Background
Classical shadows learn many properties of an unknown state \(\rho\) from a handful of randomized measurements. A single shot draws a unitary \(U\) from a chosen ensemble, rotates the state by \(U\), and measures in the computational basis, recording the outcome \(b\) together with the unitary that produced it. From this record we reconstruct the snapshot \(U^\dagger |b\rangle\langle b| U\), the post-measurement state written back in the original frame. Each snapshot is a rank-one operator, cheap to store and to manipulate.
A single snapshot is random in two ways, through the draw of \(U\) and through the Born-rule outcome \(b\). Averaging the snapshot construction over the ensemble of unitaries and over the outcomes defines a linear map on operators, \[
\mathcal{M}(\rho) = \mathbb{E}_U \sum_b \langle b| U \rho U^\dagger |b\rangle\, U^\dagger |b\rangle\langle b| U,
\] the measurement channel. It records what the randomized measurement reports on average when the input is \(\rho\).
When the ensemble is a unitary 2-design, such as the global Clifford group, the average can depend on \(\rho\) only through \(\rho\) itself and through \(\mathrm{Tr}(\rho)\,I\). The channel then takes the depolarizing form \[
\mathcal{M}(\rho) = \frac{\rho + \mathrm{Tr}(\rho)\,I}{D+1},
\] which leaves the trace fixed and shrinks the traceless part by the factor \(1/(D+1)\). Because no part of the operator is sent to zero, the map is invertible. Its inverse is \[
\mathcal{M}^{-1}(\tau) = (D+1)\,\tau - \mathrm{Tr}(\tau)\,I,
\] and for a single qubit, \(D=2\), this reads \(\mathcal{M}^{-1}(\tau) = 3\tau - \mathrm{Tr}(\tau)\,I\). Applying \(\mathcal{M}^{-1}\) to each snapshot re-amplifies the traceless part by exactly the factor the measurement suppressed, so the corrected snapshot is an unbiased estimator of \(\rho\).
The factor \(D+1\) is the dimension of the symmetric subspace of two copies that appears in the \(k=2\) Weingarten formula, and the shrinkage it encodes is the cost of randomizing the measurement. When \(D\) is large the channel is close to singular on the traceless sector, and inverting an almost-singular channel inflates the variance of the estimator. That inflation is the price of tomographic completeness, the ability to read off any observable from the same set of snapshots.
Solution
Part (a): Deriving \(\mathcal{M}\) from the 2-design average
Start from the measurement channel, \[
\mathcal{M}(\rho) = \mathbb{E}_U \sum_b \langle b| U \rho U^\dagger |b\rangle\, U^\dagger |b\rangle\langle b| U .
\] Each term carries two factors of \(U\) and two of \(U^\dagger\), so the average is a degree-two polynomial in the entries of \(U\). For a unitary 2-design this average equals the Haar average of the same polynomial.
The form of the channel. For any fixed \(V\) in the group, the substitution \(U \to UV^\dagger\) leaves a 2-design average unchanged, and it sends \(\rho \to V \rho V^\dagger\) while keeping the outer \(U^\dagger |b\rangle\langle b| U\) unchanged after relabeling. Hence \(\mathcal{M}(V\rho V^\dagger) = V \mathcal{M}(\rho) V^\dagger\) for every \(V\). A linear map on operators that commutes with conjugation by every unitary can only be a combination of the two invariant superoperators, the identity map and the trace map. Therefore \[
\mathcal{M}(\rho) = a\,\rho + b\,\mathrm{Tr}(\rho)\,I
\] for scalars \(a\) and \(b\) that depend on \(D\) alone.
First equation, from \(\rho = I\). Setting \(\rho = I\) gives \(\sum_b U^\dagger |b\rangle\langle b| U = U^\dagger I U = I\) inside the average, so \(\mathcal{M}(I) = I\). Matching with \(a\,I + b\,\mathrm{Tr}(I)\,I = (a + bD)\,I\) yields \[
a + bD = 1 .
\]
Second equation, from the second moment. Write the channel in indices, using \((U^\dagger |b\rangle\langle b| U)_{ij} = \overline{U_{bi}}\,U_{bj}\) and \(\langle b|U\rho U^\dagger|b\rangle = \sum_{kl} U_{bk}\,\rho_{kl}\,\overline{U_{bl}}\), \[
\mathcal{M}(\rho)_{ij} = \sum_{b,k,l} \rho_{kl}\; \mathbb{E}_U\!\left[\, U_{bj}\,U_{bk}\,\overline{U_{bi}}\,\overline{U_{bl}} \,\right].
\] The Haar second moment is \[
\mathbb{E}_U\!\left[\, U_{bj}\,U_{bk}\,\overline{U_{bi}}\,\overline{U_{bl}} \,\right]
= \big(\mathrm{Wg}(e) + \mathrm{Wg}(\text{swap})\big)\,\big(\delta_{ij}\delta_{kl} + \delta_{il}\delta_{kj}\big),
\] because all four row indices equal \(b\), so both permutations of the rows contribute equally and the column deltas supply the two pairings \(\delta_{ij}\delta_{kl}\) and \(\delta_{il}\delta_{kj}\). With the \(k=2\) Weingarten values \(\mathrm{Wg}(e) = \frac{1}{D^2-1}\) and \(\mathrm{Wg}(\text{swap}) = \frac{-1}{D(D^2-1)}\), \[
c \equiv \mathrm{Wg}(e) + \mathrm{Wg}(\text{swap}) = \frac{1}{D^2-1}\Big(1 - \frac{1}{D}\Big) = \frac{1}{D(D+1)} .
\] Summing over \(b\) multiplies by \(D\), and the two pairings give \(\mathrm{Tr}(\rho)\,I\) and \(\rho\) respectively, \[
\mathcal{M}(\rho) = D\,c\,\big(\rho + \mathrm{Tr}(\rho)\,I\big) = \frac{\rho + \mathrm{Tr}(\rho)\,I}{D+1} .
\] So \(a = b = \frac{1}{D+1}\), which also satisfies \(a + bD = 1\) as required.
Single qubit. For \(D = 2\), \[
\mathcal{M}(\sigma) = \frac{\sigma + \mathrm{Tr}(\sigma)\,I}{3}.
\]
Part (b): Inverting the channel
Write the output as \(\tau = \mathcal{M}(\rho) = a\,\rho + b\,\mathrm{Tr}(\rho)\,I\) with \(a = b = \frac{1}{D+1}\), and solve for \(\rho\).
Recover the trace. Taking the trace of both sides and using \(\mathrm{Tr}(I) = D\), \[
\mathrm{Tr}(\tau) = (a + bD)\,\mathrm{Tr}(\rho) = \mathrm{Tr}(\rho),
\] since \(a + bD = 1\). The channel preserves the trace, so \(\mathrm{Tr}(\rho)\) is read off directly from \(\tau\).
Solve for \(\rho\). Substitute \(\mathrm{Tr}(\rho) = \mathrm{Tr}(\tau)\) into \(\tau = a\,\rho + b\,\mathrm{Tr}(\rho)\,I\) and isolate \(\rho\), \[
\rho = \frac{1}{a}\big(\tau - b\,\mathrm{Tr}(\tau)\,I\big).
\] With \(a = b = \frac{1}{D+1}\) this is \[
\mathcal{M}^{-1}(\tau) = (D+1)\,\tau - \mathrm{Tr}(\tau)\,I .
\]
Verification. Apply \(\mathcal{M}^{-1}\) to \(\mathcal{M}(\rho)\), \[
\mathcal{M}^{-1}\!\big(\mathcal{M}(\rho)\big)
= (D+1)\,\frac{\rho + \mathrm{Tr}(\rho)\,I}{D+1} - \mathrm{Tr}\!\left(\frac{\rho + \mathrm{Tr}(\rho)\,I}{D+1}\right) I .
\] The first term is \(\rho + \mathrm{Tr}(\rho)\,I\). In the second term, \(\mathrm{Tr}(\rho + \mathrm{Tr}(\rho)\,I) = \mathrm{Tr}(\rho) + D\,\mathrm{Tr}(\rho) = (D+1)\,\mathrm{Tr}(\rho)\), so the second term is \(\mathrm{Tr}(\rho)\,I\). They cancel, \[
\mathcal{M}^{-1}\!\big(\mathcal{M}(\rho)\big) = \rho + \mathrm{Tr}(\rho)\,I - \mathrm{Tr}(\rho)\,I = \rho .
\]
Single qubit. For \(D = 2\), \(\mathcal{M}^{-1}(\tau) = 3\,\tau - \mathrm{Tr}(\tau)\,I\). The numerical cell below applies this inverse to random matrices and confirms \(\mathcal{M}^{-1}(\mathcal{M}(\sigma)) = \sigma\) for \(D = 2, 3, 4\).