Introduction

Ideal quantum computers can efficiently solve several important problems of great interest. Such problems include (but are not limited to) integer factoring1 and simulation of large quantum systems2 and are believed to be not solvable in polynomial time in the problem size by using classical computers. However, due to inevitable noise in realistic quantum systems, currently available quantum devices are not capable of performing long quantum computations in a reliable way. Quantum error correction and fault-tolerant techniques are thus essential to build a universal quantum computer (capable of implementing arbitrary quantum algorithms) out of noisy physical components. Importantly, due to significant hardware constraints, the resource overhead associated with the implementation of fault-tolerant methods will need to be low.

The transversal implementation of a logical gate is naturally fault-tolerant since errors cannot spread between qubits in a given code-block. Unfortunately, from the Eastin–Knill theorem3, given any quantum error-correcting code, there will always be at least one gate in a universal gate set that cannot be implemented using transversal operations at the error-corrected logical level. Several fault-tolerant methods for implementing gates in a universal gate set have been proposed4,5,6,7,8,9,10,11,12,13,14,15,16,17. Among these various proposals, preparing high-quality magic states by using magic state distillation has remained a leading candidate for realizing universal fault-tolerant quantum computing18,19,20,21,22,23,24,25,26,27.

It had long been believed that implementing magic state distillation was the dominant cost of building a universal fault-tolerant quantum computer. While recent results have shown that this is not necessarily the case28, the cost of performing magic state distillation still remains very high given current hardware constraints. One of the reasons for the high costs of magic state distillation is that the distillation circuits are generally not robust against failures of the Clifford gates used to distill magic states. Consequently, the Clifford gates must be encoded in some large-distance error-correcting code (often the surface code) to ensure that these gates have negligible error rates compared to the magic states being injected. Due to the high threshold of the surface code, magic state distillation schemes with the surface code can be implemented with noise rate near p = 10−3 using a large enough code distance.

In ref. 15, a fault-tolerant method for directly preparing an H-type magic state was proposed using the Steane code and flag-qubit circuits29,30,31,32,33,34,35,36,37,38. For physical error rates p 10−5 and with idle qubits failing with error rates 100 times smaller than single-qubit gate error rates, it was shown that fewer qubits were required to prepare H-type magic states than the best-known distillation schemes. Unfortunately, the scheme requires the ability to perform geometrically non-local gates and is scaled up by concatenating the Steane code with itself, making it difficult to implement such a scheme in a scalable way with realistic quantum hardware.

The Steane code belongs to the family of two-dimensional color codes8,39,40,41, which are topological codes. In particular, the two-dimensional color codes have a nice property that all logical Clifford gates can be implemented using transversal operations. In particular, for a color code with n data qubits, the logical Hadamard gate is simply given by \(\overline{H}={H}^{\otimes n}\). This features makes color codes particularly well suited for preparing H-type magic states. Furthermore, recent work introduced a simple and efficient decoding algorithm for color codes which also uses information from flag qubits to decode up to the full effective code distance38,42.

In this work, we introduce a fault-tolerant scheme for directly preparing an H-type magic state encoded in the triangular color code family. In particular, we introduce a concept that we call redundant ancilla encoding. The latter combined with flag qubits allows for circuits to fault-tolerantly extract error syndrome information and measure the global logical Hadamard operator to fault-tolerantly prepare magic states. Due to the fault-tolerance of our proposed scheme, magic states with very low logical error rates can be directly prepared without the need to use very large-distance error-correcting codes to encode the required Clifford operations. That is, we find that the Clifford gates in our scheme can have error rates comparable to the magic states being injected, thus significantly reducing the resource requirements. For instance, for a physical error rate p = 10−4, to produce a magic state with a logical error rate of ~5 × 10−8, our scheme requires only 64 qubits (compared to 810 with the best known magic state distillation schemes28) and all Clifford gate operations can be performed at the physical level. Thus, our scheme requires more than an order of magnitude fewer qubits and space–time overhead costs compared to the most competitive existing magic state distillation schemes. Most importantly, our scheme uses only nearest-neighbor interactions in a two-dimensional planar architecture and thus is well suited for various quantum computing platforms that are currently under development. Moreover, our scheme can be scaled to produce magic states with arbitrarily low error rates by using logical Clifford operations encoded in a two-dimensional topological code. We find that using the surface code for our encoded stabilizer operations appears to be the most resource-efficient scheme for producing magic states with error rates lower than 10−15.

Results

Overview of our proposed magic state preparation scheme

Note that logical Clifford gates encoded in a color code can be implemented using transversal operations and hence are fault-tolerant. Thus, to complete a universal gate set, we focus on fault-tolerantly preparing an H-type magic state encoded in a triangular color code, which can be used to implement the non-Clifford T gate (see the Methods section for more details on the Clifford and non-Clifford gates, stabilizer operations, H-type magic states, and the triangular color code). Depending on the size and duration of a quantum algorithm, the desired probability that an \(\left|H\right\rangle\) state is afflicted by an error ranges from 10−7 to ~10−15 (see, e.g., refs. 43,44,45). Since an H-type magic state \(\left|H\right\rangle\) is an eigenstate of the Hadamard operator H with +1 eigenvalue, a high-quality H-type magic state can be prepared if the Hadamard operator H can be measured non-destructively and in a fault-tolerant way. Here, we propose a fault-tolerant scheme for measuring the logical Hadamard operator \(\overline{H}={H}^{\otimes n}\) of the triangular color code, which can be used to directly prepare a high-quality magic state.

An overview of our fault-tolerant magic state preparation scheme is provided in Fig. 1. Our scheme outputs an H-type magic state \(\left|\overline{H}\right\rangle\) encoded in the distance-d triangular color code and consists of the following three elements. G(1→d): a non-fault-tolerant growing operation of a physical \(\left|H\right\rangle\) state to an encoded state \({\left|\overline{H}\right\rangle }_{G}\) (see Fig. 7 and the Methods section), \({H}_{m}^{(d)}\): a fault-tolerant logical Hadamard measurement circuit (for d {3, 5, 7}; see Figs. 3 and 4), and EC(d): a fault-tolerant syndrome extraction circuit (see Fig. 2). In particular, we call the latter two circuits \({H}_{m}^{(d)}\) and EC(d) fault-tolerant in the sense that they are t-flag circuits with t = (d − 1)/2, where the definition of t-flag circuit is given below:

Fig. 1: Overview of our fault-tolerant magic state preparation scheme.
figure 1

To prepare an H-type magic state encoded in the distance-d triangular color code (i.e., \(\left|\overline{H}\right\rangle\)), we first grow a physical \(\left|H\right\rangle\) state non-fault-tolerantly to an encoded state which we label \({\left|\overline{H}\right\rangle }_{G}\). We represent the circuit that performs the non-fault-tolerant growing operation by the label G(1→d). An example for the G(1→d) circuit is given in Fig. 7. Second, a t-flag circuit (with t = (d − 1)/2) for performing a non-destructive measurement of \(\overline{H}={H}^{\otimes n}\) (labeled as \({H}_{m}^{(d)}\)) is applied. In particular, a GHZ ancilla is constructed in a fault-tolerant way to measure the global operator Hn. An example for one round of the application of the \({H}_{m}^{(d)}\) circuit is provided in Figs. 3 and 4. Third, error correction for the distance d triangular color code (circuit labeled EC(d)) is applied immediately following the \({H}_{m}^{(d)}\) circuit (see Fig. 2 for an example when d = 5). If any flag qubits flag, or the parity of the ancilla measurements in either \({H}_{m}^{(d)}\) or EC(d) is odd, the protocol is aborted. To guarantee fault-tolerance, each pair of \({H}_{m}^{(d)}\) and EC(d) circuits need to be repeated (d − 1)/2 times (see Supplementary Note 2 and Supplementary Fig. 2 for the proof of the fault-tolerance).

Fig. 2: Fault-tolerant error syndrome extraction circuit.
figure 2

a EC(5) circuit for measuring the X stabilizers of the d = 5 color code. The gray circles correspond to the ancilla qubits used to measure the parity of the stabilizers, whereas the white circles correspond to the flag qubits. The Z stabilizers can be measured similarly by reversing the direction of the CNOT gates and replacing \(\left|0\right\rangle\) (\(\left|+\right\rangle\)) states by \(\left|+\right\rangle\) (\(\left|0\right\rangle\)) states, and Pauli X (Z) measurements by Pauli Z (X) measurements. The CNOT gate scheduling that minimizes the total number of time steps for measuring the X and Z-stabilizers is also provided. One round of X or Z-type stabilizer measurements requires a total of nine time steps. b Circuit for measuring a weight-six X-type stabilizer of the triangular color code. Note that a redundant amount of ancillas are used since they become flag qubits when measuring the logical Hadamard operator Hn of the triangular color code (see Fig. 4).

Definition 2 (t-flag circuit) A circuit C(U) which, when fault-free, implements a projective measurement of a weight-w operator \(U\in {{\mathcal{P}}}_{n}^{(2)}\) without flagging is a t-flag circuit if the following holds: For any set of v faults at up to t locations in C(U) resulting in an error E with \(\min (wt(E),wt(EU))>v\), the circuit flags (i.e., at least one flag qubit has a non-trivial measurement outcome).

In our scheme, we first grow a noisy physical \(\left|H\right\rangle\) state to an encoded state \({\left|\overline{H}\right\rangle }_{G}\) via a growing operation G(1→d). Due to the non-fault-tolerance of the growing operation, a single fault can result in a logical error afflicting \({\left|\overline{H}\right\rangle }_{G}\). However, these errors can be detected by implementing in pairs a fault-tolerant logical Hadamard measurement circuit \({H}_{m}^{(d)}\) and a syndrome extraction circuit EC(d) (d − 1)/2 times. Specifically, the Hadamard measurement circuit \({H}_{m}^{(d)}\) checks for logical errors in the encoded magic state \({\left|\overline{H}\right\rangle }_{G}\) and the syndrome extraction circuit EC(d) prevents the accumulation of residual errors so that they remain correctable by the code15,46. In particular, we show in Supplementary Note 2 that our magic state preparation scheme in Fig. 1 is fault-tolerant in the following sense15,47:

Definition 2 (Fault-tolerant state preparation) For t= (d1)/2, a state-preparation protocol using a distance-d stabilizer code C is said to be fault-tolerant if the following two conditions are satisfied: (1) If there are s faults during the state-preparation protocol with st, the resulting state differs from a codeword by an error of at most weight s. (2) If there are s faults during the state-preparation protocol with st, then ideally decoding the output state results in the same state that would be obtained from the fault-free state-preparation scheme.

Thus, (d − 1)/2 faults in a distance d {3, 5, 7} triangular color code of our magic state preparation scheme cannot result in a logical failure. In what follows, we describe the syndrome extraction circuit EC(d) and the Hadamard measurement circuit \({H}_{m}^{(d)}\) in more detail.

Syndrome extraction with redundant ancilla encoding

Here, we describe the error syndrome extraction circuit EC(d) used to detect errors at the output of the Hadamard measurement circuit \({H}_{m}^{(d)}\). In particular, to guarantee fault-tolerance of our scheme (see Definition 2), we require that the EC(d) circuit is at least a one-flag circuit. For instance, if the circuit is not a one-flag circuit, two single faults in two separate stabilizers can result in a weight-four data qubit error without any flag qubits flagging. Such an error is thus not rejected by the circuit and might not be correctable by the distance-5 triangular color code, despite being derived from a two-fault event.

In Fig. 2a we illustrate the full EC(5) circuit used to measure the stabilizers of a triangular color code along with the CNOT gate scheduling, which minimizes the circuit depth for the given qubit layout. The weight-four stabilizers are identical to the ones used in ref. 38. However, an important difference can be observed for the weight-six stabilizers, which in addition to using three flag qubits, also uses three ancilla qubits. If an error anti-commutes with a weight-six stabilizer, the measurement outcomes of the three ancillas will have odd parity, otherwise it will have even parity. The circuit for measuring a weight-six X-type stabilizer that respects the CNOT scheduling is given in Fig. 2b. By performing an exhaustive numerical search, we verified that both weight-four and weight-six circuits are two-flag circuits. Since the weights of the stabilizer generators are independent of d, having two-flag circuits is sufficient to ensure that the EC(d) circuits are implemented fault-tolerantly32. Lastly, each weight-four and weight-six plaquette in a general EC(d) circuit has the same qubit layout and gate connectivity as those of Fig. 2a.

Now, one might wonder why three ancilla qubits (gray circles in Fig. 2b) instead of a single ancilla are used for measuring the weight-six stabilizers (see for instance the weight-six circuits used in ref. 38 that only require one ancilla). Indeed, if one is only interested in performing fault-tolerant error correction instead of fault-tolerant quantum computation, then a single ancilla qubit suffices since the additional ancillas do not provide more information and they also increase the circuit depth. However, we show below that to use the same qubit layout for measuring the logical Hadamard operator \(\overline{H}={H}^{\otimes n}\) (which is a global operator), the roles of the ancillas and flags in Fig. 2a are reversed. In other words, the ancilla qubits become flag qubits and the flag qubits become ancilla qubits. We thus use more ancilla qubits than necessary to ensure the Hadamard measurement circuit \({H}_{m}^{(d)}\) satisfies the desired fault-tolerant properties. We refer to this extra redundancy as redundant ancilla encoding. Below, we demonstrate the utility of using redundant ancilla encoding.

Fault-tolerant logical Hadamard measurement

Here, we describe in detail how to construct a t-flag circuit (with t = (d − 1)/2) for the non-destructive measurement of the logical Hadamard operator (i.e., \({H}_{m}^{(d)}\)). The circuits we construct apply to distance d triangular color codes with d {3, 5, 7}. In Fig. 3a, we present a one-flag circuit for measuring of the logical Hadamard operator H7 of the d = 3 triangular color code. Note that we used the same qubit layout as the one used for the stabilizer measurement circuit (EC(3) circuit shown in Fig. 3b) but there is a role reversal between the ancilla qubits (gray circles) and the flag qubits (white circles).

Fig. 3: Fault-tolerant logical Hadamard measurement for the distance-3 triangular color code.
figure 3

a A one-flag circuit \({H}_{m}^{(3)}\) for measuring the logical Hadamard operator H7 of the d = 3 triangular color code. b A circuit for measuring the X-type stabilizers of the d = 3 triangular color code. Note that there is a role reversal between the ancilla qubits (gray circles) and the flag qubits (white circles). Also, the controlled-H symbols in a represent the controlled-Hadamard gates. The logical Hadamard circuit \({H}_{m}^{(3)}\) in a can be decomposed into four elements: c Preparation of the 6-qubit GHZ state \(\frac{1}{\sqrt{2}}({\left|0\right\rangle }^{\otimes 6}+{\left|1\right\rangle }^{\otimes 6})\) (or the logical plus state of the 6-qubit repetition code) in the ancilla qubits (gray circles). d Controlled-Hadamard gates between the ancilla qubits (in the GHZ state) and the data qubits (yellow circles). e Parity checks of the ancilla GHZ state by using flag qubits (white circles). f Measurement of the logical X operator X6 of the 6-qubit repetition code on the ancilla qubits.

We now explain why the circuit in Fig. 3a performs a non-destructive measurement of the logical Hadamard operator H7. Note that the ancilla qubits (gray circles) in Fig. 3a are prepared in the logical plus state of the 6-qubit repetition code (or the 6-qubit GHZ state \(\frac{1}{\sqrt{2}}({\left|0\right\rangle }^{\otimes 6}+{\left|1\right\rangle }^{\otimes 6})\)) through the CNOT gates between the ancilla qubits (see Fig. 3c). Then, as shown in Fig. 3d, the 7 controlled-Hadamard gates implement a logical controlled-Hadamard gate between the ancilla 6-qubit repetition code and the data d = 3 triangular color code. Eventually, the ancilla qubits (in the 6-qubit repetition code) are measured in the logical X basis via a X6 measurement (see Fig. 3f). Hence, the circuits in Fig. 3c, d, and f implement the simple non-destructive Hadamard measurement circuit in Fig. 5b, except that the ancilla qubits are now encoded in the 6-qubit repetition code and the data qubits are encoded in the d = 3 triangular color code.

The most important element of the logical Hadamard measurement circuit in Fig. 3 is the parity check of the ancilla GHZ state by using flag qubits (see Fig. 3e). Note that the flag qubits (white circles) non-destructively measure the parity of the ancilla GHZ state Z1Z2, Z3Z6, and Z4Z5, or the three (out of five) stabilizers of the 6-qubit repetition code (we labeled the qubits from the top to the bottom and from the left to the right). These stabilizer measurements will be trivial if all the CNOT gates in Fig. 3c are perfect. However, CNOT gate failures can result in non-trivial flag measurement outcomes. In particular, there are several single CNOT gate failure events that can cause a data qubit error of weight-two or higher. For the Hadamard circuit to be one-flag, all these failure events should be caught by flag qubits. Indeed, we verify via a comprehensive numerical search that the logical Hadamard circuit in Fig. 3a is a one-flag circuit by confirming that if a single fault at any location results in a data qubit error E with \(\min (wt(E),wt(E{H}^{\otimes 7}))>1\), at least one flag qubit flags.

Further, we construct a two-flag circuit for the logical Hadamard measurement \({H}_{m}^{(5)}\) of the d = 5 triangular color code and a three-flag circuit \({H}_{m}^{(7)}\) for the d = 7 triangular color code (see Fig. 4). Designing such circuits with the desired fault-tolerant properties is very involved as it requires careful utilization of the ample flag qubits that become available due to redundant ancilla encoding. However, at a high level, the design principle is similar to the one used for the d = 3 case. That is, in the d = 5 case (i.e., \({H}_{m}^{(5)}\)), we first generate a 21-qubit GHZ state in the ancilla qubits (gray circles), or equivalently, a logical plus state of the 21-qubit repetition code. The entangled ancilla qubits are then coupled to all of the 19 data qubits (yellow circles) through controlled-Hadamard gates. Finally, the ancilla qubits (in the 21-qubit repetition code) are measured in the logical X basis via a X21 measurement. Thus, the circuit in Fig. 4a implements a non-destructive measurement of the logical Hadamard measurement of the d = 5 color code by using ancilla qubits in the 21-qubit repetition code.

Fig. 4: Fault-tolerant logical Hadamard measurement for the distance-5 and 7 triangular color codes.
figure 4

a A two-flag circuit \({H}_{m}^{(5)}\) for measuring the logical Hadamard operator H19 of the d = 5 triangular color code and b a three-flag circuit \({H}_{m}^{(7)}\) for measuring the logical Hadamard operator H37 of the d = 7 triangular color code. c Illustration of the benefit of using redundant ancilla encoding. Note that the ancilla qubits in the stabilizer measurement circuits are used as flag qubits in the logical Hadamard measurement circuits. Thus, redundant ancilla encoding in the stabilizer measurement circuits (shown in d) allows the logical Hadamard measurement circuits to have sufficiently many flag qubits.

Because the ancilla qubits are encoded in the 21-qubit repetition code, we can check if the ancilla qubits are reliably prepared in the logical plus state by measuring 15 (out of 20) stabilizers of the ancilla 21-qubit repetition code using 15 flag qubits (white circles). Performing an exhaustive numerical search, we can confirm that the circuit \({H}_{m}^{(5)}\) is a two-flag circuit. A three-flag circuit for the logical Hadamard measurement \({H}_{m}^{(7)}\) of the d = 7 triangular color code is constructed in the same way by using 45 ancilla qubits prepared in the logical plus state of the 45-qubit repetition code, and using 36 flag qubits checking the 36 (out of 44) stabilizers of the 45-qubit repetition code (see Fig. 4b). We point out that the order and time steps at which the CNOT gates (used to measure the stabilizers of the repetition code or the GHZ state with flag qubits) are implemented is very important and must be carefully chosen.

Recall that we used a redundant ancilla encoding scheme in the stabilizer measurement circuits (see Fig. 2) and the ancilla qubits in the stabilizer measurement circuits are used as flag qubits in the Hadamard measurement circuits. Thus, redundant ancilla encoding in the stabilizer measurement circuits allows the logical Hadamard measurement circuits to have sufficiently many flag qubits while maintaining the same two-dimensional qubit layout. In particular, the logical Hadamard measurement circuits \({H}_{m}^{(5)}\) and \({H}_{m}^{(7)}\) have 15 and 36 flag qubits that check 15 (out of 20) and 36 (out of 45) stabilizers of the ancilla GHZ state, respectively. Without the redundant ancilla encoding, we would have had 9 flag qubits in the d = 5 case and 18 flag qubits in the d = 7 case, as opposed to 15 and 36 flag qubits, respectively. We remark that the logical Hadamard measurement circuits \({H}_{m}^{^{\prime} (5)}\) and \({H}_{m}^{^{\prime} (7)}\) that are constructed with such fewer flag qubits are not two-flag and three-flag circuits. Thus, the redundant ancilla encoding scheme plays a crucial role in guaranteeing the desired fault-tolerance property of the logical Hadamard measurement circuits. We also remark that in previous works46,48, it has been shown that GHZ ancilla states can be used to fault-tolerantly measure the logical Hadamard operator. However, such GHZ states need to be prepared using ancilla verification methods, which can be very costly and typically requires very low noise rates and non-local interactions.

Performance of the scheme with physical operations

Since our magic state preparation scheme in Fig. 1 is fault-tolerant, it is robust against any v faults with v ≤ (d − 1)/2 (including failures of all stabilizer operations). Consequently, under the circuit-level noise model detailed in the Methods section, the logical error probability of the output magic state \(\left|\overline{H}\right\rangle\) is given by

$${p}_{L}^{(d)}=\alpha {p}^{(d+1)/2}+{\mathcal{O}}({p}^{(d+3)/2}),$$
(1)

where p is the physical error rate and α counts all combinations of (d + 1)/2 faults that lead to acceptance in our state-preparation scheme but results in a logical \(\overline{X}\), \(\overline{Y}\), or \(\overline{Z}\) error. We numerically find that for values of p ≤ 10−3, the higher-order terms in Eq. (1) were found to have a negligible impact on pL (see Table 1).

Table 1 Performance of our magic state preparation scheme using physical stabilizer operations.

Note that the logical error rate in Eq. (1) is conditioned on acceptance of the output magic state produced by our state-preparation scheme, i.e., when all the flag qubits do not flag and all the ancilla qubits have even parity. In the “Methods” section, we described in detail how to compute the acceptance probability \({p}_{acc}^{(d)}(p)\). Here, we focus on estimating the qubit overhead and the space–time overhead of our magic state distillation scheme.

Given the acceptance probability \({p}_{acc}^{(d)}(p)\) for preparing a distance d encoded state \(\left|\overline{H}\right\rangle\) with physical error rate p, the average number of qubits is given by

$$\langle {n}_{tot}^{(d)}(p)\rangle =\frac{{n}^{(d)}+{n}_{anc}^{(d)}}{{p}_{acc}^{(d)}(p)},$$
(2)

where n(d) = (3d2 + 1)/4 is the number of data qubits, and \({n}_{anc}^{(d)}\) is the total number of ancilla and flag qubits used in the circuits \({H}_{m}^{(d)}\) and EC(d). Since each weight-six stabilizer generator requires six qubits, and each weight-four stabilizer three qubits, we have

$${n}_{anc}^{(d)}=6{n}_{{w}_{6}}^{(d)}+3{n}_{{w}_{4}}^{(d)},$$
(3)

where \({n}_{{w}_{4}}^{(d)}=(3/2)(d-1)\) and \({n}_{{w}_{6}}^{(d)}=(3{d}^{2}-12d+9)/8\) are the number of weight-four and weight-six stabilizers. Putting everything together, we obtain

$$\langle {n}_{tot}^{(d)}(p)\rangle =\frac{6{d}^{2}-9d+5}{2{p}_{acc}^{(d)}(p)}.$$
(4)

Note that if we repeat the protocol for preparing \(\left|\overline{H}\right\rangle\) until the output state is accepted (at the expense of having a higher time cost), the number of qubits required to prepare \(\left|\overline{H}\right\rangle\) is simply

$$\min ({n}_{tot}^{(d)})=\frac{6{d}^{2}-9d+5}{2}.$$
(5)

We now consider the space–time overhead for implementing the scheme in Fig. 1, where additional qubits (as in Eq. (4)) are used to minimize the time cost. In particular, the space–time overhead \({s}_{O}^{(d)}(p)\) is given as

$${s}_{O}^{(d)}(p)=\langle {n}_{tot}^{(d)}(p)\rangle (14+\frac{(d-1)}{2}({t}_{{H}_{m}}^{(d)}+{t}_{EC}^{(d)})),$$
(6)

where \({t}_{{H}_{m}}^{(d)}\) and \({t}_{EC}^{(d)}\) are the total number of time steps required to implement one round of the circuits \({H}_{m}^{(d)}\) and EC(d) respectively. The factor of 14 in Eq. (6) comes from the 14 times steps required to implement the circuit \({\left|\overline{H}\right\rangle }_{G}\). Note that we pessimistically assume that all time steps are reached when implementing the circuits in Fig. 1. This is pessimistic since when the magic state preparation scheme does not pass the verification steps, fewer than \(14+\frac{(d-1)}{2}({t}_{{H}_{m}}+{t}_{EC})\) time steps are used.

The values of \({p}_{L}^{(d)}\), \(\langle {n}_{tot}^{(d)}(p)\rangle\), \(\min ({n}_{tot}^{(d)})\) and \({S}_{O}^{(d)}(p)\) for p [10−4, 5 × 10−4] are given in Table 1 and were obtained by performing 109 Monte–Carlo simulations on AWS clusters. For values of p resulting in very low logical failure rates, extrapolation of the best fit curve (using Eq. (1)) was used to compute the logical error rate of \(\left|\overline{H}\right\rangle\). Note that using the d = 5 version of the protocol in Fig. 1, an \(\left|\overline{H}\right\rangle\) state can be prepared with a logical failure rate of 3.6 × 10−8 while using only 68 qubits on average when p = 10−4. Alternatively, one may use \(\min ({n}_{tot}^{(d = 5)})=55\) qubits and repeat the protocol until it is accepted (with an acceptance probability \({p}_{acc}^{(d = 5)}(p=1{0}^{-4})=0.81\)). Further, one can use the d = 7 version of the protocol to produce an \(\left|\overline{H}\right\rangle\) state with logical failure rate 4.9 × 10−10 with only 231 qubits on average. Similarly as above, one may use \(\min ({n}_{tot}^{(d = 7)})=118\) qubits and repeat the protocol until it is accepted (with an acceptance probability \({p}_{acc}^{(d = 7)}(p=1{0}^{-4})=0.51\)). In comparison, when p = 10−4, the non fault-tolerant magic state distillation scheme in ref. 28 requires 810 and 1150 qubits to prepare magic states with failure rates 4.4 × 10−8 and 9.3 × 10−10, respectively. We note that recent work suggests that p = 10−4 is the appropriate regime to have small enough decoding hardware requirements49.

An important remark is that the space–time overhead values obtained in ref. 28 cannot directly be compared with those of Table 1. Roughly speaking, one would need to multiply the numbers obtained in ref. 28 by at least six (where the factor of six comes from the fact that six time steps are required to measure all the surface code stabilizers). To be clear, Eq. (6) takes into account the total number of time steps required for each measurement cycle. As such, our scheme provides a space–time overhead improvement, say to obtain a magic state with \({p}_{L}^{(5)}=3.6\times 1{0}^{-8}\), by at least an order of magnitude. One of the main reasons for the reduction in overhead is that we did not need to use encoded Clifford operations due to the fault-tolerant properties of our circuits. In ref. 28, the magic state being distilled needed to be encoded in the d = 7 surface code (so that the logical error rates of the encoded Clifford gates are ~10−9) to obtain an output state with failure probability 4.4 × 10−8. On the other hand, our scheme does not require encoded Clifford gates with very low error rates, and instead works with physical Clifford gates with an error rate p = 10−4.

Performance of the scheme with encoded Clifford operations

While \(\left|\overline{H}\right\rangle\) states with logical error rates near 10−8 and 10−10 may be sufficient for certain quantum chemistry applications50, \(\left|\overline{H}\right\rangle\) states with even lower logical error rates are required for many quantum algorithms. To achieve such low error rates, all stabilizer operations in our magic state preparation schemes in Fig. 1 need to be encoded in an error-correcting code so that they have much lower error rates compared to unencoded stabilizer operations. We now discuss the implementation of our \(\left|\overline{H}\right\rangle\) preparation scheme presented in Fig. 1 with encoded stabilizer operations. In what follows, we denote \({\left|\overline{H}\right\rangle }_{f}\) as the state produced when implementing the scheme of Fig. 1 with encoded stabilizer operations. Further, the circuits G(1→d), \({H}_{m}^{(d)}\) and EC(d) will be denoted as \({\tilde{G}}^{(1\to d)}\), \({\tilde{H}}_{m}^{(d)}\) and \({\tilde{EC}}^{(d)}\) when implemented with encoded stabilizer operations.

Suppose that in order to prepare an \({\left|\overline{H}\right\rangle }_{f}\) state with some target logical error rate, we require all stabilizer operations to be encoded in a triangular color code of distance d2. First, \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) states are prepared using the scheme described in Fig. 1 (with d1 {3, 5, 7} and with physical stabilizer operations). The distance d1 is chosen such that the \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) states have smaller logical failure rates compared with those of the distance d2 encoded stabilizer operations. The \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) states are used to implement the logical T gates (see Fig. 5a) and for injection in the circuit \({\tilde{G}}^{(1\to {d}_{f})}\). If d1 < d2, the \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) states must first be grown into \({\left|\overline{H}\right\rangle }_{{d}_{2}}\) states using the growing circuit \({G}^{({d}_{1}\to {d}_{2})}\) shown in Fig. 7c. Note that we did not put the tilde on \({G}^{({d}_{1}\to {d}_{2})}\) since all operations are implemented with physical gates (see also the Methods section). Using encoded \({\left|\overline{H}\right\rangle }_{{d}_{2}}\) states ensures that stabilizer operations encoded in a distance d2 triangular color code can be used with the prepared magic states. See Supplementary Note 5 and Supplementary Figs. 6 and 7 for a more detailed description of the setting and how to estimate the resource overhead.

The numerical values obtained in Table 2 shows that the least costly scheme to prepare the state \({\left|\overline{H}\right\rangle }_{f}\) with a logical error rate \({p}_{L}^{({d}_{f})}<4\times 1{0}^{-15}\) when p = 10−4 is to first prepare the states \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) with d1 = 7, and to grow these states to encoded d2 = 11 states. Using distance d2 = 11 encoded stabilizer operations, the final magic state \({\left|\overline{H}\right\rangle }_{f}\) is prepared using the distance df = 3 scheme in Fig. 1. On average, the amount of qubits required to prepare such a state is 10,917 and the space–time overhead is 3.91 × 106. If the time cost for preparing the \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) states is of a lesser concern, the minimum number of qubits required to prepare \({\left|\overline{H}\right\rangle }_{f}\) with \({p}_{L}^{({d}_{f})}<4\times 1{0}^{-15}\) is 6288. To compare with other schemes, in ref. 28, a magic state with a logical error failure rate of 2.4 × 10−15 required a minimum of 16,400 qubits.

Table 2 Performance of our magic state preparation scheme using stabilizer operations encoded in the color code.

To obtain a state \({\left|\overline{H}\right\rangle }_{f}\) with \({p}_{L}^{({d}_{f})}\approx 1{0}^{-15}\) when p = 10−3 using a small amount of resources requires encoded stabilizer operations with much lower logical failure rates than what is achieved with the triangular color code family. One viable option is to use stabilizer operations encoded in the surface code51 due to the low error rates that can be achieved when p = 10−3. However, in such a setting, after the states \({\left|\overline{H}\right\rangle }_{{d}_{2}}\) have been prepared, they must be teleported to the surface code before they can be injected in the circuit of Fig. 5 and in the circuit implementing \({\tilde{G}}^{(1\to {d}_{f})}\). In particular, one can convert the color code encoded state to the surface code using lattice surgery techniques as was done in ref. 52. In Table 3, we provide estimates of the qubit overhead for preparing \({\left|\overline{H}\right\rangle }_{f}\) when the stabilizer operations are encoded in the surface code. We remark that a complete analysis of the resource overhead cost of our scheme using encoded stabilizer operations would require the inclusion of routing costs. In this work, we do not take into account costs associated with the implementation of lattice surgery for performing gates and the transportation of logical qubits. Given that such considerations highly depend on the underlying hardware architecture, we leave such an analysis to future work. In Supplementary Note 5, we discuss alternative schemes with the surface code that do not require lattice surgery techniques.

Fig. 5: Basic properties of H-type magic states.
figure 5

a Circuit for simulating a T gate using one copy of an \(\left|H\right\rangle\) state and stabilizer operations. If the Y-basis measurement outcome is −1, a \(Y(\frac{\pi }{2})\) gate is applied to the data qubit, otherwise \(Y\left(\frac{\pi }{2}\right)\) is not applied. b Circuit used to implement a non-destructive measurement of the Hadamard operator. c Decomposition of the controlled Hadamard gate in terms of non-Clifford T and T gates and a controlled-Z gate (which belongs to the Clifford group).

Table 3 Performance of our magic state preparation scheme using stabilizer operations encoded in the surface code.

Discussion

In this work we showed how to prepare an \(\left|H\right\rangle\)-type magic state in a fault-tolerant way using a two-dimensional color code architecture requiring only nearest-neighbor interactions. The proposed architecture can be used to both measure local stabilizers of the color code in addition to a global operator, without the need for changing the qubit layout. Such an architecture was made possible with the use of flag qubits, in addition to an important concept that we introduce and call redundant ancilla encoding. Estimating the performance of our scheme, we showed that when p = 10−4, only 68 and 231 qubits are required to prepare an encoded \(\left|H\right\rangle\) state with logical error rates 3.6 × 10−8 and 4.9 × 10−10, respectively. In addition, we also showed how our scheme can be used with encoded stabilizer operations to achieve significantly lower logical failure rates, both in the regime where p = 10−4 and p = 10−3. We stress that our results were obtained by considering a full circuit-level depolarizing noise model, where all stabilizer operations could fail.

We also point out key differences between magic state distillation schemes and our fault-tolerant methods for preparing magic states. Magic state distillation is a top-down approach, where error detection circuits are designed to prepare magic states without regard to their fault-tolerant properties. It is assumed that appropriate code distances for the encoded Clifford operations will be chosen to ensure that consecutive rounds of distillation will produce higher fidelity magic states. Our scheme, which uses flag-qubits and redundant ancilla encoding, is a bottom-up approach. The fault-tolerant properties of the magic state preparation circuits are prioritized and emphasis is given towards constructing v-flag circuits for large v. As such, to obtain magic states with very low failure rates, if encoded stabilizer operations are required, such operations can fail with error rates commensurate to the magic states being injected.

Note that when considering the implementation of our scheme with encoded stabilizer operations using the surface code, the df = 7 version of our scheme was optimal for both p = 10−4 and p = 10−3. A clear direction of future work would be to find a v-flag circuit (with v ≥ 4) allowing a fault-tolerant implementation of a df ≥ 9 scheme. Such a scheme could potentially further reduce the overhead for preparing \(\left|H\right\rangle\) states with very low error rates. Moreover when using the surface code for the encoded stabilizer operations, instead of performing lattice surgery to convert a color code encoded \({\left|\overline{H}\right\rangle }_{{d}_{2}}\) state to one encoded in the surface code (as we did above), another option would be to initially prepare an encoded \({\left|\overline{H}\right\rangle }_{{d}_{2}}\) state in a small distance surface code using some other method, such as a magic state distillation protocol. While these techniques can potentially further reduce the required resource overhead, a careful analysis of the overhead would require choosing the appropriate magic state distillation protocol (or some other scheme that uses fault-tolerant circuits to prepare encoded magic states). Therefore such an analysis is left for future work.

With a plethora of possible research directions for preparing magic states in a fault-tolerant way which build upon our work, and given the realistic hardware constraints that are built directly into our schemes, we believe our work paves the way for achieving very low overhead universal quantum computation with both near-term and long-term quantum devices.

Methods

H-type magic states

The n-qubit Clifford group is defined as

$${{\mathcal{P}}}_{n}^{(2)}=\{U:\forall P\in {{\mathcal{P}}}_{n}^{(1)},UP{U}^{\dagger }\in {{\mathcal{P}}}_{n}^{(1)}\},$$
(7)

where \({{\mathcal{P}}}_{n}^{(1)}\) is the n-qubit Pauli group. The Clifford group is generated by

$${{\mathcal{P}}}_{n}^{(2)}=\langle H,Y\left(\frac{\pi }{2}\right),CNOT\rangle ,$$
(8)

where

$$H=\frac{1}{\sqrt{2}}\left(\begin{array}{cc}1&1\\ 1&-1\end{array}\right),\,\,{\rm{and}}\,\,Y\left(\frac{\pi }{2}\right)=\frac{1}{\sqrt{2}}\left(\begin{array}{cc}1&-1\\ 1&1\end{array}\right).$$
(9)

Here H is the Hadamard gate, \(Y(\frac{\pi }{2})={e}^{-i\frac{\pi }{4}Y}\) and the CNOT gates acts as

$${\rm{CNOT}}\left|a\right\rangle \otimes \left|b\right\rangle =\left|a\right\rangle \otimes \left|a\oplus b\right\rangle ,$$
(10)

on the computational basis states \(\left|a\right\rangle\) and \(\left|b\right\rangle\). The Clifford group, along with the non-Clifford gate

$$T={e}^{-i\frac{\pi Y}{8}}=\left(\begin{array}{cc}\cos \frac{\pi }{8}&-\sin \frac{\pi }{8}\\ \sin \frac{\pi }{8}&\cos \frac{\pi }{8}\end{array}\right),$$
(11)

forms a universal gate set. That is, defining \({\mathcal{G}}=\langle H,Y\left(\frac{\pi }{2}\right),T,CNOT\rangle\) and given a target fidelity ϵ, a unitary operator U can be approximated with \({\mathcal{O}}({\mathrm{log}}^{c}1/\epsilon )\) gates in \({\mathcal{G}}\)52,53. Note that the T gate defined in Eq. (11) is Clifford equivalent to the gate \(\tilde{T}=diag(1,{e}^{i\pi /4})\), which is also commonly referred to as the T gate. Whenever we refer to T gates throughout this paper, they will always correspond to the gate given in Eq. (11).

A magic state is a state that can be used as a resource state to simulate non-Clifford gates using only stabilizer operations (i.e., Clifford gates, computational basis states and Z-basis measurements). Additionally, magic states can also be distilled using only stabilizer operations18. In this paper we focus entirely on preparing an \(\left|H\right\rangle\)-type magic state18,20. In particular, an \(\left|H\right\rangle\) state is given by

$$\left|H\right\rangle =\cos \frac{\pi }{8}\left|0\right\rangle +\sin \frac{\pi }{8}\left|1\right\rangle =T\left|0\right\rangle ,$$
(12)

which is a +1 eigenstate of H. Note that \(\left|H\right\rangle\) is Clifford equivalent to the following more commonly known magic state

$$|{A}_{\frac{\pi }{4}}\rangle \equiv \frac{1}{\sqrt{2}}(\left|0\right\rangle +{e}^{i\frac{\pi }{4}}\left|1\right\rangle )={e}^{i\frac{\pi }{8}}H{S}^{\dagger }\left|H\right\rangle ,$$
(13)

where S = diag(1, i) is the phase gate. The state \(|{A}_{\frac{\pi }{4}}\rangle\) can be used to simulate the \(\tilde{T}=diag(1,{e}^{i\pi /4})\) gate using stabilizer operations.

In Fig. 5a, we provide the circuit used to simulate the T gate in Eq. (11) using one \(\left|H\right\rangle\) state in addition to stabilizer operations. In many physical implementations however, noisy \(\left|H\right\rangle\) states are injected into such circuits. To determine if an \(\left|H\right\rangle\) state is afflicted by an error, one can measure the Hadamard operator using the circuit show in Fig. 5b. Since \(HY\left|H\right\rangle =-Y\left|H\right\rangle\), if \(\left|H\right\rangle\) is afflicted by a Y error, a −1 measurement outcome will be obtained. Further, if \(\left|H\right\rangle\) is afflicted by an X or Z error, then the measurement outcome is ±1 at random. If the outcome is +1, then no error will be present after the measurement. Note that the controlled-Hadamard gate can be decomposed into products of T, T and controlled-Z gates as shown in Fig. 5c.

Triangular color codes

Color codes are topological codes, and thus the data qubits can placed on a lattice where each stabilizer generator can be measured using nearest-neighbor interactions. The triangular color code family has code parameters [[n = (3d2 + 1)/4, 1, d]] and is a version of the color code defined on a two-dimensional lattice \({\mathcal{L}}\) with boundaries. It is a self-dual CSS code with weight-four and weight-six X and Z-type stabilizers (see Fig. 6). The lattice \({\mathcal{L}}\) is 3-colorable, meaning that every face can be colored in red, green, or blue with any other face sharing an incident edge having a different color. All vertices of \({\mathcal{L}}\) (apart from the three corners) are incident to three edges. The distance-d triangular color code can correct any errors of weight less than or equal to (d − 1)/2 where d is odd. Further, triangular color codes can implement all logical Clifford gates using transversal operations. In particular, the logical Hadamard operator is simply given by \(\overline{H}={H}^{\otimes n}\) where n is the number of data qubits.

Fig. 6: Triangular color code.
figure 6

Lattice \({\mathcal{L}}\) for the implementation of the triangular color code (in this case a distance d = 5 color code). Each face of \({\mathcal{L}}\) consists of both X and Z-type stabilizer generators which are supported on all qubits belonging to the face. The logical X and Z operators are given by tensor products of all X and all Z operators along a boundary of the triangle.

In ref. 42, an efficient decoder (which we refer to as the Lift decoder) for two-dimensional color codes was provided. In ref. 38 it was shown how the Lift decoder can be extended to color codes with boundaries. Further, it was shown how the Lift decoder can incorporate measurement outcomes from flag qubits to maintain the effective distance of the code under a full circuit-level noise model (see below). Using such methods, it was found that triangular color codes exhibit a competitive threshold value of 0.2% under a full circuit-level depolarizing noise model.

Growing the triangular color code

An illustration of the circuit G(1→5) for growing a physical \(\left|H\right\rangle\) state to a logical \(\left|\overline{H}\right\rangle\) state encoded in the d = 5 triangular color code is given in Fig. 7a. The preparation of \(\left|\overline{H}\right\rangle\) in a general distance d triangular color code can be done as follows. First, one prepares a stabilizer state \(\left|{S}_{t}\right\rangle\) (which encodes no logical qubits) that is stabilized by all elements in \({{\mathcal{S}}}_{{\rm{st}}}={{\mathcal{S}}}_{{w}_{2}}\cup ({{\mathcal{S}}}_{{\rm{color}}}\setminus {{\mathcal{S}}}_{{b}_{1}})\) where \({{\mathcal{S}}}_{\rm{color}}\) is the stabilizer group of a distance d triangular color code, \({{\mathcal{S}}}_{{b}_{1}}\) is generated by the X and Z-type weight-four operators (white plaquettes) along the boundary b1 of the triangular color code and \({{\mathcal{S}}}_{{w}_{2}}\) is generated by the weight-two X and Z-type operators along the boundary b1 (see Fig. 7 for the case where d = 5). The qubit that is in \(\rm{supp}({{\mathcal{S}}}_{{\rm{color}}})\setminus {\rm{supp}}({{\mathcal{S}}}_{{\rm{st}}})\) is prepared in the physical \(\left|H\right\rangle\) state. Note that in the above construction, any of the three boundaries of \({\mathcal{L}}\) can be chosen. We chose b1 for convention.

Fig. 7: Growing the triangular color code.
figure 7

a Circuit G(1→5) for growing a physical \(\left|H\right\rangle\) state to a distance d = 5 color code. First, a stabilizer state \(\left|{S}_{t}\right\rangle\) is prepared with stabilizers given by the red, green and blue plaquettes. The encoded \(\left|\overline{H}\right\rangle\) state is then obtained by measuring both weight-four X followed by Z-type operators (represented by white plaquettes) along the boundary of the triangle. Such measurements are random since the weight-four operators do not commute with the weight-two stabilizers of \(\left|{S}_{t}\right\rangle\). b Matching graph (denoted by \({G}_{1x}^{(5)}\) and \({G}_{1z}^{(5)}\)) used to implement weight-two corrections arising from −1 measurement outcomes for generators of \({{\mathcal{S}}}_{{b}_{1}}\). As an example, if the vertex v1 is highlighted, after implementing minimum-weight perfect matching (MWPM), the edge e1 would be selected resulting in the correction \({Z}_{{q}_{1}}{Z}_{{q}_{6}}\). c Circuit G(3→7) for growing an \(\left|\overline{H}\right\rangle\) state encoded in a d = 3 triangular color code to one encoded in a d = 7 triangular color code. A stabilizer state \(\left|{S}_{t}\right\rangle\) is first prepared, and the d = 3 \(\left|\overline{H}\right\rangle\) state is prepared, e.g., following the methods of Fig. 1. One then measures the X and Z-type operators supported on the white plaquettes which anti-commute with the weight-two generators of \({{\mathcal{S}}}_{st}\) resulting in random measurement outcomes. The measurements of all plaquettes are repeated three times to distinguish measurement errors from random measurement outcomes and to correct errors. d Matching graph (denoted by \({G}_{3x}^{(7)}\) and \({G}_{3z}^{(7)}\)) used to implement the weight-two corrections arising from random measurement outcomes of the operators supported on the white plaquettes. As in b, each edge corresponds to two qubits supported on a weight-two generator of \({{\mathcal{S}}}_{st}\).

After preparing \(\left|{S}_{t}\right\rangle\), the X and Z-type generators of \({{\mathcal{S}}}_{{b}_{1}}\) are measured along the boundary b1. Since the generators of \({{\mathcal{S}}}_{{b}_{1}}\) do not commute with the weight-two generators of \({{\mathcal{S}}}_{{w}_{2}}\), the measurement outcomes of each generator in \({{\mathcal{S}}}_{{b}_{1}}\) will be ±1 at random. If a −1 outcome is obtained, a Pauli frame update54,55,56,57 needs to be applied to obtain the correct encoded state. In order to perform the correct Pauli frame update based on the random measurement outcomes, we define two one-dimensional graphs \({G}_{1x}^{(d)}\) and \({G}_{1z}^{(d)}\). The vertices of the graph \({G}_{1x}^{(d)}\) contain the random measurement outcomes of the X-type generators in \({{\mathcal{S}}}_{{b}_{1}}\). Each edge corresponds to two qubits that have support on one of the weight-two operators of \({{\mathcal{S}}}_{{w}_{2}}\). Similarly, the vertices of the graph \({G}_{1z}^{(d)}\) encodes the random measurement outcomes of the Z-type generators in \({{\mathcal{S}}}_{{b}_{1}}\). An example is provided in Fig. 7a for the d = 5 triangular color code. Given the set of highlighted vertices of \({G}_{1x}^{(d)}\) and \({G}_{1z}^{(d)}\), Minimum-Weight-Perfect-Matching (MWPM)58 is applied on both graphs. Each highlighted edge involves performing a weight-two X or Z-type Pauli frame update. For instance, for the graph \({G}_{1x}^{(5)}\) in Fig. 7b, if the edge e1 is selected during MWPM, the correction \({Z}_{{q}_{1}}{Z}_{{q}_{6}}\) is applied to the data. Note that the growing scheme is not fault-tolerant, and thus there is no need to repeat the measurements described above.

Growing an \(\left|\overline{H}\right\rangle\) state encoded in a distance-d1 triangular color code to one encoded in a distance-d2 triangular color code (with d2 > d1) can be done similarly as above and we denote such a growing circuit by \({G}^{({d}_{1}\to {d}_{2})}\). The circuit \({G}^{({d}_{1}\to {d}_{2})}\) is implemented as follows. As in the case of G(1→d), a stabilizer state \(\left|{S}_{t}\right\rangle\) is prepared, and operators supported on the white plaquettes seperating \({\left|\overline{H}\right\rangle }_{{d}_{1}}\) and \(\left|{S}_{t}\right\rangle\) are measured (this step can be viewed as gauge fixing of an underlying subsystem code59). Measurements of all operators supported on each plaquette of the distance d2 triangular color code are repeated d1 times to correct errors and to distinguish measurement errors from the random outcomes obtained when measuring the white plaquettes. An example for implementing G(3→7) is provided in Fig. 7c and d. More details on the implementation of the growing circuits G(1→d) and \({G}^{({d}_{1}\to {d}_{2})}\) are provided in Supplementary Note 1 and Supplementary Fig. 1.

Circuit-level noise model and simulation details

The full circuit-level noise model used throughout all simulations performed in this work with physical stabilizer operations is given as follows:

  • With probability p, each single-qubit gate location is followed by a Pauli error drawn uniformly and independently from {X, Y, Z}.

  • With probability p, each two-qubit gate is followed by a two-qubit Pauli error drawn uniformly and independently from {I, X, Y, Z}2{I I}.

  • With probability \(\frac{2p}{3}\), the preparation of the \(\left|0\right\rangle\) state is replaced by \(\left|1\right\rangle =X\left|0\right\rangle\). Similarly, with probability \(\frac{2p}{3}\), the preparation of the \(\left|+\right\rangle\) state is replaced by \(\left|-\right\rangle =Z\left|+\right\rangle\).

  • With probability p, the preparation of the \(\left|H\right\rangle\) state is replaced by \(P\left|H\right\rangle\) where P is a Pauli error drawn uniformly and independently from {X, Y, Z}.

  • With probability \(\frac{2p}{3}\), any single qubit measurement has its outcome flipped.

  • With probability p, each idle gate location is followed by a Pauli error drawn uniformly and independently from {X, Y, Z}.

It is important to point out that due to the presence of T gates (which are non-Clifford) used to implement the controlled-Hadamard gates (see Fig. 5), an efficient Monte–Carlo simulation of the circuits \({H}_{m}^{(d)}\) using Gottesman–Knill error propagation60,61 is not possible. Consequently, we divided the Monte–Carlo simulation to calculate \({p}_{L}^{(d)}\) and \({p}_{{\rm{acc}}}^{(d)}(p)\) into two parts. First, we perform a Monte–Carlo simulation of the circuit used to prepare \({\left|\overline{H}\right\rangle }_{G}\). If the output error Eout has a non-trivial syndrome or is a logical operator, the protocol of Fig. 1 is aborted, otherwise, we proceed to simulate the \({H}_{m}^{(d)}\) and EC(d) circuits. We define \({p}_{{\rm{acc}},1}^{(d)}\) to be the probability of proceeding to the \({H}_{m}^{(d)}\) and EC(d) circuits. Note that there could be other faults in the \({H}_{m}^{(d)}\) and EC(d) circuits that would cause the protocol to be accepted even though Eout had a non-trivial syndrome or was a logical operator. However such an event would require at least (d − 1)/2 faults, and since the large majority of malignant error locations are found in \({H}_{m}^{(d)}\) and EC(d), such an approximation only affects α in Eq. (1) by a small constant factor. As an example for p = 10−4, \({p}_{{\rm{acc}},1}^{(d)}=0.9897\)(d = 3), \({p}_{{\rm{acc}},1}^{(d)}=0.9711\)(d = 5), and \({p}_{{\rm{acc}},1}^{(d)}=0.9462\)(d = 7). As such, one can see that these probabilities are close to 1 for all relevant code distances. Furthermore, we numerically verify that the probability of a logical failure when preparing \({\left|\overline{H}\right\rangle }_{G}\) non fault-tolerantly is < 90p for d ≤ 7, hence, < 1% for p = 10−4. Note that these logical errors will be detected in the later stages of Fig. 1 unless there are strictly more than (d − 1)/2 faults in the entire protocol, which is very unlikely.

If all flag qubit and ancilla qubit measurement outcomes in the (d − 1)/2 applications of the \({H}_{m}^{(d)}\) and EC(d) circuits are trivial, the output state is accepted. We define \({p}_{{\rm{acc}},2}^{(d)}\) to be the probability of acceptance for the second part of the simulation (i.e., the simulation of the \({H}_{m}^{(d)}\) and EC(d) circuits). Hence the total acceptance probability is \({p}_{{\rm{acc}}}^{(d)}={p}_{{\rm{acc}},1}^{(d)}{p}_{{\rm{acc}},2}^{(d)}\). To determine if the output error of an accepted state is correctable, we perform one round of perfect error correction using the the Lift decoder.

We also remark that to simulate the circuit \({H}_{m}^{(d)}\), we use the fact that \({T}^{\dagger }XT=\frac{1}{\sqrt{2}}(X+Z)=H\) and \({T}^{\dagger }ZT=\frac{1}{\sqrt{2}}(Z-X)=iYH\). Hence if an X or Z error is input to a T or T gate, we pessimistically apply an X or Z error to the output, each with 50% probability. Such an approximation would be exact if twirling operations were performed both before and after the T and T gates (see Supplementary Note 3 and Supplementary Fig. 3 for more details; see also9). To be clear, we do not propose applying twirling operations when implementing our scheme as this could reduce the performance. The approximations stated here are performed to allow us to simulate our scheme on a classical computer. More details on the simulation of non-Clifford gates are provided in Supplementary Note 4 and Supplementary Figs. 4 and 5. Note that instead of twirling, one could possibly perform an exact simulation using methods introduced in refs. 62,63. We leave such a more sophisticated simulation as a future research direction.