Anne Canteaut

Simon Apers

Ivan Bardet

Xavier Bonnetain

Christina Boura

Rémi Bricout

Rodolfo Canto

Kévin Carrier

Kaushik Chakraborty

André Chailloux

Pascale Charpin

Daniel Coggia

Thomas Debris

Shouvik Ghorai

Lucien Grouès

Matthieu Lequesne

Gaë- Tan Leurent

Andrea Olivo

María Naya-Plasencia

Léo Perrin

André Schrottenloher

Nicolas Sendrier

Ferdinand Sibleyras

Jean-Pierre Tillich

Valentin Vasseur

Le calcul quantique tolérant aux fautes est un ensemble de techniques dont le but est d'effectuer des calculs quantiques de manière fiable en utilisant des composants bruités. Dans ce contexte, l'utilisation de codes correcteurs quantiques maintient le nombre d'erreurs présentes dans le système en dessous d'un seuil tolérable. L'un des principaux problèmes de ce domaine est d'évaluer le coût minimum (en mémoire et en temps) nécessaire pour transformer un calcul quantique idéal en un calcul tolérant aux fautes. Dans cette thèse, nous montrons que la famille des codes expanseurs quantiques associée à l'algorithme de décodage small-set-flip peut être utilisée dans la construction de ref.

[46] pour réaliser du calcul quantique tolérant aux fautes avec coût constant en mémoire.

La famille de codes correcteurs ainsi que le décodeur que nous étudions ont été introduits dans ref.

. De plus, nous montrons que l'algorithme de décodage peut être parallélisé pour fonctionner en temps constant. Cette propriété est essentielle pour éviter que les erreurs ne s'accumulent pendant que l'algorithme est exécuté.

. Le modèle de bruit choisi pour ces simulations consiste à générer des erreurs de types X et Z de manière indépendante et identiquement distribuée sur les qubits. Les résultats obtenus pour ces codes de rendement constant sont prometteurs puisque nos simulations montrent que leur seuil est décent et que leurs performances à taille finie sont bonnes.

Introduction (Français)

Un ordinateur quantique est un objet capable d'accomplir des calculs plus rapidement que les meilleurs algorithmes classiques, en tirant avantage des lois de la physique quantique. Shor a par exemple montré dans ref. [START_REF] Peter | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] que cette technologie accélèrerait de manière exponentielle la résolution du problème de factorisation des entiers. D'autres exemples sont présentés dans [START_REF] Patrick | Quantum algorithm implementations for beginners[END_REF] tels que l'algorithme de Grover qui permet une accélération quadratique pour une requête dans une base de données non structurée [START_REF] Lov | Quantum mechanics helps in searching for a needle in a haystack[END_REF], ou bien l'algorithme HHL utilisé pour résoudre des systèmes linéaires [START_REF] Harrow | Quantum algorithm for linear systems of equations[END_REF]. Du point de vue pratique, l'un des objectifs à court terme est d'atteindre la suprématie quantique en construisant un dispositif quantique capable de faire une tâche spécifique plus rapidement que les super-ordinateurs actuels [START_REF] Boixo | Characterizing quantum supremacy in near-term devices[END_REF][START_REF] Harrow | Quantum computational supremacy[END_REF][START_REF] Bravyi | Quantum advantage with shallow circuits[END_REF]. Pour résumer, un circuit quantique utilise des portes quantiques qui agissent sur des états quantiques utilisés pour stocker de l'information quantique dont l'unité de base est appelée le qubit (qui est une abréviation pour "bit quantique"). Aujourd'hui, plusieurs architectures sont en compétition telles que les circuits basés sur les supra-conducteurs ou bien les ions piégés. Toutefois, malgré de nombreux efforts et des progrès intéressants, les ordinateurs quantiques en sont encore au stade expérimental [START_REF] Kielpinski | Architecture for a large-scale ion-trap quantum computer[END_REF][START_REF] Cj Ballance | High-fidelity quantum logic gates using trapped-ion hyperfine qubits[END_REF][START_REF] Majer | Coupling superconducting qubits via a cavity bus[END_REF][START_REF] Michel | Implementing qubits with superconducting integrated circuits[END_REF][START_REF] You | Superconducting circuits and quantum information[END_REF][START_REF] Childress | Coherent dynamics of coupled electron and nuclear spin qubits in diamond[END_REF][START_REF] Mv Gurudev Dutt | Quantum register based on individual electronic and nuclear spin qubits in diamond[END_REF]. Le principal problème est qu'un tel système est inévitablement sujet à du bruit et aux phénomènes de décohérence. Ainsi, les états quantiques sont fragiles et une protection active est nécessaire pour y stocker et manipuler de l'information. La suprématie quantique pourrait être atteinte grâce à des technologies avec un niveau de bruit intermédiaire (dites "noisy intermediatescale quantum technology") dont le but est de construire des appareils avec un bruit suffisamment petit pour accomplir un calcul non trivial qui soit hors de portée pour les ordinateurs classiques [START_REF] Preskill | Quantum computing in the nisq era and beyond[END_REF]. Toutefois, cette stratégie n'est pas viable pour effectuer des calculs longs et contrairement au cas des machines classiques, il est peu probable qu'il soit possible de supprimer complètement le bruit qui affecte les circuits quantiques. Heureusement, étant donné un circuit quantique C, il est possible de construire un autre circuit C appelé circuit tolérant aux fautes, qui effectue le même calcul que C mais fonctionne également si ses composants sont bruités.

Pour formaliser l'idée de bruit, un circuit quantique est divisé en étapes élémentaires appelées sites qui représentent les endroits où une erreur peut advenir. Par exemple, un site de porte représente un endroit dans le circuit où une porte est appliquée, et un site d'attente fait référence à un qubit sur lequel aucune action n'est faite pendant que des portes sont appliquées sur d'autres sites. Étant donné que les composants utilisés pour construire un circuit quantique sont bruités, certains sites sont défaillants ce qui signifie que l'opération effectuée par ce site n'est pas celle escomptée. Le modèle de bruit le plus simple est le modèle d'erreurs iid (indépendantes et identiquement distribuées) ou les sites sont défaillants indépendamment avec une certaine probabilité p. Le résultat fondamental dans le domaine du calcul tolérant aux fautes est appelé le théorème du seuil et a été prouvé par Aharonov et Ben-Or dans ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]. Ils ont montré que si les sites sont sujets à un modèle de bruit iid de paramètre p < p th (p th est une constante universelle appelée seuil), alors pour tout circuit quantique C et pour toute probabilité cible > 0, il existe un circuit tolérant aux fautes qui simule C et dont la probabilité d'échec est au plus . Au-delà du modèle de bruit iid, cette thèse de doctorat s'intéresse au modèle de bruit plus général appelé stochastique local [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF][START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. Nous voudrions mettre l'accent sur le fait que la tolérance aux fautes est également possible avec d'autres modèles de bruit [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF][START_REF] Aliferis | Quantum accuracy threshold for concatenated distance-3 codes[END_REF][START_REF] Barbara | Fault-tolerant quantum computation for local non-markovian noise[END_REF]. Il existe deux manières naturelles de mesurer l'efficacité d'un protocole de tolérance aux fautes, à savoir le coût en temps et le coût en espace. Soit C un circuit quantique et soit C un circuit tolérant aux fautes pour C. Supposons que C (resp. C ) ait |C| sites (resp. |C | sites), qu'il utilise m qubits (resp. m qubits) et nécessite t étapes pour fonctionner (resp. t étapes pour fonctionner). Alors, le coût en temps est défini comme le rapport t /t et le coût en espace est m /m. Par exemple, avec le théorème du seuil habituel de ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF], les coûts en temps et en espace sont polylogarithmiques en |C|:

|C | |C| = polylog |C| , t t = polylog |C| , m m = polylog |C| . (1.1)
La principale motivation de cette thèse est ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] où il est démontré qu'il est possible d'atteindre un coût en espace constant en utilisant des codes correcteurs d'erreurs bien choisis. En partant d'un état avec k qubits, l'idée de la correction d'erreurs quantiques est de l'encoder dans n > k qubits en ajoutant de la redondance, de telle manière que des erreurs sur un petit nombre de qubits n'est pas problématique pour retrouver l'état initial. La procédure utilisée pour retrouver l'état initial est appelée décodeur et le temps d'exécution de cet algorithme classique est un paramètre critique. En effet, pour chaque site de C, le circuit tolérant aux fautes fourni par [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] nécessite d'exécuter le décodeur. Dans cette thèse de doctorat, nous nous intéressons aux codes expanseurs quantiques et nous montrons que le décodeur small-set-flip qui leur est associé peut être parallélisé pour fonctionner en temps constant. En suivant ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF], nous obtenons un protocole de tolérance aux fautes avec un coût en espace constant. De plus, chaque étape du circuit quantique résultant nécessite d'exécuter un circuit classique de profondeur constante (ceci est réaliste si les calculs classiques sont suffisamment rapides).

Le but de ce résumé est de décrire et d'expliquer notre résultat. Entre autres, nous aurons besoin de définir certains termes utilisés en correction d'erreurs classiques et de discuter les concepts de produits d'hypergraphes et de codes expanseurs classiques.

Correction d'erreurs classiques

Le domaine de l'informatique qui étudie la correction d'erreurs est appelé théorie des codes et a été initié par le travail de Claude Shannon en 1948 [START_REF] Elwood | A mathematical theory of communication[END_REF]. Shannon a montré qu'une transmission peut être décomposée en deux étapes: le codage source et le codage de canal. Le codage source est utilisé pour la compression de données [START_REF] Welsh | Codes and cryptography[END_REF][START_REF] Thomas | Elements of information theory[END_REF], mais nous n'en discutons pas dans cette thèse et nous nous focalisons sur l'étape du codage de canal où les codes correcteurs sont utilisés. Dans [START_REF] Elwood | A mathematical theory of communication[END_REF], Shannon a défini le concept de capacité qui est le taux maximal auquel de l'information peut être transmise de manière fiable sur un canal bruité donné. Il a également prouvé que la capacité de n'importe quel canal est atteinte par des codes correcteurs aléatoires qui, malheureusement, ne peuvent pas être implémentés de manière efficace. Alors que ces résultats révolutionnaires étaient publiés, Richard Hamming a introduit la première famille fonctionnelle de codes correcteurs qui est maintenant appelée le code de Hamming [START_REF] Hamming | Error detecting and error correcting codes[END_REF]. Lorsqu'Alice envoie un message x ∈ F n 2 à travers le canal bruité, Bob obtient comme sortie un autre message y ∈ F n 2 suivant une distribution de probabilité donnée qui dépend de x. Deux modèles de canaux importants sont le canal binaire à effacement et le canal binaire symétrique. Tous deux prennent en entrée un unique bit, c'est à dire que n = 1. Pour le canal binaire à effacement de paramètre p ∈ [0, 1], le bit qu'Alice a envoyé est correctement transmis avec probabilité 1 -p et est effacé avec probabilité p. Lorsque Bob reçoit un 0 ou un 1, il sait que le bit est correct et lorsque le bit est effacé, il reçoit le symbole '?'. Pour le canal binaire symétrique, chaque bit transmis est flippé (0 → 1 and 1 → 0) avec probabilité p et est correct avec probabilité 1 -p. Lorsque le canal est utilisé une seule fois, Alice peut envoyer un bit à Bob mais elle peut aussi l'utiliser n ∈ N fois d'affilée pour envoyer n bits. Dans ce cas, nous supposons que les n utilisations du canal sont indépendantes en terme de probabilité. Dans ce qui suit, nous nous intéresserons principalement au cas du canal binaire symétrique. Le but d'Alice est d'envoyer un message arbitraire s ∈ F k 2 à Bob de telle manière qu'il puisse retrouver s avec une bonne probabilité. Bien évidemment, puisque n'importe quel message s ∈ F k 2 aurait pu être envoyé, Bob n'a aucun moyen de corriger un bit-flip sous l'hypothèse qu'Alice envoie s directement à travers le canal. À la place, elle peut envoyer x ∈ F n 2 une version encodée de s choisie de telle manière que Bob peut retrouver s même si le canal a flippé quelques bits de x. En particulier, les bits de x doivent contenir de la redondance et donc la condition n > k doit être vérifiée. Un code correcteur d'erreurs C ⊆ F n 2 satisfait C = F k 2 = 2 k et est défini comme l'ensemble des mots binaires x, appelés les mots de code, qu'Alice peut envoyer à travers le canal.

Un code correcteur C est appelé un [n, k] code linéaire lorsque l'ensemble des mots de code est un sous-espace de dimension k de F n 2 et, à partir de maintenant, les codes que nous considérerons sont linéaires. La distance minimale est le poids minimum d'un mot de code différent de zéro. Si la distance minimale d est connue, on dit que le code est un [n, k, d] code linéaire. Les bits de s sont appelés les bits logiques, les bits de x sont appelés les bits physiques et le nombre de bits physiques est appelé la taille du bloc.

La Figure 1.4 représente le protocole basé sur les codes correcteurs d'erreurs qu'utilisent Alice et Bob pour communiquer avec un canal bruité:

• Alice encode le message s en un mot de code x et envoie x à Bob via le canal bruité.

• Bob obtient y comme sortie du canal et essaye d'inférer le mot de code x qu'Alice a envoyé, sa conjecture est notée x.

• Bob décode x en un message ŝ en appliquant l'inverse de la fonction qu'Alice a utilisée pendant l'étape d'encodage.

Le protocole ci-dessus est un succès lorsque s = ŝ et est un échec lorsque s = ŝ. Dans cette thèse, nous nous intéressons aux codes linéaires pour lesquels la première et la troisième étape peuvent être faites facilement en utilisant de l'algèbre linéaire. Ainsi, nous allons principalement nous intéresser à la seconde étape, appelée l'étape de correction d'erreurs ou l'étape de décodage, où Bob déduit x à partir de y en utilisant un algorithme appelé l'algorithme de décodage ou le décodeur. L'un des principaux Par exemple, Alice envoie le bit s ∈ F2 trois fois à Bob qui peut le retrouver en utilisant un vote de majorité (ceci est appelé le code de répétition à 3 bits). objectifs de la théorie des codes est de trouver des familles de codes correcteurs pour lesquels le rapport k/n est large et qui admettent un décodeur efficace en temps dont la probabilité d'échec est faible.

L'un des principaux résultats de ref. [START_REF] Elwood | A mathematical theory of communication[END_REF] est la possibilité d'utiliser un canal bruité pour transmettre de l'information de manière fiable avec un taux constant. Au lieu d'utiliser un unique code correcteur d'erreurs, considérons une famille de codes C 1 , C 2 , . . . où C i encode k i bits logiques avec n i bits physiques. Lorsque le rapport k i /n i converge et n i tend vers l'infini, la limite r ∈ [0, 1] est appelée le rendement asymptotique de la famille. De plus, quand un canal binaire symétrique de paramètre p est utilisé, le seuil de C i est le nombre réel maximal p ∈ [0, 1] tel que la probabilité d'échec tend vers 0 lorsque i tend vers l'infini. Nous disons que C i permet une transmission fiable via le canal binaire symétrique quand le paramètre p est en dessous du seuil de la famille de codes. Un canal binaire symétrique avec paramètre fixe p ∈ (0, 1) ne peut pas transmettre de l'information de manière fiable avec un rendement arbitrairement proche de 1. En fait, il existe une limite appelée la capacité du canal qui est une borne supérieure sur le rendement asymptotique de n'importe quelle famille de code qui permet une transmission fiable. Le notion de capacité a été introduite par Shannon dans [START_REF] Elwood | A mathematical theory of communication[END_REF] Dans sa thèse en 1962 [START_REF] Gallager | Low-density parity-check codes[END_REF], Robert Gallager a introduit la famille des codes LDPC (Low Density Parity Check) et a suggéré de les décoder avec un algorithme appelé décodeur itératif. Toutefois à cette époque, les ordinateurs n'étaient pas suffisamment puissants pour implémenter le décodeur itératif et donc les codes LDPC n'avaient pas d'intérêt pratique. À la fin des années 1990, il y a eu un regain d'intérêt pour les codes LDPC avec les papiers [START_REF] Luby | Analysis of low density codes and improved designs using irregular graphs[END_REF][START_REF] Luby | Practical loss-resilient codes[END_REF][START_REF] Michael G Luby | Improved low-density parity-check codes using irregular graphs[END_REF][START_REF] Michael G Luby | Efficient erasure correcting codes[END_REF]. De nos jours, ces codes sont utilisés de manière intensive dans les réseaux de communication [START_REF] Richardson | Design of low-density parity check codes for 5g new radio[END_REF][START_REF] Shirvanimoghaddam | Short block-length codes for ultra-reliable low latency communications[END_REF]. Afin de définir les codes LDPC, nous avons besoin d'expliquer les concepts de matrice de parité et de graphe de Tanner. Soit C un code linéaire et soit H une matrice binaire telle que C = ker(H). On dit alors que H est une matrice de parité pour C. Un graphe de Tanner G pour C est un graphe biparti construit à partir de H de la manière suivante: les sommets gauches de G représentent les colonnes de H, les sommets droits représentent les lignes de H et deux sommets sont reliés si et seulement si l'entrée correspondante dans H est égale à 1 [START_REF] Tanner | A recursive approach to low complexity codes[END_REF]. Par définition, une famille de codes est LDPC si et seulement si les degrés dans le graphe de Tanner sont bornés supérieurement par une constante uniforme.

Au début des années 1990, les turbo codes de Berrou, Glavieux et Thitimajshima [START_REF] Berrou | Near shannon limit error-correcting coding and decoding: Turbo-codes. 1[END_REF] ont fait prendre conscience à la communauté scientifique qu'il est possible d'implémenter en pratique des codes correcteurs dont la probabilité de succès est haute et dont le rendement est proche de la capacité du canal. Les turbo codes sont basés sur les codes de convolution [START_REF] Johannesson | Fundamentals of convolutional coding[END_REF] introduits par Elias dans [START_REF] Elias | Coding for noisy channels[END_REF]. Pour un code de convolution, un flux de bits est encodé dans un autre flux de bits. Dans cette thèse, nous nous intéressons aux codes par blocs tels que les codes LDPC qui, par opposition aux codes de convolution, encode un bloc de bits dans un autre bloc plus large (un bloc est une chaîne de bits de taille fixée).

Pour simplifier, les codes classiques que nous considérerons sont des codes LDPC réguliers comme définis par Gallager dans sa thèse [START_REF] Gallager | Low-density parity-check codes[END_REF]. Par définition, un code régulier est tel que les sommets droits dans le graphe de Tanner ont degré d V et les sommets gauche ont degré d C où d V , d C ∈ N sont des entiers fixés. On remarque toutefois que les performances des codes LDPC réguliers ne sont pas aussi bonnes que celles d'autres familles de codes LPDC. Par exemple, ref. [START_REF] Oswald | Capacity-achieving sequences for the erasure channel[END_REF] montre qu'une famille de codes réguliers ne peut pas atteindre la capacité du canal binaire à effacement. Il a également été démontré que les codes irréguliers ont de meilleurs seuils [START_REF] Michael G Luby | Efficient erasure correcting codes[END_REF][START_REF] Michael G Luby | Improved low-density parity-check codes using irregular graphs[END_REF][START_REF] Luby | Practical loss-resilient codes[END_REF][START_REF] Luby | Analysis of low density codes and improved designs using irregular graphs[END_REF] et de meilleures performances à taille finie [START_REF] Thomas | Efficient encoding of low-density parity-check codes[END_REF][START_REF] Wang | Upper bounding the performance of arbitrary finite ldpc codes on binary erasure channels[END_REF][START_REF] Yedidia | Projection algebra analysis of error-correcting codes[END_REF][START_REF] Zhang | Finite-length analysis of ldpc codes with large left degrees[END_REF]. Plus généralement, de nombreuses familles de codes ont été introduites dans le but d'augmenter la probabilité de succès et de réduire le temps nécessaire aux étapes d'encodage et de décodage. On peut par exemple citer les codes concaténés [START_REF] Forney | Concatenated codes[END_REF], les codes algébriques de Reed-Solomon [START_REF] Sudan | Decoding of reed solomon codes beyond the error-correction bound[END_REF][START_REF] Koetter | Algebraic soft-decision decoding of reedsolomon codes[END_REF][START_REF] Irving | Polynomial codes over certain finite fields[END_REF] et plus récemment les codes LDPC spatialement couplés [START_REF] Jimenez | Time-varying periodic convolutional codes with low-density parity-check matrix[END_REF], les codes polaires [START_REF] Arikan | Channel polarization: A method for constructing capacityachieving codes[END_REF] et les codes irréguliers basés sur les protographes [START_REF] Thorpe | Low-density parity-check (ldpc) codes constructed from protographs[END_REF]. De plus, il existe de nombreuses techniques pour optimiser les codes LDPC [START_REF] Chung | On the construction of some capacity-approaching coding schemes[END_REF][START_REF] Roumy | Design methods for irregular repeat accumulate codes[END_REF][START_REF] Hu | Regular and irregular progressive edge-growth tanner graphs[END_REF][START_REF] Tian | Selective avoidance of cycles in irregular ldpc code construction[END_REF].

Pour plus de détails à propos des codes correcteurs d'erreurs classiques, voir [START_REF] Welsh | Codes and cryptography[END_REF][START_REF] Richardson | Modern coding theory[END_REF][START_REF] Johannesson | Fundamentals of convolutional coding[END_REF]].

Information quantique

Cette partie introduit les concepts fondamentaux de la théorie de l'information quantique dont nous aurons besoin pour expliquer nos résultats, voir [START_REF] Michael | Quantum computation and quantum information[END_REF] pour plus de détails à propos d'information quantique et de calcul quantique.

Un état pur sur n qubits |ψ ∈ C 2 n ("ket psi") est défini mathématiquement par un vecteur complexe normalisé pour la norme Euclidienne avec 2 n entrées. Il est pratique de voir |ψ comme un élément de C 2 ⊗n où tout au long de ce manuscrit, ⊗ est le 1.2. Information quantique produit tensoriel (ou le produit de Kronecker). Le vecteur ligne ψ| := |ψ † ("bra psi") est défini comme étant le transpose conjugué de |ψ . De plus, pour i ∈ 0; 2 n -1 , l'état |i est le vecteur colonne dont la seule entrée non-nulle est un 1 à la i ème position. La dynamique des états quantiques purs est divisée en deux types d'opérations: les évolutions unitaires et les mesures. Une évolution unitaire est de la forme U : |ψ → U |ψ où U est n'importe quelle matrice unitaire complexe de dimension 2 n × 2 n . Parmi les matrices unitaires, le groupe de Pauli est particulièrement important et est défini par:

P n := αP : α ∈ 1, -1, i, -i et P ∈ 1, X, Y, Z ⊗n où X est appelé le bit-flip et Z est appelé le phase-flip:

X := 0 1 1 0 , Y := iXZ = 0 -i i 0 , Z := 1 0 0 -1 .
Pour une erreur de Pauli P ∈ P n , le poids de P désigné par |P | est défini comme étant le nombre de qubits sur lesquels P agit de manière triviale. Formellement, si nous écrivons P = αP 1 ⊗ . . . ⊗ P n où α ∈ {1, -1, i, -i} est une phase globale et P 1 , . . . , P n ∈ {1, X, Y, Z} sont des matrices de Pauli agissant sur un qubit, alors |P | est défini par:

|P | := # i ∈ 1; n : P i = 1 .
Une matrice Π est un projecteur orthogonal lorsque Π 2 = Π et Π = Π † où Π † est l'opérateur adjoint de Π (l'opérateur adjoint est la matrice transpose conjuguée).

En général, les mesures d'états purs |ψ ∈ C 2 n ont pour sortie un bit classique b ∈ F 2 et modifient |ψ (on dit que |ψ est réduit à un autre état quantique). Pour la correction d'erreurs, nous nous intéressons aux mesures projectives définies par deux projecteurs orthogonaux Π 0 , Π 1 de taille 2 n × 2 n satisfaisant Π 0 + Π 1 = 1 où 1 est la matrice identité:

• Avec probabilité ψ| Π 0 |ψ : la sortie de la mesure est b = 0 et l'état est réduit à Π 0 |ψ ψ| Π 0 |ψ .

• Avec probabilité ψ| Π 1 |ψ : la sortie de la mesure est b = 1 et l'état est réduit à Π 1 |ψ ψ| Π 1 |ψ .

En particulier, une mesure de Pauli associée à un opérateur de Pauli P ∈ P n est la mesure projective définie à partir de Π 0 et Π 1 où:

-Π 0 := (1 + P )/2 le projecteur orthogonal associé à la valeur propre +1 de P .

-Π 1 := (1 -P )/2 le projecteur orthogonal associé à la valeur propre -1 de P .

En général, un système quantique S n'est pas isolé dans le sens où il interagit avec d'autres systèmes que l'on appelle l'environnement. Dans ce cas, l'état de S n'est pas nécessairement un état pur mais est toujours un mélange probabiliste d'états purs. Une matrice de densité est un moyen pratique de représenter un tel mélange par un opérateur semi-défini positif de taille 2 n × 2 n avec des coefficients complexes et trace 1. Par exemple, la matrice de densité associée à un état pur |ψ est |ψ ψ| où ψ| = |ψ † comme précédemment. Plus généralement, soient |ψ 1 , . . . , |ψ m des états purs et soient p 1 , . . . , p m ∈ [0, 1] des probabilités telles que p 1 + . . . + p m = 1. Alors, la matrice de densité d'un système où chaque état |ψ i a été préparé avec probabilité p i est:

ρ = m i=1 p i |ψ i ψ i | .
(1.2)

Lors de l'interaction d'un système quantique S avec un environnement E, le nombre de qubits dans S peut changer. En effet, certains qubits de S peuvent être jetés et certains qubits de E peuvent être ajoutés à S. Formellement, n'importe quelle évolution d'un système avec n qubits vers un système avec n qubits peut être représenté par une application CPTP E (completely positive trace preserving map) parfois appelée un canal quantique ou une opération quantique. Une application CPTP est définie par un ensemble de matrices complexes E k de taille 2 n × 2 n appelées les opérateurs de Kraus

satisfaisant k E † k E k = 1: E : ρ → K k=1 E k ρE † k .
Par exemple, une évolution unitaire U est représentée par un unique opérateur de Kraus E 1 = U où n = n . Comme indiqué précédemment, la mesure d'un opérateur de Pauli P ∈ P n d'un état pur |ψ est la mesure projective associée à Π 0 := (1 + P )/2 et Π 1 := (1 -P )/2. Soit M une application CPTP représentant cette mesure et soient:

p 0 := ψ| Π 0 |ψ , |ψ 0 := Π 0 |ψ ψ| Π 0 |ψ , p 1 := ψ| Π 1 |ψ , |ψ 1 := Π 1 |ψ ψ| Π 1 |ψ .
Alors M est équivalente à préparer l'état |ψ 0 avec probabilité p 0 et l'état |ψ 1 avec probabilité p 1 . En utilisant eq. (1.2), nous avons:

M : |ψ ψ| → |0 0| ⊗ Π 0 |ψ ψ| Π 0 + |1 1| ⊗ Π 1 |ψ ψ| Π 1 .
Ici, pour simplifier, la sortie classique de la mesure b ∈ {0, 1} est stockée comme un qubit. Plus généralement, pour n'importe quelle matrice de densité ρ nous avons:

M : ρ → |0 0| ⊗ Π 0 ρΠ 0 + |1 1| ⊗ Π 1 ρΠ 1 . (1.3)
Les opérateurs de Kraus de

M sont E 0 = |0 ⊗ Π 0 et E 1 = |1 ⊗ Π 1 avec n = n + 1.

Correction d'erreurs quantiques

Dans la Section 1.1, nous avons utilisé le scénario de communication présenté dans la Dans ce travail, nous nous intéressons aux canaux quantiques qui satisfont la propriété stochastique locale de paramètre p ∈ [0, 1]. Un modèle de bruit est stochastique local quand la probabilité qu'un certain ensemble de qubits S soit dans le support de l'erreur décroît exponentiellement en |S|. Formellement, soit V Q l'ensemble des qubits et soit E un canal quantique alors:

• E a la propriété d'être stochastique si E peut être décrit par un processus en deux étapes:

-Lors de la première étape, un ensemble aléatoire E ⊆ V Q appelé le support de l'erreur est choisi aléatoirement. -Lors de la deuxième étape, un canal quantique E E est appliqué sur les qubits.

Ici, pour chaque F ⊆ V Q , E F est une application CPTP agissant sur les qubits de F .

• E est stochastique local de paramètre p ∈ [0, 1] s'il est stochastique et la distribution de probabilité de E satisfait pour tout S ⊆ V Q :

P S ⊆ E ≤ p |S| . (1.4)
En d'autres termes, un bruit stochastique local E est tel que:

E : ρ → F ⊆V Q P E = F E F (ρ),
où le support E ⊆ V Q est choisi aléatoirement de telle manière que eq. (1.4) soit vérifiée pour tout S ⊆ V Q . Par exemple, le canal qui applique des bit-flips et des phase-flips de manière indépendante et identiquement distribuée a la propriété stochastique locale. Un autre exemple est le canal dépolarisant qui applique sur chaque qubit indépendamment le canal D défini ci-dessous:

D : ρ → (1 -p)ρ + p 3 XρX + Y ρY + ZρZ .
Le canal dépolarisant pour n qubits est égal à D ⊗n et est stochastique local de paramètre p/3. Lorsque nous parlerons de probabilité de succès (ou de probabilité pour l'erreur d'être corrigée) pour un bruit stochastique local, cela fera référence à la probabilité sur E pour la communication d'être un succès:

P Succès = F ⊆V Q P E = F P | φ = |ϕ E = F .
Notons que si l'algorithme de décodage est déterministe, on a

P | φ = |ϕ E = F ∈ {0, 1}.
Dans le cas classique, nous nous sommes concentrés sur le modèle de bit-flips qui est assez réaliste. En revanche dans le cas quantique, l'ensemble des erreurs possibles est infini: n'importe quelle unitaire ou même n'importe quelle application CPTP peut potentiellement être appliquée sur l'état que l'on essaye de protéger. De manière surprenante, il suffit de corriger l'ensemble fini des erreurs de Pauli pour corriger les erreurs générales (voir [START_REF] Charles | Mixed-state entanglement and quantum error correction[END_REF] ou [START_REF] Michael | Quantum computation and quantum information[END_REF]). Par exemple, si une procédure de correction d'erreurs est capable de corriger n'importe quelle erreur de Pauli qui agit sur les qubits de F ⊆ V Q , alors la même procédure corrige une application CPTP arbitraire agissant sur F . En conséquence, pour un modèle de bruit stochastique local, nous pouvons supposer sans perte de généralité que les applications CPTP E F sont des canaux de Pauli (c'est à dire qu'ils appliquent des erreurs de Pauli sur les qubits de F ).

Dans les années 1990, la question de savoir si la correction d'erreurs quantiques est possible était débattue jusqu'à ce que Shor [START_REF] Peter | Scheme for reducing decoherence in quantum computer memory[END_REF] et Steane [START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF] montrent que c'est en effet possible. Suite à ces travaux fondateurs, la théorie de la correction d'erreurs quantiques a été développée, par exemple dans [START_REF] Knill | Theory of quantum error-correcting codes[END_REF][START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Steane | Multiple-particle interference and quantum error correction[END_REF][START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF]. En particulier dans [START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF], Gottesman a introduit les outils mathématiques utilisés pour définir et étudier une large classe de codes quantiques appelés les codes stabilisateurs. Un code stabilisateur Q sur N qubits physiques est défini à partir d'un ensemble fini d'opérateurs de Pauli appelés les générateurs du stabilisateur. Ces générateurs g 1 , . . . , g M ∈ P N doivent commuter et Q est alors défini de la manière suivante:

Q := |ψ ∈ C 2 ⊗N : g 1 |ψ = . . . = g M |ψ = |ψ .
Le code Q est appelé un [[N ; K]] code stabilisateur où K est le nombre de qubits logiques.

Dans cette thèse, nous nous concentrons sur un groupe particulier de codes stabilisateurs appelés les codes CSS LDPC. La terminologie "CSS" vient de Calderbank, Shor et Steane qui ont introduit la construction CSS en 1996 [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF]. Un code CSS est construit à partir de deux codes classiques

C X et C Z avec C ⊥ Z ⊆ C X où C X
est utilisé pour corriger les erreurs de bit-flips et C Z est utilisé pour corriger les erreurs de phase-flips. La première étape de la procédure de correction d'erreurs est de mesurer les générateurs du stabilisateur. La sortie de la mesure est un mot binaire appelé syndrome. D'un point de vue pratique, pour être capable de mesurer les générateurs du stabilisateur, il est important que chacun implique un petit nombre de qubits et que chaque qubit soit impliqué dans un petit nombre de générateurs. Ces propriétés sont satisfaites quand les deux codes classiques utilisés pour construire le code CSS sont LDPC et dans ce cas le code est dit CSS LDPC.

La distance minimale d'un code stabilisateur est le poids minimum d'une erreur de Pauli qui envoie un état du code sur un autre état du code orthogonal au premier. Cette quantité est une bonne indication de la performance du code et c'est une question ouverte de savoir si des codes avec distance minimale D = Θ(N ) existent. Sans la contrainte LDPC, cette question a été résolue par l'affirmative lorsque les codes CSS ont été introduits dans [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF]. Pour les codes LDPC, la meilleure distance minimale connue est D = Θ( √ N 4 log(N )) pour une famille de codes avec K = 1 qubit logique, dont la construction s'appuie sur une variété en quatre dimensions [START_REF] Michael H Freedman | Z2-systolic freedom and quantum codes[END_REF] Un décodeur ou algorithme de décodage pour un code stabilisateur est un algorithme classique qui prend en entrée un syndrome et renvoie une erreur de Pauli. L'algorithme réussit lorsqu'appliquer cette Pauli sur l'état quantique reçu par Bob, lui fait retrouver l'état originel qu'Alice a envoyé par le canal quantique. Pour les codes CSS, le but du décodeur est de corriger les deux codes classiques initiaux en prenant en compte la dégénérescence du code CSS. Le terme "dégénérescence" fait référence au fait qu'il existe des erreurs équivalentes, i.e. des opérateurs de Pauli différents qui agissent de la même façon sur les états du code. Par exemple, un générateur du stabilisateur d'un code envoie n'importe quel état du code sur lui-même. Il est donc équivalent à l'identité et aux autres générateurs du stabilisateur. Par comparaison, dans le cas classique, deux erreurs agissent de la même façon sur un mot de code si et seulement si elles sont égales. À cause de la dégénérescence, le décodeur d'un code quantique peut avoir corrigé l'erreur même s' il n'a pas retrouvé l'erreur physique qui est advenue sur l'état initial. Ceci est crucial pour les code CSS LDPC puisque les codes classiques utilisés dans la construction doivent contenir des mots de code de poids constant. Les codes CSS LDPC sont donc fortement dégénérés. Un exemple de décodage avec de bonnes performances est le décodeur de poids minimum: il renvoie une erreur de Pauli de poids minimum dont le syndrome est égal au syndrome d'entrée. Un seuil pour une famille de codes quantiques est une probabilité non nulle p th ∈ (0, 1] telle que l'erreur générée par un canal stochastique local de paramètre p < p th est corrigée avec une probabilité qui tend vers 1 quand la taille de bloc tend vers l'infini.

Parmi les codes CSS LDPC, le code torique introduit par Kitaev est le plus connu et a été abondamment étudié [START_REF] Yu | Quantum error correction with imperfect gates[END_REF][START_REF] Yu | Fault-tolerant quantum computation by anyons[END_REF][START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Poulin | On the iterative decoding of sparse quantum codes[END_REF][START_REF] Delfosse | Almost-linear time decoding algorithm for topological codes[END_REF][START_REF] Liu | Neural belief-propagation decoders for quantum error-correcting codes[END_REF]. Le code torique de paramètre L ∈ N * est défini à partir du pavage d'un tore en deux dimensions, ce qui conduit à un

[[2L 2 , 2, L
]] CSS LDPC code stabilisateur. Le code torique a beaucoup d'avantages, par exemple sa distance minimale D = Θ( √ N ) est large et les générateurs du stabilisateur impliquent seulement des interactions plus proches voisins. Ceci est approprié pour une implémentation puisqu'un tore en deux dimensions peut être plongé dans notre espace euclidien à trois dimensions. Ainsi, une implémentation du code torique nécessiterait de ne faire interagir que des qubits proches dans l'espace. De plus, les performances du code torique sont vraiment bonnes même pour de petites tailles de blocs. Enfin, le décodage de plus petit poids peut être implémenté en temps polynomial avec l'algorithme de Edmonds [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Edmonds | Maximum matching and a polyhedron with 0, 1-vertices[END_REF].

Au-delà du code torique, n'importe quel pavage d'une variété définit un code CSS LDPC appelé code topologique. Ce principe permet d'utiliser de puissants arguments issus de la topologie pour étudier de tels codes et pour concevoir des décodeurs. Voir par exemple le code de surface [START_REF] Sergey | Quantum codes on a lattice with boundary[END_REF], les codes hyperboliques de dimension deux [START_REF] Nikolas | Constructions and noise threshold of hyperbolic surface codes[END_REF], les codes semi-hyperboliques [START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF] et les codes hyperboliques de dimension quatre [START_REF] Guth | Quantum error correcting codes and 4dimensional arithmetic hyperbolic manifolds[END_REF][START_REF] Londe | Golden codes: quantum LDPC codes built from regular tessellations of hyperbolic 4-manifolds[END_REF][START_REF] Matthew | Decoding in hyperbolic spaces: quantum LDPC codes with linear rate and efficient error correction[END_REF]. Il existe deux résultats qui imposent des contraintes fortes sur le compromis entre les paramètres N , K et D d'un code topologique en deux dimensions [START_REF] Bravyi | Tradeoffs for reliable quantum information storage in 2d systems[END_REF][START_REF] Delfosse | Tradeoffs for reliable quantum information storage in surface codes and color codes[END_REF]. Le premier établi que KD 2 = O(N ) et est satisfait pour n'importe quel code topologique construit à partir d'une variété euclidienne de dimension deux [START_REF] Bravyi | Tradeoffs for reliable quantum information storage in 2d systems[END_REF]. Le second résultat est KD 2 = O(N log 2 (N )) et doit être satisfait même si l'espace sous-jacent n'est pas euclidien [START_REF] Delfosse | Tradeoffs for reliable quantum information storage in surface codes and color codes[END_REF]. Par conséquent, l'avantage d'utiliser des codes topologiques construits à partir d'espaces de dimension quatre est d'outrepasser ces deux résultats négatifs. En particulier, les paramètres K = Θ(N ) et D = Ω(N 0.2 ) sont atteints pour des codes hyperboliques en quatre dimensions [START_REF] Guth | Quantum error correcting codes and 4dimensional arithmetic hyperbolic manifolds[END_REF][START_REF] Londe | Golden codes: quantum LDPC codes built from regular tessellations of hyperbolic 4-manifolds[END_REF]. Notons en revanche qu'il n'est pas possible de plonger un code hyperbolique ou un code de dimension quatre dans notre monde réel en conservant des interactions plus proches voisins.

Une autre généralisation du code torique est le code produit d'hypergraphes introduit par Tillich et Zémor dans [START_REF] Tillich | Quantum LDPC codes with positive rate and minimum distance proportional to the square root of the blocklength[END_REF]. Cette construction combinatoire a l'avantage de construire des codes quantiques à partir de bons codes classiques et donc des arguments de théorie des codes peuvent être utilisés pour les étudier. Si les codes classiques initiaux sont LDPC, ont un rendement constant et ont une distance minimale linéaire, alors le produit d'hypergraphes correspondant est également LDPC, a un rendement constant et sa distance minimale croît comme la racine carrée de la taille de bloc. Ce comportement asymptotique des paramètres est l'un des meilleurs parmi les constructions connues de codes quantiques. Le principal objet d'intérêt dans cette thèse de doctorat est une famille spécifique de produits d'hypergraphes appelés codes expanseurs quantiques [START_REF] Leverrier | Quantum expander codes[END_REF]. Contrairement aux codes produits d'hypergraphes plus généraux, les codes expanseurs quantiques ont l'avantage d'être équipés d'un décodeur efficace appelé le décodeur small-set-flip.

Dans Figure 1.6, nous donnons des exemples de codes CSS LDPC. Les colonnes "Dimension" et "Distance minimale" contiennent les paramètres K et D des codes. Par définition de la distance minimale, n'importe quelle erreur de poids jusqu'à (D -1)/2 est corrigée par le décodeur de poids minimal qui (en général) fonctionne en temps exponentiel. Toutefois, les décodeurs connus fonctionnant en temps polynomial ne corrigent pas nécessairement toutes les erreurs jusqu'à une fraction de la distance minimale. C'est pourquoi, nous reportons dans la colonne "Poids maximum d'une erreur adverse corrigée par un décodeur efficace", la meilleure valeur connue T telle que n'importe quelle erreur de poids jusqu'à T soit corrigée par un algorithme de décodage en temps polynomial. Une idée naturelle pour décoder les codes produits d'hypergraphes est d'utiliser les décodeurs des codes classiques. Toutefois, cette stratégie ne marche pas dans le cas général. Par exemple, le décodage itératif est utilisé de manière intensive dans le cas classique mais ne fonctionne pas bien pour les codes produits d'hypergraphes [START_REF] Poulin | On the iterative decoding of sparse quantum codes[END_REF][START_REF] Maurice | Codes correcteurs quantiques pouvant se décoder itérativement[END_REF]. Heureusement, il peut être amélioré en utilisant des réseaux de neurones [START_REF] Liu | Neural belief-propagation decoders for quantum error-correcting codes[END_REF] ou l'amélioration OSD (ordered statistics decoding) [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]. Ref. [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF] montre que les produits d'hypergraphes ont de bonnes performances en pratique: pour un canal dépolarisant avec un taux d'erreurs physiques en dessous de 10%, un code produit d'hypergraphes bien choisi avec 28 qubits logiques a de meilleures performances qu'un code de surface avec 1 qubit logique décodé avec le décodeur de poids minimum (voir la figure 3 de [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]).

Codes produits d'hypergraphes

Codes expanseurs quantiques

En 1996, Sipser et Spielman ont introduit le concept de graphes expanseurs et ont défini un code expanseur classique comme étant un code dont le graphe de Tanner est un expanseur [START_REF] Sipser | Expander codes[END_REF]. La propriété d'expansion est utile pour montrer certaines propriétés du code, comme par exemple le fait que la distance minimale d'un code expanseur classique est linéaire en la taille du bloc. Pour cette thèse, nous nous intéressons en particulier à la manière dont une expansion suffisante implique que n'importe quelle erreur de poids jusqu'à une fraction de la distance minimale est corrigée par un décodeur appelé l'algorithme de bit-flip. L'algorithme de bit-flip est l'un des algorithmes les plus simples qu'il soit possible de concevoir, et c'est pourquoi il est intéressant pour une analyse théorique. Toutefois, les simulations numériques montrent que le décodage itératif est le meilleur décodage pour les codes LDPC classiques et qu'il bat largement l'algorithme de bit-flip. De plus, le décodage itératif peut également être analysé avec des arguments d'expansion [START_REF] Burshtein | Expander graph arguments for message-passing algorithms[END_REF].

Le problème de trouver les paramètres d'expansion d'un graphe est un problème co-NP-difficile [START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF] et la construction de codes expanseurs n'est pas aisée. Dans ce travail, nous nous appuyons sur une construction probabiliste appelée le modèle de configuration, qui permet de construire avec grande probabilité un code avec n'importe quel paramètre d'expansion et n'importe quel rendement [START_REF] Sipser | Expander codes[END_REF][START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF][START_REF] Miller | The rate of regular ldpc codes[END_REF]. La première construction déterministe de graphes expanseurs est basée sur des arguments algébriques de Margulis [START_REF] Grigorii | Explicit constructions of graphs without short cycles and low density codes[END_REF] et a été améliorée par Barg et Zémor [START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Barg | Multilevel expander codes[END_REF][START_REF] Barg | Distance properties of expander codes[END_REF]. Il est également possible de construire des graphes expanseurs avec la méthode du produit zig-zag [START_REF] Capalbo | Randomness conductors and constant-degree lossless expanders[END_REF]. Voir [START_REF] Hoory | Expander graphs and their applications[END_REF] pour une veille sur les graphes expanseurs.

Par définition, un code expanseur quantique est un [[Θ(n 2 ), Θ(n 2 ), Θ(n)]] code stabilisateur défini comme le produit d'hypergraphes d'un [n, Θ(n), Θ(n)] code expanseur classique avec lui-même [START_REF] Leverrier | Quantum expander codes[END_REF]. Ref. [START_REF] Leverrier | Quantum expander codes[END_REF] a également introduit le décodeur small-set-flip et a montré que n'importe quelle erreur de poids jusqu'à une fraction de la distance minimale est corrigée. La principale motivation pour étudier ces codes est le résultat de Daniel Gottesman qui montre que le calcul tolérant aux fautes avec coût constant en espace est possible [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. Comme discuté au début de ce résumé, ce résultat est soumis à la conjecture qu'il existe des codes quantiques avec les propriétés appropriées. Grâce à [START_REF] Leverrier | Quantum expander codes[END_REF], il est déjà connu que les codes expanseurs quantiques satisfont plusieurs de ces propriétés: il sont LDPC, ils ont un rendement constant et une bonne distance minimale. Le principal résultat de cette thèse est de montrer que les codes expanseurs quantiques satisfont aussi les autres propriétés nécessaires, et qu'ils peuvent donc être utilisés pour implémenter le schéma de tolérance aux fautes de Gottesman.

De par la construction produit d'hypergraphes, un code expanseur quantique est un code CSS associé à deux codes classiques C X et C Z construits à partir du code expanseur classique initial. Modulo une permutation des bits, le code C X est égal à C Z . Ainsi, comme c'est le cas pour beaucoup de codes CSS, il est suffisant de décrire et d'analyser seulement le décodeur pour les erreurs de type bit-flip. Sous cette hypothèse, le support de l'erreur détermine l'erreur sur les qubits et donc nous supposerons souvent qu'une "erreur" et un "support d'erreur" sont les mêmes objets. Le décodeur small-set-flip est un algorithme de décodage à décisions dures. Cela qui signifie que son exécution est divisée en plusieurs tours et qu'à chaque tour, les qubits appartenant à un certain ensemble F sont flippés. L'implémentation de l'algorithme small-set-flip est assez simple: à chaque tour, un petit ensemble F ∈ F est sélectionné de telle manière que le poids du syndrome diminue suffisamment lorsque les qubits de F sont flippés (le poids du syndrome est le nombres de bits du syndrome égaux à 1).

Calcul quantique tolérant aux fautes

Le but du calcul tolérant aux fautes est de concevoir des circuits robustes contre le bruit [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF]. Un circuit C est décrit par des fils (qui contiennent des états quantiques) et par des opérations élémentaires telles qu'une préparation d'état, une mesure ou une porte unitaire. On suppose souvent que C a une sortie classique r ∈ F m 2 : pendant la dernière étape, tous les fils quantiques sont mesurés et un post-traitement classique est appliquée pour obtenir r. Dans cette thèse, une préparation d'état crée un état |0 , une mesure correspond à la mesure d'une matrice de Pauli Z et les portes unitaires appartiennent à l'ensemble fini G := X, Z, H, S, T, C X où:

X = 0 1 1 0 , Z = 1 0 0 -1 , H = 1 √ 2 1 1 1 -1 , S = e -iπ/4 0 0 e iπ/4 , T = e -iπ/8 0 0 e iπ/8 , C X =     1 0 0 0 0 1 0 0 0 0 0 1 0 0 1 0     . Chapter 1. Introduction (Français) Notons que G n'est pas minimal car Z = S 2 = T 4 et X = H • Z • H.
P R ⊆ F ≤ p |R| .
Une fois que F a été choisi, un site de L \ F se comporte normalement, mais un site défaillant l ∈ F est remplacé par une application CPTP arbitraire dont les espaces d'entrée et de sortie sont les mêmes que pour l. Soit r la sortie de C dans le cas sans bruit F = ∅, alors le but du calcul tolérant aux fautes est, étant donné un paramètre > 0, de concevoir un circuit C dont la sortie est r avec probabilité supérieure à 1quand les sites sont soumis à un bruit stochastique local.

Dans ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF], le circuit tolérant aux fautes C est construit en utilisant la concaténation de codes. L'idée est de définir une fonction Φ qui envoie un circuit C sur un autre circuit Φ(C) qui est plus robuste contre le bruit. Finalement, le circuit C est défini par C = Φ k (C) pour un k ∈ N bien choisi. Dans Φ(C), chaque fil de C est encodé avec N fils en utilisant un code stabilisateur [[N, 1]]. De plus, de la correction d'erreurs est régulièrement effectuée sur les fils de Φ(C). Dans ce protocole de tolérance aux fautes, les qubits sont encodés un par un ce qui résulte en un coût en temps et en espace polylogarithmique comme décrit dans eq. (1.1).

Dans ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]

Résumé des contributions

Les auteurs de ref. [START_REF] Leverrier | Quantum expander codes[END_REF] ont étudié comment le décodeur small-set-flip corrige un code expanseur quantique dans le cas d'erreurs adverses. L'inconvénient de ce cadre est que la distance minimale du code est une limite fondamentale sur le poids de l'erreur que n'importe algorithme peut corriger. Lorsque l'erreur est générée avec un canal quantique (par exemple avec le canal dépolarisant), le poids de l'erreur est en général linéaire en la taille du bloc bien au delà de la meilleure distance minimale connue Θ √ N 4 log(N ) pour un code LDPC quantique [START_REF] Michael H Freedman | Z2-systolic freedom and quantum codes[END_REF]. Malgré cette borne supérieure, il est connu que certains codes LDPC quantiques ont un seuil et donc corrigent un bruit dépolarisant (voir [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF] pour des simulations numériques et [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF] pour des arguments théoriques). Dans cette thèse, nous montrons que le décodeur small-set-flip a un seuil pour n'importe quel modèle de bruit qui satisfait la propriété stochastique locale que nous avons défini dans la Section 1.3.

Kovalev et Pryadko ont déjà montré l'existence d'un seuil quand un bruit stochastique local est corrigé avec le décodeur de poids minimum [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF]. Comme expliqué ci-dessous, nous avons montré dans ref. [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF] que des techniques similaires peuvent être utilisées pour le décodeur small-set-flip. Soit V Q l'ensemble des qubits et soit G X le graphe de Tanner de C X . On dira qu'un ensemble de qubits est un petit groupe lorsque n'importe quelle erreur adverse dont le support est inclus dans ce groupe est corrigée par le décodeur. Par exemple pour les codes expanseurs quantiques, un "petit groupe" est un ensemble de qubits

K ⊆ V Q de taille O( √ N ).
Ici, nous utilisons le mot "groupe" comme un synonyme d'"ensemble" pour éviter la confusion entre "petit groupe" et "petit ensemble". De plus, pour une erreur initiale E ⊆ V Q , deux ensembles de qubits K 1 , K 2 sont dits indépendants lorsque le comportement du décodeur sur l'erreur K 1 ∩ E ne dépend pas de l'erreur K 2 ∩ E. Dans ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF], les qubits sont divisés en petits groupes indépendants de telle manière que le décodeur corrige les erreurs de chaque groupe et donc corrige l'erreur globale. Afin de décomposer les qubits en petits groupes indépendants, nous dirons que le décodeur est local lorsque deux ensembles de qubits sont indépendants dès que l'intersection de leur voisinage dans G X est vide (pour rappel, le voisinage d'un ensemble de qubits dans G X est un ensemble de bits de parité). Par exemple, le décodeur small-set-flip et le décodeur de poids minimum sont locaux. On définit le graphe d'adjacence du code comme étant le graphe dont l'ensemble des sommets est V Q et tel que deux qubits sont reliés si et seulement si ils partagent un bit de parité dans G X . En particulier, si deux ensembles K 1 , K 2 ⊆ V Q ne sont pas adjacents dans le graphe d'adjacence alors aucun bit de parité ne peut être adjacent à la fois à

K 1 et à K 2 dans G X . Dans ce cas, K 1 et K 2 sont donc indépendants.
Lorsque le décodeur est utilisé, on appelle erreur résiduelle l'erreur physique qu'il reste sur les qubits après avoir appliqué la correction donnée par le décodeur. On définit aussi le support d'exécution comme étant l'ensemble de tous les qubits qui appartiennent au support de l'erreur à un moment quelconque de l'algorithme. Par exemple avec le décodeur small-set-flip, le support d'exécution contient les qubits de l'erreur initiale ainsi que les qubits de tous les petits ensembles qui ont été flippés par l'algorithme. Ensuite, on décompose les qubits en groupes indépendants K 1 , K 2 , . . . en définissant K i comme étant les composantes connexes du support d'exécution dans le graphe d'adjacence. Finalement, on utilisera des arguments de percolation pour montrer que K i est un petit groupe avec grande probabilité [START_REF] Grimmett | What is percolation? In Percolation[END_REF][START_REF] Lyons | Random walks, capacity and percolation on trees[END_REF][START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF]. Afin de résumer les arguments ci-dessus, donnons une esquisse de la preuve de [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF]. On applique le décodeur small-set-flip sur une erreur générée par un bruit stochastique local. Soit K une composante connexe du support d'exécution U dans le graphe d'adjacence. La propriété de localité assure que la façon dont le décodeur agit sur K ne dépend pas du fait qu'il y ait des erreurs ou non en dehors de K. En particulier, l'erreur résiduelle sur les qubits de K est égale à l'erreur résiduelle que nous obtiendrions en utilisant le décodeur small-set-flip sans erreur initiale à l'extérieur de K. En utilisant des arguments venant de la théorie de la percolation, l'ensemble K satisfait K = O( √ N ) avec grande probabilité et donc les erreurs initiales qui appartiennent à K sont corrigées par le décodeur small-set-flip. Ceci est valable pour chaque composante connexe K de U donc l'erreur globale est corrigée.

La théorie de la percolation est un domaine à part entière de la théorie des probabilités [START_REF] Grimmett | What is percolation? In Percolation[END_REF]. Dans ce travail, nous sommes intéressés par le cas particulier de la percolation de sites avec un bruit stochastique local sur un graphe fini de degré borné. Soit V l'ensemble des sommets d'un graphe fini G dont le degré maximum est d G (les sommets sont appelés "sites" dans un contexte de percolation) et choisissons un sous-ensemble aléatoire de sommets E ⊆ V. Alors la question centrale en théorie de la percolation est de comprendre comment se comporte la taille des composantes connexes de E. Dans le cas des codes correcteurs, le graphe G est le graphe d'adjacence et l'ensemble E représente le support de l'erreur. Habituellement pour la percolation, la loi de probabilité sur E est un modèle iid (chaque site est dans E avec probabilité p indépendamment des autres sites) mais dans ce travail, on s'intéresse au cas plus général d'un modèle de bruit stochastique local. Par définition, un modèle de bruit a la propriété stochastique locale quand l'ensemble aléatoire E satisfait eq. (1.4) pour tout S ⊆ V. En suivant ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF], on peut étendre des résultats utiles de percolation à ce cas.

Une autre différence majeure avec les résultats standards de percolation est que nous réalisons un processus généralisé que nous appelons α-percolation. Au lieu de s'intéresser à la taille maximale des sous-ensembles connectés de E, le but de l'αpercolation est de regarder les α-sous-ensembles connectés. Un α-sous-ensemble est un ensemble X ⊆ V tel qu'au moins α|X| éléments de X appartiennent à E. Par exemple, un 1-sous-ensemble est simplement un sous-ensemble et la 1-percolation est la percolation dans le sens habituel. S'intéresser aux α-sous-ensembles est pertinent car le support d'exécution du décodeur small-set-flip est un α-sous-ensemble de l'erreur initiale pour un certain α ∈ (0, 1]. Le principal théorème (qui a déjà été prouvé dans ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF] pour le cas particulier α = 1/2) établit qu'avec grande probabilité, tout α-sousensemble connecté de E a pour taille O( |V|). Si on revient sur la discussion à propos des décodeurs locaux, l'ensemble K (défini comme étant n'importe quel sous-ensemble du support d'exécution) est un α-sous-ensemble de E et donc l'égalité K = O( √ N ) est vraie.

Pour un bruit iid et α = 1, il est connu qu'avec grande probabilité, si p < 1/(d G -1) alors les composantes connexes de E ont pour taille O log(|V|) . À l'inverse, si p > 1/(d G -1), il existe une unique composante dont la taille est linéaire appelée "composante géante" [START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF]. Dans ce travail, nous renforçons ce résultat pour n'importe quel bruit stochastique local et α ∈ (0, 1] arbitraire. Plus précisément, nous déterminons un réel non-nul p th = p th (α) tel que si p < p th , alors la probabilité qu'il existe un α-sous-ensemble de E de taille au dessus de t ∈ N est au plus Θ(|V|β αt ) où β = p/p th < 1. Une valeur seuil détermine en général une transition de phase entre le régime où E a de petites composantes connexes et le régime où E a une composante géante unique. Toutefois pour la correction d'erreurs, la préoccupation est d'être en dessous du seuil et donc p th est appelé un seuil même s'il s'agit seulement d'une borne inférieure sur le seuil de percolation. En particulier, la valeur p th que nous obtenons n'est pas optimale puisque p th (1) < 1/(d G -1). Il serait intéressant de trouver le véritable seuil pour α < 1 et d'étendre les autres résultats venant de la théorie de la percolation sur graphes finis [START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF].

Une des hypothèses délicates pour appliquer le schéma de tolérance aux fautes de Gottesman est de montrer que les codes expanseurs quantiques permettent de gérer des erreurs sur le syndrome. Formellement dans ce modèle d'erreurs, un ensemble de bits D est aléatoirement choisi suivant un modèle de bruit stochastique local et l'entrée de l'algorithme small-set-flip est le syndrome où les bits de D ont été flippés. Cette hypothèse est nécessaire dans le contexte du calcul quantique tolérant aux fautes, parce que les bits du syndrome sont produits par une mesure quantique effectuée à l'aide de composants physiques bruités. Toutefois à cause la propriété LDPC, il n'est pas possible que le décodeur corrige entièrement les qubits lorsque le syndrome est bruité. À la place, nous montrons que l'erreur résiduelle est équivalente à une erreur stochastique locale avec un paramètre sous contrôle.

De manière similaire au cas où le syndrome est parfait, la première étape de l'analyse est de considérer des erreurs adverses dont le poids est en dessous de la distance minimale. Dans ce cas, nous montrons que le poids de l'erreur résiduelle est bornée supérieurement par une fonction linéaire en |D|. La stratégie de preuve consiste à retourner au cas où la mesure du syndrome est non bruité et de montrer que l'algorithme small-set-flip peut flipper plusieurs petits ensembles à chaque tour. Comme nous en discuterons plus tard, cette propriété implique également que le décodeur peut être parallélisé dans le cas d'un syndrome bruité ou non bruité. Finalement, afin de traiter des erreurs stochastiques locales, nous appliquerons un processus d'α-percolation sur le graphe d'adjacence du syndrome pour réduire le problème au cas d'erreurs adverses. Le graphe d'adjacence du syndrome est le graphe de Tanner de C X avec des arrêtes additionnelles entre les qubits reliés dans le graphe d'adjacence [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF].

De plus, notre analyse montre que l'algorithme de small-set-flip a la propriété d'être single-shot. Un code quantique est dit single-shot quand un unique tour de mesures bruitées du syndrome est suffisant pour que le décodeur ait un seuil. Par comparaison, le code torique n'est pas single-shot, ce qui signifie que le syndrome doit être mesuré Θ(D) fois afin d'obtenir suffisamment d'information pour corriger l'erreur. Cette propriété est très avantageuse dans le contexte de la tolérance aux fautes où de nombreuses étapes de corrections d'erreurs sont nécessaires.

La correction d'erreurs single-shot a été introduite par Hector Bombin dans [START_REF] Bombín | Single-shot fault-tolerant quantum error correction[END_REF]. Plusieurs familles de codes ont cette propriété: les codes couleurs de jauge en dimension trois [START_REF] Bombín | Single-shot fault-tolerant quantum error correction[END_REF], le code torique en dimension quatre [START_REF] Kasper Duivenvoorden | Renormalization group decoder for a four-dimensional toric code[END_REF] et les codes hyperboliques de dimension quatre [START_REF] Matthew | Decoding in hyperbolic spaces: quantum LDPC codes with linear rate and efficient error correction[END_REF]. Une théorie de la correction d'erreurs single-shot a été proposée dans ref. [START_REF] Earl | A theory of single-shot error correction for adversarial noise[END_REF] où le principe est de corriger les erreurs de syndrome avant de corriger les erreurs sur les qubits. Par [START_REF] Earl | A theory of single-shot error correction for adversarial noise[END_REF] et les résultats de cette thèse, la propriété singleshot semble étroitement liée à la propriété de robustesse. Informellement, un code est robuste si en dessous de la distance minimale, le poids du syndrome peut être borné inférieurement par une fonction linéaire du poids de l'erreur. Dans ref. [START_REF] Fawzi | Constant overhead quantum fault-tolerance with quantum expander codes[END_REF], nous avons également montré que l'algorithme de small-set-flip peut être parallélisé pour fonctionner en profondeur constante. Lorsque le syndrome est bruité, si le nombre de tours est choisi suffisamment grand (mais constant) alors l'erreur résiduelle sera équivalente à une erreur stochastique locale avec petit paramètre. D'autre part, lorsque le syndrome est parfait, un nombre fixé de tours n'est pas suffisant pour corriger entièrement l'erreur. En revanche, lancer l'algorithme avec un nombre de tours logarithmique en la taille du syndrome corrigera l'erreur avec grande probabilité. Dans ref. [START_REF] Grospellier | Numerical study of hypergraph product codes[END_REF], nous avons fait des simulations pour étudier comment le décodeur small-set-flip se comporte en pratique. Pour simplifier, nous nous sommes concentrés sur l'algorithme séquentiel avec des mesures de syndromes parfaites. Les résultats numériques que nous avons obtenus sont prometteurs. Par exemple, la valeur du seuil que nous avons obtenu est largement au dessus de la borne inférieure assurée par les arguments théoriques. Le seuil est d'environ 4.5% pour une famille de codes produits d'hypergraphes avec rendement 1/61 et d'environ 2% pour un rendement 1/5.

Conclusion

Dans cette thèse, nous montrons que les codes expanseurs quantiques et le décodeur small-set-flip peuvent être utilisés dans la construction de ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] pour réaliser du calcul quantique tolérant aux fautes avec coût constant en espace. Le décodeur small-set-flip peut être parallélisé pour fonctionner en temps constant et, par conséquent, chaque site du circuit tolérant aux fautes obtenu nécessite d'utiliser un circuit classique avec profondeur constante. Par comparaison, il n'est pas connu si la complexité temporelle nécessaire pour décoder les autres familles de codes est constante. Ainsi, pour ces autres familles de codes, chaque étape du circuit tolérant aux fautes contient un circuit classique dont la profondeur augmente avec le nombres de qubits.

Comme travail futur, il serait intéressant d'essayer de réduire le coût en temps de la construction présentée dans ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. En particulier, le coût en temps est large si le circuit initial est parallèle parce qu'il doit être transformé en un circuit séquentiel pour que la construction fonctionne. Pour les codes expanseurs quantiques et plus généralement les codes produits d'hypergraphes, il est essentiel de trouver des décodeurs plus rapides avec de meilleures performances. Par exemple, en utilisant des décodeurs basés sur le small-set-flip ou le décodeur itératif (voir [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]). De plus, les simulations de ref. [START_REF] Grospellier | Numerical study of hypergraph product codes[END_REF] nécessitent des codes avec une large taille de bloc et il serait intéressant d'étudier comment les codes produits d'hypergraphes modifiés de ref. [START_REF] Alexey | Improved quantum hypergraph-product ldpc codes[END_REF][START_REF] Maurice | Codes correcteurs quantiques pouvant se décoder itérativement[END_REF] se comportent en pratique. Finalement, des simulations numériques pour le décodage small-set-flip parallèle et pour le cas d'un syndrome bruité seraient intéressantes également.

Introduction (English)

Quantum computers are physical objects taking advantage of the laws of quantum physics to perform some computational tasks faster than the best classical algorithms. For instance, Shor showed in ref. [START_REF] Peter | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] how this technology would provide an exponential speedup for the integer factorization problem compared to the existing classical algorithms. Many further examples can be found in [START_REF] Patrick | Quantum algorithm implementations for beginners[END_REF] such as Grover's algorithm leading to a quadratic speedup for unstructured search [START_REF] Lov | Quantum mechanics helps in searching for a needle in a haystack[END_REF] or the HHL algorithm for solving linear systems [START_REF] Harrow | Quantum algorithm for linear systems of equations[END_REF]. On a practical point of view, one of the short-term targets is to reach the quantum supremacy by building a quantum device which would perform a specific task faster than the current super-computers [START_REF] Boixo | Characterizing quantum supremacy in near-term devices[END_REF][START_REF] Harrow | Quantum computational supremacy[END_REF][START_REF] Bravyi | Quantum advantage with shallow circuits[END_REF]. In short, a quantum circuit uses quantum gates acting on quantum states which store quantum information whose basic unit is called a qubit (abbreviation for quantum bit).

Today, several architectures compete with each other such as quantum circuits based on superconductors or trapped ions, but despite many efforts and interesting progress, quantum computers are still in the experimental stage [START_REF] Kielpinski | Architecture for a large-scale ion-trap quantum computer[END_REF][START_REF] Cj Ballance | High-fidelity quantum logic gates using trapped-ion hyperfine qubits[END_REF][START_REF] Majer | Coupling superconducting qubits via a cavity bus[END_REF][START_REF] Michel | Implementing qubits with superconducting integrated circuits[END_REF][START_REF] You | Superconducting circuits and quantum information[END_REF][START_REF] Childress | Coherent dynamics of coupled electron and nuclear spin qubits in diamond[END_REF][START_REF] Mv Gurudev Dutt | Quantum register based on individual electronic and nuclear spin qubits in diamond[END_REF]. The main problem is that a quantum system is unavoidably subjected to noise and decoherence. Thus, quantum states are fragile and an active protection is required to store and process quantum information. Quantum supremacy could be achieved with noisy intermediate-scale quantum technology where the goal is to build devices with small enough noise to perform a non trivial computation out of reach for classical computers [START_REF] Preskill | Quantum computing in the nisq era and beyond[END_REF]. However, this strategy is not sustainable for time-consuming computations and contrarily to the case of classical hardwares, there is no hope to remove entirely the physical noise affecting quantum circuits. Hopefully, given a quantum circuit C, it is possible to design another circuit C called a fault-tolerant circuit, which executes the same computation than C and works even though its basic components are noisy.

To formalize the idea of noise, a quantum circuit is split into elementary steps called locations that represent the spots where an error could occur. For example, a gate location represents a point in the circuit where a gate is applied and a wait location refers to a qubit waiting while some gates are applied on other locations. Since the components we use for building the circuit are noisy, some of the locations are faulty meaning that the action of this location is not the expected one. The simplest noise model is the iid error model (independent and identically distributed) where the locations are faulty with some probability p independently. The fundamental result in fault-tolerant quantum computation is called the threshold theorem and has been proven by Aharonov and Ben-Or in ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]. They showed that if the locations are subjected to an iid error model with parameter p < p th (p th is a universal constant called the threshold), then for any quantum circuit C and for any target probability > 0, there exists a fault-tolerant circuit simulating C and failing with probability at most . Beyond the iid error model, this PhD thesis is interested in the more general local stochastic error model [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF][START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. In addition, we would like to point out that fault-tolerance is also possible with other error models [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF][START_REF] Aliferis | Quantum accuracy threshold for concatenated distance-3 codes[END_REF][START_REF] Barbara | Fault-tolerant quantum computation for local non-markovian noise[END_REF].

There are two natural ways to measure the efficiency of a fault-tolerant protocol, namely the time overhead and the space overhead. Let C be a quantum circuit and let C be the corresponding fault-tolerant circuit. We assume that C (resp. C ) has |C| locations (resp. |C | locations), uses m qubits (resp. m qubits) and requires t time steps to run (resp. t time steps to run). Then, the time overhead is defined to be the ratio t /t and the space overhead to be m /m. For instance, with the usual threshold theorem of ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF], the time and space overheads are polylogarithmic in |C|:

|C | |C| = polylog |C| , t t = polylog |C| , m m = polylog |C| . (2.1)
The main motivation of this PhD is ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] where constant space overhead is proven to be achievable using well chosen quantum error correcting codes. Starting with a k-qubit state, the idea of quantum error correction is to encode it within n > k qubits, adding some redundancy in such a way that an error on a small number of qubits is not harmful to recover the initial state. The procedure used to recover the initial state is called decoder and the time consumption of this classical algorithm is a bottleneck. Indeed, for each location of C, the fault-tolerant circuit provided by [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] requires to run the decoder. In this PhD thesis, we consider the so-called quantum expander codes showing that the associated small-set-flip decoder can be parallelized to run in constant time. Following ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF], we get a fault-tolerant protocol with constant space overhead. In addition, each time step of the resulting quantum circuit requires to run a constant depth classical circuit (this is a reasonable assumption if classical computation is fast enough).

The goal of this introduction is to describe and explain our result. Among other things, we will need to give some terminology from classical error correction and discuss about the concepts of hypergraph product codes and classical expander codes.

Classical error correction

The field of computer science which studies error correction is called Coding Theory and starts with Claude Shannon's work in 1948 [START_REF] Elwood | A mathematical theory of communication[END_REF]. Shannon showed that a transmission task can be decomposed into two steps: source coding and channel coding. Source coding is used for data compression [START_REF] Welsh | Codes and cryptography[END_REF][START_REF] Thomas | Elements of information theory[END_REF], however we do not discuss it in this PhD thesis. Instead, we focus on the channel coding step where error correcting codes are used. In [START_REF] Elwood | A mathematical theory of communication[END_REF], Shannon defined the notion of capacity which is the maximum rate at which information can be transmitted reliably through a given noisy channel. He also proved that the capacity of any channel is attained by random error correcting codes which, unfortunately, cannot be implemented efficiently. At the same time as these breakthrough results were published, Richard Hamming introduced the first practical class of error correcting codes now called the Hamming code [START_REF] Hamming | Error detecting and error correcting codes[END_REF]. Error correcting codes are often presented with the communication scenario where two protagonists, generally called Alice and Bob, would like to communicate. Classical information is represented as a sequence of bits (0 and 1) and hence a message of k bits is a binary vector s ∈ F k 2 = {0, 1} k (s stands for source message). Alice and Bob are far apart and the only communication channel they have access to is noisy, meaning that some of the bits that Alice sends to Bob are corrupted by the channel.

When Alice sends a message x ∈ F n 2 through the noisy channel, Bob gets as output another message y ∈ F n 2 accordingly to a given probability distribution depending on x. Two important channel models are the binary erasure channel and the binary symmetric channel. Both of them take as input a single bit. For the binary erasure channel with parameter p ∈ [0, 1], the bit that Alice sends is correctly transmitted with probability 1 -p and is erased with probability p. When Bob receives 0 or 1 he knows that the bit is correct and when the bit is erased, he receives the symbol '?'. For the binary symmetric channel, each transmitted bit is flipped (0 → 1 and 1 → 0) with probability p and is correct with probability 1 -p. With a single use of these channels, Alice can send one bit to Bob but she can also use it n ∈ N times in a row to send n bits. In that case, we assume that the n uses of the channel are independent in term of probabilities. In what follows we will be mainly interested in the case of the binary symmetric channel. Alice's goal is to send an arbitrary message s ∈ F k 2 to Bob in such a way that he can recover s with good probability. Obviously, since any message s ∈ F k 2 could be sent, there is no way for Bob to correct a single bit-flip under the assumption that Alice sends s directly through the channel. Instead, she can send x ∈ F n 2 an encoded version of s chosen in such a way that Bob can recover s even though the channel flipped a few bits of x. In particular, the bits of x must contain some redundancy and thus n > k must hold. An error correcting code

C ⊆ F n 2 satisfies C = F k 2 =
2 k and is defined as the set of possible bit-strings x, called the codewords, that Alice can send to Bob.

An error correcting code C is said to be an [n, k] linear code when the set of codewords is a k dimensional subspace of F n 2 . From now on, the codes we consider are linear. The minimal distance of a code is the minimum weight of a non-zero codeword. When the minimal distance d is known, the code is said to be an [n, k, d] linear code. The bits of s are called the logical bits, the bits of x are called the physical bits and the number of physical bits n is called the block length. • Alice encodes the message s into a codeword x and sends x to Bob through the noisy channel.

• Bob gets y as output of the channel and tries to infer the codeword x that Alice sent, its guess is denoted by x.

• Bob decodes x to a message ŝ by applying the inverse of the function Alice applied during the encoding step.

The above protocol is a success when s = ŝ and a failure when s = ŝ. In this PhD thesis, we are interested in linear codes, for which the first and the third step can be done easily using linear algebra. Thus, we will mainly focus on the second step, called the error correction step or the decoding step, where Bob infers x from y using an algorithm called decoding algorithm or decoder. One of the main goals in coding theory is to find families of error correcting codes with large ratio k/n and which admit an efficient time decoder with low failure probability. One breakthrough result of ref. [START_REF] Elwood | A mathematical theory of communication[END_REF] is the possibility to use a noisy channel to transmit information reliably at constant rate. Instead of using a single error correcting code, consider a family of codes C 1 , C 2 , . . . where C i encodes k i logical bits with n i physical bits. When the ratio k i /n i converges and n i goes to infinity, the limit r ∈ [0, 1] is called the asymptotic rate of the family. In addition, the threshold of C i is the maximum real number p ∈ [0, 1] such that the probability of failure vanishes as i goes to infinity when using a binary symmetric channel with parameter p. We say that C i allows for reliable transmission over the binary symmetric channel when the parameter p is below the threshold of the code family. A binary symmetric channel with fixed parameter p ∈ (0, 1) cannot transmit information at rate arbitrarily close to 1. Indeed there is a limit called the capacity of the channel which is an upper bound on the asymptotic rate of any family of code allowing for reliable transmission. The notion of capacity was introduced by Shannon in [START_REF] Elwood | A mathematical theory of communication[END_REF] and is equal to C BEC (p) := 1 -p for the binary erasure channel and to C BSC (p) := 1 -h 2 (p) for the binary symmetric channel where h 2 (p) := -p log 2 (p) -(1 -p) log 2 (1 -p) is the binary entropy function.

In his thesis of 1962 [START_REF] Gallager | Low-density parity-check codes[END_REF], Robert Gallager introduced the class of LDPC codes (Low Density Parity Check codes) and suggested to decode them with an algorithm called belief propagation decoder (also called iterative decoder or message passing algorithm or probabilistic decoder). However at this point, computers were not powerful enough to implement the belief propagation decoder and thus LDPC codes were not of practical interest. In the late 90's, there has been a renewed interest in LDPC codes with the papers [START_REF] Luby | Analysis of low density codes and improved designs using irregular graphs[END_REF][START_REF] Luby | Practical loss-resilient codes[END_REF][START_REF] Michael G Luby | Improved low-density parity-check codes using irregular graphs[END_REF][START_REF] Michael G Luby | Efficient erasure correcting codes[END_REF]. Nowadays they are intensively used in the communication networks [START_REF] Richardson | Design of low-density parity check codes for 5g new radio[END_REF][START_REF] Shirvanimoghaddam | Short block-length codes for ultra-reliable low latency communications[END_REF]. In order to define LDPC codes, we need to explain the concepts of parity check matrices and Tanner graphs. Let C be a linear code and H be a binary matrix such that C = ker(H). Then H is said to be a parity check matrix for C. A Tanner graph G for C is a bipartite graph built from H in the following way: the left vertices of G represent the columns of H, the right vertices represent the rows of H and two vertices are linked if and only if the corresponding entry in H is equal to 1 [START_REF] Tanner | A recursive approach to low complexity codes[END_REF]. By definition, a family of codes is LDPC if and only if the degrees in the Tanner graphs are upper bounded by a uniform constant.

In the early 90's, the turbo codes of Berrou, Glavieux and Thitimajshima [START_REF] Berrou | Near shannon limit error-correcting coding and decoding: Turbo-codes. 1[END_REF] made the scientific community aware that some error correcting codes with high success probability and whose rate approaches channel capacity can be implemented in practice. The turbo codes use as building blocks the family of convolutional codes [START_REF] Johannesson | Fundamentals of convolutional coding[END_REF] introduced by Elias in [START_REF] Elias | Coding for noisy channels[END_REF]. A convolutional code encodes a bit-stream into another bit-stream. In this PhD thesis we are interested in block codes such as LDPC codes which, by opposition to a convolutional code, encode a block of bits into a larger block of bits (a block is a bit-string of fixed length).

For simplicity, the classical codes we will use are regular LDPC codes as defined by Gallager in his thesis [START_REF] Gallager | Low-density parity-check codes[END_REF]. By definition, a regular code is such that the left vertices of the Tanner graph have degree d V and the right vertices have degree d C where d V , d C ∈ N are fixed integers. Note however, that the performance of regular LDPC codes is not as good as the performance of other families of LDPC codes. For example, ref. [START_REF] Oswald | Capacity-achieving sequences for the erasure channel[END_REF] shows that no family of regular codes achieves the capacity of the binary erasure channel. It has also been demonstrated that irregular LDPC codes lead to better thresholds [START_REF] Michael G Luby | Efficient erasure correcting codes[END_REF][START_REF] Michael G Luby | Improved low-density parity-check codes using irregular graphs[END_REF][START_REF] Luby | Practical loss-resilient codes[END_REF][START_REF] Luby | Analysis of low density codes and improved designs using irregular graphs[END_REF] and better finite-length performance [START_REF] Thomas | Efficient encoding of low-density parity-check codes[END_REF][START_REF] Wang | Upper bounding the performance of arbitrary finite ldpc codes on binary erasure channels[END_REF][START_REF] Yedidia | Projection algebra analysis of error-correcting codes[END_REF][START_REF] Zhang | Finite-length analysis of ldpc codes with large left degrees[END_REF]. More generally, many families of codes have been introduced with the objective to increase the success probability and to speed up the encoding and decoding steps. See for example the concatenated codes [START_REF] Forney | Concatenated codes[END_REF], the algebraic Reed-Solomon codes [START_REF] Sudan | Decoding of reed solomon codes beyond the error-correction bound[END_REF][START_REF] Koetter | Algebraic soft-decision decoding of reedsolomon codes[END_REF][START_REF] Irving | Polynomial codes over certain finite fields[END_REF] and more recently the spatially-coupled LDPC codes [START_REF] Jimenez | Time-varying periodic convolutional codes with low-density parity-check matrix[END_REF], the polar codes [START_REF] Arikan | Channel polarization: A method for constructing capacityachieving codes[END_REF] and the irregular LDPC codes based on protographs [START_REF] Thorpe | Low-density parity-check (ldpc) codes constructed from protographs[END_REF]. In addition, there exist many algorithmic techniques for optimizing LDPC codes [START_REF] Chung | On the construction of some capacity-approaching coding schemes[END_REF][START_REF] Roumy | Design methods for irregular repeat accumulate codes[END_REF][START_REF] Hu | Regular and irregular progressive edge-growth tanner graphs[END_REF][START_REF] Tian | Selective avoidance of cycles in irregular ldpc code construction[END_REF].

For more details about classical error correction, see [START_REF] Welsh | Codes and cryptography[END_REF][START_REF] Richardson | Modern coding theory[END_REF][START_REF] Johannesson | Fundamentals of convolutional coding[END_REF].

Quantum information

This section introduces the fundamental concepts of quantum information theory we will need to explain our results. See [START_REF] Michael | Quantum computation and quantum information[END_REF] for more details about quantum information and quantum computation.

A pure state on n qubits |ψ ∈ C 2 n ("ket psi") is mathematically defined by a complex vector normalized for the Euclidean norm with 2 n entries. It is convenient to see |ψ as an element of C 2 ⊗n where all along this manuscript, ⊗ is the tensor product (or Kronecker product). The row vector ψ| := |ψ † ("bra psi") is defined to be the transpose conjugate of |ψ . For i ∈ 0; 2 n -1 , the state |i is the column vector whose only non-zero entry is a 1 at i th position.

Dynamics of pure quantum states is split into two kinds of operations: unitary evolution and measurements. A unitary evolution has the form U : |ψ → U |ψ where U is any complex unitary matrix of dimension 2 n × 2 n . Among the unitary matrices, the Pauli group is of particular interest. It is defined by: P n := αP : α ∈ 1, -1, i, -i and P ∈ 1, X, Y, Z ⊗n where X is called the bit-flip and Z is called the phase-flip:

X := 0 1 1 0 , Y := iXZ = 0 -i i 0 , Z := 1 0 0 -1 .
For

|P | := # i ∈ 1; n : P i = 1 .
A matrix Π is said to be an orthogonal projector when Π 2 = Π and Π = Π † where Π † is the Hermitian adjoint of Π (the Hermitian adjoint is the transpose conjugate matrix).

In general, the measurement of a pure state |ψ ∈ C 2 n outputs a classical bit b ∈ F 2 and modifies |ψ (we say that |ψ collapses to another quantum state). For error correction, we are interested in projective measurements defined with two orthogonal projectors Π 0 , Π 1 . These projectors must be of size 2 n × 2 n and must satisfy Π 0 + Π 1 = 1 where 1 is the identity matrix.

• With probability ψ| Π 0 |ψ : the measurement output is b = 0 and the state collapses to Π 0 |ψ ψ| Π 0 |ψ .

• With probability ψ| Π 1 |ψ : the measurement output is b = 1 and the state collapses to

Π 1 |ψ ψ| Π 1 |ψ .
In particular, the Pauli measurement associated to a Pauli operator P ∈ P n is the projective measurement defined with Π 0 := (1 + P )/2 (the orthogonal projector onto the +1 eigenspace of P ) and Π 1 := (1 -P )/2 (the orthogonal projector onto the -1 eigenspace of P ).

In general, a quantum system S is not isolated in the sense that it interacts with other systems called environment. In that case, the state of S is not necessarily a pure state but can always be seen as a probabilistic mixture of pure states. A density matrix is a convenient way to represent such a mixture as a 2 n × 2 n positive semi-definite operator with complex coefficients and trace 1. For example, the density matrix associated to a pure state |ψ is |ψ ψ| where ψ| = |ψ † as previously. More generally, let |ψ 1 , . . . , |ψ m be pure states and let p 1 , . . . , p m ∈ [0, 1] be probabilities such that p 1 + . . . + p m = 1. Then, the density matrix of a system where each state |ψ i has been prepared with probability p i is:

ρ = m i=1 p i |ψ i ψ i | . (2.2)
During the interaction of a quantum system S with an environment E, the number of qubits in S can change. Indeed, some of the qubits of S can be discarded and some qubits of E can be added to S. Formally, any valid evolution of an n-qubit system to an n -qubit system is represented by a CPTP map E (completely positive trace preserving map) sometimes called a quantum channel or a quantum operation. A CPTP map is defined by a set of 2 n × 2 n complex matrices E k called Kraus operators and satisfying

k E † k E k = 1. E is then equal to: E : ρ → K k=1 E k ρE † k .
For instance, a unitary evolution U is represented by the single Kraus operator E 1 = U where n = n . As stated above, the measurement of a Pauli operator P ∈ P n on a pure state |ψ is the projective measurement associated to Π 0 := (1 + P )/2 and Π 1 := (1 -P )/2. Let M be the CPTP map representing this measurement and let:

p 0 := ψ| Π 0 |ψ , |ψ 0 := Π 0 |ψ ψ| Π 0 |ψ , p 1 := ψ| Π 1 |ψ , |ψ 1 := Π 1 |ψ ψ| Π 1 |ψ .
Then M is equivalent to prepare the state |ψ 0 with probability p 0 and the state |ψ 1 with probability p 1 . Using eq. (2.2), we have:

M : |ψ ψ| → |0 0| ⊗ Π 0 |ψ ψ| Π 0 + |1 1| ⊗ Π 1 |ψ ψ| Π 1 .
Note that for simplicity, the classical outcome of the measurement b ∈ {0, 1} is stored as a qubit. More generally, for any density matrix ρ we have:

M : ρ → |0 0| ⊗ Π 0 ρΠ 0 + |1 1| ⊗ Π 1 ρΠ 1 . (2.
3)

The Kraus operators of

M are E 0 = |0 ⊗ Π 0 and E 1 = |1 ⊗ Π 1 with n = n + 1.

Quantum error correction

In Section 2.1, we used the communication scenario presented in Figure 2.4 to introduce classical error correcting codes. Similarly, a quantum error correcting code can be used in a protocol where Alice wishes to send a quantum state |ϕ with K qubits through a noisy quantum channel to Bob. The basic idea is the same as in the classical setting: she starts by encoding |ϕ redundantly in a state |ψ with N qubits, then she sends |ψ through the noisy channel and finally Bob applies a quantum operation to correct the received mixed state ρ. The communication is a success when the state | φ that Bob gets at the end is equal to |ϕ . In this protocol, each state |ϕ is mapped to its encoded version |ψ called a code state. The set of code states denoted by Q is called the code space or a quantum error correcting code. By definition, the encoding is a linear map from C 2 ⊗K to C 2 ⊗N and thus the set Q is a 2 K -dimensional linear subspace of C 2 ⊗N . The integer K is called the number of logical qubits and the integer N is called the number of physical qubits.

Alice Bob

|ϕ ∈ C 2 ⊗K Encoding Step Quantum Noisy Channel Decoding Algorithm | φ ∈ C 2 ⊗K
| φ : a guess for |ϕ

Inverse of Encoding

Step In this work, we are interested in quantum channels satisfying the local stochastic property with parameter p ∈ [0, 1]. A noise model is local stochastic when the probability for a given set of qubits S to be in the support of the error decays exponentially in |S|. Formally, let V Q be the set of qubits and let E be a quantum channel. Then:

|ψ ∈ Q ⊆ C 2 ⊗N N > K Mixed state ρ on N qubits | ψ ∈ Q | ψ : a guess for |ψ
• E has the stochastic property if E can be described by the following two steps process:

-In the first step, a random set E ⊆ V Q called the support of the error is randomly chosen. -In the second step, a quantum channel E E is applied on the qubits. Here, for each F ⊆ V Q , E F is a CPTP map acting on the qubits of F .

• E is local stochastic with parameter p ∈ [0, 1] if it has the stochastic property and the probability distribution of E satisfies for any S ⊆ V Q :

P S ⊆ E ≤ p |S| . (2.4)
In other words, a local stochastic noise E is such that:

E : ρ → F ⊆V Q P E = F E F (ρ),
where the support E ⊆ V Q is randomly chosen with eq. (2.4) holding for any S ⊆ V Q . For instance, the channel applying independent and identically distributed bit-flip and phase-flip errors has the local stochastic property. Another example is the depolarizing channel which applies the channel D defined below on each qubit independently:

D : ρ → (1 -p)ρ + p 3 XρX + Y ρY + ZρZ .
The depolarizing channel for n qubits is equal to D ⊗n and is local stochastic with parameter p/3. When we will talk about the success probability (or the probability for the error to be corrected) for a local stochastic error model, we refer to the probability on E for the communication to be a success:

P Success = F ⊆V Q P E = F P | φ = |ϕ E = F .
Note that when the decoding algorithm is deterministic, we have

P | φ = |ϕ E = F ∈ {0, 1}.
In the classical case, we focused on the bit-flip error model which is quite realistic. However, in the quantum setting the set of possible errors is infinite: any unitary or even any CPTP map could potentially happen on the quantum state we try to protect. Surprisingly, it is sufficient to correct the finite set of Pauli errors, to be able to correct general errors (see for example [START_REF] Charles | Mixed-state entanglement and quantum error correction[END_REF] or [START_REF] Michael | Quantum computation and quantum information[END_REF]). For instance, if a given error correcting procedure is able to correct any Pauli error acting on the qubits of F ⊆ V Q , then the same procedure corrects an arbitrary CPTP map acting on F . As a consequence, for a local stochastic error model, we can assume without loss of generality that the CPTP maps E F are Pauli channels (i.e. apply Pauli errors on the qubits of F ).

In the '90s, the question to know whether quantum error correction was possible was discussed until Shor [START_REF] Peter | Scheme for reducing decoherence in quantum computer memory[END_REF] and Steane [START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF] proved it is indeed feasible. Just after these seminal works, the theory of quantum error correction was developed, for example in [START_REF] Knill | Theory of quantum error-correcting codes[END_REF][START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Steane | Multiple-particle interference and quantum error correction[END_REF][START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF]. In particular in [START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF], Gottesman introduced the mathematical tools used to define and to study a wide variety of quantum codes called stabilizer codes. A stabilizer code Q on N physical qubits is defined from a finite set of commuting Pauli operators g 1 , . . . , g M ∈ P N . These operators are called stabilizer generators and Q is defined in the following way:

Q := |ψ ∈ C 2 ⊗N : g 1 |ψ = . . . = g M |ψ = |ψ .
The code Q is said to be an [[N ; K]] stabilizer code where K is the number of logical qubits.

In this thesis, we focus on a particular class of stabilizer codes called CSS LDPC codes. The terminology "CSS" stands for Calderbank, Shor and Steane who introduced the CSS construction in 1996 [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF]. A CSS code is constructed from two classical codes C X and C Z with C ⊥ Z ⊆ C X . The code C X is used to correct bit-flip errors and C Z is used to correct phase-flip errors. The first step of the error correction procedure is to measure the stabilizer generators. The output of the measurement is a bit-string called syndrome. From a practical perspective, if we want to be able to measure the stabilizer generators, it is important that each one involves a small number of qubits and each qubit is involved in a small number of operators. These properties hold when the two classical codes used to construct the CSS code are LDPC and in that case the code is said to be a CSS LDPC code.

The minimal distance of a stabilizer code is the minimal weight of a Pauli error which maps a code state to another orthogonal code state. This quantity is a good indication of the performance of the code and it not known whether CSS LDPC codes with minimal distance D = Θ(N ) exist. Without the LDPC constraint, this question was resolved in the affirmative when the CSS codes were introduced [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF][START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF]. For LDPC codes, the best known minimal distance is D = Θ(

√ N 4 log(N ))
for a family of codes with K = 1 logical qubit whose construction is based on an 4-dimensional manifold [START_REF] Michael H Freedman | Z2-systolic freedom and quantum codes[END_REF]. With the additional constraint of constant rate K = Θ(N ), the best known minimal distance is D = Θ( √ N ) and is achieved by the hypergraph product codes of Tillich and Zémor [START_REF] Tillich | Quantum LDPC codes with positive rate and minimum distance proportional to the square root of the blocklength[END_REF]. When the minimal distance D of an [[N ; K]] stabilizer code is known, the code is said to be an [[N ; K; D]] stabilizer code.

A decoder or decoding algorithm for a stabilizer code is a classical algorithm taking the syndrome as input and outputting a Pauli error. The algorithm succeeds when applying this Pauli on the quantum state received by Bob turns it back to the original code state Alice sent through the noisy channel. For CSS codes, the goal of the decoder is to correct the two initial classical codes taking into account the degeneracy of the CSS code. The terminology "degeneracy" refers to the property that there exist equivalent errors, i.e. different Pauli operators which act in the same way on the code states. For instance, a stabilizer generator of a code maps any code state to itself. Thus, it is equivalent to the identity and to the other stabilizer generators. By contrast in the classical setting, two errors act in the same way on the codewords if and only if they are equal. Because of the degeneracy, the decoder for a quantum code may have corrected the error even though it did not find the error that physically happened on the initial state. This is crucial for CSS LDPC codes since the classical codes used in the construction must contain constant weight codewords. Thus, CSS LDPC codes are highly degenerate. An example of a decoder with good performance is the minimum weight decoder. It returns a minimum weight Pauli error whose syndrome is equal to the input syndrome. A threshold for a family of quantum codes is a non-zero probability p th ∈ (0, 1] such that the error generated by a local stochastic channel with parameter p < p th is corrected with probability going to 1 in the limit of large block length.

Among CSS LDPC codes, the toric code introduced by Kitaev is the most famous one and has been widely studied [START_REF] Yu | Quantum error correction with imperfect gates[END_REF][START_REF] Yu | Fault-tolerant quantum computation by anyons[END_REF][START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Poulin | On the iterative decoding of sparse quantum codes[END_REF][START_REF] Delfosse | Almost-linear time decoding algorithm for topological codes[END_REF][START_REF] Liu | Neural belief-propagation decoders for quantum error-correcting codes[END_REF]. The toric code of parameter

L ∈ N * is defined using a tessellation of a 2-dimensional torus leading to a [[2L 2 , 2, L]]
stabilizer CSS LDPC code. The toric code has many advantages. For example, its minimal distance D = Θ( √ N ) is large and its stabilizer generators involve only nearest neighbor interactions. This is convenient for implementation since a 2-dimensional torus can be embedded in our 3 dimensional Euclidean space. Thus, a real device implementing the toric code would require only interactions between qubits close to each other in space. In addition, the performance of the toric code is really good even for small block size and the minimum weight decoder can be implemented in polynomial time with the minimum weight perfect matching algorithm of Edmonds [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Edmonds | Maximum matching and a polyhedron with 0, 1-vertices[END_REF].

Beyond the toric code, any tessellation of a manifold defines a CSS LDPC code called a topological code. This principle allows to use powerful arguments from topology to study such codes and to design decoders. See for example the surface code [START_REF] Sergey | Quantum codes on a lattice with boundary[END_REF], the 2-dimensional hyperbolic codes [START_REF] Nikolas | Constructions and noise threshold of hyperbolic surface codes[END_REF], the semi-hyperbolic codes [START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF] and the 4dimensional hyperbolic codes [START_REF] Guth | Quantum error correcting codes and 4dimensional arithmetic hyperbolic manifolds[END_REF][START_REF] Londe | Golden codes: quantum LDPC codes built from regular tessellations of hyperbolic 4-manifolds[END_REF][START_REF] Matthew | Decoding in hyperbolic spaces: quantum LDPC codes with linear rate and efficient error correction[END_REF]. There exist two results which put strong constraints on the trade-off between the parameters N , K and D of a 2-dimensional topological code [START_REF] Bravyi | Tradeoffs for reliable quantum information storage in 2d systems[END_REF][START_REF] Delfosse | Tradeoffs for reliable quantum information storage in surface codes and color codes[END_REF]. The first one states that KD 2 = O(N ) and holds for any topological code constructed from a 2-dimensional Euclidean manifold [START_REF] Bravyi | Tradeoffs for reliable quantum information storage in 2d systems[END_REF]. The second bound is KD 2 = O(N log 2 (N )) and holds even if the underlying space is not Euclidean [START_REF] Delfosse | Tradeoffs for reliable quantum information storage in surface codes and color codes[END_REF]. Thereby, the advantage of using topological codes constructed from 4-dimensional spaces is to go beyond these two no-go results. In particular, the parameters K = Θ(N ) and D = Ω(N 0.2 ) are achieved for 4-dimensional hyperbolic codes [START_REF] Guth | Quantum error correcting codes and 4dimensional arithmetic hyperbolic manifolds[END_REF][START_REF] Londe | Golden codes: quantum LDPC codes built from regular tessellations of hyperbolic 4-manifolds[END_REF]. Note however that there is no way to embed an hyperbolic code or a 4-dimensional code into the real world keeping nearest neighbors interactions.

Another generalization of the toric code is the hypergraph product code introduced by Tillich and Zémor in [START_REF] Tillich | Quantum LDPC codes with positive rate and minimum distance proportional to the square root of the blocklength[END_REF] and described in Section 4.2. This combinatorial construction has the advantage to build quantum codes from good classical ones. Thus, some arguments from classical coding theory can be imported to study them. If the initial classical codes are LDPC, have constant rate and have linear minimal distances then the resulting hypergraph product code is also LDPC, has constant rate and its minimal distance grows like the square root of the block length. This asymptotic scaling of the parameters is one of the best among the known constructions of quantum codes. The main object of interest in this PhD thesis described in Section 2.5 is a particular family of hypergraph product codes called the quantum expander codes [START_REF] Leverrier | Quantum expander codes[END_REF]. Compared to general hypergraph product codes, the quantum expander codes have the advantage to come up with an efficient decoder called the small-set-flip decoder.

In Figure 2.6, we provide examples of CSS LDPC codes. The columns "Dimension" and "Minimal distance" contain the parameters K and D of the codes. By definition of the minimal distance, any error of weight up to (D -1)/2 is corrected by the minimum weight decoder which runs in exponential time in general. However, the known polynomial time decoder do not necessarily correct all the errors of weight up to a fraction of the minimal distance. Hence, we report in the column "Maximum weight of adversarial errors corrected with an efficient decoder" the best known value of T such that any error of weight up to T is corrected by a polynomial time decoding algorithm.

Dimension

Minimal distance

Maximum weight of adversarial errors corrected with an efficient decoder

Toric code

[62] 2 Θ( √ N ) Θ( √ N ) From a 4D manifold [41] 1 Θ( √ N 4 log(N )) No efficient decoder Hyperbolic 2D [41] Θ(N ) Θ(log N ) Θ(log N ) Hyperbolic 4D [51, 55, 69] Θ(N ) Ω(N 0.2 ), O(N 0.3 ) Θ(log N ) Hypergraph product codes [108] Θ(N ) Θ( √ N ) No efficient decoder Quantum expander codes [67] Θ(N ) Θ( √ N ) Θ( √ N )

Hypergraph product codes

It is still an open question to know whether LDPC CSS codes with constant rate and linear minimal distance exist. A naive approach would be to build a CSS code from two LDPC codes C X and C Z with good minimal distances. Unluckily, if C Z is LDPC then the vector space C ⊥ Z contains constant weight elements and the required inclusion C ⊥ Z ⊆ C X implies that the minimal distance of C X is constant. Accordingly, good LDPC classical codes cannot be used directly to build a good LDPC CSS code.

The hypergraph product construction builds a CSS code Q starting from two classical codes C 1 and C 2 without any extra condition such as C ⊥ 2 ⊆ C 1 . More precisely, two classical codes C X and C Z are constructed from C 1 and C 2 and then the hypergraph product code is the CSS code associated to C X and C Z . It is particularly interesting for the LDPC case because if C 1 and C 2 are constant rate LDPC codes then so is Q. In addition, when C 1 and C 2 have linear minimal distances, the hypergraph product has minimal distance equal to D = Θ( √ N ) where N is the number of physical qubits. Thanks to these favorable parameters, it is expected that hypergraph product codes perform well for quantum error correction and fault-tolerant quantum computation.

A natural idea for decoding hypergraph product codes is to bring the decoders of classical codes. Unfortunately, this strategy does not work in general. For example, the belief propagation decoder is intensively used in the classical setting but does not perform well for hypergraph product codes [START_REF] Poulin | On the iterative decoding of sparse quantum codes[END_REF][START_REF] Maurice | Codes correcteurs quantiques pouvant se décoder itérativement[END_REF]. Hopefully, it can be improved using neural networks [START_REF] Liu | Neural belief-propagation decoders for quantum error-correcting codes[END_REF] or an ordered statistics decoding post-processing [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]. Ref. [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF] shows that hypergraph product codes have really good performance in practice: for a depolarizing channel with physical error rate below 10%, a well chosen hypergraph product code with 28 logical qubits performs better than the minimum weight decoding of a surface code with 1 logical qubit (see Figure 3 of [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]).

Quantum expander codes

In 1996, Sipser and Spielman introduced the concept of expander graphs and defined a classical expander code as being a code whose Tanner graph is an expander [START_REF] Sipser | Expander codes[END_REF].

The expansion property is really convenient to show some properties of the code. For example, the minimal distance of a classical expander code is linear in the block length. For this PhD thesis, we are especially interested in the manner in which sufficient expansion implies that any error of weight up to a fraction of the minimal distance is corrected by a decoder called the bit-flip algorithm. The bit-flip algorithm is one of the simplest decoders it is possible to design and this is why it is convenient for a theoretical analysis. Nevertheless, numerical simulations show that the belief propagation decoder is the best known decoder for classical LDPC codes and widely outperforms the bitflip algorithm. In addition, the belief propagation decoder can also be analyzed with expansion based arguments [START_REF] Burshtein | Expander graph arguments for message-passing algorithms[END_REF].

Finding the expansion parameters of a graph is a co-NP-hard problem [START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF] and constructing expander graphs is not straightforward. In this work, we rely on a probabilistic construction called the configuration model allowing to build with high probability a code with any desired expansion parameter and any desired rate [START_REF] Sipser | Expander codes[END_REF][START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF][START_REF] Miller | The rate of regular ldpc codes[END_REF]. The first deterministic construction of expander graphs is based on algebraic arguments by Margulis [START_REF] Grigorii | Explicit constructions of graphs without short cycles and low density codes[END_REF] and was latter improved by Barg and Zémor [5,[START_REF] Barg | Multilevel expander codes[END_REF][START_REF] Barg | Distance properties of expander codes[END_REF]. It is also possible to construct good expander graphs with the zig-zag product method [START_REF] Capalbo | Randomness conductors and constant-degree lossless expanders[END_REF]. See [START_REF] Hoory | Expander graphs and their applications[END_REF] for a survey on expander graphs.

By definition, a quantum expander code is a [[Θ(n 2 ), Θ(n 2 ), Θ(n)]] stabilizer code defined as the hypergraph product of a classical [n, Θ(n), Θ(n)] expander code with itself [START_REF] Leverrier | Quantum expander codes[END_REF]. Ref. [START_REF] Leverrier | Quantum expander codes[END_REF] also introduced the small-set-flip decoder and proved that any error of weight up to a fraction of the minimal distance is corrected. The main motivation for studying these codes is the result of Daniel Gottesman showing that fault-tolerant quantum computation with constant space overhead is possible [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. As discussed at the beginning of this chapter, this result is subjected to the conjecture that quantum codes with suitable properties exist. Thanks to [START_REF] Leverrier | Quantum expander codes[END_REF], it is already known that quantum expander codes satisfy many of these properties: they are LDPC, they have constant rate and a good minimal distance. The main result of my PhD is to show that quantum expander codes satisfy also the other desired properties and thus can be used to implement Gottesman's fault-tolerant scheme.

Remember from the hypergraph product construction that a quantum expander code is a CSS code associated to two classical codes C X and C Z constructed from the initial classical expander code. It turns out that up to a permutation on the bits, the code C X is equal to C Z . Thus, as it is usual for CSS codes, it is sufficient to describe and analyze the decoder for bit-flip errors only. Under this hypothesis, the error support determines the error on the qubits and thus we will often assume that an "error" and an "error support" are the same objects. The small-set-flip decoder is a hard decoding algorithm. This means that its execution is divided into several rounds and at each round, the qubits belonging to some set F are flipped. The set F is called a small-set and we denote by F the ensemble of all the possible small-sets that can be flipped. The implementation of the small-set-flip algorithm is quite simple: at each round, a small-set F ∈ F is selected in such a way that the syndrome weight decreases sufficiently when the qubits of F are flipped (the syndrome weight is the number of syndrome bits equal to 1).

Fault-tolerant quantum computation

The goal of fault-tolerant quantum computation is to design circuits which are robust against noise [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF]. A circuit C is described by wires (containing quantum states) and elementary operations such as state preparations, measurements or unitary gates. We often assume that C has a classical output r ∈ F m 2 . During the last step, all the quantum wires are measured and r is equal to the measurement output on which is applied a classical post-processing. In this PhD thesis, a state preparation creates a |0 state, a measurement corresponds to the measurement of a Z-Pauli matrix and the unitary gates belong to the finite gate set G := X, Z, H, S, T, C X where:

X = 0 1 1 0 , Z = 1 0 0 -1 , H = 1 √ 2 1 1 1 -1 , S = e -iπ/4 0 0 e iπ/4 , T = e -iπ/8 0 0 e iπ/8 , C X =     1 0 0 0 0 1 0 0 0 0 0 1 0 0 1 0     . Note that G is not minimal since Z = S 2 = T 4 and X = H • Z • H.
However, it is universal in the sense that any unitary can be approximated with gates belonging to G.

Formally, for all η > 0 and for all unitary U , there exists a unitary V constructed from the gates of G such that:

(U -V ) |ψ ≤ η for any pure state |ψ .

In addition, the Solovay-Kitaev theorem [START_REF] Yu | Quantum error correction with imperfect gates[END_REF] asserts that any circuit made of m controlled-not gates and arbitrary single qubit gates can be approximated with O m log 2 (m/η) gates of G.

A location is a point of the circuit where an error can occur. For example, each state preparation, each measurement and each unitary gate is a location. The noise model we will use is the local stochastic error model with parameter p ∈ [0, 1]. Let L be the set of locations of an arbitrary circuit C, then the error is represented by a random variable F ⊆ L called the set of faulty locations. F satisfies for all R ⊆ L:

P R ⊆ F ≤ p |R| .
Once F has been chosen, a location of L \ F behaves normally but a faulty location l ∈ F is replaced by an arbitrary CPTP map with the same input and output spaces than l. Let r be the output that C would yield in the noiseless case F = ∅. Then, the aim of fault-tolerant quantum computation is, given a parameter > 0, to design a circuit C whose output is r with probability at least 1when the locations are subjected to a local stochastic noise.

In ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF], the fault-tolerant circuit C is built using code concatenation. The idea is to define a function Φ mapping a circuit C to another circuit Φ(C) which is more robust against noise. Then, the circuit C is defined by C = Φ k (C) for a well chosen k ∈ N. In Φ(C), each wire of C is encoded into N wires using an [[N, 1]] stabilizer code and error correction is regularly performed on the wires of Φ(C). In this fault-tolerant protocol, the qubits are encoded one by one leading to polylogarithmic space and time overheads as stated in eq. (2.1).

In ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] where fault-tolerance with constant space overhead is achieved, the wires of C are divided into blocks of K ∈ N wires and each block is encoded using an [[N, K]] stabilizer code Q. Contrarily to the case of code concatenation, the block length of Q depends on the number of wires in C and Q is chosen among a family of constant rate LDPC codes. In this PhD thesis, we show that quantum expander codes can be used in this construction to correct the errors appearing in the resulting circuit C .

Summary of contributions

The authors of ref. [START_REF] Leverrier | Quantum expander codes[END_REF] studied how the small-set-flip decoder corrects a quantum expander code in the case where the error is adversarial. The drawback of this setting is that the minimal distance of the code is a fundamental limit on the error weight that any algorithm can correct. When the error is generated with a quantum noisy channel (for example with the depolarizing channel) the error weight is generally linear in the block size N . This is way above the best known minimal distance Θ √ N 4 log(N ) for LDPC quantum codes [START_REF] Michael H Freedman | Z2-systolic freedom and quantum codes[END_REF]. Despite this upper bound on the minimal distance, it is well known that some quantum LDPC codes have a threshold and thus successfully correct a depolarizing noise (see [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF] for numerical simulations and [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF] for theoretical arguments). In this PhD thesis, we show that the small-set-flip decoder has a threshold for any noise model satisfying the local stochastic property that we defined and discussed in Section 2.3.

Kovalev and Pryadko already proved the existence of a threshold when a local stochastic noise is corrected with the minimum weight decoder [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF]. As explained below, we showed in ref. [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF] that similar techniques can be used for the small-set-flip decoder. We denote by V Q the set of qubits and by G X the Tanner graph of C X . We will say that a set of qubits is a small ensemble when any adversarial error whose support is included in this ensemble is corrected by the decoder. For instance for quantum expander codes, a "small ensemble" is a set of qubits

K ⊆ V Q with size O( √ N ).
Here, we use the word "ensemble" as a synonym of "set" to avoid a mix-up between "small ensemble" and "small-set". In addition, for a given initial error E ⊆ V Q , two sets of qubits K 1 , K 2 are said to be independent when the behavior of the decoder on the error K 1 ∩ E does not depend on the error K 2 ∩ E. In ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF], the qubits are decomposed into small independent ensembles so that the decoder corrects the error included in each ensemble and thus corrects the entire error as well. In order to decompose the qubits into small independent ensembles, we will say that a decoder is local when two sets of qubits are independent as soon as the intersection of their neighborhoods in G X is empty (as a reminder, the neighborhood of a set of qubits in G X is a set of check-nodes). For example, the small-set-flip decoder and the minimum weight decoder are local. We define the adjacency graph of the code to be the graph with vertex set V Q and such that two qubits are linked if and only if they share a check-node in G X . In particular, if two sets K 1 , K 2 ⊆ V Q are not adjacent in the adjacency graph, then no check-node can be adjacent to both K 1 and K 2 in G X , and thus K 1 and K 2 are independent. When we run a decoder, we call residual error the physical error remaining on the qubits after applying the correction the decoder guessed. We also define the execution support to be the set of all qubits belonging to the error support at some point of the algorithm. For instance with the small-set-flip decoder, the execution support contains the qubits of the initial error together with the qubits of all the small-sets which have been flipped by the algorithm. Then, we can decompose the qubits into independent ensembles K 1 , K 2 , . . . by defining K i to be the connected components of the execution support in the adjacency graph. Finally, we will use percolation arguments to show that K i is a small ensemble with high probability [START_REF] Grimmett | What is percolation? In Percolation[END_REF][START_REF] Lyons | Random walks, capacity and percolation on trees[END_REF][START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF]. To summarize the arguments above, we give a sketch of the proof of [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF]: we run the small-set-flip decoder on an error generated with a local stochastic noise. Let K be a connected component of the execution support U in the adjacency graph. Then, the locality property ensures that the way the decoder acts on K does not depend on whether or not there are errors outside K. In particular, the residual error on the qubits of K is equal to the residual error we would get by running the small-set-flip decoder without initial error outside K. Using arguments from percolation theory, the set K satisfies K = O( √ N ) with high probability and thus the initial errors belonging to K are corrected by the small-set-flip decoder. This is true for each connected component K of U thus the entire error is corrected.

Percolation theory by itself is a whole field of probability theory [START_REF] Grimmett | What is percolation? In Percolation[END_REF]. However, in this work we are interested in the special case of site percolation with local stochastic noise on a finite graph with bounded degree. Let V be the set of vertices of a finite graph G with maximum degree d G (the vertices are called "sites" in the context of percolation) and choose a random subset of the vertices E ⊆ V. Then, the central question in percolation theory is to understand what is the size of the connected components of E. For error correcting codes, the graph G is the adjacency graph and the set E represents the support of the error. Usually for percolation, the probabilistic law on E is an iid error model (each site is in E with probability p independently from the other sites) but in this work we deal with the more general local stochastic error model. By definition, a noise model has the local stochastic property when the random set E satisfies eq. (2.4) for all S ⊆ V. Hence, following ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF], we extend some useful percolation results to this case.

The other significant difference with the results from standard percolation is that we perform a generalized process that we call α-percolation. Instead of being interested in the maximum size of the connected subsets of E, the aim of α-percolation is to look at the connected α-subsets where an α-subset is a set X ⊆ V such that at least α|X| elements of X belong to E. For instance, a 1-subset is simply a subset and 1-percolation is percolation in the usual sense. Looking at α-subsets is relevant because the execution support of the small-set-flip decoder is an α-subset of the initial error for some α ∈ (0, 1]. The main theorem (already proved in the particular case α = 1/2 in ref. [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF]) states that with high probability, any connected α-subset of E has size O( |V|). If we go back to the discussion about local decoders, the set K (defined to be any connected subset of the execution support) is an α-subset of E and thus K = O( √ N ) must hold. For an iid noise and α = 1, it is well known that with high probability, if p < 1/(d G -1) then the connected components of E have size O log(|V|) . On the other hand, if p > 1/(d G -1), there is a unique component whose size is linear (called "giant component") [START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF]. In this work, we extend this result to any local stochastic noise and arbitrary α ∈ (0, 1]. More precisely, we determine a non-zero value p th = p th (α) such that if p < p th , then the probability for the existence of a connected α-subset for E with size above t ∈ N is at most Θ(|V|β αt ) where β = p/p th < 1. A threshold value usually identifies a phase transition between the regime where E has small connected components and the regime where E has a unique giant component. However for error correction, the concern is to be below threshold and thus p th is said to be a threshold even though it is only a lower bound on the percolation threshold. In particular, the value p th we get is not tight for an iid noise since p th (1) < 1/(d G -1). It could be interesting to find the actual threshold for α < 1 and to extend the other results from percolation on finite graphs [START_REF] Janson | On percolation in random graphs with given vertex degrees[END_REF].

A challenging assumption to apply Gottesman's fault-tolerant scheme is to show that the quantum expander codes are not defeated when the syndrome measurement is noisy. Formally in this error model, a set of syndrome bits D is randomly chosen according to a local stochastic noise and the input of the small-set-flip algorithm is the syndrome where the bits of D have been flipped. This hypothesis is necessary in the context of fault-tolerant quantum computation, because the syndrome bits are produced by a quantum measurement performed with physical noisy components. However because of the LDPC property, we cannot hope for the decoder to correct entirely the error on the qubits when the syndrome is noisy. Instead, we show that the residual error is equivalent to a local stochastic error with controlled parameter.

Similarly to the case where the syndrome measurement is perfect, the first step of the analysis is to consider adversarial errors whose weight is below the minimal distance. In that case, the weight of the residual error is shown to be upper bounded by a linear function of |D|. The proof strategy is to go back to the case of noiseless syndrome and to show that the small-set-flip algorithm can flip many small-sets in each round. As we discuss later, this property also implies that the decoder can be parallelized for noiseless and noisy syndrome measurements. Finally, to deal with local stochastic errors, we will apply an α-percolation process to the syndrome adjacency graph to reduce the problem to the case of adversarial errors. The syndrome adjacency graph is the Tanner graph of C X with additional edges between the qubits linked in the adjacency graph [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF].

In addition, our analysis shows that the small-set-flip algorithm has the single-shot property. A quantum code is said to be single-shot when one round of noisy syndrome measurement is sufficient for the decoder to have a threshold. By contrast, the toric code and other 2-dimensional quantum codes are not single-shot. This means that the syndrome has to be measured Θ(D) times to get enough information to correct the error. This property is really favorable in the context of fault-tolerance where many error correction steps have to be performed. Single-shot error correction was introduced by Hector Bombin in [START_REF] Bombín | Single-shot fault-tolerant quantum error correction[END_REF] and various code families have been shown to be single-shot: the three-dimensional gauge color codes [START_REF] Bombín | Single-shot fault-tolerant quantum error correction[END_REF], the four-dimensional toric code [START_REF] Kasper Duivenvoorden | Renormalization group decoder for a four-dimensional toric code[END_REF] and the four-dimensional hyperbolic codes [START_REF] Matthew | Decoding in hyperbolic spaces: quantum LDPC codes with linear rate and efficient error correction[END_REF]. A theory of single-shot error correction has been proposed in ref. [START_REF] Earl | A theory of single-shot error correction for adversarial noise[END_REF] where the main idea was to correct the syndrome errors before trying to correct the qubit errors. Taking into account [START_REF] Earl | A theory of single-shot error correction for adversarial noise[END_REF] and Lemma 4.21 reported in this manuscript, the single-shot property seems closely related to the soundness property. Informally, a code is sound if below minimal distance, the syndrome weight can be lower bounded by a linear function of the error weight.

In ref. [START_REF] Fawzi | Constant overhead quantum fault-tolerance with quantum expander codes[END_REF] we have also shown that the small-set-flip algorithm can be parallelized to run in constant depth. When the syndrome is noisy, if the number of rounds is chosen to be big enough (but constant) then the residual error will be equivalent to a local stochastic error with a small parameter. On the other hand, when the syndrome is perfect, a fixed number of rounds will not be sufficient to correct entirely the error. However, running the algorithm with a number of steps logarithmic in the syndrome weight will correct the error with high probability.

In ref. [START_REF] Grospellier | Numerical study of hypergraph product codes[END_REF], we have done some simulations to study how the small-set-flip decoder performs in practice. For simplicity, we have restricted our attention to the sequential algorithm and perfect syndrome measurements. The numerical results we get are promising. For instance, the value we derived for the threshold is way above the lower bound provided by theoretical arguments. The threshold value is near 4.5% for a family of hypergraph product codes with rate 1/61 and near 2% for rate 1/5.

Chapter 3

Classical error correction

The goal of this chapter is to provide the notions of classical coding we did not introduced in Section 2.1. Section 3.1 summarizes standard terminology and definitions. Section 3.2 is a detailed study of classical expander codes, many of the ideas of this section will be used in Chapter 4 for quantum expander codes.

Background

As stated in Section 2.1, a classical message on n bits is represented with a binary vector of F n 2 . The group operation on F 2 = {0, 1} is the addition modulo 2 denoted by ⊕ and defined by:

0 ⊕ 0 = 1 ⊕ 1 = 0, 0 ⊕ 1 = 1 ⊕ 0 = 1.
The metric on F n 2 used for error correcting codes is called the Hamming distance:

|e| := # i ∈ 1; n : e i = 1 .
The Hamming distance between e 1 ∈ F n 2 and e 2 ∈ F n 2 is equal to e 1 ⊕ e 2 , it is the number of indices where the bits of e 1 and e 2 are different.

For example, when Alice sends a bit-string x ∈ F n 2 to Bob through the binary symmetric channel, the probability he gets some message y ∈ F n 2 is equal to:

P Bob gets y Alice sent x = p |x⊕y| (1 -p) n-|x⊕y| .
The binary vector e := x ⊕ y is called the error. When the i th bit of x is flipped by the channel, we have e i = 1 and e i = 0 otherwise. By definition, the set of codewords of an [n, k, d]-linear error correcting code C is a k dimensional linear subspace of F n 2 . The integer k is called the number of logical bits, n is called the number of physical bits and d is the minimal distance defined by:

d := min |c| : c ∈ C, c = 0 n .
Representing a linear code can be done using either a generator matrix or a parity check matrix. A generator matrix G is an n×k binary matrix whose columns span the set of codewords of C, in particular the rank of G is equal to k the dimension of C. In the communication protocol of Figure 2.4, Alice encodes a message s ∈ F k 2 into a codeword x ∈ F n 2 , then she sends x through the noisy channel to Bob who gets y ∈ F n 2 as channel output, he corrects y to x ∈ F n 2 with the decoding algorithm and finally he computes ŝ ∈ F k 2 the message whose corresponding codeword is x. With the generator matrix G, Alice can perform efficiently the encoding step using the formula x = Gs and Bob can deduce ŝ from x using a Gaussian elimination on the linear system x = Gŝ. A parity check matrix for C is any binary matrix H with n columns satisfying C = ker(H). In particular, each column of G belongs to the kernel of H thus HG = 0. Moreover, the rank of H is n -k thus m ≥ n -k with equality when H is full rank. The rows of H span C ⊥ the orthogonal space of C defined by

C ⊥ := d ∈ F n 2 : d T c = 0 for all c ∈ C
where d T is the transpose vector of d. The rows of H can also be seen as linear constraints on the bits of c ∈ C called parity check equations as illustrated in Figure 3.1 with the Hamming code. Hamming code. The columns of the parity check matrix are the 7 possible non-zero strings with 3 bits.

H =   1 1 1 0 1 0 0 0 1 1 1 0 1 0 0 0 1 0 1 1 1   x ∈ C ⇔      x 1 ⊕ x 2 ⊕ x 3 ⊕ x 5 = 0 x 2 ⊕ x 3 ⊕ x 4 ⊕ x 6 = 0 x 3 ⊕ x 5 ⊕ x 6 ⊕ x 7 = 0
For our purpose, there is a convenient way to represent a parity check matrix H with n columns and m rows using a bipartite graph called the factor graph or the Tanner graph of the code (see Figure 3.1 for an example). Let G be a bipartite graph whose left set of vertices V satisfies V = n and whose right set of vertices C satisfies C = m.

In this context, an element v ∈ V is called a bit-node or simply a bit and will represent a column of H (i.e. a physical bit of the code). Similarly, an element c ∈ C is called a check-node or simply a check and will represent a row of H (i.e. a parity check equation). The graph G is said to be the Tanner graph of H (or a Tanner graph for the associated code) when the edges in G correspond to the 1 in H: if H i,j = 1 then the i th bit-node and the j th check-node are connected and if H i,j = 0 then their are not connected.

The bit-string σ(y) := Hy ∈ F m 2 is called the syndrome of y or the syndrome of the error, for example y ∈ C holds if and only if σ(y) = (0, . . . , 0). The terminology "syndrome of the error" is justified by the fact that when Alice sends a codeword x to Bob who receives y, the syndrome of y does not depend on x but exclusively depends on the error e = x ⊕ y that happened on the channel. Indeed, for all x ∈ C, Hx = 0 holds and:

σ(y) = Hy ⊕ Hx = σ(e).
As shown in Figure 2.4, the error correction step is done with an algorithm which infers some x from the output of the channel y. In this PhD thesis we use the syndrome decoding strategy where the decoder takes as input the syndrome σ(y) = σ(e) ∈ F m 2 , returns ê ∈ F n 2 a guessed for the error and finally sets x = y ⊕ ê. Syndrome decoding is particularly relevant for quantum error correction since we do not have a direct access to the value of a quantum state.

E := i ∈ 1; n : e i = 1 .
Similarly, an error is often seen as a subset of the bit-nodes and the syndrome is often seen as a subset of the check-nodes: E ⊆ V and σ ⊆ C. When a bit-string is seen as a subset, the bit-wise addition ⊕ is replaced by the symmetric difference of sets and the Hamming weight defined in Definition 3.1 becomes the cardinality.

On a Tanner graph, the syndrome is the set of check-nodes incident to an odd number of faulty bits, see Figure 3.2 for some examples on the Hamming code. A check-node is said to be unsatisfied when it belongs to the syndrome and is said to be satisfied otherwise. The faulty bits and the unsatisfied checks are in red.

When we will talk about the degree of a physical bit or the degree of a check, we refer to the degree of the corresponding node in the Tanner graph. The degree of a bit is the number of parity check equations in which it appears and the degree of a check is the number of bits in the corresponding parity check equation.

In this PhD thesis, we are interested in the notion of low-density parity check (LDPC) codes. A linear code is (l, r)-LDPC when the bit-nodes in the Tanner graph have degree at most l and the check-nodes have degree at most r. A family of linear codes C 1 , C 2 , . . . is said to be LPDC when there exist two integers l, r ∈ N such that each code of the family is (l, r)-LDPC. For a family of LDPC codes, the parity check matrices are sparse because the weight of the columns of the matrices is upper bounded by l and the weight of the rows of the matrices is upper bounded by r.

Classical expander codes

Remember that the syndrome decoding task consists in finding the bit errors which have led to a given set of unsatisfied check-nodes. By definition, the neighborhood of any unsatisfied check-node must contain at least one bit in the error. It would be very convenient if, on the one hand, all the bits in the error have a neighborhood containing a majority of unsatisfied check-nodes and, on the other hand, the neighborhood of all the bits not in the error was mainly composed of satisfied check-nodes. Under these two assumptions, the error would be corrected by flipping all the bits adjacent to a majority of unsatisfied check-nodes. Actually, we cannot hope these two properties to hold for any adversarial error but classical expander codes are defined so that the bits mostly satisfy these properties. In order to avoid a situation where many satisfied check-nodes are in the neighborhood of a bit in the error, the expansion property ensures that there are few check-nodes adjacent to two bits in the error. Equivalently, the number of check-nodes in the neighborhood of the error must be large.

An expander code can be decoded with the bit-flip algorithm which, while it is possible to do so, finds and flips a bit such that this flip decreases the syndrome weight. The bit-flip algorithm is sequential in the sense that a single bit is flipped at each round of the procedure. It is also possible to design a parallel version of the algorithm where at each round, all the bits having a majority of unsatisfied neighbors are flipped. Even though the sequential algorithm has better performance than the parallel version, it is also way slower since it runs essentially in linear time compared to logarithmic time when parallelized, see for example the table in [START_REF] Sipser | Expander codes[END_REF]. In this chapter, we focus on the sequential bit-flip algorithm trying to highlight the ideas that can be reused for the analysis of the small-set-flip decoder for quantum expander codes (see Section 4.3). In particular, we introduce some concepts and show some properties that are not essential for classical expander codes but will be useful in the quantum setting. Note that the constants reported in the statements of this chapter can be improved with the arguments of [START_REF] Burshtein | On the error correction of regular ldpc codes using the flipping algorithm[END_REF].

Definition

All along this PhD thesis, we fix a Tanner graph G whose set of bit-nodes is V , whose set of check-nodes is C and we denote by Γ the neighborhood in G. In addition, G is supposed to be a regular graph: the bit-nodes have degree d V and the checknodes have degree d C . Note that for any E ⊆ V : Γ(E) ≤ d V E and for any D ⊆ C : Γ(D) ≤ d C D . An expander graph is such that for any set E or D sufficiently small, the neighborhood is large in the sense that the previous upper bounds are nearly reached. Definition 3.3 (Expander graph [START_REF] Sipser | Expander codes[END_REF]). Let G be a regular Tanner graph with V the set of bit-nodes and C the set of check-nodes. The left degree of G is denoted by d V and its right degree is denoted by d C . We say that G is an expander graph with parameter δ > 0 if there exists γ > 0 such that:

∀E ⊆ V : E ≤ γ V ⇒ Γ(E) ≥ (1 -δ)d V E , ∀D ⊆ C : D ≤ γ C ⇒ Γ(D) ≥ (1 -δ)d C D .
When we want to specify the value of γ, we say that a graph is a (γ, δ)-expander graph. A classical expander code with parameters γ, δ > 0 is a code associated to a (γ, δ)expander Tanner graph. A code family is a classical expander code family with parameter δ > 0 when there exists γ > 0 (γ independent of the code) such that each code of the family is a (γ, δ)-expander code.

Following [START_REF] Leverrier | Quantum expander codes[END_REF] we could distinguish between the notions of left expansion and right expansion. G is a left expander graph with parameter δ V > 0 if there exists γ V > 0 such that:

∀E ⊆ V : E ≤ γ V V ⇒ Γ(E) ≥ (1 -δ V )d V E . (3.2)
G is a right expander graph with parameter δ C > 0 if there exists γ C > 0 such that:

∀D ⊆ C : D ≤ γ C C ⇒ Γ(D) ≥ (1 -δ C )d C D (3.3)
For simplicity, we consider graphs with both right and left expansion where γ = γ V = γ C and δ = δ V = δ C . Note that the left expansion property is sufficient for the analysis done in Section 3.2 for classical expander codes but we will need left and right expansion for quantum expander codes.

Analysis of classical expander codes

In [START_REF] Sipser | Expander codes[END_REF], Sipser and Spielman showed that an expander code with parameter δ < 1/2 has a linear minimum distance and if δ < 1/4 then any error of weight up to a fraction of the minimal distance is corrected by a decoder called the bit-flip algorithm.

In this section, we establish useful properties of expander graphs and deduce a lower bound on the minimal distance. Notation 3.4. Let G be a bipartite expander graph with parameters γ, δ > 0, with left degree d V and right degree d C . Let V be the set of bit-nodes and let C be the set of check-nodes. The graph G is interpreted as a Tanner graph and we denote by C the corresponding classical error correcting code. For E ⊆ V , let Γ u (E) ⊆ Γ(E) be the set of unique neighbors of E:

Γ u (E) := c ∈ C : there exists a unique e ∈ E such that c ∈ Γ(e)
and let Γ m (E) be the set of multiple neighbors of E:

Γ m (E) := Γ(E) \ Γ u (E) = c ∈ C : ∃e = e ∈ E, c ∈ Γ(e) ∩ Γ(e ) .
The key property of bipartite expander graphs is that the size of Γ u (E) is large and the size of Γ m (E) is small (see Lemma 3.5). Lemma 3.5. We use Notation 3.4. If E ⊆ V is such that E ≤ γ V then:

Γ u (E) ≥ d V E (1 -2δ) and Γ m (E) ≤ d V E δ.
Proof. First of all, we have:

Γ(E) = Γ u (E) + Γ m (E) . (3.4) Moreover, d V E = e∈E Γ(e)
. On the right hand side of the latter equality, the elements of Γ u (E) are counted once and the element of Γ m (E) are counted at least twice. Thus:

d V E ≥ Γ u (E) + 2 Γ m (E) . (3.5)
Subtracting eq. (3.4) from eq. (3.5) and using the expansion property

Γ(E) ≥ (1 - δ)d V E from Definition 3.3, we get: Γ m (E) ≤ d V E -Γ(E) ≤ d V (1 -1 + δ) E = d V E δ. ( 3.6)
By eq. (3.4), eq. (3.6) and the expansion property:

Γ u (E) = Γ(E) -Γ m (E) ≥ Γ(E) -d V E δ ≥ (1 -2δ)d V E .
By Lemma 3.5 and the following argument, the minimal distance of an expander code with δ < 1/2 is linear in the block length V . Indeed, if an error

E ⊆ V satisfies 0 < E ≤ γ V then σ(E) = ∅ because Γ u (E) ⊆ σ(E) and thus: σ(E) ≥ Γ u (E) ≥ d V δ(1 -2δ) > 0.
Hence we get d(C) > γ V since the minimal distance d(C) is the minimal weight of a non-zero error with empty syndrome. Actually, the more careful analysis of Lemma 3.6 provides a better lower bound on the minimal distance of C. Lemma 3.6. We use Notation 3.4. If δ < 1/2 then:

d(C) ≥ 2(1 -δ) γ V .
Proof. We show that for any

E ⊆ V with 0 < E < 2(1 -δ) γ V , we have σ(E) = ∅.
First, using Γ u (E) ⊆ σ(E) and Lemma 3.5, we know that in the particular case where E ≤ γ V :

σ(E) ≥ Γ u (E) ≥ d V E (1 -2δ) = 0 (3.7)
and thus σ(E) = ∅.

In the other case where γ

V < E < 2(1 -δ) γ V , we choose E 1 , E 2 ⊆ E such that E = E 1 ∪E 2 , E 1 ∩E 2 = ∅ and E 1 = γ V . We have σ(E) = σ(E 1 )⊕σ(E 2 ) thus σ(E) ≥ σ(E 1 ) -σ(E 2 ) and showing σ(E 1 ) > σ(E 2 ) is sufficient to conclude that σ(E) = ∅.
Similarly to eq. (3.7), we have:

σ(E 1 ) ≥ d V (1 -2δ) E 1 = d V (1 -2δ) γ V
and:

σ(E 2 ) ≤ d V E 2 because G has left degree d V , = d V ( E -E 1 ) < d V (1 -2δ) γ V because E < 2(1 -δ) γ V and E 1 = γ V .
Hence σ(E 1 ) > σ(E 2 ) which concludes the proof.

Bit-flip algorithm

In this section we show that expander codes can be decoded using the bit-flip algorithm.

The definition of expander graphs (Definition 3.3) implies that for an error E sufficiently small E ≤ γ V , the bits e ∈ V whose neighborhood Γ(e) is mainly composed of unsatisfied checks are generally in the error. The bit-flip algorithm takes advantage of this remark by flipping the bits whose neighborhood contains more unsatisfied checknodes than satisfied ones. When we pay attention to the syndrome, the bit-flip algorithm flips a bit when this leads to a decrease in the syndrome weight and it iterates this process while such a bit exists. The bit-flip algorithm was introduced by Gallager in [START_REF] Gallager | Low-density parity-check codes[END_REF] and the analysis for the expander codes was done by Sipser and Spielman in [START_REF] Sipser | Expander codes[END_REF]. In Algorithm 1 we present a slight generalization of the bit-flip where a bit is flipped when this decreases the syndrome weight by at least B ∈ N * units. This parameter B is not really necessary (for example [START_REF] Gallager | Low-density parity-check codes[END_REF] and [START_REF] Sipser | Expander codes[END_REF] set B = 1) but we allow for B being arbitrary because our objective is to extend the ideas of the analysis to the quantum case where taking B = 1 is relevant.

It is great for understanding the algorithm to think about the physical error on the bits as shown in Figure 3.3. Indeed, let E i be the set of bits in error at round number i of the while loop. Of course, the decoder does not have access to E i but we make it appear on the comments of Algorithm 1 for clarity. The variables used by the algorithm are σ i = σ(E i ) and Êi = E ⊕ E i . Let f be the number of rounds in the while loop then the output of the algorithm Ê = Êf represents a guess for the error E. Hence, the procedure is a success when Ê = E, i.e. when the physical error at the end is empty: // σ = σ(E) for some E ⊆ V Output: a guess for the error Ê ⊆ V .

E f = ∅.
Ê0 = ∅ ; σ 0 = σ ; i = 0 // E 0 = E, σ 0 = σ(E 0 ) while ∃e i ∈ V : σ i ⊕ Γ(e i ) ≤ σ i -B do Pick such a e i arbitrarily. // σ(E i ⊕ {e i }) ≤ σ(E i ) -B Êi+1 = Êi ⊕ {e i } // E i+1 = E i ⊕ {e i } σ i+1 = σ i ⊕ Γ(e i ) // σ i+1 = σ(E i+1 ) i = i + 1 end while return Êi
For simplicity we will say that we run Algorithm 1 on an input E ⊆ V when we run it on the input σ(E). In addition, we say that Algorithm 1 corrects the error E when its output Ê is equal to E. Theorem 3.7. Let B ∈ N * . We use Notation 3.4 assuming δ <

1 4 1 - B -1 d V .
Any error

E ⊆ V with E ≤ γ V 1 + d V B -1
is corrected by Algorithm 1.

The proof of Theorem 3.7 has two main steps that we describe below in Lemma 3.9 and Lemma 3.10. The first part of the analysis is independent of the fact that we consider an expander code and uses the notion of execution support defined in Notation 3.8. Notation 3.8. We run Algorithm 1 with parameter B ∈ N * on the input error E ⊆ V and we denote by f the number of rounds of this execution. The execution support U ⊆ V is defined to be the set:

U := E ∪ {e 0 , . . . , e f -1 }.
The execution support contains all the bits which are in error at some point during the execution of the algorithm. Lemma 3.9 below shows that U = O( E ). Lemma 3.9. Using Notation 3.4 and Notation 3.8, we have:

U ≤ E 1 + d V B .
Proof. Let σ i ⊆ C be the variables from the body of Algorithm 1, we have:

σ 0 ≥ σ 0 -σ f = f -1 i=0 σ i -σ i+1 ≥ Bf.
But σ 0 ≤ d V E because the bit-nodes have degree d V thus:

U ≤ E + f ≤ E + σ 0 B ≤ E 1 + d V B .
Lemma 3.9 does not assume the code to be an expander but this hypothesis will be used in Lemma 3.10 below. Using the notations of Figure 3.3, while the set of physical errors E i is not empty, we do not wish the decoder to stop at round i. If |E i | is sufficiently small, the bit-flip will indeed not stop because, as stated in Lemma 3.10 where E i is called F , there is at least one bit satisfying the while loop condition. Let F ⊆ V be an error with 0 < F ≤ γ V then there exists e ∈ F such that flipping the bit e decreases the syndrome weight by at least d V (1 -4δ):

σ(F \ {e}) ≤ σ(F ) -d V (1 -4δ).
Proof. Using Lemma 3.5 applied for E = F :

Γ u (F ) ≥ d V F (1 -2δ). (3.8)
Hence the mean value of Γ u (F ) ∩ Γ(e) over e ∈ F is lower bounded in the following way:

1 F e∈F Γ u (F ) ∩ Γ(e) ≥ 1 F Γ u (F ) ∩ e∈F Γ(e) = Γ u (F ) F ≥ d V (1 -2δ).
Thus there exists at least one bit e ∈ F with Γ u (F )∩Γ(e) ≥ d V (1-2δ). We conclude that:

σ(F \ {e}) = σ(F ) ⊕ Γ(e) = σ(F ) + Γ(e) -2 σ(F ) ∩ Γ(e) ≤ σ(F ) + Γ(e) -2 Γ u (F ) ∩ Γ(e) because Γ u (F ) ⊆ σ(F ), ≤ σ(F ) + d V -2d V (1 -2δ) = σ(F ) -d V (1 -4δ).
We are now ready to prove Theorem 3.7 using Lemma 3.9 and Lemma 3.10.

Proof of Theorem 3.7. We run Algorithm 1 on the input E and denote by Ê the output. In this proof we set F := E ⊕ Ê to be the physical error on the bits after applying the correction Ê. Note that F = E f where f is the number of rounds in the while loop and E i is defined as in Figure 3.3. By the contraposition of Lemma 3.10, showing items (i) and (ii) below is sufficient to prove F = 0 and Theorem 3.7.

(i) F ≤ γ V . (ii) ∀e ∈ F : σ(F \ {e}) > σ(F ) -d V (1 -4δ).
Let's show items (i) and (ii). By definition of the execution support U defined in Notation 3.8, we have F ⊆ U . Using Lemma 3.9 and the hypothesis

E ≤ γ V 1 + d V B -1
, we get item (i):

F ≤ U ≤ E 1 + d V B ≤ γ V .
For item (ii), we remark that Algorithm 1 stopped because the while loop condition was not satisfied at round i = f for σ i = σ(F ):

∀e ∈ V : σ(F ) ⊕ Γ(e) > σ(F ) -B.
We are dealing with integers and thus:

∀e ∈ V : σ(F ) ⊕ Γ(e) ≥ σ(F ) -B + 1 > σ(F ) -d V (1 -4δ) because δ < 1 4 1 - B -1 d V .
Finally, item (ii) holds because for e ∈ F :

σ(F ) ⊕ Γ(e) = σ(F ⊕ {e}) = σ(F \ {e}).

Existence of expander graphs

The goal of this section is to discuss the existence and the construction of expander graphs, we do not give the proofs which can be found in ref. [START_REF] Richardson | Modern coding theory[END_REF]. Note that the expansion property is equivalent to both left expansion and right expansion as defined in eqs. (3.2) and (3.3). Ref. [START_REF] Richardson | Modern coding theory[END_REF] is only interested in the left expansion property but their results also hold for right expansion by exchanging the bit-nodes and the check-nodes.

In this PhD thesis, we rely on a probabilistic construction called configuration model which produces a bipartite graph having the expansion property with high probability. For any desired rate r ∈ [0, 1) and any desired expansion parameter δ > 0, this construction shows the existence of regular LDPC code families with expansion parameter δ and asymptotic rate r (the asymptotic rate is the limit of the rates when the number of bits goes to infinity). Explicit constructions of expander graphs are possible but are more complicated thus we focus on the configuration model [START_REF] Grigorii | Explicit constructions of graphs without short cycles and low density codes[END_REF][START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Barg | Multilevel expander codes[END_REF][START_REF] Barg | Distance properties of expander codes[END_REF][START_REF] Capalbo | Randomness conductors and constant-degree lossless expanders[END_REF]. The first constraint one needs to know when trying to build a family of expander codes with the LDPC property is given in Lemma 3.11 below. Lemma 3.11. Let G be a bipartite graph with left degree d V , right degree d C and expansion parameter δ then:

δ > max 1 d V , 1 d C .
Proof. The proof is presented in ref. [START_REF] Richardson | Modern coding theory[END_REF] Problem 8.2.

Since the bipartite graphs represent error correcting codes, the inequality d V ≤ d C generally holds. By Lemma 3.11, in order to build a Tanner graph with target parameter δ > 0, the left degree must satisfy d V > 1/δ. For instance, the hypothesis δ < 1/4 of Lemma 3.10 requires d V ≥ 5.

The configuration model presented below allows to construct expander graphs with high probability as soon as the constraint of Lemma 3. Pick a random permutation σ of 1; nd V = 1; md C .

4.

For each i ∈ 1; nd V , create an edge between the i th left-half-edge and the σ(i) th right-half-edge (by convention, an edge is created only once).

A graph constructed with the configuration model is not always a good expander since any permutation σ can be picked. However, as stated in Lemma 3.12, if the necessary condition δ > 1/d V of Lemma 3.11 holds then the resulting graph is an expander of parameter δ with high probability. Lemma 3.12. Let δ > 1/d V and let G be a bipartite graph chosen at random with the configuration model as described above, then there exists γ > 0 such that:

P G is an expander graph with parameters (γ, δ) ≥ 1 -O n -β where β = d V δ -1 > 0.
Proof. The proof is presented in ref. [START_REF] Richardson | Modern coding theory[END_REF] Theorem 8.7.

For a regular LDPC code C with n bit-nodes and m check-nodes, we call design rate the real number 1 -m/n = 1 -d V /d C . The code C has dimension at most n -m and rate at most equal to the design rate with equalities if and only if the parity check equations are independent from each other. If the left degree d V is even then each bit appears d V times in the parity check equations, thus they cannot be independent since their binary sum is equal to zero. Lemma 3.13 below asserts that with high probability, there is no other dependency between the parity check equations. Lemma 3.13. With high probability, the rate of a random code constructed with the configuration model as described above is equal to:

1 - d V d C if d V is odd 1 - d V d C + 1 n if d V is even. (3.9)
Proof. The proof is presented in ref. [START_REF] Richardson | Modern coding theory[END_REF] Lemma 3.27.

To summarize this section, we apply the previous results for the construction of a code family C i with any desired expansion parameter and any minimum asymptotic rate. Let δ > 0 and r ∈ [0, 1), we define:

d V := 1 δ + 1, d C := d V 1 -r .
By Lemmas 3.12 and 3.13, there exists γ > 0 such that for n sufficiently large, there exist codes with expansion parameters (γ, δ) and rate as in eq. (3.9). Hence, for i ∈ N * sufficiently large, there exists a code C i with n i = id C bit-nodes, m i = id V checknodes, left degree d V , right degree d C , expansion parameters (γ, δ) and rate as in eq. (3.9). The code family we get has asymptotic rate 1 -d V /d C ≥ r and expansion parameter δ.

Chapter 4

Quantum error correction

Background

In this section, we pursue the presentation of quantum error correcting codes we started in Section 2.3.

Definition of stabilizer codes

In full generality, a quantum error correcting code Q can be defined as an arbitrary 2 K dimensional linear subspace of the Hilbert space C 2 ⊗N . However in this work, we are interested in the class of stabilizer codes that we define below [START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF].

For a stabilizer code Q, the code states are defined using a group S ⊆ ±{1, X, Y, Z} ⊗N ⊆ P N of Pauli operators called the stabilizer group or simply the stabilizer of the code. By definition, the code states are eigenstates with eigenvalue +1 for each operator in S:

Q := |ψ : s |ψ = |ψ , ∀s ∈ S . ( 4.1)
In order to prevent the degenerate case Q = {0}, we require the group S to be abelian and to satisfy -1 / ∈ S. One advantage of stabilizer codes is the possibility to provide a compact representation: it is sufficient to write down a generating set of S to describe Q. The elements of this generating set are called the stabilizer generators or simply the generators of the code and are the counter-part of the parity check equations of classical linear codes. For example, the quantum code called "the 5-qubit code" is stabilized by S = g 1 , g 2 , g 3 , g 4 where:

g 1 = X ⊗ Z ⊗ Z ⊗ X ⊗ 1 g 2 = 1 ⊗ X ⊗ Z ⊗ Z ⊗ X g 3 = X ⊗ 1 ⊗ X ⊗ Z ⊗ Z g 4 = Z ⊗ X ⊗ 1 ⊗ X ⊗ Z (4.2) 55
The dimension of the 5-qubits code is equal to 2 and an orthonormal basis of the code space is given by the states |0 L and |1 L defined by:

|0 L = 1 4 [|00000 + |10010 + |01001 + |10100 + |01010 -|11011 -|00110 -|11000 , -|11101 -|00011 -|11110 -|01111 -|10001 -|01100 -|10111 + |00101 ] |1 L = X ⊗5 |0 L = 1 4 [|11111 + |01101 + |10110 + |01011 + |10101 -|00100 -|11001 -|00111 . -|00010 -|11100 -|00001 -|10000 -|01110 -|10011 -|01000 + |11010 ]
In particular, we can check that |0 L and |1 L are +1 eigenstates for g 1 , g 2 , g 3 and g 4 and form an orthonormal family. The fact that the dimension of the 5-qubits code is equal to 2 is a consequence of Proposition 4.5: an N -qubit stabilizer code defined with M independent generators has dimension 2 K where K = N -M is called the number of logical qubits. A code with N physical qubits and k logical qubits is said to be an [[N, K]] stabilizer code or simply an [[N, K]] code, for example the 5-qubit code is a [ [START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]] stabilizer code. x i = 0 and z i = 0 if P i = 1,

x i = 1 and z i = 0 if P i = X, x i = 1 and z i = 1 if P i = Y, x i = 0 and z i = 1 if P i = Z.
For instance, the four generators of the 5-qubit code shown in eq. (4.2) lead to the following parity check matrix:

    1 0 0 1 0 0 1 1 0 0 0 1 0 0 1 0 0 1 1 0 1 0 1 0 0 0 0 0 1 1 0 1 0 1 0 1 0 0 0 1     .
When we define a stabilizer code with its parity check matrix, we implicitly state that the stabilizer generators belong to {1, X, Y, Z} ⊗N . Since, the symplectic representation is a bijection from {1, X, Y, Z} ⊗N to F 2N 2 , each parity check matrix represents a unique stabilizer code. Note that the generators belong to {1, X, Y, Z} ⊗N but the whole stabilizer group is included in ±{1, X, Y, Z} ⊗N and not necessarily in {1, X, Y, Z} ⊗N . The symplectic representation is not bijective from P N to F 2N 2 : each r ∈ F 2N 2 represents four matrices P , -P , iP and -iP . This ambiguity is not problematic because we will use the symplectic representation when the global phase in front of P is not relevant, for example when P is an error applied on a quantum state or when we wish to know whether P commutes with another Pauli operator. Notation 4.2. Let P 1 , P 2 ∈ P N be two Pauli matrices. We denote by c(P 1 , P 2 ) ∈ F 2 the bit defined by: c(P 1 , P 2 ) = 0 if P 1 and P 2 commute, c(P 1 , P 2 ) = 1 if P 1 and P 2 anti-commute.

Here the letter c stands for "commute".

In Notation 4.2, we emphasize the useful fact that two Pauli matrices either commute or anti-commute. Let x ∈ F N 2 and z ∈ F N 2 be two row vectors such that r(P 2 ) is the concatenation of x and z, then c(P 1 , P 2 ) is equal to the inner product r(P 1 ) • r T where r is the concatenation of z and x. In mathematics, the function c is called a symplectic form.

The symplectic representation is a surjective group homomorphism:

r(P 1 P 2 ) = r(P 1 ) ⊕ r(P 2 ).
A family of stabilizer codes is said to be LDPC when there exist two integers l, r ∈ N such that the weight of the columns of the parity check matrices is upper bounded by l and the weight of their rows is upper bounded by r. LDPC codes are particularly advantageous for implementations because the measurement of a generator with weight r is done with a quantum measurement on r particles, thus r must be as small as possible.

Decoding algorithm

In this section, we discuss the way Pauli errors are corrected for stabilizer codes and in Section 4.1.4 we will address the case where the error is any CPTP map. Informally, a CPTP map can be written as a linear combination of Pauli errors. Section 4. 1.4 formalizes this idea to show that an error correcting procedure which corrects any Pauli error acting on T ∈ N qubits corrects an arbitrary CPTP map acting on these qubits.

Hence, as it is usual in quantum error correction, this manuscript will mostly focus on the case where the error is Pauli. By the definition of a stabilizer code given in eq. (4.1), a code state |ψ ∈ Q is an eigenvector with eigenvalue +1 for the stabilizer generators. In particular, when we measure one of the generators on the state |ψ , we get +1 with probability 1. On the other hand, when we measure the generators g 1 , . . . , g M on U |ψ where U is some unitary representing an error, we get some sequence of eigenvalues in {-1, +1} M . These M eigenvalues are generally reported as a sequence of bits called the syndrome

σ ∈ F M 2 ,
where a +1 eigenvalue is represented by the bit 0 and a -1 eigenvalue is represented by the bit 1. The syndrome contains information about the error applied on the code state and the goal of the error correction procedure is to infer the error from the syndrome.

When U is a general unitary, the quantum state U |ψ is not necessarily an eigenvector of the generators, thus the value of the syndrome is not deterministic and the state collapses during the measurements. Nevertheless, in this section we focus on the case where U is a Pauli matrix. In this particular case, the state U |ψ is indeed an eigenvector of the generators, see eq. (4.3).

Let P ∈ {1, X, Y, Z} ⊗N ⊆ P N be a Pauli error, let g ∈ g 1 , . . . , g M be a generator and let |ψ ∈ Q be a code state then P |ψ is either a +1 or a -1 eigenstate of g:

If
σ(P ) i := 0 if P g i = g i P ,
1 if P g i = -g i P . equivalently σ | ψ i := 0 if g i | ψ = | ψ , 1 if g i | ψ = -| ψ . (4.4)
We emphasize that the syndrome of | ψ depends on P but does not depend on the initial code state |ψ . Let ρ be a density matrix then measuring the operator P corresponds to the CPTP map of eq. ( 2.3) implemented with the circuit on the left part of Figure 4.1.

The circuit on the left part of Figure 4.1 uses the Hadamard gate H and the controlled-P gate C-P defined by: The circuit proceeds in the following way:

H :        |0 → 1 √ 2 |0 + |1 |1 → 1 √ 2 |0 -|1 C-P : |0 ⊗ |ψ → |0 ⊗ |ψ |1 ⊗ |ψ → |1 ⊗ P |ψ
• An ancilla qubit is prepared in the state |0 .

• The Hadamard gate H is applied on the ancilla qubit.

• The controlled-P gate is applied.

• The Hadamard gate is applied on the ancilla qubit.

• The ancilla qubit is measured in the Z-basis (i.e. we perform the Pauli measurement associated to the Pauli matrix Z).

A decoding algorithm or decoder is a classical algorithm that takes as input a syndrome σ ∈ F M 2 and tries to guess the error P . Once the decoder has provided its output P ∈ {1, X, Y, Z} ⊗N , the correction P = P † is applied on the quantum state with the hope that P | ψ = |ψ holds.

In the classical setting, a decoder succeeds when it identifies exactly the error, i.e. when P = P . However, for a stabilizer code the success condition is relaxed: suppose we start from a code state |ψ ∈ Q, that the error P ∈ P N yields | ψ := P |ψ and that the decoder outputs P = sP where s ∈ S is in the stabilizer group. Under these assumptions, when we apply the correction P to | ψ , we end up with the state P | ψ = s |ψ = |ψ . In this example, the decoder did not find the error but it was sufficient to correct the state. We say that two Pauli errors P 1 , P 2 ∈ P N are equivalent when they are equal up to a multiplication by a matrix of the stabilizer group S, or equivalently when P 1 P 2 ∈ S. In that case, P 1 and P 2 act in the same way on the code states:

∀ |ψ ∈ Q : P 1 |ψ = P 2 |ψ .
We say that a stabilizer code is degenerate to mention the existence of two different Pauli errors which are equivalent.

If two Pauli errors P 1 and P 2 are equivalent then the syndrome of P 1 is equal to the syndrome of P 2 since these syndromes are both equal to the syndrome of | ψ = P 1 |ψ = P 2 |ψ . However, the contraposition is false: there exist errors with the same syndrome but non equivalent. In fact, two Pauli errors P 1 and P 2 have the same syndrome if and only if they satisfy P 1 P † 2 ∈ N where N = N (Q) is called the normalizer group (or simply the normalizer) of the code defined by: N := P ∈ P N : σ(P ) = 0 M .

In mathematics, for a group G, the normalizer of a subgroup S ⊆ G is the subgroup N ⊆ G containing the elements g ∈ G which commute with all s ∈ S. Using eq. (4.4), a Pauli matrix is indeed in N if and only if it commutes with each stabilizer generators g 1 , . . . , g M . In addition, since g 1 , . . . , g M generate the stabilizer group S, a Pauli matrix is in N if and only if it commutes with each element of S: N = P ∈ P N : ∀s ∈ S, P s = sP , N = P ∈ P N : ∀i ∈ 1; m , P g i = g i P .

Another interesting property is that the normalizer group fixes the code space and the stabilizer group fixes the code states:

∀n ∈ N : nQ = Q, ∀s ∈ S, ∀ |ψ ∈ Q : s |ψ = |ψ .
For the 5-qubit code defined in eq. ( 4.2), the normalizer group is equal to:

N = S, X L , Z L where X L := X ⊗5 and Z L := Z ⊗5 .
The operators X L and Z L satisfy:

X L |0 L = |1 L , X L |1 L = |0 L , Z L |0 L = |0 L , Z L |1 L = -|1 L ,
where |0 L and |1 L are the logical states of the 5-qubit code defined below eq. (4.2). The effect of the matrices X L and Z L on the logical states is similar to the effect of the usual Pauli matrices X and Z on the computational basis |0 , |1 thus they are called logical Pauli operators of the code. In fact, we can talk about other logical operations such as a logical Hadamard or a logical controlled-not or a logical measurement. The logical operations allow us to process the information contained in the code states while keeping the protection of the error correcting code. This is essential to perform fault-tolerant quantum computation (see Chapter 6).

The minimal distance of an [[N ; K]] stabilizer code is the minimum weight of an error in N \ S.

D := min P : P ∈ N \ S . (4.5)
This definition is meaningful because N is the set of undetectable Pauli errors and S is the set of Pauli errors which leave the code states invariant. Thus D is the minimum weight of an undetectable error which does not act trivially on the code space. When the minimal distance is specified, we say that the code is an [[N, K, D]] stabilizer code.

To conclude this section, we provide the example of the minimum weight decoder, which, given a syndrome σ, returns a minimum weight error among the errors with syndrome σ: P := arg min P ∈P N :σ(P )=σ P .

(4.6)

This decoder have the advantage to perform well, but in general it cannot be implemented efficiently. A major exception is the polynomial time implementation for the 2-dimensional topological codes [START_REF] Dennis | Topological quantum memory[END_REF][START_REF] Nikolas | Constructions and noise threshold of hyperbolic surface codes[END_REF][START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF].

In this PhD thesis, we are interested in the hypergraph product codes, see Section 4.2, and for this specific code family we do not know how to implement the minimum weight decoding efficiently. In Section 4.3.1, we define the family of quantum expander codes which is a particular case of hypergraph product and can be decoded with the efficient small-set-flip decoder.

Error correction of non Pauli errors

In Section 4.1.3, we discussed the way Pauli errors can be corrected with stabilizer codes. In fact, the error correction procedure we used in that case also works for more general errors. If we consider a CPTP map with Kraus operators {E 1 , . . . , E K } such that E k acts on at most T qubits (the operators E k may act on different qubits but each one acts on at most T qubits) then this CPTP map is corrected by EC:

∀ |ψ ∈ Q : EC K k=1 E k |ψ ψ| E † k = |ψ ψ| .
The full proof of Proposition 4.3 can be found in Theorem 10.2 of [START_REF] Michael | Quantum computation and quantum information[END_REF]. Here, we focus on the particular case where the error correction procedure EC is the one described in Section 4.1.3 and we will only prove the case where the error is a unitary matrix acting on the first T qubits. Up to technical details, our proof can be generalized to the case where the error is a CPTP map with each Kraus operator acting on T qubits. However, our arguments are a bit different from the one used in [START_REF] Michael | Quantum computation and quantum information[END_REF] for the case where EC is not supposed to be the procedure described in Section 4.1.3.

Let g 1 , . . . , g M be the stabilizer generators of Q. The error correction procedure presented in Section 4.1.3 proceeds in three steps:

(i) Measure the stabilizer generators to get a syndrome σ ∈ F M 2 .

(ii) Use a decoder to guess a Pauli correction Ê ∈ P N .

(iii) Apply the correction Ê to the quantum state.

We denote by M the quantum operation corresponding to item (i) and by C the quantum operation corresponding to items (ii) and (iii). M takes as input a quantum register on N qubits and its output is composed of one classical register with M bits and one quantum register with N qubits. C takes as input a classical register on M bits and a quantum register on N qubits and its output is a quantum register on N qubits. In order to measure one bit of the syndrome in the operation M, we need to measure a generator which is a Pauli matrix P ∈ {1, X, Y, Z} ⊗N . This measurement can be done with the circuit presented in the left part of Figure 4.1. This circuit maps an arbitrary density matrix ρ to:

|0 0| ⊗ Π 0 ρΠ † 0 + |1 1| ⊗ Π 1 ρΠ † 1
where Π 0 = 1 2 (1 + P ) is the orthogonal projector onto the +1 eigenspace of P and Π 1 = 1 2 (1-P ) is the orthogonal projector onto the -1 eigenspace of P . More generally, when we measure the generators g 1 , . . . , g M with M copies of the circuit presented in Figure 4.1, the syndrome σ ∈ F M 2 is stored in a classical register and a projection Π σ is applied on the quantum register:

ρ → σ∈F M 2 |σ σ| ⊗ Π σ ρΠ † σ where Π σ := 1 2 M M i=1 1 + (-1) σi g i .
The matrix Π σ is an orthogonal projector onto the states with syndrome σ (for a proof of this point, see the proof of Proposition 4.5). We can check that for all |ψ ∈ Q, σ ∈ F M 2 and P ∈ {1, X, Y, Z} ⊗N :

Π σ P = P Π σ⊕σ(P ) Π σ |ψ = 0 if σ = 0 M Π σ |ψ = |ψ if σ = 0 M . ( 4.7)
Thus:

Π σ P |ψ = P |ψ if σ(P ) = σ Π σ P |ψ = 0 if σ(P ) = σ. (4.8)
As a summary, the operations M and C satisfy:

M : ρ → σ∈F M 2 |σ σ| ⊗ Π σ ρΠ † σ , ( 4.9)
C : |σ σ| ⊗ ρ → Pσ ρ P † σ (4.10)
where Pσ ∈ {1, X, Y, Z} ⊗N is the Pauli matrix computed by the decoder on input σ.

We are now ready to show that if C • M corrects any Pauli error acting on the first T ∈ N qubits then C • M also corrects an arbitrary unitary acting on the first T qubits.

We denote by P N,T := {1, X, Y, Z} ⊗T ⊗ 1 ⊗N -T the set of Pauli matrices acting on the first T qubits. We assume that these Pauli errors are corrected by the error correction procedure, i.e. for all P ∈ P N,T and for all |ψ ∈ Q:

C • M P |ψ ψ| P † = |ψ ψ| .
For simplicity, we replace the density matrices with pure states:

C • M P |ψ = |ψ . (4.11)
First, eq. (4.11) implies that two Pauli errors with the same syndrome act in the same way on the code states, i.e. for all P 1 , P 2 ∈ P N,T :

σ(P 1 ) = σ(P 2 ) ⇒ ∀ |ψ ∈ Q : P 1 |ψ = P 2 |ψ . (4.12)
Indeed, let σ = σ(P 1 ) = σ(P 2 ) then using eqs. (4.8) to (4.11):

Pσ P 1 |ψ = C • M P 1 |ψ = |ψ = C • M P 2 |ψ = Pσ P 2 |ψ .
Hence we have P 1 |ψ = P 2 |ψ because Pσ is invertible. When we deal with general errors, the key observation is that the operators Π σ collapse arbitrary errors onto Pauli errors. For instance, let ρ = U |ψ ψ| U † where U = U 0 ⊗ 1 ⊗N -T and U 0 is a unitary complex matrix of size 2 T × 2 T acting on the first T qubits. The family {1, X, Y, Z} ⊗T is a basis for the linear space of complex matrices thus we can write U as:

U = P ∈P N,T α P P
where α P ∈ C.

As a consequence, the state ρ can be written as:

ρ = P1,P2∈P N,T α P1 α * P2 P 1 |ψ ψ| P † 2 (4.13)
We have: where P σ ∈ P N,T is chosen such that σ(P σ ) = σ and:

M[ρ] = σ∈F M 2 |σ σ| ⊗   P1,P2∈P N,T α P1 α * P2 Π σ P 1 |ψ ψ| P † 2 Π †
β σ = P1,P2∈P N,T : σ=σ(P1)=σ(P2) α P1 α * P2
Note that P σ is undefined when P ∈ P N,T : σ(P ) = σ is empty. However in that case, β σ = 0 thus we can set P σ arbitrarily, for example P σ = 0. By hypothesis, P σ ∈ P N,T is corrected by C • M and thus we have:

C • M(ρ) =   σ∈F M 2 β σ   |ψ ψ| .
The CPTP map C • M is trace preserving thus:

C • M(ρ) = |ψ ψ| .
The conclusion is that C • M corrects the error U .

Dimension of a stabilizer code

The goal of this section is to prove the formula for the dimension of a stabilizer code given in Proposition 4.5. Let g 1 , . . . , g M ∈ P N be commuting Pauli operators. We define a stabilizer group S = g 1 , . . . , g M and Q the corresponding quantum code as in eq. (4.1). First, since we have assumed -1 / ∈ S to avoid the degenerate case Q = {0}, we must have g i ∈ ±{1, X, Y, Z} ⊗N to ensure g 2 i = -1. Second, if one of the generators is equal to the product of other generators then we can freely remove it without changing S. Hence we assume that the generators are independent:

∀v ∈ F M 2 : M i=1 g vi i = 1 ⇒ v = 0 M . (4.14)
As a summary, without loss of generality we assume that the stabilizer generators g 1 , . . . , g M belong to ±{1, X, Y, Z} ⊗N , are independent in the sense of eq. (4.14) and satisfy:

g 2 i = 1, g i = g † i . (4.15)
The first step to compute the dimension of a stabilizer code is to understand how Q is modified when g i is replaced by -g i . Let σ ∈ F M 2 be a syndrome. Then the set of quantum states with syndrome σ is the code space of the quantum code whose stabilizer generators are (-1) σ1 g 1 , . . . , (-1) σ M g M :

Q σ := |ψ : (-1) σi g i |ψ = |ψ , i = 1, . . . , M .
(4.16)

For example we have Q = Q σ when σ = 0 M . The stabilizer code Q σ does depend on σ but all these codes are similar because, as shown in Lemma 4.4, they are equal up to a multiplication by a Pauli matrix.

Lemma 4.4. Let g 1 , . . . , g M ∈ P N be independent, i.e. satisfying eq. (4.14), and commuting Pauli matrices such that -1 / ∈ g 1 , . . . , g M . Let σ, σ ∈ F M 2 be two syndromes and let Q σ , Q σ as defined in eq. (4.16). Then:

Q σ = P Q σ where P ∈ P N .
Proof. First, using the independence of the generators, we show that the parity check matrix H of Q is full rank. For that, we show that H T is injective using the symplectic representation r defined in Notation 4.1. Let v ∈ F M 2 be such that H T v = 0 2N then:

r(1) = 0 2N = H T v = M i=1 v i r(g i ) = r M i=1 g vi i .
The homomorphism r is not injective but nonetheless M i=1 g vi i = λ1 where λ ∈ {1, -1, i, -i} and we get λ = 1 using the hypothesis -1 / ∈ g 1 , . . . , g M . By eq. (4.14), we conclude that v = 0 M and thus H is full rank.

Since H is full rank, there exist x, z ∈ F N 2 such that He = σ ⊕ σ where e = (z, x) ∈ F 2N 2 is the concatenation of z and x. We define the Pauli matrix P promised by Lemma 4.4 to be such that r(P ) = (x, z). For i ∈ 1, M , the i th bit of He is equal to the inner product r(g i ) • e T and thus we have c(g i , P ) = r(g i ) • e T = σ i ⊕ σ i where c(g i , P ) defined in Notation 4.2 satisfies:

g i P = (-1) c(gi,P ) P g i .
By the definition of Q σ and Q σ , we have

P Q σ ⊆ Q σ and P † Q σ = P Q σ ⊆ Q σ .
We conclude this section with Proposition 4.5 which states that the dimension of a stabilizer code is 2 N -M where M is the number of independent generators. Proposition 4.5. Let g 1 , . . . , g M ∈ P N be independent,i.e. satisfying eq. (4.14), and commuting Pauli matrices such that -1 / ∈ g 1 , . . . , g M . The associated quantum code Q has K := N -M logical qubits and the physical space C 2 ⊗N is equal to the following orthogonal direct sum (⊕ is the orthogonal direct sum of linear spaces):

C 2 ⊗N = σ∈F M 2 Q σ .
Proof. For σ ∈ F M 2 , we define Π σ by:

Π σ := 1 2 M M i=1 1 + (-1) σi g i .
With eq. ( 4.15) and the definition of Π σ above, we have:

Π σ Π σ = Π σ Π † σ = Π σ Im(Π σ ) = Q σ .
Hence Π σ is the orthogonal projector onto Q σ . Similarly, for any i ∈ 1, M :

1 + g i 1 -g i = 1 -g i 1 + g i = 0.
Thus for σ = σ , we get Π σ Π σ = 0 and the two subspaces Q σ and Q σ are orthogonal.

Finally, as stated in Proposition 4.5, we have C 2 ⊗N = σ Q σ because:

σ∈F M 2 Π σ = 1 2 M M i=1 σi∈F2 1 + (-1) σi g i = 1
and thus for all |ψ ∈ C 2 ⊗N , |ψ = σ Π σ |ψ .

For the dimension of Q, we already know that

2 N = dim C 2 ⊗N = σ dim(Q σ ).
By Lemma 4.4, the dimension of Q σ does not depend on σ and thus dim(Q) = 2 N -M .

CSS codes

In 1996, a broad class of quantum codes called the Calderbank-Shor-Steane codes, or CSS codes for short, was introduced independently by Calderbank and Shor in [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF], and by Steane in [START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF]. Even though the CSS codes were defined before the stabilizer codes, it is convenient to use the stabilizer formalism to describe them. A CSS code is a stabilizer code where each stabilizer generator is either a product of X-Pauli matrices or a product of Z-Pauli matrices:

g i ∈ {1, X} ⊗N for i = 1, . . . , M Z , g i+M Z ∈ {1, Z} ⊗N for i = 1, . . . , M X .
The generators equal to a product of X-Pauli matrices are called the X-type generators and those equal to a product of Z-Pauli matrices are called the Z-type generators.

Let C X and C Z be two classical codes satisfying C ⊥ Z ⊆ C X (or equivalently C ⊥ X ⊆ C Z ) then we can define a CSS code denoted by CSS(C X , C Z ) in the following manner. Let H X be a parity check matrix for C X with size M X × N and let H Z be a parity check matrix for C Z with size M Z × N . Then CSS(C X , C Z ) is the stabilizer code with M = M X + M Z generators given by the following parity check matrix:

H = H Z 0 0 H X . (4.17)
When we talk about CSS codes in this PhD thesis, the subscript X is used to indicate that the code C X corrects the X-Pauli errors and the subscript Z is used to indicate that C Z corrects the Z-Pauli errors. Hence the generators associated to C X are Z-type generators and the generators associated to C Z are X-type generators. Some authors take the converse convention.

One nice feature of CSS codes is the possibility to handle them with the formalism of classical error correcting codes. Since the generators of a CSS code commute and are either X-type or Z-type generators, the stabilizer group S is included in S 0 where:

S 0 := g X g Z : g X ∈ {1, X} ⊗N , g Z ∈ {1, Z} ⊗N . (4.18)
The symplectic representation defined in Notation 4.1 restricted to S 0 is a bijection

r : S 0 → F 2N 2 .
Hence for all P ∈ S 0 and for all v ∈ F M 2 , we have the equivalence:

P = M i=1 g vi i ⇔ r(P ) = M i=1 v i r(g i ). (4.19)
As a consequence, the elements of the stabilizer group can be seen as binary vectors and CSS codes are described with linear algebra. For example, a product of X-type generators has symplectic representation (e, 0 N ) where e ∈ C ⊥ Z :

C ⊥ Z × {0 N } = r(s) : s ∈ S ∩ {1, X} ⊗N . (4.20)
As discussed in Section 4.1.1 and Proposition 4.5, defining a stabilizer code with commuting generators and -1 / ∈ g 1 , . . . , g M is necessary and sufficient to avoid the degenerate case Q = {0}. For a CSS code, the condition that the generators commute is equivalent to H X H T Z = 0 and is ensured by the requirement C ⊥ Z ⊆ C X . The other condition -1 / ∈ g 1 , . . . , g M always holds for a CSS code because -1 / ∈ S 0 . When the Z-type generators of a CSS code are measured, we get the first part of the syndrome σ X ∈ F M X 2 which gives information about the X-type errors on the state.

Similarly, the Z-type errors are detected with the syndrome σ Z ∈ F M Z 2 obtained when we measure the X-type generators. The entire syndrome σ ∈ F M 2 is the concatenation of these two bit-strings σ = (σ X , σ Z ). In this PhD thesis, we focus on CSS codes and we correct X-type and Z-type errors independently. Therefore we need two decoders: the first one takes as input the syndrome σ X and uses the code C X to infer an X-type correction P ∈ {1, X} ⊗N often seen as a bit-string êX ∈ F N 2 , and the second decoder proceeds in the same way for Z-type errors. Note that if a decoder corrects both X and Z errors on some qubit then the error Y = iXZ is also corrected. Thereby, the decoding problem for CSS codes is close to the one for classical codes and thus we will often use the terminology from classical error correction in the quantum setting. For example, the Z-type generators will be sometimes called the check-nodes. Note that for many error models such as the depolarizing channel, the correlations between X and Z errors can be used to improve the decoders [START_REF] Delfosse | A decoding algorithm for css codes using the x/z correlations[END_REF][START_REF] Poulsen Nautrup | Optimizing quantum error correction codes with reinforcement learning[END_REF][START_REF] Puri | Bias-preserving gates with stabilized cat qubits[END_REF].

Nonetheless, since some CSS codes are degenerate, they cannot be corrected in the same way as classical codes. The degeneracy of a stabilizer code implies that it is sufficient to correct the error up to an element of the stabilizer group, for example the X-type error can be corrected up to a product of X-type generators. Let e X ∈ F N 2 be an X-type error and let êX ∈ F N 2 be the correction that returns the decoder. Using the bijection given in eq. (4.20) between product of X-type generators and the vector space C ⊥ Z , the decoder succeeds in correcting the X-error if and only if e X ⊕ êX ∈ C ⊥ Z .

Taking into account the degeneracy is particularly important for LDPC codes since the vector space C ⊥ Z contains constant weight elements. For a stabilizer code, remember from Section 4.1.3 that the minimal distance is the minimal weight of an element in N \ S, where N \ S is the set of a Pauli errors with an empty syndrome acting non-trivially on the code state. For a CSS code, there is always an X-type error or a Z-type error in N \ S with weight equal to the minimal distance. We define D X to be the minimal weight of an X-type error in N \ S. Using the terminology of classical error correction, D X is the minimal weight of a codeword in C X which does not belong to C ⊥ Z . The minimal distance for Z-type errors is defined in a similar manner:

D X := min e X : e X ∈ C X \ C ⊥ Z , D Z := min e Z : e Z ∈ C Z \ C ⊥ X .
Note that D X and D Z are not the minimal distances of the codes C X and C Z . Finally, the minimal distance of CSS(C X , C Z ) is equal to:

D = min(D X , D Z ). (4.21)
The classical codes C X and C Z can be represented by their Tanner graphs which must have the same number of bit-nodes. The Tanner graph for the code CSS(C X , C Z ) has three types of nodes: the bits-nodes, the check-nodes of C X (which represent the Z-type generators) and the check-nodes of C Z (which represent the X-type generators). A bit-node and an Z-type generator (resp. X-type generator) are connected if and only if they are connected in the Tanner graph of C X (resp. C Z ). For example when both C X and C Z are equal to the [START_REF] Barg | Multilevel expander codes[END_REF][START_REF] Arikan | Channel polarization: A method for constructing capacityachieving codes[END_REF][START_REF] Arikan | Channel polarization: A method for constructing capacityachieving codes[END_REF] Hamming code defined in Figure 3.1, we get a CSS code called the 7-qubit code or the Steane code whose parity check matrix is given in Figure 4.2 and whose factor graph is given in Figure 4.3.

       
1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 1 1 1 0 1 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 The CSS codes we are interested in are the quantum expander codes which can be decoded with the small-set-flip decoder (see Section 4.3.1). In that case, the Tanner graphs of C X and C Z are isomorphic and thus the correction of X-errors is similar to the correction of Z-errors. In particular, the decoding algorithm is the same for both types of errors and we will describe it only for X-errors. An X-type error can be seen either as a classical error e X ∈ F N To summarize, the small-set-flip decoder is a classical algorithm which takes as input a syndrome σ ⊆ C X and returns a subset of the qubits Ê ⊆ V Q . Proposition 4.6 provides the formula to compute the dimension of a CSS code from the dimension of the underlying classical codes.

       
Proposition 4.6. Let C X be a classical [N, k X ] code and C Z be an [N, k Z ] code with C ⊥ Z ⊆ C X . The quantum code CSS(C X , C Z ) is an [[N, K]] stabilizer code where K = k X + k Z - N .
Proof. We would like to use Proposition 4.5 but the generators g 1 , . . . , g M are not necessarily independent. A consequence of eq. (4.20) is that the number of independent generators in g 1 , . . . , g M is equal to the number of independent rows in the parity check matrix H. By the rank nullity theorem, the parity check matrix H Z has M Z = N -k Z independent rows and the parity check matrix H X has M X = N -k X independent rows. Thus the number of independent rows in H is equal to

M = M X + M Z = 2N -k X -k Z . By Proposition 4.5: K = N -M = k X + k Z -N .
In [START_REF] Calderbank | Good quantum error-correcting codes exist[END_REF] and [START_REF] Andrew M Steane | Error correcting codes in quantum theory[END_REF], the CSS codes were introduced by giving an explicit orthogonal basis for the code space. For x ∈ C X , we define:

|x ⊕ C ⊥ Z := 1 C ⊥ Z y∈C ⊥ Z |x ⊕ y .
Lemma 4.7. The set |x + C ⊥ Z : x ∈ C X is an orthogonal basis for the code space of CSS(C X , C Z ).

Proof. Let Q be the quantum code spanned by the states |x ⊕ C ⊥ Z :

Q := span |x ⊕ C ⊥ Z : x ∈ C X .
The strategy to show the equality

CSS(C X , C Z ) = Q is to prove that Q ⊆ CSS(C X , C Z )
and then that these two vector spaces have both dimension equal to N -k X -k Z .

The statement Q ⊆ CSS(C X , C Z ) means that the states |x ⊕ C ⊥ Z are +1 eigenstates for the generators of CSS(C X , C Z ) specified by the parity check matrix of eq. (4.17).

Let h ∈ F N 2 be a row of H Z then the corresponding X-type generator is

g = N i=1
X hi and:

g |x ⊕ C ⊥ Z = y∈C ⊥ Z g |x ⊕ y = y∈C ⊥ Z |x ⊕ y ⊕ h = y ∈C ⊥ Z g |x ⊕ y = |x ⊕ C ⊥ Z .
Note that in the previous equalities and in what follows, we omit the global phase

1/ C ⊥ Z of the definition of |x ⊕ C ⊥ Z .
Let h ∈ F N 2 be a row of H X then the corresponding Z-type generator is:

g = N i=1
Z hi and:

g |x ⊕ C ⊥ Z = y∈C ⊥ Z g |x ⊕ y = y∈C ⊥ Z (-1) (x⊕y)•h |x ⊕ y = y∈C ⊥ Z |x ⊕ y = |x ⊕ C ⊥ Z . Hence Q ⊆ CSS(C X , C Z ) holds.
In order to compute the dimension of Q, we show that |x ⊕ C ⊥ Z : x ∈ C X is an orthonormal basis of Q. Let x, x ∈ C X , we distinguish between two cases:

• If x ⊕ x ∈ C ⊥ Z then |x ⊕ C ⊥ Z = |x ⊕ C ⊥ Z because: |x ⊕ C ⊥ Z = y∈C ⊥ Z |x ⊕ y = y ∈C ⊥ Z |x ⊕ y ⊕ x ⊕ x = y ∈C ⊥ Z |x ⊕ y = |x ⊕ C ⊥ Z . • If x ⊕ x / ∈ C ⊥ Z then for any y, y ∈ C ⊥ Z : x ⊕ y ⊕ x ⊕ y / ∈ C ⊥ Z .
In particular x ⊕ y = x ⊕ y and thus the vectors |x ⊕ y and |x ⊕ y are orthogonal. Finally, the states |x ⊕ C ⊥ Z and |x ⊕ C ⊥ Z are orthogonal since the two sums that define them are orthogonal term by term.

The dimension of Q is equal to:

dim(Q) = # |x ⊕ C ⊥ Z : x ∈ C X = C X C ⊥ Z = 2 k X 2 N -k Z = 2 k X +k Z -N .
Using Proposition 4.6, we conclude that Q and CSS(C X , C Z ) have the same dimension and thus they are equal.

Hypergraph product codes

The hypergraph product construction introduced by Tillich and Zémor in ref. [START_REF] Tillich | Quantum LDPC codes with positive rate and minimum distance proportional to the square root of the blocklength[END_REF] is a generic way to build a quantum code Q from two classical codes C 1 and C 2 . Let G 1 , G 2 be the Tanner graphs of C 1 , C 2 then the associated hypergraph product is a CSS code whose Tanner graph is equal to the so-called Cartesian product of G 1 and G 2 . This construction provides quantum LDPC codes with constant rate and a minimal distance proportional to the square root of the block length. For instance, when C 1 and C 2 are both equal to the same

[n, Θ(n), Θ(n)] LDPC code, Q is an [[N, Θ(N ), Θ( √ N )]] LDPC CSS code where N = Θ(n 2 ).
As shown in Figure 2.6, the asymptotic scaling for the hypergraph product code parameters is good by comparison to the other known families of LDPC codes. The technical idea to compute the dimension and the minimal distance of an hypergraph product code is to rely on two notions from classical coding called transpose code and classical product code. Let C be a classical code with parity check matrix H. Then, by definition, the transpose code of C denoted by C T has parity check matrix H T . In other words, the Tanner graph of C T is equal to the Tanner graph of C where the bit-nodes are interpreted as check-nodes and vice-versa. Classical product codes have been introduced by Elias in ref. [START_REF] Elias | Error-free coding[END_REF].

Given C 1 an [n 1 , k 1 , d 1 ] code and C 2 an [n 2 , k 2 , d 2 ] code, the associated product code is an [n 1 n 2 , k 1 k 2 , d 1 d 2 ]
that we denote by C. Informally, the physical bits of C are organized accordingly to an n 1 × n 2 rectangle and a bit-string c ∈ F n1×n2 2 is a codeword of C if and only if each column of c is a codeword of C 1 and each row of c is a codeword of C 2 . For completeness, we provide a quick survey on classical product codes in Chapter 7. Finally, the hypergraph product associated to C 1 and C 2 is the CSS code built from

C X , C Z where C T X is the classical product of C 1 , C T 2 and C T Z is the classical product of C T 1 , C 2 .
The organization of this section is the following: Section 4.2.1 defines the hypergraph product construction and Section 4.2.2 is a review on their main properties.

Definition of hypergraph product codes

Let C 1 be an [n 1 , k 1 , d 1 ] classical code with parity check matrix H 1 ∈ F m1×n1 2 and let C 2 be an [n 2 , k 2 , d 2 ] classical code with parity check matrix H 2 ∈ F m2×n2 2
. The hypergraph product of C 1 , C 2 denoted by Q is defined to be the CSS code associated to the classical codes C X , C Z described by the following parity check matrices:

H X = 1 n1 ⊗ H 2 , H T 1 ⊗ 1 m2 , H Z = H 1 ⊗ 1 n2 , 1 m1 ⊗ H T 2 , (4.22)
where 1 n is the n × n identity matrix. Note that H X is an M X × N matrix and H Z is an M Z × N matrix where: Furthermore, it is straightforward to check that the orthogonality property H X H T Z = 0 holds:

N := n 1 n 2 + m 1 m 2 , M X := n 1 m 2 , M Z := m 1 n 2 .
H X H T Z = 1 n1 ⊗ H 2 , H T 1 ⊗ 1 m2 • H T 1 ⊗ 1 n2 1 m1 ⊗ H 2 = (1 n1 ⊗ H 2 ) • H T 1 ⊗ 1 n2 + H T 1 ⊗ 1 m2 • (1 m1 ⊗ H 2 ) = H T 1 ⊗ H 2 + H T 1 ⊗ H 2 = 0.
The Tanner graph G Q of an hypergraph product code is equal to the Cartesian product of the classical Tanner graphs as represented in Figure 4.4. Formally, let V 1 (resp. V 2 ) be the set of bit-nodes of C 1 (resp. C 2 ), let C 1 (resp. C 2 ) be its set of checknodes and let G 1 (resp. G 2 ) be its Tanner graph. Then, the graph G Q is the Cartesian product of G 1 and G 2 defined in the following way:

-The qubits are indexed by the set

V Q := (V 1 × V 2 ) (C 1 × C 2 ) ( is the disjoint union).
-The X-type generators are indexed by the set

C Z := C 1 × V 2 .
-The Z-type generators are indexed by the set

C X := V 1 × C 2 . -Two nodes u 1 , u 2 ∈ V Q C X C Z are connected in G Q in two cases.
Either the first components of u 1 and u 2 are equal and their second components are connected in G 2 ; or their second components are equal and their first components are connected in G 1 .

The qubits belonging to V 1 × V 2 are called the VV-type qubits and the qubits belonging to C 1 × C 2 are called the CC-type qubits. The incidence relation of G Q defined above can be split in four cases:

-A VV-type qubit q ∈ V 1 × V 2 is in the support of an X-type generator (c 1 , v 2 ) ∈ C 1 × V 2 if and only if q = (v 1 , v 2 ) where v 1 is connected to c 1 in G 1 . -A VV-type qubit q ∈ V 1 × V 2 is in the support of a Z-type generator (v 1 , c 2 ) ∈ V 1 × C 2 if and only if q = (v 1 , v 2 ) where v 2 is connected to c 2 in G 2 . -A CC-type qubit q ∈ C 1 × C 2 is in the support of an X-type generator (c 1 , v 2 ) ∈ C 1 × V 2 if and only if q = (c 1 , c 2 ) where c 2 is connected to v 2 in G 2 . -A CC-type qubit q ∈ C 1 × C 2 is in the support of a Z-type generator (v 1 , c 2 ) ∈ V 1 × C 2 if and only if q = (c 1 , c 2 ) where c 1 is connected to v 1 in G 1 .
In Figure 4.4 where G Q is depicted, each column is a copy of G 1 and each row is a copy of G 2 . In particular, there is no edge between a qubit and a generator if they are not in the same row or in the same column. Therefore in G Q , there are

V 2 + C 2 = n 2 + m 2 copies of G 1 and V 1 + C 1 = n 1 + m 1 copies of G 2 .
The Tanner graph of the classical code C X used to correct X-type errors is the sub-graph of G Q induced by the set of VV-type qubits, the set of CC-type qubits and the set of Z-type generators (see the left part of

Parameters of an hypergraph product code

The goal of this section is to prove Theorem 4.9 below where the dimension and the minimal distance of an hypergraph product code are computed. Let C be a classical error correcting code with parity check matrix H. Then the transposed code C T is defined to be the classical code whose parity check matrix is H T . The code C T has the same Tanner graph as C where the bit-nodes and the check-nodes have been switched. In particular in Theorem 4.9, m 1 is the number of check-nodes of C 1 and m 2 is the number of check-nodes of C 2 . In the degenerate case where a code C = {0 N } is trivial, Theorem 4.9 uses the convention that C is an [n, 0, d] code with d = +∞. Theorem 4.9 ([108]). Let C 1 and C 2 be two classical error correcting codes and let n 1 ,

k 1 , d 1 , n 2 , k 2 , d 2 , m 1 , k T 1 , d T 1 , m 2 , k T 2 , d T 2 ∈ N be such that: C 1 is an [n 1 , k 1 , d 1 ] code, C T 1 is an [m 1 , k T 1 , d T 1 ] code, C 2 is an [n 2 , k 2 , d 2 ] code, C T 2 is an [m 2 , k T 2 , d T 2 ] code.
Then Q the hypergraph product of C 1 and C 2 is an [[N, K, D]] stabilizer code where:

(i) N = n 1 n 2 + m 1 m 2 , (ii) K = k 1 k 2 + k T 1 k T 2 , (iii) D = min(D X , D Z ), (iv) D X ≥ min(d T 1 , d 2 ), (v) D Z ≥ min(d 1 , d T 2 ).
The integers D X and D Z are the minimal distances associated to X-type and Z-type errors and moreover:

(vi) If k 1 = 0 and k 2 = 0 then D X ≤ d 2 and D Z ≤ d 1 . (vii) If k T 1 = 0 and k T 2 = 0 then D X ≤ d T 1 and D Z ≤ d T 2 .
(viii) Otherwise K = 0 and Q is trivial.

We split the proof of Theorem 4.9 into three parts: the proof of item (ii), the proof of item (iv) and the proof of item (vi). Item (i) is a direct consequence of the hypergraph product definition, item (iii) has already been proven in eq. (4.21), the proof of item (v) is similar to the proof of item (iv), the proof of item (vii) is similar to the proof of item (vi) and item (viii) is a consequence of item (ii).

Oftentimes, the parity check matrices of C 1 and C 2 are full rank with n 1 < m 1 and n 2 < m 2 . In that case, the codes C T 1 and C T 2 are reduced to the all-zero codeword and:

k 1 = n 1 -m 1 , k 2 = n 2 -m 2 , k T 1 = k T 2 = 0, d T 1 = d T 2 = +∞.
Moreover in the next sections, we will only consider the hypergraph product of a code C with itself. If C is an [n, k, d] code with m < n check-nodes and full rank parity check matrix then Theorem 4.9 becomes:

N = n 2 + m 2 = n 2 + (n -k) 2 , K = k 2 , D = D X = D Z = d.
When C defines a family of classical codes with rate r = k/n and linear minimal distance d = Θ(n), the corresponding hypergraph product is a family of CSS codes with rate r Q where:

N = Θ(n 2 ), 1 r Q = 1 r 2 + 1 r -1 2 , D = Θ √ N .
An interesting example where the parity check matrices are not full rank is given in Example 4.10 below.

Example 4.10 (Toric code). The toric code of length L ∈ N * can be defined as the hypergraph product of an L-bit repetition code C with itself. By definition, the L-bit repetition code C = C T is an [L, 1, L] linear code whose Tanner graph is a cycle of length 2L with L bit-nodes and L check-nodes. By Theorem 4.9, the toric code is a [[2L 2 , 2, L]] stabilizer code.

We now prove the statements of Theorem 4.9.

Proof of Theorem 4.9 (ii). First, we show using linear algebra that computing K is equivalent to computing k T X and k T Z the dimensions of C T X and C T Z . Let C be an [n, k] classical error correcting code (later we will take C ∈ {C 1 , C 2 , C X , C Z }) with m checknodes and with parity check matrix H. The rank-nullity theorem asserts that:

k = n -rank(H) and k T = m -rank(H T ).
Since rank(H) = rank(H T ), we have k = n -m + k T and for C ∈ {C 1 , C 2 , C X , C Z } we get:

k 1 = n 1 -m 1 + k T 1 , k X = n 1 n 2 + m 1 m 2 -n 1 m 2 + k T X , k 2 = n 2 -m 2 + k T 2 , k Z = n 1 n 2 + m 1 m 2 -m 1 n 2 + k T Z .
(4.23) Let G 1 be the sub-graph of

G 1 induced by V 1 C 1 and let G 2 be the sub-graph of G 2 induced by V 2 C 2 . Then the Tanner graph G Q is a sub-graph of G Q .
In a nutshell, the error E is equal to a product of X-type generators because its syndrome is empty for Q which has zero logical qubit. We provide more details below: Firstly, some of the Z-type generators have fewer neighbors in

G Q than in G Q . How- ever, for any X-type error E ⊆ V 1 × V 2 C 1 × C 2 included
in the qubits of Q , the syndrome of E does not depend on whether we are talking about Q or Q . In particular, the error E has an empty syndrome for both codes. Secondly, any error E 2 ⊆ V 2 included in the bits-nodes of C 2 has the same syndrome for C 2 and for C 2 . In particular, E 2 ≤ V 2 ≤ E < d 2 thus E 2 cannot have an empty syndrome except if E 2 = ∅. Hence the only codeword of C 2 is the all zero bit-string and thus the dimension of C 2 is zero. Similarly, the dimension of C T 1 is zero and using Theorem 4.9 (ii) we conclude that Q has zero logical qubit. Since the error E has an empty syndrome for Q , it can be written as a product of X-type generators. Thirdly, an X-type generator appearing in G Q has the same neighborhood in G Q and in G Q . In particular, E is a product of X-type generator for Q thus it is a product of X-type generator for Q.

Finally, the proof of item (vi) lies in finding a non trivial X-type error with empty syndrome and weight below d 2 under the assumptions k 1 , k 2 = 0.

Proof of Theorem 4.9 (vi). To prove the inequality D X ≤ d 2 , we show that if k 1 = 0 and k 2 = 0 then there exists an X-type error E ⊆ V Q of weight d 2 with an empty syndrome and which cannot be written as a product of X-type generators. The inequality D Z ≤ d 1 could be proven in the same way.

We emphasize that below, we use C ⊥ 1 the dual space of C 1 not to be confused with C T 1 . First, the inequality k 1 = 0 implies dim(C ⊥ 1 ) = n -k 1 < n and thus there exists at least one binary vector e 1 / ∈ C ⊥ 1 with Hamming weight equal to 1. Second, the inequality k 2 = 0 implies that there exists a codeword e 2 ∈ C 2 whose support

E 2 ⊆ V 2 satisfies E 2 = ∅. Let v 1 ∈ V 1 be the unique element in the support of e 1 , let v 2 ∈ E 2 and let E := {v 1 } × E 2 .
To conclude the proof, we show that E is not a product of X-type generators and has an empty syndrome.

If the error E was equal to a product of X-type generators then the error {v 1 } × {v 2 } would be equal to a product of X-type generators belonging to C 1 × {v 2 }. The X-type generators in C 1 × {v 2 } belong to the red column of Figure 4.7 which is a copy of the Tanner graph of C 1 . Hence e 1 / ∈ C ⊥ 1 implies that E cannot be a product of X-type generators.

The syndrome of E is included in the Z-type generators of {v 1 } × C 2 . These generators are represented by the blue row in Figure 4.7 which is a copy of the Tanner graph of C 2 and thus the statement e 2 ∈ C 2 implies that E has an empty syndrome for the hypergraph product code.

Quantum expander codes

Given C 1 , C 2 , two classical expander codes as defined in Section 3.2, the hypergraph product of C 1 and C 2 is called a quantum expander code [START_REF] Leverrier | Quantum expander codes[END_REF]. For simplicity in this manuscript, we focus on the particular case

C = C 1 = C 2 where C is an [n, Θ(n), Θ(n)]
expander code with a regular Tanner graph (see Section 3.2.4 for the existence of such codes). By Remark 4.8 and Theorem 4.9, the resulting quantum code is LDPC (but not regular) with parameters [[N, Θ(N ), Θ(

√ N )]]
where N = Θ(n 2 ). The main advantage of a quantum expander code compared to other families of hypergraph product codes is the possibility to analyze the performance of the small-setflip decoder [START_REF] Leverrier | Quantum expander codes[END_REF]. The small-set-flip decoder is similar to the bit-flip algorithm discussed in Section 3.2.3: the execution is divided into several rounds where the algorithm tries to reduce the syndrome weight. In the classical setting, a single bit is flipped at each round, but in the quantum case, a set of several qubits F has to be flipped if we wish to ensure the syndrome weight to decrease. When the small-set-flip decoder is used to correct X-type errors, the check-nodes are represented by the Z-type generators and the set F is selected among all possible subsets of an X-type generator support. A subset of an X-type generator support is called a small-set and the set of small-sets is denoted by F. As a summary, at each round, the small-set-flip algorithm decreases the syndrome weight by flipping a set of qubits F ∈ F.

This section is a review on the results of ref. [START_REF] Leverrier | Quantum expander codes[END_REF], in particular the small-set-flip algorithm is shown to correct any adversarial error with weight up to a fraction of the minimal distance. This section is organized as follows: in Section 4.3.1 we define the quantum expander codes and the small-set-flip decoder, and in Section 4.3.3 we analyze their behavior against adversarial errors. In Chapter 5, we will rely on the results presented in this section to show that quantum expander codes have a threshold for any local stochastic error model as defined in Section 2.3. In what follows, we describe the error correction procedure for X-type errors. In fact, for the hypergraph product of a code with itself, the Tanner graph of C X and C Z presented in Figure 4.5 are equal up to a permutation on the qubits. Hence, X-type errors and Z-type errors are corrected in the same way and without loss of generality, we deal with X-type errors only.

Definition

All along this section we use the notations defined below.

Notation 4.12. Let G be the Tanner graph of a classical expander code, let V be the set of bit-nodes, let C be the set of check-nodes and let Γ be the neighborhood in G. We assume that G has left degree d V , right degree d C and is a (γ, δ)-expander graph with γ > 0 and δ < 1/8. We denote by Q the associated quantum expander code, by V Q the set of qubits, by C X the set of Z-type stabilizer generators, by C Z the set of X-type stabilizer generators and by N the number of physical qubits:

V Q := V 2 C 2 , C X := V × C, C Z := C × V, N := V Q . For an X-type error E ⊆ V Q , the syndrome of E is denoted σ X (E) ⊆ C X .
In addition we define the following positive constants:

r := d V d C = C V , γ 0 = r 2 √ 1 + r 2 γ, β 0 := 1 -8δ, α 0 := rβ 0 4 + 2rβ 0 .
When a quantum expander code is decoded with the bit-flip algorithm used in the classical case, there exist constant weight errors which are not corrected. Figure 4.8 provides an example where the error is made of three VV-type qubits and two CC-type qubits in the support of an X-type generator g = (c, v) ∈ C X . In this example, the error weight is 5, the syndrome weight is 12, the Tanner graph of the initial classical code has left degree d V = 4 and right degree d C = 6, and the X-type generators have degree 10. The bit-flip decoder fails in correcting this error since no bit-flip decreases the syndrome weight. In particular, we can check that the syndrome weight is not modified when a single qubit belonging to the support of g is flipped.

For the example shown in Figure 4.8, the small-set-flip decoder proposed by ref. [START_REF] Leverrier | Quantum expander codes[END_REF] flips the five red qubits in one round. More generally, the decoding strategy is to decrease the syndrome weight by flipping a set of qubits called a small-set. By definition, a set F ⊆ V Q is a small-set if and only if it is included in the support of an X-type generator, i.e. if and only if F ∈ F 0 where:

F 0 := F ⊆ Γ Z (g) : g ∈ C Z . (4.25)
Given a syndrome σ ⊆ C X and a small-set F ∈ F 0 , we denote by ∆(σ, F ) the diminution of the syndrome weight when F is flipped:

∆(σ, F ) := σ -σ ⊕ σ X (F ) . (4.26)
In the original paper [START_REF] Leverrier | Quantum expander codes[END_REF], at each round, the small-set-flip algorithm flips a set of qubits F chosen to be the small-set F ∈ F 0 maximizing ∆(σ, F )/ F . In order to simplify the proofs in this manuscript, the selected set F is an arbitrary

F ∈ F 0 satisfying σ X (F ) ≥ d V
2 F and ∆(σ, F ) ≥ β 0 σ X (F ) (β 0 is defined in Notation 4.12). Our condition is more convenient for the case where the syndrome is noisy but the algorithm of [START_REF] Leverrier | Quantum expander codes[END_REF] and many other variants can be analyzed in the same way. Let:

F := F ∈ F 0 : σ X (F ) ≥ d V 2 F . (4.27)
We are now ready to define the small-set-flip decoder (Algorithm 2).

Algorithm 2 : the small-set-flip decoder.

Input: the syndrome σ ⊆ C X . // σ = σ(E) for some E ⊆ V Q Output: a guess for the error Ê ⊆ V Q . Ê0 = ∅ ; σ 0 = σ ; i = 0 // E 0 = E, σ 0 = σ(E 0 ) while ∃F i ∈ F : ∆(σ i , F i ) ≥ β 0 σ X (F i ) do
Pick such an

F i arbitrarily. // σ X (E i ) -σ X (E i ⊕ F i ) ≥ β 0 σ X (F i ) Êi+1 = Êi ⊕ F i // E i+1 = E i ⊕ F i σ i+1 = σ i ⊕ σ X (F i ) // σ i+1 = σ(E i+1 ) i = i + 1 end while return Êi
Similarly to the bit-flip algorithm (Algorithm 1) it is insightful to think about the set E i := E ⊕ Êi which represents the physical errors at each round of the algorithm (see Figure 3.3 for a graphical representation of E, E i and Êi ). The comments of Algorithm 2 mention the set E i and its relationship with the variables of the algorithm.

Weighted cardinality, reduced weight and reduced set

Before analyzing Algorithm 2, we introduce in Definition 4.13 below three convenient tools: the weighted cardinality, the reduced weight and the concept of reduced set. Definition 4.13. We use Notation 4.12. Let E ⊆ V Q = V 2 C 2 be an error set. The weighted cardinality E is defined by:

E := E ∩ V 2 d C + E ∩ C 2 d V .
The reduced weight of E denoted by E R is defined to be the minimum weight of an error equivalent to E:

E R := min E ∈C ⊥ Z E + E .
A set E ⊆ V Q is said to be reduced when |E| is minimal over the errors equivalent to E:

E is reduced ⇔ E = E R .
Similarly, a set E ⊆ V Q is said to be -reduced when E is minimal over the errors equivalent to E:

E is -reduced ⇔ E = min E ∈C ⊥ Z E + E .
As shown in Lemma 4.14 below, the weighted cardinality • shares a couple of properties with the usual the cardinality | • |. Lemma 4.14. We use Notation 4.12. Let E, E 1 , E 2 ⊆ V Q then:

(i) E ≥ 0, (ii) E = 0 ⇔ E = ∅, (iii) E 1 ⊆ E 2 ⇒ E 1 ≤ E 2 , (iv) d V E ≤ E ≤ d C E , (v) σ X (E) ≤ d V d C E , (vi) E 1 ∪ E 2 ≤ E 1 + E 2 , (vii) E 1 E 2 = E 1 + E 2 , (viii) E 1 ⊕ E 2 = E 1 + E 2 -2 E 1 ∩ E 2 .
Proof. For the usual cardinality, we already have:

E ≥ 0, E = 0 ⇔ E = ∅, E 1 ⊆ E 2 ⇒ E 1 ≤ E 2 , E 1 ∪ E 2 ≤ E 1 + E 2 , E 1 E 2 = E 1 + E 2 , E 1 ⊕ E 2 = E 1 + E 2 -2 E 1 ∩ E 2 .
It is a direct consequence to show items (i), (ii), (iii), (vi), (vii), (viii) where

| • | is replaced by • . The inequality d V ≤ d C implies item (iv).
Finally, by linearity, it is sufficient to show item (v) in the two particular cases E ⊆ V 2 and E ⊆ C 2 . For example when E ⊆ V 2 :

σ X (E) = e∈E σ X {e} ≤ e∈E σ X {e} = d V E = d V d C E .
In addition, all along this manuscript we will use the handy property of Lemma 4.15 below. Lemma 4.15. We use Notation 4.12.

Let E 1 ⊆ E 2 ⊆ V Q be two errors. If E 2 is -reduced (resp. reduced) then E 1 is -reduced (resp. reduced).
Proof. Let's prove that E 1 ≤ E 1 ⊕ E holds for any E ∈ C ⊥ Z . By Lemma 4.14 (viii):

E 1 ⊕ E -E 1 = E 1 + E -2 E 1 ∩ E -E 1 = E -2 E 1 ∩ E .
Similarly:

E 2 ⊕ E -E 2 = E -2 E 2 ∩ E ,
and by Lemma 4.14 (iii):

E 1 ∩ E ≤ E 2 ∩ E . Since E 2 is -reduced, for all E ∈ C ⊥ Z : 0 ≤ E 2 ⊕ E -E 2 = E -2 E 2 ∩ E ≤ E -2 E 1 ∩ E = E 1 ⊕ E -E 1 .
Hence E 1 is -reduced. The same proof also works when replacing • with | • |. In this section, we show in Proposition 4.16 that any error with weight up to Θ( √ N ) is corrected by Algorithm 2. For simplicity, we assume that the expansion parameter δ of Notation 4.12 satisfies δ < 1/8, but as stated in Theorem 2 of ref. [START_REF] Leverrier | Quantum expander codes[END_REF], the result still hold under the weaker hypothesis δ < 1/6. Proposition 4.16 (Lemma 10 of [START_REF] Leverrier | Quantum expander codes[END_REF]). We use Notation 4.12. Let E ⊆ V Q be an error satisfying E ≤ 2α 0 γ 0 √ N . Then E is corrected by the small-set-flip algorithm. In other words, if we run Algorithm 2 on input σ X (E) then the output Ê is equivalent to E.

Errors in the adversarial setting [67]

The proof of Proposition 4.16 is given at the end of this section which is organized in such a manner that we will be able to reuse the intermediate results in Chapter 5.

We start with a quick proof sketch for Proposition 4.16. Assume Algorithm 2 runs on input σ X (E) where E ⊆ V Q is an error and E = O( √ N ). For each round i, let E i := E ⊕ Êi be the physical error on the qubits as defined in the comments of Algorithm 2. First, we show that

E i = O( √ N
) holds for all i. We already know that

E 0 = E = O( √ N )
and by the LDPC property, the weight of the initial syndrome

σ 0 = σ X (E 0 ) satisfies |σ 0 | = O( E 0 ) = O( √ N ).
At each round of the algorithm, a small-set F i is flipped and the syndrome weight decreases. In other words, the weight of the physical error changes by the quantity 1) and the syndrome weight decrease at least by one. Finally:

|E i+1 | -|E i | ≤ |F i | = O(
|E i | = |E 0 | + O(|σ 0 |) = O( √ N ).
By definition, the error is corrected if the algorithm stops when the physical error E i is trivial (equivalent to the empty error). By contraposition, to prove Proposition 4.16, it is sufficient to show the following assertion: if the physical error E i is not trivial and satisfies

|E i | = O( √ N
) then the algorithm does not stop at round i. In fact, showing the last statement is the main difficulty in the proof of Proposition 4.16. The solution proposed by the authors of ref. [START_REF] Leverrier | Quantum expander codes[END_REF] is to use the notion of critical generator defined in Definition 4.17 below. In a nutshell, if an X-type generator is critical then flipping the appropriate small-set in its support will decrease the syndrome weight.

The definition of critical generator is a bit technical thus we provide a schematic representation in Figure 4.9. The idea is to rely on the observation that, for an hypergraph product code, the support of any X-type generator (c 1 , v 2 ) ∈ C × V has the following shape:

-The VV-type qubits in the support of (c 1 , v 2 ) are the elements of Γ(c 1 ) × {v 2 }.

-The CC-type qubits in the support of (c 1 , v 2 ) are the elements of {c 1 } × Γ(v 2 ).

-The Z-type generators connected to the support of (c 1 , v 2 ) are the elements of

Γ(c 1 ) × Γ(v 2 ).
The latter point means that the rectangle Γ(c 1 ) × Γ(v 1 ) in the Tanner graph of Figure 4.9 represents the set of check-nodes affected by at least one qubit of the support of (c 1 , v 2 ). Informally, (c 1 , v 2 ) is a critical generator when:

-The VV-type qubits in Γ(c 1 )×{v 1 } can be partitioned using three sets Γ 1 , Γ 1 , Γ 1 ⊆ V (see item [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF] in Definition 4.17).

In what follows, we say "a qubit of Γ 1 " (resp. Γ 1 , resp. Γ 1 ) to talk about the qubits of

Γ 1 × {v 1 } (resp. Γ 1 × {v 1 }, resp. Γ 1 × {v 1 }).
-The CC-type qubits in {c 1 }×Γ(v 1 ) can be partitioned using three sets Γ 2 , Γ 2 , Γ 2 ⊆ C (see item [START_REF] Aliferis | Quantum accuracy threshold for concatenated distance-3 codes[END_REF] in Definition 4.17).

In what follows, we say "a qubit of Γ 2 " (resp. Γ 2 , resp. Γ 2 ) to talk about the qubits of

{c 1 } × Γ 2 (resp. {c 1 } × Γ 2 , resp. {c 1 } × Γ 2 ).
-The qubits of Γ 1 and Γ 2 are in the error (see items ( 3) and ( 4) in Definition 4.17)

-The qubits of Γ 1 and Γ 2 are not in the error (see items ( 5) and ( 6) in Definition 4.17).

-The qubits of Γ 1 and Γ 2 can be either in the error or outside the error but there are few such qubits (see items ( 8) and ( 9) in Definition 4.17).

-For any qubit q of Γ 1 , Γ 1 , Γ 2 or Γ 2 and for any check-node c connected to q, if a qubit q = q is in the support of c then q is not in the error (see items [START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF] to [START_REF] Nikolas P Breuckmann | Hyperbolic and semi-hyperbolic surface codes for quantum storage[END_REF] in Definition 4.17).

As shown in the proof of Lemma 4.19 below, when a critical generator exists, the while loop condition of Algorithm 2 is satisfied by the small-set whose elements are the qubits of Γ 1 and Γ 2 . As a consequence, showing the existence of a critical generator is sufficient to prove that the algorithm does not stop. Definition 4.17 (Critical generator, Definition 6 of [START_REF] Leverrier | Quantum expander codes[END_REF]). We use Notation 4.12. A critical generator for an error

E ⊆ V Q is an X-type generator (c 1 , v 2 ) ∈ C Z such that there exist Γ 1 , Γ 1 , Γ 1 ⊆ V and Γ 2 , Γ 2 , Γ 2 ⊆ C with: (1) Γ(c 1 ) = Γ 1 Γ 1 Γ 1 , (2) Γ(v 2 ) = Γ 2 Γ 2 Γ 2 , (3) Γ 1 × {v 2 } ⊆ E, ( 4
) {c 1 } × Γ 2 ⊆ E, (5) Γ 1 × {v 2 } ⊆ V 2 \ E, (6) {c 1 } × Γ 2 ⊆ C 2 \ E, (7) Γ 1 + Γ 2 = 0, (8) Γ 1 ≤ 2δd C , (9) Γ 2 ≤ 2δd V ,
and for all

v 1 ∈ Γ 1 , v 1 ∈ Γ 1 , c 2 ∈ Γ 2 and c 2 ∈ Γ 2 : (10) E ∩ {v 1 } × Γ(c 2 ) = (v 1 , v 2 ) (11) E ∩ Γ(v 1 ) × {c 2 } = (c 1 , c 2 ) (12) E ∩ {v 1 } × Γ(c 2 ) = ∅ (13) E ∩ Γ(v 1 ) × {c 2 } = (c 1 , c 2 ) (14) E ∩ {v 1 } × Γ(c 2 ) = (v 1 , v 2 ) (15) E ∩ Γ(v 1 ) × {c 2 } = ∅ (16) E ∩ {v 1 } × Γ(c 2 ) = ∅ (17) E ∩ Γ(v 1 ) × {c 2 } = ∅
Using expansion based arguments, we can show the existence of critical generators for errors of weight O( √ N ).

Lemma 4.18 (Lemma 7 of [START_REF] Leverrier | Quantum expander codes[END_REF]). We use Notation 4.12.

Let E ⊆ V Q be an error with 0 < E ≤ γ C then there exists a critical generator for E.

Proof. We denote by E V := E ∩ V 2 the error on the VV-type qubits and by E C := E ∩ C 2 the error on the CC-type qubits. In this proof, we find a critical generator (c 1 , v 2 ) in the case where E V = ∅. If E V = ∅ then E C = ∅ and the proof works in the same way exchanging the roles of V and C. Hence we assume E V = ∅ and we denote by

E 1 V , E 2 V ⊆ V and E 1 C , E 2 C
⊆ C the projections of E V and E C on their first and second coordinates:

E 1 V := v 1 ∈ V : ∃v 2 ∈ V, (v 1 , v 2 ) ∈ E V , E 2 V := v 2 ∈ V : ∃v 1 ∈ V, (v 1 , v 2 ) ∈ E V , E 1 C := c 1 ∈ C : ∃c 2 ∈ C, (c 1 , c 2 ) ∈ E C , E 2 C := c 2 ∈ C : ∃c 1 ∈ C, (c 1 , c 2 ) ∈ E C . Since 0 < E V ≤ E ≤ γ C ≤ γ V , we also have 0 < E 2 V ≤ γ V . By Lemma 3.5: Γ u (E 2 V ) ≥ d V E 2 V (1 -2δ), (4.28)
where the notation Γ u is defined in Notation 3.4 and refers to Γ the neighborhood in the initial expander graph. Hence the mean value of

Γ u (E 2 V ) ∩ Γ(v 2 ) over v 2 ∈ E 2 V satisfies: 1 E 2 V v2∈E 2 V Γ u (E 2 V ) ∩ Γ(v 2 ) ≥ 1 E 2 V Γ u (E 2 V ) ∩ v2∈E 2 V Γ(v 2 ) = Γ u (E 2 V ) E 2 V ≥ d V (1 -2δ).
Thus there exists at least one vertex

v 2 ∈ E 2 V with Γ u (E 2 V ) ∩ Γ(v 2 ) ≥ d V (1 -2δ).
We define the set A 1 ⊆ C by:

A 1 := Γ u (E 2 V ) ∩ Γ(v 2 ).
• In the second case where A 1 ∩ E 2 C = ∅, we define A 2 ⊆ C by:

A 2 := c 2 ∈ C : ∃c 1 ∈ A 1 , (c 1 , c 2 ) ∈ E C .
We have 0 < A 2 ≤ E 2 C ≤ γ C and the same argument as the one used below eq. (4.28) ensures that there exists

c 1 ∈ A 2 such that Γ u (A 2 ) ∩ Γ(c 1 ) ≥ d C (1 -2δ).
We define A 3 := Γ u (A 2 ) ∩ Γ(c 1 ) and:

Γ 1 := E 1 V ∩ A 3 Γ 1 := (V \ E 1 V ) ∩ A 3 Γ 1 := Γ(c 1 ) \ A 3 Γ 2 := E 2 C ∩ A 1 Γ 2 := (C \ E 2 C ) ∩ A 1 Γ 2 := Γ(v 2 ) \ A 1
Lemma 4.18 establishes the existence of a critical generator when the error is small enough. The next step provided by Lemma 4.19 is to use this critical generator to construct a small-set F such that flipping F decreases the syndrome weight. Lemma 4.19 (Lemma 8 of [START_REF] Leverrier | Quantum expander codes[END_REF]). We use Notation 4.12.

Let E R ⊆ V Q be a -reduced error such that 0 < E R ≤ γ 0 √ N /d V , then there exists a small-set F ∈ F with F ⊆ E R and: (i) σ X (F ) ≥ 1 2 d V d C F , (ii) ∆(σ X (E R ), F ) ≥ σ X (F ) -4δd V d C F .
Proof. We have:

E R ≤ d C E R ≤ γ 0 √ N /r = γ r √ 1 + r 2 √ N = γ r √ 1 + r 2 V 2 + C 2 = γ C .
By Lemma 4.18 there exists a critical generator (c 1 , v 2 ) ∈ C Z for E R and the associated sets

Γ 1 , Γ 1 , Γ 1 , Γ 2 , Γ 2 , Γ 2 defined in Definition 4.17. Let F := Γ 1 × {v 2 } {c 1 } × Γ 2 . Then F ⊆ E R .
For this proof, we extend the notation • of Definition 4.13 to any set A 1 ⊆ V and to any set A 2 ⊆ C by the formulas:

A 1 := A 1 d C , A 2 := A 2 d V .
We have:

σ X (F ) = Γ 1 × Γ(v 2 ) \ Γ 2 Γ(c 1 ) \ Γ 1 × Γ(c 1 ) = Γ 1 × Γ 2 Γ 2 Γ 1 Γ 1 × Γ(c 1 ) .
Thus:

σ X (F ) = Γ 1 Γ 2 + Γ 2 + Γ 2 Γ 1 + Γ 1 = d V d C Γ 1 Γ 2 + Γ 2 + Γ 2 Γ 1 + Γ 1 = d V d C Γ 1 1 -Γ 2 + Γ 2 1 -Γ 1 . But F = Γ 1 + Γ 2 , thus: σ X (F ) d V d C F = 1 - 2 Γ 1 Γ 2 Γ 1 + Γ 2 . (4.29) Note that 0 < Γ 1 + Γ 2 because 0 < Γ 1 + Γ 2 . Let S := Γ(c 1 ) × {v 2 } {c 1 } × Γ(v 2
) be the support of the generator (c 1 , v 2 ) and let F := S \ F . The sets F and F are equivalent and F is -reduced since it is a subset of the -reduced set E R (see Lemma 4.15) hence the following two properties hold:

F ≤ F , F + F = S = 2.
As a consequence:

F ≤ 1, Γ 1 ≤ 1 -Γ 2 .
A function analysis shows that

Γ 1 → Γ 1 Γ 2 Γ 1 + Γ 2
is non-decreasing and thus:

Γ 1 Γ 2 Γ 1 + Γ 2 ≤ 1 -Γ 2 Γ 2 ≤ 1 4 .
Lemma 4.19 (i) is a consequence of the latter upper bound and eq. (4.29). We also have F ∈ F by Lemma 4.14 (iv):

σ X (F ) ≥ 1 2 d V d C F ≥ d V 2 F .
For Lemma 4.19 (ii), we lower bound ∆ σ X (E R ), F using the inequalities Γ 1 ≤ 2δ and Γ 2 ≤ 2δ:

∆ σ X (E R ), F ≥ Γ 1 Γ 2 + Γ 2 Γ 1 -Γ 1 Γ 2 -Γ 2 Γ 1 = σ X (F ) -2d V d C Γ 1 Γ 2 + Γ 2 Γ 1 ≥ σ X (F ) -4δd V d C Γ 1 + Γ 2 = σ X (F ) -4δd V d C F .
By Lemma 4.19, for an error E R ⊆ V Q satisfying the right hypothesis, there exists a small-set F ⊆ E R such that flipping F decreases the syndrome weight. When we apply Lemma 4.19 iteratively, we can write E R as a disjoint union of small-sets as shown in Lemma 4.20 below. Lemma 4.20. We use Notation 4.12.

Let E R ⊆ V Q be a -reduced error such that E R ≤ γ 0 √ N /d V .
Then there exists an integer f ∈ N and small-sets F 0 , . . . , F f -1 ∈ F such that:

(i) E R = f -1 i=0 F i , (ii) σ X (E R ) ≥ f -1 i=0 σ X (F i ) - f -1 i=0 4δd V d C F i .
In addition we have:

(iii) σ X (E R ) ≥ β 0 d V d C 2 E R .
Proof. We use an induction to define the small-sets F 0 , . . . , F f -1 ∈ F as well as some -reduced sets E 0 , . . . ,

E f ⊆ V Q with E i ≤ γ 0 √ N /d V . Let E 0 := E R . By hypothesis, E 0 is -reduced and E 0 ≤ γ 0 √ N /d V .
Assume by the induction hypothesis that the -reduced set E i has already been defined and satisfies

E i ≤ γ 0 √ N /d V . Lemma 4.19 applied to E i provides the desired small-set F i ⊆ E i and we define E i+1 := E i ⊕ F i = E i \ F i . The set E i+1 is
-reduced as a subset of the -reduced set E i (see Lemma 4.15) and satisfies

E i+1 ≤ E i ≤ γ 0 √ N /d V .
Let f ∈ N be the number of rounds after which Lemma 4.19 cannot be applied anymore.

The set E f is also -reduced and satisfies

E f ≤ γ 0 √ N /d V .
Hence we necessarily have E f = 0 and thus item (i) holds. Item (ii) holds by Lemma 4.19 (ii):

σ X (E R ) = σ X (E 0 ) = f -1 i=0 ∆(σ X (E i ), F i ) ≥ f -1 i=0 σ X (F i ) - f -1 i=0 4δd V d C F i .
Finally, when we combine items (i) and (ii) with Lemma 4.19 (i) we get item (iii):

σ X (E R ) ≥ f -1 i=0 σ X (F i ) - f -1 i=0 4δd V d C F i ≥ β 0 d V d C 2 f -1 i=0 F i = β 0 d V d C 2 E R .
Item (iii) of Lemma 4.20 asserts that the syndrome weight of a small -reduced error E R can be lower bounded by a linear function of E R . This property is called soundness and, as stated in Lemma 4.21, a similar lower bound can be derived using the usual cardinality | • | instead of • . Lemma 4.21 (Soundness, Corollary 9 of [START_REF] Leverrier | Quantum expander codes[END_REF]). We use Notation 4.12 and | • | R from Definition 4. [START_REF] Bravyi | Quantum advantage with shallow circuits[END_REF].

If E ⊆ V Q satisfies E R ≤ γ 0 √ N then: σ X (E) ≥ β 0 d V 2 E R .
Proof. Let E 1 be a reduced error equivalent to E and let E 2 be a -reduced error equivalent to E then:

E 2 ≤ E 1 ≤ 1 d V E 1 = 1 d V E R ≤ γ 0 d V √ N .
We can conclude using Lemma 4.20 (iii):

σ X (E) = σ X (E 2 ) ≥ β 0 d V d C 2 E 2 ≥ β 0 d V 2 E 2 ≥ β 0 d V 2 E 1 = β 0 d V 2 E R .
To conclude this section, we prove Proposition 4.16.

Proof of Proposition 4.16. We run the small-set-flip algorithm (Algorithm 2) on input E, we denote by Ê ⊆ V Q the output of the algorithm, by f ∈ N the number of rounds and we use the notations σ i and F i from the body of Algorithm 2.

We also define U := E ∪ F 0 ∪ . . . ∪ F f -1 called the execution support. This set will be a key notion when we will deal with stochastic noise in Section 5.1. Informally, a qubit is an element of U ⊆ V Q if and only if there is an error on that qubit at some point of the algorithm. Each F i belongs to the set

F := F ∈ F 0 : σ X (F ) ≥ d V
2 F thus we have:

σ i -σ i+1 = ∆(σ i , F i ) ≥ β 0 σ X (F i ) ≥ β 0 d V 2 F i .
Hence we can lower bound the weight of the initial syndrome by:

σ X (E) = σ 0 ≥ σ 0 -σ f = f -1 i=0 σ i -σ i+1 ≥ β 0 d V 2 f -1 i=0 F i . But σ X (E) ≤ d C E thus i F i ≤ 2
β0r E and the size of the execution support is upper bounded linearly with the size of the initial error:

|U | ≤ E + f -1 i=0 F i ≤ 1 2α 0 E .
Let E R be a -reduced error equivalent to E ⊕ Ê then:

E R ≤ E ⊕ Ê ≤ 1 d V E ⊕ Ê ≤ 1 d V U ≤ 1 2d V α 0 E ≤ γ 0 √ N d V .
To show Proposition 4.16, it is sufficient to prove that E R = ∅. Suppose by contradiction that E R = 0 then all the hypotheses of Lemma 4.19 hold and thus there exists F ∈ F such that:

∆ σ X (E R ), F ≥ σ X (F ) -4δd V d C F ≥ β 0 σ X (F ) .
In other words, the while loop condition of the small-set-flip algorithm (Algorithm 2) is satisfied for σ i = σ X (E R ). But since Ê is the output of the algorithm, the while loop condition is not satisfied for σ i = σ X (E ⊕ Ê) = σ X (E R ) and we get a contradiction.

Chapter 5

Small-set-flip algorithm with noisy syndrome measurements

In this chapter are presented the results we get during this PhD concerning the decoding of quantum expander codes with the small-set-flip algorithm. These results are summarized by the following points:

• Analysis of the decoder when the error on the qubits is generated with a local stochastic noise model.

• Analysis of the decoder when the syndrome measurements are noisy.

• Showing that the decoder has the single-shot property.

• Parallelization of the decoder.

• Numerical simulations of the decoder.

We start this introduction with a discussion about local stochastic error models. We use the small-set-flip algorithm to correct a quantum expander code with block-length N subjected to bit-flip errors. In Section 4.3, we have already reported the results of ref. [START_REF] Leverrier | Quantum expander codes[END_REF] where any adversarial error with weight O( √ N ) is shown to be corrected. However, in a practical situation such as fault-tolerant quantum computation (where the goal is to build quantum circuits working even if their basic components are noisy), a natural hypothesis is to assume that each qubit has a non-zero probability to be in the error support. For such an error model, the results of Section 4.3 are not sufficient because a typical error has linear weight.

One of the noise models we could think about is the iid error model, where each qubit belongs to the error support with some probability p phys ∈ (0, 1] independently from the other qubits. However, the independence assumption is not suitable for fault-tolerant quantum computation. For instance, a controlled-not gate acts on two qubits and, when this gate is noisy, it will probably create a correlated error on the qubits (here we are talking about correlation in the probability distribution of the support, not about quantum correlations). On the other hand, we cannot ask a family of quantum codes to correct an error with arbitrary correlations. Take as an example the noise model where the error is empty with probability 1 -p phys and a logical error occurs with probability p phys . Even though each qubit belongs to the error support with probability at most p phys , no code family can correct the resulting error with high probability.

In this manuscript, the only constraint we ask for a noise model to be valid is to satisfy the local stochastic property defined below. In addition, we will also assume that the small-set-flip decoder takes as input a noisy syndrome. This hypothesis is necessary in the context of fault-tolerant quantum computation because the circuit used to measure the stabilizer generators is noisy. Let V Q be the set of physical qubits and let C X be the set of check-nodes, then the error is described by two random sets E ⊆ V Q and D ⊆ C X . The set E contains the qubits affected by an X-Pauli error and D is the set of faulty syndrome bits. A noise model is local stochastic with parameter (p phys , p synd ) when for all S ⊆ V Q and for all T ⊆ C X :

P S ⊆ E and T ⊆ D ≤ p |S| phys p |T | synd .
(

Informally, eq. ( 5.1) means that the probability for an error pattern to be in the error support decreases exponentially with its size. Let E ⊆ V Q and D ⊆ C X be generated with a local stochastic error model with parameter (p phys , p synd ) and let σ X (E) be the syndrome of E. The small-set-flip algorithm takes as input the observed syndrome σ X (E) ⊕ D and outputs some set Ê ⊆ V Q on which X-Pauli matrices are applied to try to correct E. The set E ⊕ Ê is called the residual error and represents the qubits on which a physical error remains after correction. We will show the existence of a threshold p 0 > 0 such that if p phys < p 0 and p synd < p 0 then the residual error is described by a local stochastic noise with controlled parameter. In addition, the correction is performed with a single round of syndrome measurement, this feature is called single-shot error correction [START_REF] Bombín | Single-shot fault-tolerant quantum error correction[END_REF].

We will also explain how the small-set-flip decoder can be parallelized. On the one hand, if the syndrome measurement is perfect, running the parallel algorithm for a logarithmic number of rounds is sufficient to correct entirely the error with high probability (i.e. the residual error is equivalent to the empty error with high probability). On the other hand, if the syndrome measurement is noisy then, with high probability, running the parallel algorithm for a constant number of rounds leads to a residual error described by a local stochastic error model with small parameter.

When we compute numerical lower bounds on the threshold p 0 by theoretical arguments, the value we get is not reasonable (∼ 10 -58 ). Hence, in order to get an idea on the real value of p 0 , we have performed some simulations for the sequential algorithm with perfect syndrome measurements. Our results yield a threshold of 4.5% for a family of quantum expander codes with rate 1/61 and 2% for a family with rate 20%.

As a conclusion, using ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF], our results allow to design fault-tolerant protocols with constant space overhead as described in Chapter 6. For more details and a technical discussion about the content of this introduction, see Section 2.7. This chapter is organized as follows: Section 5.1 analyses the sequential small-set-flip decoder, Section 5.2 analyses the parallel version and Section 5.3 summarizes the numerical simulations.

Sequential decoding

The goal of this section is to show the following: when a local stochastic error is corrected by the small-set-flip algorithm with noisy syndrome measurements, the residual error E ⊕ Ê is equivalent to a local stochastic error E ls . By the definition given in eq. (5.1), E ls is local stochastic if for all S ⊆ V Q , we can upper bound the probability of the event {S ⊆ E ls } with a quantity exponentially small in |S|. By assumption, for all T ⊆ C X , we already have a similar upper bound on the probability for the event {T ⊆ D} to happen. As shown in this section, for all S ⊆ V Q , the hypothesis S ⊆ E ⊕ Ê implies the existence of a large set T ⊆ D. More precisely, we will find a set of qubits W that we will call a witness and the set T will be the check-nodes of D whose support contains a qubit of W . Finally, P[S ⊆ E ls ] is upper bounded by the probability for a witness to exist and, since the corresponding set T is large and satisfies T ⊆ D, we will show that this probability is exponentially small. Before looking at local stochastic noise, the first part of the analysis deals with adversarial errors whose weight is below the minimal distance. In that case, the size of the residual error is shown to be upper bounded by a linear function of |D|. The proof for local stochastic noise will rely on this result and on arguments from percolation theory.

From now on, the small-set-flip decoder presented in Section 4.3 (Algorithm 2) will not be used anymore, it is replaced by Algorithm 3 below. The only difference between these two algorithms is the while loop condition where the constant β 0 = 1 -8δ is replaced by β 1 = 1/2 -8δ < β 0 (the real number δ is the expansion parameter of the classical Tanner graph). In particular, since β 1 > 0 is required for the analysis of this chapter to work, δ must satisfy δ < 1/16 whereas δ < 1/8 was sufficient in the case of noiseless syndrome measurement. We also change the notation σ to σ to remind the reader that σ represents a faulty syndrome.

At each round of Algorithm 3, an element of F is flipped where F is the small-set ensemble as defined in eq. (4.27):

F := F ⊆ Γ Z (g) : g ∈ C Z and σ X (F ) ≥ d V 2 F .
In addition, for all σ ⊆ C X and F ∈ F, the quantity ∆( σ, F ) used in Algorithm 3 has been defined in eq. (4.26) by:

∆( σ, F ) := σ -σ ⊕ σ X (F ) .
When the observed syndrome is σ and the small-set F is flipped, the syndrome weight decreases by ∆( σ, F ) units.

c 0 := 4 d V β 1 , c 1 := β 1 β 0 (1 -β 1 ) , c 2 := 2 1 -β 1 , α 0 := rβ 0 4 + 2rβ 0 , α 1 := rβ 1 4 + 2rβ 1 , c 3 := 1 2α 1 , c 4 := 1 2α 1 -1, d G := d C (d C + 2d V -2).
The syndrome adjacency graph. The notion of syndrome adjacency graph will be used in Section 5.1.3. We will perform a percolation process on its vertices to study the typical shape of a random error. We define G called the syndrome adjacency graph of the code in the following way: G is equal to the Tanner graph of C X (see the left part of Figure 4.5) with additional edges between the qubits which share an X-type or a Z-type generator. In other words, the set of vertices of G is indexed by V := V ∪ C X , a Z-type generator is incident to the qubits in its support and two qubits are linked when they are both in the support of the same generator. We denote by Γ Q the neighborhood in the Tanner graph of Q, by Γ X the neighborhood in the Tanner graph of C X , by Γ G the neighborhood in the graph G and we point out that the degree of G is upper bounded by the integer d G defined above.

Errors below minimal distance

The first step in the analysis of Algorithm 3 is to address the case where the error has weight O( √ N ). In Section 4.3.3, we assumed perfect syndrome measurement and in this section, we tackle the case where the syndrome is noisy. The main result is Let E i := E ⊕ Êi be the physical error on the qubits at round i. In what follows, a small-set is said to be valid for Algorithm 2 (resp. Algorithm 3) when it satisfies the while loop condition of Algorithm 2 (resp. Algorithm 3). Hence, a small-set

F ∈ F is valid if and only if the difference between |σ X (E i )| and |σ X (E i ⊕ F )| is at least β 0 |σ X (F )| (resp. β 1 |σ X (F )|).
In Section 4.3.3 where we wanted to show that the residual is trivial (i.e. equivalent to an empty error), the critical point was to prove that Algorithm 2 does not stop as long as E i is not trivial. It is indeed the case by Lemma 4.19: if E i is not trivial then a valid small-set for Algorithm 2 exists. Similarly here, we will show that the condition |E i | R > c 0 |D| implies the existence of a valid small-set for Algorithm 3. When |E i | R > c 0 |D|, the set E i is not trivial and we have a valid small-set F for Algorithm 2, but unfortunately, since the check-nodes adjacent to F could be affected by the syndrome error, F is not guaranteed to be valid for Algorithm 3 as well.

The solution is to strengthen the statement of Lemma 4.19: we decompose the error as a disjoint union of small-sets F 0 , . . . , F f -1 (as we did in Lemma 4.20) and we show that several small-sets among F 0 , . . . , F f -1 are valid for Algorithm 3. The technical idea is to compute the average of σ ∩ σ X (F i ) over the F i to give a lower bound on the number of F i which are valid for Algorithm 3. Finally we get Lemma 5.1 below: there exists a set of small-sets F * ⊆ F which are valid for Algorithm 3. More precisely, the small-sets belonging to F * are valid for Algorithm 3 by item (i), these small-sets do not intersect by item (ii) and item (iii) provides a lower bound on the size of F * . Note that if c 1 σ X (E) < c 2 D then the lemma is pointless since F * could be empty, but otherwise the lower bound of item (iii) is non-trivial. As a summary, Lemma 5.1 improves Lemma 4.19 in two ways: firstly, it can be applied even if the syndrome is noisy and secondly, it provides many valid small-sets instead of a single one. This second point will be useful to parallelize the algorithm in Section 5.2.

Lemma 5.1. We use the notations of Section 5.1.1. If E ≤ γ 0 √ N then there exists F * ⊆ F such that:

(i) ∆( σ, F ) ≥ β 1 σ X (F ) for all F ∈ F * , (ii) F ∩ F = ∅ for all F, F ∈ F * with F = F , (iii) F ∈F * σ X (F ) ≥ c 1 σ X (E) -c 2 D .
Proof. Let E R be the -reduced error equivalent to E then:

E R ≤ E ≤ 1 d V E ≤ γ 0 d V √ N .
Applying Lemma 4.20 to E R provides some small-sets F 0 , . . . , F f -1 .

Let us start by providing an overview of how we will proceed in this proof. By Lemma 4.20 (i) we have:

σ X (E) = σ X (E R ) = f -1 i=0 σ X (F i )
and a union bound yields

σ X (E) ≤ f -1 i=0 σ X (F i ) .
In fact, we will prove in eq. (5.2) below that that this upper bound is nearly tight:

σ X (E) ≥ β 0 f -1 i=0 σ X (F i )
where β 0 defined in Section 5.1.1 is arbitrarily close to 1 when δ is small. Intuitively, this means that the intersection of the sets σ X (F i ) is small and thus σ X (E) ∩ σ X (F i ) is generally large. This is still true if the size of the syndrome error D is small, i.e., it holds that σ ∩ σ X (F i ) is generally large. Hence, we will obtain Lemma 5.1 by computing the average of the quantity σ ∩ σ X (F i ) over the sets F i . We now provide the details:

σ X (E) = σ X (E R ) ≥ f -1 i=0 σ X (F i ) - f -1 i=0 4δd V d C F i by Lemma 4.20 (ii), = f -1 i=0 σ X (F i ) -4δd V d C E R by Lemma 4.20 (i), ≥ f -1 i=0 σ X (F i ) - 8δ β 0 σ X (E)
by Lemma 4.20 (iii).

Hence we have:

σ X (E) ≥ 1 + 8δ β 0 -1 f -1 i=0 σ X (F i ) = β 0 f -1 i=0 σ X (F i ) . ( 5.2)
The relation between ∆( σ, F ) and σ ∩ σ X (F ) is given by:

∆( σ, F ) = σ -σ ⊕ σ X (F ) = 2 σ ∩ σ X (F ) -σ X (F ) (5.3)
where we have used the equality

A 1 ⊕ A 2 = A 1 + A 2 -2 A 1 ∩ A 2 .
We define the set F * promised in Lemma 5.1 by:

F * := F ∈ {F 0 , . . . , F f -1 } : ∆( σ, F ) ≥ β 1 σ X (F ) .
Lemma 5.1 (i) holds by definition of F * . Lemma 5.1 (ii) holds because the property E R = i F i from Lemma 4.20 (i) implies that the sets F i are disjoint. Moreover by eq. ( 5.3), when

F ∈ {F 0 , . . . , F f -1 } \ F * : σ ∩ σ X (F ) ≤ 1 + β 1 2 σ X (F ) . ( 5.4)
On the one hand, eqs. (5.2) and (5.4) give an upper bound on the sum S :=

f -1 i=0 σ ∩ σ X (F i ) : S = Fi∈F * σ ∩ σ X (F i ) + Fi / ∈F * σ ∩ σ X (F i ) ≤ Fi∈F * σ X (F i ) + 1 + β 1 2 Fi / ∈F * σ X (F i ) by eq. (5.4), = 1 -β 1 2 Fi∈F * σ X (F i ) + 1 + β 1 2 f -1 i=0 σ X (F i ) ≤ 1 -β 1 2 Fi∈F * σ X (F i ) + 1 + β 1 2β 0 σ X (E)
by eq. (5.2).

On the other hand, the property

E R = i F i from Lemma 4.20 (i) implies that σ X (E) = σ X (E R ) = f -1 i=0 σ X (F i )
and thus S is lower bounded by:

S ≥ σ ∩ σ X (E) = (σ X (E) ⊕ D) ∩ σ X (E) = σ X (E) ⊕ (D ∩ σ X (E)) = σ X (E) -D ∩ σ X (E) ≥ σ X (E) -D .
Combining both inequalities we get Lemma 5.1 (iii).

The main statement of this section is presented in Proposition 5.2 and asserts that the weight of the residual error after correction is upper bounded linearly in the syndrome error weight. In Corollary 5.4, we will give another formulation of Proposition 5.2 where the hypothesis

U = O( √ N ) is replaced by the more natural one E , D = O( √ N ).
Proposition 5.2. We use the notations of Section 5.1.1.

Suppose that E ⊕ Ê is reduced with U ≤ γ 0 √ N then:

E ⊕ Ê ≤ c 0 D .
Proof. With the notations of Section 5.1.1, the value of the syndrome at the end of the algorithm is σ f = σ X (E ⊕ Ê) ⊕ D. Lemma 5.1 applied when the input of Algorithm 3 is (E ⊕ Ê, D) provides a set F * and since the while loop condition is not satisfied for σ f , the set F * must be empty. By Lemma 5.1 (iii):

c 1 σ X (E ⊕ Ê) ≤ c 2 D .
By Lemma 4.21:

E ⊕ Ê ≤ 2 β 0 d V σ X (E ⊕ Ê) ≤ 2c 2 c 1 β 0 d V D = c 0 D .
As shown in Lemma 5.3 below, the hypothesis of Proposition 5.2 U = O( √ N ) holds as soon as the initial errors E and D are sufficiently small. More precisely, the size of the execution support U is a linear function of E and D . Lemma 5.3. We use the notations of Section 5.1.1 then:

U ≤ c 3 E + c 4 D .
Proof. The sets σ i and F i defined in Section 5.1.1 satisfy:

σ i -σ i+1 ≥ β 1 σ X (F i ) ≥ β 1 d V 2 F i .
Thus we can lower bound the weight of σ 0 = σ X (E) ⊕ D by:

σ X (E) ⊕ D ≥ σ 0 -σ f = f -1 i=0 σ i -σ i+1 ≥ β 1 d V 2 f -1 i=0 F i . But |σ X (E) ⊕ D| ≤ d C |E| + |D| ≤ d C |E| + |D| thus i |F i | ≤ 2 β1r |E| + |D| and: U + D ≤ E + D + f -1 i=0 F i ≤ E + D 2α 1 .
Hence:

U ≤ 1 2α 1 E + 1 2α 1 -1 D = c 3 E + c 4 D .
Combining Proposition 5.

E ⊕ Ê R ≤ c 0 D .
Proof. Let E be a reduced error equivalent to E ⊕ Ê then:

E ≤ E ⊕ Ê ≤ U ≤ c 3 E + c 4 D ≤ γ 0 √ N
where the third inequality holds by Lemma 5.3. The syndromes of the errors E and E ⊕ Ê are equal thus no flip is done by Algorithm 3 on the input (E , D). Hence, there is a valid execution of Algorithm 3 on the input (E , D) with output ∅, support E and residual error E . Applying Proposition 5.2 to the latter execution we get:

E ⊕ Ê R = E ≤ c 0 D .

Random errors with linear size

The upper bound given by Corollary 5.4 can be applied for any error with weight O √ N , but in this work we are interested in random errors whose typical weight is Θ(n). The only assumption we do on the error is that it is generated by a noise model satisfying the local stochastic condition of Definition 5.5 (see the introduction of this chapter for a discussion about the local stochastic property). A random error E ⊆ V Q , D ⊆ C X is local stochastic with parameter (p phys , p synd ) when for all S ⊆ V Q and for all T ⊆ C X :

P S ⊆ E and T ⊆ D ≤ p |S| phys p |T | synd .
In the particular case where we do not mind about the error on the syndrome bits, a random error E ⊆ V Q is local stochastic with parameter p phys when for all S ⊆ V Q :

P S ⊆ E ≤ p |S| phys .

a) Statement of the main theorem

The main theorem of this section is Theorem 5.6 below: if the initial errors E and D satisfy the local stochastic property with parameters sufficiently small, then there exists a local stochastic error E ls ⊆ V Q such that E ls and the residual error are equivalent with high probability. In other words, the residual error on the qubits can be described by a local stochastic noise, and this description is valid except for an event whose probability vanishes in the limit of large block-length (this event corresponds to a decoding failure).

Theorem 5.6. We use the notations of Section 5.1.1. There exists a non-zero constant p 0 > 0 such that the following holds. Suppose the error (E, D) satisfies a local stochastic noise model with parameter (p phys , p synd ) where p phys < p 0 and p synd < p 0 . If we run Algorithm 3 on the input (E, D) then there exists a random variable E ls ⊆ V Q with a local stochastic distribution with parameter p ls := p 1/(2c0) synd such that:

P E ls and E ⊕ Ê are not equivalent ≤ e -Θ( √ N ) .
The proof of Theorem 5.6 is given at the end of this section. It is worthwhile to rewrite Theorem 5.6 with the additional assumption that the syndrome measurement is perfect (p synd = 0 and D = ∅). In that case, a local stochastic error whose parameter is below threshold is corrected by the small-set-flip decoder with high probability:

Corollary 5.7. We use the notations of Section 5.1.1. There exists a non-zero constant p 0 > 0 such that the following holds. Suppose D = ∅ and E satisfies a local stochastic noise model with parameter p phys < p 0 then:

P Algorithm 3 corrects E ≥ 1 -e -Θ( √ N ) .
Proof. When we apply Theorem 5.6 with p synd = 0, we get p ls = 0 and E ls = ∅. Hence, with probability

1 -e -Θ( √ N ) , E ⊕ Ê is equivalent to ∅, i.e. Algorithm 3 corrects E.
When a quantum expander code Q is used in the context of fault-tolerance, the goal is to process the information encoded in Q by applying logical quantum gates on the qubits. Each logical operation adds a local stochastic error on the qubits, thus a round of error correction is performed after each logical gate. The concern in this discussion is to understand how evolves the error on the qubits: we would like to use Theorem 5.6 to show that the logical state encoded with Q is preserved after applying T ∈ N logical gates. A simplified error model for this framework is the following:

• At the beginning, there is no error on the qubits: A 0 := ∅.

• Repeat for t = 0, . . . , T -1:

-An error (E t , D t ) is generated accordingly to a local stochastic noise model with parameter (p E , p D ).

-The error E t is added to the error on the qubits:

B t := A t ⊕ E t .
-We run Algorithm 3 on the input (B t , D t ) and apply the output Êt to the qubits:

A t+1 := B t ⊕ Êt .
Roughly speaking, E t comes from the noise in the circuit used to implement the t th logical gate and D t comes from the noise in the circuit used to measure the syndrome bits for the t th error correction procedure. In fault-tolerant quantum computation, Êt is applied with a circuit made of noisy physical gates, but for simplicity here, we assume that Êt is applied without fault. This procedure is a success when the logical state is preserved throughout the T rounds. In practice, we can determine whether the logical state has been preserved by checking if running the decoder without syndrome error turns the state back to the expected state. As a summary, if we run Algorithm 3 on the input (A T , ∅) and apply the output ÊT to the qubits:

A T +1 := A T ⊕ ÊT ,
then the above procedure is a success if and only if A T +1 is trivial (equivalent to the empty error). As shown in Claim 5.8 below, A T +1 is indeed trivial with probability 1 -(T + 1)e -Θ( √ N ) . In particular, if the number of logical gates T is polynomial in N then the procedure fails with vanishing probability. Claim 5.8. Let p 0 be the threshold of Theorem 5.6 and Corollary 5.7, and let p D and p E be such that:

p D < p 0 2 2c0 and p E < p 0 2 .
Then the above procedure fails with probability at most (T + 1)e -Θ( √ N ) .

Proof. In this proof, we say that an error A is local stochastic with parameter p and failure probability p if there exists an error A with local stochastic parameter p such that:

P A and A are not equivalent ≤ p .
With this terminology, Theorem 5.6 asserts that the residual error E ⊕ Ê is local stochastic with parameter p ls and failure probability e -Θ( √ N ) . When t = 0, the error A 0 = E 0 is local stochastic with parameter p E < p 0 and failure probability 0. By Theorem 5.6, the residual error In particular for t = T , the error A T is local stochastic with parameter p 1/(2c0) D and failure probability T e -Θ( √ N ) . By Corollary 5.7, the residual error A T +1 = A T ⊕ ÊT is non trivial with probability at most (T + 1)e -Θ( √ N ) . Since the procedure is a success when A T +1 is non trivial, we get Claim 5.8.

A 1 = A 0 ⊕ Ê0 is local stochastic with parameter p 1/(2c0) D and failure probability e -Θ( √ N ) . When t = 1, the error A 1 = A 1 ⊕ E 1 is local stochastic with parameter p 0 /2 + p E <

b) Proof ideas and useful definitions

Let's turn our attention to the proof of Theorem 5.6 which is inspired from the arguments of [START_REF] Alexey | Fault tolerance of quantum lowdensity parity check codes with sublinear distance scaling[END_REF] and [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. Before providing the formal statements, we describe the main ideas of the proof. When a random error (E, D) is generated with a local stochastic error model, percolation arguments will allow us with high probability to decompose E and D as disjoint unions of small error sets, each of which has size O( √ N ):

E = K E K , D = K D K . ( 5.5)
As we explain in more details later, the index K ⊆ V Q of eq. (5.5) goes through the connected components of U in the syndrome adjacency graph G. Let ÊK be the output of Algorithm 3 on the input

(E K , D K ). Because E K , D K = O( √ N ), Corollary 5.4 states that after correction, the residual error E K ⊕ ÊK is equivalent to E K satisfying E K = O D K .
Moreover, Algorithm 3 is local in the sense that two errors far away in the factor graph of the code will not interact during the decoding procedure. The consequence for the error E is that each error set E K is corrected independently from the other ones and thus the residual error E ⊕ Ê is equal to the disjoint union:

E ⊕ Ê = K E K .
Finally, since D has been chosen with a local stochastic noise, the upper bounds E K = O D K imply that there is an error equivalent to E ⊕ Ê with a local stochastic distribution.

The locality property for the small-set-flip algorithm is formalized in Lemma 5.9 where Γ Q denotes the neighborhood in the Tanner graph of the quantum expander code. In this lemma, the sets E K and D K we talked about above are equal to

E K = E ∩ K and D K = D ∩ Γ X (K).
Lemma 5.9 (Locality of Algorithm 3 [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF]). We use the notations of Section 5.1.1. For any set

K ⊆ U with Γ Q (K) ∩ Γ Q (U \ K) = ∅, there is a valid execution of Algorithm 3 on the input E ∩ K, D ∩ Γ X (K) whose output is Ê ∩ K and whose support is U ∩ K.
The locality property is important to understand this section, however the proof of Lemma 5.9 is less useful and that's why we report it later in Section 5.1.4.

Lemma 5.9 formalizes the idea that the small-set-flip algorithm handles the errors in the set K independently from the errors outside K. In fact, if

Γ Q (K) ∩ Γ Q (U \ K) = ∅
holds then the support of a check-node cannot contain simultaneously a qubit of K and a qubit of U \ K. Moreover, to know whether the small-set-flip algorithm can flip a given small-set F ⊆ K, the only required information is the value of the check-nodes belonging to Γ Q (K). As a consequence, the error on the qubits of U \ K does not affect the decisions of the decoder regarding the qubits of K. In particular, the behavior of the algorithm in K would have been the same if there were no error at all on the qubits of U \ K, and this is the statement of Lemma 5.9.

In Section 5.1.1, we have defined the syndrome adjacency graph G where two qubits are connected if and only if they are in the support of the same stabilizer generator. As shown in the proof of Corollary 5.10 below, for all set K ⊆ U , the hypothesis

Γ Q (K) ∩ Γ Q (U \ K) = ∅ of Lemma 5.9 is equivalent to K ∩ Γ G (U \ K) = ∅ where Γ G is the neighborhood in G. Consequently, if K is a connected component of U in G
then the hypotheses of Lemma 5.9 are satisfied for K. To summarize, each connected component of U in the syndrome adjacency graph is corrected by the small-set-flip algorithm independently from the other connected components, see Figure 5.1 for a schematic representation. The small-set-flip decoder corrects the connected components of U independently.

In Corollary 5.10 below, we restate the locality property using the graph G instead of the Tanner graph.

Corollary 5.10. We use the notations of Section 5.1.1. For any set K ⊆ U with K ∩ Γ G (U \ K) = ∅, there is a valid execution of Algorithm 3 on the input E ∩ K, D ∩ Γ X (K) whose output is Ê ∩ K and whose support is U ∩ K.

Proof. By Lemma 5.9, it is sufficient to prove that the statement

K ∩ Γ G (U \ K) = ∅ implies Γ Q (K) ∩ Γ Q (U \ K) = ∅. We show it by contraposition. If Γ Q (K) ∩ Γ Q (U \ K) = ∅ then there is a generator g ∈ C X C Z such that g ∈ Γ Q (K) and g ∈ Γ Q (U \ K).
Thus there are two qubits q 1 ∈ K and q 2 ∈ U \ K belonging to the support of g. Let q 3 be another qubit in the support of g with q 3 = q 1 and q 3 = q 2 , then by the definition of the syndrome adjacency graph we have

q 3 ∈ Γ Q (K) ∩ Γ Q (U \ K).
Using the execution support U = E ∪ F 0 ∪ . . . ∪ F f -1 , the error decomposition required in eq. (5.5) is done in the following way: each connected component K of U in G provides the error sets E K := K ∩ E and D K := D ∩ Γ X (K). By Corollary 5.10, running Algorithm 3 on the input (E K , D K ) leads to the residual error E K = (E ⊕ Ê) ∩ K and we will prove that the execution support K is small enough to apply Proposition 5.2. The key point is to remark that a fraction 2α 1 of the vertices in X := K ∪ D K ⊆ V belong to E ∪ D (see Lemma 5.3). We will say that X is a 2α 1 -subset of E ∪ D (see Definition 5.11) and percolation arguments (see Lemma 5.18) will show that with high probability, any connected α-subset of a random error E ∪ D must be small enough to apply Proposition 5.2. Definition 5.11 (α-subset and MaxConn α ). We use the notations of Section 5.1.1. Let α ∈ (0; 1] and let X, Y ⊆ V. X is said to be an α-subset of Y if X ∩ Y ≥ α X . We also define the integer MaxConn α (Y ) by: MaxConn α (Y ) = max X : X is connected in G and is an α-subset of Y .

As stated in Corollary 5.12 below, Lemma 5.3 implies that U ∪ D is a 2α 1 -subset of E ∪ D. Corollary 5.12. We use the notations of Section 5.1.1. The set U ∪ D is a 2α 1 -subset of E ∪ D.

Proof. By Lemma 5.3:

U + D ≤ c 3 E + (c 4 + 1) D = 1 2α 1 E ∪ D = 1 2α 1 (U ∪ D) ∩ (E ∪ D) . thus U ∪ D is a 2α 1 -subset of E ∪ D.
If we go back to Theorem 5.6, the error E ls will be defined to be reduced and equivalent to E ⊕ Ê, and the local stochastic property for E ls will be a consequence of the local stochastic property for D. More precisely, we already know for all T ⊆ C X : (5.6) and we want to show for all S ⊆ V Q :

P T ⊆ D ≤ p |T | synd
P S ⊆ E ls ≤ p |S| ls .
Given a set S ⊆ E ls , we will find a large set T ⊆ D to upper bound P S ⊆ E ls using eq. (5.6). Informally, the set T contains the faulty check-nodes which prevent the small-set-flip algorithm from correcting the qubits of S. Formally, T = D ∩ Γ X (W ) where W ⊆ V Q is called a witness as defined in Definition 5.14. Let S ⊆ E ls , then a witness for S is a set W ⊆ V Q satisfying S ⊆ W with D ∩ Γ X (W ) = Ω W and such that S intersects every connected component of W in G. Finally, the main difficulty in the proof of Theorem 5.6 is to show the existence of a witness W for all S ⊆ E ls . Up to technical details, W will be the union of the connected components of the execution support which intersect S. Definition 5.13 ([46]). We use the notations of Section 5.1.1. For S ⊆ V Q , we define M(S) to be the set of all subsets

W ⊆ V Q with S ⊆ W such that any connected component W of W in G satisfies W ∩ S = ∅.
Lemma 2 of [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] provides an upper bound on the number of sets W ∈ M(S) of a given size:

# W ∈ M(S) : W = t ≤ (ed) t ed |S| .
(5.7) Definition 5.14 (Witness). We use the notations of Section 5.1.1. W ⊆ V Q is said to be a witness for S ⊆ V Q if W ∈ M(S) and D ∩ Γ X (W ) ≥ W /c 0 .

c) Formal proof

Besides Theorem 5.6, there are three main statements in this section:

• Lemma 5.15 shows how to find a witness for any S ⊆ E ⊕ Ê under the assumptions that E ⊕ Ê is reduced and E ⊕ Ê ≤ γ 0 √ N .

• Lemma 5.17 shows how to find a witness for any S ⊆ E ⊕ Ê under the assumption MaxConn α1 (E) ≤ γ 0 √ N .

• Lemma 5.18 shows that MaxConn α1 (E) ≤ γ 0 √ N holds with high probability when E and D are local stochastic.

Finally, we will conclude the section with the proof of Theorem 5.6 where the existence of witnesses is used to establish the local stochastic property for the residual error.

Lemma 5.15. We use the notations of Section 5.1.1. If the residual error E ⊕ Ê is reduced and E ⊕ Ê ≤ γ 0 √ N then for all S ⊆ E ⊕ Ê, there is a witness W for S with the additional constraint W ⊆ E ⊕ Ê.

with the additional constraint W K ⊆ E ls ∩ K.

The errors E and E have the same syndrome thus the behavior of Algorithm 3 is the same on input (E, D) and on input (E , D). Hence, there is a valid execution of Algorithm 3 on input (E , D) whose output is Ê and whose support is E ∪ F 0 ∪ . . . ∪ F f -1 . By locality (Corollary 5.10), there is also a valid execution of Algorithm 3 on input (E K , D K ) whose output is ÊK and whose support is

(E ∪ F 0 ∪ . . . ∪ F f -1 ) ∩ K.
The residual error of the latter execution is (E ⊕ Ê) ∩ K = E ls ∩ K which is reduced and is of weight smaller than γ 0 √ N . By Lemma 5.15, there is a witness W K for S K with W K ⊆ E ls ∩ K.

Finally, W = K W K is a witness for S.

The last ingredient before proving Theorem 5.6 is provided by Lemma 5.18 below: the condition MaxConn α1 (E ∪ D) ≤ γ 0 √ N needed in Lemma 5.17 is verified with high probability for local stochastic errors.

Lemma 5.18 (α-percolation, [START_REF] Fawzi | Efficient decoding of random errors for quantum expander codes[END_REF]). We use the notations of Section 5.1.1.

Let α ∈ (0, 1] then there exists a threshold p th = p th (α) > 0 such that for any t ∈ N * , for any p phys < p th and for any p synd < p th the following holds. If an error (E, D) is chosen according to a local stochastic noise with parameter (p phys , p synd ) then:

P MaxConn α (E ∪ D) ≥ t ≤ C V max(p phys , p synd ) p th αt ,
where C = C(p, α) is independent of t.

Lemma 5.18 is a particular case of Theorem 5.24 where the graph G is the syndrome adjacency graph. The proof of Theorem 5.24 is the purpose of Section 5.1.5. We conclude this section with the proof of Theorem 5.6.

Proof of Theorem 5.6. Let p th > 0 as defined in Lemma 5.18. The constant p 0 > 0 is defined to be a positive number such that:

p 0 ≤ p th , 2 d C c0 p 0 < 1/2, ed2 d C p 1/c0 0 ≤ 1/2, 4 • 2 d C p 1/(2c0) 0 ≤ 1. (5.8)
Let p phys < p 0 and p synd < p 0 . We assume that the pair (E, D) satisfies a local stochastic noise model with parameter (p phys , p synd ) and we run Algorithm 3 on the input (E, D). We define the random error E ls promised by Theorem 5.6 in the following way:

If MaxConn α1 (E ∪ D) > γ 0 √ N then E ls = ∅. If MaxConn α1 (E ∪ D) ≤ γ 0 √
N then E ls is the error promised by Lemma 5.17.

Lemma 5.17 To conclude, we upper bound the probability that a witness exists. For a fixed W ⊆ V Q , if W is a witness for S then there is a set T ⊆ Γ X (W ) satisfying W ≤ c 0 T and T ⊆ D. Thus the probability that W is a witness for S is upper bounded by:

P W is a witness for S ≤ T ⊆Γ X (W ): |W |≤c0|T | P T ⊆ D ≤ T ⊆Γ X (W ): |W |≤c0|T | p |T | synd .
Since the cardinality of Γ X (W ) is upper bounded by d C |W |, we have:

P W is a witness for S ≤ t≥|W |/c0 2 d C |W | p t synd ≤ t≥|W |/c0

Locality of the small-set-flip algorithm

The goal of this section is to prove the locality property of Lemma 5.9. We start with Lemma 5.19 below showing that if

Γ Q (K) ∩ Γ Q (U \ K) = ∅ then
the syndrome of an error contained in K is independent of the qubits outside K. The variable A of this lemma will be set later to be either A = E or A = F i .

Lemma 5.19. We use the notations of Section 5.1.1.

Let K ⊆ V Q be such that Γ Q (K) ∩ Γ Q (U \ K) = ∅. Then for all A ⊆ U : σ X (A ∩ K) = σ X (A) ∩ Γ X (K). Proof. Let K := V Q \ K be the complement of K in V Q . We decompose σ X (A) ∩ Γ X (K) using the partition A = (A ∩ K) (A ∩ K): σ X (A) ∩ Γ X (K) = σ X (A ∩ K) ⊕ σ X (A ∩ K) ∩ Γ X (K) = σ X (A ∩ K) ∩ Γ X (K) ⊕ σ X (A ∩ K) ∩ Γ X (K) .
On the one hand, we have σ X (A ∩ K) ⊆ Γ X (K) thus:

σ X (A ∩ K) ∩ Γ X (K) = σ X (A ∩ K).
On the other hand, we have σ

X (A ∩ K) ⊆ Γ X (A ∩ K) ⊆ Γ Q (A ∩ K) and Γ X (K) ⊆ Γ Q (K) thus: σ X (A ∩ K) ∩ Γ X (K) ⊆ Γ Q (A ∩ K) ∩ Γ Q (K) ⊆ Γ Q (U ∩ K) ∩ Γ Q (K) because A ⊆ U , = Γ Q (U \ K) ∩ Γ Q (K) = ∅.
Combining the three equalities, we get Lemma 5.19.

In Lemma 5.20 below, we compare the way flipping a small-set F ∈ F affects a given syndrome σ and the way it affects the same syndrome restricted to the check-nodes which touch K. Lemma 5.20. We use the notations of Section 5.1.1. Let σ ⊆ C X and let K ⊆ V Q then for all F ∈ F:

(i) ∆( σ ∩ Γ X (K), F ) ≤ ∆( σ, F ), (ii) If F ⊆ K then ∆( σ ∩ Γ X (K), F ) = ∆( σ, F ).
Using the previous statements we can easily prove item (i):

Ê = Ê ∩ K = f -1 i=0 F i ∩ K = f -1 i=0 F i ∩ K = f -1 j=0 F j .
Item (ii) is proved in the same manner:

K = U ∩ K = E ∪ f -1 i=0 F i ∩ K = E ∩ K ∪ f -1 i=0 F i ∩ K = E ∪ f -1 j=0 F j .
Before proving items (iii) and (iv), we need to show that the sets σ j defined by eq. (5.9) satisfy eq. (5.11) below:

σ j = σ ij ∩ Γ X (K) for j ∈ 0; f -1 , σ f = σ f ∩ Γ X (K).
(5.11)

For i ∈ 0; f , let σ i := σ i ∩ Γ X (K) then we have:

σ 0 = σ 0 ∩ Γ X (K) = σ X (E) ⊕ D ∩ Γ X (K) = σ X (E) ∩ Γ X (K) ⊕ D by distributivity, = σ X (E ) ⊕ D by Lemma 5.19 applied with W = E.
Similarly, for i ∈ 0; f -1 :

σ i+1 = σ i+1 ∩ Γ X (K) = σ i ⊕ σ X (F i ) ∩ Γ X (K) = σ i ⊕ σ X (F i ) ∩ Γ X (K) by distributivity, = σ i ⊕ σ X (F i ∩ K) by Lemma 5.19 applied with W = F i .
Using eq. (5.10), the sets σ i satisfy:

     σ 0 = σ X (E ) ⊕ D , σ i+1 = σ i ⊕ σ X (F i ) if i ∈ {i 0 , . . . , i f -1 }, σ i+1 = σ i if i / ∈ {i 0 , . . . , i f -1 }.
(5.12)

When we compare eq. (5.9) and eq. (5.12), an induction yields: [START_REF] Hee | Combinatorial interpretation of raney numbers and tree enumerations[END_REF][START_REF] Uehara | The number of connected components in graphs and its applications[END_REF]). Let G be a graph with degree upper bounded by d G ≥ 3 and let V be the set of vertices. For any integer s ≥ 1, the number of connected sets of G with size s satisfies:

σ 0 = σ 0 = . . . = σ i0 , σ j+1 = σ ij +1 = . . . = σ ij+1 for j ∈ 0; f -2 , σ f = σ i f -1 +1 = . . . = σ f . Lemma 5.22 ([
C s (G) ≤ V d G s s(d G -2) + 2 s(d G -1) s -1 .
Proof. The main tool for this proof is the set T (s) of labeled rooted trees with maximum degree d G and size s. An element of T (s) is a directed tree (a directed graph without cycle) with s vertices and a particular vertex called the root such that the edges are directed from the root to the leaves of the tree. Note that the in-degree is 0 for the root and 1 for the other vertices and, in addition, we require the out-degree to be at most d G for the root and at most d G -1 for the other vertices. Finally, the trees are labeled meaning that for each vertex v, the directed edges whose tail is v are injectively labeled with labels in 1; d G if v is the root and with labels in 1; d G -1 if v is not the root. By [START_REF] Hee | Combinatorial interpretation of raney numbers and tree enumerations[END_REF], we have:

T (s) = R(d G -1, s -1, d G ) := d G s(d G -2) + 2 s(d G -1) s -1 .
where R(a, b, c) are the Raney numbers.

From the graph G, we construct the oriented graph G 0 where each non-oriented edge has been replaced by two opposite oriented edges. Similarly than for the trees, we fix some labeling of G 0 : the directed edges whose tail is some node v are injectively labeled with labels in 1; d G .

Let v ∈ V and let C s (v) be the set of connected sets X ∈ C s (G) such that v ∈ X. Let X ∈ C s (v) then there is at least one spanning tree T 0 of X in G 0 . From T 0 , we get a labeled rooted tree T ∈ T (s) by fixing v as the root and using the labels in G 0 . We need to make a comment at this point: the labeling for T is not exactly the same as the one for T 0 as we explain below. The difficulty is that the labels in T are in 1; d G -1 (for edges whose tail is not the root) whereas the label d G is allowed in T 0 . Let v 1 be a vertex in T 0 which is not the root, let v 0 be the father of v 1 and let i be the label in T 0 of the oriented edge from v 1 to v 0 . If j is the label in T 0 of another edge whose tail is v 1 then this edge in T has label j if j < i and j -1 if j > i.

Once a vertex v ∈ V has been fixed, the above procedure builds at least one labeled rooted tree from a given X ∈ C s (v) and conversely, any T ∈ T (s) can be obtained from at most one connected set X ∈ C s (v). Hence C s (v) ≤ T (s) . In the sum v∈V C s (v) , each connected set of G is counted s times. Therefore:

C s (G) = 1 s v∈V C s (v) ≤ V d G s s(d G -2) + 2 s(d G -1) s -1 .
Corollary 5.23. Let G be a graph with degree upper bounded by d G ≥ 3 and let V be the set of vertices of G. For any integer s ≥ 1, the number of connected sets of G with size s satisfies:

C s (G) ≤ V K s where K = K(d G ) := (d G -1) 1 + 1 d G -2 d G -2 .
Proof. From Lemma 5.22, we have:

C s (G) ≤ V d G s s(d G -2) + 2 s(d G -1) s -1 = V d G s(d G -2) + 1 s(d G -2) + 2 s(d G -1) s ≤ V s(d G -1) s since s ≥ 1 and d G ≥ 2, ≤ V 2 s(d G -1)h(1/(d G -1)
) by eq. ( 5.15),

= V (d G -1) 1 + 1 d G -2 d G -2 s .
Theorem 5.24 (α-percolation). Let G be a graph with degree upper bounded by d G ≥ 3 and let V be the set of vertices of G. Let α ∈ (0, 1], let t ≥ 1 be an integer and let p th be defined by:

p th =    2 -h(α) d G -1 1 + 1 d G -2 d G -2    1 α , where h(α) = -α log 2 α -(1 -α) log 2 (1 -α)
is the binary entropy function. Then, for any random variable Y ⊆ V satisfying the local stochastic noise property of Definition 5.21 with parameter p < p th , we have

P MaxConn α (Y ) ≥ t ≤ C V p p th αt where 1/C = (1 -2 h(α)/α p) 1 -p p th α .
Proof. Let C s (G) be the set of connected sets of vertices of size s in G. Applying a union bound, we obtain

P MaxConn α (Y ) ≥ t = P ∃s ≥ t, ∃X ∈ C s (G) : X ∩ Y ≥ α X ≤ s≥t X∈Cs(G) P X ∩ Y ≥ α X .
Let us first consider the quantity P X ∩ Y ≥ α X for a set X ∈ C s (G):

P X ∩ Y ≥ α X ≤ m≥αs X ⊆X: X =m P X ∩ Y = X ≤ m≥αs X ⊆X: X =m P X ⊆ Y ≤ m≥αs X ⊆X: X =m p m ≤ m≥αs s m p m .
Using eq. (5.15):

P X ∩ Y ≥ α X ≤ m≥αs 2 s m h m s p m . Since (x → h(x)/x) is non increasing on [α, 1]: P X ∩ Y ≥ α X ≤ m≥αs 2 h(α)/α p m ≤ (2 h(α)/α p) αs 1 -2 h(α)/α p . Let K := d G -2 1 + 1 d G -2 d G -2
as defined in Corollary 5.23 then:

P MaxConn α (Y ) ≥ t ≤ s≥t X∈Cs(G) P X ∩ Y ≥ α X ≤ 1 1 -2 h(α)/α p s≥t C s (G) 2 h(α)s p αs by the union bound, ≤ V 1 -2 h(α)/α p s≥t K2 h(α) p α s by Corollary 5.23, ≤ V 1 -2 h(α)/α p (K2 h(α) p α ) t 1 -K2 h(α) p α . Observing that p th = 1 K2 h(α)
1/α , we obtain the desired result.

Parallel decoding

In this chapter, we introduce a parallel implementation for the small-set-flip algorithm where many small-sets are flipped in each round (Algorithm 4). Unlike the sequential decoder presented in Section 5.1, Algorithm 4 stops after a fixed number of rounds f ∈ N even though there still exists some small-sets that decrease the final syndrome weight when flipped. In Section 5.2.4, f is set to be a constant integer independent of the initial syndrome weight and hence the decoder runs in constant time. This is particularly relevant in the context of fault-tolerant quantum computation where we do not want to give time for the errors to accumulate. The drawback is that the residual error satisfies the local stochastic condition with a constant parameter independent of the initial local stochastic parameters. In particular when the syndrome measurement is perfect, the errors on the qubits are not entirely corrected. In Section 5.2.5, the integer f is set to be logarithmic in the initial syndrome weight. In that case, the residual error has local stochastic parameter p ls := p c synd where c is a constant and p synd is the local stochastic parameter of the syndrome error. In particular, for perfect syndrome measurements where p synd = 0, we have p ls = 0 and thus there is no residual error on the qubits after correction.

Notations

In Section 5.2, we keep the notations of Section 5.1.1 running Algorithm 4 defined below instead of Algorithm 3. In particular, (E, D) is the input of Algorithm 4, Ê its output and U = E ∪ F 0 ∪ . . . ∪ F f -1 its execution support. We also use the notation C k Z defined in Lemma 5.25 and define the additional positive constants:

χ := d C (d V -1) + 1 d V (d C -1) + 1 , η := 1 - β 1 c 1 d V d C χ(d V + d C ) < 1, c 5 := 1 -η + β 1 c 2 d V d C χ(d V + d C ) , c 6 := c 5 1 -η .
For Section 5.2.4, we fix a parameter c > 1 and define:

f 0 = f 0 (c) := χ     log 8c β0d V -log (η)     , c 7 = c 7 (c) := 2 β 0 d V 1 + η f0/χ + c 6 , c 8 = c 8 (c) := 4cc 7 c 3 + c 4 -1 , c 9 = c 9 (c) := c 3 + c 4 4cc 7 -1 .
For Section 5.2.5 we define:

f 1 : s → χ     log 2s β0d V -log(η)     + 1, c 0 := 2 1 + c 6 β 0 d V .
Lemma 5.28. We use the notations of Section 5.2.1. If we assume U ≤ γ 0 √ N then:

σ χ ≤ η σ 0 + c 5 D .
Proof. Our strategy is to find a step i ∈ 0; χ -1 where the weight of the observed syndrome decreases a lot. Using Lemma 5.1, we are already able to build many smallsets (the elements of F * ) which would decrease σ 0 , but we have to face two difficulties to prove that the syndrome decreasing stated in Lemma 5.28 holds. The first difficulty is that two flips F, F ∈ F * can be subsets of the same generator g ∈ C Z and thus the decoder cannot flip both in one step. However, if for each generator g ∈ C Z we pick some F * g ∈ F * then the number of F * g which are not empty is a fraction of F * . Thus, using the set {F * g : g ∈ C Z } instead of F * will tackle the first difficulty. Let i ∈ 0; χ -1 be the step at which the small-set corresponding to some X-type generator g is flipped. The second difficulty is that even though flipping F * g decreases the weight of σ 0 , there is no guarantee that this flip decreases the weight of σ i as well. Indeed, we could have ∆( σ i , F * g ) = ∆( σ 0 , F * g ) due to the fact that we have flipped another small-set F in one of the prior steps. However, by the LDPC property, each flip F affects at most a constant number of F * g and as a consequence, either we flip many small-sets before flipping a given color k ∈ 0; χ -1 or the majority of the flips with the color k are done. Finally, if we identify k ∈ 0; χ -1 the most represented color in F * and i ∈ 0; χ -1 the step where the decoder flips the generators with color k, then the weight of the observed syndrome will decrease a lot either before step i or at step i.

Here is the formal proof of the statement. We have E ≤ U ≤ γ 0 √ N thus Lemma 5.1 provides a set F * ⊆ F. For all X-type generator g ∈ C Z , we define:

F g := F ∈ F : F ⊆ Γ Z (g), ∆( σ 0 , F ) ≥ β 1 σ X (F ) , F * g := F * ∩ F g .
In addition, we define a set F * g ∈ F * g in the following manner:

   If F * g = ∅ then F * g := arg max F ∈F * g σ X (F ) , If F * g = ∅ then F * g := ∅.
By Lemma 5.1 (ii), the small-sets in F * g are disjoint thus:

F * g ≤ Γ Z (g) = d V + d C .
Hence:

F ∈F * g σ X (F ) ≤ σ X (F * g ) F * g ≤ σ X (F * g ) d V + d C .
(5.16)

The average value of g∈C k Z σ X (F * g ) over k ∈ 0; χ -1 satisfies:

1 χ χ-1 k=0 g∈C k Z σ X (F * g ) = 1 χ g∈C Z σ X (F * g ) ≥ 1 χ(d V + d C ) g∈C Z F ∈F * g σ X (F ) by eq. (5.16), = 1 χ(d V + d C ) F ∈F * σ X (F ) ≥ c 1 σ X (E) -c 2 D χ(d V + d C ) by Lemma 5.1 (iii).
Thus there exists a color k ∈ 0; χ -1 such that the set

F 0 := {F * g : g ∈ C k Z } satisfies: F ∈F0 σ X (F ) ≥ c 1 σ X (E) -c 2 D χ(d V + d C ) .
(5.17)

Let i be the integer in 1; χ such that i -1 is a step of the algorithm where we flip the color k. In other words, k = (i -1) mod χ.

We define F 1 ⊆ F the set of all flips done during the steps 0, . . . , i -2 and F 2 ⊆ F k the set of all flips done at step i -1. By the coloring property of Lemma 5.25, we have σ X (F ) ∩ σ X (F ) = ∅ for all F, F ∈ F 0 , thus for all F ∈ F 1 , each check-node of σ X (F ) is in the syndrome of at most one element of F 0 . In other words, for a given syndrome σ and for F ∈ F 1 , the number of F ∈ F 0 such that ∆( σ, F ) = ∆( σ ⊕ σ X (F ), F ) is at most σ X (F ) (as a reminder, F * g ∈ F * g ). As a consequence:

F 2 ≥ F 0 - F ∈F1 σ X (F ) . ( 5.18)
Moreover:

σ 0 -σ i-1 ≥ F ∈F1 β 1 σ X (F ) , ( 5.19)
and

σ i-1 -σ i ≥ F ∈F2 β 1 σ X (F ) ≥ β 1 F 2 .
(5.20)

Combining eqs. (5.18) to (5.20) we get:

F ∈F0 σ X (F ) ≤ d V d C F 0 ≤ d V d C F 2 + F ∈F1 σ X (F ) ≤ d V d C β 1 σ 0 -σ i .
By eq. (5.17):

σ 0 -σ i ≥ β 1 d V d C F ∈F0 σ X (F ) ≥ β 1 c 1 σ X (E) -c 2 D d V d C χ(d V + d C ) = (1 -η) σ X (E) -(c 5 -1 + η) D .
Thus:

σ χ ≤ σ i ≤ σ 0 -(1 -η) σ X (E) + (c 5 -1 + η) D ≤ η σ 0 + c 5 D .
When we apply Lemma 5.28 several times, we get Lemma 5.29 below: the weight of the observed syndrome decreases exponentially fast as a function of f . Lemma 5.29. We use the notations of Section 5.2.1 assuming U ≤ γ 0 √ N then:

σ f ≤ η f /χ σ 0 + c 6 D .
Proof. By Lemma 5.28, for all i:

σ (i+1)χ ≤ η σ iχ + c 5 D .
By an induction on i:

σ iχ ≤ η i σ 0 + c 5 i-1 k=0 η k D .
Hence we can upper bound σ f by:

σ f ≤ η f /χ σ 0 + c 6 D .

Constant time decoding

In this section, we fix f = f 0 where f 0 is defined in Section 5.2.1. As stated in Theorem 5.30 below, if the initial error is local stochastic with parameter sufficiently small then the residual error is also local stochastic with high probability.

Theorem 5.30. We use the notations of Section 5. Note that the constant integer f 0 depends on the parameter c > 1 appearing in the value of p ls in Theorem 5.30. When c increases, the local stochastic parameter p ls of the residual error gets better but the number of steps f 0 grows. On the other hand, when c is chosen close to 1, p ls gets worse but the number of steps drops.

The proof of Theorem 5.30 proceeds in the same way as the proof of Theorem 5.6. Indeed, it is sufficient to find a reduced error E ls equivalent to E ⊕ Ê and such that for all S ⊆ E ls there is a p-witness for S in the sense of Definition 5.32 (the "p" in p-witness stands for parallel). We start by establishing the existence of p-witnesses under the assumptions that the residual error E ⊕ Ê is reduced with weight smaller than γ 0

√

N . This will be done in Lemma 5.33 below but we first show that the weight of the residual error is upper bounded by a linear function of the initial error weight (Lemma 5.31).

Lemma 5.31. We use the notations of Section 5.2.1 running Algorithm 4 with f 0 steps. Suppose U ≤ γ 0 √ N and E ⊕ Ê is reduced then

E ⊕ Ê ≤ 1 4c E + c 7 D .
Proof. The error E ⊕ Ê is reduced and satisfies E ⊕ Ê ≤ U ≤ γ 0 √ N , hence:

E ⊕ Ê ≤ 2 β 0 d V σ X (E ⊕ Ê) by Lemma 4.21, ≤ 2 β 0 d V σ f0 + D ≤ 2 β 0 d V η f0/χ σ 0 + (1 + c 6 ) D by Lemma 5.29, ≤ 2 β 0 d V η f0/χ σ X (E) + 1 + η f0/χ + c 6 D ≤ 1 4c σ X (E) + c 7 D .
The definition of p-witness (Definition 5.32) is a bit different from the definition of witness we gave for the sequential algorithm (Definition 5.14). Definition 5.32 (p-witness). We use the notations of Section 5.2.1. We say that W ⊆ V is a p-witness for S ⊆ V if W ∈ M(S) and:

W ≤ c 3 E ∩ W + c 4 D ∩ Γ X (W ) , S ≤ 1 4c E ∩ W + c 7 D ∩ Γ X (W ) .
It remains to show the existence of p-witnesses for the residual error as stated in Lemma 5.33 and Lemma 5.34. To conclude, we upper bound the probability that a p-witness exists. For a fixed W ⊆ V , we distinguish between two cases:

E ∩ W ≤ 4cc 7 D ∩ Γ X (W ) , (5.23) E ∩ W ≥ 4cc 7 D ∩ Γ X (W ) .
(5.24)

Let us upper bound the probability that W is a p-witness for S in the case where eq. (5.23) holds. By Definition 5.32:

W ≤ c 3 E ∩ W + c 4 D ∩ Γ X (W ) ≤ D ∩ Γ X (W ) /c 8 .
In particular, the set T := D ∩ Γ X (W ) satisfies T ⊆ Γ X (W ), W ≤ T /c 8 and T ⊆ D. Thus: P W is a p-witness for S and eq. (5.23) holds (5.25)

≤ P ∃T ⊆ Γ X (W ) : W ≤ T /c 8 , T ⊆ D ≤ T ⊆Γ X (W ): |T |≥c8|W | p |T | synd ≤ t≥c8|W | 2 d C |W | p t synd ≤ t≥c8|W | 2 d C /c8
In the second case where W is a p-witness for S and eq. ( 5.24) holds, we have:

S ≤ 1 4c + 1 4c E ∩ W ≤ E ∩ W 2c and W ≤ E ∩ W /c 9 .
Thus the set

T := E ∩ W satisfies T ⊆ W , S ≤ T /2c, W ≤ T /
P S ⊆ E ls ≤ p c|S| 1 2 + p c|S| 1 2 = p c|S| 1 .

Logarithmic time decoding

In this section, we run Algorithm 4 with f 1 (| σ|) steps where the function f 1 is defined in Section 5.2.1. The main benefit of this implementation compared to Section 5.2.4 is the following: the smaller p synd is, the smaller the local stochastic parameter of the residual error is. In particular, if the measurement is perfect (D = ∅ and p synd = 0) then the error on the qubits is entirely corrected and this will be important for performing the gate teleportation technique in Chapter 6.

Lemma 5.35. We use the notations of Section 5.2.1 running Algorithm 4 with f

= f 1 (| σ|) steps. Suppose that E ⊕ Ê is reduced with U ≤ γ 0 √ N then: E ⊕ Ê ≤ c 0 D . Proof. The error E ⊕ Ê is reduced and satisfies E ⊕ Ê ≤ U ≤ γ 0 √ N hence: E ⊕ Ê ≤ 2 β 0 d V σ X (E ⊕ Ê) by Lemma 4.21, ≤ 2 β 0 d V σ f + D ≤ 2 β 0 d V η f /χ σ 0 + (1 + c 6 ) D by Lemma 5.29, < 1 + 2(1 + c 6 ) β 0 d V D Because f = f 1 (| σ 0 |), ≤ 1 + c 0 D .
We have E ⊕ Ê < 1+c 0 D and all the values are integers thus Lemma 5.35 holds.

Lemma 5.35 is the same statement as Proposition 5.2 except that c 0 is replaced by c 0 and Algorithm 3 is replaced by Algorithm 4. Hence, if we rewrite the lemmas and the proofs of Section 5.1 replacing c 0 by c 0 then we end up with Theorem 5.36 below.

Theorem 5.36. We use the notations of Section 5.2.1 running Algorithm 4 with f = f 1 (| σ|) steps. There exists a non-zero constant p 3 > 0 such that the following holds. Suppose the error (E, D) satisfies a local stochastic noise model with parameter (p phys , p synd ) where p phys < p 3 and p synd < p 3 . If we run Algorithm 3 with f = f 1 |σ X (E) ⊕ D| steps on the input (E, D) then there exists a random variable E ls ⊆ V Q with a local stochastic distribution with parameter p ls := p 1/(2c 0 ) synd and such that:

P E ls and E ⊕ Ê are not equivalent ≤ e -Θ( √ N ) .
Proof. We rewrite the statements and the proofs of Section 5. c 0 is replaced by c 0 in the definition of witness (Definition 5.14).

-Lemma 5.15 and Lemma 5.17 are proved in the same way.

-The proof of Theorem 5.36 is the same as the proof of Theorem 5.6.

An interesting consequence of Theorem 5.36 is the case where the syndrome is noiseless (see Corollary 5.37 below).

Corollary 5.37. We use the notations of Section 5.2.1. There exists a non-zero constant p 3 > 0 such that the following holds. Suppose D = ∅ and E satisfies a local stochastic noise model with parameter p phys < p 3 then if we run Algorithm 4 with f 1 (|σ X (E)|) steps:

P E is corrected ≥ 1 -e -Θ( √ N ) .
Proof. Similar to the proof of Corollary 5.7.

Numerical simulations for the small-set-flip algorithm

The results we have presented in Sections 5.1 and 5.2 are interesting from a theoretical perspective but are not of practical interest: as shown in Section 5.3.1 below, the lower bound we get on the threshold is small (< 10 -58 ) and the proofs hold when the weights of the stabilizer generators are large (≥ 35). In Section 5.3.2, we present simulation results showing that the real threshold value is near 4.5% for codes with rate 1/61 and stabilizer weight 11, and near 2% for codes with rate 1/5 and stabilizer weight 15.

Theoretical lower bound on the threshold

In Section 5.

p th =    2 -h(α1) d G -1 1 + 1 d G -2 d G -2    1 α 1
, with:

r := d V /d C , d G := d C (d C + 2d V -2), β 1 := 1 -16δ 2 , α 1 := rβ 1 4 + 2rβ 1 .
By Lemma 3.11, we have δ > 1/d V thus:

β 1 < β * 1 := 1 -16/d V 2 , α 1 < α * 1 := rβ * 1 4 + 2rβ * 1 , p th < p * th :=    1 d G -1 1 + 1 d G -2 d G -2    1 α * 1 .
For instance, if we set d C = d V + 1 then the maximum of the function d V → p * th is reached for d V = 66 where p * th ≈ 10 -58 . This value is not physically reasonable, but the numerical simulations of Section 5.3.2 show that the real threshold is much better than the lower bound p th .

Results

Algorithm 5 : the small-set-flip decoder of ref. [START_REF] Leverrier | Quantum expander codes[END_REF].

Input: the syndrome σ ⊆ C X . // σ = σ(E) for some E ⊆ V Q Output: a guess for the error Ê ⊆ V Q . Ê0 = ∅ ; σ 0 = σ ; i = 0 while ∃F ∈ F 0 : ∆(σ i , F ) > 0 do F i := arg max F ∈F0 ∆(σ i , F ) |F | Êi+1 = Êi ⊕ F i σ i+1 = σ i ⊕ σ X (F i ) i = i + 1 end while return Êi
The simulations presented in this section have been done using the sequential smallset-flip algorithm of ref. [START_REF] Leverrier | Quantum expander codes[END_REF] (Algorithm 5) with a perfect syndrome measurement and an iid bit-flip error model (each qubit is flipped with probability p independently). In Algorithm 5, V Q is the set of qubits, C X is the set of check-nodes, F 0 is the set of small-sets as defined in eq. (4.25) and ∆ is the function defined in eq. (4.26):

F 0 := F ⊆ V Q : F is included in the support of an X-type generator , ∆(σ, F ) := σ -σ ⊕ σ X (F ) .
At each round, Algorithm 5 selects the small-set F ∈ F 0 which maximizes ∆(σ i , F ) |F | and flips the qubits of F .

The classical codes used in the hypergraph product construction are regular LDPC codes generated with the configuration model and the switching method as described in Section 5.3.3 [START_REF] Mckay | Asymptotics for symmetric 0-1 matrices with prescribed row sums[END_REF]. For short, we will say that a code family has degrees (d V , d C ) or is a (d V , d C ) family to indicate that the left degree of the classical Tanner graph is d V and the right degree is d C . The first hypergraph product family we consider has rate 1/61 ∼ 1.6% and is constructed from classical codes with rate 1/6 and degrees (5, 6) (see Figure 5.2). The second family has rate 1/5 = 20% and is constructed from classical codes with rate 1/2 and degrees (5, 10) (see Figure 5.3).

For a given error probability p ∈ [0, 1] called physical error rate, we have used Monte Carlo simulations to estimate the block error rate, which is the probability of failure when the small-set flip algorithm corrects an error where each qubit is flipped with probability p independently. Hence, the block error rate is the success rate of the following protocol:

-Each qubit is flipped with probability p independently. size l v which contain v. For instance, l v = 2 if and only if v belongs to a double edge in G. For l ∈ {2, 4, 8, . . . , n} and m ∈ N * , we define s 1 (l, m) to be the number of bit-nodes v such that l v = l and m v = m:

s 1 (l, m) = # v ∈ V Q : l v = l and m v = m .
For a given l ∈ {2, 4, 8, . . . , n}, we define s 2 (l) to be the tuple:

s 2 (l) = s 1 (l, M ), s 1 (l, M -1), s 1 (l, M -2), . . . , s 1 (l, 0)
where M := max m : s 1 (l, m) = 0 . Finally, we define the score associated to a Tanner graph G by the tuple:

s G = s 2 (2), s 2 (4), s 2 (6), . . . , s 2 (n) .
Two scores are compared using the lexicographic order on tuples.

The classical codes used in the simulations have been generated in the following way:

• Create a Tanner graph using the configuration model (keeping the double edges when they exist).

• Repeat many times:

-Pick two edges randomly and switch them if the score of the Tanner graph decreases.

As a remark, we have used the score s G because it leads to the best codes we have been able to produce, but there is no theoretical guarantee that this is the optimal quantity to consider.

Plots

For all plots, the error bars represent the 99% confidence intervals (≈ 2.58 standard deviation).

Fault-tolerant quantum computation

In fault-tolerant quantum computation, the objective is to perform quantum computations with circuits built from noisy gates. The threshold theorem asserts this is indeed possible if the noise on the gates is below a constant threshold value: given an arbitrary circuit C, there exists an equivalent circuit C such that the output of C is not modified by a small number of faulty gates [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]. The circuit C is divided into error correction cycles where an [[N, K]] stabilizer code Q is used to remove the errors, and simulation cycles where the information encoded into Q is processed with logical gates. Formally, let U be a unitary on K qubits, then the associated logical unitary U L satisfies for all |ϕ ∈ C 2 ⊗K :

U L E |ϕ = E U |ϕ where E |ϕ ∈ C 2 ⊗N is the code state associated to |ϕ and E U |ϕ ∈ C 2 ⊗N
is the code state associated to U |ϕ ∈ C 2 ⊗K . A circuit used to implement a logical gate is said to be fault-tolerant if the error resulting from a faulty location hits a small number of qubits. Finally, the circuit C is built in the following way: the qubits of C are encoded using the code Q, each gate U of C is replaced by a faulttolerant implementation of U L and the errors are regularly corrected using the decoding algorithm. In ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF], the code Q used to prove the threshold theorem is a concatenated code. By definition, given an [[N 0 , 1]] code Q 0 and an integer k ∈ N, the associated concatenated code is an [[N k 0 , 1]] code where each qubit is encoded k times in Q 0 . The space overhead is defined to be the ratio between the number of qubits in C and C; for instance, with fault-tolerance based on concatenated codes, the space overhead is polylogarithmic in the size of C. In this chapter, we present the protocol of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] where constant space overhead is reached using quantum expander codes (in fact, other families of constant rate LDPC stabilizer codes could be used). The implementation of the logical gates for quantum expander codes is done with the gate teleportation trick of ref. [START_REF] Gottesman | Quantum teleportation is a universal computational primitive[END_REF] where the required ancilla states are prepared using concatenated codes. 139 In Section 6.1 we provide a formal definition of a circuit and describe the noise model we will use. In Section 6.2 we present the threshold theorem using concatenated codes and in Section 6.3 we explain the protocol of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF].

Background

A quantum circuit C defines a discrete time computation on classical bits and quantum states. In this model a bit is called a classical wire, a qubit is called a quantum wire and we will talk about registers to refer to a set of wires. For each time step t ∈ 1; T , some of the quantum wires are said to be inactive, the other one are said to be active which informally means that they are used for the computation. The state of the circuit at time step t is given by the value of the bits stored in the classical wires and by the quantum state stored in the active quantum wires. The time step t is also described by a collection of locations applied on wires: some of the inactive wires are associated with a state preparation location and each active wire is associated with either a wait location, a gate location or a measurement location.

If a state preparation location is applied on an inactive wire, then the wire is initialized as a |0 state and becomes active at time step t + 1; otherwise it stays inactive. A wait location does nothing on the wire it acts on, this type of location will be used to model memory errors in noisy circuits. Gate locations represent unitary transformations applied to the quantum state and we will use six types of gate locations associated with the bit-flip gate X, the phase-flip gate Z, the Hadamard gate H, the controlled-not gate C-X (in that case, the location acts on two active wires), the S gate and the T gate:

X : |0 → |1 |1 → |0 Z : |0 → |0 |1 → -|1 H :        |0 → 1 √ 2 |0 + |1 |1 → 1 √ 2 |0 -|1 S : |0 → e -iπ/4 |0 |1 → e iπ/4 |1 T : |0 → e -iπ/8 |0 |1 → e iπ/8 |1 C-X :          |00 → |00 |01 → |01 |10 → |11 |11 → |10
When a measurement location is applied on an active wire, a Z-type measurement is performed on the corresponding qubit, the measurement result is stored in a classical wire and the quantum wire becomes inactive at time step t + 1. Since the classical wires are not subjected to noise, it is not necessary to use the location formalism to describe their evolution; instead we will explain with words the algorithm we apply on them. The output of the circuit is given by the value of the classical bits and by the quantum state stored in the active wires at time step t = T . We will assume that all the quantum wires are inactive at time step t = 1 and we will say that the circuit has classical output when all the quantum wires are inactive at the final time step.

A circuit will often be represented graphically, see the examples given in Figure 6.1. An active quantum wire is represented by a line, a quantum register (multiple active quantum wires) is represented by a thick line and a classical wire is represented by a double line. In Figure 6.1, the controlled-Z gate is defined to be C-Z := (1 ⊗ H) • C-X • (1 ⊗ H) and the bit-flip acting on a classical wire maps 0 to 1 and 1 to 0. • A preparation location prepares the wire in the |0 state. When the location is in F , the CPTP map representing the error is applied on the wire once the |0 has been prepared.

• A measurement location measures the wire in the Z-basis and stores the measurement result in a classical wire. When the location is in F , the CPTP map representing the error is applied on the quantum wire before the measurement is performed.

• A gate location applies a unitary gate on the wire. When the location is in F , it applies the CPTP map representing the error after the unitary. Note that the CPTP map acts on two qubits when the gate is a controlled-not gate and it acts on one qubit otherwise.

• A wait location does not modify the quantum state of the circuit. When the location is in F , it applies the CPTP map representing the error on the wire.

A local stochastic error model on L with parameter p loc ∈ [0, 1] is a stochastic noise model such that the random set of faulty locations F satisfies for all T ⊆ L:

P T ⊆ F ≤ p |T | loc .
A local stochastic error model on L is Pauli when the errors applied on the faulty locations are Pauli matrices.

In the previous chapter, we already used the local stochastic error model in an another context to talk about the error applied on a set of qubits and bits. This error model will be used in this chapter as well, thus we recall the definition below. Definition 6.2 (Stochastic error model, local stochastic error model and local stochastic Pauli error model for a set of wires). Let V be a set of quantum wires and let C be a set of classical wires, then a stochastic noise model on V and C produces an error in the following way:

• A random set of faulty qubits E ⊆ V is picked and a CPTP map E E is applied on the qubits belonging to E. The error E E can be any channel which maps |E| qubits to |E| qubits.

• A random set of faulty bits D ⊆ C is picked and the bits belonging to D are flipped.

A local stochastic error model on V and C with parameter p wire ∈ [0, 1] is a stochastic noise model such that the sets E and D satisfy for all S ⊆ V and T ⊆ C:

P S ⊆ E, T ⊆ D ≤ p |S|+|T | wire .
A local stochastic error model on V and C is Pauli when the error applied on the faulty qubits are Pauli matrices.

Fault-tolerance with poly-logarithmic overhead

The most famous result in fault-tolerant quantum computation is the threshold theorem of Aharonov and Ben-Or published in ref. [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]. We quickly present it in Theorem 6.3, see [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF][START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF] for more details. Informally, if we are able to build gates whose noise is below a threshold p th > 0 (which is a universal constant), then for any circuit D, the threshold theorem provides a circuit D with the same output as D but working even with noisy gates. In Section 6.3, the result of this section will be used as a black-box to prepare the ancilla quantum states needed to perform fault-tolerant quantum computation with constant space overhead. Theorem 6.3 (Threshold theorem, [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]). There exists a threshold p th > 0 such that the following holds. Let p loc < p th , let δ > 0 and let D be a circuit with classical output, with m qubits, with T time steps and |D| locations. Then there exists another circuit D such that D has the same output as D and fails with probability at most δ when its locations are subjected to a local stochastic noise model with parameter p loc . In addition, D has m qubits, T time steps and |D | locations where:

m = m polylog |D| δ , T = T polylog |D| δ , |D | = |D| polylog |D| δ .
Proof sketch. The circuit D is constructed from D using usual fault-tolerant techniques based on concatenated codes, see [START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF] or [START_REF] Gottesman | An introduction to quantum error correction and fault-tolerant quantum computation[END_REF] for a complete description of the procedure. For example, using the [ [START_REF] Barg | Multilevel expander codes[END_REF][START_REF] Aharonov | Fault-tolerant quantum computation with constant error rate[END_REF]] Steane code, we define below a transformation Φ 0 on circuits such that Φ 0 (D) is more robust than D when the gates are noisy. The circuit D promised by Theorem 6.3 will be defined as D := Φ k 0 (D) for a well chosen k. In Φ 0 (D), each qubit of the circuit D is replaced by 7 qubits whose state is the encoded version of the original one-qubit state, and each location of D is replaced by the corresponding fault-tolerant gadget followed by a fault-tolerant error correction cycle. The 7-qubit code is particularly pleasant because the gadget corresponding to the Clifford gates are transversal:

X L = X ⊗7 , Z L = Z ⊗7 , H L = H ⊗7 , S L = ZS ⊗7 , C L X = (C X ) ⊗7 .
In Φ 0 (D), a single error somewhere in a gadget will be corrected by the next error correction cycle. Hence, when the output of the circuit is wrong, two faulty locations happened in the same gadget, an event whose probability is upper bounded by c 1 p 2 loc |D| where c 1 is a constant. The number of gates and the probability of failure for D, Φ(D) and Φ k (D) are summarized in Figure 6.2 where c 0 and c 1 are two universal constants. The second and third columns in this table show that the number of qubits and the number of gates grow exponentially with k. The fourth column provides the probability for the circuit to have a wrong output when the circuit is subjected to a local stochastic noise with parameter p loc . If p loc < p th := 1/c 1 , then this probability decreases as a double exponential in k.

Circuit

#Qubits #Gates

P[wrong output] D m |D| ≤ p loc |D| Φ 0 (D) 7m ≤ c 0 |D| ≤ c 1 p 2 loc |D| Φ k 0 (D) 7 k m ≤ c k 0 |D| ≤ (c 1 p loc ) 2 k c 1 |D| Figure 6.2
For a target probability δ > 0, we define

D := Φ k 0 (D) where k = Θ log log |D| δ is such that: (c 1 p loc ) 2 k c 1 |D| ≤ δ.
Finally, the circuit D fulfills the requirements of Theorem 6.3. Theorem 6.3 holds when the output of the circuit D is classical, but in this work, the fault-tolerant protocol based on concatenated codes will be used to create ancilla quantum states. Let D be a circuit whose output is a quantum state |ψ . When D is subjected to a local stochastic noise, there is a non zero probability that the last location of D is faulty, thus we cannot hope to get |ψ with high probability. Instead, we can build a fault-tolerant circuit D such that when D is subjected to a local stochastic noise, the output is |ψ on which has been applied a local stochastic error in the sense of Definition 6.2. Theorem 6.4. There exists a threshold p th > 0 such that the following holds. Let p loc < p th , let δ > 0 and let D be a circuit with m qubits, with T time steps and |D| locations. We assume that the output of D is a quantum state |ψ . Then there exists another circuit D whose output is |ψ and such that when D is subjected to a local stochastic noise model with parameter p loc , there exists N a local stochastic noise on the qubits of |ψ with parameter p wire = c p loc such that:

P output of D is not N |ψ ≤ δ.
In addition, D has m qubits, T time steps and |D | locations where:

m = m polylog |D| δ , T = T polylog |D| δ , |D | = |D| polylog |D| δ .
Proof sketch. Let m 0 be the number of qubits of |ψ and let Φ 0 be the function defined in the proof of Theorem 6.3. The output of Φ k 0 (D) is |ψ encoded in the concatenated code, thus we need to decode the output of Φ k 0 (D) in a fault-tolerant manner. We fix E -1 some decoding circuit for the Steane code and we denote by Φ(D) the circuit Φ 0 (D) followed by m 0 copies of E -1 , one per block of the Steane code. In particular, the output of Φ(D) is an m 0 -qubit state. Note that when the circuit Φ 2 (D) is created, the transformation Φ 0 is also applied to the m 0 decoding circuits contained in Φ(D). In other words, the circuit Φ k (D) is the circuit Φ k 0 (D) followed by k layers of decoding: the first layer uses the circuit Φ k-1 0 (E -1 ), the second layer uses Φ k-2 0 (E -1 ) and the last layer uses E -1 .

For a given δ > 0, we choose again k = Θ log log |D| δ so that the probability that Φ k 0 (D) fails is upper bounded by δ. The output of the circuit is equal to N 0 (|ψ ) where N 0 represents the physical noise on the qubits. The local stochastic noise N promised in Theorem 6.4 is defined to be N 0 except when Φ k 0 (D) fails:

• If the circuit Φ k 0 (D) does not fail, the noise N is equal to N 0 .

• If the circuit Φ k 0 (D) fails then N applies the identity on the qubits.

Fault-tolerance with constant space overhead

In this section, we describe the protocol of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] in the particular case where quantum expander codes are used. Given any circuit C with n qubits and size |C| = poly(n), the fault-tolerant circuit provided by [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] uses Θ(n) qubits and fails with vanishing probability when n goes to infinity. Contrarily to Theorem 6.3 where a single circuit was considered, we are interested here in the asymptotic behavior for a family of circuits.

The main theorem of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] is very general and could be used with other constant rate LDPC stabilizer codes such as the 4-dimensional hyperbolic code of ref. [START_REF] Guth | Quantum error correcting codes and 4dimensional arithmetic hyperbolic manifolds[END_REF]. However, for adversarial errors with weight up to a fraction of the minimal distance, the known algorithms to decode a 4-dimensional hyperbolic code run in exponential time. Hence, applying ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] with 4-dimensional hyperbolic codes is possible only if classical computation is instantaneous, indeed it would require to run an exponential time classical circuit between some time steps of the fault-tolerant circuit. By contrast, for quantum expander codes, we do not require that classical computation is instantaneous since the small-set-flip decoder runs in constant depth. If we set aside the constant time requirement, there exists an efficient decoder for 4-dimensional hyperbolic codes but this algorithm corrects adversarial errors up to logarithmic weight [START_REF] Matthew | Decoding in hyperbolic spaces: quantum LDPC codes with linear rate and efficient error correction[END_REF]. As a consequence, for a local stochastic noise, the probability of correction failure decreases as the inverse of a polynomial in the block-length. Hence, when we deal with a circuit of size |C| = poly(n), the threshold depends on the polynomial rather than being a universal constant. Similarly, we could use 2-dimensional hyperbolic codes, but their minimal distance is logarithmic and thus we cannot start from any polynomial size circuit keeping a threshold which is a universal constant.

Theorem 6.5 (Fault-tolerant quantum computation with constant space overhead [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]).

For any asymptotic space overhead α > 1, there exists a threshold p th > 0 such that the following holds. Let p loc < p th and let C be a circuit with classical output, with n qubits, with T time steps and |C| locations where |C| = poly(n).

Then there exists another circuit C such that C has the same output as C and fails with vanishing probability for large n when subjected to a local stochastic noise model with parameter p loc . In addition, C has n qubits where: n = αn + o(n).

Description of the protocol

The protocol of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] requires to start from a sequential circuit (a circuit is said to be sequential when at each time step, all but one location are wait locations). In fact, there exists a sequential circuit equivalent to C with n qubits and at most n|C| = poly(n) locations. Hence, without loss of generality, C is assumed to be sequential.

To construct the circuit C , we consider a family of quantum expander codes with rate R := 2/(1 + α) and choose the smaller code in this family with parameters [[N, K]] where N ≥ √ n . For simplicity, we assume that K divides n and we split the qubits of C into n/K blocks of size K. In C , each block of C is replaced by a block of N qubits (called data qubits) and each location is replaced by a simulation cycle followed by an error correction cycle. During a simulation cycle, the location of C is simulated in C using the protocols described in this section. During the error correction cycle, the n/K blocks are corrected in parallel: for each block, the syndrome is measured and the correction inferred by the small-set-flip algorithm is applied on the qubits.

As explained in this section, the number of data qubits in C is n/R, the number of ancilla qubits for the syndrome measurements is (N -K)n/K = n(1/R -1) and the number of ancilla qubits for the simulation cycles is o(n). Hence, the space overhead of this protocol is asymptotically equal to 1/R + 1/R -1 = α.

Since the performance of quantum expander codes increases with their size, taking codes with bigger block length would be an advantage for error correction. However, we take N = Θ( √ n) for convenience in the proofs but N = n/polylog(n) would lead to constant space overhead as well. The error correction is performed with the usual circuit presented in Figure 6.3 where the thick line represents one block of the quantum expander code. There are three main steps in this circuit:

a) Error correction cycle

1. The stabilizer generators are measured, for example using the circuit presented in Figure 4.1 (these measurements can be done in a non fault-tolerant way because the generators have constant weight). The measurement result for the Z-type

generators is denoted σ X ∈ F M X 2
and the measurement result for the X-type

generators is denoted σ Z ∈ F M Z 2 .
2. The small-set-flip decoder is used twice:

• Once on the input σ X . The output denoted by e X ∈ F N 2 represents an X-type correction.

• Once on the input σ Z . The output denoted by e Z ∈ F N 2 represents a Z-type correction.

Here, it is important to use a constant time decoder since the data qubits are waiting while the decoder is running. If the amount of time for the decoder to run was depending on N , there would be a non-constant number of wait locations between the syndrome measurement and the gate P , leading to a failure with high probability for large N . Hence, the small-set-flip decoder used here is the constant time parallel version analyzed in Section 5.2.4. All along this section, X i (resp. Z i ) is the X Pauli matrix (Z Pauli matrix) applied on the i th qubit of the register.

b) Simulation of state preparation

During the simulation of a state preparation location, the goal is to prepare the state |ψ defined to be the logical |0

⊗K encoded in the quantum expander code. There exists a circuit D which creates |ψ using m = Θ(N ) qubits and |D| = O(N 2 ) locations (D is not necessarily fault-tolerant) [START_REF] Gottesman | Stabilizer codes and quantum error correction[END_REF]. Let δ = 1/T 2 = 1/poly(n), we apply Theorem 6. To simulate a measurement, we use the circuit of Figure 6.4:

1. Measure the physical qubits on the Z-basis. The output is z ∈ F N 2 where for i ∈ 1; N , the bit z i is the measurement result for the Pauli operator Z i .

2. The classical processing step computes a bit-string z L ∈ F K 2 where for k ∈ 1; K :

-The bit z L k represents the output of a noiseless measurement of the logical Pauli operator Z L k .

We already have access to z ∈ F N 2 , where for i ∈ 1; N :

-The bit z i represents the output of a noisy measurement of the physical Pauli operator Z i .

To compute z L from z, we will define as an intermediate step the bit-string z ∈ F N 2 such that for i ∈ 1; N :

-The bit z i represents the output of a noiseless measurement of the physical Pauli operator Z i .

On the one hand, since Z L k is equal to a product of Z i , the bit z L k is a sum of z i . On the other hand, z is a noisy version of z , thus the small-set-flip decoder corrects z to z with high probability.

Formally, there are three steps to compute z L : 2.1 Let g 1 , . . . , g M X be the Z-type generators of the quantum expander code.

We compute the syndrome σ ∈ F M X 2 where for all j ∈ 1; M X :

σ j := i∈supp(gj ) z i .
2.2 We run the small-set-flip algorithm on input σ and denote by Ê ∈ F N 2 the decoder output. The bit-string z is defined by: z := z ⊕ Ê.

In order to get the right value for z , we need to correct entirely the error on z. In addition, the syndrome σ has not been measured with noisy gates, thus the bits of σ are not subjected to noise. Hence, the small-set-flip algorithm used here is the logarithmic time decoder described in Section 5.2.5 and analyzed in Corollary 5.37.

2.3

We compute z L ∈ F K 2 , where for all k ∈ 1; K :

z L k := i∈supp(Z L k ) z i .
As a conclusion, the bit-string z L has been computed and the time complexity of the overall procedure is logarithmic in N . Pending the procedure completion, the other active wires in the circuit C are corrected with the constant time small-set-flip algorithm. The Pauli gate P depends on the value of x L and z L .

d) Simulation of gate

When the location in C is a gate location, the goal of the simulation cycle is to apply the corresponding logical gate in C .

To apply a logical gate U in C , we use the teleportation circuit presented in Figure 6.5. At the beginning, the register R 1 contains the data qubits and registers R 2 and R 3 contain an ancilla state |Ψ U defined by:

|Ψ U := 1 R2 ⊗ U R3 E ⊗2 |00 R2,R3 + |11 R2,R3 ⊗K ,
where E is the encoding map associated to the quantum expander code. In other words, the state |Ψ U matches the following description:

-K EPR pairs are shared between R 2 and R 3 .

-R 2 and R 3 are both encoded in the quantum expander code.

-The unitary U is applied on R 3 .

There exists a circuit D which creates |Ψ U using m = Θ(N ) qubits and |D| = O(N2 ) locations (D is not necessarily fault-tolerant). In C , the state |Ψ U is prepared with the fault-tolerant circuit D we get when we apply Theorem 6.4 to D with δ = 1/T 2 = 1/poly(n). The number of qubits in D is:

m = m polylog |D| δ = m polylog poly(m) poly(n) = m polylog(n) = Θ N polylog(n) .
Hence, since N = Θ( √ n), the number of extra qubits needed here is m = o(n). Once the ancilla state |Ψ U has been created, the circuit of Figure 6.5 is done in the following way:

1. Perform a physical Bell measurement on registers R 1 and R 2 , the outputs are denoted x, z ∈ F N 2. The classical processing step computes a bit-string x L ∈ F K 2 using x ∈ F N 2 and a bit-string z L ∈ F K 2 using z ∈ F N 2 . Similarly to the procedure used for simulating a measurement, we define x ∈ F N 2 and z ∈ F N 2 such that for all i ∈ 1; N and k ∈ 1; K :

-The bit x i is the output of a noisy measurement of X i,R1 ⊗ X i,R2 .

-The bit x i is the output of a noiseless measurement of X i,R1 ⊗ X i,R2 .

-The bit x L k is the output of a noiseless measurement of X L k,R1 ⊗ X L k,R2 . -The bit z i is the output of a noisy measurement of Z i,R1 ⊗ Z i,R2 .

-The bit z i is the output of a noiseless measurement of Z i,R1 ⊗ Z i,R2 .

-The bit z L k is the output of a noiseless measurement of Z L k,R1 ⊗ Z L k,R2 . As described in more details for the case of a measurement simulation, we correct x (resp. z) using the logarithmic time small-set-flip algorithm of Section 5.2.5 to get x (resp. z ). The bit-strings x L and z L are defined for all k ∈ 1; K by:

x L k := i∈supp(X L k ) x i , z L k := i∈supp(Z L k ) z i .
Since we use the small-set-flip algorithm of Section 5.2.5, the time complexity of the classical processing is logarithmic in N .

3. While the classical processing is running, the state in register R 3 is continuously corrected with the constant time small-set-flip decoder of Section 5.2.4.

4.

Apply U P U † on register R 3 where:

P = P (x L , z L ) :=   k∈supp(z L ) X L k     k∈supp(x L ) Z L k   .
When the gate U is a logical Clifford, the unitary U P U † is a logical Pauli which can be applied transversally. More generally, when U is in the i th level of the Clifford hierarchy, U P U † belongs to the (i -1) th level of the Clifford hierarchy.

The procedure described above is called gate teleportation [START_REF] Gottesman | Quantum teleportation is a universal computational primitive[END_REF] and can be used to apply a universal logical gate set on C :

• A logical Pauli is applied in C with a circuit made of transversal Pauli gates.

• A logical Hadamard, a logical controlled-not or a logical S gate is applied with the gate teleportation protocol. In that case, the gate U is a logical Clifford gate and thus U P U † is a logical Pauli that we apply transversally. For a controlled-not gate between two different code blocks, more registers are involved but a similar procedure works.

• A logical T gate is also implemented with gate teleportation. In that case, the unitary U P U † is a logical Clifford and is applied with a second gate teleportation protocol.

Behavior against local stochastic Pauli noise

In this section, we show that if the locations of the circuit C are subjected to a local stochastic Pauli noise, then the classical output of C is the expected output with high probability. When a circuit is run with Pauli errors applied on a set of faulty locations, we will say that we have run a faulty realization of the circuit. As we explain below, a faulty realization of C is equivalent to running C without faulty locations but where Pauli errors are applied on the data qubits after the simulation cycles, and where some measurement results are flipped before being used. Similarly, let D 1 be one of the circuits presented in Section 6.3 (Figure 6.3 or Figure 6.4 or Figure 6.5), then applying Pauli errors at faulty locations is equivalent to flipping some classical bits after the measurements, and to applying Pauli errors on the data qubits at the end of D 1 . For instance, in the circuit of Figure 4.1 used to measure a Pauli operator, the Hadamard gates and the controlled-P gate are invertible Clifford operations. Hence, a faulty realization of this circuit is equivalent to the circuit presented in Figure 6.6. In addition, as shown in Figure 6.7, an X or Y gate followed by a measurement is equivalent to a measurement followed by a bit-flip, and a Z gate followed by a measurement is equivalent to a measurement. By the same arguments:

-A faulty realization of the error correction circuit of Figure 6. Let D 1 be one of the circuits presented in Section 6.3 (Figure 6.3 or Figure 6.4 or Figure 6.5) and let D 2 be the equivalent circuit defined above (Figure 6.8 or Figure 6.9 or Figure 6.10). Using the previous points, running D 1 with a local stochastic Pauli noise on the locations is equivalent to run D 2 where the boxes "Some bits are flipped" represent a local stochastic noise on the classical bits and the boxes "Pauli gates" represent a local stochastic Pauli noise on the data qubits. Let p loc be the parameter for the local stochastic noise on the locations of D 1 , let p wire be the parameter for the local stochastic noise on the data qubits and bits of D 2 , and let p 4 := min(p 1 , p 2 , p 3 ) where p 1 , p 2 and p 3 are the thresholds for the quantum expander codes as defined in Theorem 5.30 and Theorem 5.36. For this analysis to work, the inequality p wire < p 4 /3 is required, thus we show below that p wire can be made as small as desired by lowering p loc .

An error on a data qubit q at the end of D 2 is necessarily the consequence of an error on a location which is above q in the circuit (i.e. a location which is linked to q by wires). Let L be the set of locations in D 1 and let V be the set of data qubits at the end of D 2 . For a given set S ⊂ V , we denote by A(S) ⊆ L the set of locations which are above at least one qubit of S. We have |A(S)| ≤ c 1 |S| where c 1 is a constant and each location is above at most c 2 data qubits. Given a set of faulty locations F ⊆ L, the corresponding set of faulty data qubits E ⊆ V satisfies: Let t ∈ 1; T be a time step of the initial circuit C and let |ψ t be the state of the circuit C after the t th error correction cycle under the hypothesis that the locations are not faulty. We are going to build P t a local stochastic noise on the qubits of |ψ t with parameter p 4 /2 such that when the locations of C are subjected to a local stochastic noise with parameter p loc , the state after the t th error correction cycle is P t |ψ t with high probability.

E ⊆ q ∈ V : F ∩ A(q) = ∅
To analyze the error correction cycles described in Figure 6.3 and Figure 6.8, we use Theorem 5.30 about the constant time small-set-flip algorithm. If p loc is sufficiently small, then the error on the data qubits and the syndrome bits are local stochastic with parameter sufficiently small to apply Theorem 5.30. In this theorem, c is chosen such that p ls < p 4 /4, then there is a small probability for this circuit to fail and otherwise the data qubits at the end are subjected to a local stochastic noise with parameter p 4 /2. Formally:

(1) Let |ψ be a code state of the quantum expander code. We run the error correction circuit D 1 of Figure 6.3 with the following hypothesis:

-The input of the circuit is P 1 |ψ where P 1 is a local stochastic Pauli noise with parameter < p 4 .

-The locations of D 1 are subjected to a local stochastic Pauli noise with parameter p loc .

Then there exists P a local stochastic Pauli noise with parameter < p 4 /2 such that:

P The output of D 1 is P |ψ ≥ 1 - 1 e Θ( √ N )
.

When circuit C simulates a measurement with Figure 6.4, the small-set-flip algorithm with logarithmic time is used. If p loc is sufficiently small, the error on the bits after the transversal measurement are local stochastic with parameter sufficiently small to apply Corollary 5.37. Hence the classical output of the circuit is the right one with high probability:

(2) Let |ψ be a code state of the quantum expander code. We run the measurement circuit D 1 of Figure 6.4 with the following hypothesis:

-The input of the circuit is P 1 |ψ where P 1 is a local stochastic Pauli noise with parameter < p 4 /2.

-The locations of D 1 are subjected to a local stochastic Pauli noise with parameter p loc .

Then:

P D 1 has the right output ≥ 1 - 1 e Θ( √ N )
.

Finally, when the gate teleportation protocol of Figure 6.5 is performed in C , we use Theorem 5.30 and Corollary 5.37 for the small-set-flip decoder:

(3) Let |ψ be a code state of the quantum expander code and let U be a logical gate.

We apply U with the gate teleportation circuit D 1 of Figure 6.5 with the following hypothesis:

-The data qubits at the entrance of D 1 are in the state P 1 |ψ where P 1 is a local stochastic Pauli noise with parameter < p 4 /2.

-The ancilla state is prepared in the state P 2 |Ψ U where P 2 is a local stochastic Pauli noise with parameter < p 4 /4.

-The locations of D 1 are subjected to a local stochastic Pauli noise with parameter p loc .

Then there exists P a local stochastic Pauli noise with parameter < p 4 such that:

P The output of D 1 is P U |ψ ≥ 1 - polylog(N ) e Θ( √ N )
.

We are now ready to conclude. We run the entire circuit C with the following hypothesis:

-The locations of D 1 are subjected to a local stochastic Pauli noise with parameter p loc .

-The ancilla qubits for gate teleportations are prepared in the state P 1 |Ψ U where P 1 is a local stochastic Pauli noise with parameter < p 4 /4.

-The state preparation cycles prepare the state P 2 |ψ where |ψ is the logical zero state and P 2 is a local stochastic Pauli noise with parameter < p 4 .

Let |ψ t be the state of the circuit C after the t th error correction cycle when there is no faulty location. Using the properties (1), ( 2) and (3) above, we can perform an induction on t to show the existence of a Pauli error P t with local stochastic parameter < p 4 /2 such that: P After the t th error correction cycle, the state is P t |ψ t ≥ 1 -t poly(N )

Behavior against local stochastic noise

We are now ready to give a proof sketch for Theorem 6.5. As described in Section 6.3.1, we use the fault-tolerant protocol with concatenated codes as a black-box for state preparation (the goal is to prepare either a logical zero or an ancilla state for gate teleportation). This protocol fails with probability at most 1/T 2 and is used at most T times, thus the states are successfully prepared with probability 1-o(1). By Theorem 6.4, when a state preparation does not fail, the noise on the prepared state is local stochastic with parameter c p loc . In what follows, we assume that p loc is sufficient small to ensure c p loc < p 4 /4. Hence, similarly to the hypotheses in Section 6.3.2, the qubits of the prepared states are subjected to a local stochastic noise with parameter < p 4 /4. We assume that the locations of the circuit C are subjected to a noise N with local stochastic parameter p loc . Let L be the set of locations and let L be the power set of L, then the support of the location error is a set F ∈ L. We say that F ∈ L is problematic when we can make C fail by applying Pauli errors on the locations of F . Let L * ⊆ L be the set of error supports which are not problematic. We define a Pauli noise P with local stochastic parameter p loc in the following way:

-The set of faulty locations F is chosen with the same probability distribution as N .

-If F / ∈ L * , then P applies the problematic Pauli error associated to F .

-If F ∈ L * , then P applies an arbitrary Pauli on the faulty locations (for example the identity).

The local stochastic Pauli noise P has parameter p loc . By Section 6.3.2, when the c ∈ M n1,n2 (F 2 ) is a codeword of C 1 ⊗ C 2 if and only if each row of c is a codeword of C 2 and each column of c is a codeword of C 1 (see Figure 7.2). Proof. We reduce the general problem to the particular case where H 1 and H 2 are in systematic form (see Section 7.1). By Proposition 7.1, there exist two invertible matrices Q 1 ∈ M m1,m1 (F 2 ), Q 2 ∈ M m2,m2 (F 2 ), two permutation matrices P 1 ∈ M n1,n1 (F 2 ), P 2 ∈ M n2,n2 (F 2 ) and two matrices A 1 ∈ M n1-k1,k1 (F 2 ), A 2 ∈ M n2-k2,k2 (F 2 ) such that:

Q 1 H 1 P 1 = H 1 := A 1 1 n1-k1 0 m1-n1+k1
H = 1 n1 ⊗ H 2 H 1 ⊗ 1 n2 H = 1 n1 ⊗ H 2 H 1 ⊗ 1 n2
then using the product of block matrices, we can check that H = QHP where Q is an invertible matrix and P is a permutation matrix defined as the block matrices:

Q = P -1 1 ⊗ Q 2 0 n1m2,m1n2 0 m1n2,n1m2 Q 1 ⊗ P -1
2 and P = P 1 ⊗ P 2 .

In particular, we have:

dim(C 1 ) = dim(C 1 ) = k 1 because ker(H 1 ) = P -1 1 ker H 1 , dim(C 2 ) = dim(C 2 ) = k 2 because ker(H 2 ) = P -1 2 ker H 2 , dim(C 1 ⊗ C 2 ) = dim(C 1 ⊗ C 2 )
because ker(H ) = P -1 ker H.

Hence, we have reduced the problem to the case where H 1 and H 2 are in systematic form and it remains to show dim(C 1 ⊗ C 2 ) = k 1 k 2 . The matrix H is not necessarily in systematic form but we can anyway show that if we fix a set of k 1 k 2 logical bits as shown in Figure 7.3 then there is a unique possibility for the parity bits. Formally, for any s ∈ M k1,k2 (F 2 ), there exists a unique x ∈ C 1 ⊗ C 2 such that s is the upper left part of x. Using eq. ( 7.3), for any x 1 ∈ F n1 2 and x 2 ∈ F n2 2 , we have:

x 1 ∈ C 1 ⇔ ∀i ∈ 1; n 1 -k 1 : x 1 (i + k 1 ) = k1 l=1
H 1 (i, l)x 1 (l),

x 2 ∈ C 2 ⇔ ∀j ∈ 1; n 2 -k 2 : x 2 (j + k 2 ) = k2 l=1
H 2 (j, l)x 2 (l).

If we fix some s ∈ M k1,k2 (F 2 ) and try to find x ∈ C 1 ⊗ C 2 whose upper left part is equal to s then the only possible choice is to use the following formulas: Informally, the parity bits of the lower left part are uniquely determined by the column conditions and the parity bits of the upper right part are uniquely determined by the row conditions. Moreover, the parity bits of the lower right part can be determined either using the row condition on the parity bits of the lower left part or by using the column condition on the parity bits of the upper right part. Note that both methods give the same result. The conclusion is that x is uniquely determined by s and thus C 1 ⊗ C 2 has dimension k 1 k 2 .

∀i ∈ 1; k 1 ∀j ∈ 1; k 2 x(i, j) = s(i, j), ∀i ∈ 1; k 1 -n 1 ∀j ∈ 1; k 2 x(i + k 1 , j) =
Remark 7.3. Let G 1 and G 2 be the generator matrices of C 1 and C 2 then H(G 1 ⊗G 2 ) = 0 and the equality between dimensions show that G 1 ⊗ G 2 is a generator matrix for C 1 ⊗ C 2 . Moreover, as shown in [START_REF] Sloane | The theory of error-correcting codes[END_REF], the minimal distance of C 1 ⊗ C 2 is equal to d 1 d 2 but we do not use this fact in this manuscript.

Chapter 8

Conclusion

In this work, we showed that quantum expander codes and the small-set-flip decoder can be used in the construction of ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF] to achieve fault-tolerant quantum computation with constant space overhead. The small-set-flip decoder can be parallelized to run in constant time and, as a consequence, each location of the resulting fault-tolerant circuit needs to run a constant depth classical circuit. By comparison, the time complexity for decoding other family of codes is not known to be constant leading to a fault-tolerant circuit where each time step requires to run a classical circuit whose depth grows with the number of qubits. As a future work, it would be interesting to try to reduce the time overhead of the construction presented in ref. [START_REF] Gottesman | Fault-tolerant quantum computation with constant overhead[END_REF]. In particular, the time overhead is large if the initial circuit is parallel since it has to be turned into a sequential circuit for the construction to work. For quantum expander codes and other hypergraph product codes, it is crucial to find decoders with better performance and lower time consumption; for example with decoders based on the small-set-flip algorithm or the belief propagation decoder (see [START_REF] Panteleev | Degenerate quantum ldpc codes with good finite length performance[END_REF]). Furthermore, the simulations of ref. [START_REF] Grospellier | Numerical study of hypergraph product codes[END_REF] require codes with large block-length and it would be interesting to study how the modified hypergraph product codes of ref. [START_REF] Alexey | Improved quantum hypergraph-product ldpc codes[END_REF][START_REF] Maurice | Codes correcteurs quantiques pouvant se décoder itérativement[END_REF] perform in practice. Finally, numerical studies for the parallel small-set-flip decoder and for the case of noisy syndrome measurements would be insightful as well.

163

Figure 1 . 1 :

 11 Figure 1.1: Le diagramme de Shannon pour la communication [94].

Figure 1 . 2 :Figure 1 . 3 :

 1213 Figure 1.2: le canal binaire à effacement.

2 y

 2 Figure 1.4: une communication classique avec des codes correcteurs d'erreurs.

  et est égale à C BEC (p) := 1 -p pour le canal binaire à effacement et à C BSC (p) := 1 -h 2 (p) pour le canal binaire symétrique où h 2 (p) := -p log 2 (p) -(1 -p) log 2 (1 -p) est l'entropie binaire.

Figure 1 .

 1 4 pour introduire les codes correcteurs classiques. De manière similaire, un code correcteur quantique peut être utilisé dans un protocole où Alice souhaite envoyer à Bob un état quantique |ϕ avec K qubits via un canal de communication bruité. L'idée générale est la même que dans le cas classique: elle commencent par encoder |ϕ de manière redondante dans un état |ψ avec N qubits, puis elle envoie |ψ à travers le canal bruité et finalement Bob applique une opération quantique pour corriger ρ l'état mixte reçu. La communication est un succès quand l'état | φ que Bob obtient à la fin est égal à |ϕ . Dans ce protocole, chaque état |ϕ est encodé par un état du code |ψ et l'ensemble des états du code noté Q est appelé l'espace de code ou un code correcteur d'erreurs quantiques. Par définition, l'encodage est une application linéaire de C 2 ⊗K vers C 2 ⊗N et donc l'ensemble Q est un sous-espace vectoriel de C 2 ⊗N de dimension 2 K . Le nombre entier K est appelé le nombre de qubits logiques et N est appelé le nombre de qubits physiques. État mixte ρ sur N qubits | ψ ∈ Q | ψ : conjecture pour |ψ

Figure 1 . 5 :

 15 Figure 1.5: scénario de communication pour les codes correcteurs quantiques.

  . Avec la contrainte additionnelle d'un rendement constant K = Θ(N ), la meilleure distance minimale connue est D = Θ( √ N ) et est atteinte par le produit d'hypergraphes de Tillich et Zémor [108]. Quand la distance minimale D d'un [[N ; K]] code stabilisateur est connue, on dit que le code est un [[N ; K; D]] code stabilisateur.

Figure 1 . 6 :

 16 Figure 1.6: exemples de codes CSS LDPC.

Figure 2 . 1 :

 21 Figure 2.1: Shannon's diagram for communication [94].

Figure 2 . 2 :Figure 2 . 3 :

 2223 Figure 2.2: the binary erasure channel.

2 Ex: x = 000 y ∈ F n 2 y

 20002 = x ⊕ error Ex: y = 100 x ∈ C x : a guess for x Ex: majority vote

Figure 2 . 4 :

 24 Figure 2.4: classical communication with error correcting codes.For instance, Alice sends the bit s ∈ F2 three times to Bob who can recover it using a majority vote (this is called the 3-bit repetition code).

Figure 2 .

 2 Figure 2.4 presents the protocol based on error correcting codes used by Alice and

Figure 2 . 5 :

 25 Figure 2.5: communication scenario for quantum error correcting codes.

Figure 2 . 6 :

 26 Figure 2.6: some examples of CSS LDPC codes.

Definition 3 . 1 (

 31 Hamming weight and Hamming distance). The Hamming weight of a binary vector e ∈ F n 2 is the number of 1s in e:

Figure 3 . 1 :

 31 Figure 3.1: parity check matrix, parity check equations and factor graph for the [7, 3, 3]Hamming code. The columns of the parity check matrix are the 7 possible non-zero strings with 3 bits.

  For example, on the input σ ∈ F m 2 , the minimum weight decoder returns: ê := arg min e∈F n 2 :σ(e)=σ |e|. (3.1) Notation 3.2. It will be convenient to see an error pattern e ∈ F n 2 as a subset of 1; n denoted by an upper letter:

Figure 3 . 2 :

 32 Figure 3.2: examples of errors and the associated syndrome for the Hamming code.The faulty bits and the unsatisfied checks are in red.

Figure 3 . 3 :

 33 Figure 3.3: schematic representation of the sets E, Ei and Êi used in the bit-flip algorithm (Algorithm 1).

Lemma 3 . 10 .

 310 We use Notation 3.4 assuming δ < 1 4.

Figure 3 . 4 :

 34 Figure 3.4: configuration model with n = 16, m = 8, dV = 2 and dC = 4.

  3.11 holds. The goal is to build a regular Tanner graph with n ∈ N bit-nodes, m ∈ N check-nodes, left-degree d V ∈ N and right degree d C ∈ N where nd V = md C . Note that nd V = md C is required since both integers nd V and md C are equal to the number of edges in the graph. The configuration model proceed in the following way (see Figure 3.4 for a graphical representation): 1. Build n bit-nodes and m check-nodes. 2. Create d V sockets per bit-node called left-half-edges and create d C sockets per check-node called right-half-edges.

4. 1 . 2 1 . 4 . 1 (

 12141 Parity check matrices and the symplectic representation of Pauli operators Let Q be an [[N, K]] code defined by M ∈ N stabilizer generators. These generators can be represented with a binary matrix H of size M × 2N called the parity check matrix of the code where, by definition, each row is the symplectic representation of one stabilizer generator as defined in Notation 4.Notation Sympleptic representation of Pauli operators). Let P = α N i=1 P i ∈ P N be a Pauli operator on N qubits where α ∈ {1, -1, i, -i} and P i ∈ {1, X, Y, Z} ⊗N . The symplectic representation of P denoted by r(P ) ∈ F 2N 2 is the concatenation of the two bit-strings x ∈ F N 2 and z ∈ F N 2 defined by:

( 4 . 3 )

 43 gP = P g then g P |ψ = P g |ψ = P |ψ . If gP = -P g then g P |ψ = -P g |ψ = -P |ψ .When we measure the generators g 1 , . . . , g M on the state | ψ := P |ψ , the syndrome we get is called the syndrome of the error P (or the syndrome of the state | ψ ), it is denoted by σ(P ) ∈ F M 2 or σ | ψ and its i th bit is equal to:

Figure 4 . 1 :

 41 Figure 4.1: the circuit to measure a Pauli matrix P (on the left) and the circuit to measure the generator g1 = X ⊗ Z ⊗ Z ⊗ X ⊗ 1 of the 5-qubit code (on the right).

Proposition 4 . 3 (

 43 Theorem 10.2 of [82]). Let Q be an [[N, K]] stabilizer code such that any Pauli error of weight at most T ∈ N is corrected by a given error correction procedure EC: ∀ |ψ ∈ Q, ∀P ∈ P N with P ≤ T : EC P |ψ = |ψ .

2 β

 2 N,T : σ=σ(P1)=σ(P2) α P1 α * P2 P 1 |ψ ψ| P † σ |σ σ| ⊗ P σ |ψ ψ| P † σ by eq. (4.12)

Figure 4 . 2 :

 42 Figure 4.2: Parity check matrix for the 7-qubit code.

Figure 4 . 3 :

 43 Figure 4.3: Factor graph for the 7-qubit code.

Figure 4 . 4 :

 44 Figure 4.4: Tanner graph of an hypergraph product code.

Figure 4 . 5 :

 45 Figure 4.5: Tanner graph of CX (on the left) and Tanner graph of CZ (on the right).

Remark 4 . 8 .

 48 Figure 4.5). Similarly, the qubits and the X-type generators induce the Tanner graph of C Z used to correct Z-type errors (see the right part of Figure 4.5). If the initial codes C 1 and C 2 have the LDPC property then the resulting hypergraph product code Q is also LDPC. Proof. In this proof, a matrix A is said to be (r, c)-LDPC when each row has weight upper bounded by r and each column has weight upper bounded by c. If a matrix A is (r, c)-LDPC then the tensor product A ⊗ 1 is also (r, c)-LDPC. By eq. (4.22), if C 1 , C 2 are LDPC then C X , C Z and Q are also LDPC. In Section 4.3, we will assume that the Tanner graph G 1 (resp. G 2 ) of C 1 (resp. C 2 ) is regular with left degree d V1 (resp. d V2 ) and right degree d C1 (resp. d C2 ). In that case, the VV-type qubits have degree d V1 + d V2 , the CC-type qubits have degree d C1 + d C2 , the X-type generators have degree d C1 + d V2 and the Z-type generators have degree d V1 + d C2 .

Figure 4 . 6 :

 46 Figure 4.6: Tanner graph of Q .

Figure 4 . 7 :

 47 Figure 4.7: Example of a non trivial error E with empty syndrome.

Figure 4 . 8 :

 48 Figure 4.8: constant weight error on which the bit-flip decoder is blocked. The qubits in red represent the error and the Z-type generators in red represent the unsatisfied check-nodes.

Figure 4 . 9 :

 49 Figure 4.9: schematic representation of a critical generator (c1, v2).

  Corollary 5.4 where we show that the residual error E ⊕ Ê satisfies |E ⊕ Ê| R ≤ c 0 |D| where | • | R is the reduced weight of Definition 4.13. In other words, the residual error is equivalent to an error E satisfying |E | ≤ c 0 |D|.

4 . 5 . 4 .

 454 2 and Lemma 5.3, we get Corollary 5.Corollary We use the notations of Section 5.1.1. If c 3 E + c 4 D ≤ γ 0 √ N then the reduced weight of the residual error satisfies:

Definition 5 . 5 (

 55 Local stochastic error model). We use the notations of Section 5.1.1.

  p 0 and failure probability e -Θ( √ N ) . By Theorem 5.6, the residual error A 2 = A 1 ⊕ Ê1 is local stochastic with parameter p 1/(2c0) D and failure probability 2e -Θ( √ N ) . More generally, an induction on t ∈ 1, T shows that the error E t is local stochastic with parameter p 1/(2c0) D and failure probability te -Θ( √ N ) .

Figure 5 . 1 :

 51 Figure 5.1: schematic representation of the error support in the syndrome adjacency graph.The small-set-flip decoder corrects the connected components of U independently.

  ensures that if MaxConn α1 (E ∪ D) ≤ γ 0√N then E ls is equivalent to E ⊕ Ê thus byLemma 5.18:P E ls and E ⊕ Ê are not equivalent ≤ P MaxConn α1 (E ∪ D) > γ 0 √ N ≤ C V max(p phys , p synd ) p th α1γ0 √ NWe have V = Θ(N ) and max(p phys , p synd ) < p th hence as stated in Theorem 5.6:P E ls and E ⊕ Ê are not equivalent = e -Θ( √ N ) .It remains to show that E ls is local stochastic with parameter p ls = p 1/(2c0) synd . For any S ⊆ V Q , if S ⊆ E ls then E ls = ∅ and thus MaxConn α1 (E ∪ D) ≤ γ 0 √ N . In addition by Lemma 5.17, if MaxConn α1 (E ∪ D) ≤ γ 0 √ N then there is a witness W for any S. Hence we have: P S ⊆ E ls = P S ⊆ E ls and MaxConn α1 (E ∪ D) ≤ γ 0 √ N ≤ P There exists a witness W for S .

Lemma 5 .

 5 [START_REF] Edmonds | Maximum matching and a polyhedron with 0, 1-vertices[END_REF] ensures that if MaxConn α1 (E ∪ D) ≤ γ 0√N then E ls is equivalent to E ⊕ Ê thus byLemma 5.18:P E ls and E ⊕ Ê are not equivalent ≤ P MaxConn α1 (E ∪ D) > γ 0 √ N ≤ C V max(p phys , p synd ) p th α1γ0 √ NWe have V = Θ(N ) and max(p phys , p synd ) < p th hence as stated in Theorem 5.[START_REF] Dennis | Topological quantum memory[END_REF]:P E ls and E ⊕ Ê are not equivalent = e -Θ( √ N ) .It remains to show that E ls is local stochastic with parameter p ls = p c 1 . We know by Lemma 5.34 that provided MaxConn α1 (E ∪ D) ≤ γ 0 √ N , there is a p-witness W for any S ⊆ E ls thus for all S ⊆ V Q : P S ⊆ E ls = P S ⊆ E ls and MaxConn α1 (E ∪ D) ≤ γ 0 √ N ≤ P There exists a p-witness W for S .(5.22)

  1 replacing c 0 by c 0 and Algorithm 3 by Algorithm 4. In more details: -Proposition 5.2 is replaced by Lemma 5.35. -Lemma 5.3 and Corollary 5.12 are replaced by Remark 5.26. -Corollary 5.10 is replaced by Lemma 5.27.

Figure 5 . 4 :

 54 Figure 5.4: simulation results for the (5, 6) family.

Figure 5 . 5 :

 55 Figure 5.5: simulation results for the (5, 6) family.

Figure 5 . 6 :Figure 5 . 7 :

 5657 Figure 5.6: simulation results for the (4, 5) family.

Figure 6 . 1 :

 61 Figure 6.1: representation of a unitary U , a controlled-not gate, a controlled-Z gate, a measurement and a bit-flip.

Figure 6 . 3 :

 63 Figure 6.3: Circuit for performing error correction. The Pauli gate P depends on the bit-strings eX and eZ .

3 .

 3 The Pauli correction P is applied on the data block where: P = P (e X , e Z ) :=

  [START_REF] Cj Ballance | High-fidelity quantum logic gates using trapped-ion hyperfine qubits[END_REF] to D and the resulting circuit D is used to perform the state preparation in C . The number of qubits in D is:m = m polylog |D| δ = m polylog poly(m) poly(n) = m polylog(n) = Θ N polylog(n) .Hence, since N = Θ( √ n), the number of extra qubits needed here is m = o(n).c) Simulation of measurement

Figure 6 . 4 :

 64 Figure 6.4: circuit for measurement.

Figure 6 . 5 :

 65 Figure 6.5: gate teleportation circuit. R1, R2 and R3 are the name of three quantum registers.The Pauli gate P depends on the value of x L and z L .

  3 is equivalent to the circuit of Figure 6.8. -A faulty realization of the measurement circuit of Figure 6.4 is equivalent to the circuit of Figure 6.9. -A faulty realization of the gate teleportation circuit of Figure 6.5 is equivalent to the circuit of Figure 6.10.

.

  Thus for all S ⊆ V :P S ⊆ E ≤ P ∃R ⊆ A(S) : |R| ≥ |S|/c 2 ,R ⊆ F ≤ For p loc sufficiently small, we have P[S ⊆ E] ≤ (p 4 /4) |S| and thus F is local stochastic with parameter p wire < p 4 /4.

P

  The output of C is right ≥ 1 -T poly(N )

Figure 6 . 6 :

 66 Figure 6.6: this circuit is equivalent to a faulty realization of Figure 4.1.

Figure 6 . 7 :

 67 Figure 6.7: two equivalent circuits.

Figure 6 . 8 :

 68 Figure 6.8: this circuit is equivalent to a faulty realization of Figure 6.3.

Figure 6 . 9 :

 69 Figure 6.9: this circuit is equivalent to a faulty realization of Figure 6.4.

Figure 6 . 10 :

 610 Figure 6.10: this circuit is equivalent to a faulty realization of Figure 6.5.

Figure 7 . 2 :

 72 Figure 7.2: schematic representation of a product code.

Figure 7 . 3 :

 73 Figure 7.3: product code when the parity check matrices are in systematic form.

H 1 1 ∀j ∈ 1 ;

 111 (i, l)s(l, j), ∀i ∈ 1; k n 2 -k 2 x(i, j + k 2 ) =

H 2 1 ∀j ∈ 1 ;H 1

 2111 (j, l)s(i, l), ∀i ∈ 1; n 1 -k n 2 -k 2 x(i + k 1 , j + k 2 ) = (i, l 1 )H 2 (j, l 2 )s(l 1 , l 2 ).

  Quantum error correction . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Hypergraph product codes . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Quantum expander codes . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Fault-tolerant quantum computation . . . . . . . . . . . . . . . . . . . 2.7 Summary of contributions . . . . . . . . . . . . . . . . . . . . . . . . Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Classical expander codes . . . . . . . . . . . . . . . . . . . . . . . . .

	3 Classical error correction
	3.1

1 Introduction (Français) 1.1 Correction d'erreurs classiques . . . . . . . . . . . . . . . . . . . . . . 1.2 Information quantique . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Correction d'erreurs quantiques . . . . . . . . . . . . . . . . . . . . . 1.4 Codes produits d'hypergraphes . . . . . . . . . . . . . . . . . . . . . . 1.5 Codes expanseurs quantiques . . . . . . . . . . . . . . . . . . . . . . . 1.6 Calcul quantique tolérant aux fautes . . . . . . . . . . . . . . . . . . . 1.7 Résumé des contributions . . . . . . . . . . . . . . . . . . . . . . . . . 1.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Introduction (English) 2.1 Classical error correction . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Quantum information . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 3.2.1 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Analysis of classical expander codes . . . . . . . . . . . . . . . 3.2.3 Bit-flip algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 Existence of expander graphs . . . . . . . . . . . . . . . . . . iii Chapter 1

  La question de savoir s'il existe des codes CSS LDPC avec rendement constant et distance minimale linéaire est toujours ouverte. Une approche naïve serait de construire un code CSS à partir de deux codes LDPC C X et C Z avec une bonne distance minimale. Malheureusement, si C Z est LDPC alors l'espace vectoriel C ⊥ Z contient des éléments de poids constant. Ainsi, l'inclusion C ⊥ Z ⊆ C X implique que le distance minimale de C X est constante. C'est pourquoi, de bons codes LDPC classiques ne peuvent pas être utilisés directement pour construire de bons codes CSS LDPC. X et C Z sont construits à partir de C 1 et C 2 , et le code produit d'hypergraphes est le code CSS associé à C X et C Z . Ceci est particulièrement intéressant pour les codes LDPC parce que si C 1 et C 2 sont des codes LDPC de rendement constant alors Q l'est aussi. De plus, quand C 1 et C 2 ont des distances minimales linéraires, le produit d'hypergraphes a une distance minimale égale à D = Θ( √ N ) où N est le nombre de qubits physiques. Grâce à ces paramètres favorables, il est attendu que les codes produits d'hypergraphes se comportent favorablement pour la correction d'erreurs quantiques et le calcul quantique tolérant aux fautes.

Un code produit d'hypergraphes est un code CSS Q issu de deux codes classiques C 1 et C 2 sans condition supplémentaire telle que C ⊥ 2 ⊆ C 1 . Plus précisément, deux codes classiques C

  Par contre, G est universel dans le sens où n'importe quelle unitaire peut être approchée par des portes appartenant à G. Formellement, pour tout η > 0 et pour toute unitaire U , il existe une unitaire V construite à partir des portes de G telle que: De plus, le théorème de Solovay-Kitaev[START_REF] Yu | Quantum error correction with imperfect gates[END_REF] affirme que n'importe quel circuit fait de m portes C X et de portes arbitraires sur un qubit peut être approché par O m log 2 (m/η) portes de G.Un site est un point du circuit où une erreur peut se produire. Par exemple, chaque préparation d'état, chaque mesure et chaque porte unitaire est un site. Le modèle de bruit que nous utiliserons est le modèle de bruit stochastique local de paramètre p ∈ [0, 1]. Soit L l'ensemble des sites d'un circuit arbitraire C. Alors l'erreur est représentée par une variable aléatoire F ⊆ L appelée l'ensemble des sites défaillants qui satisfait pour tout R ⊆ L:

(U -V ) |ψ ≤ η pour n'importe quel état pur |ψ .

  a Pauli error P ∈ P n , the weight of P denoted by |P | is defined to be the number of qubits on which P acts non trivially. Formally, if we write P = αP 1 ⊗ . . . ⊗ P n where α ∈ {1, -1, i, -i} is a global phase and P 1 , . . . , P n ∈ {1, X, Y, Z} are one-qubit Pauli matrices, then |P | is defined by:

  1.1.There exist two non-zero constants p 1 , p 2 > 0 such that the following holds. Suppose the pair (E, D) satisfies a local stochastic noise model with parameter (p phys , p synd ) where p phys < p 1 and p synd < p 2 . If we run Algorithm 4 with f 0 steps on the input (E, D), then there exists a random variable E ls ⊆ V Q with a local stochastic distribution with parameter p ls = p c 1 and such that:

P E ls and E ⊕ Ê are not equivalent ≤ e -Θ( √ N ) .

  By eq. (5.21), we have 2 d C /c8 p synd ≤ 1/2 thus: P W is a p-witness for S and eq. (5.23) holds ≤ 2 2 d C p c8

	|W |
	synd	.

p synd t .

  c 9 and T ⊆ E.

	By eqs. (5.25) and (5.26):
	P S ⊆ E ls ≤ 2		2 d C p c8 synd	|W |	+ p c|S| phys 2p	phys c9/2	|W |
		W ∈M(S)
	≤	2 ed |S|	w≥|S|	2 d C edp c8 synd	w	+ p	c|S| phys 2edp	c9/2 phys	w	by eq. (5.7).
	By eq. (5.21), we have 2 d C edp c8 synd ≤ 1/2 and 2edp c9/2 phys ≤ 1/2 thus:
	P S ⊆ E ls ≤	4 e	2 d C ep c8 synd	|S|	+	4 e	p	c|S| phys 2ep	c9/2 phys	|S|	.
	By eq. (5.21), we have 4 e 2 d C ep c8 synd ≤ p c 1 /2 and 4 e 2ep	c9/2 phys ≤ 1/2 thus:
										phys p |T |/2	2
							T ⊆W :
						|T |≥c9|W |,
						|T |≥2c|S|
				≤ p	c|S| phys				p	|T |/2 phys
								T ⊆W :
								|T |≥c9|W |
				≤ p	c|S| phys				t/2 2 |W | p phys
								t≥c9|W |
				≤ p	c|S| phys				2 1/c9 p 1/2 phys	t	.
								t≥c9|W |
	By eq. (5.21), we have 2 1/c9 p	1/2 phys ≤ 1/2 thus:
	P W is a p-witness for S and eq. (5.24) holds ≤ 2p c|S| phys 2p c9/2 phys	|W |	.	(5.26)
	Thus:
	P S ⊆ E ls ≤ P There exists a p-witness W for S	by eq. (5.22),
		≤		P W is a p-witness for S
			W ∈M(S)
		≤		P W is a p-witness for S and eq. (5.23) holds
			W ∈M(S)

Thus: P W is a p-witness for Sandeq. (5.24)holds ≤ P ∃T ⊆ W : S ≤ T /2c, W ≤ T /c 9 , T ⊆ E ≤ + P W is a p-witness for S and eq. (5.24) holds

  1.1, we assumed that the expansion parameter δ of the initial classical expander code satisfies δ < 1/16, which requires left degree d V ≥ 17 (by Lemma 3.11) and right degree d C ≥ d V + 1 (to get a code family with non-zero rate). The stabilizer generators of the resulting quantum expander code have weight d V + d C ≥ 35, the VV-type qubits have weight 2d V ≥ 34 and the CC-type qubits have weight 2d C ≥ 36.Moreover, the thresholds given by Theorems 5.6, 5.30 and 5.36 are very low since they are smaller than p th defined in Theorem 5.24:

  ,n1 and Q 2 H 2 P 2 = H 2 := A 2 be the parity check matrix of C 1 ⊗ C 2 , let C 1 , C 2 be the codes with party checks matrices H 1 , H 2 and let H be the parity check matrix of C 1 ⊗ C 2 :

	1 n2-k2
	0 m2-n2+k2,n2
	(7.3)
	let H

or as a subset of the qubits E X ⊆ V Q where V Q is the set of qubits. For quantum expander codes, it is convenient to use the representation E X and to see the syndrome as a subset σ X ⊆ C X where C X is the set of Z-type generators.

• In the case whereA 1 ∩ E 2 C = ∅, we take an arbitrary v 0 ∈ V such that (v 0 , v 2 ) ∈ E V (v 0 exists because v 2 ∈ E 2V ) and we pick an arbitrary c 1 ∈ Γ(v 0 ). The two elements c 1 and v 2 define the critical generator (c 1 , v 2 ) and we set:Γ 1 := v 1 ∈ Γ(c 1 ) : (v 1 , v 2 ) ∈ E V Γ 1 := Γ(c 1 ) \ Γ 1

. In more details, for i ∈ 1; N , x i is the bit we get when the Pauli operator X i,R1 ⊗ X i,R2 is measured and z i is the bit we get when the Pauli operator Z i,R1 ⊗ Z i,R2 is measured.

Chapter 8. Conclusion

Bibliography

By Proposition 4.6, we have K = k X + k Z -n 1 n 2 -m 1 m 2 and thus computing k T X and k T Z is sufficient to compute K. The integer k T X is the dimension of the code C T X whose Tanner graph is given in the left part of Figure 4.5 where the Z-type generators are interpreted as bits and the qubits are interpreted as check-nodes. In fact C T X = C 1 ⊗ C T 2 is a classical product code as defined in Section 7.2. By Proposition 7.2:

and similarly

Finally, using eqs. (4.23) and (4.24) we get:

Surprisingly, the formula for the dimension of an hypergraph product code given in Theorem 4.9 (ii) can be used to determine its minimal distance.

Proof of Theorem 4.9 (iv). As discussed in Section 4.1.6, D X is the minimal weight of an X-type Pauli error outside the stabilizer group with an empty syndrome. To prove D X ≥ min(d T 1 , d 2 ), we show that if an X-type error E ⊆ V Q satisfies E < min(d T 1 , d 2 ) and has an empty syndrome then E is equal to a product of generators. In order to write E as a product of generators, we are going to construct Q another hypergraph product code with zero logical qubit and whose Tanner graph is a sub-graph of the Tanner graph of Q. The way Q is constructed ensures that the error E has also an empty syndrome with respect to Q . Finally, since Q has zero logical qubit, any error with an empty syndrome is a product of generators.

In this proof, we denote by G 1 and G 2 the Tanner graphs of C 1 and C 2 . We will also define a classical code C 1 (resp. C 2 ) by its Tanner graph G 1 (resp. G 2 ) which is a sub-graph of G 1 (resp. G 2 ). The hypergraph product of C 1 and C 2 (resp. C 1 and C 2 ) is denoted by Q (resp. Q ) and its Tanner graph by

an X-type error seen as a subset of the qubits with σ(E) = ∅ and E < min(d T 1 , d 2 ). As illustrated in Figure 4.6, we define the set

Algorithm 3 : the small-set-flip decoder for noisy syndrome measurements.

Pick such an F i arbitrarily.

This section is organized as follows: we focus on adversarial errors with weight below the minimal distance in Section 5.1.2 and we analyze the local stochastic error model in Section 5.1.3.

Notations

All the statements presented in Section 5.1 will use the notations given below.

The error correcting code. Let G be a (γ, δ)-expander graph with γ > 0 and δ < 1/16 seen as a Tanner graph. We denote by V its set of bit-nodes, by C its set of check-nodes, by d V its left degree, by d C its right degree and by Q the associated quantum expander code. Let V Q be the set of qubits, let C X be the set of Z-type stabilizer generators, let C Z be the set of Z-type stabilizer generators and let N := V Q be the number of physical qubits of Q. We also use the notations • and | • | R from Definition 4.13.

The decoder. We run Algorithm 3 with the observed syndrome σ := σ X (E) ⊕ D as input where E ⊆ V represents the error on the qubits and D ⊆ C X represents the error on the syndrome bits.

For simplicity, we say that the input of the decoder is (E, D) instead of σ(E) ⊕ D. We denote by Ê its output, by f the number of rounds and by F 0 , . . . , F f -1 the smallsets flipped by Algorithm 3. We will also use the following variables from the body of Algorithm 3:

The set U := E ∪ F 0 ∪ . . . ∪ F f -1 is called the execution support and E ⊕ Ê is called the residual error.

Useful constants. We define the following positive constants:

Proof. Let W be the union of all the connected components of E ⊕ Ê in G that contain at least one element of S. The properties W ∈ M(S) and W ⊆ E ⊕ Ê clearly hold and it remains to prove W ≤ c 0 D ∩ Γ X (W ) . By locality (Corollary 5.10 applied with K = W ), no flip is done by Algorithm 3 on the input (W, D ∩ Γ X (W )). Moreover, the error W is reduced as a subset of the reduced error E ⊕ Ê (Lemma 4.15) and satisfies W ≤ γ 0 √ N . As a summary, there is a valid execution of Algorithm 3 on the input (W, D ∩ Γ X (W )) with output ∅ leading to the residual error W . Proposition 5.2 applied for this execution provides:

Now, our goal is to prove Lemma 5.17 which is quite similar to Lemma 5.15 where the hypothesis

There is a small technical difficulty for that: contrarily to the hypothesis of Lemma 5.15, the residual error is not reduced in general and thus we need to combine Lemma 5.15 with Lemma 5.16 below. Lemma 5.16. We use the notations of Section 5.

Lemma 5.17. We use the notations of Section 5.1.1. If MaxConn α1 (E ∪ D) ≤ γ 0 √ N then there is a reduced error E ls equivalent to the residual error E ⊕ Ê such that there is a witness for all S ⊆ E ls .

Proof. We define E ls as one of the minimal weight errors whose syndrome is the same as the syndrome of E ⊕ Ê. The first step is to show that E ls and E ⊕ Ê are equivalent.

. By locality (Corollary 5.10), there is a valid execution of Algorithm 3 on the input (E K , D K ) whose output is ÊK := Ê ∩ K and whose support is

In particular, (E ⊕ Ê) ∩ K and E ls ∩ K have the same syndrome and the weight of

Keeping the same notations than above, we will prove that for each K, there is a witness W K for S K := S ∩ K Proof. We rewrite ∆( σ, F ) in the following way:

The proof of item (i) is straightforward using the latter equality:

Under the assumption F ⊆ K of item (ii), we have Γ X (K) ∩ σ X (F ) = σ X (F ) hence the inequality above is an equality and thus item (ii) holds.

We are now ready to prove Lemma 5.9.

Proof of Lemma 5.9. Let:

Lemma 5.9 asserts that there is a valid execution of Algorithm 3 with input (E , D ), output Ê and support K. Hence we would like to find some small-sets F 0 , . . . , F f -1 ∈ F such that if we define

(5.9)

then we have the following four properties:

For any i ∈ 0; f , the set F i is a subset of the support of an X-type generator g ∈ C Z . If we assume by contradiction that F i K and

the steps of the algorithm such that F i k ⊆ K and let us prove that the sets F 0 = F i0 , . . . , F f = F i f -1 are appropriate. By definition we have:

(5.10) Hence eq. (5.11) hold.

We are now ready to prove items (iii) and (iv). By hypothesis, we have a valid execution of Algorithm 3 with input (E, D), output Ê and support U , thus:

(5.13)

Hence item (iii) holds because for all j ∈ 0; f -1 :

by eq. (5.13).

For item (iv), let F ∈ F then:

by eq. (5.14).

Percolation

The aim of this section is to prove Theorem 5.24 where a percolation process is performed on a graph G with degree upper bounded by d G ≥ 3. In the particular case where G is the syndrome adjacency graph, Theorem 5.24 turns into Lemma 5.18 that we have used in the main text. Let V be the set of vertices of G. Then a percolation process picks a random set Y ⊆ V and the question we are interested in is to compute the probability that Y contains a large connected α-subset in the sense of Definition

In this section we use the following upper bound holding for all integers n, k ∈ N:

where h(x

The first part of this section is dedicated to derive an upper bound on the number of connected sets of a degree bounded graph as stated in Lemma 5.22 and Corollary 5.23. The proof of Lemma 5.22 uses the Raney numbers [START_REF] Hee | Combinatorial interpretation of raney numbers and tree enumerations[END_REF] and follows the proof of [START_REF] Uehara | The number of connected components in graphs and its applications[END_REF].

Definition of the decoder

The sequential small-set-flip algorithm (Algorithm 3) flips one small-set per step. It is possible to parallelize this procedure by flipping many small-sets belonging to the support of different X-type generators and such that their syndromes do not intersect. For that, we introduce in Lemma 5.25 a coloring of the X-type generators represented by the sets C k Z : if g 1 and g 2 have the same color then σ X (F 1 ) ∩ σ X (F 2 ) = ∅ for any

Lemma 5.25. We use the notations of Section 5.1.1. There is a partition

Z for the X-type generators such that for all k ∈ 1; χ and all g 1 , g 2 ∈ C k Z , we have:

Proof. Let G 0 be a graph with vertex set C Z where g 1 , g 2 ∈ C Z are connected if and only if Γ X (Γ Z (g 1 )) ∩ Γ X (Γ Z (g 2 )) = ∅. In other words the incidence relation Γ 0 is defined for all g ∈ C Z to be:

).

The sets C 1 Z , . . . , C χ Z are defined as a coloring of the graph G 0 . The degree of G 0 is χ -1 thus its chromatic number is upper bounded by χ.

Lemma 5.25 leads to Algorithm 4 below which is a parallelized version of Algorithm 3. It is important to note a difference with Algorithm 3 though: instead of running until no flips reduce the syndrome weight, Algorithm 4 runs for a fixed number of steps f and may have some final steps that do not reduce the syndrome weight.

Algorithm 4 : the parallel small-set-flip decoder for noisy syndrome measurements with f = f (| σ|) steps.

Remark 5.26. Assume we establish a list of all the small-sets that are flipped by Algorithm 4 on some input, then Algorithm 3 could flip these small-sets in the same order. As a consequence, if we define U = E ∪ F 0 ∪ . . . ∪ F f -1 the execution support of Algorithm 4 then Corollary 5.12 implies that the set U ∪ D is a 2α 1 -subset of E ∪ D and Lemma 5.3 provides:

We will use Algorithm 4 in two cases: when the number of steps f is a fixed constant and when f grows logarithmically with the size of the input syndrome.

Analysis of the parallel decoder

In this section we show two useful properties we will use later in Section 5.2.4 and Section 5.2.5: Algorithm 4 is local (Lemma 5.27) and the weight of the observed syndrome decreases rapidly (Lemma 5.28 and Lemma 5.29).

Lemma 5.27 (Locality for Algorithm 4). We use the notations of Section 5.2.1. For any K ⊆ U with K ∩ Γ G (U \ K) = ∅, there is a valid execution of Algorithm 4 on the input (E ∩ K, D ∩ Γ X (K)) whose output is Ê ∩ K and whose support is U ∩ K.

Proof. The proof of Lemma 5.27 follows the same scheme than the proof of Lemma 5.9 presented in Section 5.1.4. Lemma 5.33. We use the notations of Section 5.2.1 running Algorithm 4 with f 0 steps. Suppose U + D ≤ γ 0 √ N and the residual error E ⊕ Ê is reduced then for all S ⊆ E ⊕ Ê, there is a p-witness W for S with W ⊆ U .

Proof. Let W be the union of the connected components of U in G which contains at least one element of S. We have W ∩ Γ G (U \ W ) = ∅. Thus using Lemma 5.27 with K = W , there is a valid execution of Algorithm 4 on input (E ∩ W, D ∩ Γ X (W )), with output Ê ∩ W and support U ∩ W = W . We have W ≤ γ 0

√

N and the residual error (E ⊕ Ê) ∩ W is reduced as a subset of the reduced error E ⊕ Ê (see Lemma 4.15). Hence we can apply Lemma 5.31:

By Remark 5.26:

Lemma 5.34. We use the notations of Section 5.2.1 running Algorithm 4 with f 0 steps. If MaxConn α1 (E ∪ D) ≤ γ 0 √ N then there is a reduced error E ls equivalent to the residual error E ⊕ Ê such that for all S ⊆ E ls there is a p-witness for S.

Proof. The proof is identical to the proof of Lemma 5.17 using Lemma 5.27 instead of Corollary 5.10 and Lemma 5.33 instead of Lemma 5.15.

Finally, we can prove Theorem 5.30.

Proof of Theorem 5.30. Let p th > 0 as defined in Lemma 5.18. We define p 1 , p 2 > 0 to be some positive numbers such that:

(5.21)

Let p phys < p 2 and p synd < p 2 , we assume that the pair (E, D) satisfies a local stochastic noise model with parameter (p phys , p synd ) and we run Algorithm 3 on the input (E, D). We define the random error E ls promised by Theorem 5.30 in the following way:

N then E ls is the error promised by Lemma 5.34.

-Algorithm 5 is used to correct the error.

-If the residual error on the qubits is equivalent to an empty error then the protocol is a success.

The block error rate as a function of the physical error rate is plotted in Figure 5.2 for the [START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Barg | Distance properties of expander codes[END_REF] family and in Figure 5.3 for the [START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Blum | The complexity of testing whether a graph is a superconcentrator[END_REF] family. The usual way to determine numerically the threshold is to identify the pseudo-threshold defined to be the physical error rate where the curves of Figures 5.2 and 5.3 cross. Using Figure 5.4, the pseudothreshold is near 4.5% for the [START_REF] Barg | Error exponents of expander codes[END_REF][START_REF] Barg | Distance properties of expander codes[END_REF] family. Similarly, our numerical results show that the pseudo-threshold is near 2% for the (5, 10) family. Unfortunately, near the pseudo-threshold, the block error rate is close to 1 meaning that these families cannot be used at physical error rate close to the threshold.

For the (5, 6) family, we plot in Figure 5.5 the block error rate as a function of √ K where K the number of logical qubits. Using the results of Theorem 5.6, we expect to have p ∼ ae -b √ K but we have not been able to fit the curves in that way. In Figures 5.6 and 5.7, we show how evolves the small-set-flip performance depending on the degrees of the classical codes. When d V = 4, the results are not satisfying since increasing the block length of the codes does not clearly increase the success rate, see Figure 5.6. When d V = 6, we get codes with smaller rate and the decoder performance is quite similar than for d V = 5, see Figure 5.7.

As a conclusion, the lower bound on the threshold presented in Section 5.3.1 is very pessimistic since the small-set-flip decoder can be used at decent error rates (Figure 5.2 and Figure 5.3). Moreover, the (5, 6) family seems to be optimal for the small-set-flip algorithm since this decoder does not work for a (4, 5) family (Figure 5.6) and has a worse performance for a (6, 7) family (Figure 5.7).

Code generation

The configuration model described in Section 3.2.4 builds regular Tanner graphs, however it is known that other techniques provide codes with better performance [START_REF] Hu | Regular and irregular progressive edge-growth tanner graphs[END_REF][START_REF] Mao | A heuristic search for good low-density parity-check codes at short block lengths[END_REF][START_REF] Daniel A Spielman | Finding good ldpc codes[END_REF]. In this work, we rely on the switching method introduced by McKay and Brendan in ref. [START_REF] Mckay | Asymptotics for symmetric 0-1 matrices with prescribed row sums[END_REF] to increase the girth of the Tanner graph (the girth is the length of the smallest cycle) [START_REF] Nicholas | Models of random regular graphs[END_REF]. We say that two edges (v 1 , c 1 ) and (v 2 , c 2 ) of a Tanner graph are switched when they are removed and replaced by (v 1 , c 2 ) and (v 2 , c 1 ) (note that this transformation does not change the node degrees and preserves the bipartite property). To generate our codes, we have built an initial Tanner graph using the configuration model and we have switched well chosen edges to increase the girth of the graph. As shown in Figure 5.2 and Figure 5.8, an [[N, K]] stabilizer code generated with the switching method has similar performance than a [[4N, 4K]] stabilizer code generated directly with the configuration model. Except for the codes of Figure 5.8, the classical Tanner graphs have been created with the switching method as described below.

Let n be the number of bit-nodes of a classical Tanner graph G and let v be a bitnode, then we define l v ∈ {2, 4, 8, . . . , n} to be the size of the smallest cycle containing v (l v is even since the graph is bipartite) and m v ∈ N * to be the number of cycles with locations are subjected to P, the circuit C has the right output with probability at least 1 -o(1) thus:

We purify the circuit C and use the noise N on the locations. If the error support satisfies F ∈ L * , then we can write the error applied by N as a sum of Pauli errors whose support are included in F . By definition of L * , each term of the sum is not problematic for C , thus the circuit C has the right output by linearity. As a conclusion, when the circuit C is subjected to a local stochastic noise with parameter p loc , the output is the right one with probability 1 -o(1).

Chapter 7

Deferred proofs

The goal of this chapter is to compute the dimension of the classical product code that we used in Section 4.2 to compute the dimension of hypergraph product codes. In Section 7.1 we introduce the systematic form for classical codes and use it in Section 7.2 to compute the dimension of classical product codes.

Systematic form

In this section, we define the concept of systematic form which is a standard notion in classical error correction and will be used for the analysis of the classical product code. The terminology "systematic form" can be applied either to a code, to a generator matrix or to a parity check matrix .

Let M a,b (F 2 ) be the set of a × b binary matrices. A linear code is in systematic form if there exists A ∈ M n-k,k (F 2 ) such that the generator matrix G ∈ M n,k (F 2 ) is equal to the block matrix:

where

is the identity matrix. As illustrated in Figure 7.1, the first bits of a codeword x = Gs are equal to the bits of s. Thereby, the codeword associated to s is the concatenation of s (the logical bits) and As (the parity bits). Furthermore, let H ∈ M n-k,n (F 2 ) be the following parity check matrix defined by block:

We have

thus span(G) ⊆ ker(H). Moreover, by the rank-nullity theorem dim(ker H) = k = dim(span(G)) thus span(G) = ker(H) and the codes defined by H and G are equal. A generator matrix which has the form of eq. ( 7.1) and a parity check matrix which has the form of eq. ( 7.2) are said to be in systematic form.

The main property presented in this section is Proposition 7.1: up to permutation on the bits, any error correcting code admits a parity check matrix in systematic form. Proposition 7.1. Let H ∈ M m,n (F 2 ) be a matrix with rank n -k then there exists an invertible matrix Q ∈ M m,m (F 2 ), a permutation matrix P ∈ M n,n (F 2 ) and a matrix A ∈ M n-k,k (F 2 ) such that:

Before giving the proof of Proposition 7.1, we remark that:

• If C is the code with parity check matrix H then the block matrix (A 1 n-k ) is a parity check matrix for the code C = {P -1 x : x ∈ C} where the bits have been permuted.

• Similarly, for any generator matrix G ∈ M n,k (F 2 ), there exists an invertible matrix Q ∈ M k,k (F 2 ), a permutation matrix P ∈ M n,n (F 2 ) and a matrix A ∈ M n-k,k (F 2 ) such that:

A and P GQ is a generator matrix for C = {P -1 x : x ∈ C}.

Proof. First, we remark that ker H = ker QH holds for any invertible matrix Q ∈ M m,m (F 2 ), i.e. we can apply invertible operations on the rows of H without changing the corresponding error correcting code. Moreover, in the statement of Proposition 7.1, H is multiplied on the right by the permutation matrix P , meaning that we allow the operation consisting in permuting the columns of H. Indeed, we show that using three invertible operations on H, we can turn it into the form promised in Proposition 7.1. The three operations are the following:

-Permuting the columns of the matrix.

-Replacing row number i by the sum of row number i and row number j = i.

Using these three operations, we perform a Gaussian elimination on the matrix H in order to turn it into the desired form. First, up to a permutation on the columns of the matrix, it is equivalent to show that H can be turned into the matrix:

The idea is to transform the columns of H one by one starting from the first one. Formally, we show by induction on l ∈ 0; n -k that using the three operations we can turn H into the following form:

A l 0 m-l,l B l where A l ∈ M l,n-l (F 2 ) and B l ∈ M m-l,n-l (F 2 ). The initialization of the induction for l = 0 is done with B 0 = H and the other matrices being empty. For the induction step, the rank of H and the rank of H l are equal to n -k thus, while l < n -k, there is a 1 somewhere in the matrix B l . We put this 1 in the first entry of B l using a permutation on the rows and the columns. In order to get the matrix H l+1 , we keep the 1 at position (l + 1, l + 1) and delete all the other 1 in column l + 1 by replacing for each i = l + 1 the row i by the sum of row i and row l + 1. Finally, when l = n -k, because the matrices H and H l have rank n -k, we have B l = 0 m-l,n-l and we get Proposition 7.1.

Definition of classical product code

In this section we define a class of codes obtained by taking the product of two codes. Note that given two classical error correcting codes, two kinds of product appear in this PhD thesis: "the product code" which is a classical code and the "hypergraph product code" which is a quantum code. The product code construction is used to determine the parameters of the hypergraph product codes. For more details about the classical product code, see [START_REF] Elias | Error-free coding[END_REF][START_REF] Sloane | The theory of error-correcting codes[END_REF].

Let C 1 be an [n 1 , k 1 , d 1 ] code and let C 2 be an [n 2 , k 2 , d 2 ] code then the product code C 1 ⊗ C 2 is the code whose parity check matrix H is defined by:

Note that the block-length of C 1 ⊗ C 2 is the number of columns of H and is equal to n 1 n 2 . In the case of a product code, it is relevant to represent a set of n 1 n 2 bits as a binary matrix with n 1 rows and n 2 columns. With this representation in mind, a matrix