and black (added) trap qubits $i$.

– Client applies corrections according to measurement outcomes $b_i$ and secret parameters $\theta_i, r_i$ at the output layer green qubits and obtains the final output.

\[vbqc verif\] Protocol \[prot:KW15\] is $\epsilon_{2}$-verifiable for the Client, where $\epsilon_{2} = \qty(\frac{8}{9})^{d}$ for $d = \ceil*{\frac{\delta}{2(2c+1)}}$. $\epsilon_2$-verifiability means that for any strategy of the server the real state is $\epsilon_2$-close (in trace distance) to $\rho_{ideal}(\rho_{in},p_{ok})$ for some $0\leq p_{ok}\leq 1$ where $\rho_{in}$ is the initial state and $\rho_f:=U(\rho_{in})$ is the desired final state: [$$\begin{array}[c]{lllllllllllllll}\rho_{ideal}(\rho_{in},p_{ok})&:=&p_{ok}\rho_f +(1-p_{ok})([\mathsf{abort}_1])\end{array}$$]{}

Standard Definitions of Security for Quantum Two-Party Computations
-------------------------------------------------------------------

Following [@DNS10], we have two parties $A$ and $B$ with quantum registers $\mathcal{A}$ and $\mathcal{B}$ and extra register $\mathcal{R}$, where $dim\mathcal{R} = (dim\mathcal{A} + dim \mathcal{B})$. The input is denoted $\rho_{in} \in D(\mathcal{A}\otimes\mathcal{B}\otimes\mathcal{R})$, where $D(\mathcal{A})$ is the set of all possible quantum states in register $\mathcal{A}$. Let then $L(\mathcal{A})$ be the set of linear mappings from $\mathcal{A}$ to itself and let $\phi : L(\mathcal{A}) \rightarrow L(\mathcal{B})$ be a completely positive and trace preserving superoperator, also called *quantum operation*. Finally let $\bbbone_{\mathcal{A}}$ be the totally mixed state and $\mathbf{1}_\mathcal{A}$ be identity operator in register $\mathcal{A}$. We will write $U \cdot \rho$ instead of $U \rho 