton bound using even random CSS codes, unfortunately these wouldn't be explicit, nor efficiently decodable. Thus for conciseness, we dedicate Appendix A to a collection of their properties which we later use in our concatenated constructions. Before diving into the explicit constructions, let us briefly overview the necessary background on these classical codes and related quantum codes.
Definition 3.4 (Generalized Reed-Solomon Codes). Let q be a prime power. Fix k < n < q, a primitive element γ of F * q , and a set of 'multipliers' U = (u 0 · · · u n−1 ) ⊂ F * q . The degree k − 1 GRS code is the set Each codeword of a Reed-Solomon code corresponds to the evaluation of a distinct polynomial over F q . The codewords of the Generalized RS code defined above, are RS codewords multiplied element-wise by scalars.
The following properties don't depend on the choice of primitive γ or subset U of F * q : The Quantum GRS codes, or Galois-qudit RS codes [ABO08,JX14], are quantum codes based on the Galois-Qudit CSS construction of the classical codes above. They are a class of quantum codes which meets the quantum Singleton bound, but at the cost of a large local qudit dimension: Theorem 3.4 (Quantum GRS codes [LXW08]). Fix a constant R ∈ (0, 1). Let C ⊥ 2 ⊂ C 1 ⊂ F n q be two GRS codes of block length n < q and dimension k 2 = n(1 − R)/2, k 1 = n(1 + R)/2 respectively, with the same evaluation points S = {1, γ, · · · , γ n−1 } ⊂ F q . The Quantum GRS code One can interpret the QGRS encoding as a superposition of polynomial evaluations, where the high degree coefficients are defined by the message. By combining our insights in the previous section with the result by [GS98], we obtain a quantum adaptation of a well known family of classically list decodable codes: Corollary 3.5. The Quantum GRS codes of Theorem 3.4 of rate R and block-length n are (1− 1+R 2 , n O(1) )-QLD. For small R, this approaches radius ≈ .29 − 1.4 · R.
Proof. Note that the classical codes C 1 , C 2 in Theorem 3.4 both have rate R ′ = (1 + R)/2, and are efficiently LD up to a radius 1 − √ R ′ [GS98]. Theorem 3.2 concludes the proof.
In their seminal work Guruswami and Rudra [GR08] introduced Folded Reed-Solomon codes, which are efficiently list decodable up to almost the Singleton bound. Informally, they are defined by 'bundling' or 'folding' together groups of m consecutive symbols of the RS code, into a symbol of a code on a larger alphabet.
Definition 3.6 (m-folded Reed-Solomon codes [GR08]). Fix a primitive element γ of F * q , integers n, m, k where k < n ≤ q − 1 and m divides n. The m-folded RS code F RS m n,k,q is an [n/m, . . .
Theorem 3.6 ([GR08]). For any q > n, there exists a choice of By multiplying element-wise the RS codes above by scalars u i ∈ F * q , i ∈ [n], one defines Folded Generalized RS codes. Our starting point for efficiently list decodable quantum codes is an analogous bundling for the physical qudits of any stabilizer code.
Definition 3.7. Let S 1 , · · · , S r ∈ P n q define a set of generators for an where each generator S i = ⊗ j∈[n] S ij is expressed as a tensor product of operators acting on C q .
Analogously to the classical construction, we are folding the physical qudits together, and we view the stabilizers as operators acting on a larger local dimension. We emphasize however that they are the same stabilizers, and the syndromes of operators acting on the code are measured in the same way as before.
The key distinction is that now the notion of the 'weight' of an operator E acting on Q (m) , is the number of distinct 'bundles' that E acts non-trivially on. A simple claim allows us to use the list decoding algorithms of folded classical codes on folded quantum codes, when Q is a CSS code.
Claim 3.7. If Q is the Galois-qudit CSS code of two linear classical codes C 1 , C 2 ⊂ F n q , then Q (m) is the vector-space CSS code of the two F q -linear folded classical codes C See the definitions in Theorem 2.1 and Theorem 2.2 for the distinctions between these CSS constructions.
Proof. As defined in Theorem 2.2, the vector space CSS code of C ) ⊥ as an element of F n q is the 'unfolded' element a ∈ C ⊥ 1 , we arrive at precisely the definition of Q (m) .
Equipped with this notion of folding, we can now consider folding the Quantum GRS codes of Theorem 3.4.
Definition 3.8 (Folded Quantum Reed-Solomon Code). For 0 < R < 1, fix a primitive element γ ∈ F * q and integer block length n < q − 1, and define integers dimension d = n − (1 + R)n/2 and m with m|n. The m-folded Quantum RS code is an [[n/m, R · n/m, d/m]] q m quantum error correcting code defined over qudits of local dimension q m , which encodes a computational basis state |f , f ∈ F Rn q through the superposition Enc(|f ) = |f : . . .
Where in the above (f + f ′ )(x) corresponds to the evaluation at x ∈ F q of the polynomial defined by f ′ as the low degree coefficients < d, and f as the high degree coefficients within d and d + R · n. The bracket notation corresponds to the tensor product state in C ⊗m . . .
The main theorem of this section is that these m-folded QRS codes are QLD up to essentially the distance of the quantum code.
Proof. From Claim 3.7, we understand the FQRS codes as the vector space CSS codes (Theorem 2.2) of two classical folded GRS codes. These are classically ( 1−R 2 − γ, q O(1/γ) )-LD from Theorem 3.6, [GR08]. Finally, since the folded GRS codes are F q -linear, from Theorem 3.2 we conclude the FQRS codes are

Approximate Quantum Error Correction
In this section we construct approximate quantum error correcting codes (AQECCs) that approach the quantum Singleton bound. In Section 4.1 we construct private AQECCs -which use a private classical side-channel -from quantum list decodable codes and purity testing codes. In Section 4.2 we show how to use a classical robust secret sharing scheme to remove the need for the classical side-channel, at the cost of slightly increasing the alphabet size.

Private AQEC from Quantum List Decoding and Purity Testing
Recall our definition of a private AQECC, where the sender and receiver have access to a private classical side-channel.
Definition 4.1 (Definition 1.5, restatement). A set of pairs {(Enc k , Dec k )} k∈K of quantum channels is said to be a (δ, ε)-private AQECC with keys K if for all adversarial channels A of weight δ · n, We now describe a construction of private AQECCs from list decodable quantum codes (QLDs) and purity testing codes (PTCs). Recall that a (δ, L)-QLD stabilizer code produces a list of possible corrections of size L, given any codestate that has been adversarially corrupted on up to a δ fraction of symbols (see Definition 3.2). Roughly, an ε-PTC detects any fixed Pauli error with probability 1 − ε (see Definition 1.4).
Given an [[n, by channels Enc k that encode a message state ρ into Q k and then into Q LD : To decode the quantum code composition Q LD • Q k 6 , we use Algorithm 1.
Algorithm 1: Dec k for Q LD • Q k Input: A corrupted code-state A(Enc k (ρ)) 1 Measure the syndromes s QLD of Q LD and s P T C of Q k ; 2 Apply list decodability to s QLD to obtain a list E 1 , . . . , E L of potential errors; 3 Compute the Q k -syndromes s 1 , . . . , s L of E 1 , . . . , E L , and choose any i ∈ [L] such that s i = s P T C ; 4 Apply (E i • Enc k ) † to the corrupted code-state and output the resulting message; The main result of this subsection is the following lemma, which states that the composition above forms a private AQECC. m]] q stabilizer codes, and a (δ, 2 · L · ε) private AQECC.
Theorem 4.2 ([BCG + 02]). For every prime power q and every λ, n P T C ∈ N with λ|n P T C , there exists a stabilizer ε-PTC {Q k } on qudits of local dimension q and key size λ · log q bits, encoding n P T C − λ qudits into n P T C qudits, where ε ≤ 2 · n P T C · q −λ /λ.
We leverage two key ideas to prove Lemma 4.1. First, recall the discussion in Section 3: If Q LD has distance d, then the syndrome measurement in step 1 of Algorithm 1 of any adversarial channel A(·) of support at most δ · n < d collapses the corruption on the code state down to a single Pauli error E. Moreover, the local indistinguishability of the stabilizer code guarantees that an adversary can't learn any information about the secret key k, and thus E is independent of the random choice of k. We formalize this idea in Fact 4.1, and for conciseness, defer to Claim C.2 in Appendix C a proof of a more general version even in the presence of adversaries with entangled side information.
Next, the list decodability of Q LD enables us to write down a short list F 1 , · · · , F L of errors associated to the syndrome measurement s QLD of E. We argue in Claim 4.4 that if any candidate error F i has the same PTC syndrome as the syndrome measurement s P T C , then with high probability it exactly corrects the error E. Finally, in Claim 4.5 we tie these ideas together and conclude the proof of Lemma 4.1. In this manner, if we pre-encode a message ψ with an 'inner' PTC code Q k (for a random choice of key k) before encoding it into a stabilizer code Q LD , then the syndrome measurement s QLD must be independent of k.
Claim 4.4 below reasons that if an operator E is an undetectable error of Q LD (i.e., E ∈ N (Q LD ) \ S(Q LD )), then with high probability over the choice of k, E is not an undetectable error of the composition Q LD • Q k .
Later, we use this claim to show the PTC indeed eliminates all but one list element (up to stabilizerequivalence) with high probability.
Claim 4.4. Let E ∈ P n q satisfy E ∈ N (Q LD ) \ S(Q LD ). If {Q k } forms an ε-PTC, then , E is equivalent up to a stabilizer (of Q LD ) to some encoded operator O on Q LD . Let O be the operator acting on the message space of Q LD corresponding toŌ. If we could by definition of the ε-PTC. To prove our claim, we consider two cases on O: is simply a stabilizer of the composed code. If O / ∈ N (Q k ), then O doesn't commute with some stabilizer S of Q k . That implies their encodings in the composed codeŌ,S also don't commute. Thus Let us now tie these ideas together, and prove that Algorithm 1 approximately decodes the code composition. Claim 4.5 below reasons that the density matrix produced at the end of the decoding Algorithm 1 has uniquely decoded the adversarial error with high probability over the random choice of key k, and the outcome of the syndrome measurement.
Claim 4.5. For any adversarial channel A acting on |S| ≤ δ·n < d code components, and any Q LD syndrome measurement s = s QLD , there exists a large subset of PTC keys Good A,s ⊂ K, |Good A,s | ≥ |K|(1 − L · ε), such that the density matrix describing the outcome of step 4 in Algorithm 1 in expectation over k ∈ K can be written as where p A,s denotes the probability of the syndrome measurement s, and ρ k,s are arbitrary m qudit density matrices. Thus, Algorithm 1 uniquely recovers the encoded state ρ with probability (and fidelity) ≥ 1 − L · ε, and moreover Q LD • Q k forms a (δ, 2εL) private AQECC.
Proof. From Fact 4.1, we know that the syndrome measurement of Q LD in step 1 of Algorithm 1 collapses the state into a mixture of single Pauli errors where each Pauli σ A,s ∈ P n q is a function only of s = s QLD and the support of A. Note that the syndrome measurement of s P T C does not further collapse the state.
Given (s QLD , s P T C ), if E 1 · · · E L is the list of candidate corrections to σ A,sQLD produced in step 3, then at least some j ∈ [L] corrects σ A,sQLD , i.e. E † j σ A,sQLD ∈ S(Q LD • Q k ). Moreover, the decoding algorithm fails to produce ρ if there exists some other E i of PTC syndrome s P T C which fails to correct σ A,sQLD , i.e.
From Claim 4.4, the probability over k this occurs is at most L · ε by a union bound. Thereby, for every Q LD syndrome measurement s = s QLD , there exists a subset of PTC keys Good A,s ⊂ K, |Good A,s | ≥ |K|(1−L·ε) where any E j in the list with PTC syndrome s P T C exactly recovers ρ. If k ∈ K \ Good A,s , we have no guarantees on the returned state ρ k,s .
To conclude the proof, let us trace out the syndrome measurement and choice of key k in ρ 4 . For any encoded state ρ, Tr s,k [ρ 4 ] = ρ · p success + ρ f ail , where p success = s p A,s Good A,s /|K| ≥ (1 − L · ε) and ρ f ail 1 = 1 − p success ≤ Lε. Thus,

AQECC from Private AQEC and Robust Secret Sharing
Recall the definition of an AQECC.
Definition 4.2. A pair (Enc, Dec) of quantum channels is said to be a (δ, ε)-AQECC if, for all adversarial channels A of weight δ · n, The following definition of robust secret sharing is taken from [CDD + 15], except that we do not restrict to linear schemes and we do not include separate parameters for privacy and reconstructability. We also require the algorithms in the scheme to be efficient. The following result is from [CDD + 15], with the explicit choice of alphabet size a from [GX14]. Concretely, we use the fact that 2 1/γ < a = 2Õ (γ −2 ) .  Formally, Enc forQ works as follows: 2. Apply Enc to ρ, and call the resulting register C = (C 1 , . . . , C n ).
4. Use (C, S) as the codestate, where register i ∈ [n] is the a · q-dimensional register (C i , S i ).
To decodeQ, we recover the private keys using the reconstruction algorithm of RSS and then apply the decoder for Q to the C register: Proof. Let ρ be any message. Partition the registers of Enc(ρ) into C A , CĀ, S A , SĀ, where C A , CĀ are the private AQECC part and S A , SĀ are the RSS part, and the error channel acts only on C A , S A . Let E denote the error channel. By the secrecy guarantee of the RSS against any subset of d symbols, we have and thereby the adversary gains no information about the encryption key. By the recoverability guarantee of the RSS, Dec will use the correct private keys r with probability 1 − ε, so Using the private AQECC of Corollary 4.3 and the robust secret sharing scheme of [CDD + 15], we are able to instantiate Theorem 4.7 to obtain the following result.

Distance Amplification and Alphabet Reduction for Quantum Codes
In this section, we describe how we apply Alon-Edmonds-Luby (AEL) distance amplification [AEL95] to quantum codes. This technique has seen extensive use in classical coding theory [GI01, GI02, GI03, GR08, HW18, KMRZS15, GKO + 18, HRZW19], as it allows for amplifying the distance of a code while reducing alphabet size and preserving properties such as decodability and local testability and correctability.
To the best of our knowledge, AEL amplification has not previously been used in the quantum setting. However, as shown below, this technique translates almost flawlessly to quantum codes. This observation immediately yields some new results that will be discussed below, such as efficiently decodable quantum codes approaching the quantum Singleton bound over constant sized alphabets. In fact, such codes can be made LDPC using recent asymptotically good quantum LDPC constructions [PK22,LZ22c], some of which permit efficient decoding [LZ22a, DHLV22, GPT22, LZ22b].
Both of our constructions of AQECCs approaching the quantum Singleton bound apply the AEL construction. Specifically, we instantiate the AQECC construction described in Section 4 using quantum listdecodable codes approaching the quantum Singleton bound with constant alphabet size that we will construct in Section 6 by applying AEL to reduce the alphabet size of folded quantum Reed-Solomon codes. Then in Section 7, we provide another construction of AQECCs by applying AEL amplification directly with inner codes that are themselves appropriately chosen AQECCs.
At a high level, the AEL construction amplifies the distance of a code by concatenating with a small inner code of good distance, and then permuting the symbols of the concatenated code using an expander graph. If the outer code is chosen to have high rate and constant relative distance, then the resulting construction inherits the rate and distance of the inner code, up to a small loss. This procedure in fact works for arbitrary quantum codes; we do not even need to restrict attention to stabilizer codes below.
We first define the appropriate notion of expansion.
Definition 5.1. An r-regular bipartite graph G = (L, R, E) with |L| = |R| = n is said to be ε-pseudorandom if it holds for every S ⊆ L and T ⊆ R that By the well-known expander mixing lemma, the 2-lift of any λ-spectral expander graph is λ-pseudorandom. Thus in particular, the 2-lift of a r-regular Ramanujan graph is ε-pseudorandom for ε = 2 √ r − 1/r. It follows that there exist explicit families of r-regular ε-pseudorandom graphs for all r ≥ 4/ε 2 .
We now present the AEL construction in the quantum setting. We first present a basic version that amplifies distance without decreasing the alphabet size. We will then explain how the alphabet size can also be reduced. The analysis of the quantum version of the AEL construction in Proposition 5.1 and Proposition 5.4 below directly adapts the well-known analogous results for classical codes dating back to [AEL95]. However, to the best of our knowledge the application to the quantum setting is new, as are the corollaries below providing quantum codes approaching the quantum Singleton bound that are efficiently unique-decodable up to half their distance.

Distance Amplification without Alphabet Reduction
We first describe a simple version of AEL amplification that does not reduce alphabet size. Let Q out and Q in be [[n out , k out , ∆ out n out ]] qout and [[n in , k in , ∆ in n in ]] qin quantum codes respectively such that q out = q kin in . Let Q ⋄ = Q out ⋄ Q in denote the [[n out n in , k out k in ]] qin concatenated code. The key step is now to permute the components of Q ⋄ according to the edges of an n in -regular bipartite expander, and to block the n out n in q in -ary components into n out q nin in -ary components. Specifically, let G = (L = [n out ], R = [n out ], E) be an n in -regular ε 0 -pseudorandom bipartite graph, and assume that the edges at each vertex have an arbitrary labeling by elements of [n in ]. Let π G : [n out ] × [n in ] → [n out ] × [n in ] be the permutation that maps (i, j) ∈ [n out ] × [n in ] to the unique pair (i ′ , j ′ ) such that the jth outgoing edge in G from vertex i ∈ L lands on i ′ ∈ R, and j ′ is the label that vertex i ′ assigns to this edge (i, i ′ ). Define Q = π G (Q ⋄ ) to be the [[n out , R in k out ]] q n in in code obtained by applying the permutation π G to the components of Q ⋄ , and then regrouping each resulting block of n in components to a single q nin in -ary symbol. Observe that Q has the same rate R = R ⋄ = R out R in as Q ⋄ . Proposition 5.1. The code Q defined above has relative distance ∆ ≥ ∆ in − 2ε 0 ∆ in /∆ out .
More generally, for every 0 < α out , α in < 1, if a codeword of Q experiences an error on α ≤ α in −ε 0 α in /α out fraction of its (q nin in -ary) components, then after applying π −1 G , fewer than α out fraction of the resulting inner code blocks experience errors on at least α in fraction of their (q in -ary) components.
Proposition 5.1 follows directly from the following lemma, which captures the key property of the permutation π G .
Lemma 5.2. Let G = (L = [n out ], R = [n out ], E) be an n in -regular ε 0 -pseudorandom bipartite graph, and define π G : [n out ] × [n in ] → [n out ] × [n in ] as above. Then for every 0 < α out , α in < 1, and for every T ⊆ R of size |T | ≤ (α in − ε 0 α in /α out ) · n out , there are fewer than α out · n out vertices i ∈ L for which Proof. The proof is a direct application of the definition of ε 0 -pseudorandomness. Let S ⊆ L be the set of vertices for which Equation (27) holds. Then by definition |E(S, T )| ≥ |S| · α in n in .
Meanwhile by the ε 0 -pseudorandomness of G, where the second inequality above applies the fact that |T | ≤ (α in − ε 0 α in /α out ) · n out . The above inequalities give a contradiction whenever |S|/n out ≥ α out , so we must have |S|/n out < α out , as desired.
To apply Lemma 5.2 to an AEL code Q = π G (Q out ⋄ Q in ), we will typically choose α out and α in to be the decoding radii of Q out and Q in respectively. Then if Q experiences errors on α in − ε 0 α in /α out fraction of its components, we may apply the natural decoding algorithm Dec Qout • Dec ⊗nout Qin • π −1 G , and Lemma 5.2 guarantees that fewer than α out fraction of the inner decodings fail, so that the outer decoding will succeed. The following proof of Proposition 5.1 formalizes this idea for unique decoding for both the inner and outer codes. We will subsequently follow [GR08] in applying the same idea with list decoding for the inner code and list recovery for the outer code.
Proof of Proposition 5.1. The second statement in the proposition is equivalent to Lemma 5.2, so we just need to show the first statement. For this purpose, it suffices to show that Q can be decoded from errors acting on at most κ = ∆ in /2 − ε 0 ∆ in /∆ out fraction of the components. Assume some error acts on some subset T ⊆ [n out ] of the code components with |T | ≤ κn out . Let S ⊆ [n out ] be the set of blocks in Q ⋄ = π −1 G (Q) inside which at least ∆ in n in /2 of the qudits are mapped by π G to blocks in T . Lemma 5.2 with α in = ∆ in /2 and α out = ∆ out /2 gives that |S| < ∆ out n out /2, so the natural decoding algorithm Dec Qout • Dec ⊗nout Qin • π −1 G is guaranteed to successfully correct the error, as all inner decodings in blocks outside of S must succeed.
Below we show how applying AEL amplification to asymptotically good quantum LDPC codes with a constant sized random inner code yields efficiently decodable quantum LDPC codes approaching the quantum Singleton bound over constant sized alphabets. To the best of our knowledge, such a family of quantum codes was not previously known even without the LDPC requirement.
Corollary 5.3. For every γ > 0 and 0 < R < 1, there exists some q = q(γ) such that there exists an explicit infinite family of quantum LDPC CSS codes of rate R, relative distance ∆ = (1 − R − γ)/2, and alphabet size q that are decodable in time O γ (n) up to errors on ∆/2 fraction of the n components.
Proof. We may assume that R < 1−γ, as otherwise ∆ ≤ 0 and the result holds trivially. We may also assume that R ≥ γ/2, as otherwise we may simply construct an AQECC of larger rate γ/2 using the argument below for updated parameters R ′ = γ/2 and γ ′ = γ/2. By [PK22, LZ22c, LZ22a, DHLV22, GPT22, LZ22b], there exist explicit infinite families of [[n out , k out ]] 2 qLDPC CSS codes Q out of rate 1 − γ/20 over a binary alphabet that are decodable in linear time (for fixed γ) up to some constant fraction κ = κ(γ) of errors. Here we do not need to let κ or the decoding runtime depend directly on R because γ/2 ≤ R ≤ 1 − γ by assumption.
Futhermore, by Claim A.2, there exist sufficiently large q in = q in (γ) and n 0 = n 0 (γ) such that for every n in ≥ n 0 , a random CSS code Q in of rate R + γ/20, block length n in , and alphabet size q in will with positive probability have relative distance ≥ (1 − R − γ/10)/2. Here we may assume that q in = 2 m for some m ∈ N, so the classical codes making up the random CSS code are linear over F qin , and therefore are also F 2 -linear. Now set γ 0 = γ √ κ/40, and set n in = max{n 0 , 4/γ 2 0 }. Let Q ⋄ = Q out ⋄ Q in denote the concatenated code, where before concatenating we first block together groups of mk in qubits in Q out to obtain a code with the same rate and decoding radius over the alphabet (F m 2 ) kin . Finally, for some n in -regular γ 0 -pseudorandom bipartite graph G, let Q = π G (Q ⋄ ). Such a graph exists because n in ≥ 4/γ 2 0 by assumption. Thus we have constructed an infinite family of quantum codes Q of rate (1 − γ/20)(R + γ/20) ≥ R over the alphabet F m 2 . By Proposition 5.1, these codes are decodable up to errors acting on ∆ in /2 − 2γ 0 / √ κ > (1 − R − γ)/4 fraction of the components. The proof of Proposition 5.1 in fact implies that the natural decoding algorithm Dec Q = Dec Qout • Dec ⊗nout Qin • π −1 G decodes up to this radius. For fixed γ, this algorithm runs in time linear in the block length because Dec Qout by assumption runs in linear time, and Q in is a constant size CSS code and thus can be decoded in constant time via brute force. Also observe that for fixed γ, R, then Q out is an explicit LDPC CSS code, and Q in is a constant sized CSS code that can be constructed in constant time via a brute force search. Thus Q ⋄ and therefore Q is an explicit quantum LDPC CSS code.

Distance Amplification with Alphabet Reduction
We now show how the AEL construction can simultaneously amplify the distance and reduce the alphabet size of the outer code. Again let Q out and Q in be [[n out , k out , ∆ out n out ]] qout and [[n in , k in , ∆ in n in ]] qin quantum codes respectively such that q out = q kin in . Let Q ⋄ = Q out ⋄ Q in denote the [[n out n in , k out k in ]] qin concatenated code. As in Section 5.1, we will permute the components of Q ⋄ according to an appropriate expander graph and reblock into larger symbols. However, we will now reblock into smaller symbols than before.
Specifically, for some r ≤ n in , we partition the code components into groups of r q in -ary symbols, each of which we block into a q r in -ary symbol. To avoid rounding issues, for simplicity assume that r divides n in , and let b = n in /r. Let G = (L = [n out b], R = [n out b], E) be an r-regular ε 0 -pseudorandom bipartite graph, and assume that the edges at each vertex have an arbitrary labeling by elements of [r]. Similarly as in Section 5.1, let π G : [n out b] × [r] → [n out b] × [r] be the permutation that maps (i, j) ∈ [n out b] × [r] to the unique pair (i ′ , j ′ ) such that the jth outgoing edge in G from vertex i ∈ L lands on i ′ ∈ R, and j ′ is the label that vertex i ′ assigns to this edge (i, i ′ ). Define Q = π G (Q ⋄ ) to be the [[n out b, k out k in /b]] q r in code obtained by applying the permutation π G to the components of Q ⋄ , and then regrouping each consecutive block of r q in -ary components into a single q r in -ary component. As before, Q has the same rate R = R ⋄ = R out R in as Q ⋄ . However, now the alphabet size q r in of Q does not depend on the inner code's block length n in . Proposition 5.4. The code Q defined above has relative distance ∆ ≥ ∆ in − 6(ε 0 /2 · ∆ in /∆ out ) 2/3 . More generally, for every 0 < α out , α in < 1, if a codeword of Q experiences an error on α ≤ α in − 3(ε 0 /2 · α in /α out ) 2/3 fraction of its (q r in -ary) components, then after applying π −1 G , fewer than α out fraction of the resulting inner code blocks experience errors on at least α in fraction of their (q in -ary) components.
Proof. We will prove the second statement in the proposition, as the first statement then follows by letting α out = ∆ out /2 and α in = ∆ in /2 analogously as in Proposition 5.1. Let ε ′ = (ε 0 /2 · α in /α out ) 2/3 . Then Q experiences an error on α ≤ α in − ε ′ − ε 0 α in /ε ′ α out fraction of its components, so Lemma 5.2 implies that fewer than ε ′ α out fraction of the components of π −1 G (Q) (each of which is itself a length-r block of q in -ary symbols) experience an error acting on at least α in − ε ′ fraction of its symbols. Now recall that each inner code block of π −1 G (Q) consists of b of these length-r blocks with br = n in . Thus for a given inner code block, if at most ε ′ fraction of the b length-r blocks experience an error acting on at least (α in − ε ′ )r symbols, then the number of symbols in the entire inner block that experience an error is at most ε ′ br + (1 − ε ′ )(α in − ε ′ )br < α in br. Thus an inner code block can only experience errors on ≥ α in fraction of its n in = br symbols if > ε ′ fraction of its length-r blocks experience errors on at least α in − ε ′ fraction of their symbols. Therefore if at least α out fraction of the inner code blocks experience errors on at least α in fraction of their components, then more than ε ′ α out fraction of the length-r blocks in the entire code π −1 G (Q) must experience errors on ≥ α in − ε ′ fraction of their symbols. But as described above, Lemma 5.2 implies that this latter statement cannot occur, so fewer than α out fraction of the inner code blocks can experience errors on at least α in fraction of their components, as desired.
We will typically apply Proposition 5.4 with an outer code of growing alphabet size q out = poly(n out ), such as quantum Reed-Solomon or folded Reed-Solomon, and an inner code of fixed alphabet size q in = O(1), such as a random CSS code.

Constant-Alphabet Quantum List Decodable Codes Near the Singleton Bound
In this section, we apply the AEL distance amplification and alphabet reduction construction described in Section 5 to the folded quantum Reed-Solomon codes described in Section 3.1. This construction is a quantum analogue of the classical construction of [GR08]. As in the classical case, the resulting quantum codes have constant alphabet size and are efficiently list-decodable with polynomial list size for a fraction of adversarial errors approaching the Singleton bound. The proof of Theorem 6.1 concatenates a folded quantum Reed-Solomon outer code (see Section 3.1) with a list-decodable random CSS inner code and then reduces the alphabet size using AEL. To list-decode such a concatenation, we typically want to use a list-recoverable outer code as defined below.
The following result of [GR08] shows that folded Reed-Solomon codes have this property.
In Theorem 6.2, we will typically have q growing with the block length N while s, t, ℓ, R are fixed, so the condition that (s + t)(ℓ/R) 1/(s+1) < q trivially holds. Then for γ > 0 and ℓ = O γ (1) we may choose sufficiently large s, t, m = O γ (1) to obtain list-recovery up to a radius η = R + O(γ) lying within O(γ) of the Singleton bound.
Proof of Theorem 6.1. The code Q is an instantiation of the AEL construction described in Section 5.2 with the following parameters. Note that we may assume that γ/2 ≤ R ≤ 1 − γ, as if R < γ/2 we may simply instead construct a code of greater rate γ/2, and if R > 1 − γ then the desired relative distance satisfies δ < 0, which is trivially achievable. For completeness below we give explicit constants, which we do not attempt to optimize.
• Set Let Q out be the [[n out , k out ]] qout code defined to be the m-folding of Q 0 out (see Section 3.1).
• Let Q in be a [[n in , k in ]] qin CSS code of rate R in = R + γ/20 and dimension k in = log qin q out that has relative distance ≥ δ in = (1 − R in − γ/10)/2 and consists of two classical (δ in , ℓ) list-decodable codes, so that Q in (δ in , ℓ 2 ) list-decodable. By Claim A.2, a random CSS code satisfies these properties with probability 1 − q −Ω(γn) in .
• As described in Section 5.2, let Q ⋄ = Q out ⋄ Q in , and let Q = π G (Q ⋄ ) be our final construction.
A direct application of Proposition 5.4 implies that Q has relative distance ≥ δ. We now show that Q is efficiently (δ, L) list-decodable. For this purpose, observe that Q ⋄ is the concatenation of the CSS codes Q out = CSS(C out 1 , C out 2 ) and Q in = CSS(C in 1 , C in 2 ), and thus by Claim 2.3, Therefore by Theorem 3.2, it suffices to show that C 1 /C ⊥ 2 and C 2 /C ⊥ 1 above are efficiently (δ, √ L) listdecodable in the sense of Definition 3.3. By symmetry of the construction, it suffices to consider C 1 /C ⊥ 2 , as C 2 /C ⊥ 1 is identical. Then our goal is to show that given a corrupted codeword x of C 1 , there exists an efficient algorithm that outputs a list of size ≤ √ L containing a representative of every coset in C 1 /C ⊥ 2 that intersects the Hamming ball B δn (x) of radius δn centered at x. Recall that then subtracting x from each list element yields the desired list of stabilizer-distinct X error operators for quantum list-decoding as stated in Definition 3.2; the Z error operators are obtained by analogously list-decoding C 2 /C ⊥ 1 . The desired list-decoding algorithm is as follows. Let α in = δ in and α out = γ/50. First, for each i ∈ [n out ], we apply a brute force search to compute the list ⊥ of all inner code messages whose encodings differ from the ith inner code block of π −1 G (x) in at most α in -fraction of positions. Then we apply the list-recovery algorithm given by Theorem 6.1 to S 1 , . . . , S nout , and output the (encodings into C 1 of the) returned list. Recall that when we re-encode the inner code, we apply the maps Enc in 1 and Enc in 2 described in Section 2.3 that send outer code symbols to cosets, and then we may select an arbitrary element from each coset. To show correctness, assume that x is obtained by corrupting at most δ-fraction of the symbols in some codeword c ∈ C 1 . It suffices to show that the list returned by the above algorithm includes an element of the coset c + C ⊥ 2 . By Proposition 5.4 and by the list-decodability of C in 1 , at most α out -fraction of the inner decodings return a list that does not contain the respective component of c. Thus by Theorem 6.2, the final list returned by the algorithm will contain c, up to addition by some element of π G ((C in 2 ⊥ ) ⊕nout ) ⊆ C ⊥ 2 from the re-encoding step described above. Also observe that by Theorem 6.2, the returned list will have size at most (n out m) O(s) ≤ n O(1/γ 3 ) .
It remains to be shown that Q can be constructed in time n O(1/γ 4 ) with failure probability 2 −Ω(n) . The folded Reed-Solomon code is explicit, so the construction algorithm simply needs to find an appropriate inner CSS code Q in . By Claim A.2, a random choice of Q in works with probability > 1/2, so trying n random codes and checking the distance and list-decodability of each one by brute force gives the desired construction algorithm.

AQEC without List Recovery
This section presents a construction of efficient AQECCs that avoid the need for list recovery. In fact, the only algorithmic ingredient this construction relies on is an efficient unique-decoder for an asymptotically good code, as the construction only performs list-decoding on a small inner code where a brute force search is sufficient.
The main idea of this construction is to concatenate an outer high-rate constant-distance unique-decodable QECC with an inner AQECC that permits exact unique decoding with high probability almost up to the Singleton bound. Specifically, for the inner code we use the concatenation of a quantum list-decodable code near the Singleton bound with a PTC, to ensure (inefficient) unique decodability near the Singleton bound with high probability for any fixed error. The inefficiency here is not a concern due to the small block length of the inner code. We then apply AEL distance amplification to boost the distance of the concatenated code almost to the Singleton bound.
We now show how to construct private AQECCs approaching the Singleton bound. Theorem 4.7 then gives the desired non-private AQECCs.
Theorem 7.1. For any given γ > 0 and 0 < R < 1, let δ out > 0 be such that there is an infinite explicit family of stabilizer codes Q 0 of rate 1 − γ/4 and alphabet size q 0 that are unique-decodable from errors acting on δ out fraction of the components in f (n 0 log q 0 ) time for some increasing function f : R + → R + , where n 0 denotes the block length.
Proof. We may assume that R ≤ 1 − γ, as otherwise the decoding radius in the theorem statement is 0. We may also assume that R ≥ γ/2, as otherwise we may simply construct an AQECC of larger rate γ/2 using the argument below for updated parameters R ′ = γ/2 and γ ′ = γ/2; such a change only affects the resulting code's parameters by constant factors in the R ′ and γ ′ coefficients.
We construct Q as follows. Below, we ignore rounding issues when choosing integer-valued parameters for ease of presentation; such rounding only affects the resulting bounds by constant factors. For completeness we give explicit constants, which we do not attempt to optimize.
qin CSS code of rate R in and relative distance ≥ δ in that is (δ in , ℓ) quantum list-decodable. By Claim A.2, a random CSS code satisfies these properties with probability ≥ 1 − q −Ω(γn) in ≥ 1/2. Such a code can be found via a brute force search in time q out ) }, which is constant with respect to n.
• Let q out = q kP in ≥ q γnin/2 in ≥ q 0 , and let Q out be the [[n out , k out , δ out ]] qout code of rate R out = 1 − γ/4 obtained by reblocking (that is, folding) the code Q 0 defined in the theorem statement to increase the alphabet size from q 0 ≤ q out to q out .
• Let q = q nin in , and for every κ ∈ K n , define the Here Enc Q κ ⋄ takes as input a message state and the classical private key κ, the latter of which consists of n independent private keys for the n respective calls to Enc Pin .
• Let G be an n in -regular γ 0 -pseudorandom bipartite graph, and for κ ∈ K n let Q κ = π G (Q κ ⋄ ), where π G : [n] × [n in ] → [n] × [n in ] is the permutation specified by G as described in Section 5.1.
We now show that the private code Q = {Q κ : κ ∈ K n } defined above has the desired properties. By definition, Q has rate R out R P R in ≥ R, alphabet size q = 2 O(1/γ 3 δout) , and private key length n · log q λ in ≤ O(n(1/γ)(1/γ + log(1/δ out ) + γ log n in )) ≤ O(γ 2 · n log q), where this final inequality uses the fact that δ out ≤ γ/8 by the quantum Singleton bound for Q 0 , and the fact that q = q nin in with n in ≥ 4/γ 2 0 = Θ(1/γ 2 δ out ). It remains to be shown that Q has a decoding algorithm with the desired error and efficiency parameters. We define the following natural decoding algorithm Dec κ Q . Let Dec κ in = Enc † Q in•P κ in • Dec κ in be the brute force decoding algorithm for the composed stabilizer code Q in • P κ in . Here Dec κ in first performs a syndrome measurement for Q in •P κ in and finds all stabilizer-distinct errors of weight ≤ δ in consistent with the syndrome. If there is a unique such error E (up to multiplication by stabilizers), the algorithm applies E † to the measured state to correct the error; otherwise, it fails and gives an arbitrary output. Let Dec Qout denote the uniquedecoding algorithm for Q out provided by the theorem statement. Then we let As Q κ is the concatenation of stabilizer codes, the decoding algorithm described above can be implemented as a single syndrome measurement followed by a classical algorithm that computes a Pauli error, whose inverse can then be applied to the measured state to restore the initial code state with high probability. However, for the purpose of our analysis, it is helpful to assume that the inner code syndromes are measured before the outer code syndrome, as then we can apply Lemma 4.1 (and its composable generalization in Theorem C.1) to the inner codes.
Each of the inner decodings Dec κi in runs in time O(q 2 ) because the brute force search may simply iterate through all possible Pauli errors. Thus the overall runtime of Dec Q is f (n) + O(nq 2 ).
It remains to be shown that Q is a private (δ, 2 −Ω(δoutn) )-AQECC for δ = (1 − R − γ)/2. For this purpose, we will show that for every error channel A acting on some subset T ⊆ [n] of the code components with |T | ≤ δn, it holds with probability 2 −Ω(δoutn) over the uniformly random choice of key κ ∈ K n and over the randomness from measurements in the decoding algorithm that for every message |φ , we have As a point of notation, above we are viewing the channel Dec Q κ • A • Enc Q κ as a procedure that outputs a classical ensemble of pure quantum states. Thus in the notation of density matrices, we would equivalently like to show that for some 0 ≤ p bad ≤ 2 −Ω(δoutn) and some density matrix ρ bad .
Note that we allow the message |φ to be an arbitrary pure state on the joint system consisting of the message register and an arbitrarily large side register, to which none of the encoding, decoding, or error channels have access. Allowing |φ to be entangled with a side register in this way implies that our proof gives the desired diamond norm bound in Definition 1.5. However, the side register effictively has no effect in the argument below, so we will not need to reference it further.
Letting |ψ = π −1 G Enc Q κ (|φ ) and A G = π −1 G Aπ G , then (29) is equivalent to Recall that we may decompose where ν ranges over a set of orthonormal environment states, and the A ν are some operators such that Then it suffices to show for each ν, with probability ≥ 1 − 2 −Ω(δoutn) we have . Because δ in − γ 0 / δ out /100 < δ, Lemma 5.2 implies that the set has |S ′ |/n ≤ δ out /100. That is, the ≥ 1 − δ out /100 fraction of inner blocks with i / ∈ S ′ have error rate from A G below the list decoding radius δ in of Q in . Fix ν. Let P S ⊆ P n q denote the set of Paulis supported inside S. Then we may decompose A ν = E∈PS a E E for some coefficeints a e .
As the left hand side of Equation (30) does not depend on the order in which the inner blocks are decoded, assume that we first sequentially apply Dec κi in to the inner code blocks i / ∈ S ′ of A G (|ψ ). Then for a given such i / ∈ S ′ , Dec κi in is applied to the ith block of j / ∈S ′ :j<i Dec κj in A ν (|ψ ). We may let for some coefficients a (i) E , which are random variables depending on the choices of κ j as well as on the outcomes of measurements in Dec κj in for j / ∈ S ′ with j ≤ i. Note that for a fixed i, the random variables a (i) E over E ∈ P S may be correlated.
For every i / ∈ S ′ , since A G and therefore A ν acts on fewer than δ in fraction of the components in block i, local indistinguishability guarantees (Claim C.2) that the distribution of the coefficients a

For an inner code block
E E is such that a (j) E = 0 for every E with ith block E i not equal to the identity, we say that block i is error-free in A , it holds with probability ≥ 1−δ out /10 over the randomness in κ i and in the syndrome measurement that Dec κi in successfully corrects the error on inner code block i, meaning that block i is error-free in A ν for all j ≥ i, so that in particular block i is error-free in A Dec κi is equal to A ′ Enc Qout |φ for some operator A ′ that acts as the identity on > 1−δ out fraction of the components i ∈ [n]. In this case we are guaranteed that Dec Qout A ′ Enc Qout |φ = |φ , so Equation (30) holds with probability ≥ 1 − e −δoutn/2 , as desired.
The following corollary instantiates Theorem 7.1 with two examples of suitable outer codes, namely distanceamplified concatenated Reed-Solomon codes and asymptotically good quantum LDPC codes.
For the first item in Corollary 7.2, we will concatenate a Reed-Solomon outer code with an inner code from the ensemble of codes given below.
Lemma 7.3. For a prime power q and positive integers r, s, let C 1 , C 2 ⊆ F s q r be (s−1)-dimensional subspaces chosen uniformly at random subject to the constraint that C ⊥ 1 ⊆ C 2 . Let Q = CSS Fq (C 1 , C 2 ) be the CSS code of block length n = rs, rate R = 1 − 2/s, and local dimension F q obtained by associating F q r ∼ = F r q . Then for every γ > 0, it holds with probability ≥ 1 − 2q −γn that Q has relative distance at least H −1 q (1/s − γ), where H q denotes the q-ary entropy function.
Proof. By definition for i = 1, 2, the code C i contains any given x ∈ F s q r ∼ = F rs q with probability (q r(s−1) − 1)/(q rs − 1) ≤ q −r . Therefore the chance that C i contains some x of Hamming weight ≤ H −1 q (1/s − γ) is at most q −r · |B 0 (H −1 q (1/s − γ))| ≤ q −r · q rs(1/s−γ) = q −rsγ . Union bounding over i = 1, 2, it follows that both C 1 , C 2 , and therefore Q, has relative distance at least The codes in Lemma 7.3 may be viewed as a quantum analogue of the Wozencraft ensemble, as they provide a derandomization of random CSS codes that still approach the quantum Singleton bound over large alphabets. Proof. We construct Q by applying the AEL construction in Proposition 5.4 to the concatenation of an outer Reed-Solomon code of rate 1 − γ/2 with an inner code of rate 1 − γ/2 from the ensemble in Lemma 7.3. Specifically, let Q in = CSS Fq in (C 1 , C 2 ) be a [[n in , k in , ∆ in n in ]] qin code from the ensemble in Lemma 7.3 of rate R in ≥ 1 − γ/2, local dimension q in = 1/γ, and relative distance ∆ in ≥ H −1 qin (γ/8) ≥ Ω(γ). As described in Lemma 7.3, each of C 1 , C 2 is specified by a single parity check vector in F s q r in up to scalar multiplication by F q r in . Therefore there are at most 2q kin in possible choices for each of C 1 , C 2 , so there are at most (2q kin in ) 2 possible choices for Q. Computing the distance of each of C 1 , C 2 by brute force takes O(q kin in ) time, so a brute force search to find Q in takes O(q 3kin in ) time. Now let Q out be a [[n out , k out ]] qout quantum Reed-Solomon code of rate R out = 1 − γ/2, and block length and local dimension n out = q out = q kin in . Then Proposition 5.4 implies that we may choose γ 0 = Θ(γ 3/2 ), r = 4/γ 2 0 , and G an r-regular γ 0 -pseudorandom bipartite graph such that the [[n, k]] q code Q = Π G (Q out • Q in ) has local dimension q = q r in = 2 O( 1 γ 3 log 1 γ ) and is decodable from adversarial errors acting on Ω(γ) fraction of the components. Furthermore, the decoding algorithm simply decodes the inner codes and then decodes the outer code. Brute force decoding in all inner code blocks takes time O(n out ) 3 ≤ O(n 3 ), and decoding the Reed-Solomon outer code can be done in time O(n out log q out ) 3 ≤ O(n log q) 3 . Thus the overall decoding algorithm takes O(n log q) 3 time as desired.
Furthermore, Q is explicit as we showed above that the inner code Q in can be constructed by a brute force search in time O(q 3 out ) ≤ O(n 3 ), and the quantum Reed-Solomon code Q out is explicit.
Proof of Corollary 7.2. 1. The result follows from Theorem 7.1 by letting Q 0 be a code of rate 1 − γ/4 and alphabet size q 0 = 2 O( 1 γ 3 log 1 γ ) that is unique-decodable from errors acting on δ out = Ω(γ) fraction of the components in time O(n 0 log q 0 ) 3 , as given in Lemma 7.4.
2. The result follows form Theorem 7.1 by letting Q 0 be a family of asymptotically good quantum LDPC codes of local dimension q 0 = 2 that permits linear-time decoding. For instance, the codes of [PK22,LZ22c] have such a decoding algorithm [LZ22a].
As described in Section 4.2, the private key of a private AQECC can be incorporated into the code using a classical robust secret sharing scheme. Specifically, Theorem 4.6 and Theorem 4.7 imply that the statement of Theorem 7.1 still holds when we remove the condition that the AQECC is private.
Thus in particular we immediately obtain the following non-private analogue of Item 1 of Corollary 7.2, again by letting Q 0 be the code from Lemma 7.4.

A Properties of Random CSS Codes
In this section, we briefly discuss the list decodability and other properties of random CSS codes, which we apply in for the construction of concatenated codes. These properties follow from straightforward applications of their well known classical counterparts, and so for conciseness we simply refer to the necessary statements. That is, we construct random CSS codes from correlated random classical linear codes. Therefore, by a union bound, any property that holds with high probability for these classical codes also holds with high probability for the CSS code.
We generate a random [[n, k]] q CSS code as follows. First, sample k 1 = (n+k)/2 random linearly independent vectors g 1 , · · · g k1 in F n q . Let G 1 = (g 1 · · · g k1 ) ∈ F n×k1 q be the matrix defined by the sampled vectors and G 2 = (g 1 · · · g k2 ) to be the first k 2 = n − k 1 columns of G 1 . We define C 1 to be the classical linear code defined by using G 1 as a generator matrix, and C 2 to be the classical linear code defined by using G T 2 as the parity check matrix, such that C ⊥ 2 ⊂ C 1 by construction. We now consider the random Galois-Qudit CSS code Q R = CSS(C 1 , C 2 ), where R is the rate k/n.
First, by assumption with high probability both G 2 , G 1 are full rank. Thereby, we have C 2 , C 1 are [n, k 1 ] q classical codes, and CSS(C 1 , C 2 ) is a [[n, k]] q QECC. A standard exercise in coding theory is to prove random generator matrices (and parity check matrices) of k columns (resp. n − k rows) have distances approaching the Gilbert-Varshamov bound of n · H −1 q (1 − k n ) with exponentially high probability, where H q denotes the q-ary entropy function. A similar statement also holds for list-decodability, as shown in [Gur01,Theorem 5.3] and stated below.

B List-Recoverable Quantum Codes
In this section, we discuss a quantum analog of a certain extension to list-decoding, the problem of listrecovery. While, at a high level, list-decoding requests the codewords of a certain code C around a given point, the problem of list-recovery requests the codewords c ∈ C whose individual symbols c 1 , c 2 ...c n come from a small set of 'candidate' symbols: This would suggest that once one fixes sets of candidate symbols S 1 · · · S n , there aren't many codewords c ∈ C which agree with the subsets S i ⊂ Σ at most i. We emphasize that the special case (η, 1, L)-LR is equivalent to (1 − η, L)-LD. This is since if C is (η, 1, L)-LR, for any vector y ∈ Σ n , one can pick S i = {y i } (such that |S i | = 1) and the number of codewords c ∈ C which agree with y on at least η locations is the number of codewords in a ball of radius 1 − η around y. Finally, C is said to be efficiently list-recoverable if there exists an efficient algorithm to find these codewords.
Below, we discuss an analogous notion of list recoverability for the normalizer group of a stabilizer QECC. Informally, it corresponds to enumerating the logical operators of the quantum code whose single-qudit components are selected from candidate lists E i ⊂ P q of single-qudit operators.
if, for all subsets E 1 , · · · , E n ⊂ P q of single-qudit operators with |E i | ≤ l, any list L({E}) of logically-distinct operators in the normalizer group N (Q) where has size bounded by |L({E})| ≤ L.
This means that there don't exist many logical operators which match the E i at most locations i ∈ [n]. We expect this to naturally reduces to the QLD definition when l = 1. Indeed, Proof. Fix E ∈ P n q . Recall the set of operators F ∈ P n q such that F † E ∈ N (Q) is a logical operator, is equivalent to the set EA † for A ∈ N (Q). Thus F has weight ≤ δ · n if A i = E i for at least 1 − δ locations.
We note that the characterization above of quantum list-recovery can be cast in terms of an analogous classical question about syndromes of the stabilizer code.
Claim B.2. Let Q be (η, l, L)-QLR, let E ∈ P n q be any error on Q of syndrome s, and consider any set of subsets E 1 , · · · , E n ⊂ P q of single-qudit operators with |E i | ≤ l. Then any set L s ({E}) ⊂ P n q of logicallydistinct operators of syndrome s and which agree with the E i on at least η · n qudits i, has size bounded by |L s ({E})| ≤ L.
Proof. Given any such set L s ({E}), consider the set L = E † F : for F ∈ L s ({E}) defined by shifting the elements of the former by E. Also, for each i ∈ [n], 'shift' each list of single qudit operators E ′ i = (E † ) i E i by E † i . Note that |E ′ i | ≤ l, and |L s ({E})| = |L|. Since each F ∈ L s ({E}) has the same syndrome as E, E † F ∈ N (Q) and thus the elements of L are logically-distinct operators in N (Q). Moreover, (E † F ) i ∈ E ′ i for most i. By the definition of QLR, we must have |L| ≤ L, which concludes the proof.
Much like the case for quantum list decoding, we show that one can devise quantum codes with good list recovery properties from the CSS construction of two classically list recoverable codes. Claim B.3. If C 1 , C 2 ⊂ (F m q ) n are two F q -linear classical codes with C ⊥ 2 ⊂ C 1 and C 1 , C 2 are (η, l, L)-LR, then the Galois-qudit CSS(C 1 , C 2 ) is (η, l, L 2 )-QLR.
Proof. The elements in the normalizer of CSS(C 1 , C 2 ) are the operators E a,b , a ∈ C 1 , b ∈ C 2 . Now, fix arbitrary sets E 1 , · · · , E n ⊂ P m q of size ≤ l. We can write each single qudit operator E ij in the ith set E i = {E ij } j∈[l] into a Pauli basis: E ij = E aij ,bij , a ij , b ij ∈ (F m q ). We can thereby define sets of 'X' symbols S X i = {a ij } j∈ [l] , and 'Z' symbols S Z i = {b ij } j∈[l] , for each location i.
If A = E a,b ∈ N (S), and A i ∈ E i for most i, then we have that a i ∈ S X i and b i ∈ S Z i for most i. However, a ∈ C 1 is (η, l, L)-LR, so there exist at most L such valid codewords of C 1 . Analogously, there exist at most L valid choices of b ∈ C 2 . The set of of valid elements A ∈ N (S) is at most the number of pairs of valid elements.
By casting this notion of list recovery as a classical problem, we inherit the efficiency of classical list decoding algorithms.
Claim B.4. If C 1 , C 2 ⊂ (F m q ) n with C ⊥ 2 ⊂ C 1 are efficiently (η, l, L)-LR, then given any syndrome s of the quantum code Q =CSS(C 1 , C 2 ) and subsets E 1 , · · · , E n ⊂ P q of single-qudit operators with |E i | ≤ l, there exists a polynomial time classical algorithm to find a list of logically-distinct operators F of syndrome s and F i ∈ E i for at least η · n symbols i ∈ [n].
Proof. If s = s x , s z are the syndrome measurements of the X and Z checks, respectively, then let E ′ = E ex,ez be any Pauli operator with the same syndrome. Given the sets of single qudit operators E i = {E aij ,bij } j∈[l] , then consider the sets of q-ary symbols We call the classical list decoding algorithm for C 1 on the S X 1 , S X 2 · · · and C 2 on the S Z i , obtaining lists of codewords (c 1,1 , c 1,2 · · · c 1,L ) ⊂ C 1 and (c 2,1 , c 2,2 · · · c 2,L ) ⊂ C 2 respectively. We note that each 'correction' c 1,k − e x , for k ∈ [L], defines a Pauli operator X ex−c 1,k with the same syndrome as e x . Moreover, (e x − c 1,k ) i agrees with {a ij } l∈[n] in at least η·n locations i. Thus a subset of the L 2 operators E ex−c 1,k ,ez −c 2,k ′ , k, k ′ ∈ [L] satisfy the claim. By combining the above with known results on the list-recoverability of folded Reed-Solomon codes (the below is a corollary of Theorem 6.2 of [GR08] stated previously),

B.1 List Decodable Codes from List Recovery and Distance Amplification
In this section, we discuss an application of a classical technique to devise codes over smaller alphabets with better list-decoding properties, using the distance amplification techniques in [AEL95]. To do so, we discuss a quantum adaptation of the approach in [GR08], who concatenated Folded RS codes with list decodable inner codes, to reduce the large alphabet size of the RS construction, and approach list decoding capacity on constant size alphabets (with efficient decoding). The theorem below is the main result of this section, on the construction of list decodable quantum codes up to the Singleton bound from the concatenation and distance amplification of list recoverable and list decodable quantum codes.
. Moreover, Q can be list-decoded efficiently.

B.1.1 The Construction
We build the quantum code in the theorem above using the concatenation Q ⋄ = Q out ⋄ Q in of two stabilizer codes Q out , Q in . Informally, the 'outer' quantum code Q out is chosen to be a high rate, large alphabet, quantum list recoverable code, of size n and local dimension q m . In particular, a [[n, (1 − 4γ)n]] q m QECC which is (1−γ, l, L)-QLR. In turn, the 'inner' code Q in has rate R near the target rate and is near list decoding capacity, i.e. with decoding radius approaching the quantum singleton bound, (1 − R)/2. Formally, Q in is a [[n ′ , m]] q QECC and ((1 − R)/2 − 4 · γ, l)-QLD, where m = n ′ (R + 5γ). Their concatenation Q ⋄ = Q out ⋄ Q in is a code on nn ′ qudits of local dimension q and rate (R + 5γ)(1 − 4γ) ≥ R To conclude the construction, the physical qudits of the resulting concatenated code are permuted and re-grouped, using the AEL alphabet-reducing distance amplification techniques discussed in Section 5. Intuitively, as before this permutation is used to 'spread out' errors on the inner code, such that any error on the final code doesn't corrupt most inner blocks beyond repair. Formally, we pick an γ 0 -pseudorandom D-biregular bipartite graph G, with γ 0 = γ 2 and degree D = 10/γ 2 0 = poly(1/γ), and use it to define a permutation π G . The final code is defined by π G (Q ⋄ ), and is defined on qudits of local dimension q D .

B.1.2 Analysis
We present a lemma on the distance amplification of generic list recoverable and list decodable quantum codes, and then instantiate the lemma with a particular choice of quantum codes Q out , Q in to prove Theorem B.7.
If E G = π G (E) ∈ (P D q ) nn ′ /D is an operator on the code π G (Q ⋄ ), then we refer to π −1 G (E G ) = E ∈ (P n ′ q ) n as the 'unpermuted' operator E acting on the concatenated code Q ⋄ . We emphasize here that we restrict our attention to a basis of operators which factorizes as a tensor product of operators on the individual qudits of local dimension q. Since Q ⋄ is a concatenated code, recall that its syndrome measurement corresponds to the syndromes of the inner codes, as well as the syndrome measurement of the encoding of the stabilizers of the outer code, see Fact 2.2.
To prove the lemma above, it suffices to show that there aren't many low weight, logically-distinct, operators F G on π G (Q ⋄ ), which agree with both of the syndrome measurements. To do so, we divide the proof into two key steps. First, we measure the syndrome of the inner blocks, and argue that their list-decodability and the expansion of G produces small lists of candidate 'correction' operators acting on the inner blocks. Then, we measure the syndrome of the outer code, and use its list-recoverability to infer that there can't be many global operators matching the elements of these inner-block lists.
Claim B.9. Let s 1 · · · s n be any syndrome measurements of the n inner code blocks, and let each L si , for i ∈ [n], correspond to a list of operators on Q in of relative weight ≤ (1 − R)/2 − 4 · γ which match s i and are all distinct up to a stabilizer of Q in . Let O G = π G (O) be any operator of relative weight ≤ (1 − R)/2 − 8γ on π G (Q ⋄ ), where O = ⊗ i O i ∈ (P n ′ q ) n , and O i ∈ P n ′ q is supported on the ith inner block. Then, if O has syndrome s i on the ith block for i ∈ [n], O i is stabilizer equivalent to some element of L si for ≥ 1 − γ inner blocks i ∈ [n] (34) Proof. Let O G = π G (O) be any operator of relative weight ≤ (1−R)/2−8·γ on π G (Q ⋄ ). From Proposition 5.4, the expansion of G tells us that at least ≥ 1 − γ inner blocks have wt(O i ) ≤ n ′ · ((1 − R)/2 − 4 · γ). We refer to these inner blocks as 'Good' blocks. Via the list decodability of Q in , if i is Good, then O i is equivalent up to a stabilizer of Q in , to some element of L si . Moreover, |L si | ≤ l.
Now, let us measure the syndrome s out of the outer code, by means of the encoded stabilizers of Q out . Please refer to Fact 2.2 for a description of the stabilizers of concatenated codes. From Claim B.9 it suffices to argue that there aren't many operators O on the concatenated code with outer syndrome s out and where O i ∈ L si for most i. This resembles a statement about list-recoverability, but about operators on the concatenated code, not the outer code. The claim below formalizes how to reduce that statement to the list recoverability of the outer code.
Claim B.10. There are at most L operators E ∈ (P n ′ q ) n which are distinct up to a stabilizer of the concatenated code Q out ⋄ Q in and have outer syndrome s out , inner syndromes s 1 · · · s n , where E G = π G (E) is an operator on the distance amplified code of relative weight ≤ (1 − R − 16 · γ)/2.
As an immediate corollary of the above, we recover Lemma B.8.
Proof of Claim B.10. The proof proceeds by using the elements of the lists L si to construct operators acting on each symbol of the outer code, for which we then invoke list-recoverability. Consider, WLOG, the first element F i 1 ∈ P n ′ q in the list L si of the ith inner block. For each i ∈ [n], we construct a list of inner code normalizers Note that each element of L i is S(Q in )-logically-equivalent to a logical operatorX ij ∈ N (Q in )/S(Q in ), defined by quotienting out the stabilizer group of Q in . Thus, one can derive from L i a list of operators E i ⊂ P q m acting on the ith qudit of the outer code: E i = X ij = Enc † inX ij Enc in ∈ P q m :X ij stabilizer equivalent to some element of L i Note that |L si | ≤ l ⇒ |E i | ≤ l, and that the identity operator is in E i (since it was in L i as well). Let s out 1 denote the syndrome of the operator F 1 = ⊗ n i F i 1 on the encoded stabilizers of the outer code. Now, we invoke the list recoverability of the outer code to find a list L out ⊂ P n q m of at most L S(Q out )-logically-distinct operators E = ⊗E i acting on the outer code where E i ∈ E i for ≥ 1 − γ qudits i ∈ [n], and E has syndrome s out − s out 1 . Each element of L out can now be represented as an operator acting on the concatenated code, by re-encoding into Q in , and to conclude we shift back the rotation by F 1 = ⊗ n i F i 1 : L s out ,s in = F 1 ⊗ n i Enc in X ⊗ n i Enc † in : X ∈ L out (37) To conclude the proof, we argue correctness of the produced list. It suffices to prove that any operator O with bounded weight on the distance-amplified code with syndromes s out , s in = s 1 · · · s n is S(Q ⋄ )-stabilizer equivalent to an element of L s out ,s in . For the purposes of contradiction, assume otherwise and let one such operator be O = ⊗O i on Q ⋄ . By construction, F † 1 O has syndrome 0 on all inner code blocks, since (F i 1 ) † O i ∈ N (Q in ), and thereby F † 1 O is S(Q ⋄ )-stabilizer equivalent to some encoded operator (⊗ n i Enc in )X(⊗ n i Enc † in ), for X ∈ P n q m . Moreover, X i ∈ E i for at least 1 − γ locations i, and the outer code syndrome of X is the same as that of F † 1 O. Since the outer code syndrome of F † 1 O is precisely s out − s out 1 , X must be S(Q out )-logicallyequivalent to some element returned by the list recovery, concluding the proof.
To conclude this section, we make an explicit choice of codes and parameters. Let q = 2 Θ(1/γ) , and pick Q in to be a random q-ary CSS code of rate R+5γ which is ((1−R)/2−4γ, q Θ(1/γ) )-QLD, see Claim A.2. By picking l = q Θ(1/γ) in Theorem 3.8, we let Q out be the m-Folded Quantum RS code of Definition 3.8 of rate 1 − 4γ, and blocklength n, folding parameter m = Θ( 1 γ 4 log q) = Θ( 1 γ 5 ), which is (1−γ, q O(1/γ) , n O(log(1/γ)/γ 3 ) )-QLR. Naturally Q out , Q in are defined over a field of the same characteristic, and we let the alphabet size of Q out be any composite Q = q m·x where x = Θ(log n), such that the block-length of Q in is Θ(m log n). The resulting alphabet size is q D = 2 Θ(1/γ 5 ) , and list size n O(log(1/γ)/γ 3 ) . We list decode the resulting code by brute force decoding the inner codes in time N · q O(m log N ) = N O( 1 γ 5 ) , and list recover Q out in time N Oγ (1) , resulting in an efficient decoding.

C Generalization of Lemma 4.1
In this section we prove a particular parallel composability property of the private AQECCs of Lemma 4.1 presented in Section 5. For simplicity, we simply discuss the main modifications from Lemma 4.1. We later apply this composability to study the concatenation of AQECCs.
In our proof of Lemma 4.1, we actually showed the slightly stronger statement that Q LD • Q k uniquely decodes an arbitrary adversarial error with high probability over the choice of private key k. In this section, we show that this stronger property continues to hold when the adversary is allowed access to a side-register entangled with the encoded message.
Consider the following setting, where Alice and Eve hold a bipartite quantum state |ψ AE , and Alice desires to send the A register to a third party, Bob. To do so, Alice has access to an adversarial quantum communication channel A SE , where Eve can adversarially tamper with up to a δ fraction S of the registers of the sent message, in addition to their half E of ψ AE . Before doing so, Alice picks a random key k ∈ K, and encodes her half of the state using the private AQECC (Enc k ) A→Q , and then sends her half over the channel. After receiving the corrupted code-state (and with knowledge of k), Bob attempts to decode using the channel Dec k defined in Algorithm 1. The density matrix ρ k BE produced by Bob can be written as Theorem C.1 below is a generalization of Claim 4.5, which states that with high probability over the choice of k (and the syndrome measurement outcomes), the quantum state ρ k BE Bob recovers is simply as if Eve had corrupted their register E without touching the A register at all: i.e. ρ k BE ≈ (I A ⊗ A E )(ψ) AE , for some CP operator A E acting only on E.
Theorem C.1. Let (Enc k , Dec k ) be the private (δ, ε ′ )-AQECC of Lemma 4.1, defined via the composition of a [[n, m, d ≥ δn]] (δ, L)-QLD code Q LD and an ε-PTC {Q k } with keys K. Let |ψ AE be a bipartite quantum state, and for k ∈ K let |ψ k QE = (I E ⊗ (Enc k ) A→Q ) |ψ AE be the encoding of the A half of ψ AE into the AQECC. If I Q\S ⊗ A SB is an arbitrary CP error operator supported on B and a set S ⊂ Q of at most δ · n code registers, then for a random choice of k the decoding algorithm Dec k of Algorithm 1 produces the density matrix s k∈GoodA,s p A,s |K| |k k| ⊗ |s s| ⊗ (I A ⊗ A s E )(ψ AE ) + s k∈K\GoodA,s p A,s |K| |k k| ⊗ |s s| ⊗ (ρ k,s ) BE (39) That is, for each syndrome s of the stabilizer code Q LD , s is measured with probability p A,s , A s E is a CP operator acting only on the register E, (ρ k,s ) BE are generic bipartite PSD matrices, and Good s ⊂ K is a large subset of the PTC keys of size ≥ |K|(1 − L · ε).
In other words, even if the adversary can corrupt a sideregister E entangled with the message, with probability at least (1 − L · ε) Bob recovers the A half of the original bipartite state ψ AE uncorrupted.
Remark C.1. We remark that the proof of Theorem C.1 below holds even if the state |ψ is entangled with a third environment register to which none of the encoder, decoder, or error operators have access.
To prove the theorem above, we present a generalization of Fact 4.1 and the intuition in Section 3. Qualititatively, it formalizes that the local indistinguishability of the stabilizer code ensures Eve learns nothing about the private encryption key k, even if Eve has prior entanglement with the message. Thus, if Bob performs a syndrome measurement upon receiving the corrupted codestate, he will collapse the state into a mixture of Pauli errors acting on his half of the state, and generic operators acting on Eve's half. Together with Claim 4.4 and Claim 4.5, Claim C.2 below directly implies Theorem C.1.
Claim C.2. Let Q be be a [[n, m, d]] q stabilizer code, let |ψ AE be any bipartite quantum state, and let |ψ QE = (I E ⊗ Enc A→Q ) |ψ AE be the encoding of half of |ψ AE into the code Q. If I Q\S ⊗ A SE is an arbitrary CP error operator supported on E and a set S ⊂ Q of fewer than d code registers, then the syndrome measurement (M Q ⊗ I E ) collapses the corrupted state into the mixture That is, the syndrome s is measured with probability p A,s and the resulting state is collapsed a single Pauli error σ A,s on the code Q, and a CP operator A s E supported only on the non-encoded half E. If A SE is CPTP, then s p A,s = 1. We emphasize that the distribution over syndrome measurements, {p A,s }, doesn't depend on the encoded half A of |ψ AE , only on the choice of error operator A and ρ E = Tr E [ψ AE ].
Proof. Consider a decomposition of the CP map A = A SE into Krauss operators {A ν }. Let us further decompose each operator A ν = σ=σS ⊗σE c ν σ · σ S ⊗ σ E into a Pauli basis. The POVM (I E ⊗ M Q ) is comprised of projectors Π s for each syndrome s, which we observe to collapse A ν into Pauli's on S ⊂ Q of syndrome s: However, each σ S in the sum above is supported on |S| ≤ d and they all have the same syndrome s, and thereby must all be stabilizer-equivalent to an operator σ A,s supported on S. One can thereby re-arrange the above To conclude, we denote as p A,s = ν ψ |I ⊗ A † s,ν A s,ν |ψ QE = ν σE ,σ ′