operational tools for moment characterization ... · operational tools for moment characterization,...

Operational tools for moment

characterization, entanglement

verification and quantum key distribution

Der Naturwissenschaftlichen Fakultat

der Friedrich-Alexander-Universitat Erlangen-Nurnberg

zur

Erlangung des Doktorgrades

vorgelegt von

Moroder Tobiasaus Erlangen

Als Dissertation genehmigt von der Naturwissen-schaftlichen Fakultat der Universitat Erlangen-Nurnberg

Tag der mundlichen Prufung: 31.07.2009

Vorsitzender der Promotionskommission: Prof. Dr. Eberhard BanschErstberichterstatter: Prof. Dr. Norbert LutkenhausZweitberichterstatter: Prof. Dr. Hajo LeschkeDrittberichterstatter: Prof. Dr. Maciej Lewenstein

i

Summary

In this thesis we address several different topics within the field of quantuminformation theory. These results can be classified to either enhance the appli-cability of certain conceptual ideas to be more suited for an actual experimentalsituation or to ease the analysis for further investigation of central problems. Indetail, the present thesis contains the following achievements:

We start our discussion with the question under which conditions a givenset of expectation values is compatible with the first and second moments ofthe spin operators of a generic spin j state. The aim lies on an operationaldescription that allows working with the moments directly rather than using adensity operator. We link this characterization of physical moments to the Bose-symmetric extension problem for a particular two qubit state that is completelydetermined by the given moments. Via this reformulation we can provide opera-tional sub- and superset approximations in order to identify moments which areassured to be physical and others which are clearly incompatible with quantummechanics. We show that this operational approximate solution becomes moreaccurate for increasing total spin numbers j and converges to the exact solutionin the limiting case.

Another part deals with the theoretical concept of entanglement witnesses;the most common and applicable tool for entanglement detection. In particular,we concentrate how to improve the detection strength of a linear entanglementwitness by nonlinear terms, i.e., such that one detects more entangled statesat once. The considered improvement method has the advantage that it can beemployed multiple times such that it generates a sequence of nonlinear entan-glement witnesses with higher nonlinearities and which become stronger in eachstep. This developed iteration process can be employed for different tasks andwe analyze two distinguished cases: Either we optimize the iteration method fora given target state or we try to improve the entanglement witness with respectto all entangled states equally.

In the remaining parts we discuss different options in order to make alreadyexisting ideas more applicable for actual experiments, since most of the famousapplications in quantum information theory have only been introduced on avery idealized level and hence are not directly valid for the real experiment. Ofcourse this is of particular importance for the field of quantum key distribution,because one naturally likes to conclude unconditional security also for a keygenerated in a real experiment and not just for a simplified version of it. Withthis goal in mind we first investigate the theoretical concept of a squash model,that represents an elegant “evaluation trick” to directly apply for instance thesecurity analysis of an idealized quantum key distribution protocol to the realexperiment. However this concept even helps with other tasks like detecting orquantifying entanglement. We develop a formalism to check whether a givenrealistic measurement device has such a squash model or not and provide rele-vant detection schemes with and without this particular property. In contrastto this theoretical model we also address an experimental option which equallywell provides security of a realistic quantum key distribution experiment by justusing the idealized version of it. We exploit the idea that one can combine avariable beam splitter with a simple click/no-click detector in order to achievethe statistics of a photon number resolving detector. Via this hardware change itis straightforward to estimate the crucial parameters for the security statement.

ii

Using this technique provides a way to even prove security of realistic quantumkey distribution experiments for which the theoretical squash model idea doesnot work. This results for example in a new distance record for a quantum keydistribution experiment with present technology. As a last result along theselines we focus on experimental entanglement verification. Considering the merequestion of entanglement verification this practicality issue occurs since one of-ten uses—because of various reasons—an oversimplified model for the performedmeasurements. We show that via such a misinterpretation of the measurementresults one can indeed make mistakes, nevertheless we are more interested inconditions under which such errors can be excluded. For that we introduce andinvestigate a similar, but less restrictive, concept of the squash model. As an ap-plication we show that the usual tomography entanglement test, typically usedin parametric down-conversion or even multipartite photonic experiments, caneasily be made error-free.

iii

Zusammenfassung

In der vorliegenden Arbeit behandeln wir verschiedene Themen aus dem Gebietder Quanteninformationstheorie. Die unterschiedlichen Ergebnisse sollen entwe-der die Anwendung theoretischer Konzepte auf reale Experimente erleichternoder bei der weiterfuhrenden Arbeit an zentralen Fragen helfen. Im Detail wer-den folgende Punkte genauer untersucht:

Wir wenden uns als Erstes der Fragestellung zu, unter welchen Vorraus-setzungen eine gegebene Menge an Erwartungswerten mit den ersten beidenMomenten der Spinoperatoren eines Zustandes von Gesamtspin j kompatibleist. Hierbei liegt das Hauptaugenmerk auf einer operationellen Beschreibung,so dass man direkt mit den Momenten arbeiten kann, anstatt den komplettenDichteoperator zu verwenden. Wir zeigen, dass diese Charakterisierung physi-kalischer Momente zu dem Problem der Bose-symmetrischen Erweiterungen furspeziell bestimmte Zweiqubit Zustande aquivalent ist. Mittels dieser Umformu-lierung bestimmen wir operationelle Teil- und Ubermengen der exakten Menge,um somit auf einfache Art und Weise Momente identifizieren zu konnen, diesicher physikalisch sind, als auch andere, die eindeutig inkompatibel mit denVorhersagen der Quantenmechanik sind. Diese approximative Losung des Pro-blems gewinnt mit steigender Gesamtspinzahl j an Genauigkeit, und konvergiertim Limes gegen die exakte Losung.

Im nachsten Abschnitt beschaftigen wir uns mit dem theoretischen Konzeptder Verschrankungszeugen; der gebrauchlichsten und anwendungsfreundlichstenMethode zur Verschrankungsdetektion. Wir untersuchen, wie man die Qualitateines linearen Verschrankungszeugen durch quadratische, nichtlineare Termeverbessen kann, so dass man mehr verschrankte Zustande auf einmal detektiert.Das betrachtete Verbessungsschema hat den Vorteil dass man es iterative be-nutzen kann. Dies liefert eine Abfolge von nichtlinearen Verschrankungszeugenmit Nichtlinearitaten immer hoherer Ordnung, deren Starke in jedem Schrittzunimmt. Die entwickelte Iterationsmethode kann fur verschiedene Aufgabenverwendet werden und wir betrachten zwei ausgezeichnete Extremfalle: Ent-weder optimieren wir die Iterationsmethode fur einen vorgegeben Zielzustandoder wir verbessern den Verschrankungszeugen gleichmassig in Bezug auf allemoglichen Zustande.

Im restlichen Teil der Arbeit untersuchen wir verschiedene Moglichkeiten,wie man bereits vorhandene Ideen besser an reale Experimente anpasst. Hiersei angemerkt dass viele Anwendungen der Quanteninformationstheorie nur furstark idealisierte Systeme vorgeschlagen und diskutiert wurden und somit nichtdirekt fur das Experiment anwendbar sind. Dieser Punkt ist fur das Feld derQuantenschlusselverteilung von besonderer Bedeutung, da man die vorbehalts-lose Sicherheit eines realen, durch ein Experiment generierten Schlussels zeigenmochte und nicht nur fur die einer idealisierten Version davon. Mit diesem Zielim Hinterkopf untersuchen wir zuerst die theoretische Idee des sogenanntenSquash Modells. Dieses bietet einen eleganten “Ausrechentrick”, der es erlaubt,die Sicherheitsanalyse eines idealisierten Quantenschlusselverteilungsprotokollsdirekt fur das wirkliche Experiment zu verwenden. Dennoch sei angemerkt, dassdieses Modell auch bei anderen Fragestellungen wie zum Beispiel der Verifizie-rung oder der Quantifizierung von Verschrankung hilft. Wir entwickeln einengeeigneten Formalismus zur Prufung dieses Squash Modells fur einen gegebe-nen Messaufbau und betrachten physikalisch relevante Messschemen mit und

iv

ohne dieser Eigenschaft. Im Gegensatz zu diesem theoretischen Modell behand-len wir auch eine experimentelle Moglichkeit, die es uns erlaubt, die Sicher-heitsanalyse des idealisierten Systems direkt fur das realistische Experiment zuverwenden. Dazu benutzen wir die Idee, dass man durch die Kombination ei-nes variablen Strahlteilers mit einem einfachen “Click/No-Click” Detektor, dieStatistik von photonauflosenden Detektoren erhalten kann. Durch diese Hard-wareanderung ist es moglich, die sicherheitsrelevanten Parameter des Quan-tenschlusselverteilungsexperiments direkt abzuschatzen. Diese Methode bietetsomit auch einen Weg, die Sicherheit eines realen Quantenschlusselverteilungs-experiments zu beweisen, fur das die theoretische Squash Modell Idee nichtfunktioniert. Als Ergebnis erhalt man unter anderem einen neuen Distanzre-kord fur ein reales Quantenschlusselverteilungsexperiment mit derzeitiger Tech-nologie. Als letzten Punkt betrachten wir das Problem der experimentellen Ver-schrankungsverifizierung. Bei dieser Verifizierung hat man oftmals ein Prakti-kabilitatsproblem, weil man—ob verschiedener Grunde—meistens nur ein sehrvereinfachtes Modell fur die verwendenten Messapparate benutzt. Wir zeigen,dass man in diesem Fall der Fehlinterpretation der beobachteten MessausgangeFehler machen kann, allerdings untersuchen wir in erster Linie Bedingungen, un-ter denen ein falschlicher Verschrankungsnachweis ausgeschlossen werden kann.Zu diesem Zweck verwenden wir ein dem Squash Modell ahnliches, aber wenigerrestriktives Konzept. Eine interessante Anwendung liefern die ublicherweise mit-tels Tomographie durchgefuhrten Verschrankungstests, die man typischerweisefur parametrische Fluoreszenz Quellen oder fur photonische Mehrparteienexpe-rimente verwendet. Wir zeigen, dass diese sehr einfach fehlerfrei gemacht werdenkonnen.

Contents

1 Introduction 1

2 Truncated moment problem 5

2.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52.2 Moment problem . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2.2.1 Problem formulation . . . . . . . . . . . . . . . . . . . . . 72.2.2 Expectation value matrix . . . . . . . . . . . . . . . . . . 82.2.3 Standard form . . . . . . . . . . . . . . . . . . . . . . . . 9

2.3 Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.3.1 Different representations . . . . . . . . . . . . . . . . . . . 102.3.2 Two qubit reduction . . . . . . . . . . . . . . . . . . . . . 112.3.3 First moment problem . . . . . . . . . . . . . . . . . . . . 13

2.4 Approximation techniques . . . . . . . . . . . . . . . . . . . . . . 142.4.1 Approximating subset . . . . . . . . . . . . . . . . . . . . 142.4.2 Approximating superset . . . . . . . . . . . . . . . . . . . 15

2.5 Discussion of generic problem . . . . . . . . . . . . . . . . . . . . 172.6 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202.8 Additional comments . . . . . . . . . . . . . . . . . . . . . . . . . 21

3 Nonlinear entanglement witnesses 23

3.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233.2 Iteration process . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

3.2.1 Main idea . . . . . . . . . . . . . . . . . . . . . . . . . . . 253.2.2 Definition, properties and an example iteration . . . . . . 28

3.3 Optimized iteration . . . . . . . . . . . . . . . . . . . . . . . . . . 303.4 Averaged iteration . . . . . . . . . . . . . . . . . . . . . . . . . . 323.5 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

3.5.1 Optimized iteration . . . . . . . . . . . . . . . . . . . . . 353.5.2 Random iteration . . . . . . . . . . . . . . . . . . . . . . . 383.5.3 Averaged iteration . . . . . . . . . . . . . . . . . . . . . . 38

3.6 Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

4 Squash model 41

4.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414.2 Squash model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

4.2.1 Problem formulation . . . . . . . . . . . . . . . . . . . . . 42

v

vi CONTENTS

4.2.2 QKD application . . . . . . . . . . . . . . . . . . . . . . . 444.2.3 Formalism . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

4.3 QKD measurements . . . . . . . . . . . . . . . . . . . . . . . . . 474.3.1 Polarization measurement . . . . . . . . . . . . . . . . . . 474.3.2 Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 494.3.3 BB84 and 6-state results . . . . . . . . . . . . . . . . . . . 50

4.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 524.5 Current research . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

5 Entanglement verification 55

5.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555.2 Ion trap example . . . . . . . . . . . . . . . . . . . . . . . . . . . 575.3 Positive squashing operation . . . . . . . . . . . . . . . . . . . . . 58

5.3.1 Problem formulation . . . . . . . . . . . . . . . . . . . . . 585.3.2 Entanglement verification . . . . . . . . . . . . . . . . . . 595.3.3 Existence . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

5.4 Example: Polarization measurement . . . . . . . . . . . . . . . . 625.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6 Detector decoy quantum key distribution 67

6.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 676.2 Estimating photon number statistics . . . . . . . . . . . . . . . . 69

6.2.1 Main idea . . . . . . . . . . . . . . . . . . . . . . . . . . . 706.2.2 Finite settings . . . . . . . . . . . . . . . . . . . . . . . . 716.2.3 Realistic detectors . . . . . . . . . . . . . . . . . . . . . . 73

6.3 Entanglement based QKD schemes . . . . . . . . . . . . . . . . . 746.3.1 Security analysis . . . . . . . . . . . . . . . . . . . . . . . 75

6.4 Detector decoy estimation . . . . . . . . . . . . . . . . . . . . . . 796.4.1 Simple detector decoy setup . . . . . . . . . . . . . . . . . 796.4.2 Refined detector decoy setup . . . . . . . . . . . . . . . . 81

6.5 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826.5.1 Data simulation . . . . . . . . . . . . . . . . . . . . . . . 826.5.2 Resulting key rates . . . . . . . . . . . . . . . . . . . . . . 84

6.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

7 Final remarks 91

Bibliography 93

Acknowledgments 105

Publication list 107

Curriculum Vitae 109

Chapter 1

Introduction

Quantum information theory represents a recent interdisciplinary research field.Motivated by a few key ideas like Shor’s factoring algorithm or the idea of quan-tum key distribution for secure communication, this field has drawn interest bythe insight that quantum mechanics offers, rather than being a disturbance effectin devices of always shrinking size, the potential for fascinating new applicationswhich are impossible otherwise. Hence the present time can be compared withthe end of the nineteenth century when it was realized that electromagnetismis not just a mere physical sandbox but instead represents a theory from whichone can benefit greatly, and in fact our past century was dominated by all theapplications which emerged from this theory.

Because of its interdisciplinary setting there are many different research areaswhich are all combined under the term of quantum information theory; clearlysome parts are more suited for physicists than others. In this introduction wewould like to motivate some of those research topics which are discussed morethoroughly within the subsequent chapters of this thesis.

Like any other theory of physics quantum information rests on a few basicprinciples and a consequent formalism how to describe, explain and predict theobservations from an experiment. From this underlying formalism one typicallydevelops different working tools in order to simplify the investigation and analy-sis of further problems. Obviously each of these working tools has its advantagefor particular applications, but in general it is always good to have various op-tions to choose from. Consider for instance the problem how to describe thestate of a system. Here one can use for example the density operator or aquasiprobability function to describe the state in a phase-space representation.Although both tools describe the same physical state, the density operator hasits virtue for low-dimensional systems whereas a quasiprobability function pro-vides an easier description for certain infinite dimensional states. Let us pointout that each working tool should also be operational, i.e., the advantage shouldbe of an useable form. As an example of such a particular working tool we ad-dress the question how to operationally describe the information from a system.In many occasions it happens that one is only interested in some properties ofthe system, like the expectation values of just a handful of different operatorswhich are actually measured in the experiment. Consequently one also likes tohave a formalism which describes such partial information of the entire systemmore compactly than just given by the usual density operator, which includes,

1

2 CHAPTER 1. INTRODUCTION

in this case, lots of redundant and unknown information that also increases withthe dimension of the system. An example of such a compact tool is given by thecovariance matrix that provides an operational information description if one isonly interested in the first and second moments of the position and momentumoperator. Inspired by this remarkable example we examine in Chap. 2 the anal-ogous problem how to operationally describe the first two moments of the spinoperators of a generic spin-j system. We link this information characterizationto a well-known extension problem for low-dimensional quantum states and con-sequently can formulate operational approximations. This description becomesin particular convenient for very large spin numbers j and indeed becomes exactin the limiting case of an infinite total spin number. For very small systems wepresent an alternative reformulation of the problem, which can easily be tackledby numerical means, and compare it with the operational approximations.

As for any other theory there are still some open questions in quantuminformation theory about very basic concepts. It is obvious that one first needsto attain knowledge of the underlying principles in order to see how one is able toexploit them in applications. This is even more important for the fundamentalresources. Clearly entanglement represents one, if not the most important, ofthese resources of quantum mechanics and indeed it has already been employedfor various different ideas like teleportation or superdense coding. Nevertheless,very basic properties of this resource are not fully explored yet. Already thequite simple sounding question whether a given state is entangled or not, knownas the separability problem, causes severe problems and an operational solutionis only known for particular cases. More specific questions how to quantify,distill or protect entanglement are even less investigated, but are clearly equallyimportant for further studies. In Chap. 3 we investigate one of the most powerfuland applied tools for the separability problem, known as entanglement witnesses.These are just linear operators that “witness” entanglement of the underlyingstate if their expectation value is beyond a certain threshold. However a singlewitness is unfortunately only capable to detect a rather small fraction of allentangled states, and consequently one needs to evaluate much more than oneof theses operators. In order to overcome this drawback we describe a genericway how to improve the detection strength of an entanglement witness by addinga nonlinear, quadratic term. This method can be iterated and hence generatesa whole sequence of nonlinear entanglement witnesses that become strongerin each step. We optimize this iteration according to various objectives andinvestigate which fraction of entangled states can be detected by this methodin the end.

Another working area in the field of quantum information deals with thetask how to make proposed applications more suited for an actual experiment.At this point it is important to stress that most of these applications, like quan-tum key distribution as a prominent example, have been introduced on a ratherabstract level. In this more conceptual context it is often easier to discuss itsadvantages and to perform the necessary analysis, e.g., for quantum key dis-tribution this analysis refers to the precise method to bound the eavesdroppersinformation on the raw key from the observed data. However, in any real exper-iment the situation is often far from this idealized description. Any real devicesuffers from various types of imperfections and noise while certain requirements,like a single photon source, are simply beyond our present experimental capa-bilities. This is by far not a minor point, since these differences between theory

3

and experiment can of course endanger the whole advantage of the proposedapplication. Furthermore, it should be self-evident that also the correspondinganalysis changes drastically if one needs to evaluate it for a real system insteadof an idealized, simple version. Consequently one needs to work on ideas howto close this gap between theory and experiment. Obviously there is no generalsolution to this problem since each method is more or less tied to a specific appli-cation. Nevertheless, our intention is to stay as general as possible. Rather thanproviding a special solution for a very particular experimental realization we aremore interested in different tools that can be applied for various setups. Forexample, we do not intend to solve the security issues for a particular quantumkey distribution protocol; instead we like to provide ways how to prove securityof such schemes in general. Clearly there are different possibilities: On the onehand one can try to update the underlying theory of the proposed scheme withthe intent of adjusting it better to the experimental situation. Here one caneven try to reuse part or most of the already performed analysis. On the otherhand there is always the option that one modifies the setup of the experimentsuch that it becomes easier to adopt the already existing scheme and its relatedanalysis.

Via this guideline we examine the following problems: At first we focus onconditions under which the security analysis of an idealized version of a quantumkey distribution protocol can be directly applied to its experimental realization.Chapter 4 introduces the squash model that represents a theoretical idea whereone tries to recover the idealized measurement scheme of the proposed protocolwithin the real measurement device; this is already enough to apply the corre-sponding simple security analysis to the realistic setup. Although this modelhas been employed in many different “realistic” security proofs it has never beenanalyzed more rigorously. We present a formalism that allows to check whethera given measurement scheme indeed has this squash model feature or not andwe show examples of measurement schemes with and without this property. Adifferent option of such an adaption technique is presented in Chap. 6, howeverhere we consider a slight change of the measurement setup. In the scope of thisidea one merely inserts a few additional beam splitters into the linear opticalnetwork and varies their corresponding efficiency. Via this modification onegains access to the statistics of photon number resolving detectors even if oneemploys simple click/no-click detectors. Consequently it is possible to directlyestimate the crucial (single-photon) parameters for the simple security proof.We compare this idea with the one from the squash model and motivate itsapplication via a simulation of a quantum key distribution experiment over thelongest distance so far. In a last part, Chap. 5, we investigate entanglementverification tools under realistic measurement assumptions. It often occurs thatone uses a certain entanglement detection tool without paying particular at-tention to the real measurement operators of the experiment. Consequently itcan happen that one “verifies” entanglement although it is not really there. Wepresent a theoretical formalism, similar to that of the squash model but lessrestrictive, under which such a fake entanglement conclusion can be excluded.As an example we show that the entanglement tests that are typically employedfor parametric down-conversion sources or even for certain multipartite photonicexperiments can easily indeed be made error-free.

Summarizing let us point out that the present thesis can equally well beconsidered as a collection of different results, and indeed any chapter discusses

4 CHAPTER 1. INTRODUCTION

independently one of the above mentioned topics. Therefore it is natural thatwe provide a more specialized introduction and motivation at the beginningof each chapter, as well as some background information about already knownresults within the considered topic. Moreover note that the applied techniquesare usually described at the point of their first appearance.

Chapter 2

Truncated moment problem

for spin and polarization

states

2.1 Motivation

The “black magic” calculus of quantum mechanics allows us to make predictionsabout expectation values of certain measurement outcomes; however these ex-pectation values are surprising in the following way: On the one hand we knowfrom Bell’s inequality [6] that not all possible quantum mechanical expectationvalues are compatible with a local hidden variable model; on the other hand, notall expectation values which originate from a non-signaling constrained prob-ability theory are quantum mechanical [117]. Given the quantum mechanicaldescription of the measurement device, the question arises which expectationvalues are compatible with quantum theory at all. The quantum mechanicalmoment problem [108, 111], as well as its truncated version [111] are famousparadigms of this sort of question. An operational characterization of physicalexpectation values is of course desirable, however, only few cases are known sofar. A well-known example is provided in the context of Gaussian states forsystems with a finite number of degrees of freedom. The first two moments ofthe corresponding position and momentum operators are compatible with quan-tum mechanics if and only if the Schrodinger-Robertson uncertainty principleis fulfilled [52]. This condition can be written in terms of a covariance matrix[40], which allows—together with a vector formed by the mean values—an op-erational low-dimensional description of all those moments that are compatiblewith quantum mechanics. One can exploit this low-dimensional characterizationto solve problems like separability, entanglement distillation or key distributiondirectly on the level of moments [164, 166], which pinpoints the importanceof such a result. By contrast satisfying the Schrodinger-Robertson uncertaintyprinciple is not sufficient to guarantee the existence of a quantum state in thecase of higher moments [112], and a straightforward extension of Gaussian statesmight be non-trivial [119].

In order to obtain the set of physical expectation values with respect to a

5

6 CHAPTER 2. TRUNCATED MOMENT PROBLEM

given operator set, note that there are a few trivial conditions: Whenever there issome linear dependency within the given set of operators, then the correspondingset of expectation values must satisfy the same linear relation. Moreover, eachexpectation value has to lie within the spectrum of the associated operator.However in order to obtain additional constraints we already restrict ourselvesto operator sets with further internal structure. Nevertheless we will come backto the general problem in one of the later parts of this chapter. Inspired bythe leading example of Gaussian states we mainly focus on operators sets thatbuild up the first and second moments of some observables. However, instead ofposition and momentum we consider the spin operators, presumably the othermost important set of operators in quantum mechanics, and ask again underwhich requirements a given set of expectation values are actually physical valuesfor the first and second moments of the spin operator of a total spin j system.

Of course we aim at an operational description of the set of valid expecta-tion values that enables working with the moments directly rather than usingthe complete density matrix. In order to check for compatibility of a given setof expectation values, denoted as M , the following solution is provided: First,one verifies that all linear dependencies are fulfilled by the expectation values.Next, one reconstructs a particular operator ρred(M) which acts on the symmet-ric subspace of a two qubit system. The given expectation values are consistentwith the first and second moments of the spin operators if and only if the oper-ator ρred(M) belongs to a particular class of two qubit states. This precise setis given by all two qubit states with at least (2j− 2) Bose-symmetric extension,a requirement which demands that the given two qubit operator is actually thereduced state of a 2j qubit system that is only supported on the symmetricsubspace. Although that this abstract reformulation of the problem does notprovide an operational description yet, it opens the possibility to apply resultsfrom this extension problem directly to this truncated moment problem. As aresult we can formulate operational approximations : Whenever one finds thatthis reconstructed state is separable, which can efficiently be characterized forthe two qubit case, then it is assured that the corresponding expectation valuesare quantum mechanical. In contrast if one observes that the reconstructed twoqubit state ρred(M) violates a certain, low-dimensional, positivity constraint,τj [ρred(M)] 6≥ 0, that also depends on the total spin number j, then the ex-pectation values are incompatible with quantum mechanics. This approximatecharacterization gets more accurate the larger the total spin number j becomes,and converges to the exact solution in the case of infinite spin numbers.

In particular the chapter is laid out as follows: After the precise definitionof the problem we introduce the concept of the expectation value matrix, whichalready imposes a strong condition on quantum mechanical expectation valuesfor such moment problems. After that we employ a particular representation ofthe spin operators such that we can relate the problem to the characterizationof Bose-symmetric extendible two qubit state. We further demonstrate thisreduction idea, though only carried out explicitly for the first two moments,by solving an equivalent first moment problem. Since the exact solution tothis extension problem is unknown we consider two different methods in orderto provide solutions for large and small spin numbers. In particular Sec. 2.4deals with the two different aforementioned approximation methods which bothconverge in the limit of high spin numbers. In Sec. 2.5 we return to the generalproblem and provide a solution in terms of hyperplanes; in case of the spin

2.2. MOMENT PROBLEM 7

operator this problem can be solved efficiently for low spin numbers. Using thisexact (numerical) solution we can compare the exact set via its correspondingoperational approximations. We conclude and provide an outlook on possiblefurther directions. In the end we summarize on some recent results which havebeen obtained after the completion of this work.

2.2 Moment problem

2.2.1 Problem formulation

In order to formulate the problem some notation is required first. The spinoperators of a generic spin-j system are denoted as Sj

k with k ∈ {1, 2, 3} and areacting on the Hilbert space Hj of dimension (2j + 1). These operators appearin a variety of different fields in physics: Apart from their usual appearance asthe spin operators, they also occur as the angular momentum operators, as themacroscopic spin observables of an ensemble of two-level atoms supported onlyon the symmetric subspace [75], or as the Stokes operators acting on a two-mode system with a fixed total photon number1 [77]. These operators satisfythe relations

[Sjk, S

jl ] =

3∑

m=1

iεklmSjm, (2.1)

3∑

k=1

(Sjk)2 = j(j + 1)1, (2.2)

where εklm denotes the Levi-Civita tensor, while the second condition representsthe total spin or Casimir identity. Abstractly these operators can be consideredas an irreducible representation of the Lie algebra su(2) acting onto the Paulioperator basis in the desired dimension. Note that there is only one irreduciblerepresentation for a fixed dimension of the Hilbert space, hence the spin opera-tors are uniquely defined up to a global unitary freedom, however this does notmatter here.

In the following, we are interested in the expectation values of products ofat most two spin operators only. Although higher moments can in principle bemeasured, in experiments it is often very tedious to get accurate values for thosemoments, e.g., Ref. [90]. For a given Hilbert space H let us formally denote theset of density operators as

D(H) = {ρ ∈ L(H) : ρ ≥ 0, tr(ρ) = 1} . (2.3)

The second moment problem asks for the compatibility of a given set of expec-tation values with respect to the spin operators of a system of fixed dimension.

Problem 2.2.1 (Second moment problem). Consider the set of operators givenby the products of two spin operators of a total spin j system, i.e., the set Sj

kSjl

with k, l ∈ {1, 2, 3}. Under which conditions does a given set of expectationvalues Mkl ∈ C correspond to an actual physical quantum state, i.e., there existsa quantum state ρ ∈ D(Hj) such that tr(ρSj

kSjl ) = Mkl holds for all k, l?

1The Stokes operators differ from the spin operators only by a normalization factor of 2.


Note that via the present formulation of the problem we consider first andsecond moments of the spin operators in arbitrary directions of the coordinateframe. The expectation values of the single spin operators are present via thecommutator, i.e., by the linear relation

Mkl −Mlk =∑

m

iεklmLm (2.4)

where Lm stands for the mean value of the spin operator Sjm. Note that the

spin operator along an arbitrary direction is given by Sjn =

∑

k nkSjk for a unit

vector n ∈ R3 characterizing the direction; hence its mean value and its productcan again be expanded in the considered operators of the problem formulation.

2.2.2 Expectation value matrix

The product structure of the operators considered in the truncated momentproblem directly offers a way to formulate a strong constraint on the corre-sponding expectation values. The construction of this expectation value matrix,as introduced for a more generic operator case in the following proposition, isequivalent to the derivation of the Schrodinger-Robertson uncertainty princi-ple, which all given expectation values must clearly satisfy in order to originatefrom a valid physical state. In fact the positivity requirement on the expectationvalue matrix can be considered as a compact way to simultaneously check forall uncertainties that can in principle be built up from the known expectationvalues. Note, however, that one can even form matrices which include momentsthat are not yet determined, but which constrain the already given moments.Let us point out that the concept of the expectation value matrix (or matrix ofmoments in other terminology) has recently drawn attention in the literature,Refs. [136, 104, 76, 125, 49], but we provide a short proof nevertheless due tocompleteness and simplicity.

Proposition 2.2.1 (Expectation value matrix). For a given set of operatorsFk ∈ L(H) with k ∈ {1, . . . , n} the expectation value matrix χ : L(H) → Cn×n

is defined viaC 7→ [χ(C)]kl = tr(C F †

kFl) (2.5)

for k, l ∈ {1, . . . , n}. This map χ is linear, preserves hermiticity and positivity

∀C ≥ 0 : χ(C) ≥ 0. (2.6)

Proof. Linearity and hermiticity follow directly from the definition. For thepositivity statement note that any operator of the form B†B ≥ 0 is positivesemidefinite, consequently the expectation value with any positive C ≥ 0 mustbe non-negative tr(CB†B) ≥ 0. If the operator B is formed by a linear combi-nation of the generating operator set, i.e., B =

∑

k ckFk with ck ∈ C, then anexpansion of this expectation value delivers

tr(CB†B) =∑

kl

c∗k tr(CF †kFl)cl =

∑

kl

c∗k [χ(C)]kl cl ≥ 0. (2.7)

Since this requirement must hold for arbitrary complex coefficients the expec-tation value matrix χ(C) must be positive semidefinite itself.

2.3. REDUCTION 9

Apparently each expectation value Mkl from the truncated moment problemconstitutes an entry of the expectation value matrix that results from the spinoperators as the generating operator set. Consequently, a given set of expecta-tion values M can only be physical if it already represents a positive semidefinitematrix. Because of this connection we also employ the term expectation valuematrix M in order to refer to the given set of expectation values. Note thatone can even enlarge the generating operator set with the identity; this way oneobtains a slightly bigger expectation value matrix which will become importantin the superset approximation section. Let us point out that an analogue pos-itivity requirement for the position and momentum case provides a conditionwhich is not only necessary but also sufficient for this example.

2.2.3 Standard form

In order to reduce the number of important parameters in the expectation valuematrix M we give a standard form first. Any given set of expectation values canbe transformed into such a form without changing the compatibility questionof the corresponding moments; consequently one only needs to solve the mo-ment problem for such special expectation value matrices. This standard formrelies on the idea that from any physical state and its corresponding momentsone can directly generate a different quantum state for which the coordinateframe of the spin operators is just rotated. Hence one can select a preferredreference frame in which all real parts of the off-diagonal entries vanish suchthat one is left with only five different parameters. Note that one can choosealternative orientations, for example that the mean spin vector always pointsalong a preselected direction; however this is a matter of choice. We will employthis standard form in the example section. This idea is quite common in theliterature of atomic ensembles, see, e.g., Ref. [151], hence the proof is omitted.

Proposition 2.2.2 (Standard form). For all orthogonal transformations O theexpectation value matrix M ′ = OMOT is physical if and only if M is phys-ical itself. Hence each expectation value matrix M can be transformed to thestandard form given by

M = D + iA, (2.8)

where D is a diagonal matrix with fixed trace, tr(D) = j(j + 1) and iA denotesthe antihermitean, tracefree part.

2.3 Reduction

The spin operators of a total spin-j system can be considered as a collection ofsingle spin-1/2 observables. This representation appears naturally as the prob-lem of spin coupling in physics. In the group theoretical language of the spinoperators this problem corresponds to the task how to obtain an irreducible rep-resentation of the su(2) Lie algebra from its fundamental representation [48].Let us point out that this way of writing each spin operator is the usual repre-sentation in the case of atomic ensembles [75].

We will show that for a given density operator of such a multipartite systemonly an effective two qubit state determines the expectation values of the prod-ucts of at most two spin operators. Using this idea enables us to establish a


connection between the second moment problem and the Bose-symmetric exten-sion problem for two qubit states, which represents the first main result of thechapter. This particular extension problem shows similarities to the so-calledsymmetric extension problem that has recently appeared in different contexts ofthe quantum information theory field, cf. Ref. [27, 26, 147, 58, 106, 167]. In theend we further demonstrate this reduction idea by solving an equivalent firstmoment problem.

2.3.1 Different representations

Spin-coupling examines the process how to combine a collection of differentspins such that the overall system represents a state with a different total spin.The representation change that we employ in the following is precisely based onthis idea. We regard any spin-j state as being built up by exactly 2j differentspin-1/2 systems, or equivalently by a collection of 2j different qubits. Hereone has to be careful since not each collection of such spin-1/2 states, i.e.,not any state vector of the composite Hilbert space of the multiqubit systemH2j = (C2)⊗2j , actually corresponds to a real spin-j system. For example, twodifferent pure spin-1/2 states couple to a spin-1 state if both spins are alignedalong the same direction, but if the spins point in opposite directions then thetotal spin vanishes. Of course the same problem occurs if one combines morespins together. Nevertheless, if all spins are aligned along the same directionthen one obtains a state of total spin j. Via the superposition principle togetherwith the unitary freedom it is easy to see that any state vector formed by linearcombinations of states of the form |φ〉⊗2j ∈ H2j represents a spin-j state, where|φ〉 ∈ C2 denotes an arbitrary pure state. This linear subspace generated byall this vectors is the symmetric subspace of the overall Hilbert space H2j

sym, cf.Ref. [48]. As a result we have the following equivalence: Any spin-j state canbe regarded as a multipartite state of 2j qubits which is only supported on thesymmetric subspace. On a more abstract level it is to say that the usual spin-jHilbert space C2j+1 and the symmetric subspace of a 2j qubit system H2j

sym areisomorphic.

The symmetric subspace H2jsym consists of all vectors |ψ〉 ∈ H2j that are

invariant under all possible permutations of the corresponding subsystems, i.e.,π(p)|ψ〉 = |ψ〉. Here p denotes the chosen permutation while the operator π(p)is defined via its action on a product state basis given by π(p)|i1〉⊗ · · ·⊗ |i2j〉 =|ip−1(1)〉 ⊗ · · · ⊗ |ip−1(2j)〉.

On this symmetric subspace the spin operators take the following represen-tation

Sjk =

1

2

2j∑

n=1

σ(n)k

�|sym

, (2.9)

with

σ(n)k = 1⊗(n−1) ⊗ σk ⊗ 1⊗(2j−n) (2.10)

being the Pauli operator σk acting on the n-th qubit, while the symbol �sym

denotes the restriction to the symmetric subspace.

2.3. REDUCTION 11

2.3.2 Two qubit reduction

As explained in the previous section any spin-j state can be interpreted as aparticular multiqubit state that is only supported on the symmetric subspace.Because of the special symmetry of such states and the explicit representationof the spin operators, the products of at most two spin operators only depend onan effective spin-1 state. The following proposition summarizes this reductionand links the corresponding spin operators to its equivalent spin-1 counterparts.This reduction idea appears already in the context of atomic ensembles, cf.Ref. [160] which also contains examples of such reduced states. The proof isstraightforward and can directly be extended to higher moments, e.g., if one isinterested in products of up to n different spin operators then the reduced stateof n qubits already determines the expectation values.

Proposition 2.3.1 (Spin-1 reduction). For every spin-j state ρj ∈ D(H2jsym),

the expectation values of products of at most two spin operators only need to becalculated on the reduced spin-1 state ρred(ρj) ∈ D(H2

sym) given by

ρred = tr3...2j(ρj). (2.11)

Each expectation value equals to tr(ρjSjkS

jl ) = tr(ρreds

jkl) with

sjkl =

1

4[2j σkσl ⊗ 1+ 2j(2j − 1) σk ⊗ σl]

�|sym

. (2.12)

Proof. The proof is given by direct evaluation of the expectation values. For agiven multipartite state ρj that corresponds to a spin-j state one obtains

tr(ρjSjkS

jl ) =

1

4

2j∑

n,m=1

tr(ρjσ(n)k σ

(m)l )

=1

4

∑

n=m

tr(ρjσ(n)k σ

(m)l ) +

1

4

∑

n6=m

tr(ρjσ(n)k σ

(m)l )

=1

4

{∑

n=m

tr[ρj(σkσl ⊗ 1⊗ . . . )] +∑

n6=m

tr[ρj(σk ⊗ σl ⊗ 1⊗ . . . )]}

=1

4

{

2j tr[ρred(σkσl ⊗ 1)] + 2j(2j − 1) tr[ρred(σk ⊗ σl)]}

.

In the first line we have employed the particular representation of the spin oper-ators given by Eq. 2.9. However, let us point out that because of simplicity wehave ignored the explicit restriction to the symmetric subspace �sym althoughthis restriction is implicitly present because the spin-j density operator ρj onlyoperates on this subspace. Moreover note that this restriction is also unimpor-tant in the product evaluation of the spin operators. Afterwards, we split thesum into two terms depending whether the Pauli operators act on the same oron different qubits of the overall system. Because of the permutation symmetryof each spin-j state the exact ordering of the operators does not matter and wechoose without loss of generality that all Paulis act on the first two qubits whileon the rest we just act with the identity operator. Hence each expectation valueonly depends on the reduced state of the first two qubits ρred = tr3...2j(ρj).For the last step one only needs to count the number of different terms in the


summation. In order to obtain the final result of the proposition note that thereduced state ρred is again an operator on the symmetric subspace only andtherefore one can insert this dependence again into the operator.

Let us point out that the mean value of each spin operator is again includedvia the commutation relation of the spin operators, cf. Eq. 2.1. As shown bythe proposition, only the reduced two qubit state ρred of a given multipartitestate ρj determines the expectation values of the spin operators. However,not all possible spin-1 density operators are actually reduced states of sucha multipartite system. For example a maximally entangled state can neveroriginate from such a symmetric multipartite state, because the permutationsymmetry would imply that each single qubit is maximally entangled with everyother qubit of the system; however this contradicts with the monogamy propertyof entanglement [72]. The formal definition of all valid two qubit reductions ofa spin-j state is given by

Sj ={ρred ∈ D(H2

sym) : ∃ρj ∈ D(H2jsym) : tr3...2j(ρj) = ρred

}, (2.13)

with j ≥ 1. Hence, a spin-1 state can only correspond to a spin-j system ifit can be extended back to a symmetric multipartite state of 2j qubits. Thisdefinition resembles the notion of symmetric extensions, as examined for exam-ple in the seminal paper of Ref. [27]. However in the definition of symmetricextensions, as given in this reference, the corresponding multipartite state mustonly be invariant under the permutation of the individual subsystems, while inthe present case one demands that the extension is on the symmetric subspaceonly. Although both problems are very similar—and in fact, many results canbe “borrowed” directly form the symmetric extension case—certain propertiesdiffer2; hence we employ the term Bose-symmetric extensions for such a problemaccording to notion common in the de Finetti literature [21]. The next theoremestablishes the connection between the second moment problem as introducedin Prob. 2.2.1 and the Bose-symmetric extensions question of a particular spin-1state.

Theorem 2.3.1 (Physical expectation values). For a given set of expectationvalues M the corresponding spin-1 state ρred = ρred(M) is uniquely determinedby the set of linear equations

tr(ρredsjkl) = Mkl, ∀k, l (2.14)

with sjkl given by Eq. 2.12.

The set of expectation values M is physical if and only if ρred(M) ∈ Sj, i.e.,the state ρred(M) has exactly (2j − 2) Bose-symmetric extensions.

Proof. It is straightforward to check that the operators given by Eq. 2.12 spanan operator basis for a generic spin-1 state, hence the corresponding spin-1state ρred = ρred(M) is uniquely determined by the set of expectation valuesM . This particular two qubit state can only correspond to a spin j system if itis an element of the class Sj .

2For example, every separable and permutation invariant two qubit density operator has asymmetric extension to arbitrary many copies, while it does not need to have a Bose-symmetricextension, cf. Ref. [151].

2.3. REDUCTION 13

2.3.3 First moment problem

In this subsection we briefly discuss a simplified version of the truncated momentproblem in which one asks for compatibility of the first moments only. Thisproblem highlights again the importance of the reduction idea, which allows anoperational solution in this case. The problem states as follows:

Problem 2.3.1 (First moment problem). Consider the set of spin operatorsSj

k with k ∈ {1, 2, 3} of a total spin j system. Under which conditions does agiven set of expectation values Lk ∈ R correspond to an actual physical quantumstate, i.e., there exists a quantum state ρ ∈ D(Hj) such that tr(ρSj

k) = Lk holdsfor all k?

The operational description of the set of valid expectation values relies onthe reduction to a qubit problem in close analogy to Prop. 2.3.1. The crucialpoint is that every valid qubit state represents a possible reduced state of a totalspin-j state, i.e., each physical qubit density operator has an arbitrary numberof Bose-symmetric extensions. The next proposition contains the operationalsolution of the first moment problem.

Proposition 2.3.2 (Operational description). The set of expectation valuesLk ∈ R with k ∈ {1, 2, 3} is physical with respect to the spin operators of ageneric spin j system if and only if it holds

3∑

k=1

L2k ≤ j2. (2.15)

Proof. Similar to Prop. 2.3.1 it holds that for every spin-j density operator ρj

the expectation values of the spin operators only need to be calculated on thereduced qubit state ρred = tr2...2j(ρj) and are given by tr(ρjS

jk) = j tr(ρredσk)

for all possible k. In contrast to the second moment problem we have the casethat every valid qubit state can originate from a corresponding multipartite statevia ρj = ρ⊗2j

red �sym. Thus, the given expectation values Lk of the spin operatorsonly need to form a physical qubit density operator ρred(L) ∈ D(C2). Since theset of given expectation values L uniquely determines the Bloch vector Lk/j ofthe reduced qubit state, this is the case if and only if Eq. 2.15 is satisfied.

We close with a discussion of the structure of possible “solution states” tothe first moment problem. For the given set of expectation values any com-patible quantum state can be parameterized as ρ(x) = ρfix(L) + ρopen(x), witha fixed part ρfix(L) that is completely determined by the given moments Lk,and an orthogonal (with respect to the Hilbert Schmidt inner product) openpart ρopen(x) that depends linearly on a set of real parameters xi ∈ R, whichmust be chosen in order to fulfill the positivity requirement ρ(x) ≥ 0 of thedensity operator. Proposition 2.3.2 guarantees the existence of such a set ofparameters x as long as the expectation values fulfill Eq. 2.15. However, thereis even the special class of solutions in the case when the fixed part alreadyforms a valid density operator, i.e., ρfix(L) ≥ 0. However this only happens forthe case

∑

k L2k ≤ (j+ 1)2/9, which shows that the open part ρopen(x) is indeed

necessary for the solution because it allows to compensate a non-positive fixedpart in many cases.


2.4 Approximation techniques

Any solution of the Bose-symmetric extension problem for two qubits provides asolution for the second moment problem. However, an operational analytic char-acterization of those sets is cumbersome and only partial results are known sofar. Therefore we will restrict ourselves to two different operational approxima-tions in the following: In particular, we identify a set of states which completelylies within the set of extendible states, and a different set which contains at leastall the states with a given number of extensions. Combined together both setsapproximate the precise set in such a way that only a fraction of states areuncharacterized whether they can be extended to a certain number of qubits ornot. This region of unknown states becomes smaller with an increasing totalspin number and both approximations converge to the exact solution in thelimiting case of an infinite spin number.

Using these results for the truncated moment problem enables the identi-fication of expectation values M which are assured to be physical and otherswhich are clearly incompatible with quantum mechanics. However with theconvergence result one has to be careful since it only states convergence withrespect to a set of normalized expectation values. More precisely, for a givenset of expectation values M in the standard form, cf. Eq. 2.8, these expectationvalues read as

mjk :=

〈Sjk〉j

(2.16)

vjk :=

〈(Sjk)2〉

j(j − 1/2)− 1

2j − 1(2.17)

for all possible k. The parameters vjk determine the diagonal entries of the ex-

pectation value matrix, while mjk fixes the antihermitean tracefree part. Via

this set of normalized expectation values the corresponding spin-1 state ρred

is independent of the considered total spin number j. In the limiting case ofj → ∞, when these normalized expectation values converge to mk and vk respec-tively3, only these values are assured to be characterized by the approximationtechnique.

2.4.1 Approximating subset

The set of separable two qubit states, only supported on the symmetric subspace,forms an approximating subset to the set of Bose-symmetric extendible states,independent of the number of extensions. Hence, if a given set of expectationvalues M allows the reconstruction of a separable spin-1 state ρred(M), then allexpectation values are guaranteed to be physical. The set of separable spin-1states is characterized as

R ={ρred ∈ D(H2

sym) : ρΓred ≥ 0

}. (2.18)

in which Γ denotes the partial transpose with respect to one of the subsystem.This condition provides an operational necessary and sufficient condition for

3For the products on the diagonal it also holds for vjk

:= 〈(Sjk)2〉/j2 → vk which is the

leading term in the limit j → ∞.

2.4. APPROXIMATION TECHNIQUES 15

separability in low dimensions [114, 55]. The next theorem outlines the prop-erties of this subset. Let us point out that the convergence result is a directconsequence of the corresponding result for states with symmetric extensions,cf. Ref. [27]. A separable two qubit density operator appears for example in thecase of polarization states, in which all photons (of a fixed number) are in onepolarization mode; clearly the same holds for any convex combination of suchstates. In contrast, any spin squeezed state must necessarily have an entangledtwo qubit density operator [161], as well as certain multipartite states from theatomic ensemble literature [142].

Theorem 2.4.1 (Approximating subset). The sets Sj with j ≥ 1, and R definedby Eqs. 2.13 and 2.18 satisfy:

1. If ρred ∈ R, then ρred ∈ Sj , ∀j. Hence R ⊆ Sj , ∀j.

2. If ρred ∈ Sj, then ρred ∈ Sj′ with j′ ≤ j. Hence Sj ⊆ Sj′ for j′ ≤ j.

3. For all ρred 6∈ R there exists an j0 ∈ N such that ρred 6∈ Sj for j0 ≤ j.

Proof. Any density operator from the set of separable states R can be writtenas a convex combination of product states, i.e., ρsep =

∑

i pi|αi〉〈αi| ⊗ |βi〉〈βi|,where pi denote the respective probabilities and |αi〉, |βi〉 are pure states fromthe qubit Hilbert space. Since each two qubit density operator is only sup-ported on the symmetric subspace it has to hold that the projection on theantisymmetric subspace vanishes, i.e., tr(ρsepP−) = 0 where P− stands for thecorresponding projector. Using the given expansion of the density operator andthe non-negativity of each term, this condition can only be fulfilled if each purestate |αi〉 ⊗ |βi〉 ∈ H2

sym is already an element from the symmetric subspace.However, this requirement can only hold if both states equal, |αi〉 = |βi〉 forall i. Via this particular structure of the separable states from the set R itis straightforward to write down a valid Bose-symmetric extension to (2j − 2)copies according to

ρj =∑

i

pi|αi〉〈αi|⊗2j, (2.19)

which consequently proves the first statement of the theorem.The second statement follows easily from the set definition of Sj . The last

point is a direct consequence of Thm. 1 from Ref. [27] that states that any bi-partite state ρAB ∈ D(HAB) with an arbitrary number of symmetric extensionsto one of the subsystems must necessarily be separable.

2.4.2 Approximating superset

The concept of the expectation value matrix, cf. Prop. 2.2.1, offers a way toformulate an approximating superset to the set of Bose-extendible states. Noteagain that any reduced state ρred contains the expectation values for productsof at most two spin operators of the corresponding spin-j system by using theoperators sj

kl from Eqs. 2.12, hence it is also possible to “recover” a certainexpectation value matrix from this reduced state. Proposition 2.4.1 formallyintroduces the reduced expectation value matrix τj in which one exactly tries toachieve this task: One reproduces an original expectation value matrix χj ofa spin-j system from the reduced state ρred. Note that this expectation value


matrix includes a normalization which is needed to protect against divergence ofthe expectation values in the limit j → ∞. The crucial property for our purposeis that any recovered expectation value matrix must be positive semidefinite ifthe reduced state corresponds to an actual physical spin-j state. Since it is adirect combination of Prop. 2.2.1 and Thm. 2.3.1 we omit an explicit proof.

Proposition 2.4.1 (Reduced expectation value matrix). Let χj denote theexpectation value matrix formed by the identity and the set of normalized spinoperators Sj

k/j.The reduced expectation value matrix (of order j) τj : L(H2

sym) → C4×4

maps any reduced operator Cred to this expectation value matrix, i.e.,

Credsj

kl7−→ τj(Cred) = χj , (2.20)

via the spin-1 operators sjkl from Eq. 2.12. This map satisfies

∀ρred ∈ Sj : τj(ρred) ≥ 0. (2.21)

The approximating superset is formed by all spin-1 states which provide anon-negative reduced expectation value matrix of order j, hence it is given by

Tj ={ρred ∈ D(H2

sym) : τj(ρred) ≥ 0}, (2.22)

defined for all j ≥ 1. Unlike the subset characterization, any superset dependson the number of considered extensions j. The next theorem lists the prop-erties of these supersets. If a given set of expectation values M provides areconstructed spin-1 operator ρred(M) that is not element of the class Tj , thenthe given expectation values are incompatible with quantum mechanics. How-ever, note that if one really has such a set of expectation values at hand then onedoes not need to compute the expectation value matrix χj via the reduced statebut instead one can directly build up the matrix χj from the given expectationvalues M . Nevertheless, also non-positivity of the reduced state ρred(M) 6≥ 0signals that the given expectation values are non-physical.

The defined supersets converge to the set of separable states in the limit ofan infinite number of extensions. Hence the reduced expectation value matrix(in the limit j → ∞) delivers an alternative necessary and sufficient separabilitycriterion valid only for symmetric two qubit states, but which does not rely onthe partial transpose. However, in order to prove convergence of those sets, weexploit a necessary and sufficient condition for entanglement of the reduced twoqubit state, cf. Ref. [74], which is derived using the partial transpose.

Theorem 2.4.2 (Approximating superset). The sets Tj of Eq. 2.22 with j ≥ 1satisfy:

1. If ρred ∈ Tj, then ρred ∈ Tj′ with j′ ≤ j. Hence Tj ⊆ Tj′ for j′ ≤ j.

2. If ρred ∈ Sj , then ρred ∈ Tj , ∀j. Hence Sj ⊆ Tj , ∀j.

3. For all ρred 6∈ R there exists an j0 ∈ N such that ρred 6∈ Tj for j0 ≤ j.

Proof. The proof of the first two statements is straightforward. We prove con-vergence by contradiction along the following lines: First, one uses the resultfrom Ref. [74] in order to formulate a necessary and sufficient condition for the

2.5. DISCUSSION OF GENERIC PROBLEM 17

entanglement of the reduced two qubit state in terms of the normalized expec-tation values. Here one can alternatively employ the condition from Ref. [156].Second, one derives a necessary requirement for the non-negativity of the re-duced expectation value matrix τj in the limit j → ∞, expressed again interms of the normalized expectation values of the spin-1 state. The two givenconditions are mutually exclusive, hence no entangled state can be part of thesuperset Tj in the limit j → ∞. This shows convergence to the separable statesin the end, since any separable spin-1 state is part of the supersets.

For any unit vector n ∈ R3 the corresponding spin operator along thisdirection is denoted as Sj

n, cf. the problem formulation section. Let mjn and vj

n

denote the corresponding normalized expectation values of this spin operator,similar as given by Eq. 2.16. Using the condition from Ref. [74], the reducedspin-1 state ρred is entangled if and only if there exists a direction n such thatvj

n − (mjn)2 < 0 holds.

The reduced expectation value matrix of order j for a given spin-1 statecan only be positive semidefinite if all principle minors are non-negative. Usingthe unitary freedom of the matrix representation, in combination with the non-negativity of all possible 2 × 2 minors ensures the condition ∆Sj

n/j2 ≥ 0 for

all possible directions n. If one re-expresses this requirement in terms of thenormalized expectation values one arrives at

vjn − (mj

n)2 +1

2j(1 − vj

n) ≥ 0, (2.23)

which becomes vn−m2n ≥ 0 in the limit j → ∞. This condition ensures that the

entanglement condition can never be met in the limit, which proves convergencein the end.

2.5 Discussion of generic problem

In this section we return to the general problem and ask under which require-ments a given set of numbers are possible expectation values from a physicalstate with respect to a certain set of operators, similar to Prob. 2.2.1. Here itis sufficient to consider a linearly independent set of hermitian operators, sincelinear dependencies within the operator set demand just trivial (linear) con-straints on the corresponding expectation values and any linear operator canalways be written as the sum of two hermitian ones. The precise consistencyproblem reads as follows:

Problem 2.5.1 (Consistency problem). Consider a linearly independent set ofhermitian operators Ai with i = 1, . . . n on a finite dimensional Hilbert space H.Under which conditions does a given expectation value vector b ∈ Rn correspondto an actual physical quantum state, i.e., there exists a quantum state ρ ∈ D(H)such that tr(ρAi) = bi holds for all i?

Since the set of density operators D(H) is compact, and because of linearityof the map M : D(H) → Rn that assigns the corresponding expectation valuesto a given state, ρ 7→ [M(ρ)]i = tr(ρAi), the set of valid expectation valuesis also compact. According to the Hahn-Banach theorem, every expectationvalue vector outside this set can be separated by a corresponding hyperplane,in analogy to entanglement witnesses [55] for the separability problem. The


following theorem summarizes the necessary properties of those hyperplanes andtherefore provides a possible characterization of the set of quantum mechanicalexpectation values. Let us point out that for a given expectation value vector,the search for the optimal hyperplane can be cast in the form of a semidefiniteprogram [158], which can be solved efficiently with interior-point methods. Thegiven proof is based on this idea and employs well-known duality relations fromsemidefinite programming, cf. Ref. [158].

For the considered second moment problem of the spin operators, the formu-lation in terms of a semidefinite program offers an efficient way to characterizethe set of possible expectation values for low spin numbers j, i.e., for situationswhere the approximation method fails to provide a good description. Note thatif one uses the particular representation of the considered spin operators, thenone obtains a characterization of Bose-extendible states in terms of witness op-erators, similar to the entanglement witness method for the symmetric extensioncase as described in Ref. [27].

Theorem 2.5.1 (Hyperplane characterization). For a given set of linearly in-dependent operators {Ai} and an expectation value vector b ∈ Rn, one has:� The vector b is non-physical if there exists a hyperplane, characterized by

the normal vector z ∈ Rn : Z =∑ziAi ≥ 0, tr(Z) = 1, such that it holds

zT b < 0.� The vector b is physical if for all hyperplanes, characterized by the normalvector z ∈ Rn : Z =

∑ziAi ≥ 0, tr(Z) = 1, it holds that zT b ≥ 0.

Proof. Via the Gram-Schmidt orthogonalization procedure one can transformany linearly independent set of hermitian operators {Ai} into an orthonormalset of hermitian operators {Si}, i.e., the operators satisfy tr(SiSj) = δij andtr(Si) ∝ δi1. This transformation is 1-to-1 and onto, while the correspondingexpectation value vector b has to be modified in the same way, which results inthe new expectation value vector t.

The transformed set {Si} with i = 1, . . . n can be extended to a completehermitian operator basis {Si} with i = 1, . . . d2 and d = dim(H). This basisset {Si} then satisfies again tr(SiSj) = δij and tr(Si) ∝ δi1, which states that

only the first operator is proportional to the identity, in fact S1 = 1/√d, andall other elements Sj for j > 1 are tracefree. Since we have an operator basis athand every density operator can be expressed as ρ =

∑

i xiSi with xi = tr(ρSi).It must hold that xi = ti for all i = 1, . . . n, because otherwise the expectationvalues do not match. The remaining open parameters xi, ∀i = n+ 1, . . . d2 mustbe chosen such that ρ(x) = ρfix + ρopen(x) ≥ 0 forms a positive semidefiniteoperator. Here we have denoted the fixed part of the density operator by ρfix =∑

i≤n tiSi and the open part by ρopen(x) =∑

i≥n+1 xiSi. This parameter searchcan be cast into the form of a semidefinite program [158], given by

min s (2.24)

s.t. F (x, s) = ρ(x) + s1 ≥ 0,

with a possible solution (x∗, s∗). On the one hand we have that if s∗ > 0, thenthere exists no parameters x such that ρ(x) ≥ 0 holds because of the optimalityof s∗. On the other hand, if s∗ ≤ 0 then ρ(x∗) ≥ 0, and consequently theexpectation value vector t is quantum mechanical.

2.6. EXAMPLES 19

Every semidefinite program has an associated dual program, cf. Ref. [158],which reads as

max − tr(ρfixZ) (2.25)

s.t. Z ≥ 0

tr(Z) = 1,

tr(ZSi) = 0, ∀i ≥ n+ 1.

Using the orthogonality of the operators Si, the last set of linear constraints re-stricts the open variable of the dual program to take the form Z =

∑

i≤n ziSi ≥ 0with tr(Z) = 1. Additionally, the objective value can be expressed as tr(ρfixZ) =zT t, and its optimal value is denoted by d∗. Note that both semidefinite pro-grams are strictly feasible: If one selects s > |minλ(ρfix)|, where λ(·) denotesthe set of corresponding eigenvalues then one obtains a strictly positive solu-tion F (x = 0, s) > 0 for the primal program of Eq. 2.24; while the operatorZ = 1/d > 0 provides a strictly positive solution for the dual program ofEq. 2.25. These conditions ensure strong duality, which states equality of bothprograms s∗ = d∗, and complementary slackness, which guarantees that thereexists actual parameters for (xopt, sopt) and Zopt that attain the solutions ofs∗ = sopt and d∗ = − tr(ρfixZopt) respectively, cf. Ref. [158]. Therefore, if t isnot quantum mechanical it holds that

−s∗ = −d∗ = tr(ρfixZopt) = zToptt < 0, (2.26)

hence every non-quantum mechanical expectation value vector is detected by acorresponding hyperplane. In contrast, if t is quantum mechanical, the weakduality condition [158] ensures that for every feasible solution z of the secondprogram one has

zT t = tr(ρfixZ) ≥ −s∗ ≥ 0, (2.27)

so no quantum mechanical expectation value vector is detected by a hyperplane.Using the described 1-to-1 correspondence allows to translate these conditionsback to the original operator set {Ai}, which finally proves the result.

2.6 Examples

In the present section we like to compare the exact set of physical expectationvalues for the second moment problem of the spin operators with its describedoperational approximations. For that we illustrate each convex set along thefollowing lines: One starts with given mean values for the normalized spin oper-ators mj

k with k ∈ {1, 2, 3} that satisfies∑

k(mjk)2 ≤ 1. This condition ensures

that the exact set is at least non-empty since there exists a quantum state withprecisely those moments, cf. Prop. 2.3.2. The remaining open parameters of anexpectation value matrix in standard form, i.e., vj

k with k ∈ {1, 2, 3}, must nowbe chosen such that the overall set of parameters either fulfills the conditionsfrom one of the two approximation sets or from the exact solution. Howeverusing the identity given by Eq. 2.2, one can further reduce the number of con-sidered expectation values vj

k, and we pick vj1 and vj

2 without loss of generality.For each case we determine the extreme values for both parameters. In case ofone of the two approximations this search can be cast again into the form of a


semidefinite program, which can be efficiently solved by standard semidefiniteprogramming modules [89, 148]; for the exact solutions one needs to employ asemidefinite program anyway, cf. Sec. 2.5.

-0.2

0

0.2

0.4

0.6

0.8

1

-0.2 0 0.2 0.4 0.6 0.8 1

v 2

v1

j=5

ExactSuperset

Subset

j=3 j=7 j=10

j=15

Figure 2.1: Sets of normalized expectation values vj1 and vj

2 described by theapproximation in comparison with the exact solution for the case of mj =(0.1, 0.2, 0.3) and j = 5. The inset figures are drawn with the same axis scale,and should demonstrate the effect of different total spin numbers j on the dif-ferent sets.

Figure 2.1 shows the exact and the approximation sets for a mean valuevector mj = (0.1, 0.2, 0.3) and for a total spin number j = 5. As one canclearly see, the considered sub- and superset really enclose the set of quantummechanical expectation values. The inset figures show the same sets for dif-ferent spin numbers, and should demonstrate the corresponding convergence ofboth approximations. Additionally one can observe that the superset approxi-mation describes the actual set of quantum mechanical expectation values withincreasing accuracy as the total spin number j becomes larger.

2.7 Conclusion

We have addressed the problem whether a given set of expectation values arecompatible with the first and second moments of the spin operators of a totalspin-j system along arbitrary direction. These spin operators appear in manydifferent forms in physics; for example as the Stokes operators in the quan-tum optics literature or as the collective spin operators in the case of atomicensembles.

2.8. ADDITIONAL COMMENTS 21

Because of the particular product structure of the operators in this con-sidered truncated moment problem one can already impose a strong conditionon the given set of expectation values, which is captured as a positivity con-straint on a particular matrix that ensures the Schrodinger-Robertson uncer-tainty principle. Furthermore, if one exploits a particular representation of thespin operators then one can relate the considered truncated moment problemto the Bose-symmetric extension problem for bipartite qubit states, hence wecan provide the following solution: For a given set of expectation values Mone first checks the linear constraint imposed by the Casimir identity. After-wards one reconstructs a completely determined two qubit operator ρred(M).This operator must represent a valid two qubit density operator of a bipartitequbit system with at least (2j − 2) Bose-symmetric extensions, otherwise thegiven expectation values M disagree with the predictions of quantum mechanics.Since the exact characterization of such two qubit states is unknown, we havefocused on solutions for the two extreme cases: More precisely, we have pre-sented two different approximation sets. Whenever one finds a separable twoqubit state ρred(M), then the expectation values are assured to be quantummechanical. Contrary, if one finds non-positivity of a particular expectationvalue matrix τj [ρred(M)] 6≥ 0, that depends on the total spin number j andthe reconstructed two qubit state, then the corresponding expectation valuesare incompatible with the spin operators. In combination, these tools allowan operational approximate description of the quantum mechanical expectationvalues. This characterization gets better the larger the total spin number j be-comes and convergences to the exact solution in the limit of an infinite numbersof extensions. In order to provide a feasible solution for low spin numbers, wecharacterize the sets of physical expectation values via hyperplanes, similar asthe idea of entanglement witnesses for the separability problem. The searchfor the optimal hyperplane can be cast into the form of a semidefinite programwhich can be solved efficiently for small spin numbers.

It remains open whether one can find an operational characterization of Bose-symmetric extendible two qubit states. In addition, it might be interesting tofurther investigate whether similar ideas can be used for different operator sets;we leave this open for future discussions.

2.8 Additional comments

Finally, we like to mention recent results that appeared after completion of thiswork, but which seem interesting for a further discussion of the truncated mo-ment problem. According to a recent conjecture from Ref. [109] a given spin-1state ρred can only be the reduced density operator of a spin-3/2 system if it sat-isfies the requirement tr1[tr2(ρred)2] ≥ tr(ρ2

red). The conjecture, as formulatedfor the symmetric extension problem, has been verified for particular two qubitstates, e.g., also for Bell-diagonal states in Ref. [110], and is further supportedby an extensive numerical counterexample search. Though this condition dealsonly with one Bose-symmetric extension it still maintains the hope for an op-erational solution for an arbitrary number of copies and consequently for a fullsolution to the truncated moment problem of the spin operators. Nevertheless,as pointed out in Ref. [109], the extension to more copies or higher dimensionalstates seems to require different methods.


Additionally let us remark on the convergence statement of the supersetapproximation. The reduced expectation value matrix τj(ρred) converges to thecorrelation matrix definition of Ref. [149] in the limit j → ∞. As shown in thisreference, positivity of the correlation matrix is equivalent to the PPT criterionfor states only supported on the symmetric subspace. Hence it is clear whyany entangled spin-1 state will be “witnessed” at some point of the supersetapproximation. However, as shown in Ref. [149], positivity of this correlationmatrix, defined also for higher-dimensional systems, is even equivalent to otherwell-known entanglement criteria, e.g., to the realignment criterion or conditionsbased on covariance matrices, if one just investigates states on the symmetricsubspace. Still bound entangled PPT states exist and hence are not detected bythis method. This result becomes important if one tries to extend the supersetapproximation of the truncated moment problem to other operator sets, likefor example to irreducible representations of the Lie algebra su(3). It showsthat if one employs a similar reduced expectation value matrix definition for thesuperset approximation—to operationally describe the solution for an increasingdimension of the system—then one does not detect all entangled state, but towhich the exact set usually converges.

Chapter 3

Iteration methods for

nonlinear entanglement

witnesses

3.1 Motivation

When Erwin Schrodinger introduced the notion of entanglement for certain bi-partite quantum states in the thirties of the last century, he might not haveimagined that nowadays this peculiar phenomenon constitutes the fundamen-tal resource for such fascinating tasks like quantum cryptography or quantumteleportation. By definition, an entangled state is not separable, which meansthat it cannot be prepared by local operations and classical communication[163]. Any separable state ρsep

AB can be written as a convex combination of pureproduct states, i.e.,

ρsepAB =

∑

i

pi|ψi〉A〈ψi| ⊗ |φi〉B〈φi|, (3.1)

with a probability distribution {pi}i and corresponding pure states |ψi〉A and|φi〉B for the local subsystems1.

Despite its importance for the field of quantum information theory, the prop-erties of entangled states are not fully explored yet. Even to determine whethera given quantum state is entangled or not is still an open problem, although con-siderable progress has been achieved along this direction over the last decade, seeRef. [60]. In fact this so-called separability problem can already be regarded as aresearch field on its own and several different results have provided insight intothis problem: the formulation of operational criteria which are sufficient to de-tect either entangled or separable states [114, 55, 129, 18, 51, 42], different waysto tackle the problem by numerical means [30, 27, 141], or the reformulation ofthe separability problem into a different context [76, 130]. Remarkably, in thecase of low dimensionality [55], or for a particular class of even infinite dimen-sional states [139, 164], the separability problem is solved. Another approach tothe separability problem investigates entanglement witnesses [55, 146, 82]. An

1Throughout this chapter only finite dimensional systems are considered.

23

24 CHAPTER 3. NONLINEAR ENTANGLEMENT WITNESSES

Figure 3.1: Because the set of separable states (dotted) forms a convex subsetto the set of all possible density operators (outer, thick-lined), any entangledstate can be separated by a corresponding linear entanglement witness W1. Thepresent chapter describes an iteration method to successively improve entangle-ment witnesses, corresponding to a certain positive but not completely positivemap, by quadratic nonlinear terms. This generates a sequence of nonlinearentanglement witnesses W2,W3, . . .W� of increasing strength.

entanglement witness W is an observable which has a non-negative expectationvalue on all separable states, and therefore any negative expectation value ofthis observable signals the presence of entanglement. Those kind of operatorsoffer a powerful tool to verify the creation of an entangled state in an actualexperiment, since one only has to measure the corresponding observable, whichcan even be evaluated by local measurements, cf. Refs. [41, 9, 91]. Witnesses al-low the following geometrical interpretation: As schematically shown in Fig. 3.1the set of all possible bipartite quantum states forms a convex set, while the re-stricted set of only separable states constitutes a convex subset of it. Therefore itis possible to separate any given entangled state from the set of separable statesby a corresponding hyperplane. This hyperplane represents the correspondingentanglement witness, or, more precisely, the states for which the mean valueof the witness equals zero. The witness detects the entangled state, becauseits expectation value allows distinction between states from either the “left” or“right” hand side of the witness.

From this geometrical picture, it is natural to ask whether it is possible toimprove a given linear entanglement witness by some nonlinear correction inorder to approximate the set of separable states better. This is indeed alwayspossible as shown in Refs. [43, 44], in which a general method has been providedto compute a nonlinear improvement to a given linear witness. The nonlinearcorrections are typically given by squares of certain expectation values suchthat the whole expression is still positive on all separable states. The nonlinear

3.2. ITERATION PROCESS 25

witness may also be viewed as linear observable, but acting on the tensor productof several copies of the input state [56]. In this chapter we provide an extension ofthis improvement idea which leads to a whole sequence of nonlinear witnesses.We first present a method to compute a nonlinear improvement for a givenwitness. This method can then be iterated and hence leads to a whole sequenceof nonlinear entanglement witnesses which contain higher nonlinearities andbecome stronger in each step. Each iteration step requires the choice of anunitary transformation. We consider the two extreme case: First we show how tooptimize this choice with respect to a given preselected target state, in the sensethat this state should be detected after as few iterations as possible. Afterwardswe address the exact opposite question how to “bend” a given starting witnessalong all possible directions equally. Our main result states that both iterationswill detect all entangled states which are also detected by the correspondingpositive map of the original starting witness.

In detail the chapter is organized as follows: In Sec. 3.2 we present themain idea of the iteration and fix our notation. At this point we only considerentanglement witnesses from the criterion of a positive partial transpose (PPT)[114], however, as we see in the end, the method can directly be used for arbitraryentanglement witnesses by employing the duality between witnesses and maps.In Sec. 3.3 we address the optimization of the iteration with respect to a giventarget state and prove its main properties, while in Sec. 3.4 we concentrate onthe exact opposite case. Afterwards we present several examples of the differentiteration methods in Sec. 3.5. We finally explain the extension of our methodto arbitrary witnesses and conclude.

3.2 Iteration process

The main idea of the iteration process is a particular way to improve a givenentanglement witness by some quadratic, nonlinear term. The point is that thisimprovement method has the advantage that it can be employed several times.This leads to a sequence of entanglement witnesses of increasing strength. Inthis section we first introduce the basic idea of the iteration before we giveits precise definition. Afterwards we explain some generic properties of theiteration process itself. By giving a simple example sequence we can show thatthe considered iteration process allows to “curve” a given entanglement witnessin such a way that it will detect an arbitrary given state violating the PPTcondition at some point in this sequence.

3.2.1 Main idea

The iteration process relies on the following simple observation: Since the par-tial transpose of every separable state describes another valid quantum state itmust necessarily have a positive partial transpose (PPT) ρΓ ≡ ρΓ

AB ≥ 0, i.e.,all eigenvalues are non-negative. Consequently any violation of this conditiondirectly signals the presence of so-called NPT entanglement of the underlyingquantum state. In the following we examine this positivity requirement of thepartial transpose more closely. Obviously if one has another positive semidef-inite operator A ≥ 0 then the resulting expectation value tr(ρΓA) ≥ 0 shouldbe non-negative. If one tests this requirement for all such operators then the


corresponding condition becomes necessary and sufficient. Since any positivesemidefinite operator can be written in terms of A = BB† one has the followingstatement2

ρΓ ≥ 0 ⇔ ∀B : tr(ρΓBB†) ≥ 0. (3.2)

This requirement provides us with a relation to the notion of an entanglementwitness via the partial transpose (or more precisely via the adjoint map of thepartial transpose, but both maps equal in this case). The operator

WL = (BB†)Γ, (3.3)

automatically fulfills the positivity requirement for all separable states becauseof the identity tr[ρ(BB†)Γ] = tr(ρΓBB†). Note however that not all such op-erators correspond to an entanglement witness in the strict sense, because eachwitness should at least detect one entangled state. However any entangled stateviolating the PPT criterion can be “witnessed” by an entanglement witnessof the considered form: Suppose that |ψ〉 denotes the eigenvector to the mostnegative eigenvalue of the corresponding partial transpose ρΓ 6≥ 0. If one setsB = |ψ〉〈ψ| and uses the form of Eq. 3.3, then one obtains an entanglementwitness in the strict sense, because

tr(ρWL) = tr(ρ(|ψ〉〈ψ|)Γ

)= tr

(ρΓ |ψ〉〈ψ|

)= 〈ψ|ρΓ|ψ〉 < 0 (3.4)

heralds the entanglement. Therefore any observable of the form given by Eq. 3.3is positive on all PPT quantum states, while any NPT entangled state can bedetected by exactly such a witness. In addition let us note that all optimalentanglement witnesses, capable of detecting the largest fraction of entangledstates, are also of the considered form, cf. Ref. [82].

We obtain a quadratic, nonlinear improvement for such linear entanglementwitnesses by a particular strategy to search through the operators B fromEq. 3.2. For this task we employ again the construction of the expectationvalue matrix, as defined in Prop. 2.2.1 of the previous chapter. Via this toolone compactly verifies non-negativity of the corresponding expectation value forall operators formed by a linear combination B =

∑

i ciFi of a given operatorset {Fi}, i.e., the requirement that

tr(ρΓBB†) =∑

ij

ci tr(ρΓFiF†j )

︸︷︷︸

=[χ(ρΓ)]ij

c∗j ≥ 0

has to hold for all possible combinations of ci ∈ C implies that the correspondingexpectation value matrix χ(ρΓ) ≥ 0 must be positive semidefinite itself. Hence,in total one obtains the relation

ρΓ ≥ 0 ⇒ χ(ρΓ) ≥ 0. (3.5)

In order to enhance the linear entanglement witness, one applies this construc-tion to the specific operator set F1 = U † and F2 = B, where U constitutes an ar-bitrary unitary and the operatorB characterizes the linear entanglement witness

2The decomposition A = BB† is not unique. For example one can use the Cholesky-decomposition [53], which even restricts the operator B to be lower triangular. A differentapproach consists in using the square-root B =

√A = B† of A, defined by the Taylor expansion

series, in which each operator B ≥ 0 is positive semidefinite itself. The main results of thischapter are formulated for exactly this special class of operators, hence there is no loss ofgenerality.


via Eq. 3.3. Using normalization of the partially transposed state tr(ρΓ) = 1,the resulting expectation value matrix becomes

χ(ρΓ) =

[1 tr[ρΓ(BU)†]

tr(ρΓBU) tr(ρΓBB†)

]

. (3.6)

Next we employ the Sylvester criterion [53], which states that a given matrixcan only be positive semidefinite if all principle minors are non-negative. Forthe matrix of Eq. 3.6, the non-trivial principle minors are given by

WL(ρ) ≡ tr(ρΓBB†) (3.7)

WNL(ρ) ≡ tr(ρΓBB†) −∣∣tr(ρΓBU)

∣∣2. (3.8)

A negative principle minor directly contradicts with the PPT criterion forseparable states and hence “witnesses” the entanglement of the underlying quan-tum state. The first condition given by Eq. 3.7 represents the original linearentanglement witness WL, while the nonlinear entanglement witness WNL is de-fined by Eq. 3.8. It is important to note that the second condition demandsan even stronger requirement because in addition to the linear term one furthersubtracts another non-negative term. As a consequence each nonlinear entan-glement witness can only be stronger than its original linear witness3. For thepreviously consider example of B = |ψ〉〈ψ| with |φ〉 = U †|ψ〉 the nonlinearentanglement witness equals to

WNL(ρ) = tr(ρ(|ψ〉〈ψ|)Γ

)−∣∣ tr(ρ(|ψ〉〈φ|)Γ

)∣∣2,

which is similar to the quadratic improvement from Ref. [43]. However theimprovement method introduced in this reference enables the subtraction of aneven larger term, but this requires more specific information from the partialtranspose of real quantum states4.

The main point of this described improvement method is that it can beiterated. In order to employ the enhancement method once more we only needto interpret the nonlinear entanglement witness WNL(ρ) as the expectation valueof another linear entanglement witness. If one sets

B′ ≡ B′(B,U, ρΓ) := BU − tr(ρΓBU)1, (3.9)

3The Sylvester criterion can directly be applied to the partial transpose ρΓ, which results ina finite number of principle minors in the case of finite dimensions. Since any principle minorcorresponds to a certain nonlinear entanglement witness via the adjoint map, cf. Refs. [16, 136,49], one has a finite number of such nonlinear entanglement witnesses that detect all quantumstates which are detectable by the partial transpose. This number of entanglement witnessescan even be reduced further if one employs another connection between the principle minorsand the non-negativity of the corresponding eigenvalues: Such a connection has for examplebeen used in Ref. [14] and will generate exactly (d − 1) nonlinear entanglement witnesses,where d denotes the dimension of the bipartite Hilbert space. However in our approach welike to have a sequence of entanglement witnesses of increasing strength, so any improvementof a given entanglement witness must at least detect all the states which are witnessed by theentanglement witness in the step before. To our knowledge, this particular “ordering” cannotbe achieved by any principle minor ordering.

4For example, in the two qubit case the partial transpose of any physical quantum state

can only have at most one negative eigenvalue. Moreover in such events the other remainingeigenvalues must all be strictly positive. Such an extra knowledge about the partial transposeis exploited in order to derive a single nonlinear entanglement witness for the two qubitcase [131, 159, 3].


this requirement holds WNL(ρ) = tr(ρΓB′B′†). Note however that the definedoperator B′ depends on the starting operator B, the chosen unitary U and theconsidered partially transposed state ρΓ. Despite those dependencies the corre-sponding operator B′ can directly be put into the “improvement machinery”.

This iteration process poses a set of interesting questions: First we can askwhether it is possible to detect a given target state, that is not yet detected bythe starting witness, via such a sequence of nonlinear entanglement witnesses.Since this will indeed be the case we address the second point how to find theoptimal iteration, such that each subtracted nonlinear term is maximized foreach step. Third we focus on the question how to employ this iteration inorder to enhance a given entanglement witness equally for all possible states.Concluding let us point out once more that the described iteration only dependson the knowledge whether the partial transpose is positive semidefinite or not.Consequently no PPT entangled state is detected by any of those nonlinearentanglement witnesses, however the method can directly be generalized to otherpositive but not completely positive maps, cf. Sec. 3.6.

3.2.2 Definition, properties and an example iteration

The following definition formally introduces the iteration process. More specif-ically the iteration contains the sequence of entanglement witnesses, which aredefined via their relation to the operators B (cf. Sec. 3.2.1), the correspond-ing sequence of expectation values and the resulting sequence of improvements.However, note that the iteration process itself is not fully specified yet, becauseso far no explicit recipe to draw the unitary operators has been fixed. In gen-eral, one can distinguish different kinds of iterations depending on the strategyto choose each unitary. In the subsequent sections we mainly distinguish threedifferent iterations: the optimized iteration (Sec. 3.3) in which each unitary ischosen such that it maximizes the improvement for a given quantum state, arandom iteration where each unitary is chosen at random and the averaged iter-ation (Sec. 3.4), which considers the averaged expectation value taken over allpossible unitaries.

Definition 3.2.1 (Iteration process). Given the operator ρΓ with tr(ρΓ) = 1together with a starting operator B1, the iteration process contains the fol-lowing sequences with n ≥ 1. Each sequence depends on the set of unitariesU1, . . . Un−1, which are chosen in the steps before.� The sequence of operators {Bn}n, which are recursively defined by

Bn := Bn−1Un−1 − tr(ρΓBn−1Un−1)1, (3.10)

and the operator B1 is the given starting operator.� The sequence of expectation values {wn}n, that are defined via

wn := tr(ρΓBnB†n). (3.11)� The sequence of improvements {cn}n, which characterize the detection

improvement in each step are given by

cn :=∣∣tr(ρΓBnUn)

∣∣2. (3.12)


Note that each operator Bn, each expectation value wn and each improve-ment cn depends on the unitaries U1, . . . Un−1 chosen in the iteration stepsbefore, the operator ρΓ and the given starting operator B1; however, this ex-plicit dependence is suppressed in most of the following cases. Even withoutspecifying the exact sequence of unitary operators, the iteration process hassome generic properties:

Proposition 3.2.1 (Generic properties). For the iteration process, introducedby Def. 3.2.1, one has the following generic properties, which are independentof the starting operator B1:� For a given operator ρΓ that satisfies tr(ρΓ) = 1, the sequence of expecta-

tion values {wn}n is monotonically decreasing.� If the state is PPT, ρΓ ≥ 0, then the expectation values wn(ρΓ) ≥ 0 arenon-negative for all n ≥ 1.

Proof. Using the recursion formula for Bn and the definition of the cn, one getsan analogous recursion statement

wn = wn−1 − cn−1. (3.13)

The first statement then directly follows from cn ≥ 0 for all n ≥ 1. For thesecond point one uses the definition of the expectation value wn = tr(ρΓBnB

†n)

and the fact that BnB†n ≥ 0 and ρΓ ≥ 0.

Before considering more specialized situations, we discuss a simple exampleiteration. It shows that if one starts with an arbitrary entanglement witnesscorresponding to the operator B1 > 0 it is always possible to improve the givenwitness in such a way that it detects a preselected NPT entangled state.

Proposition 3.2.2 (Example sequence). For a given detectable operator ρΓ 6≥ 0with tr(ρΓ) = 1 and B1 > 0, consider the following sequence of unitaries,

U1 = P+ − P−, Un = −U1 ∀n ≥ 2, (3.14)

where P− denotes the projector on the subspace of negative eigenvalues of ρΓ,and P+ its orthogonal complement. Then there exists an N0 ∈ N+ such thatwn < 0 for all n ≥ N0, hence the corresponding sequence of expectation values{wn}n will detect the state; in fact the sequence {wn}n diverges to −∞.

Proof. The recursion formula for the sequence of expectation values {wn}n,given by Eq. 3.13, allows us to prove the proposition by showing that the se-quence of improvements {cn}n does not converge to zero; in fact, we even provedivergence of this sequence. Because of the special set of unitaries, each im-

provement is given by cn =[tr(ρΓBnUn)

]2. The first two improvements can be

directly computed, and are given by c1 = [tr(|ρΓ|B1)]2 > 0 and

c2 =[tr(|ρΓ|B1)‖ρΓ‖1 − tr(ρΓB1)

]2 ≥ ‖ρΓ‖21

{tr[(|ρΓ| − ρΓ)B1]

}2> 0, (3.15)

where ‖...‖1 denotes the trace norm. The first inequality is valid for the casethat tr(ρΓB1) ≥ 0; if this is not the case, then c2 > 0 trivially holds. Thestrict inequality in Eq. 3.15 comes from the fact that (|ρΓ| − ρΓ) ≥ 0 and


the assumption that B1 > 0. Note that in the case of a positive semidefiniteoperator, i.e., ρΓ = |ρΓ| ≥ 0, the second improvement vanishes. In the remainingpart of the proof, we want to show by induction that

cn = c2‖ρΓ‖2(n−2)1 , ∀n ≥ 2. (3.16)

The starting case n = 2 is trivial, and we only need to care about the inductionstep n 7→ n+ 1. One arrives at

cn+1 =[tr(ρΓBn) − tr(ρΓUn+1) tr(ρΓBnUn)

]2

={

tr(ρΓBn−1Un−1)[1 − tr(ρΓ)] + ‖ρΓ‖1 tr(ρΓBnUn)}2

= c2‖ρΓ‖2[(n+1)−2]1 ,

where we used the recursion formula for the operators Bn+1 and UnUn+1 = 1in the first line. In the second step, we employed the recursion formula for theoperator Bn and the identity tr(ρΓUn+1) = −‖ρΓ‖1, while in the last part weused tr(ρΓ) = 1 and the induction hypothesis in the end. Since ‖ρΓ‖1 > 1, thecorresponding sequence of improvements {cn}n diverges and the proposition isproved.

This sequence of unitaries can always be “started” at each step of an ar-bitrary sequence; detection and divergence are ensured as long as the secondexpectation value, after one has used this particular sequence, is strictly greaterthan zero.

3.3 Optimized iteration

Suppose that one starts with a certain entanglement witness and that one likesto verify entanglement of a given target state. Then it is of course desirable todetect the state with the least number of iterations. One possible way to achievethis goal might be to try to optimize the improvement for the specific quantumstate in each step. Such a particular iteration method is termed optimizediteration and is formally introduced in the following definition. Is is importantto note that the sequence of unitaries, which are chosen during the iterationprocess, is mainly determined by the given target state. From a geometricalpoint of view, this process corresponds to the task that one wants to curve agiven entanglement witness along a certain direction, and the direction is linkedto the quantum state. The final result of this section is the statement that thisoptimized sequence will finally detect the initial target state.

Definition 3.3.1 (Optimized iteration). For a given target operator ρΓ withtr(ρΓ) = 1 and a certain starting operator B1, the optimized iteration is definedas the iteration in which each improvement is maximized over the chosen uni-tary. This maximization of cn = | tr(ρΓBnUn)|2 is obtained as follows: For anyvalid singular value decomposition ρΓBn = VnDnW

†n with Dn ≥ 0, one selects

the unitary Uoptn = WnV

†n that results in

cn =[tr(ρΓBnU

optn )

]2= [tr(Dn)]2 = ‖ρΓBn‖2

1. (3.17)

3.3. OPTIMIZED ITERATION 31

This particular unitary has the additional feature that ρΓBnUoptn ≥ 0 is a positive

semidefinite operator5.

The requirement that the operator after the optimization ρΓBnUoptn ≥ 0

forms a positive semidefinite operator is of particular importance in order toshow detection of an arbitrary target state, because it allows some predictionsof the structure of the next optimal unitary. The proof itself relies on the ideathat the sequence of improvements does not converge to zero.

Theorem 3.3.1 (Detection for the optimized iteration). For any detectableoperator ρΓ 6≥ 0 with tr(ρΓ) = 1, and any strictly positive starting operatorB1 > 0, the optimized iteration process will always detect the state.

Proof. Because of the recursion formula of the sequence of expectation values,given by Eq. 3.13, it is sufficient to prove that each improvement cn is boundedfrom below by a strictly positive constant. For the optimized iteration each im-provement simplifies to cn = d2

n with dn = tr(ρΓBnUoptn ) ∈ R, hence it is enough

to prove this bound only for the sequence {dn}n. Note that the first improve-ment, given by d1 = tr(ρΓB1U

opt1 ) = ‖ρΓB1‖1 > 0, is strictly positive. Accord-

ing to the definition of the optimized iteration process, the optimal unitary inthe first step Uopt

1 is determined by a singular value decomposition of the oper-ator ρΓB1 and that one obtains a positive semidefinite operator ρΓB1U

opt1 ≥ 0.

In the following we want to prove the bound

dn = tr(ρΓBnUoptn ) ≥ d1λmin > 0, ∀n ≥ 2, (3.18)

where λmin denotes the absolute value of the most negative eigenvalue of theoperator ρΓ. The corresponding eigenvector is labeled by |ψ〉.

The case n = 2 already covers the main idea. Because of the particular uni-tary that we chose in the first step, the next operator ρΓB2 = ρΓB1U

opt1 − d1ρ

Γ

is already hermitian. Therefore we can expand the operator in terms of itsspectral decomposition as ρΓB2 =

∑ηi|vi〉〈vi|. From this explicit decom-

position one can directly infer the next optimal unitary, which is given byUopt

2 =∑

sign(ηi)|vi〉〈vi| where sign(ηi) denotes the sign of the correspond-ing eigenvalue. As a result, one obtains a new positive semidefinite operatorρΓB2U

opt2 =

∑ |ηi||vi〉〈vi| ≥ 0. These properties allow the following statement,

d2 = tr(ρΓB2Uopt2 ) ≥ 〈ψ|ρΓB2U

opt2 |ψ〉

=∑

|ηi|〈ψ|vi〉〈vi|ψ〉 ≥∑

ηi〈ψ|vi〉〈vi|ψ〉= 〈ψ|ρΓB2|ψ〉 = 〈ψ|ρΓB1U

opt1 |ψ〉 − d1〈ψ|ρΓ|ψ〉 ≥ d1λmin.

For the first inequality one uses that the trace over a positive semidefinite op-erator is lower bounded by the overlap over only one possible state. Note thatthe second inequality 〈ψ|ρΓB2U

opt2 |ψ〉 ≥ 〈ψ|ρΓB2|ψ〉 only relies on the particu-

lar spectral decomposition of the operator ρΓB2 and the explicit choice of the

5The optimality follows from the properties of the singular value decomposition, seeThm. 7.4.9 in Ref. [53]. However, there is an ambiguity in this definition, since the singularvalue decomposition is not necessarily unique. In such cases, one is free to choose any validdecomposition. Note that if one only demands for an optimal improvement maxUn

cn(Un),

then the resulting operator ρΓBnUoptn might not even be hermitian, because one could always

add an arbitrary random phase to the operator Uoptn .


unitary Uopt2 . Therefore this property holds in any step of the optimized iter-

ation process. Using this idea multiple times enables us to prove the generalstatement,

dn = tr(ρΓBnUoptn ) ≥ 〈ψ|ρΓBn−1U

optn−1|ψ〉 + dn−1λmin

≥ 〈ψ|ρΓBn−2Uoptn−2|ψ〉 + (dn−2 + dn−1)λmin

≥ . . . ≥ 〈ψ|ρΓB1Uopt1 |ψ〉 + λmin(d1 + . . .+ dn−1) ≥ d1λmin.

This finally proves the bound of Eq. 3.18, and therefore shows that the generalsequence of improvements {cn} does not converge to zero. As a consequence thecorresponding sequence of expectation values {wn} will diverge to −∞, so thatthere exists a particular N0 ∈ N+, such that wn < 0 for all n ≥ N0. Thereforeany partially transposed state ρΓ 6≥ 0 will be detected at some point in thesequence.

This theorem can be extended to the case in which the operator B1 ≥ 0 ispositive semidefinite and d1 = ‖ρΓB1‖1 > 0, since the method to lower boundeach improvement does not rely on strict positivity of the starting operator.However in the specific case of d1 = 0, the partially transposed state ρΓ and thestarting operator B1 are acting on completely orthogonal subspaces, and hencethe sequence can never detect the state.

3.4 Averaged iteration

Obviously, one drawback of the optimized iteration process is that the targetstate has to be known in advance; however in certain cases such prior knowledgemight be unavailable. Therefore, it is interesting what happens if one choosesthe unitaries in the iteration process in a different, state independent way. Afirst simple method would be to choose each unitary at random. At first sight,such a random iteration seems to produce only small improvements, however ifone repeats the iteration many times one can still hope to detect many states.We will discuss this random iteration process with an example in Sec. 3.5.2.

In the present section we study the averaged iteration, in which, instead ofusing only a single sequence of unitaries, one takes the average over all possibleunitaries in the iteration process. As before, a negative expectation value forthese mean values signals the presence of entanglement. However, one shouldmention that the resulting nonlinear entanglement witness can not be writtenas a single nonlinear witness in the original form of the iteration.

The final theorem of this section states that there is a sequence of nonlinearentanglement witnesses, which in the limit of infinite many improvements, detectall NPT entangled states at once. Although this results seems surprising atfirst, such a method is already known [57] and relies on the seminal spectrumestimation method introduced in Ref. [67]. Nevertheless, a similar statementcan be derived using the idea of the averaged iteration process.

Definition 3.4.1 (Averaged iteration). For a given operator ρΓ that acts ona composite Hilbert space of dimension d, with tr(ρΓ) = 1, and for a certainstarting operator B1, the averaged iteration defines the sequence of expecta-tion values {wn}n in which one performs the average over all possible unitaries

3.4. AVERAGED ITERATION 33

U1, . . . , Un−1 that one can choose up to the n-th step. More precisely, one defines

wn :=

∫∫

dU1 . . . dUn−1 wn(ρΓ, B1, U1, . . . , Un−1), (3.19)

with wn(ρΓ, B1, U1, . . . , Un−1) being the expectation value defined by Eq. 3.11,and where dUi, for i = 1, . . . n, represents the Haar measure of the unitary groupU(d) with normalization

∫dUi = 1.

The intuition behind the detection statement of the averaged iteration pro-cess is very simple: One knows already certain sequences of unitaries (e.g., ex-ample or optimized iteration) that will detect a given quantum state and evendiverge to −∞. In contrast, for any other sequence of unitaries, in particularthose that will never detect the state, the corresponding expectation values aremonotonically decreasing and bounded from above. Hence if one performs theaverage over all possible sequences of unitaries, the resulting sequence of meanvalues should diverge as well.

Detection for the averaged iteration process is shown in a two step procedure:In a first step one obtains a recursion formula for the sequence of averagedexpectation values. This particular formula greatly simplifies the final proof ofdetection.

Proposition 3.4.1 (Recursion formula for the averaged iteration). In the aver-

aged iteration process, each expectation value can be written as wn =tr(AnB1B†1)

for the starting operator B1. The sequence of operators {An}n, which only de-pend on the given input operator ρΓ are recursively defined by

An := An−1 +1

d

[tr(An−1)(ρΓ)2−(ρΓAn−1 +An−1ρ

Γ)], (3.20)

starting with A1 = ρΓ, while d denotes the dimension of the underlying Hilbertspace.

Proof. The proposition follows by direct calculation of the averaged expectationvalues. In order to perform this task, we employ the identity

∫

dU d tr(CU) tr(DU †) = tr(CD), (3.21)

which holds for arbitrary operators C,D ∈ L(H). This can be proven for exam-ple by the Peter-Weyl6 theorem, see for instance Ref. [33]. To actually computethe averaged expectation value wn, given by Eq. 3.19, one uses the followingstrategy:

One starts with the average over the last chosen unitary Un−1. Using therecursion formula for the operator Bn, and the given identity, it is possibleto express the next integrand as the expectation value of a witness in thestep before with a new operator A2 = A2(ρΓ), hence

∫dUn−1 tr(ρΓBnB

†n) =

tr(A2Bn−1B†n−1). One continues with the integration over the next unitary

Un−2, and exploits the same trick again to obtain a new operator A3. In thisstep, one needs to be careful since the operator A2 might not be normalized

6The Peter-Weyl theorem states the identity∫

dU d 〈ei|U |ej〉〈ek|U†|el〉 = δilδjk, where{|ei〉}i is an arbitrary set of basis elements.


any more, i.e., tr(A2) 6= 1. In the end, one uses this idea exactly (n− 1) timesuntil one has performed all the integration and ends up with the final operatorAn. For this operator one needs to compute the expectation value with the firstwitness B1B

†1, and obtains the final result wn = tr(AnB1B

†1).

Now that the strategy is fixed, one is left to perform the integration overonly one unitary in order to obtain the recursion formula. Suppose the inte-grand is tr(ABnB

†n), where A denotes an arbitrary hermitian operator. Using

the recursion formula for the operator Bn, given by Eq. 3.10, the integrand isexpanded into

tr(ABnB†n) = tr(ABn−1B

†n−1) + tr(A)| tr(ρΓBn−1Un−1)|2

− tr(ABn−1Un−1) tr(ρΓU †n−1B

†n−1) − c.c.

Since the operator Bn−1 is independent of the last unitary Un−1, one can di-rectly perform the average over this last unitary. Each term can be integratedseparately, and by using the given identity, this results in

∫

dUn−1 tr(ABnB†n) = tr

({

A+1

d

[tr(A)(ρΓ)2 − (ρΓA+AρΓ)

]}

Bn−1B†n−1

)

,

so it can be expressed as tr(A′Bn−1B†n−1), where A′ is given by the expression in

the curly brackets, that precisely gives the stated recursion formula of Eq. 3.20.This proves the proposition.

Next, one turns to the detection theorem itself. This theorem states that anyNPT entangled state will be detected at some point of the averaged iteration.

Theorem 3.4.1 (Detection for the averaged iteration). For any detectable op-erator ρΓ 6≥ 0 with tr(ρΓ) = 1, and any strictly positive starting operator B1 > 0,the averaged iteration process will always detect the state.

Proof. In order to prove detection of an arbitrary state ρΓ 6≥ 0, it is sufficient toshow that the operators An, which determine the average expectation values viaProp. 3.4.1, become negative definite (on the range of ρΓ) at some point in thesequence. Since all operators An necessarily commute with A1 = ρΓ, one caneasily identify the corresponding eigenvectors so that one just needs to examinethe behavior of the corresponding eigenvalues during the iteration. Assume thefollowing spectral decompositions of the operators

ρΓ =∑

i∈I+

λ+i |vi〉〈vi| +

∑

j∈I−

λ−j |vj〉〈vj |, (3.22)

An =∑

i∈I+

a(n)i |vi〉〈vi| +

∑

j∈I−

b(n)j |vj〉〈vj |, (3.23)

in which the index set I− labels the negative eigenvalues of ρΓ, and I+ thestrictly positive eigenvalues.

In order to show that all eigenvalues become negative at some point in theiteration, we proceed as follows: First we show that all eigenvalues on thenegative subspace are decreasing exponentially with the number of iterations n,whereas eigenvalues on the positive subspace can only increase linearly with n.This already guarantees exponential fast divergence of tr(An). Because of that,

3.5. EXAMPLES 35

all eigenvalues on the positive subspace will decrease exponentially fast as well,since the factor tr(An) enters in the iteration formula, cf. Eq. 3.20. Combinedwith the fact that B1 > 0 this proves the claim. In detail, we show by inductionthe following bounds:

a(n)i ≤ |λ+

i | + (n− 1)|λ+

i |2d

, (3.24)

b(n)j ≤ −|λ−j |

(

1 +|λ−j |d

)n−1

, (3.25)

for all n ≥ 1. The induction start is trivial and we care about the inductionstep n 7→ n + 1 only. Let us consider the positive subspace first. In total weobtain the following sequence of inequalities

a(n+1)i = a

(n)i

(

1 − 2|λ+i |d

)

+tr(An)|λ+

j |2d

≤ a(n)i

(

1 − 2|λ+i |d

)

+|λ+

j |2d

≤[

|λ+i | + (n− 1)

|λ+i |2d

](

1 − 2|λ+i |d

)

+|λ+

j |2d

≤ |λ+i | + n

|λ+i |2d

.

In the first line one has used the recursion formula of the operators An andthe first inequality stems from the condition tr(An) ≤ tr(A1) = 1, that comesfrom the generic properties of the iteration process, Prop. 3.2.1, applied tothe average iteration process with B1 = 1. In the next step, the inductionhypothesis is employed and one obtains the final result if one upper bounds theterm in the parenthesis. For the negative subspace, one similarly obtains

b(n+1)j = b

(n)j

(

1 +2|λ−j |d

)

+tr(An)|λ−j |2

d≤ b

(n)j

(

1 +2|λ−j |d

)

+|λ−j |2d

≤ b(n)j

(

1 +2|λ−j |d

)

− b(n)j

|λ−j |d

≤ −|λ−j |(

1 +|λ−j |d

)(n+1)−1

.

Again, the recursion formula and tr(An) ≤ 1 were employed first. The sec-ond inequality originates from the induction hypothesis, since it allows to infer

|λ−j | ≤ −b(n)j . The induction step finishes with another application of the in-

duction hypothesis for the last inequality. This concludes the proof.

3.5 Examples

In order to visualize the effect of the iteration process—and to provide a qual-itative picture of the “curvature” of the corresponding nonlinear entanglementwitnesses similar to the motivation picture—two qubit examples are sufficient.

3.5.1 Optimized iteration

In order to investigate the different iterations we consider a set of noisy op-timal entanglement witnesses. More precisely the starting witness is given bya convex combination between an optimal entanglement witness and the iden-tity operator; the parameter ε describes the corresponding mixedness of these


two operators. This class of entanglement witnesses with the correspondingiteration-operator is given by

W (ε) =(

B1B†1

)Γ

= ε (|ψ−〉〈ψ−|)Γ + (1 − ε)14, (3.26)

B1 =1

2

[√1 + 3ε|ψ−〉〈ψ−| +

√1 − ε (1− |ψ−〉〈ψ−|)

], (3.27)

with the abbreviation |ψ−〉 = (|01〉 − |10〉) /√

2. In the following we mainlyconsider three different cases: the optimal entanglement witness with ε = 1 andtwo slightly weaker witnesses with ε = 0.8 and ε = 0.5 for different kinds of twoqubit states.

For the first example we analyze how each nonlinear improvement effects theparticular class of Bell-diagonal states that are parameterized as follows

ρ = p1|φ+〉〈φ+| + p2|φ−〉〈φ−| + (1 − p1 − p2)14, (3.28)

with |φ±〉 = (|00〉 ± |11〉) /√

2 and 1/4 represents the totally mixed state. Ofcourse only certain parameter pairs (p1, p2) actually correspond to physicalstates since the corresponding operator must be positive semidefinite in orderto form a valid density operator. In Fig. 3.2 this set of physical states corre-sponds to the triangular shaped region. The convex set of separable states isdetermined by the partial transpose and is given by the subset within this setof physical states.

The examples for the optimized iteration process are shown in Fig. 3.2 (leftside) in which the target state is marked by the black triangular. Note that thistarget state is on the “wrong side” of the state region, i.e., it is far from beingdetected by one of the linear witness given by Eq. 3.26. As one can see thegiven target state is already detected after a few iterations. The improvement,which characterizes the extend to which the entanglement witness can be “bent”over to the other side of the state region, depends on the original strength ofthe starting witness. Starting with a rather weak witness, the first examplewith ε = 0.5, already allows to curve the witness in such a way that nearly allstates on the other side are detected, while for the slightly stronger witness,the second case with ε = 0.8, the first improvement is not yet enough to verifyentanglement for the target state. For the optimal entanglement witness, thelast case with ε = 1, this task becomes the hardest, however even in this casethe target state is detected already after the third iteration. For completenesslet us mention that starting with the identity operator, the case ε = 0, enablesdetection of any given target state already after the first iteration. In additionnote that if one follows the optimized iteration process the chosen target stateis of course detected, but in general one will not end up with an entanglementwitness that is capable to witness all possible states at once.

In the second example we investigate how many steps are required to detecta given target state via the optimized iteration. For this task we randomly(with respect to Hilbert-Schmidt norm) generate entangled two qubit statesand compute how many iterations, starting from each of the three witnessesgiven by Eq. 3.26, are at least necessary. The results are shown in Fig. 3.3.Clearly one sees that most of the generated states are already detected afterless than five iterations.

3.5. EXAMPLES 37

Figure 3.2: Curvature examples for the optimized (left) and averaged (right)iteration: The set of physical states is given by the triangular shaped regionconnecting the extreme points (0, 1) and (1, 0) with the origin, while all separablestates are described by the region inside. The black triangular, with coordinates(0.6, 0.2), symbolizes the target state for the optimized iteration. For the lastcase with ε = 1 each nonlinear entanglement witness follows the first linearwitness (case n = 1) and “curves back” on the other side.


0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

1 2 3 4 5 6 7 8 9 10

Pro

babi

lity

Iterations

ε=0.5ε=0.8

ε=1

Figure 3.3: Optimized iteration: Probability to detect a randomly chosen en-tangled state in the n-th step for the three values of ε characterizing the startingwitness.

3.5.2 Random iteration

In the following we address the random iteration process in which each unitary,that is required for the nonlinear improvement scheme, is chosen at random.Note that this iteration is different than the discussed averaged iteration fromSec. 3.4. Again we employ the three different starting witnesses from Eq. 3.26and examine how many improvements are indeed necessary in order to detectthe randomly generated state. The results are shown in Fig. 3.4. One directlyobserves that much more iterations are essential. Nevertheless after roughly ahundred steps most of the generated states will be detected.

Via this example we like to further support our believe that even such arandom iteration process is complete, i.e., any detectable state will be witnessedat some point of the sequence except a rapidly decreasing failure probability.However the exact form of this statement remains unclear.

3.5.3 Averaged iteration

Finally we consider the averaged iteration process and present similar curvature-examples as already performed for the optimized iteration. From the resultsshown in Fig. 3.2 (right side) one sees that much more iterations are necessaryin comparison to the optimized iteration process; still all states will be detectedat some point of the sequence. The first example, ε = 0, represents a special casesince we start with the identity operator. If one follows the averaged iterationmethod then one observes a symmetry between the states that are detected inthe upper and lower part of the state region. This effect should demonstratethat the corresponding witness is indeed improved equally along all possibledirections. This symmetry breaks of course if one uses one of the asymmetricentanglement witnesses to start with.

3.6. EXTENSION 39

0

0.05

0.1

0.15

0.2

0.25

0.3

1-10 11-20 21-30 31-40 41-50 51-60 61-70 71-80 81-90

Pro

babi

lity

Iterations

ε=0.5ε=0.8

ε=1

Figure 3.4: Random iteration: Probability to detect a randomly chosen entan-gled state in intervals of iteration steps for the three values of ε characterizingthe starting witness.

3.6 Extension

Although the iteration process and its corresponding results were solely dis-cussed for the PPT criterion, the method and all its results directly generalizeto other trace-preserving, positive but not completely positive maps Λ; for ex-ample to the reduction criterion and various extensions of it [54, 116], or to theChoi-map [19]. All entangled states which violate the corresponding conditionρΛ ≡ id⊗Λ(ρ) ≥ 0, in analogy to the PPT requirement ρΓ ≥ 0, can be detectedby the iteration method. In order to connect the iteration operator B to anentanglement witness in the familiar form one employs the adjoint map Λ† suchthat one obtains

W := id ⊗ Λ†(BB†), (3.29)

similar to the relation given by Eq. 3.3. Note that the iteration process can beapplied to any starting witness, because every entanglement witness can be castinto this form due to the isomorphism studied by de Pillis, Jamio lkowski andChoi [24, 66, 20].

3.7 Conclusion

Concluding we have examined how to improve of a given linear entanglementwitness by a quadratic, nonlinear term. The considered enhancement schemehas the advantage that it can be employed iteratively and hence generates asequence of nonlinear entanglement witnesses of increasing strength. Two par-ticular iterations were investigated in more detail: In the optimized iterationone tries to maximize each improvement according to a given preselected targetstate. From a geometrical point of view, cf. Fig. 3.1, this process corresponds to


the task that one likes to “curve” a given witness along a certain predefined di-rection. By contrast, the averaged iteration deals with the exact opposite case;one tries to improve the witness along all possible directions equally. The mainresult of this chapter is that both iteration methods are successful: Any entan-gled state, detectable by the corresponding positive but not completely positivemap, is also witnessed by the corresponding sequence of nonlinear entanglementwitnesses, as long as the starting witness does not act on a completely differentsubspace.

There are several questions which deserve further study. First it remainsopen whether a similar detection statement holds for the random iteration pro-cess as suggested by the numerical example of Sec. 3.5.2. Second it might bedesirable to extend the iteration idea beyond a certain positive but not com-pletely positive map; however this seems to require some extra knowledge aboutthe structure of quantum states applied to some particular map. Moreover it istempting to ask whether similar ideas translate to other known entanglementcriteria, which do not rely on a positive but not completely positive map, butwhich can be considered in an entanglement witness form, e.g., the computablecross norm or realignment criterion [129, 18]. In addition it remains to clarifywhether there is a connection between the averaged iteration process and thespectrum estimation idea from Ref. [67]. Finally the idea of using nonlineari-ties might also be applicable to linear maps itself in order to deliver strongerseparability criteria.

Chapter 4

Squash model

4.1 Motivation

A qubit represents the quantum mechanical equivalent to a classical bit andsimply stands for a two-level system that is used in the information processingtask. Because of this basic notation most of the proposed quantum communica-tion protocols are designed to work with these low-dimensional systems as theinformation carrier. However when it comes to an actual experimental realiza-tion of those schemes the original situation can change quite drastically becauseone rarely operates with single qubits. For example, in optical implementationsthe signals are often realized with photons which are naturally described by theFock space of a many mode system, hence in contrast to the single qubit de-scription one has to cope with an infinite dimensional characterization of eachsignal. These deviations between theory and experiment can of course endangerthe whole advantage of the original proposed protocol.

For example these differences play a crucial role in the security aspects of aQKD experiment. Since a single photon source is beyond present experimentalcapabilities it is common to employ weak coherent laser pulses to carry the keyinformation. However, via this setup one does not generate single qubit signals,as demanded in the first QKD proposals [7], but instead encodes the key in-formation on much larger dimensional signal states. However this presumablysmall variation opens the possibility for new attacks, namely the photon num-ber splitting attack [10], which is not covered by a simple qubit security proof.Consequently, the resulting secret key generation rate changes from an expectedlinear to an unintentional quadratic decay with respect to the channel trans-mission and hence to a much shorter distance; note that one can counteractthis distant limitation now via a different technique, the so-called decoy statemethod [63]. Nevertheless let us point out that it was still necessary to repeatpart of the security analysis of the QKD protocol itself [93, 71, 39, 78] and somenew ideas were essential to guarantee security again.

Though the above mentioned example represents more a problem of the ex-act signal preparation stage, it is clear that similar difficulties occur also on thedetection side, simply because any real-life measurement also does not act on asingle qubit alone. In the present chapter we address this point more rigorously:In the following we examine under which conditions a given large-dimensional

41

42 CHAPTER 4. SQUASH MODEL

measurement description can without loss of generality be regarded as first theapplication of a particular physical map followed by a different but determinedmeasurement on a very low-dimensional system. Via this idea one can for ex-ample design qubit measurements again; the situation only differs in the pointthat one explicitly knows that a certain physical map has been applied priorto the hypothetical qubit measurement. However for most quantum commu-nication protocols such a consideration is already sufficient to directly applythe qubit analysis of the protocol to its full optical implementation. The pre-cise map which appears in the decomposition of the measurement scheme canbe regarded as a decoding operation which takes any physical input state anddecodes its stored information on the low-dimensional “information” system.This particular partition of a measurement scheme emerged first in the contextof QKD [71, 39], in which it is referred as a squash model. Although this ideahas been employed in—to our knowledge—all unconditional security proofs sofar [71, 39, 78] it has never been analyzed in more detail. This is precisely thepurpose of the current chapter and in fact we show directly relevant examplesof measurement schemes with and without such a decomposition. However, letus point out that there are also security evaluations without this model [93],though only for a restricted class of attacks.

We start our discussion with the precise definition of the squash model andcomment on some of the advantages of this method for the purpose of QKD.Afterwards we address the problem how one can investigate whether a givenmeasurement scheme possesses such a squash model or not. Furthermore weprove that the usual active polarization measurement, as employed in an polar-ization encoded BB84 experiment, can indeed be related to its intended qubitmeasurement. This verifies the squash model assumption for this BB84 measure-ment scheme and directly provides the possibility to employ the single photonsecurity proof for the real experiment. Note that the same positive statementabout the existence of a squash model for this setup has also been given re-cently in Ref. [153] though applying different techniques. However with thedeveloped formalism we can additionally show that a similar security shortcutdoes not work for the 6-state protocol, because this measurement scheme cannotbe decomposed in such a way as demanded by the squash model.

4.2 Squash model


In the following we introduce the notion of a squash model and fix the terminol-ogy. The actual description of the measurement setup used in the experimentis given by a positive operator valued measure (POVM) of the full mode oper-ators Fi acting on the full mode Hilbert space HF. This characterization mightnot be the physical detection device alone but can as well include some possiblepost-processing of the classical data, cf. the first situation in Fig. 4.1. Note thata given measurement description {Fi} can typically be realized or interpretedwith several different physical setups; however via the squashing operation oneasks for a very particular one. As shown in the second part of Fig. 4.1 themeasurement should modelled as first applying a physical map Λ which trans-form any input state to a particular target density operator. Afterwards this

4.2. SQUASH MODEL 43

Figure 4.1: Via the squash model one tries to decompose the given full measure-ment setting into a preceding physical map Λ, that constitutes the squashingoperation, followed by a specific predetermined target measurement. Note thatthe full measurement can differ from the physical measurement {Mi} by anadditional postprocessing.

state is measured with a different, but fixed target POVM whose elements aredenoted as Ti and which are acting on the target Hilbert space HT. Typicallythis physical and hence completely positive map is designed to output only avery low-dimensional state, hence the map should “squash” the dimensions ofthe full mode Hilbert space, and therefore it is referred as a squashing operationΛ : L(HF) → L(HT) in the following. In order that the two measurement de-vices from Fig. 4.1 are really equivalent we have to demand that both schemesare indistinguishable with respect to their classical outcome patterns. There-fore the expectation value of any input state ρin with respect to the full modemeasurements Fi must yield the same outcome as the expectation value of thecorresponding target observable Ti with the squashed input state Λ(ρin), i.e.,

tr(ρinFi) = tr[Λ(ρin)Ti], ∀ρin ∈ D(HF), ∀i. (4.1)

Here D(HF) denotes the set of all valid density operators on the full modeHilbert space. This condition gets more apparent if one employs the adjointmap Λ† : L(HT) → L(HF) that is defined via the requirement

tr[Λ(C)D] = tr[C Λ†(D)], ∀C ∈ L(HF), D ∈ L(HT). (4.2)

Using the adjoint map, which also has to be completely positive, together withthe property that all density operators span the complete operator space, therequirement from Eq. 4.1 transforms to

Λ†(Ti) = Fi, ∀i. (4.3)


This requirement directly highlights that the squash model is a property thatlinks two different POVMs, hence the term “a detection device has a squashmodel” only makes sense if the target measurement is also specified. Moreover,note that the squashing operation Λ must be trace-preserving since the sum ofall POVM elements from Eq. 4.1 equals unity; this condition translates to aunital requirement for the adjoint map Λ†. In addition, it can also happen thatboth measurement devices depend on a classical input, e.g., the basis choice forthe BB84 measurements. This choice (or more precisely its a priori probability)can be included in the total POVM description, such that the above frameworklacks no generality. Note that we employ the term squashing operation for bothmaps, the original Λ and its adjoint Λ†, and it should be clear from the contextto which we refer.

4.2.2 QKD application

As first introduced in the context of QKD [71, 39] the squash model offers anartful “calculation” trick for the security evaluation of a full optical QKD system(against collective attacks). In particular it offers an adaption technique becausethe described connection between the two measurements guarantees that anysecurity proof using only the target measurement description remains valid evenfor the full mode measurement. For the precise argument note that because ofthe validity of the squash model we can regard the full mode measurement asa two-step procedure: First one applies the squashing operation and afterwardsone performs the target measurement. If one now proves security exclusivelyby using the target operators then one must not assume anything about theoperations prior to this particular target measurement. Hence it is clear thatany positive security statement remains unchanged even if we explicitly knowthat a particular map (the squashing operation) has been applied prior to thetarget measurement, or alternatively that one has performed the full mode mea-surement from the beginning. This already captures the key idea. This fact issummarized in the following proposition, however in order to make this propo-sition precise we first need to repeat some notion for a generic QKD protocol.Nevertheless let us point out that via this calculation trick one can only overesti-mate the eavesdroppers capabilities, or underestimate the corresponding secretkey rate for Alice and Bob.

Without loss of generality we can consider an entanglement based QKD pro-tocol since even prepare and measure schemes can be cast into this framework1.In this protocol Alice and Bob perform local measurements on their part of thequantum state, which result in measurement outcomes according to the observedprobability distribution pij . The quantum phase of the protocol is completelydetermined once we fix the measurement operators associated to these classicaloutcomes. Here we either use the full mode measurements FA

i ⊗ FBj , i.e., the

ones really performed in the experiment, or we employ the hypothetical targetmeasurements from the squash model construction TA

i ⊗ TBj . Note that if only

one local measurement has the squash model property then one can easily ap-ply this definition locally, which would be more the situation for a prepare andmeasure scheme2.

1Note that there are minor description changes for prepare and measure protocols, seeRef. [107].

2The particular choice to consider the squash model property here on both sides is moti-

4.2. SQUASH MODEL 45

Proposition 4.2.1 (Secret key rates). Consider an entanglement based QKDscheme for which both local measurements have a squash model according tothe definition given in Sec. 4.2.1. Then the secret key rate using the full modemeasurements is lower bounded by the secret key rate of the target measurements.

Proof. For this proposition it is sufficient to prove that for each possible eaves-dropping attack on an entanglement based QKD scheme using the full modemeasurements there exists an at least equally strong attack on the “target mea-surement” protocol. This is enough to guarantee the above statement, howevernote that it can still happen that there is a more powerful attack on the targetmeasurement protocol in which cases one would overestimate the eavesdropperscapabilities then.

The set of possible collective attacks is given by all tripartite states sharedbetween Alice, Bob and Eve, that give rise to the observed probability distribu-tion pij . For the full mode operators this set is given by

SF = {ρABE ∈ D(HABE) : trABE(ρABFAi ⊗ FB

j ) = pij , ∀i, j}, (4.4)

and a similar definition for the set ST by using the target measurements. Eachof these states can in principle be obtained by a particular interaction strategyby Eve, hence each of these states can therefore be shared between the threeparties. Once Alice and Bob have performed their measurements on such astate to produce the raw key3, the situation of Eve is completely characterizedby the set of conditional states ρij

E that appear according to the observed prob-ability distribution pij . Eve has to distinguish these states in order to obtaininformation on the raw key.

Next, let us assume that each local measurement satisfies the squash modelcondition, i.e., such that we have Λ†

A(TAi ) = FA

i and a similar relation for Bob’smeasurement apparatus. Now let us assume that Eve’s attack on the full QKDprotocol is specified by the tripartite state ρABE ∈ SF. Then for the conditionalensemble one obtains

pijρijE = trAB

(FA

i ⊗ FBj ρABE

)= trAB

[Λ†

A(TAi ) ⊗ Λ†

B(TBj )ρABE

]

= trAB

[TA

i ⊗ TBj ΛA ⊗ΛB (ρABE)

]= trAB

(TA

i ⊗ TBj σABE

).(4.5)

Here we again employed the definition of the squashing operation and the cyclicproperty (with respect to system A and B only) of the trace. In the last partwe have defined σABE ≡ ΛA ⊗ΛB (ρABE). This operator represents a validstate on the target Hilbert space because both maps are completely positiveand trace-preserving. Moreover since this property holds for all outcomes i, jit is direct that this state belongs to the class of possible attacks for the targetmeasurements, i.e., σABE ∈ ST. Hence the conditional states from Eq. 4.5 canas well be obtained by an eavesdropping attack σABE ∈ ST using the targetmeasurements. This proves the above statement and concludes the proof.

Another advantage of the squash model is that it offers a possibility toapply the fast converging quantum de Finetti theorem [122, 123] even for infi-nite dimensions. For most security proofs it is common to first verify security

vated by the entanglement based QKD scheme of Chap. 6.3Note that the measurements to create the raw key need not to be the same as the total

measurements. Nevertheless these “key” measurements must be contained within the (linearspan) of the overall measurement description. However here we assume for simplicity that allmeasurement outcomes are raw key material first.


with respect to collective attacks only, and then apply the quantum de Finettitheorem to upgrade it to a full security proof for the most general form of eaves-dropping attacks. This theorem can be applied as soon as the underlying stateof N � 1 copies exhibits exchangeability and extendibility. Both requirementscan typically be enforced by acting on the classical data only, i.e., by randompermutations of the classical outcome pairs or by chopping off a small, but ran-dom, fraction of the signal data. Then the quantum de Finetti theorem statesthat the underlying quantum state of N ′ ≈ N copies is close (with respect tothe trace distance) to the one resulting from a collective attack; thus a securityproof for those kind of attacks is sufficient. However there is a dimension fac-tor in the distance estimation which ruins this method for infinite dimensions.Nevertheless this drawback can still be eliminated if the employed measurementdevice has a squash model with respect to a finite dimensional target description.In this case each signal state can equivalently (or without underestimating theeavesdroppers capabilities) be described within finite dimensions and thus onecan directly apply the quantum de Finetti theorem. In this sense the squashingoperation can be considered as a type of decoding operation from an infinitedimensional information carrier to a finite dimensional information system.

4.2.3 Formalism

In the following we examine the conditions for a valid squashing operation moreclosely. In particular we transform the problem to find a suitable squashingoperation between two different POVMs into a more convenient form whichdirectly provides us with a toolbox to prove or to disprove its existence. Themain idea is to reformulate the problem within higher dimensions such that onegains a simpler handling on the complete positivity requirement of the squashingoperation. This trick is quite common in the literature and has been applied inseveral different cases, e.g., Refs. [120, 32].

The addressed trick is the Choi-Jamio lkowski isomorphism [66, 19] betweenlinear maps and linear operators, in which the considered linear map acts onhalf of a maximally (and in our case unnormalized) entangled input state of thebipartite target space |ψ+〉 =

∑

i |ii〉 given by

Λ† → τ(Λ†) = Λ† ⊗id (|ψ+〉〈ψ+|) =∑

ij

Λ† (|i〉〈j|) ⊗ |i〉〈j|. (4.6)

Here one clearly sees that the resulting operator τ = τ(Λ†) ∈ L(HF ⊗ HT ) isa linear operator on the bipartite system composed of full and target Hilbertspace. Via this described method the linear map is completely determinedby the resulting Choi-Jamio lkowski operator because one explicitly knows howthe map acts on an operator basis, i.e., Λ†(|i〉〈j|), from which the action ona generic input operator can be inferred by linearity. Via this isomorphisma direct characterization of completely positive maps becomes available: Bydefinition any completely positive map as applied as in Eq. 4.6 on a positivesemidefinite operator must necessarily result in a positive semidefinite Choi-Jamiolkowski operator; the reverse direction of this statement holds becausefor any eigenspectrum of a positive semidefinite τ one can explicitly constructan operator sum representation of the corresponding map, which then has tobe completely positive, cf. Refs. [66, 19]. Hence the important relation of the

4.3. QKD MEASUREMENTS 47

isomorphism from Eq. 4.6 is

Λ† completely positive ⇔ τ(Λ†) ≥ 0. (4.7)

In order to complete the reformulation it is still necessary to express theremaining constraints of the squashing operation, given by Eq. 4.2, in terms ofthe Choi-Jamio lkowski operator. Via the relation for the corresponding matrixelements 〈α, i|τ(Λ†)|β, j〉 = 〈α|Λ†(|i〉〈j|)|β〉, that directly follows from Eq. 4.6,one obtains

Λ†(C) = trT[τ(Λ†)1F ⊗ CT ], ∀C ∈ L(HT), (4.8)

with the transposition T . In conclusion we have achieved the following refor-mulation for the squashing operation, summarized in the next proposition.

Proposition 4.2.2 (Reformulation). Via the Choi-Jamio lkowski isomorphismthe problem of an appropriate squashing operation Λ† which fulfills Eq. 4.3 canbe cast into the following form

trT(τ1F ⊗ Ti) = Fi, ∀i, (4.9)

τ ≥ 0. (4.10)

Note that the conditions from Eq. 4.9 are still linear with respect to the Choi-Jamiolkowski operator. For two given POVMs those requirements constrain(if not inconsistent within themselves) the operator τ to have a certain fixedpart. Whether the remaining parameters of τ can be chosen in order to satisfythe requirement of positive semidefiniteness, determines whether the squashingoperation exists or not. Note that the described problem given by Eqs. 4.9, 4.10represents a semidefinite program [158], which can efficiently be tackled alsoby numerical means. However note that the described formalism strictly worksonly for finite dimensions.

4.3 QKD measurements

4.3.1 Polarization measurement

It is time to apply the developed formalism to some actual, physical relevantmeasurement setups. In the following we draw our attention to the active polar-ization measurement on a two-mode system by using only threshold detectors;such detectors cannot resolve the impinging number of photons. More precisely,as shown in Fig. 4.2, the incoming light field is separated according to an activelychosen polarization basis β ∈ {x, y, z} via a polarizing beam splitter, followedby a photon number measurement on each of those modes by a simple thresh-old detector, so in total one can distinguish between four different outcomes: noclick at all, only one of the detector clicks or both of them trigger a signal andproduce a double click. Because of its great simplicity this measurement deviceappears quite frequently in actual QKD experiments in which the information isencoded onto the polarization degree of freedom. For an actual BB84 protocolthe receiver chooses between two different polarization axes, e.g., {x, z}, whilefor the 6-state protocol all three settings are employed. In the following we showthat the BB84 measurements can be squashed to its single photon counterparts,while, quite surprisingly, the corresponding 6-state measurements cannot.


Figure 4.2: Schematic setup of the considered polarization measurement: Viaquarter (QWP) and half wave plate (HWP) one can effectively select the po-larization basis β of the polarizing beam splitter (PBS) according to the basischoices {±45◦,� / , H/V } that we label as {x, y, z}.

Next let us become precise which POVMs should be connected by the squash-ing operation. For each chosen polarization basis β the different mode measure-ment elements are denoted as Mi,β with the hopefully self-explanatory labeli ∈ {vac, 0, 1, d} for all classical outcomes. Via the target measurement choiceone typically wants to justify a single photon assumption, i.e., each click eventcan only originate from a single photon state, hence as target measurementsone selects the same measurement device only that it just acts on the singlephoton subspace and the vacuum component. In order to achieve the squashingproperty at all the double click events must be processed, since such events areclearly incompatible with a (perfect) single photon measurement; otherwise onedirectly violates the normalization. A common post-processing scheme, origi-nally introduced for the QKD context in Ref. [93, 94], consists in randomly as-signing each double click event to one of the single click outcomes. This schemecan be considered as a penalty for double clicks, thus multi-photon states, suchthat they become compatible with a single photon state. This particular setof post-processed measurement operators becomes the exact set of full mea-surements {Fi,β} with i ∈ {vac, 0, 1} and β ∈ {x, y, z} and with the relationFi,β = Mi,β + 1/2Md,β with i = 0, 1 for all β.

Let us start with a perfect single-polarization mode description of the op-erators Fi,β . Imperfections like finite efficiency or dark counts are typicallyconsidered as completely positive maps prior or after this perfect measurementdescription and hence can easily be included in the squashing operation, cf. alsoChap. 5. The “no click” outcome is assumed to be independent of the chosenpolarization basis and becomes Fvac,β = |0, 0〉〈0, 0|. All other operators areblock-diagonal with respect to the photon number subspace, i.e.,

Fi,β =

∞∑

n=1

Fni,β (4.11)

with the n-photon part being given by

Fni,β =

1

2

[1n + (−1)i(

|n, 0〉β〈n, 0| − |0, n〉β〈0, n|)]

, i ∈ {0, 1}, (4.12)


Figure 4.3: A schematic picture of the overall reduction of the squashing oper-ation for the active polarization measurement. In the end only the squashingmap ΛP

n remains to be characterized.

in which |·, ·〉β denotes the corresponding two-mode Fock state in the chosenpolarization basis β, and 1n represents the identity operator on the n-photonsubspace. This perfect single-polarization mode description is also employed forthe target operators, however only acting on the vacuum Tvac,β = |0, 0〉〈0, 0| orthe single photon subspace

Ti,β = Fn=1i,β , i ∈ {0, 1}. (4.13)

4.3.2 Reduction

In order to simplify the search of an appropriate squashing operation for thedescribed polarization measurement we first reduce the problem to lower dimen-sions. Note that both POVMs are block-diagonal with respect to the photonnumber subspaces, hence a preceding QND measurement of the total numberof photons does not alter the result of the successive measurement. Thereforesuch photon number measurements can be included without loss of generalityin the squashing operation itself. Consequently the resulting map becomes amixture of different squashing operations acting only on definite photon numbersubspaces. Thus we are left to examine how a generic n-photon input state hasto be mapped to a probabilistic mixture of a single photon target state and theone-dimensional vacuum component. Equation 4.1 directly states that any vac-uum state can only be mapped to itself, while any real n-photon state, n ≥ 1,must completely be transferred to a single photon (hence qubit) target state.This combined action is depicted in Fig. 4.3 in which the vacuum component isdenoted as a “flag” outcome of the photon number measurement.

In order to obtain a fixed finite dimensional problem for each photon numbersubspace n we exploit some additional structure of the full mode measurementoperators. As apparent from Eq. 4.12 all POVM elements for the n-photon sub-space differ only within the low dimensional subspace spanned by the extremepolarization states, i.e., |n, 0〉β, |0, n〉β for all different basis settings β. Henceby using similar arguments as already employed in the previous reduction idea,one can without loss of generality decompose each squashing operation on then-photon subspace into one part that acts only on this non-trivial subspace andinto a different part that just operates on its orthogonal complement. Further-


more, since all measurement operators equal on the orthogonal complement, alldifferent outcomes must be triggered with the same probability; hence the cor-responding squashing operation just needs to produce a random single photonstate, cf. Fig. 4.3. In total we are left to determine the squashing operation ΛP

n

that is conditioned on the photon number n and the low-dimensional subspaceP .

4.3.3 BB84 and 6-state results

Theorem 4.3.1 (BB84). The active polarization measurement of the BB84protocol, Fi,β with i ∈ {vac, 0, 1} and β ∈ {x, z}, can be mapped to its singlephoton target operators Ti,β via a physical squashing operation.

Proof. Via the preceding discussion it is clear that we only have to prove ex-istence of the conditional squashing operation ΛP

n for each photon numbern. For a given photon number the corresponding Choi-Jamio lkowski opera-tor τn = τ(ΛP

n ) = τfix + τopen (we skip the label n for most of the cases) can bedecomposed into a fixed part τfix, that is completely determined by the set oflinear constraints given by Eq. 4.9, and into an orthogonal open part τopen. Ifone exploits the particular structure of the operator τn, cf. Eq. 4.6, these linearconstraints can be solved straightforwardly (cf. also the proof of Thm. 4.3.2)such that one obtains

τfix =1

2

1F ⊗ 1T +∑

β=x,z

(|n, 0〉β〈n, 0| − |0, n〉β〈0, n|) ⊗ σβ

, (4.14)

with the corresponding Pauli operators σβ , and the remaining part equals toτopen = O⊗σy with a still undetermined operator O. According to Eq. 4.10 thisoperator O has to be chosen such that τn ≥ 0 becomes positive semidefinite.

In the following let us denote the extreme polarization states that determinethe non-trivial subspace P by |ψi〉 with i = 1, . . . , 4. This set of states {|ψi〉}becomes linear independent as soon as n ≥ 3 and hence forms a non-orthogonalbasis of this subspace. Nevertheless such a particular basis is already sufficientto check for positive semidefiniteness. More precisely, let us define the followingmatrix M(τn) using the combined non-orthogonal basis |ψi, j〉 = |ψi〉⊗|j〉, witha standard basis |j〉 for the qubit space, given by

Mij,kl(τn) = 〈ψi, j|τn|ψk, l〉. (4.15)

This matrix M(τn) is related with the Choi-Jamio lkowski operator τn via acongruence transformation G, i.e., M(τn) = GτnG

†, which is nonsingular if andonly if the set of states |ψi, j〉 is linear independent [53]. Thus this particulartransformation preserves the number of strictly positive, vanishing and negativeeigenvalues, and hence one can alternatively check the positivity requirementM(τn) ≥ 0 for this particular matrix4.

Since M as defined by Eq. 4.15 is clearly linear we have M(τn) = M(τfix) +M(τopen) and the fixed part M(τfix) can directly be computed from Eq. 4.14 by

4For the low photon number cases n < 3 one only takes (n + 1) arbitrary extreme polar-ization states such that one obtains linear independence.


using the so-called Gram matrix of the extreme polarization states. This matrixspecifies the overlap of the extreme polarization states and is given by

M(1F) = [〈ψi|ψj〉]ij =

1 0 s s0 1 s ±ss s 1 0s ±s 0 1

, (4.16)

with respect to the state ordering {|n, 0〉z, |0, n〉z, |n, 0〉x, |0, n〉x}. Here s =2−n/2 denotes the corresponding overlap between states from different basissets, whereas the sign change distinguishes between the even and odd photonnumber case. Since M(τfix) contains only real entries one can assume withoutloss of generality that the open part M(τopen) = M(O) ⊗ σy is also composedof real entries only; otherwise any solution can be combined with its complexconjugation to obtain a real solution. Using this with the hermiticity of theopen part one obtains the following structure of the open part M(O) = iS, witha real skew-symmetric matrix S. For this open part we choose the followingform

M(O) =i

2

0 2δsn s −s

−2δsn 0 −s ±s

−s s 0 −2δns ∓s 2δs

n 0

+ i

0 x1 x2 x3

−x1 0 x4 x5

−x2 −x4 0 x6

−x3 −x5 −x6 0

, (4.17)

with real open parameters xi ∈ R, i = 1, . . . , 6 and the abbreviation 2δsn =

s2(1 − (−1)n). Note that this particular parameterization is still completelyopen and it is more a matter of presentation here. Using this particular form ofthe open part results in the following structure of the matrix M(τn) given by

1 0 0 2δsn + x1 s s+ x2 s −s+ x3

0 0 −x1 0 −x2 0 −x3 00 −x1 0 0 0 x4 0 x5

2δsn + x1 0 0 1 s− x4 s ∓s− x5 ±ss −x2 0 s− x4 1/2 1/2 δs

n −δsn + x6

s+ x2 0 x4 s 1/2 1/2 δsn − x6 −δs

n

s −x3 0 ∓s− x5 δsn δs

n − x6 1/2 −1/2−s+ x3 0 x5 ±s −δs

n + x6 −δsn −1/2 1/2

.

In the remaining part of the proof we show how to determine the free pa-rameters xi such that M(τn) ≥ 0 becomes positive semidefinite for all photonnumbers n. For this we employ the Sylvester criterion [53] which states that allprinciple minors, i.e., the determinants of all submatrices formed by deletingcomplete columns and its corresponding rows, have to be non-negative. For ex-ample the principle minor formed by the second and third line directly puts therequirement −x2

1 ≥ 0, hence only x1 = 0 is possible. Similar 2 × 2 submatricesdetermine xi = 0 for all i = 2, . . . 5, while the remaining parameter x6 = 0 getsfixed by the principle minor of the 5− 7th line. Thus all open parameters mustvanish, hence the first term in Eq. 4.17 already provides the solution. For theresulting matrix one can analytically compute the corresponding eigenvalues(for the two different cases whether n is even or odd) and verify that all of themare non-negative. This finally proves the theorem.


Theorem 4.3.2. [No-go 6-state] The active polarization measurement of the6-state protocol, Fi,β with i ∈ {vac, 0, 1} and β ∈ {x, z}, cannot be mapped toits single photon target operators Ti,β via a physical squashing operation.

Proof. We employ the reduction idea to get rid of the vacuum part such thatwe need to care about the single click outcomes only. Since the set of targetoperators of the 6-state protocol Ti,β with i ∈ {vac, 0, 1} and β ∈ {x, y, z}provide complete tomography on the target space, the corresponding set oflinear constraints given by Eq. 4.9 completely determines the Choi-Jamio lkowskioperator τ . In order to obtain τ = τ(Λ†) directly (without solving the linearconstraints explicitly) we use its original definition from Eq. 4.6, as the outputof the map Λ† applied to half of an unnormalized maximally entangled state∑

ij |ii〉〈jj|. Note that we can expand this input operator within the operatorset {Ti,β ⊗ σj}, where σj denotes the usual operator basis of a qubit operatorformed by the identity and the Pauli operators. Afterwards it is straightforwardto apply the map, since it just transforms Ti,β 7→ Fi,β . If one restricts the outputto the n-photon space one directly obtains

τn =1

2

1F ⊗ 1T +∑

β

(|n, 0〉β〈n, 0| − |0, n〉β〈0, n|) ⊗ σTβ

. (4.18)

If the underlying squashing operation is physical the resulting operator τn ≥ 0has to be positive semidefinite, cf. Eq. 4.10. However if one sets n = 3 andselects the state

|θ−〉 =1√2

(|3, 0〉z ⊗ |1〉 − |0, 3〉z ⊗ |0〉) , (4.19)

a direct calculation delivers 〈θ−|τ |θ−〉 < 0. Hence the resulting map violatescomplete positivity and thus cannot be physical.

4.4 Conclusion

Via the squash model one poses the question whether a given measurementscheme can alternatively be realized in a two-step procedure: First one per-forms a physical operation that transforms any incoming state to a preferablylow-dimensional output state; afterwards this outgoing system is measured withrespect to a particular designed measurement scheme on this smaller dimen-sional system. Using this method provides a way to recover for example aspecifically chosen qubit measurement within the decomposition of the originaldetection scheme. This provides a great advantage for most quantum communi-cation experiments, since the prior map typically does not weaken the advantageof the protocol itself and hence one can directly adapt the qubit analysis for thereal experiment. A prominent example of this represents the security analysis ofa practical QKD scheme, for which indeed this assumption about the validity ofsuch a squash model has been employed. We have addressed the question howone can actually verify or falsify such a squash model for certain QKD relevantmeasurement setups, in particular for the active polarization measurement usingonly threshold detectors. As a result we have shown that the active polarizationmeasurement of the BB84 protocol can indeed be “squashed” to its single pho-ton counterparts. Thus we have proven the missing link in most of the practical

4.5. CURRENT RESEARCH 53

security proofs. As a matter of fact, this assumption about the squash model isnot that obvious as it may seem first. For example the active polarization mea-surement of the 6-state protocol, that only differ from the BB84 by adding oneadditional basis setting, cannot be mapped to its corresponding single photonrealization via a physical map; hence the squash model assumption is wrong forthis setup.

A further direction might be to generalize the current concept of a squashmodel to a probabilistic notion, i.e., instead of requiring strict equality for thedecomposition of the given measurement device one also tolerates some smallε-deviation. Such a framework seems necessary if one wants to transfer thesquash model idea to continuous variable measurement schemes like homodyneor heterodyne detection. Another point concerns the falsification of the squash-ing operation for the 6-state measurement setup. However note that this onlystates that the shortcut in the security analysis via the squash model assump-tion is incorrect, but not that the computed key rates via this model are indeedinsecure. Analyzing this problem can provide further insights to the squashmodel itself. For example if one is only concerned with the security of a givenQKD scheme then one needs to verify the squashing property given by Eq. 4.1only for the subset of states that are compatible with the observed data. How-ever, to actually verify such a restricted model, in particular for the observed6-state measurement outcomes, seems to be a non-trivial task, and we leave itopen for further investigation.

4.5 Current research

Further results on the squash model have been obtained recently in Ref. [5].Because any squashing operation strictly connects two different measurementsetups, this argument must be kept in mind for the no-go statement of the 6-state measurement scheme. Consequently, one can try to “repair” the squashmodel of the 6-state protocol if one changes the full measurement description bya different postprocessing scheme. It is obvious that this idea should work out atsome point because one can always completely randomize the classical results.Note that the target measurements are kept fixed in order to benefit from theadaption mechanism of the security statement. As a result it turns out thatif one introduces an artificial symmetric bit error rate of about 16.67% via thepostprocessing scheme then one can indeed obtain a valid squash model again.However this error rate is already too high to achieve private key distillationvia unidirectional classical communication and hence it is more interesting on aconceptual level.

The squashing property has been investigated for several other QKD mea-surement schemes. For the considered BB84 or 6-state protocol it is also possibleto employ a passive basis choice selection via beam splitters in front of appropri-ate adjusted active polarization measurements, cf. Ref. [93]. Via the describedformalism of the present chapter it is straightforward to prove that both mea-surement realizations, of the BB84 and the 6-state protocol, possess a squashmodel with respect to their perfect single photon target measurements. This re-sult is particularly surprising for the 6-state case, however there is an importantdifference between an active or passive basis choice selection: In the passive set-ting the overall probability that all incoming photons are measured with respect


to the same basis choice rapidly decreases with the total photon number, whileall other events will necessarily produce multiclick events between different basisoutcomes and hence can be randomized. With the obtained insight it is evenpossible to describe a generic way how to modify a photon number preservinglinear optics measurement scheme in such a way that it can be squashed toits single photon counterpart. The last point addresses a rigorous multi-modedescription of the overall measurement setup; however even in these case thesquash model can be assured for the BB84 protocol.

Chapter 5

Entanglement verification

with realistic measurement

devices

5.1 Motivation

According to Asher Peres, entanglement is “a trick that quantum magicians useto produce phenomena (e.g., teleportation, superdense coding or quantum keydistribution) that cannot be imitated by classical magicians” [13]. Because ofthis key role of entanglement in these applications lots of effort has been putinto actually realizing this fragile resource in the lab, for example via parametricdown-conversion sources (PDC) or within ion traps to name only a few. In a realexperiment it is of course desirable to verify the creation of entanglement, andin fact many different operational tools have been developed over the past yearsto achieve this task, cf. Ref. [45] for a recent review. Note that reliable entan-glement verification has to satisfy a few crucial criteria [157]; most important,the verification method should not rely on assumptions from the entanglementgeneration process (including exchangeability and extendibility assumptions),but instead one only acquires information about the system via measurements.Moreover the obtained data are considered under a worst case assumption, i.e.,the test is only considered to be affirmative if the data exclude compatibilitywith all separable states1, in similar spirit as already motivated in Ref. [59].This viewpoint is even essential for certain tasks like quantum cryptography[22]. Still it is typical to allow one basic ingredient: Since one normally trustsor believes in quantum mechanics it is common to assume that one is equippedwith an accurate quantum mechanical description of the employed measurementdevices; to actually test or to “measure” a measurement device is anyway oftencombined with other assumptions [92] or seems to be unlikely to work in prac-tice if really no assumptions are made [101]. Note that if one does not restrictoneself to this model then one can still use for example Bell inequalities for theverification, however with the known drawback that certain entangled statescan never be verified [163] and there is even the conjecture that certain classes

1Of course in the limiting case of an infinite number of experimental runs.

55

56 CHAPTER 5. ENTANGLEMENT VERIFICATION

of interesting entangled states may be undetectable [115]. However these pointsdo not concern us here any further, such that we always have an operator setassociated with the observed data, which allows us to interpret them in a clearand meaningful, quantum mechanical way.

An example of a straightforward and hence quite often applied entanglementverification method, e.g., Ref. [65], consists in the following procedure to whichwe refer as tomography entanglement test in the later part of this chapter: Sincethe useful entanglement might be confined to a very low dimensional subspace,e.g., the single photon-pair subspace of a PDC source or the lowest two en-ergy levels of each ion in the trap, one just performs a few number of differentmeasurements to obtain tomography on this subspace. Of course after severalruns of the experiment one has collected enough data to reliably reconstruct theunderlying density operator on this subspace via some explicit reconstructiontechnique. Note that here one employs the knowledge of the measurement de-scription. In order to check for entanglement one simply investigates whetherthis reconstructed density operator describes an entangled state or not. How-ever does one really verify entanglement via this method? It is the questionhow one can have doubt about it at all? Of course the problem lies within themeasurement description, because such ideal measurements, as the ones usedin the reconstruction mechanism, might not have actually been performed inthe experiment. A good example represents a polarization measurement withtwo threshold detectors, cf. Fig. 4.2. Apart from acting on several input modesat once this device does not even respond solely to the single photon subspace,since such detectors cannot resolve the number of photons. Even restricting tothe single click outcomes (only one of two detectors clicks) it is never guaranteedthat the same outcome has not been triggered by a multiphoton signal. Hencethe question arises whether one still verifies entanglement if a “more refined”measurement description is employed. This is the purpose of the present chap-ter. Note that the aforementioned scenario often occurs not because one is notaware of the more realistic model, but because an oversimplified measurementdescription is employed, possibly motivated by the entanglement generationprocess, which then greatly eases the task of tomography and entanglementverification.

Let us proceed along the following lines: We start with an example in Sec. 5.2of such a tomography entanglement test which indeed signals the wrong con-clusion about the presence of entanglement under a small, physical change ofthe employed measurement description. As a natural next step, we investigatein Sec. 5.3 under which requirements such mistakes can safely be excluded. Inshort, the entanglement verification process remains stable as soon as the consid-ered set of operators are connected by a positive but not necessarily completelypositive map. Similar relations between different measurement schemes haverecently appeared in the QKD context, cf. Chap. 4, and even other known ver-ification methods can be cast into this framework. Afterwards we reformulatethe existence of such a positive map into a necessary and sufficient conditionwhich provides a particular intuitive solution for the described tomography en-tanglement test: The map exists if and only if each classical outcome patternfrom the refined set of observables remains compatible with the oversimplifiedset of observables. In Sec. 5.4 we prove that the aforementioned polarizationmeasurement with threshold detectors along all three different polarization axesrepresents an example which indeed can only be linked to its single photon real-

5.2. ION TRAP EXAMPLE 57

ization by a positive but not completely positive map. This analysis states thatthe tomography entanglement test that is typically employed for PDC sources[80] or in multipartite photonic experiments [165] can easily be made error-freeif the (local) double click events are taken into account. In the end we concludeand provide an outlook on possible further directions.

5.2 Ion trap example

Via a change of the underlying operator structure one modifies the (quantummechanical) meaning of the observed data, which directly affects the entan-glement statement. A famous example represents the case of a passive BB84protocol in which the observed data either directly verify the creation of a max-imally entangled state, or, after a change of the assumed operator structure,are reproducible with a separable state, cf. Ref. [2]. In the following we liketo provide another simple, yet practically relevant example, which shows thatthe tomography entanglement test indeed can lead to a false conclusion aboutthe presence of entanglement if the structure of the observables is not properlytaken into account.

For a single 40Ca-ion in a trap one typically considers only the lowest twoenergy levels given by |S〉 = |1〉, |D〉 = |0〉 and treats them as a qubit. Resonancefluorescence provides a mechanism to read out the occupation number of theenergy level |D〉. An electron in this state is coupled to a higher energy level|P 〉, and observing photons from the |D〉 ↔ |P 〉 transition signals that the qubitwas in the state |D〉. This overall process corresponds to a projection ontothis energy state and consequently allows to measure the σz Pauli, while themeasurement along different directions is achieved by a local basis rotations priorto the σz measurement, cf. Ref. [47]. In order to avoid too many measurementsit is common to measure the occupation probability only for the state |D〉,simply because for qubits the other probability equals to p(S) = 1 − p(D) dueto normalization, and similar for the remaining basis settings. Suppose that oneuses this measurement procedure to obtain tomography in order to verify thecreation of entanglement between two separated ions in the trap. Consider nowthe example that the observed expectation values, abstractly denoted as Eij(p)and characterized by a noise parameter p, may allow the reconstruction of thestate

ρAB(p) = (1 − p)|ψ+〉〈ψ+| + p14, (5.1)

which is, by virtue of the PPT criterion, entangled for p < 2/3.However in practice the situation is more complicated since the ion is not

a simple two-level system. To model this, one can add another energy level toonly one of the ions, thereby enlarging the two qubit system to a qubit-qutritone. Without any additional information about the occupation number of thisextra level, it is clear that the assignment of p(S) = 1 − p(D) is not correctany more. Consequently the observed data Eij(p) can only verify entanglementfor the case p < 0.63; this can be checked by using the tools from Ref. [23] inwhich the search for an appropriate separable state can be cast into the formof a semidefinite program. Hence we have an interval, i.e., p ∈ [0.63, 2/3),for which the performed tomography entanglement test indicates the presenceof entanglement although with a more realistic model it does not. Though


this region might be small this effect can become important in the multipartitescenario, where current experiments just operate within the border of genuinemultipartite entanglement [46, 81, 35].

Concerning the experimental consequences, however, two facts are impor-tant: First, for ion trap experiments it is verified that the occupation probabil-ity for levels apart from the lowest two energy states is very small, typically it isaround 10−3. Given this additional measurement data, it is possible to providea quantitative estimate of the resulting error in the used entanglement verifica-tion scheme, e.g., for the mean value of an entanglement witness. For typicalwitnesses employed in those scenarios this error is far below the unavoidablestatistical uncertainty which is caused by the finite number of copies of a stateavailable in any experiment. Second, note that the probabilities p(S) and p(D)of each energy level can be measured independently by additional local rotations,hence at the expense of more measurements. Then the resulting probabilitiescorrespond to the unnormalized two-level state ρred that is obtained from themodelled three-level system ρtot by a local projection, i.e., ρred = ΠρtotΠ, withΠ = |S〉〈S| + |D〉〈D|. As long as we prove entanglement of the combined twoqubit system ρAB

red ∝ 1⊗ΠρABtot 1⊗Π, this also implies entanglement for the total

state ρABtot , since the projection is local. This shows that additional dimensions

of the Hilbert space alone do not invalidate the conclusion that the state isentangled in case that the measurements are performed properly.

5.3 Positive squashing operation


The considered problem states as follows: In order to verify entanglement wesuppose that each party measures a set of local observables which are used forinstance to evaluate the expectation value of an entanglement witness or toobtain tomography of the underlying quantum state. In a real experiment theselocal operators (another system identifier is added if necessary) are given bythe so-called full observables, labelled as Fi with i = 1, . . . , n and are acting onthe Hilbert space HF. Nevertheless, these observed data are interpreted—onpurpose or because of various other reasons—as the expectation values of a setof different operators that we term target observables Ti and which are actingon Hilbert space HT respectively. These target operators are actually employedfor the entanglement verification process, e.g., in the reconstruction mechanismof the tomography entanglement test. For the ion-trap example of Sec. 5.2the target observables were considered as qubit operators, whereas the real fulloperators were acting on a qutrit system. As shown, such a misinterpretationcan lead to a false detection of entanglement. In the following we provide asimple condition on the two operator sets only which excludes such possibilities,and hence guarantees the presence of entanglement.

Suppose that both sets of observables are at least connected by a positivebut not necessarily completely positive linear map Λ : L(HF) → L(HT) suchthat the expectation value of each observable Fi with an arbitrary input stateρF is the same as the expectation value of the corresponding target operator Ti

with the output state of the map Λ(ρF), that is

tr(ρFFi) = tr[Λ(ρF)Ti], ∀ρF ∈ D(HF), ∀i, (5.2)

5.3. POSITIVE SQUASHING OPERATION 59

in which D(HF) stands for the set of all density operators of the correspondingHilbert space. Such a described link between two different observable sets closelyresembles the notion of a squash model from the QKD context, cf. Chap. 4,which differs from the present definition only by the extra requirement of beingcompletely positive, rather than just positive, and that it is defined on a com-plete set of measurement operators. Because of those similarities we employ theterm positive squashing operation in order to refer to map Λ, or its adjoint Λ†

in the later part. Similar as in Chap. 4, via the definition of the adjoint mapΛ† : L(HT) → L(HF) the condition of Eq. 5.2 can be rephrased into

Λ†(Ti) = Fi, ∀i. (5.3)

together with a positivity requirement for the adjoint map Λ†. Note that typ-ically we consider the case of a trace-preserving map Λ, or a respective unitalmap Λ†, such that density operators are mapped to properly normalized densityoperators; however this requirement is not mandatory. A famous example ofa non-trace-preserving, but positive map between operator sets is given by thematrix of moments2 [104]. The only difference is that one must be careful withentanglement criteria on the target space that explicitly employ normalizationof the density operators, e.g., the computable cross norm or realignment crite-rion, but one can also deal with these points [104]; others like positive maps arefine right away.

5.3.2 Entanglement verification

The advantage of a positive squashing operation is that the structure of sepa-rable states (from full to target Hilbert space) remains invariant, so that anysuccessful entanglement verification on the target space directly translates to apositive verification statement on the full Hilbert space:

Proposition 5.3.1 (Entanglement verification). Let us assume that the twolocal observable sets on Alice’s side, labeled as {FA

i } and {TAi } respectively, are

connected by a positive, not necessarily completely positive, unital linear mapΛ†

A satisfying Eq. 5.3, and a similar relation holds for Bob’s observables. If theobserved data verify entanglement with respect to the target observables TA

i ⊗TBj ,

then these data also prove the presence of entanglement for the full operator setFA

i ⊗ FBj . An analogous statement holds for more than two parties.

Proof. For any separable state on the full Hilbert space ρsepAB =

∑

k pkρkA ⊗ ρk

B

the operator

σsepAB = ΛAB(ρsep

AB) =∑

k

pk ΛA(ρkA) ⊗ ΛB(ρk

B) (5.4)

represents a valid separable state on the target space because of positivity ofthe corresponding maps. This state is also compatible with the observed data

2Though there are different applications of the matrix of moments, or equivalently theexpectation value matrix, only the one from Ref. [104] exploits it in the same spirit as forthe present purpose: Rather than trying to reconstruct the matrix of moments of the, e.g.,partially transposed state [136, 49], the verification method from Ref. [104] applies the separa-bility criteria directly on the matrix of moments, since it can be considered as an unnormalizedphysical state. Moreover let us note that the matrix of moments is the composition of a com-pletely positive map followed by the transposition, hence only positive but not completelypositive.


Eij due to the identity Eij = tr(ρABFAi ⊗ FB

j ) = tr[ΛAB(ρAB)TAi ⊗ TB

j ]. Con-sequently if one proves that the observed data Eij are incompatible with aseparable target state, then these data must also be inconsistent with a separa-ble state on the full Hilbert space. Note that here one just needs positivity ofΛA and ΛB but not complete positivity.

Let us point out that such a local squashing operation between operatorsets does not represent the most general map between bipartite observable setsthat preserve the structure of separable states; however we neglect other (non-local) options on behalf of the “locality” of this connection. Furthermore notethat since we do not require for a completely positive map, it can happen thatone obtains an unphysical, i.e., not positive semidefinite, density matrix on thetarget space; such an operator is then also incompatible with a separable state.However since this situation can only occur for an entangled state on the fullbipartite Hilbert space, the positive entanglement statement remains valid evenin this case.

Moreover let us remark how the tomography entanglement test depends onthe precise state reconstruction technique. The most common reconstructionalgorithms are either a direct inversion of Born’s rule or a maximum likelihoodestimation [61], though there are also problems associated with these mech-anisms [8]. For the case that the squashing operation is completely positiveany state on the target space is positive semidefinite, hence both reconstructionmethods will produce the same operator in the limit of exact expectation values,so there is no difference in the tomography entanglement test. However for apositive but not completely positive squashing operation the situation changes.First note that because any separable state on the full Hilbert space correspondsto a valid separable target state, i.e., to a positive semidefinite operator, fake en-tanglement detection is again excluded because both reconstruction techniquesdeliver the same operator. However, for the case of an unphysical and thus“entangled” target operator the statements can differ: Via a direct inversion ofBorn’s rule one would directly detect the entanglement by the non-positivityof the corresponding target operator3. In contrast to this the maximum likeli-hood method always produces the closest positive semidefinite operator [61, 8](with respect to the likelihood “distance”). Consequently it can happen thatan unphysical entangled target state is mapped to a separable target state bythe maximum likelihood estimation and hence is not witnessed as an entangledstate by the tomography entanglement test.

5.3.3 Existence

Next we investigate which requirements need to be fulfilled by the two differentoperator sets in order to be connected by a positive squashing operation. Thereare of course different ways how one can tackle this problem: For example onecan employ the Choi-Jamio lkowski isomorphism to transform the requirementfrom Eq. 5.3 into a set of linear equations, and the positivity constraint intoan entanglement witness condition, in close analogy to the method discussedin Chap. 4. However we take a different direction here that provides a clear

3In this case one should be convinced that the actual operator description TAi ⊗TB

j cannotbe the precise one for the experiment. However via the matrix of moment of the partiallytransposed state [136, 49] one effectively performs such a detection.

5.3. POSITIVE SQUASHING OPERATION 61

interpretation for the existence of such a positive linear map and which is alsoemployed in the later part to prove the positive squashing property for thepolarization measurement.

The requirement of the squashing operation given by Eq. 5.2 directly al-lows to read off a necessary condition: It states that for any density operatorρF of the full Hilbert space there exists a valid density operator Λ(ρF) (if Λ istrace-preserving) of the target space such that both operators assign the sameexpectation values for the considered observables. Hence all expectation valuesEi that can in principle be observed on the full Hilbert space must remain physi-cal with respect to the target observables. As we will see, this condition becomesalso sufficient if the target operators Ti with i = 1, . . . , n provide complete to-mography. Thus, in combination with the Prop. 5.3.1, we have the followingsolution for the question posed in the introduction: The tomography entangle-ment test is error-free as long as the full local observables on Alice and Bob’sside can only produce measurement results which are also consistent with thelocal target or reconstruction observables. For the following proposition we needthe set of possible physical expectation values associated with an observablesset, defined as

SF = {E ∈ Rn : ∃ρ ∈ D(HF), Ei = tr(ρFi), ∀i = 1, . . . n} , (5.5)

and a similar definition for the target operator set ST.

Proposition 5.3.2 (Existence). The set of full observables {Fi} and the tomo-graphic complete set of target observables {Ti} are related by a positive unitalsquashing operation Λ† if and only if it holds that SF ⊆ ST.

Proof. One direction of the proof is clear: Suppose that there exists a positivetrace-preserving squashing operation Λ. For any E ∈ SF we must have a validdensity operator ρF such that one obtains Ei = tr(ρFFi) = tr[Λ(ρF)Ti]. Becauseof the properties of the corresponding map we receive a valid target densityoperator ρT = Λ(ρF) which provides the same expectation values E, henceE ∈ ST. This concludes the first direction of SF ⊆ ST.

For the other direction, we employ the fact that the set of target operatorsis tomographic complete and the set inclusion SF ⊆ ST to explicitly obtain thepositive squashing operation. First note that for a given set of physical expec-tation values E ∈ ST, the corresponding target density operator is uniquelydetermined by a direct inversion of Born’s rule, RT : E 7→ ρT(E), i.e., by alinear reconstruction mechanism that maps the expectation values to the den-sity operator. Moreover for a given full density operator ρF the correspondingexpectation values are already determined, which is described by the linear mapMF : ρF 7→ E. Combining these two maps according to

Λ = RT ◦MF (5.6)

provides the squashing operation: That is, for a given input state ρF one firstcomputes the expectation values E via the full operator set and then uses thesevalues in the reconstruction algorithm (that depends on the target operators) toobtain the corresponding target output state. The set inclusion guarantees thatany valid full density operator is mapped towards a valid target state, hencethe described map is already positive. Since both maps in the decompositionare linear the overall map is linear as well. This proves the second part of thestatement.


Note that Prop. 5.3.2 can additionally be employed in the case of partialinformation on the target space if one expands each operator set with appropri-ate observables in such a way that the set inclusion holds and that one finallyobtains tomography. In a concrete example the proposition of course only helpsif one obtains knowledge on the sets S. Although this is by far not a trivial taskone can employ approximation techniques for special set of observables or evena hyperplane characterization for the exact determination, see Chap. 2 for moredetails. Let us comment that one can even characterize a completely positivemap via such a set inclusion requirement if one adds an additional referencesystem on each side; however for an actual verification of this we recommendthe formalism of Chap. 4.

5.4 Example: Polarization measurement

As a physical relevant example we consider again the active polarization mea-surement using threshold detectors, which already played the key applicationin the original squash model discussion of Chap. 4. However, apart from theQKD purpose, this setup occurs in a variety of different optical experiments,cf. Ref. [113] for a recent review, and in particular has also been employed toanalyze the polarization entanglement in the bi- and multipartite setting. Addi-tionally as shown via Thm. 4.3.2, if one uses this detection scheme and measuresalong all three different axes, then one cannot justify a single photon assump-tion via a physical, completely positive map, yet exactly this setup is used formost of the tomography entanglement tests. However, as we will show in thissection, one can connect it via a positive but not completely positive map, andhence can validate the tomography entanglement test for all these experiments.

The exact specification of full and target observables is precisely the sameas already introduced in Sec. 4.3.1. Let us remind that via the choice of targetoperators one likes to support the single photon assumption for each “singleclick” outcome, while the particular post-processing scheme on the measurementoutcomes is required because of normalization. We will discuss its effect onthe tomography entanglement test later. In the following suppose that Fi,β

and Ti,β with i ∈ {vac, 0, 1} and β ∈ {x, y, z} denote again the perfect singlepolarization mode description of the full and target operators respectively, asgiven in Sec. 4.3.1.

Let us further comment on these observable sets: Note that if one selectsthe following standard basis for the single photon subspace |1, 0〉z = |0〉 and|0, 1〉z = |1〉, then each difference of the single click target operators equals toa familiar Pauli operator, i.e., σβ = T 1

0,β − T 11,β for all β. Hence each of the

single click operators Ti,β corresponds to a projection to one of the two differenteigenstates of the related Pauli operator σβ . Furthermore the correspondingdifference between the full observables Fβ = F0,β − F1,β =

∑

n=1 Fnβ is again

block-diagonal and each n-photon part is given by

Fnβ = Fn

0,β − Fn1,β = |n, 0〉β〈n, 0| − |0, n〉β〈0, n|. (5.7)

Let us remark that these observables are also accessible with a different polar-ization measurement that only uses a single threshold detector4 and which hasalternatively been employed for PDC experiments, cf. Ref. [65].

4The measurement setup is similar to the one from Fig. 4.2, however one only measures

5.4. EXAMPLE: POLARIZATION MEASUREMENT 63

The following theorem proves the positive squashing property between thetwo given sets of observables; however it also applies to the other measurementdescription of Ref. [65].

Theorem 5.4.1. There exists a positive but not completely positive squashingoperation Λ† connecting the target Ti,β with the full operators Fi,β of the polar-ization measurement, which are given by Eq. 4.13 and Eq. 4.11 respectively, andwith i ∈ {vac, 0, 1}, β ∈ {x, y, z}.

Proof. First let us point out that the existence of a completely positive squashingoperation has already been ruled out by Thm. 4.3.2. In order to prove thesquashing operation we only need to focus on the click events, since the vacuumpart can be directly removed by a local projection discriminating between thevacuum and all other Fock-states, cf. reduction idea from Sec. 4.3.2. Note thatit is sufficient to prove the squashing operation for a set of linear independenttarget operators only, because other linear dependencies are directly present inthe linear map. In short, it is equivalent to prove a positive unital squashingoperation Λ†(σβ) = Fβ for all β ∈ {x, y, z}, where Fβ is the described differencebetween the click outcomes of the full observables.

Since we only concentrate on the single photon subspace we are equippedwith full tomography and hence can readily apply Prop. 5.3.2, such that itremains to prove SF ⊆ ST. Since each full observable is photon number diagonalone obtains that SF is given by the convex hull of all n-photon sets Sn

F , i.e., theset of physical expectation values on an n-photon state. Hence we need to verifythat each n-photon state can only produce expectation values which are alsocompatible with a single photon state, i.e., Sn

F ⊂ S1F = ST for all n ≥ 1. The

set S1F directly equals to the familiar Bloch sphere. Hence we prove existence of

a positive squashing operation if we can show that∑

β∈{x,y,z}

[tr(ρFnβ )]2 ≤ 1 (5.8)

holds for all n photon density operators ρ, and for all photon numbers n ≥ 1.In order to simplify the analysis in the following, each operator Fn

β canbe regarded as an operator acting on a n-qubit space. Indeed, the n-photonHilbert space Hn

F = Cn+1 is isomorphic to the symmetric subspace Sym(Hn)of the n-qubit system Hn = (C2)⊗n. Using the given standard basis definitionone obtains for example

Fnz = |0〉〈0|⊗n − |1〉〈1|⊗n

, (5.9)

while for any other operator Fnβ one just replaces the states |0〉, |1〉 with the

eigenvectors of the corresponding Pauli σβ .Expanding these operators within a multiple qubit basis delivers

Fnβ =

(1+ σβ

2

)⊗n

−(1− σβ

2

)⊗n

=1

2n−1

∑

j odd

∑

π

π(

σ⊗jβ ⊗ 1⊗(n−j)

)

(5.10)

behind one of the outputs of the polarizing beam splitter. It is direct that the operators Fβ

can be obtained by using the difference of the two outputs (or alternatively with appropriatebasis settings before). However in order to obtain the double click information, respectivelythe identity 1, one has to measure the overall input via a threshold detector, i.e., with nopolarizing beam splitter. It is not, as typically employed, given by the sum of both clicksevents on both different outcomes.


in which∑

π denotes the sum over all possible permutations π(·) of the subsys-tems that yield different terms. Next we exploit the result from Ref. [150] thatfor odd j, every quantum state ρ, hence also for each n-photon state, satisfies

∑

β∈{x,y,z}

〈π(σ⊗jβ )〉2ρ ≤ 1, (5.11)

with the abbreviation

〈π(σ⊗jβ )〉ρ = tr

[

ρ π(

σ⊗jβ ⊗ 1⊗(n−j)

)]

. (5.12)

This inequality is based on the property that the observables π(σ⊗jβ ⊗ 1⊗(n−j))

with β ∈ {x, y, z} have all eigenvalues equal to ±1 and anticommute pairwise.Note that this identity holds for all occurring j and for all possible permuta-tions π. Consequently one obtains

∑

β

[tr(ρFnβ )]2 =

1

22n−2

n∑

j,j′ odd

∑

π,π′

∑

β

〈π(σ⊗jβ )〉ρ〈π′(σ⊗j′

β )〉ρ

≤ 1, (5.13)

where the inequality (together with the Cauchy-Schwarz inequality) was usedto upper bound each term in the squared bracket by 1. For the final resultone needs to count the numbers of distinct permutations π, which is given by acorresponding binomial coefficient.

How can one use this result in the tomography entanglement test of a PDCsource? First each party measures along all three different polarization axes.Next one either directly post-processes the double click events or just computesthe corresponding rates and/or probabilities of the full operators. Afterwardsboth parties can safely use the single photon assumption, or more precisely theset of perfect single photon target operators {Ti,β}, to compute the correspond-ing two qubit state ρAB (single photon subspace on each side) via their preferredreconstruction technique. In case that this reconstructed state is entangled onecan be assured that the observed data still verify entanglement if both partiesbelieve in the more realistic measurement description {Fi,β}.

It is worth mentioning that this scheme is different than the one used inmost of the experiments. Typically one only considers the real “single click”outcomes in the reconstruction process, while double clicks are discarded. How-ever the effect of a random double click assignment is that one mixes the “singleclick” reconstructed state with some additional noise that is of the order of theobserved double click probability. Although this contribution is small for mostexperiments, this part is nevertheless essential. Otherwise one can construct ascenario (with an of course high double click rate) that originates from a separa-ble state but which shows a maximally entangled state on the single click level,cf. the so-called strong pulse attack in an entanglement based QKD scheme.

Next let us focus on the imperfections of the photodetectors. Inefficiencies,usually around 15%, are typically modeled as an additional beam splitter infront of the perfect measurement device [169], hence if one combines the beamsplitter map (completely positive) with the already proven positive squashingmap from the perfect case then one directly obtains the positive squashingproperty for an inefficient measurement description. The same idea applies to

5.5. CONCLUSION 65

dark counts, which can be modeled as a particular post-processing scheme onthe classical outcomes [93], and to misalignment errors, that are described by afixed depolarizing channel on each photon separately. Even the extension to amulti-mode description is possible if one employs the model from Ref. [5].

Additionally we like to comment on two points: As one can prove the cor-responding squashing operation is completely positive on the single and twophoton subspace. Hence one only observes a positivity violation of the corre-sponding target density operator if the local multiphoton contribution is verylarge in comparison to the single and double photon parts (and even then onlyfor very particular entangled states); consequently it is very unlikely to observesuch a non-positive target operator in a real PDC experiment. As a last remarkwe like to stress that one has to be careful with Thm. 5.4.1. In particular formultipartite experiments it is common that one does not even want to obtain“full” tomography on the target space, but instead tries to verify entanglementby measuring an entanglement witness, e.g., Ref. [91]. In order to evaluate thiswitness it is convenient to measure along more than just the three differentorientations β of the local polarization measurement (but only for a handful ofglobal settings such that the effective number of measurements is smaller thanthe one required for tomography). In this case the corresponding single photontarget measurements Ti are overcomplete, hence it is tempting to assume that itis sufficient to check the local squashing property only for a linear independentset of target operators. Nevertheless for the overall squashing property to holdit is still required that the remaining observables of both Hilbert spaces are con-nected by the same linear relation. This property is violated by the describedpolarization measurement. Note that for the (qubit) target space any measure-ment along a given polarization axis can be expressed as a linear combination oftarget measurements along the three extreme settings, whereas for polarizationmeasurements on the full Hilbert space this statement does not hold anymore.As a result the different operator sets cannot even be connected by a linearmap, and thus also the local squashing operation cannot exist. Neverthelessit is worth mentioning that here one might try to proceed with a global sep-arable squashing operation on the effective number of global measurements ascommented after Prop. 5.3.1.

5.5 Conclusion

Entanglement verification typically assumes that one has knowledge of the un-derlying measurement operators such that each classical outcome gets an ac-curate quantum mechanical meaning. We have addressed the question underwhich conditions an affirmative entanglement statement remains valid undera change of the underlying operator structure. Apparently this situation canemerge if the actual measurement observables are different from the ones usedin the verification process, simply because of imperfections, wrong calibrationor other assumptions like the support of each operator. However it even happenon purpose: Indeed one can try, despite of being aware of certain differences,to explain the data via an oversimplified model, e.g., a very low-dimensionaldescription, such that it eases the task of applying an entanglement criteria.Such a case can occur for example for an active polarization measurement withthreshold detectors to analyze the entanglement from a PDC source: Here one


likes to employ a single photon description only, although that one knows thatcertain multiphoton states can also trigger events that are indistinguishable froma single photon case, because then one easily obtains “tomography” by usingthree different measurement settings and directly checks for entanglement onthe reconstructed two qubit state. Summarizing, the entanglement statementremains stable if both set of measurement operators can be related by a posi-tive (not necessarily completely positive) map. In case that the reconstructionoperators provide complete tomography such a positive map exists if and only ifall measurement results from the refined, actual measurement device stay com-patible with the assumed measurement description of the device. In the end wehave shown that the aforementioned polarization measurement, measured alongall three different polarization axes, constitutes a physical relevant example ofsuch a connection that is positive but not completely positive. This result showsthat most of the performed tomography entanglement tests for a PDC sourceare indeed error-free if one incorporates a penalty for the double clicks duringthe reconstruction process.

Chapter 6

Detector decoy quantum

key distribution

6.1 Motivation

Among the research performed nowadays in order to increase the secret key rateand distance that can be covered by quantum key distribution (QKD) systemsone can already distinguish three main work areas which are nevertheless closelyrelated to each other [37, 28, 133]. First we have the development of new prooftechniques, together with better classical post-processing protocols, that areable to extend the proven secure regimes for idealized QKD schemes, whichare typically based on the transmission of abstract two-level quantum systems,called qubits [102, 103, 86, 138, 17, 38, 25, 69, 79, 124]. Second we find thecontinuous improvements from the technological side. Especially the design ofbetter light sources and more advanced detectors further increase the distanceof secure communication [143, 144, 127]. Finally there is the research whichaims to close the gap between theoretical security concepts for idealized QKDschemes and their experimental realization [63, 39, 78, 87, 162, 64, 132].

The awareness of such a theory-experiment gap was triggered by the impor-tant deviations present in a practical QKD setup with respect to its originaltheoretical proposal which usually demands technologies that are beyond ourpresent experimental capability. Especially, the signal states emitted by thesource, instead of being single photons, are usually weak coherent laser pulseswhich can contain more than one photon prepared in the same polarizationstate. In such cases the eavesdropper, typically named Eve, can efficiently at-tack those multiphoton signals in order to obtain a perfect copy of the singlephoton state. This so-called photon number splitting attack [10, 62] gives Evefull information about the part of the key generated from multiphoton stateswithout causing any detectable disturbance in the signal polarization. As a re-sult the use of weak coherent laser pulses greatly endangers the security of arealistic QKD experiment and hence limits the rate and distance that can beachieved by this setup. For instance it turns out that the BB84 protocol [7]with weak coherent laser pulses can give a key generation rate of order O(η2)[39, 64] where η denotes the transmission efficiency of the quantum channel.

One can obtain a significant improvement of the secret key rate if the hard-

67

68 CHAPTER 6. DETECTOR DECOY QUANTUM KEY DISTRIBUTION

ware is slightly modified by using the so-called decoy state method [63, 87, 162].In this approach the sender Alice varies independently and at random the meanphoton number of each signal state by employing different intensity settingsfor the source. Since the eavesdropper does not know the mean photon num-ber of each signal sent the corresponding gain and the quantum bit error rate(QBER) of each signal can only depend on its photon number but not on theparticular intensity setting used to generate it. From the measurement resultscorresponding to different intensity settings it turns out that the legitimateusers can estimate the gain and the QBER associated to each photon numberand consequently Alice and Bob obtain a better estimation of the behavior ofthe quantum channel. This translates into an enhancement of the resultingsecret key rate. The decoy state technique has been successfully implementedin several recent experiments [127, 172, 134, 29, 168] and it can deliver a keygeneration rate of linear behavior O(η) similar to one from a real single photonsource.

Note that the decoy state idea cannot be employed for all QKD experiments;for instance it fails for an entanglement based QKD scheme with an untrustedsource. In those scenarios it is very tempting to assume validity of the squashmodel. As explained in detail in Chap. 4 this model directly justifies the singlephoton assumption for each local detection side and consequently greatly easesthe security analysis. However such a squash model might not exist for theconsidered measurement device as for example in the case of an active polariza-tion measurement of the 6-state protocol, cf. Thm. 4.3.2. Hence the questionremains how to prove security nevertheless. Of course the easiest way would beto directly employ photon number resolving detectors. With those kind of de-tectors it is possible to condition each outcome onto the single photon outcomes,yet this is not always feasible nor the most practical way. However in order toguarantee security for most QKD schemes it is usually enough to have alreadyaccess to the statistics of such photon number resolving detectors, because inthe end it is only important to confirm that a large fraction of all conclusiveoutcomes have indeed originated from single photon states.

In this chapter, we analyze a simple method to estimate the photon numberstatistics provided by a photon number resolving detector using only a practicalthreshold detector together with a variable attenuator. The basic idea consistsin measuring the incoming light field with a set of simple threshold detectorsof different efficiencies, thus endowing us with more information about the un-derlying distribution of the photons. This technique has its origin in the fieldof quantum metrology as discussed in Refs. [105, 128, 171] and has been suc-cessfully implemented in some recent experiments [170, 36, 12] which also showthe practical feasibility of this method. However if one likes to employ thistechnique in the QKD context one has to estimate the photon number statisticsunder the worst case assumption for Alice and Bob. Thus the known reconstruc-tion method from Refs. [128, 171] which considers only a truncated version of theproblem (but under the additional constraint of merely a finite, small number ofexperimental runs) cannot be directly used for the QKD setups. Nevertheless,the central idea of the technique remains unchanged. In fact, this method canbe considered as the decoy state technique applied to the detector side: If Al-ice and Bob vary independently and at random the detection efficiency of theirapparatus then they can estimate the photon number statistics of the receivedsignals. Note that the photon number distribution of the incoming signals can-

6.2. ESTIMATING PHOTON NUMBER STATISTICS 69

not depend on the particular efficiency setting used to measure them. Thus,from now on, we shall refer to this estimation procedure as detector decoy toemphasize its connection and applicability to QKD. The detector decoy idea canbe employed both for calibrated and uncalibrated devices [133]. The essentialrequirement here is that Eve cannot modify the variable attenuator employedby the legitimate users to vary the detection efficiency of their setups.

In detail the chapter is organized as follows: We start with the descriptionof the detector decoy method in Sec. 6.2. Apart form the central idea we alsodiscuss the finite setting case and the modifications necessary to include imper-fections of the detector model. The remaining sections are dedicated to provesecurity of an entanglement based QKD scheme by solely using this estimationprocedure, hereby also demonstrating the generality of the method. This goal isreached in several steps: We start with a detailed security analysis in Sec. 6.3.1.As a result we see that one can obtain good lower bounds on the secret key ratefor the BB84 and 6-state protocol that only depend on a few (single photon)parameters of the incoming light field. In Sec. 6.4 we show two different alter-natives for the implementation of the detector decoy idea in a real detectionsetup such that these key-rate relevant parameters can be estimated efficiently.Let us point out that these proposed changes in the original detection schemeare minimal since only one or two additional beam splitters have to be insertedinto the linear optics network. In Sec. 6.5 we evaluate the resulting key ratesfor a simulated parametric down-conversion QKD experiment. Here we alsoinclude a comparison with key rates arising from a security proof based on thesquash model assumption of Chap. 4. Finally Sec. 6.6 concludes the chapterand provides an outlook on further projects.

6.2 Estimating photon number statistics

Most of the security proofs for QKD only require the estimation of a few param-eters related with the photon number statistics of the incoming signals. Theseparameters suffice to obtain good lower bounds for the achievable secret keyrate. Here we discuss and explain the technique to measure the photon numberdistribution of an optical signal by means of a practical threshold detector incombination with a variable attenuator. As mentioned, this idea has been intro-duced previously in the scientific literature, cf. Refs. [105, 128, 171]. The currentdiscussion differs in the particular way how one reconstructs part of the photonnumber distribution from the observed measurement outcomes; here we need toprovide bounds for certain photon number parameters, cf. Prop. 6.2.1, that arevalid without any further assumptions on the signal states. Of course the pho-ton number distribution can also be obtained by using directly photon numberresolving detectors [15, 68]. Via this approach Alice and Bob would not only beprovided with the distribution of the incoming signals but also with the num-ber of photons contained in each of them. Unfortunately most of the proposedmethods so far to construct this type of detectors result in devices with lowdetection efficiencies and which are unable to operate at room-temperatures.An interesting alternative is based on detection schemes which employ timemultiplexing techniques [1, 92]. This method has for instance allowed already apassive decoy state selection in QKD, cf. Ref. [99, 100]. However in this last casethe achievable photon number resolution depends on the number of detectors


and on the number of spatially, or temporal, employed detection bins.

6.2.1 Main idea

The basic idea of the detector decoy technique can be highlighted with a simpleexample: Consider the case that we either receive a very strong pulse or a signalcontaining just one photon. If we measure with a perfect threshold detector thenboth signals will repeatedly trigger the click outcome of the detector, and hencecannot be distinguished by the observed outcome. However suppose that werepeat the experiment and that in addition we place a very strong attenuatorin front of the threshold detector. Then, it is clear that the single photon pulsewill less likely produce a click in the detector than the strong pulse, and becauseof that the two different cases become distinguishable. Therefore changing thetransmittance of the beam splitter provides us with more information about thephoton number distribution of the incoming signal.

Figure 6.1: Case A shows a detection setup which combines a beam splitterof transmittance η together with an ideal threshold detector. If one varies thetransmittance of the beam splitter, then the detection setup given in case Aprovides for every input state ρ the same statistics (after several repetitions ofthis experiment) as a photon number resolving detector that is modelled by aquantum non-demolition (QND) measurement prior to the threshold detectoras shown in case B.

In the following we make this idea more precise. Consider the measurementscheme as shown as case A in Fig. 6.1, in which η denotes the variable transmit-tance of the inserted beam splitter. For a fixed chosen attenuation the combineddetection setup can be characterized by a positive operator valued measure(POVM) which contains the two elements Fvac(η) and Fclick(η) = 1− Fvac forthe respective outcomes. In particular the no click event is described by theoperator [126]

Fvac(η) =

∞∑

n=0

(1 − η)nΠn, (6.1)

in which Πn represents the projector on the n-photon subspace. Hence fora generic input state ρ the corresponding probability to observe the no clickoutcome equals to

pvac(η) =

∞∑

n=0

(1 − η)npn (6.2)

and clearly depends on the photon number distribution pn = tr(ρΠn) of theincoming state and on the chosen beam splitter setting η. Note that if one variesthe transmittance of the inserted beam splitter then the observed probability


changes only because of the binomial factors depending on the beam splitterefficiency; however the photon number distribution remains invariant. Now onecan follow similar arguments as already employed for the decoy state method:In particular if the receiver randomly chooses between different transmittancesη ∈ {η1, . . . , ηM} of the beam splitter he can generate a set of linear equationsin which the probabilities pn appear as the unknown parameters [105, 128, 171],

pvac(η1) =

∞∑

n=0

(1 − η1)npn,

... (6.3)

pvac(ηM ) =

∞∑

n=0

(1 − ηM )npn.

From the observed data together with the knowledge of the employed transmit-tances the receiver can use the set of linear equations given by Eq. 6.3 to obtainbounds on the photon number distribution pn. For instance, in the generalscenario where he employs an infinite number of possible decoy transmittancesη ∈ [0, 1], he can always estimate any finite number of probabilities pn witharbitrary precision. This result is illustrated as case B in Fig. 6.1.

6.2.2 Finite settings

If the receiver is only interested in the values of a few probabilities pn, thenone can estimate them by means of only a few different decoy transmittances,like in the decoy state method [63, 87, 162, 97]. This last statement is given byProp. 6.2.1 for the case where the receiver only wants to find worst case boundsfor the probabilities p0, p1, and p2. This proposition can straightforwardly begeneralized to cover also the case of any other finite number of probabilitiespn. Note that it constitutes a possible example of a finite setting estimationprocedure for which the derived bounds converge to the exact values of theprobabilities pn in the considered limit; however no optimality statement isgiven. In principle, many other estimation techniques are available, like linearprogramming tools [4] or different ideas from the original decoy state method[152], such that one obtains sharper, or for the purpose of QKD better, boundson the considered probabilities.

Proposition 6.2.1 (Finite settings). Consider the linear equation

f(c) =

∞∑

n=0

cnxn, (6.4)

where the unknown parameters xn fulfill xn ≥ 0 and∑∞

n=0 xn ≤ C for a givenconstant C, and where c satisfies c ∈ [0, 1]. Consider now three different set-tings c0 = 0, c1 and c2. Then, the unknown variables x0, x1 and x2 satisfy,respectively, x0 = f(c0) = f(0),

l1(c1) =f(c1) − f(0)

(1 − c21

)− c21C

c1 − c21≤ x1 ≤ u1(c1) =

f(c1) − f(0)

c1, (6.5)


and l2(c1, c2) ≤ x2 ≤ u2(c1, c2) with bounds

l2(c1, c2) =f(c2) − f(0)

(1 − c32

)− u1(c1)

(c2 − c32

)− c32C

c22 − c32, (6.6)

u2(c1, c2) =f(c2) − f(0) − c2l1(c1)

c22. (6.7)

When c1 = ∆ and c2 =√

∆, the given bounds converge to the exact value of thevariables x1 and x2 in the limit ∆ → 0.

Proof. We present the explicit derivation of the upper bound u1(c1) and of thelower bound l2(c1, c2). The other bounds can be obtained in a similar way.The basic idea is as follows: We first upper bound x1 from the knowledge off(c1); afterwards this result is used to lower bound x2 given the value of f(c2).Starting with the definition of f(c1) we obtain

f(c1) = x0 + c1x1 +∞∑

n=2

cn1xn ≥ f(0) + c1x1, (6.8)

where we have used the fact that x0 = f(0), c1 ≥ 0 and xn ≥ 0. This inequalityalready gives the upper bound u1(c1) on x1. To obtain the lower bound l2(c1, c2),note that the other extra condition on the open parameters xn gives

∞∑

n=N+1

xn ≤ C −N∑

n=0

xn, ∀N ∈ N. (6.9)

Using a similar expansion to that in Eq. 6.8 for the definition of f(c2) in com-bination with the condition given by Eq. 6.9 and c2 ∈ [0, 1] we obtain

f(c2) ≤ x0 + c2x1 + c22x2 + c32 (C − x0 − x1 − x2)

≤ f(0)(1 − c32) + u1(c1)(c2 − c32) + x2(c22 − c32) + c32C. (6.10)

In the second step we have employed again the fact that f(0) = x0 togetherwith the upper bound for x1 ≤ u1(c1). Equation 6.10 directly delivers the lowerbound given by Eq. 6.6.

Let us now prove that both bounds converge. The unknown parameters xn

are exactly the Taylor expansion coefficients of the function f(c) evaluated atthe point c = 0, i.e.,

xn =1

n!f (n)(0) =

1

n!

dn

dcnf(c)

∣∣∣c=0

. (6.11)

This means that the upper bound u1(c1) becomes exact if one finds the ap-propriate setting to estimate the first derivative. Choosing c1 = ∆ directlygives

lim∆→0

u1(∆) = lim∆→0

f(∆) − f(0)

∆= f (1)(0) = x1. (6.12)

For the lower bound l2(c1, c2) one has to perform the limit c1 → 0 prior toc2 → 0. Hence, one selects the setting c2 =

√∆ > ∆ = c1. Using the Taylor

expansion series,

f(c1) = f(∆) ≈ f(0) + f (1)(0)∆, (6.13)

f(c2) = f(√

∆) ≈ f(0) + f (1)(0)√

∆ +1

2f (2)(0)∆, (6.14)


we obtain

lim∆→0

l2(∆,√

∆) = lim∆→0

1

1 −√

∆

{1

2f (2)(0) +

√∆[

f(0) − C + f (1)(0)]}

=1

2f (2)(0) = x2. (6.15)

This proves that also the lower bound on x2 becomes exact in the consideredlimit.

For the further discussion we shall typically assume that one can always obtainthe exact values of the probabilities pn, hence we will ignore any finite settingeffects from now on.

6.2.3 Realistic detectors

So far, we have only analyzed the case of an ideal threshold detector. Whenthe detector has some finite detection efficiency ηdet and shows some noise inthe form of dark counts which are, to a good approximation, independent ofthe incoming signals, such a detector can be described by a beam splitter oftransmittance ηdet combined with a noisy detector [169]. In this scenario thesame argument as presented above still holds, hence the detector decoy methodcan also be used in the calibrated device scenario. Note that the no click operatorFvac(η) is now given by

Fvac(η) = (1 − ε)

∞∑

n=0

(1 − ηηdet)nΠn, (6.16)

where ε represents the probability to have a dark count. Via this measurementoperator the observed no click probability pvac(η) is now given by the form

pvac(η) = (1 − ε)

∞∑

n=0

(1 − ηηdet)npn. (6.17)

Again if one varies the transmittance η then the receiver can deduce mathemat-ically1 bounds on the probabilities pn from the measured data pvac(η) togetherwith the knowledge of the parameters η, ηdet and ε.

The results provided in this section only rely on the description of the detec-tors given by Eq. 6.1 or Eq. 6.16. However, there are many different ways how tomodel the exact behavior of an imperfect detector, and quite often the model istailored to the explicit situation for which one wants to use the calculated data.The probability of a no click outcome given by Eq. 6.3 or Eq. 6.17 describes thetypical QKD situation quite accurate, e.g., Ref. [93]. Of course, whenever thissituation changes the exact analysis need to be adapted. Nevertheless, the mainidea behind the detector decoy method stays invariant. Via the observationson several different distributions {pn(η)}, that directly depend on the incomingphoton number distribution {pn} by means of an explicit known transformationrule (binomial transformation in the case of the beam splitter) one can obtainmore information about the incoming photon statistics.

1Note that the convergence result given in Prop. 6.2.1 does not directly apply to thisscenario. However, it is still correct if one ignores the detector efficiency part. This is the caseconsidered in Sec. 6.3, when we analyze the security of QKD schemes.


6.3 Entanglement based QKD schemes

In the following we like to combine the detector decoy idea with the securitystatement for an entanglement based QKD scheme with an untrusted source.The schematic setup of such an experiment is shown in Fig. 6.2. The source,which is assumed to be under Eve’s control, is placed between the two receivers.In the ideal case, this source produces entangled states that are sent to Alice andBob. The entanglement is contained in the polarization degree of freedom of thelight field. This means that at least two different optical modes have to be con-sidered for each side. On the receiving side, we assume that both measurementdevices only act onto these two modes. For simplicity, we restrict ourselves tothe familiar active polarization measurement setup, in which each party activelychooses the basis β of the polarization measurement, and which have alreadyplayed a key role in the preceding two chapters. For the BB84 protocol eachreceiver can choose between two different basis, while in the 6-state protocolall three different polarization axes can be selected. Each measurement deviceconsists of a polarizing beam splitter that spatially separates the two incomingmodes according to the chosen polarization basis β, followed by two thresholddetectors on the two different output modes of the beam splitter. The securityanalysis for other measurement devices, like for example a passive measurementsetup is completely analogous. Entanglement based schemes constitute a verypromising alternative to implement QKD over long distances. In fact, they holdthe theoretical distance record for a QKD scheme without quantum repeatersso far, cf. the simulation in Ref. [96]. These protocols have been successfullyimplemented in many different recent experiments, e.g., Ref. [154, 83, 31], andthey are a suitable candidate to realize earth-satellite QKD links [155]. For moredetails on the setup, or on the measurement apparatus, we refer the reader toRefs. [96, 93].

Figure 6.2: Schematic diagram of an entanglement based QKD scheme withan untrusted source for the case of an active choice of the measurements basisβA, βB respectively.

In the following subsection we thoroughly discuss the security issues for suchan entanglement based QKD scheme. This part mainly summarizes the prooftechnique from Ref. [79, 124, 78]; we only have to show that one can indeedapply this security analysis for the considered scenario. Note that this part isheld quite general so that we can directly pinpoint the usefulness of the detectordecoy method in the security proof. Additionally let us point out that the mainresult, which is employed in the later parts, is given by Eq. 6.29, which showsthat the final lower bound on the secret key rate only depends on a few essentialparameters of the system. In Sec. 6.4 we then employ the detector decoy idea toestimate these parameters for the active measurement scheme. Finally, Sec. 6.5

6.3. ENTANGLEMENT BASED QKD SCHEMES 75

contains the simulation of a real QKD experiment, in which we also comparethe detector decoy method with other proof techniques.

6.3.1 Security analysis

We discuss the security level in the case of collective attacks. More precisely, weassume that the three parties Alice, Bob and Eve share an unlimited numberof copies of the same state |Ψ〉ABE. Once Alice and Bob have received theirpart of the quantum state, they measure it to obtain information about thestate ρAB = trE (|Ψ〉ABE〈Ψ|). The POVMs used by Alice and Bob are denoted,respectively, as {FA

i } and {FBj }. They contain all measurement operators that

Alice and Bob perform during the protocol, i.e., they also include the detec-tor decoy measurements. These additional measurements enable the legitimateusers to estimate some of the crucial parameters of the key rate formula withhigh confidence. Let us further assume that all measurement operators arephoton number diagonal, i.e., each of the elements FA

i or FBj satisfies

Fi =

∞∑

n=0

ΠnFiΠn, (6.18)

where Πn represents the projection on the n-photon subspace. Using this as-sumption, one can consider a slightly different, but completely equivalent, sce-nario for the distribution of the quantum states. This new scenario has the ad-vantage that it allows a direct application of a known key rate formula based onunidirectional classical error correction and privacy amplification [79, 124, 78].However, Prop. 6.3.1 holds independently of whether we restrict ourselves tounidirectional or bidirectional classical communication protocols in the post-processing stage.

Proposition 6.3.1. Whenever Alice and Bob use photon number diagonal mea-surement devices, then the secret key rate in the following two scenarios is thesame:

1. Eve distributes pure quantum states |Ψ〉ABE〈Ψ| from a given set P thatcontains the purification of all quantum states ρAB = trE(|Ψ〉ABE〈Ψ|) thatare compatible with the observed measurement data.

2. Alice, Bob and Eve share tripartite states ρABE = trR(|Φ〉ABER〈Φ|) ∈ Sthat originate from a four-party state of the form

|Φ〉ABER =

∞∑

n,m=0

√pnm|φnm〉ABE|n,m〉R, (6.19)

where |φnm〉ABE represents a state that contains n photons in the modedestined to Alice and m photons in the mode for Bob, and where |n,m〉Rdenotes an inaccessible shield system that records the photon number in-formation of Alice and Bob’s signals. The set of possible tripartite states Scontains all such states for which the bipartite (photon number diagonal)state ρAB = trER(|Φ〉ABER〈Φ|) is compatible with the observations.


Proof. We show that for any state |Ψ〉ABE〈Ψ| ∈ P chosen from the first scenario,there is a particular three party state ρABE ∈ S from the second case such thatEve’s situation, once Alice and Bob have performed their measurements, iscompletely equivalent. The reverse direction of this statement holds trivially.Note that Eve’s eavesdropping capabilities are completely determined by thecollection of conditional states ρij

E and their corresponding probabilities pij ,both defined via the relation

pijρijE = trAB

(FA

i ⊗ FBj σABE

), (6.20)

when Alice, Bob, and Eve share a state σABE. Let us start with the first case,where σABE = |Ψ〉ABE〈Ψ| ∈ P . Using Eq. 6.20 and the measurement propertygiven by Eq. 6.18 we arrive at

pijρijE =

∑

n,m

trAB

(ΠA

nFAi ΠA

n ⊗ ΠBmF

Bj ΠB

m |Ψ〉ABE〈Ψ|)

=∑

n,m

pnm trAB

(FA

i ⊗ FBj |φnm〉ABE〈φnm|

), (6.21)

where in the second line we have defined ΠAn ⊗ ΠB

m|Ψ〉ABE =√pnm|φnm〉ABE.

To compare this with the second scenario we select |Φ〉ABER arising from thestate |Ψ〉ABE via a coherent photon number measurement. Its outcome is storedin the additional register system R and the state is given by

|Φ〉ABER =∑

n,m

ΠAn ⊗ ΠB

m|Ψ〉ABE|n,m〉R =∑

n,m

√pnm|φnm〉ABE|n,m〉R. (6.22)

Using σABE = trR (|Φ〉ABER〈Φ|) in Eq. 6.20 directly delivers the same result asEq. 6.21. This finally proves the proposition.

Next we employ a security proof that only requires direct classical commu-nication in the reconciliation part of the protocol. More precisely, we applythe secret key rate formula derived in the recent security proof presented inRefs. [79, 124, 78]. It relies on Alice, Bob, and Eve sharing signal states of theform given by Eq. 6.19. Once the legitimate users have measured their partof ρABE = trR(|Φ〉ABER〈Φ|), they only have access to their classical outcomeswhich are stored in registers X and Y respectively. On the contrary, Eve stillhas at her disposal a quantum state. This scenario is described by the so-calledccq state ρXYE = M(ρABE) that results from the map

ρABE 7→ ρXYE = M(ρABE) =∑

i,j

pij |i, j〉XY〈i, j| ⊗ ρijE , (6.23)

where the probabilities pij and the conditional states ρi,jE are defined like in

Eq. 6.20 by setting σABE = ρABE. According to Refs. [78], the secret key rate,that we shall denote as R, satisfies

R ≥ infρABE∈S

∞∑

n,m=0

gnmS(X |E, n,m) − gH(X |Y ). (6.24)

The infimum runs over all possible tripartite states ρABE that belong to theclass S defined in Prop. 6.3.1. Here H(X |Y ) stands for the conditional Shan-non entropy of Alice’s random variable X conditioned on Bob’s random vari-able Y . This part accounts for the error correction step of the protocol and it

6.3. ENTANGLEMENT BASED QKD SCHEMES 77

is independent of the chosen tripartite state ρABE ∈ S. In order to computethe conditional von Neumann entropies S(X |E, n,m) describing Eve’s infor-mation about Alice’s raw key, we first calculate the ccq states for the def-inite photon number states |φnm〉ABE as they appear in the decompositionρABE =

∑

n,m pnm|φnm〉ABE〈φnm| ∈ S. Let us denote these conditional ccqstates as ρnm

XYE = M(|φnm〉ABE〈φnm|). From the definition of the conditionalentropy we obtain S(X |E, n,m) = S(ρnm

XE ) − S(ρnmE ), where S(ρ) denotes the

von Neumann entropy of a generic quantum state ρ. The remaining parametersthat appear in Eq. 6.24 are the overall gain g and the individual gains gnm, i.e.,the probability that Alice and Bob obtain an overall conclusive result when nand m photons are arriving on each side respectively. These parameters can bewritten as

gnm = pnmYnm, (6.25)

g =∑

n,m

gnm, (6.26)

with the conditional yields Ynm defined as the probability that both partiesobtain a conclusive outcome conditioned on the fact that they received thestate trE(|φnm〉ABE〈φnm|).

The detector decoy idea now does not imply any change in the underlyingsecurity proof. In fact, one could even improve the lower bound on the secretkey rate given by Eq. 6.24 via local randomization steps [79, 124, 121, 140]or via several rounds of classical bidirectional communication [78]. The mainadvantage of the detector decoy method is that it allows Alice and Bob toacquire more information about the class S over which they have to performthe optimization. As explained in the next subsection, one can in principleobtain the full statistics provided by photon number resolving detectors. Thisfact allows the legitimate users to gain more knowledge about Eve’s informationon the raw key. Thus a smaller amount of privacy amplification is needed, andconsequently one obtains more secret key. Note, however, that when Alice andBob really use photon number resolving detectors they also have a single shotresolution such that they can condition their raw key already on the, e.g., singlephoton case.

One can further simplify the lower bound on the secret key rate such thatonly a few parameters need to be estimated, cf. Ref. [78]. The conditional en-tropies (of a classical variable) satisfy S(X |E, n,m) ≥ 0 for all photon numbersn and m. This means that the secret key rate R can always be lower boundedby restricting the sum in Eq. 6.24 to any of its terms. For instance, one canselect the single photon and the vacuum contributions only, and obtains

R ≥ infρABE∈S

∞∑

m=0

g0mS(X |n = 0,m) + g11S(X |E, n = 1,m = 1)

−gH(X |Y ). (6.27)

Note that so far we have not considered any explicit QKD scheme yet. In thefollowing we restrict ourselves to the BB84 and the six-state protocol so that wecan express the entropies by quantities that are directly observable. Moreover,and for simplicity, let us assume that the sifted key is only composed by thoseevents for which Alice and Bob have used their normal detection device, i.e.,


all possible decoy outcomes are considered as inconclusive results and they areonly used to estimate the class S. Similarly, all the no click outcomes andall detection events where Alice and Bob employed different basis choices arediscarded as well. In the case of double clicks two options are possible: Eitherthey are discarded as well, or one assigns at random one of the two conclusiveoutcomes “0” or “1” [93]. As a result, Alice and Bob are left with binaryvalues whenever they consider an outcome pair as conclusive. As shown inRef. [79, 124], both parties can randomly flip their bit values together, whichresults in an overall symmetric error rate Q that gives H(X |Y ) = h2(Q), whereh2 denotes the binary entropy. For the first term in Eq. 6.27 note that anyconclusive result on Alice’s side that originates from a vacuum input containsno information for the eavesdropper [84]. If we assume that these events areunbiased we obtain S(X |E, n = 0,m) = 1 for all m. This means that Alice andBob do not need to perform any privacy amplification on all these outcomes, butnote as well that these outcomes do not provide any real key information becauseof the error correction part in the formula. The total vacuum gain is given byg0 =

∑

m g0m. Finally, the conditional von Neumann entropy from the singlephoton contribution can always be lower bounded by the completely symmetriccase, which gives S(X |E, n = 1,m = 1) ≥ f(Q11), where f denotes a functionthat depends on the chosen protocol, and Q11 represents the conditional singlephoton QBER that one observes with perfect detectors. For the two consideredprotocols this function f takes the form2

f(x) =

{1 − h2(x) BB84,1 + h2(x) − h2(3x

2 ) − 3x2 log2(3) 6-state.

(6.28)

For all states of the class S we denote by gmin11 and gmin

0 respective lower boundson the single photon and vacuum gain and by Qmax

11 an upper bound to themaximal attainable value of the single photon QBER. With this notation thesecret key rate satisfies

R ≥ gmin0 + gmin

11 f(Qmax11 ) − gh2(Q), (6.29)

with the distinction between the BB84 and the 6-state protocol being only in thefunction f given by Eq. 6.28. Note that the gains g11, g0 and g depend on thechoice of which outcomes are considered as conclusive. This decision includesas well the overall sifting effect q, that denotes the probability that both partiesuse their normal detection device and that they measure in the same basis.However using an asymmetric basis choice in combination with a very rarelyswitching to the decoy measurement, this overall sifting factor q can be madearbitrary close to unity [85] and thus we drop it in the evaluation section.

2Let us mention two important points here. Since both functions are decreasing withrespect to the error rate one could alternatively use the actual (higher) single photon QBERas an argument of the lower bound functions f . This situation corresponds to the case in whichone assumes the uncalibrated device scenario for the evaluation of the privacy amplificationpart. However, if one takes into account any imperfections from the actual detection device,then one could even enhance the actual lower bound function f . For example, if one has adark count model that randomly flips the bit value on Alice side (dark counts produce doubleclicks which are randomly assigned afterwards) this actually reduces Eve’s information on theraw key originating from single photons and hence the privacy amplification part [79, 124].Nevertheless we shall ignore this effect in our discussion.

6.4. DETECTOR DECOY ESTIMATION 79

6.4 Detector decoy estimation

In this section we apply the detector decoy idea to the active polarization mea-surement scheme as it is used in the usual BB84 or 6-state protocol, and weshow how Alice and Bob can estimate the essential quantities to evaluate thelower bound given by Eq. 6.29, that are: the vacuum gain g0, the single photongain g11 and the conditional quantum bit error rate Q11 for perfect detectors.

This discussion starts with the typical model of an imperfect threshold detec-tor which shows some noise in the form of dark counts as given by Eq. 6.17 withη = 1. Furthermore we require that both threshold detectors on each side haveequal (and constant) detection inefficiency; otherwise this opens the possibilityfor powerful new eavesdropping attacks [98, 118] and other techniques have tobe applied [34, 95]. Under this assumption it is a common technique to includethe inefficiency of the detectors into the action of the quantum channel, andone performs the analysis with a threshold detector model of perfect efficiency.If one can prove security without knowing the exact detector efficiency, thenone automatically also shows security with this particular extra knowledge. Forconvenience we further assume that both threshold detectors on each side haveequal dark count probabilities. The POVM elements for the active measurementchoice β are given by [93]

F0 = (1 − ε)

∞∑

n=1

|n, 0〉β〈n, 0| + ε(1 − ε)|0, 0〉〈0, 0|, (6.30)

F1 = (1 − ε)

∞∑

n=1

|0, n〉β〈0, n| + ε(1 − ε)|0, 0〉〈0, 0|, (6.31)

together with Fvac = (1 − ε)2|0, 0〉〈0, 0| for the no click outcome and FD =1−Fvac −F0 −F1 for the double click case. Here |n, 0〉β and |0, n〉β refer to thecorresponding two-mode Fock state in the chosen polarization basis β. Althoughwe restrict ourselves to this particular model, the analysis that follows can alsobe straightforwardly adapted for the calibrated device scenario.

6.4.1 Simple detector decoy setup

Let us begin by analyzing the single photon gain g11. Consider a simple setupwhere Alice and Bob insert only a single beam splitter in front of their mea-surement devices. This beam splitter is of course not assigned to the quantumchannel. This scenario is illustrated in Fig 6.3, where the transmittance of Aliceand Bob’s beam splitter is denoted by ηA and ηB respectively. This setup hasthe advantage that both legitimate users only need to collect the count rates forone variable beam splitter per site, but it still enables Alice and Bob to obtainthe overall photon number distribution pnm of the incoming signals. With thisinformation they can directly compute the individual gain of the single pho-ton contribution g11 for the considered scenarios. For this detection device theoverall no click operator on Alice’s side becomes

FAvac(ηA) = (1 − ε)2

∞∑

n=0

(1 − ηA)nΠAn , (6.32)


Figure 6.3: Schematic diagram of the simple detector decoy setup, where Aliceand Bob place a single beam splitter, with transmittance ηA and ηB respectively,in front of their detection device.

where the projector on the n-photon subspace is given by

ΠAn =

n∑

k=0

|k, n− k〉β〈k, n− k|. (6.33)

Note that this operator is independent of the chosen measurement basis β, andhence we omit this label in the following whenever it is redundant. A similarexpression holds for Bob’s measurement operator FB

vac(ηB). Suppose that bothparties receive now the generic input state ρAB, then they observe a no clickoutcome with probability

pABvac(ηA, ηB) = (1 − ε)4

∞∑

n,m=0

(1 − ηA)n(1 − ηB)mpnm, (6.34)

where the photon number distribution is given by pnm = trAB(ΠAn ⊗ ΠB

mρAB).Now, if Alice and Bob vary the transmittance of their inserted beam splitters,they can generate a whole set of linear equations similar to those given byEq. 6.34, in which the photon number distribution pnm appears as the open pa-rameter. With this set of equations the whole distribution becomes accessibleto Alice and Bob, however if they are only interested in the single photon prob-ability p11 then the three different settings of Prop. 6.2.1 are already enough.Next, let us compute the single photon gain g11 for the two different scenariosdepending on double click choice. Whenever Alice and Bob randomly assign bitvalues to their double click outcomes any single photon state will necessarilyproduce a conclusive outcome. In the other case only single clicks contribute tothe raw key, hence the individual gain is slightly lower than in the first situationsince a single photon can trigger a double click event because of dark counts.The two different individual gains are given, respectively, by

g11,d = p11, (6.35)

g11,s = (1 − ε)2p11, (6.36)

where the subscripts “d” (with double clicks) and “s” (single clicks only) labelthe two different cases. Let us mention that the idea to obtain the impingingphoton number statistics with only one variable beam splitter can be appliedto any other photon number preserving linear network, since the probabilityto obtain an overall no click outcome in all threshold detectors after such anetwork can always be calculated by replacing the whole network by only onesuch threshold detector.

6.4. DETECTOR DECOY ESTIMATION 81

The vacuum gain g0 represents a direct observable quantity even without thedetector decoy method. It relies on the fact that one can obtain the statistics of aperfect threshold detector from the observed data of a detector with dark counts[107]. Suppose that Bob considers a specific measurement outcome k which hecan perfectly distinguish with his measurement device, and the correspondingPOVM element is denoted by FB

k . Then, the probability that Alice registers noclick at all while Bob sees this specific outcome k is given by

pABvac,k = (1 − ε)2 trAB

(|0, 0〉A〈0, 0| ⊗ FB

k ρAB

)= (1 − ε)2p0,k. (6.37)

Since both parties have access to the dark count probability ε they can employEq. 6.37 to compute the probability p0,k for the perfect threshold detector case.Via this value one can directly compute the vacuum gain for the two differentscenarios given by

g0,d = [1 − (1 − ε)2]p0,d, (6.38)

g0,s = 2ε(1 − ε)p0,s. (6.39)

6.4.2 Refined detector decoy setup

A drawback of the simple detector decoy setup of the preceding section is thatthe resolved single photon QBER Q11 is inaccessible.. Therefore we can considera refined setup in which a variable beam splitter is placed in front of eachthreshold detector. This scenario is depicted in Fig. 6.4. Now Alice and Bobcan adjust the transmittance of their two beam splitters ~ηA = (ηA,1, ηA,2) and~ηB = (ηB,1, ηB,2) respectively. Although from a practical point of view, thisscenario is less attractive than the previous one—it requires more statisticalanalysis—it is interesting on a conceptual level since it can provide Alice andBob with the same statistics provided by photon number resolving detectors.Obviously all the results from the simple setup apply if one selects ηA,1 = ηA,2 =ηA and similar for Bob’s side. Now the POVM element for the overall no click

Figure 6.4: Schematic diagram of the refined detector decoy setup, where Aliceand Bob place a variable beam splitter in front of every threshold detector.

outcome on Alice’s side is given by

FAvac,βA

(~ηA) = (1 − ε)2∞∑

k,l=0

ηkA,1η

mA,2|k, l〉βA

〈k, l|, (6.40)

where we use the abbreviation η = 1 − η. A similar expression holds forFB

vac,βB(~ηB). In contrast to the first measurement device analyzed, the over-

all no click outcome now depends on the chosen polarization basis on each side


~β = (βA, βB). The probability of the combined no click outcome becomes

pABvac,~β

(~ηA, ~ηB) = (1 − ε)4∞∑

k,l,r,s=0

ηkA,1η

lA,2η

rB,1η

sB,2 q~β(k, l; r, s), (6.41)

where the probabilities q~β(k, l; r, s) have the form

q~β(k, l; r, s) = trAB

(

|k, l〉βA〈k, l| ⊗ |r, s〉βB

〈r, s| ρAB

)

. (6.42)

These probabilities coincide with the ones provided by photon number resolvingdetectors. Using again the idea of different settings for the transmittance ofthe adjustable beam splitters one can generate more linear equations of theform given by Eq. 6.41. Consequently, the photon number resolved statisticq~β(k, l; r, s) becomes accessible to Alice and Bob. With this resolved distributionat hand it is straightforward to compute the single photon QBER Q~β,11 thatAlice and Bob would observe using perfect detectors. It is determined by

p11Q~β,11 = q~β(1, 0; 0, 1) + q~β(0, 1; 1, 0). (6.43)

Note that one has to use the symmetrized single photon QBER in the lowerbound formula given by Eq. 6.29.

6.5 Evaluation

In this part we evaluate the lower bound on the secret key rate for the dif-ferent decoy detection schemes presented in the last section. Additionally, wecompare it with a security proof that relies on validity of the squash model,cf. Chap. 4; for a different comparison between the squash model and an alter-native estimation procedure not based on this last paradigm see also Ref. [70].We assume that all relevant parameters that appear in the lower bound formulacan be estimated precisely, i.e., we ignore any effects of a finite decoy settingestimation.

6.5.1 Data simulation

In this part we describe the precise model to simulate the observed data forthe QKD experiment. We assume that these data originate from a pumpedtype-II down-conversion source. The states emitted by this type of source canbe written as [73]

|Ψsource〉AB =

∞∑

n=0

√pn|Φn〉AB, (6.44)

where the probability distribution pn is given by

pn =(n+ 1)λn

(1 + λ)n+2. (6.45)

The parameter λ is related with the pump amplitude of the laser and determinesthe mean photon pair number per pulse as µ = 2λ. Each signal state |Φn〉AB

6.5. EVALUATION 83

contains exactly 2n photons; n of them travel to Alice and the other n to Bob.These states are of the form

|Φn〉AB =

n∑

m=0

(−1)m

√n+ 1

|n−m,m〉A|m,n−m〉B, (6.46)

where we have used the standard basis on each side, i.e., βA = βB = z. Whenn = 1, the signal state in Eq. 6.46 becomes the EPR state, which admits perfectanticorrelations in all directions3. When n ≥ 2, the states |Φn〉AB represent so-called W -states. That is, even if Alice and Bob measure them along the samedirection they might observe double clicks. In fact, the biggest contribution inthe observed QBER stems from multiphoton pairs. For instance, if the signal|Φn=2〉 loses only one photon in the channel, then the error rate of the resultingstate (although still entangled) is already about4 16.6%. This QBER is abovethe threshold error rate allowed by the one-way security proof employed inthe previous section, even assuming a single qubit realization. This means, inparticular, that the expected average mean photon number λopt which optimizesthe secret key rate in the long distance limit is quite low, and one does notexpect a security proof which enables to drive the source with a much highermean photon number.

To generate the observed data of an experiment that uses this kind of sourcewe employ the following procedure: Since the loss is the predominant factorin the error rate and in the overall gain, we assume that the state emitted bythe source passes first through a lossy, but otherwise error-free channel. Sucha channel is characterized by the loss coefficient α and the total distance l. Inthis channel we include as well the effect of the detector efficiency ηdet of themeasurement device. Hence, the overall transmission in the optical line towardsAlice becomes

ηA = ηdet10−αl10 = 10−

dbA10 , (6.47)

and determines the overall loss coefficient dbA. A similar relation holds also forthe channel towards Bob. The total loss between both parties is characterizedby dbtot = dbA + dbB. After the lossy channel, we include the effect of themisalignment and the dark counts of the detectors in the observed data. Mis-alignment slightly varies the polarization of the incoming light field. This effectchanges over time and is assumed to be uncontrollable. Averaging it results inan action similar to that of a depolarizing channel. Specifically, we consider thefollowing misalignment model: Every time a single photon arrives at the detec-tion device it triggers the correct detector with probability (1 − e), while withprobability e it hits the wrong detector. When more photons enter the detectionapparatus this effect is assumed to occur independently for each single photonso that it can also change the probability to observe a double click. Dark countsare already included in the measurement description of the detection device, cf.Sec. 6.4. Note that dark counts are typically the crucial parameter that limitthe distance of a QKD scheme.

3If Alice and Bob employ the measurement device from Eqs. 6.30, 6.31, then they wouldalways observe anticorrelated outcomes. Hence one of the parties has to interchange the labelof the observed data “0” ↔ “1”.

4However, note that there are different, more complicated measurement techniques thatcan be more robust against particle loss from a PDC source [11].


6.5.2 Resulting key rates

In the following we compare the different lower bounds on the secret key rate forthe various different scenarios. Let us remind the reader of all possible options:We have a distinction between the BB84 and the 6-state protocol, the freedomto either use the simple or the refined detector decoy setup, and the doubleclick choice, i.e., so whether the raw key is comprised only by the single clickoutcomes or whether it contains as well the randomly assigned double clicks.This last option is again distinguished by the label “s” and “d”.

As mentioned in Sec. 6.4 with the simple detector decoy setup the resolvedsingle photon QBER is not directly accessible. Thus in order to evaluate thecorresponding lower bound we need an upper bound to this quantity. This caneasily be achieved via a worst case assumption in which one assumes that allerrors originate from single photon states only. In the single click case this upperbound, denoted as Q11,s, is given by5

Q11,s =1

g11,s

(

Qsgs − g01

2

)

≥ Q11, (6.48)

and a similar bound Q11,d for the double click case. Note that with the refineddetector decoy setup, which has two variable beam splitters at each side, theconditional QBER Q11 is equal to one arising from perfect detectors, indepen-dently of the chosen scenario. The different lower bounds are summarized inTab. 6.1. This table also includes the case where both parties employ perfect

Scenario Lower bound

Updated Squash g0 + g11[1 − h2(Q11)] − gdh2(Qd)

Double g0,d + g11,df(Q11) − gdh2(Qd)

Double + Bound g0,d + g11,df(Q11,d) − gdh2(Qd)

Single g0,s + g11,sf(Q11) − gsh2(Qs)

Single + Bound g0,s + g11,sf(Q11,s) − gsh2(Qs)

Perfect PNR p11[f(Q11) − h2(Q11)]

Table 6.1: Different lower bounds on the secret key rate for the various differentscenarios. Via the function f , given by Eq. 6.28, one distinguishes between theBB84 and the 6-state protocol. See text for further details.

photon number resolving (“Perfect PNR”) detectors. These detectors allow Al-ice and Bob to condition the error correction on the observed photon number.In this way, the term H(X |Y ), that appears in Eq. 6.24, can be changed to theconditional term

∑gnmH(X |Y, n,m). The lower bound contained in Tab. 6.1

corresponds to the case where single click events are the only conclusive out-comes. A fair comparison with a security proof based on the squash model is

5In this estimation one could even try to subtract the dark count probability of the detec-tors. However we shall ignore this effect here.

6.5. EVALUATION 85

only possible if one employs the result from Chap. 4 and further extends the va-lidity of the squash model to the situation where the detectors have dark counts;otherwise one loses the vacuum gain. The exact target measurements, followingthe terminology of Chap. 4, are given by Eqs. 6.30, 6.31 with n = 1 and whereevery double click is randomly assigned to one of the bit values. As a result,we obtain the lower bound formula given in Tab. 6.1 (“Updated Squash”) inwhich g0 and g11 denote, respectively, the squashed vacuum gain and the corre-sponding single photon gain, while Q11 stands for the conditional QBER of thesquashed single photons. Let us point out that since the squash model does notexist for the active 6-state protocol, one cannot choose the protocol dependentfunction f , so we only use the one from the BB84 protocol in this case6.

For the simulation we consider an asymmetric distance scenario, since thissituation optimizes the gain of the detector decoy idea over a security proof thatrelies on the squash model. In particular, we assume that Bob is much closerto the source than Alice. Such a situation might appear in a QKD network,where certain users can be further away from the relay stations than others.The results for the BB84 and the 6-state protocol are shown, respectively, inFig. 6.5 and in Fig. 6.6. The first case corresponds to the situation where Aliceand Bob place a single beam splitter in front of their detection device, while thesecond case represents the scenario where the legitimate users place a variablebeam splitter in front of every threshold detector. The position of the source isdenoted by a black square and is kept constant at a dbB = 3 loss distance, sowe only increase the distance towards Alice. For each lower bound we performan optimization over the free parameter λ that corresponds to the mean photonpair number of the source.

It is worth mentioning that the squash model delivers a higher lower boundon the secret key rate for the BB84 protocol than that corresponding to thedetector decoy method in the double click case. This seems surprising at firstsince the detector decoy idea provides the exact knowledge of all important sin-gle photon parameters. Note, however, that in the discussion which led to thelower bound formula given by Eq. 6.27 we restricted ourselves to only draw asecret key from the single photon contribution. In contrast, the squash modeldoes not necessarily constrain the parties to obtain a secret key from the realsingle photons only, but instead tries to create a secret key even from the multi-photon events. In this sense, one can consider the squash model as a “calculationmethod” that allows to upper bound the amount of privacy amplification nec-essary for the multiphoton events by an equal amount of privacy amplification“calculated” on a hypothetical single photon state, cf. Sec. 4.2.2. Hence usingthe squash model directly lower bounds the key rate from Eq. 6.24.

The detector decoy idea provides a slightly higher secret key rate than thesquash model when Alice and Bob discard their double click events. Note thatthis action is not possible with the squash model assumption. For the consideredasymmetric distance scenario, this fact allows the two parties to drive the sourcewith a higher mean photon number, since the double clicks that occur morefrequently on the side closer to the source can be discarded from the error rate;see the inset plots of the optimized mean photon number in Figs. 6.5, 6.6. In the

6All formulae in Tab. 6.1 are for active basis choice measurements. In particular, for apassive basis choice selection the results of the squash model change. One could at leastdiscard double or multiclick events between different basis outcomes, and moreover a squashmodel exists for the passive 6-state protocol, cf. Sec. 4.5.


-9

-8

-7

-6

-5

-4

-3

-2

0 10 20 30 40 50 60

Log 1

0(R

ate)

Total dB loss

BB84 protocol SquashDouble + BoundSingle + Bound

PNR

0

0.03

0.06

0.09

0.12

0 10 20 30 40 50

Opt

imal

λ

-9

-8

-7

-6

-5

-4

-3

-2

0 10 20 30 40 50 60

Log 1

0(R

ate)

Total dB loss

6-state protocol SquashDouble + BoundSingle + Bound

PNR

0

0.03

0.06

0.09

0.12

0 10 20 30 40 50

Opt

imal

λ

Figure 6.5: Different lower bounds on the secret key rate for the simple detectordecoy setup shown in Fig. 6.3 with ε = 10−6 and e = 0.03. The inset figureshows the value for the optimized parameter λ of the source.

squash model one has to keep the double click rate low on both sides, becausethe penalty in the error rate for each double clicks is 50%. Therefore, one has tokeep a lower mean photon number. This effect decreases with the distance, andin the long distance limit this advantage vanishes. Moreover, let us note that

6.5. EVALUATION 87

-9

-8

-7

-6

-5

-4

-3

-2

0 10 20 30 40 50 60

Log 1

0(R

ate)

Total dB loss

BB84 protocol SquashDoubleSingle

PNR

0

0.03

0.06

0.09

0.12

0 10 20 30 40 50

Opt

imal

λ

-9

-8

-7

-6

-5

-4

-3

-2

0 10 20 30 40 50 60

Log 1

0(R

ate)

Total dB loss

6-state protocol SquashDoubleSingle

PNR

0

0.03

0.06

0.09

0.12

0 10 20 30 40 50

Opt

imal

λ

Figure 6.6: Different lower bounds on the secret key rate for the refined detectordecoy setup shown in Fig. 6.4 with ε = 10−6 and e = 0.03. The inset figureshows the value for the optimized parameter λ of the source.

by adding the vacuum gain in the lower bound formula the resulting maximalachievable distance is shifted by around ∆db = 10.

Via this simulation we have shown that the detector decoy idea provides asimple method to adapt a single photon security proof to its full optical imple-


mentation, while still providing similar key rates as those arising from a securityproof using the squash model assumption. Its main advantage relies on the factthat it can straightforwardly be applied also to QKD protocols, like the active6-state protocol, where the squash model, the other “adaption technique”, doesnot work.

6.6 Conclusion

In this chapter we have analyzed a simple technique which allows the directapplication of a single photon security proof for quantum key distribution to itsphysical, full optical implementation. This so-called detector decoy method isconceptually different to that of the squash model, the other adaptation mecha-nism. It is based on an estimation procedure for the photon number distributionof the incoming light field that uses only a simple threshold detector in com-bination with a variable attenuator. The detector decoy method is similar inspirit to that of the usual decoy state technique: Since the eavesdropper doesnot know the particular detection efficiency setting used to measure the signals,any eavesdropping attempt must leave the expected photon number distribu-tion unchanged (similar to the conditional channel losses in the decoy statetechnique).

Specifically, we have investigated an entanglement based QKD scheme withan untrusted source where Alice and Bob actively choose the measurement basisof either the BB84 or the 6-state protocol. The security of both schemes isproven solely by means of the detector decoy method and without the need of asquash model, which would have to be proven to be correct for each measurementdevice anew. Besides, and opposite to the squash model paradigm, the detectordecoy technique allows the legitimate users to discard double click events fromthe raw key data. As a result, it turns out that the secret key rates in theinfinite (or sufficiently large) key rate limit of a BB84 simulated experiment arecomparable with each other for both alternatives. However, the detector decoyidea offers a better performance in those scenarios where there exists no squashmodel, like in the 6-state protocol. Nevertheless it is worth mentioning thatin any real-life QKD experiment much more obstacles have to be taken care ofand thus the situation can change, mainly because of the finite numbers of totalsignals sent. However, for the current increasing interest in examining this so-called finite size effects of different protocols, it can only be of advantage to havea broader spectrum of different proof techniques available, even if they all showa similar behavior in the asymptotic key rate limit. We believe that there mightbe many other potential applications of this method in QKD, simply becauseestimating the (single) photon contribution is most often a crucial task in thisfield, e.g., Ref. [34, 145].

To conclude, let us mention that there might be scenarios where it is notreally necessary to insert and vary the transmittance of an additional beamsplitter in the measurement device. For instance, let us consider the efficient,passive BB84 measurement setup, in which a beam splitter of high transmittanceη = 1 − ∆ splits the incoming light in favor of one basis versus the other.With this measurement apparatus, one can directly obtain three different beamsplitter settings to apply the detector decoy formalism: Using the overall no clickoutcome of all detectors gives η0 = 1, whereas if one ignores all the outcomes

6.6. CONCLUSION 89

of only one basis and looks at the no click outcome in the other basis, thenone obtains two more settings, η1 = 1 − ∆ and η2 = ∆. Although these threesettings are different from the ones given in Prop. 6.2.1 they can still providegood estimations of the single photon contribution. Moreover, the method couldbe improved even further. After all, in showing security we have not used allavailable information from our measurement results, as the further occurrencesof double or multiclicks in our detection devices has been ignored. The use ofthis extra knowledge can only enhance the estimation procedure and thus canfurther reduce the number of necessary detector decoy settings. In fact, it ispossible to provide a BB84 security proof by just using an estimation technique[70]. It might be interesting to compare the detector decoy idea with the resultspresented in Ref. [70], however we leave this question open for further analysis.

Chapter 7

Final remarks

A central point of this thesis addressed the question how to make already exist-ing ideas of powerful new applications more practical for an actual experiment,which is one of the major research topics nowadays. We tried to approach thispoint quite general and showed different techniques how to adopt the corre-sponding analysis of the idealized setting to the more realistic model of theexperiment. In particular we focussed on the question whether the currentanalysis even holds for a more realistic quantum mechanical characterization ofthe employed devices. Clearly for such a particular, more refined descriptionthe considered ideas and tools should prove themselves useful in answering thisquestion, at least in an affirmative way. Yet one big problem remains. As it isclear that one can never obtain the exact quantum mechanical description of theexperiment, this gives rise to the question: Which characterization is accurateenough for the purpose at hand?

As one might expect, this point is of particular importance for the secu-rity evaluation of a realistic QKD experiment. Typically each security proofassumes an underlying description of the employed devices, and if this char-acterization is different from the real one present in the experiment then thecorresponding security proof does not hold. The history of QKD has producedseveral nice examples along this line. At first nobody ever thought that theuse of weak coherent laser pulses instead of single photons would really causeany big problems; however now we know better since this difference opened thepossibility for the photon number splitting attack and consequently one hadto update the security analysis. Recently, different kind of attacks have beenproposed which all exploit a similar difference between the real experimentalsituation and the considered model of the respective security proof used at thattime: Via the faked pulse [98] and the time shift attack [118] one exploits theefficiency mismatch between the two different detectors usually employed in themeasurement setup on the receiver side. On the source side it has been noted,as discussed in Ref. [50], that a parametric down-conversion source, employedas a heralded single photon source, violates one of the basis assumptions ofthe decoy state method; if one pumps the crystal via different intensities thecorresponding signal and decoy states can be further discriminated by a slightdifference in the frequency distribution. Other points, e.g., whether the sourcereally emits phase randomized states, bear an additional risk, since real co-herent states would cause a dramatic drop in the secret key rate [88]. By all

91

92 CHAPTER 7. FINAL REMARKS

these examples we would like to stress the importance of the above mentionedquestion.

Obviously this question is hard to answer, as any quantum mechanical de-scription, independent how accurate, will always stay a model for a realisticdevice and hence some effects of the real setup are always neglected. Never-theless certain parts of this characterization are more crucial than others; forexample the phase randomization step seems to be more important than theexact Poisson statistic of the photon number distribution. Hence a good start-ing point for the above question would be to determine which parts of thedescription are more and which parts are less relevant for the security issue.For this task one can exploit the formalism developed in this thesis because itoffers a clear way to identify description changes which leave the correspond-ing security statement unchanged. As a different approach one can also tryto put the whole security statement on less restrictive assumptions, i.e., is italso possible to prove security if one knows that the employed description iswithin some ε-distance to the real one, or whether it it is enough to just knowa few global properties of the device. Clearly there is also the possibility toemploy no quantum-mechanical characterization at all, cf. Ref. [2], however inthis approach it is still not clear whether security can hold at all in full gen-erality and such proofs cannot confirm, even for restrictive attacks, a positivekey rate for realistic QKD experiments so far. Nevertheless one can benefitfrom this approach, in particular since it provides a way to get rid of certainparts in the quantum mechanical description which are hard to control other-wise. With respect to this general question for the QKD purpose it might beworthwhile to investigate the corresponding entanglement verification part first,since a positive entanglement statement represents a necessary prerequisite fora successful secret key distillation. From Bell’s inequalities one knows alreadythat it is at least possible to verify entanglement with no quantum descriptionat all. However it is even possible to formulate stronger conditions if one haspartial knowledge. For example Ref. [135] deals with an inequality in whichit is enough to know that one measures a qubit system at each side but notthe exact quantum mechanical description of the measurement device. Similarresults have also been obtained without restriction to a specific dimension or toa corresponding bound on the observable outcomes [137].

At last we would like to stress a different direction for approaching the sep-arability problem. As it occurred quite natural, there are many different neces-sary criteria for separability of the underlying state, and clearly any violationof such a condition signals the presence of entanglement. However if one findsno violation of this condition then one has no statement at all and consequentlyone needs to check the next criterion. In the case of a separable state this searchcontinues, but one never obtains a decisive answer. Hence it would be of greatadvantage if one also has some sufficient criteria for separability; cf. Ref. [141]for a numerical method along this direction. This would not only be interestingfrom the mere theoretical point, but also for applications like how to find upperbounds on certain QKD protocols and other specific applications. Neverthelessthis part seems to be much harder than verifying entanglement.

Bibliography

[1] D. Achilles, C. Silberhorn, C. Sliwa, K. Banaszek, I. A. Walmsley, M. J.Fitch, B. C. Jacobs, T. B. Pittman, and J. D. Franson. Photon numberresolving detection using time-multiplexing. Opt. Lett., 28:2387, 2003.

[2] A. Acın, N. Gisin, and L. Masanes. From Bell’s theorem to secure quantumkey distribution. Phys. Rev. Lett., 97:120405, 2006.

[3] R. Augusiak, M. Demianowicz, and P. Horodecki. Universal observabledetecting all two-qubit entanglement and determinant based separabilitytests. Phys. Rev. A, 77:030301(R), 2008.

[4] M. S. Bazaraa, J. J. Jarvis, and H. D. Sherali. Linear Programming andNetwork Flows. John Wiley & Sons, New York, Chichester, 3rd edition,2004.

[5] N. J. Beaudry, T. Moroder, and N. Lutkenhaus. How I stopped worryingabout multiphoton pulses... (working title). in preparation.

[6] J. S. Bell. On the Einstein-Podolsky-Rosen paradox. Physics, 1:195, 1964.

[7] C. H. Bennett and G. Brassard. Quantum cryptography: Public keydistribution and coin tossing. In Proc. IEEE Int. Conf. on Computers,Systems, and Signal Processing, Bangalore, India, page 175, New York,1984.

[8] R. Blume-Kohout. Optimal, reliable estimation of quantum states.arXiv.org/quant-ph/0611080.

[9] M. Bourennane, M. Eibl, C. Kurtsiefer, S. Gaertner, H. Weinfurter,O. Guhne, P. Hyllus, D. Bruß, M. Lewenstein, and A. Sanpera. Exper-imental detection of multipartite entanglement using witness operators.Phys. Rev. Lett., 92:087902, 2004.

[10] G. Brassard, N. Lutkenhaus, T. Mor, and B. Sanders. Limitations onpractical quantum cryptograpy. Phys. Rev. Lett., 85:1330, 2000.

[11] G. Brassard, T. Mor, and B. C. Sanders. Quantum cryptography viaparametric downconversion. arXiv.org/quant-ph/9906074.

[12] G. Brida, M. Genovese, G. Gramegna, A. Meda, S. Olivares, M. G. A.Paris, F. Piacentini, E. Predazzi, and P. Traina. A review on recentresults on on/off reconstruction of optical states. arXiv:0810.5472.

93

94 BIBLIOGRAPHY

[13] D. Bruß. Characterizing entanglement. J. Math. Phys., 43:4237, 2002.

[14] M. S. Byrd and N. Khaneja. Characterization of the positivity of thedensity matrix in terms of the coherence vector representation. Phys.Rev. A, 68:062322, 2003.

[15] B. Cabrera, R. M. Clarke, P. Colling, A. J. Miller, S. Nam, and R. W.Romani. Detection of single infrared, optical, and ultraviolet photonsusing superconducting transition edge sensors. Appl. Phys. Lett., 73:735,1998.

[16] H. A. Carteret. Noiseless quantum circuits for the Peres separability cri-terion. Phys. Rev. Lett., 94:040502, 2005.

[17] H. F. Chau. Practical scheme to share a secret key through a quantumchannel with a 27.6% bit error rate. Phys. Rev. A, 66:060302(R), 2002.

[18] K. Chen and L.-A. Wu. A matrix realignment method for recognizingentanglement. Quantum Inf. Comput., 3:193, 2003.

[19] M. D. Choi. Completely positive linear maps on complex matrices. LinearAlg. Appl., 10:285, 1975.

[20] M. D. Choi. Positive linear maps. Proc. Symp. Pure Math., 38:583, 1982.

[21] M. Christandl, R. Koenig, G. Mitchison, and R. Renner. One-and-a-halfquantum de Finetti theorems. Comm. Math. Phys., 273:473, 2007.

[22] M. Curty, M. Lewenstein, and N. Lutkenhaus. Entanglement as precon-dition for secure quantum key distribution. Phys. Rev. Lett., 92:217903,2004.

[23] M. Curty and T. Moroder. On single-photon quantum key distribution inthe presence of loss. Phys. Rev. A, 75:052336, 2007.

[24] J. de Pillis. Linear transformations which preserve hermitian and positivesemidefinite operators. Pacific J. Math., 23:129, 1967.

[25] I. Devetak and A. Winter. Distillation of secret key entanglement fromquantum states. Proc. of the Roy. Soc. of London Series A, 461:207, 2005.

[26] A. C. Doherty, P. A. Parrilo, and F. M. Spedalieri. Distinguishing sepa-rable and entangled states. Phys. Rev. Lett., 88:187904, 2002.

[27] A. C. Doherty, P. A. Parrilo, and F. M. Spedalieri. Complete family ofseparability criteria. Phys. Rev. A, 69:022308, 2004.

[28] M. Dusek, N. Lutkenhaus, and M. Hendrych. Quantum cryptography. InE. Wolf, editor, Progress in Optics, volume 39, page 381. Elsevier, 2006.

[29] J. F. Dynes, Z. L. Yuan, A. W. Sharpe, and A. J. Shields. Practicalquantum key distribution over 60 hours at an optical fiber distance of20km using weak and vacuum decoy pulses for enhanced security. OpticsExpress, 15:8465, 2007.

BIBLIOGRAPHY 95

[30] J. Eisert, P. Hyllus, O. Guhne, and M. Curty. Complete hierarchies ofefficient approximations to problems in entanglement theory. Phys. Rev.A, 70:062317, 2004.

[31] C. Erven, C. Couteau, R. Laflamme, and G. Weihs. Entangled quantumkey distribution over two free-space optical links. arXiv:0807.2289.

[32] A. S. Fletcher, P. W. Shor, and M. Z. Win. Optimum quantum errorrecovery using semidefinite programming. Phys. Rev. A, 75:021338, 2007.

[33] G. Folland. A course in abstract harmonic analysis. CRC-Press, 1995.

[34] C. H. F. Fung, K. Tamaki, B. Qi, H. K. Lo, and X. Ma. Securityproof of quantum key distribution with detection efficiency mismatch.arXiv:0802.3788.

[35] W. B. Gao, C. Y. Lu, X. C. Yao, P. Xu, O. Guhne, A. Goebel, Y. A. Chen,C. Z. Peng, Z. B. Chen, and J. W. Pan. Experimental demonstration ofa hyper-entangled ten-qubit Schrodinger cat state. arXiv:0809.4277.

[36] M. Genovese, M. Gramegna, G. Brida, M. Bondani, G. Zambra, A. An-dreoni, A. R. Rossi, and M. G. A. Paris. Measuring the photon distributionby ON/OFF photodectors. Laser Physics, 16:385, 2006.

[37] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden. Quantum cryptography.Rev. Mod. Phys., 74:145, 2002.

[38] D. Gottesman and H. K. Lo. Proof of security of quantum key distributionwith two-way classical communications. IEEE Trans. Inf. Theory, 49:457,2003.

[39] D. Gottesman, H. K. Lo, N. Lutkenhaus, and J. Preskill. Security ofquantum key distribution with imperfect devices. Quantum Inf. Comput.,4:325, 2004.

[40] O. Guhne. Characterizing entanglement via uncertainty relations. Phys.Rev. Lett., 92:117903, 2004.

[41] O. Guhne, P. Hyllus, D. Bruß, A. Ekert, M. Lewenstein, C. Macchiavello,and A. Sanpera. Detection of entanglement with few local measurements.Phys. Rev. A, 66:062305, 2002.

[42] O. Guhne, P. Hyllus, O. Gittsovich, and J. Eisert. Covariance matricesand the separability problem. Phys. Rev. Lett., 99:130504, 2007.

[43] O. Guhne and N. Lutkenhaus. Nonlinear entanglement witnesses. Phys.Rev. Lett., 96:170502, 2006.

[44] O. Guhne and N. Lutkenhaus. Nonlinear entanglement witnesses, covari-ance matrices and the geometry of separable states. J. Phys.: Conf. Ser.,67:012004, 2007.

[45] O. Guhne and G. Toth. Entanglement detection. arXiv:0811.2803.

96 BIBLIOGRAPHY

[46] H. Haffner, W. Hansel, C. F. Roos, J. Benhelm, D. Chek-al-kar,M. Chwalla, T. Korber, U. D. Rapol, M. Riebe, P. O. Schmidt, C. Becher,O. Guhne, W. Dur, and R. Blatt. Scalable multi-particle entanglement oftrapped ions. Nature, 438:643, 2005.

[47] H. Haffner, C. F. Roos, and R. Blatt. Quantum computing with trappedions. Phys. Reports, 469:155, 2008.

[48] B. C. Hall. Lie groups, Lie algebras, and representations: An elementaryintroduction. Springer-Verlag New York, 2003.

[49] H. Haseler, T. Moroder, and N. Lutkenhaus. Testing quantum devices:Practical entanglement verification in bipartite optical systems. Phys.Rev. A, 77:032303, 2008.

[50] W. Helwig, W. Mauerer, and C. Silberhorn. Multi-mode states in decoy-based quantum key distribution protocols. arXiv:0901.4695.

[51] H. F. Hofmann and S. Takeuchi. Violation of local uncertainty relationsas a signature of entanglement. Phys. Rev. A, 68:032103, 2003.

[52] A. S. Holveo. Probabilistic and statistical aspects of quantum theory. Am-sterdam: North-Holland Pub. Co., 1982.

[53] R. A. Horn and C. R. Johnson. Matrix analysis. Cambridge UniversityPress, 1985.

[54] M. Horodecki and P. Horodecki. Reduction criterion of separability andlimits for a class of distillation protocols. Phys. Rev. A, 59:4206, 1999.

[55] M. Horodecki, P. Horodecki, and R. Horodecki. Separability of mixedstates: Necessary and sufficient conditions. Phys. Lett. A, 223:1, 1996.

[56] P. Horodecki. From limits of quantum operations to multicopy entangle-ment witnesses and state-spectrum estimation. Phys. Rev. A, 68:052101,2003.

[57] P. Horodecki and A. Ekert. Method for direct detection of quantum en-tanglement. Phys. Rev. Lett., 89:127902, 2002.

[58] P. Horodecki and M. Nowakowski. Simple test for quantum channel ca-pacity. arXiv.org/quant-ph/0503070.

[59] R. Horodecki, M. Horodecki, and P Horodecki. Entanglement processingand statistical inference: The Jaynes principle can produce fake entangle-ment. Phys. Rev. A, 59:1799, 1999.

[60] R. Horodecki, P. Horodecki, M. Horodecki, and K. Horodecki. Quantumentanglement. arXiv.org/quant-ph/0702225.

[61] Z. Hradil. Quantum-state estimation. Phys. Rev. A, 55:R1561, 1997.

[62] B. Huttner, N. Imoto, N. Gisin, and T. Mor. Quantum cryptography withcoherent states. Phys. Rev. A, 51:1863, 1995.

BIBLIOGRAPHY 97

[63] W. Y. Hwang. Quantum key distribution with high loss: Toward globalsecure communication. Phys. Rev. Lett., 91:57901, 2003.

[64] H. Inamori, N. Lutkenhaus, and D. Mayers. Unconditional security ofpractical quantum key distribution. Euro. Phys. J. D, 41:599, 2007.

[65] D. F. V. James, P. G. Kwiat, W. J. Munro, and A. G. White. Measurementof qubits. Phys. Rev. A, 64:052312, 2001.

[66] A. Jamio lkowski. Linear transformations which preserve trace and positivesemidefiniteness of operators. Rep. Mat. Phys., 3:275, 1972.

[67] M. Keyl and R. F. Werner. Estimating the spectrum of a density operator.Phys. Rev. A, 64:052311, 2001.

[68] J. Kim, S. Takeuchi, Y. Yamamoto, and H. H. Hogue. Multiphoton de-tection using visible light photon counter. Appl. Phys. Lett., 74:902, 1999.

[69] M. Koashi. Unconditional security of quantum key distribution and theuncertainty principle. J. Phys.: Conf. Ser., 36:98, 2006.

[70] M. Koashi, Y. Adachi, T. Yamamoto, and N. Imoto. Security ofentanglement-based quantum key distribution with practical detectors.arXiv:0804.0891.

[71] M. Koashi and J. Preskill. Secure quantum key distribution with an un-characterized source. Phys. Rev. Lett., 90:057902, 2003.

[72] M. Koashi and A. Winter. Monogamy of quantum entanglement and othercorrelations. Phys. Rev. A, 69:022309, 2004.

[73] P. Kok and S. L. Braunstein. Postselected versus nonpostselected quantumteleportation using parametric down-conversion. Phys. Rev. A, 61:042304,2000.

[74] J. K. Korbicz, J. I. Cirac, and M. Lewenstein. Spin squeezing inequalitiesand entanglement of N qubit states. Phys. Rev. Lett., 95:120502, 2005.

[75] J. K. Korbicz, O. Guhne, M. Lewenstein, H. Haffner, C. F. Ross, andR. Blatt. Generalized spin squeezing inequalities in N qubit systems.Phys. Rev. A, 74:052319, 2006.

[76] J. K. Korbicz and M. Lewenstein. Group-theoretical approach to entan-glement. Phys. Rev. A, 74:022318, 2006.

[77] N. Korolkova, G. Leuchs, R. Loudon, T. C. Ralph, and C. Silberhorn.Polarization squeezing and continuous-variable polarization entanglement.Phys. Rev. A, 65:052306, 2002.

[78] B. Kraus, C. Branciard, and R. Renner. Security of quantum key distri-bution protocols using two-way classical communication or weak coherentpulses. Phys. Rev. A, 75:012316, 2007.

[79] B. Kraus, N. Gisin, and R. Renner. Lower and upper bounds on the secretkey rate for QKD protocols using one-way classical communication. Phys.Rev. Lett., 95:080501, 2005.

98 BIBLIOGRAPHY

[80] P. G. Kwiat, A. J. Berglund, J. B. Altepeter, and A. G. White. Experi-mental verification of decoherence-free subspaces. Science, 290:498, 2000.

[81] D. Leibfried, E. Knill, S. Seidelin, J. Britton, R. B. Blakestad, J. Chi-averini, D. B. Hume, W. M. Itano, J. D. Jost, C. Langer, R. Ozeri, R. Re-ichle, and D. J. Wineland. Creation of a six-atom ’Schrodinger cat’ state.Nature, 438:639, 2005.

[82] M. Lewenstein, B. Kraus, J. I. Cirac, and P. Horodecki. Optimization ofentanglement witnesses. Phys. Rev. A, 62:052310, 2000.

[83] A. Ling, M. P. Peloso, I. Marcikic, V. Scarani, A. Lamas-Linares, andC. Kurtsiefer. Experimental quantum key distribution based on a Belltest. arXiv:0805.3629.

[84] H. K. Lo. Getting something out of nothing. Quantum Inf. Comput., 5:5,2005.

[85] H. K. Lo, F. Chau, and M. Ardehali. Efficient quantum key distributionscheme and proof of its unconditional security. Journal of Cryptology,18:133, 2005.

[86] H. K. Lo and H. F. Chau. Unconditional security of quantum key distri-bution over arbitrarily long distances. Science, 283:2050, 1999.

[87] H. K. Lo, X. Ma, and K. Chen. Decoy state quantum key distribution.Phys. Rev. Lett., 94:230504, 2005.

[88] H. K. Lo and J. Preskill. Security of quantum key distribution using weakcoherent states with nonrandom phases. Quantum Inf. Comput., 8:431,2007.

[89] J. Lofberg. YALMIP: A toolbox for modeling and optimization inMATLAB. In Proceedings of the CACSD Conference, page 284,Taipei, Taiwan, 2004. Available from http://control.ee.ethz.ch/

~joloef/yalmip.php.

[90] S. Lorenz, J. Rigas, M. Heid, U. L. Andersen, N. Lutkenhaus, andG. Leuchs. Witnessing effective entanglement in a continuous variableprepare-and-measure setup and application to a quantum key distribu-tion scheme using postselection. Phys. Rev. A, 74:042326, 2006.

[91] C. Y. Lu, X. Q. Zhou, O. Guhne, W. B. Gao, J. Zhang, Z. S. Yuan,A. Goebel, T. Yang, and J. W. Pan. Experimental entanglement of sixphotons in graph states. Nature Physics, 3:91, 2007.

[92] J. S. Lundeen, A. Feito, H. Coldenstrodt-Ronge, K. L. Pregnell, C. Silber-horn, T. C. Ralph, J. Eisert, M. B. Plenio, and I. A. Walmsley. Measuringmeasurement. Nature Physics, 5:27, 2009.

[93] N. Lutkenhaus. Estimates for practical quantum cryptography. Phys.Rev. A, 59:3301, 1999.

[94] N. Lutkenhaus. Security against individual attacks for realistic quantumkey distribution. Phys. Rev. A, 61:052304, 2000.

BIBLIOGRAPHY 99

[95] L. Lydersen and J. Skaar. Security of quantum key distribution with bitand basis dependent detector flaws. arXiv:0807.0767.

[96] X. Ma, C. H. F. Fung, and H. K. Lo. Quantum key distribution withentangled photon sources. Phys. Rev. A, 76:012307, 2007.

[97] X. Ma, B. Qi, Y. Zhao, and H. K. Lo. Practical decoy state for quantumkey distribution. Phys. Rev. A, 72:012326, 2005.

[98] V. Makarov, A. Anisimov, and J. Skaar. Effects of detector efficiencymismatch on security of quantum cryptosystems. Phys. Rev. A, 74:022313,2006.

[99] W. Mauerer, W. Helwig, and C. Silberhorn. Recent developments in quan-tum key distribution: Theory and practice. Ann. Phys., 17:158, 2008.

[100] W. Mauerer and C. Silberhorn. Passive decoy state quantum key distri-bution: Closing the gap to perfect sources. Phys. Rev. A, 75:050305(R),2007.

[101] C. Mayers and A. Yao. Self testing quantum apparatus. Quantum Inf.Comput., 4:273, 2004.

[102] D. Mayers. Quantum key distribution and string oblivious transfer innoisy channels. In Advances in Cryptology — Proceedings of Crypto ’96,page 343, Berlin, 1996. Springer.

[103] D. Mayers. Unconditional security in quantum cryptography. JACM,48:351, 2001.

[104] A. Miranowicz, M. Piani, P. Horodecki, and R. Horodecki. Inseparabilitycriteria based on matrices of moments. arXiv.org/quant-ph/0605146.

[105] D. Mogilevtsev. Diagonal element inference by direct detection. Opt.Commun., 156:307, 1998.

[106] T. Moroder, M. Curty, and N. Lutkenhaus. One-way quantum key dis-tribution: Simple upper bound on the secret key rate. Phys. Rev. A,74:052301, 2006.

[107] T. Moroder, M. Curty, and N. Lutkenhaus. Upper bound on the secretkey rate distillable from effective quantum correlations with imperfectdetectors. Phys. Rev. A, 73:012311, 2006.

[108] J. E. Moyal. Quantum mechanics as a statistical theory. Proc. CambridgePhilos. Soc., 45:99, 1949.

[109] G. O. Myhr and N. Lutkenhaus. Spectrum conditions for symmetric ex-tendible states. arXiv:0812.3667.

[110] G. O. Myhr, J. M. Renes, A. C. Doherty, and N. Lutkenhaus. Symmetricextension in two-way quantum key distribution. arXiv:0812.3607.

[111] F. J. Narcowich. The problem of moments in the phase space formulationof quantum mechanics. J. Math. Phys., 28:2873, 1987.

100 BIBLIOGRAPHY

[112] F. J. Narcowich and R. F. O’Connell. Necessary and sufficient conditionsfor a phase-space function to be a Wigner distribution. Phys. Rev. A,34:1, 1986.

[113] J. W. Pan, Z. B. Chen, M. Zukowski, H. Weinfurter, and A. Zeilinger.Multi-photon entanglement and interferometry. arXiv:0805.2853, 2008.

[114] A. Peres. Separability criterion for density matrices. Phys. Rev. Lett.,77:1413, 1996.

[115] A. Peres. All the Bell inequalities. Found. of Phys., 29:589, 1999.

[116] M. Piani and C. E. Mora. Class of PPT bound entangled states associatedto almost any set of pure entangled states. Phys. Rev. A, 75:012305, 2007.

[117] S. Popescu and D. Rohrlich. Quantum nonlocality as an axion. Found. ofPhys., 24:379, 1994.

[118] B. Qi, C. H. F. Fung, H. K. Lo, and X. Ma. Time-shift attack in practicalquantum cryptosystems. Quantum Inf. Comput., 7:73, 2007.

[119] A. K. Rajagopal and E. C. G. Sudarshan. Some generalizations of theMarcinkiewicz theorem and its implications to certain approximationschemes in many-particle physics. Phys. Rev. A, 10:1852, 1974.

[120] M. Reimpell and R. F. Werner. Iterative optimization of quantum errorcorrecting codes. Phys. Rev. Lett., 94:080501, 2005.

[121] J. M. Renes and G. Smith. Noisy preprocessing and the distillation ofprivate states. Phys. Rev. Lett., 98:020502, 2007.

[122] R. Renner. Security of quantum key distribution. PhD thesis, Swiss FederalInstitute of Technology (ETH) Zurich, 2005.

[123] R. Renner. Symmetry implies independence. Nature Physics, 3:645, 2007.

[124] R. Renner, N. Gisin, and B. Kraus. An information-theoretic securityproof for QKD protocols. Phys. Rev. A, 72(012332):012332, 2005.

[125] J. Rigas, O. Guhne, and N. Lutkenhaus. Entanglement verification forquantum-key-distribution systems with an underlying bipartite qubit-mode structure. Phys. Rev. A, 73:012341, 2006.

[126] P. P. Rohde and T. C. Ralph. Modeling photo-detectors in quantumoptics. J. Mod. Opt., 53:1589, 2006.

[127] D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson,R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. Nordholt. Long distancedecoy state quantum key distribution in optical fiber. Phys. Rev. Lett.,98:010503, 2007.

[128] A. R. Rossi, S. Olivares, and M. G. A. Paris. Photon statistics withoutcounting photons. Phys. Rev. A, 70:055801, 2004.

[129] O. Rudolph. Further results on the cross norm criterion for separability.arXiv.org/quant-ph/0202121.

BIBLIOGRAPHY 101

[130] J. Samsonowicz, M. Kus, and M. Lewenstein. Separability, entanglementand full families of commuting normal matrices. Phys. Rev. A, 76:022314,2007.

[131] A. Sanpera, R. Tarrach, and G. Vidal. Quantum inseparability as localpseudomixture. Phys.Rev. A, 58:826, 1998.

[132] V. Scarani, A. Acın, G. Ribordy, and N. Gisin. Quantum cryptographyprotocols robust against photon number splitting attacks for weak laserpulse implementations. Phys. Rev. Lett., 92:057901, 2004.

[133] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dusek, N. Lutken-haus, and M. Peev. A framework for practical quantum cryptography.arXiv:0802.4155.

[134] T. Schmitt-Manderbach, H. Weier, M. Furst, R. Ursin, F. Tiefen-bacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity,A. Zeilinger, and H. Weinfurter. Experimental demonstration of free-space decoy-state quantum key distribution over 144 km. Phys. Rev. Lett.,98:010504, 2007.

[135] M. Seevinck and J. Uffink. Local commutativity versus Bell inequalityviolation for entangled states and versus non-violation for separable states.Phys. Rev. A, 76:042105, 2007.

[136] E. Shchukin and W. Vogel. Inseparability criteria for continuous bipartitequantum states. Phys. Rev. Lett., 95:230502, 2005.

[137] E. Shchukin and W. Vogel. Bell-type inequalities for arbitrary observables.arXiv:0902.3962, 2009.

[138] P. W. Shor and J. Preskill. Simple proof of security of the BB84 quantumkey distribution protocol. Phys. Rev. Lett., 85:441, 2000.

[139] R. Simon. Peres-Horodecki separability criterion for continuous variablesystems. Phys. Rev. Lett., 84:2726, 2000.

[140] G. Smith, J. M. Renes, and J. A. Smolin. Structured codes improvethe Bennett-Brassard-84 quantum key rate. Phys. Rev. Lett., 100:170502,2008.

[141] F. M. Spedalieri. Detecting separable states via semidefinite programs.Phys. Rev. A, 76:032318, 2007.

[142] J. K. Stockton, J. M. Geremia, A. C. Doherty, and H. Mabuchi. Charac-terizing the entanglement of symmetric many-particle spin-1/2 systems.Phys. Rev. A, 67:022112, 2003.

[143] D. Stucki, N. Gisin, O. Guinnard, G. Ribordy, and H. Zbinden. Quantumkey distribution over 67 km with a plug&play system. New J. Phys., 4:41,2002.

[144] H. Takesue, S. W. Nam, Q. Zhang, R. H. Hadfield, T. Honjo, K. Tamaki,and Y. Yamamoto. Quantum key distribution over 40 dB channel lossusing superconducting single photon detectors. Nature Photonics, 1:343,2007.

102 BIBLIOGRAPHY

[145] K. Tamaki, N. Lutkenhaus, M. Koashi, and J. Batuwantudawe. Uncondi-tional security of the Bennett 1992 quantum key-distribution scheme withstrong reference pulse. arXiv.org/quant-ph/0607082.

[146] B. Terhal. Bell inequalities and the separability criterion. Phys. Lett. A,271:319, 2000.

[147] B. M. Terhal, A. C. Doherty, and D. Schwab. Symmetric extensionsof quantum states and local hidden variable theories. Phys. Rev. Lett.,90:157903, 2003.

[148] K. C. Toh, R. H. Tutuncu, and M. J. Todd. SDPT3–A Matlab soft-ware package for semidefinite programming. Optimization Methods andSoftware, 11:545, 1999. Available from http://www.math.nus.edu.sg/

~mattohkc/sdpt3.html.

[149] G Toth and O Guhne. Entanglement and permutational symmetry.arXiv:0812.4453.

[150] G. Toth and O. Guhne. Entanglement detection in the stabilizer formal-ism. Phys. Rev. A, 72:022340, 2005.

[151] G. Toth, C. Knapp, O. Guhne, and H. J. Briegel. Optimal spin squeezinginequalities detect bound entanglement. arXiv.org/quant-ph/0702219.

[152] T. Tsurumaru, A. Soujaeff, and S. Takeuchi. Exact minimum and max-imum of yield with a finite number of decoy light intensities. Phys. Rev.A, 77:022319, 2008.

[153] T. Tsurumaru and K. Tamaki. Security proof for QKD systems withthreshold detectors. arXiv:0803.4226.

[154] R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl,M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek,B. Omer, M. Furst, M. Meyenburg, J. Rarity, Z. Sodnik, C. Barbieri,H. Weinfurter, and A. Zeilinger. Entanglement-based quantum communi-cation over 144 km. Nature Physics, 3:481, 2007.

[155] R. Ursin et al. Space-QUEST: Experiments with quantum entanglementin space. arXiv:0806.0945.

[156] A. R. Usha Devi, M. S. Uma, R. Prabhu, and A. K. Rajagopal. Constraintson the uncertainties of entangled symmetric qubits. Phys. Lett. A, 364:203,2007.

[157] S. J. van Enk, N. Lutkenhaus, and H. J. Kimble. On experimental proce-dures for entanglement verification. Phys. Rev. A, 75:052318, 2007.

[158] L. Vandenberghe and S. Boyd. Semidefinite programming. SIAM Review,38:49, 1996.

[159] F. Verstraete, K. Audenaert, J. Dehaene, and B. De Moor. A comparisonof the entanglement measures negativity and concurrence. J. Phys. A:Math. Gen., 34:10327, 2001.

BIBLIOGRAPHY 103

[160] X. Wang and K. Mølmer. Pairwise entanglement in symmetric multi-qubitsystems. Euro. Phys. J. D, 18:385, 2002.

[161] X. Wang and B. C. Sanders. Spin squeezing and pairwise entanglementfor symmetric multiqubit states. Phys. Rev. A, 68:012101, 2003.

[162] X. B. Wang. Beating the photon-number-splitting attack in practicalquantum cryptography. Phys. Rev. Lett., 94:230503, 2005.

[163] R. F. Werner. Quantum states with Einstein-Podolsky-Rosen correlationsadmitting a hidden-variable model. Phys. Rev. A, 40:4277, 1989.

[164] R. F. Werner and M. M. Wolf. Bound entangled Gaussian states. Phys.Rev. Lett., 86:3658, 2001.

[165] W. Wieczorek, C. Schmid, N. Kiesel, R. Pohlner, O. Guhne, and H. We-infurter. Experimental observation of an entire family of four-photon en-tangled states. Phys. Rev. Lett., 101:010503, 2008.

[166] M. M. Wolf, G. Giedke, and J. I. Cirac. Extremality of Gaussian quantumstates. Phys. Rev. Lett., 96:080502, 2006.

[167] M. M. Wolf and D. Perez-Garcia. Quantum capacities of channels withsmall environment. Phys. Rev. A, 75:4, 2007.

[168] Z. L. Yuan, A. W. Sharpe, and A. J. Shields. Unconditionally secureone-way quantum key distribution using decoy pulses. Appl. Phys. Lett.,90:011118, 2007.

[169] B. Yurke. Wideband photon counting and homodyne detection. Phys.Rev. A, 32:311, 1985.

[170] G. Zambra, A. Andreoni, M. Bondani, M. Gramegna, M. Genovese,G. Brida, A. Rossi, and M. G. A. Paris. Experimental reconstruction ofphoton statistics without photon counting. Phys. Rev. Lett., 95:063602,2005.

[171] G. Zambra and M. G. A. Paris. Reconstruction of photon-number distri-bution using low-performance photon counters. Phys. Rev. A, 74:063830,2006.

[172] Y. Zhao, B. Qi, X. Ma, H. K. Lo, and L. Qian. Experimental quantumkey distribution with decoy states,. Phys. Rev. Lett., 96:070502, 2006.

Acknowledgments� The biggest thanks belong to my supervisor Prof. Dr. Norbert Lutkenhaus.First of all for giving me the chance to join his research group for my PhDstudies, the possibility to take part in the adventure Canada, all the greatscientific advice and encouragement, his belief in me and also for the non-scientific help within the last five years. Nobody deserves more thanksthan him for the success of this work.� I am really grateful for the opportunity to work with so many professionalresearchers. In particular I owe special thanks to my direct collaborators,Prof. Dr. Michael Keyl, Dr. Marcos Curty, Dr. Otfried Guhne, Dr. MarcoPiani, Dr. Xiongfeng Ma, Norm Beaudry, Hauke Haseler, Dr. KiyoshiTamaki and Prof. Dr. Hoi-Kwong Lo. The achieved results would nothave been possible without their hard work and inspiring interest in thefield.� In particular I would like to thank Dr. Marcos Curty for his great scien-tific and non-scientific support throughout all these years, all the fruitfuldiscussions and his strength to keep on with projects, for his friendshipand all the awesome times that we have experienced together. I cannotexpress how sad I am that Spain is that bad in skiing. . .� I am grateful to Prof. Dr. Michael Keyl for the great collaboration whichgave me a big boost of motivation during my studies. Let me say thatI’m still very proud of our achieved results and in particular thankful forthe invitation to the ISI Foundation in Torino, which was a magnificentexperience for me.� Moreover I would like to thank Dr. Otfried Guhne, our group’s regular“autumn visitor”. It was always a great pleasure to work with him andI’m grateful for everything that I have learned from him.� I’m much obliged to all members from the QIT/OQCT group: Dr. MohsenRazavi, Dr. Marco Piani, Matthias Heid, Geir-Ove Myhr, Hauke Haseler,Norm Beaudry, Volkher Scholz, Agnes Ferenczi and Nathan Killoran. Youguys made work a lot easier.� Additionally, I would like to thank all people from IQC. It was a greatexperience for me to work in such a professional surrounding, where therewas always somebody around to discuss with. In particular I would liketo thank Dr. Rainer Kaltenbaek and Jonathan Lavoie for all the insightsinto an “experimentalist’s life”.

105

� Moreover, I would like thank: Matthias, Jonathan and Rainer—Waterloowould have been really boring without you, my nearly “common-in-lawpartner” Matthias for our three year experience of living together, JaneBond for all the lovely hours and the great help of making me leave Wa-terloo that easy, all the people from the International Student’s Night,the Grad House, Fratello Pizza, our neighbors Dan and Jill, Hauke forour fabulous tennis matches—what was the score again?, Mohsen for allthe challenging table tennis “lessons”, Value Mart, the Convenience storeon Erb, sport.orf.at, ZDFMediathek,, kniffel.de, Skype, Neverwin-ter Nights, LCBO, Jonathan for our great trip to Quebec, the people fromErlangen: Wolfgang, Roland, Max, Julian, Horst, Franz, Martin & Steffi;the table tennis guys from Erlangen, my cousin Sebastian, P. K. Dickand G. Martin for their way of distracting me, Buffalo Sabres, AustrianU20 Soccer Team, Manni, Joe, Tom, NatWest for causing and ScotiaBankfor not causing problems, the dog “Seppi”, metal-only.de, Mc Donald,Marlboro, . . .� Finally I would like to thank my parents, Winfried and Marliese Moroder,as well as my sister, Heike, for their kind support and my beloved Steffifor many other things that don’t have to be listed here.� In the end, let me apologize to everybody whom I may have forgotten . . .

106

Publication list

The results of this thesis have been discussed partially in several publications.The following list of these papers is ordered with respect to their appearance inthe presented thesis.� T. Moroder, M. Keyl, and N. Lutkenhaus. Truncated su(2) moment

problem for spin and polarization states. J. Phys. A: Math. Theo.,41:275302, 2008.� T. Moroder, O. Guhne, and N. Lutkenhaus. Iterations of nonlinear en-tanglement witnesses. Phys. Rev. A, 78:032326, 2008.� N. J. Beaudry, T. Moroder, and N. Lutkenhaus. Squashing models foroptical measurements in quantum communication. Phys. Rev. Lett.,101:093601, 2008.� T. Moroder, O. Guhne, N. J. Beaudry, M. Piani and N. Lutkenhaus. En-tanglement verification with realistic measurement devices via squashingoperations. arXiv:0909.4212.� T. Moroder, M. Curty, and N. Lutkenhaus. Detector decoy quantum keydistribution. New J. Phys., 11:045008, 2009.

The following list contains in respective chronological ordering the remainingpublications and preprints, that have been finished during the PhD period.These publications emerged either from the author’s diploma thesis or fromfurther collaborations.� T. Moroder, M. Curty, and N. Lutkenhaus. Upper bound on the secret

key rate distillable from effective quantum correlations with imperfectdetectors. Phys. Rev. A, 73:012311, 2006.� T. Moroder, M. Curty, and N. Lutkenhaus. One-way quantum key dis-tribution: Simple upper bound on the secret key rate. Phys. Rev. A,74:052301, 2006.� M. Curty and T. Moroder. On single-photon quantum key distributionin the presence of loss. Phys. Rev. A, 75:052336, 2007.� H. Haseler, T. Moroder, and N. Lutkenhaus. Testing quantum devices:Practical entanglement verification in bipartite optical systems. Phys.Rev. A, 77:032303, 2008.

107

� M. Curty, K. Tamaki, and T. Moroder. Effect of detector dead-times onthe security evaluation of differential-phase-shift quantum key distributionagainst sequential attacks. Phys. Rev. A, 77:052321, 2008.� X. Ma, T. Moroder, and N. Lutkenhaus. Quantum key distribution secureagainst the efficiency loophole. arXiv:0812.4301.� M. Curty, T. Moroder, X. Ma, H. K. Lo, and N. Lutkenhaus. Upperbounds for the secure key rate of decoy state quantum key distribution.Phys. Rev. A, 79:032335, 2009.� M. Curty, T. Moroder, X. Ma, and N. Lutkenhaus. Non-Poissonian statis-tics from Poissonian light sources with application to passive decoy statequantum key distribution. Opt. Lett., 34:3238, 2009.

108

Curriculum Vitae

Personal information

Name: Tobias Ernst MoroderDate of birth: 19.02.1980Place of birth: Erlangen, GermanyNationalities: Austrian, GermanParents: Winfried and Marliese Moroder

Education

Jan. 09 - Friedrich Alexander University Erlangen-Nuremberg

present Erlangen, Germany

Jan. 06 - Institute for Quantum Computing

Dec. 08 Waterloo, Canada

Apr. 05 - Friedrich Alexander University Erlangen-Nuremberg

Dec. 05 Erlangen, GermanyPhD Student, PhysicsThesis title: Operational tools for moment characterization,

entanglement verification and quantum keydistribution

Supervisor: Prof. Dr. N. Lutkenhaus


Apr. 05 Erlangen, GermanyDiploma Student, PhysicsThesis title: Entanglement verification in quantum key

distributionSupervisor: Prof. Dr. N. Lutkenhaus


Apr. 04 Erlangen, GermanyStudent, Physics Diploma

Oct. 01 - Imperial College

Mar. 02 London, Great BritainErasmus Exchange Student

109

Aug. 99 - Friedrich Alexander University Erlangen-Nuremberg

Sept. 01 Erlangen, GermanyStudent, Physics Diploma

Conferences� “XII International Conference on Quantum Optics and Quantum Informa-tion”, Vilnius, Lithuania, September 08, Posters: Detector decoy quantumkey distribution, Iterations of nonlinear entanglement witnesses.� “Canadian Quantum Information Student’s Conference”, Calgary, Cana-da, August 06, Talk: Upper bounds for practical QKD.� “Quantum Reality, Relativistic Causality, and Closing the Epistemic Cir-cle: An International Conference in Honor of Abner Shimony”, Waterloo,Canada, July 06.� “Quantum Physics of Nature”, Vienna, Austria, May 2005, Poster: Upperbound on secret key rate distillable from effective quantum correlations.� “DPG Tagung”, Berlin, Germany, March 05, Talk: Entanglement detec-tion in QKD.

Workshops� “QKD North”, Toronto, Canada, March 08.� “Theory and Realization of Practical Quantum Key Distribution”, Wa-terloo, Canada, June 07.� “SECOQC-QIT Workshop”, Vienna, Austria, March 06, August 06, De-cember 07.� “Entanglement and Decoherence: Mathematics and Physics of QuantumInformation and Computation”, Oberwolfach, Germany, January 05.

Summer schools� “Information Security in a Quantum World”, Waterloo, Canada, Au-gust 08, Poster: Detector decoy quantum key distribution.� “Quantum Computation and Quantum Information”, Chania, Crete, May05, Poster: Upper bound on secret key rate distillable from effective quan-tum correlations.

Teaching

Jan. 08 - Teaching Assistant, Electromagnetic Theory (undergraduate)Mar. 08 University of Waterloo, Canada

assisted Prof. Dr. N. Lutkenhaus

Oct. 07 - Teaching Assistant, Quantum Physics 1 (undergraduate)Dec. 07 University of Waterloo, Canada

assisted Prof. Dr. N. Lutkenhaus and Prof. Dr. R. Hill

110

Jan. 05 - Teaching Assistant, Klassische Mechanik (undergraduate)Feb. 05 University of Erlangen-Nuremberg, Germany

assisted Prof. Dr. P.-G. Reinhard

Research visits� Institute for Scientific Interchange Foundation, Torino, Italy, December07, visiting Prof. Dr. M. Keyl.� National Institute of Informatics, Tokyo, Japan, February 08, visiting re-search group of Prof. Dr. K. Nemoto.

111

operational tools for moment characterization ... · operational tools for moment characterization,...

Documents