ńņš. 23 |

for some value of the ļ¬tting parameter Ī·. Given appropriate assumptions about the

curve-ļ¬tting technique, one can show that

Ī·=V. (19.65)

The physical meaning of a high, but imperfect (V < 1), visibility is that decoherence

of some sort has occurred between the two photons Ī³A and Ī³B during their propagation

from the source to Alice and Bob. Thus the entangled pure state emitted by the source

changes, for either fundamental or technical reasons, into a slightly mixed state before

arriving at the detectors.

Next, let us consider experiments with four counters, such as the one sketched in

Fig. 19.3. Again, using data analysis that assumes a ļ¬nite-visibility ļ¬tting parameter

Ī·, the joint probabilities (19.58) and (19.59) have the following modiļ¬ed forms:

11

ā’ Ī· cos(2Ī± ā’ 2Ī²) ,

pee (Ī±, Ī²) = poo (Ī±, Ī²) = (19.66)

22

11

+ Ī· cos(2Ī± ā’ 2Ī²) ,

peo (Ī±, Ī²) = poe (Ī±, Ī²) = (19.67)

22

so that Bellā™s joint expectation value becomes

E(Ī±, Ī²) = ā’Ī· cos(2Ī± ā’ 2Ī²) . (19.68)

For the special settings in eqn (19.61), one ļ¬nds

ā

4

S = ā’ ā Ī· = ā’2 2Ī· . (19.69)

2

This implies that the maximum amount of visibility Vmax permitted by Bellā™s inequal-

ity |S| 2 is

1

Vmax = Ī·max = ā = 70.7% . (19.70)

2

Comparisons with experiments

19.6.2 Data from the tandem-crystal experiment violates the Bell

inequality |S| 2

For comparison with experiment, we show once again the data from the tandem two-

crystal experiment discussed in Section 13.3.5, but this time we superpose a ļ¬nite-

visibility, sinusoidal interference-fringe pattern, of the form (19.64), with the maximum

visibility Vmax = 70.7% permitted by Bellā™s theorem. This is shown as a light, dotted

curve in Fig. 19.7.

One can see by inspection that the data violate the Bell inequality (19.38) by many

standard deviations. Indeed, detailed statistical analysis shows that these data violate

the constraint |S| 2 by 242 standard deviations. However, this data exhibits a high

signal-to-noise ratio, so that systematic errors will dominate random errors in the data

analysis.

19.6.3 Possible experimental loopholes

A The detection loophole

Since the quantum eļ¬ciencies of photon counters are never unity, there is a possible

experimental loophole, called the detection loophole, in most quantum optical tests

of Bellā™s theorem. If the quantum eļ¬ciency is less than 100%, then some of the photons

will not be counted. This could be important, if the ensemble of photons generated by

the source is not homogeneous. For example, it is conceivableā”although far-fetchedā”

that the photons that were not counted just happen to have diļ¬erent correlations than

the ones that were counted. For example, the second-order interference fringes for the

undetected photons might have a visibility that is less than the maximum allowable

amount Vmax = 70.7%. Averaging the visibility of the undetected photons with the

visibility of the detected photons, which do have a measured visibility greater than

70.7%, might produce a total distribution which just barely manages to satisfy the

inequality (19.38).

2000

Singles (10 s)

Coincidences (10 s)

1500

1000

500

0 0

ā’45 45 135 225

0 90 180 270 315

Īø2 (Īø1 = ā’45 )

Fig. 19.7 Data from the tandem-crystals experiment (discussed in Section 13.3.5) compared

to maximum-visibility sinusoidal interference fringes with Vmax = 70.7% (light, dotted curve),

which is the maximum visibility permitted by Bellā™s theorem. (Adapted from Kwiat et al.

(1999b).)

Bellā™s theorem and its optical tests

This scenario is ruled out if one adopts the entirely reasonable, fair-sampling as-

sumption that the detected photons represent a fair sample of the undetected photons.

In this case, the undetected photons would not have substantially distorted the ob-

served interference fringes if they had been included in the data analysis. Nevertheless,

the fair-sampling assumption is diļ¬cult to prove or disprove by experiment.

One way out of this diļ¬culty is to repeat the quantum optical tests of Bellā™s

theorem with extremely high quantum eļ¬ciency photon counters, such as solid-state

photomultipliers (Kwiat et al., 1994). This would minimize the chance of missing any

appreciable fraction of the photons in the total ensemble of photon pairs from the

source. To close the detection loophole, a quantum eļ¬ciency of greater than 83% is

required for maximally entangled photons, but this requirement can be reduced to

67% by the use of nonmaximally entangled photons (Eberhard, 1993).

Replacing photons by ions allows much higher quantum eļ¬ciencies of detection,

since ions can be detected much more eļ¬ciently than photons. In practice, nearly

all ions can be counted, so that almost none will be missed. An experiment using

entangled ions has been performed (Rowe et al., 2001). With the detection loophole

closed, the experimenters observed an 8 standard deviation violation of the Clauserā“

Horneā“Shimonyā“Holt inequality (Clauser et al., 1969)

|E (Ī±1 , Ī²1 ) + E (Ī±2 , Ī²1 )| + |E (Ī±1 , Ī²2 ) ā’ E (Ī±2 , Ī²2 )| 2. (19.71)

This is one of several experimentally useful Bell inequalities that are equivalent in

physical content to the condition |S| 2 discussed above.

B The locality loophole

Another possible loopholeā”which is conceptually much more important than the ques-

tion of detector eļ¬ciencyā”is the locality loophole. Closing this loophole is especially

vital in light of the incorporation of the extremely important Einsteinian principle of

locality into Bellā™s theorem.

Since photons travel at the speed of light, they are much better suited than atoms or

ions for closing the locality loophole. Using photons, it is easy to ensure that Aliceā™s and

Bobā™s decisions for the settings of their parameters Ī± and Ī² are space-like separated,

and therefore truly independent.

For example, Alice and Bob could randomly and quickly reset Ī± and Ī² during the

time interval after emission from the source and before arrival of the photons at their

respective calcite prisms. There would then be no way for any secret machinery at

the source to know beforehand what values of Ī± and Ī² Alice or Bob would eventu-

ally decide upon for their measurements. Therefore, properties of the photons that

were predetermined at the source could not possibly inļ¬‚uence the outcomes of the

measurements that Alice and Bob were about to perform.

The ļ¬rst attempt to close the locality loophole was an experiment with a separation

of 12 m between Alice and Bob. Rapidly varying the settings of Ī± and Ī², by means of

two acousto-optical switches (Aspect et al., 1982), produced a violation of the Clauserā“

Horneā“Shimonyā“Holt inequality (19.71) by 6 standard deviations.

However, the time variation of the two polarizing elements in this experiment was

periodic and deterministic, so that the settings of Ī± and Ī² at the time of arrival of the

Comparisons with experiments

photons could, in principle, be predicted. This would still allow the properties of the

photons that led to the observed outcomes of measurements to be predetermined at

the source.

A more satisfactory experiment vis-`-vis closing the locality loophole was per-

a

formed with a separation of 400 m between the two polarizers. Two separate, ultrafast

electro-optic modulators, driven by two local, independent random number genera-

tors, rapidly varied the settings of Ī± and Ī² in a completely random fashion. The result

was a violation of the Clauserā“Horneā“Shimonyā“Holt inequality (19.71) by 30 standard

deviations.

The two random number generators operated at the very high toggle frequency

of 500 MHz. After accounting for various extraneous time delays, the experimenters

concluded that no given setting of Ī± or Ī² could have been inļ¬‚uenced by any event that

occurred more than 0.1 Āµs earlier, which is much shorter than the 1.3 Āµs light transit

time across 400 meters.

Hence the locality loophole was ļ¬rmly closed. However, the detection loophole was

far from being closed in this experiment, since only 5% of all the photon pairs were

detected. Thus a heavy reliance on the fair-sampling assumption was required in the

data analysis.

19.6.4 Relativistic issues

An experiment with a very large separation, of 10.9 km, between Alice and Bob has

been performed using optical ļ¬ber technology, in conjunction with a spontaneous

down-conversion light source (Tittel et al., 1998). A violation of Bellā™s inequalities

by 16 standard deviations was observed in this experiment.

Relativistic issues, such as putting limits on the so-called speed of collapse of the

two-photon wave function, could then be examined experimentally using this type of

apparatus. Depending on assumptions about the detection process and about which

inertial frame is used, the speed of collapse was shown to be at least 104 c to 107 c

(Zbinden et al., 2001). Further experiments with rapidly rotating absorbers ruled out

an alternative theory of nonlocal collapse (Suarez and Scarani, 1997).

19.6.5 Greenbergerā“Horneā“Zeilinger states

The previous discussion of experiments testing Bellā™s theorem was based on constraints

on the total amount of correlation between random events observable in two-particle

coincidence experiments. These constraints are fundamentally statistical in nature.

Greenberger, Horne, and Zeilinger (GHZ) (Kafatos, 1989, pp. 69ā“72) showed that

using three particles, as opposed to two, in a maximally entangled state such as

|ĻGHZ ā |a, b, c ā’ |a , b , c , (19.72)

allows a test of the combined principles of locality and realism by observing, or failing

to observe, a single triple-coincidence click. Thus, in principle, the use of statistical

correlations is unnecessary for testing local realistic theories. However, in practice,

the detectors with quantum eļ¬ciencies less than 100% used in real experiments again

required the use of inequalities. Violations of these inequalities have been observed

in experiments involving nonmaximally entangled states generated by spontaneous

Ā¼Ā¼ Bellā™s theorem and its optical tests

down-conversion (Torgerson et al., 1995; White et al., 1999). Once again, the results

contradict all local realistic theories.

For a review of these and other quantum optical tests of the foundations of physics,

see Steinberg et al. (2005).

19.7 Exercises

19.1 The original EPR argument

(1) Show that the EPR wave function, given by eqn (19.1), is an eigenfunction of

the total momentum pA + pB , with eigenvalue 0, and also an eigenfunction of the

operator xA ā’ xB , with eigenvalue L.

(2) Calculate the commutator [pA + pB , xA ā’ xB ] and use the result to explain why

(1) does not violate the uncertainty principle.

(3) If pA is measured, show that pB has a deļ¬nite value. Alternatively, if xA is mea-

sured, show that xB has a deļ¬nite value.

(4) Argue from the previous results that both xB and pB are elements of physical

reality, and explain why this leads to the EPR paradox.

19.2 Parameter independence for quantum theory

(1) Use eqns (19.43)ā“(19.45) to derive eqn (19.47).

(2) Verify parameter independence when |Ļ is replaced by any of the four Bell states

{|ĪØĀ± , |Ī¦Ā± } deļ¬ned by eqns (13.59)ā“(13.62).

19.3 Violation of outcome independence

(1) Use eqn (19.50) to expand |hA , vB and |vA , hB in terms of |hA , Ī²B and vA , Ī² B .

(2) Evaluate the reduced states |ĪØā’ yes and |ĪØā’ no .

(3) Calculate the conditional probabilities p(Ayes |Ī», Ī±, Ī², Byes ) and p(Ayes |Ī», Ī±, Ī²,

Bno ).

(4) Calculate the joint probability p (Ayes , Byes |ĪØā’ , Ī±, Ī² ).

(5) If |ĪØā’ is replaced by |Ļ = |hA , vB , is outcome independence still violated?

19.4 Violation of Bellā™s inequality

(1) Carry out the calculations needed to derive eqns (19.58) and (19.59).

(2) If |ĪØā’ is replaced by |Ļ = |hA , vB , is the Bell inequality still violated?

20

Quantum information

Quantum optics began in the early years of the twentieth century, but its applications

to communications, cryptography, and computation are of much more recent vintage.

The progress of communications technology has made quantum eļ¬ects a matter of

practical interest, as evidenced in the discussion of noise control in optical transmission

lines in Section 20.1. The issue of inescapable quantum noise is also related to the

diļ¬cultyā”discussed in Section 20.2ā”of copying or cloning quantum states.

Other experimental and technological advances are opening up new directions for

development in which the quantum properties of light are a resource, rather than a

problem. Streams of single photons with randomly chosen polarizations have already

been demonstrated as a means for the secure transmission of cryptographic keys, as

discussed in Section 20.3. Multiphoton states oļ¬er additional options that depend on

quantum entanglement, as shown by the descriptions of quantum dense coding and

quantum teleportation in Section 20.4. This set of ideas plays a central role in the

closely related ļ¬eld of quantum computing, which is brieļ¬‚y reviewed in Section 20.5.

20.1 Telecommunications

Optical methods of communicationā”e.g. signal ļ¬res, heliographs, Aldis lamps, etc.ā”

have been in use for a very long time, but high-speed optical telecommunications

are a relatively recent development. The appearance of low-loss optical ļ¬bers and

semiconductor lasers in the 1960s and 1970s provided the technologies that made new

forms of optical communication a practical possibility.

The subsequent increases in bandwidth to 104 GHz and transmission rates to the

multiterabit range have ledā”under the lash of Mooreā™s lawā”to substantial decreases

in the energy per bit and the size of the physical components involved in switching

and ampliļ¬cation of signals. An inevitable consequence of this technologically driven

development is that phenomena at the quantum level are rapidly becoming important

for real-world applications.

Long-haul optical transmission lines require repeater stations that amplify the

signal in order to compensate for attenuation. This process typically adds noise to the

signal; for example, erbium doped ļ¬ber ampliļ¬ers (EDFA) degrade the signal-to-noise

ratio by about 4 dB. Only 1 dB arises from technical losses in the components; the

remaining 3 dB loss is due to intrinsic quantum noise.

Thus quantum noise is dominant, even for apparently classical signals containing

a very large number of photons. Similar eļ¬ects arise when the signal is divided by a

passive device such as an optical coupler. Future technological developments can be

Ā¼Ā¾ Quantum information

expected to increase the importance of quantum noise; therefore, we devote Sections

20.1.2 and 20.1.3 to the problem of quantum noise management.

Optical transmission linesā—

20.1.1

Let us consider an optical transmission line in which the repeater stations employ

phase-insensitive ampliļ¬ers. For phase-insensitive input noise, the input and output

signal-to-noise ratios are deļ¬ned by

2

bĪ³ (Ļ)

[SNR]Ī³ = (Ī³ = in, out) , (20.1)

NĪ³ (Ļ)

where Nin and Nout are the noise in the input and output respectively. The relation

between the input and output signal-to-noise ratios is obtained by combining eqns

(16.36) and (16.150) to get

2 2

bout (Ļ) bin (Ļ) [SNR]in

[SNR]out = = = . (20.2)

Nout (Ļ) Nin (Ļ) + A (Ļ) 1 + A (Ļ) /Nin (Ļ)

The most favorable situation occurs when the input noise strength has the standard

quantum limit value 1/2. In this case one ļ¬nds

[SNR]out 1 1 1

ā’.

= (20.3)

2 ā“ 1/G (Ļ)

[SNR]in 1 + 2A (Ļ) 2

The inequality follows from eqn (16.151) and the ļ¬nal result represents the high-gain

limit. The decibel diļ¬erence between the signal-to-noise ratios is therefore bounded by

[SNR]out

ā’10 log 2 ā ā’3 .

d = 10 log (20.4)

[SNR]in

In other words, the quantum noise added by a high-gain, phase-insensitive ampliļ¬er

degrades the signal-to-noise ratio by at least three decibels. This result holds even for

strong input ļ¬elds containing many photons. For example, if the input is described by

the multi-mode coherent state deļ¬ned by eqns (16.98)ā“(16.100), then the input noise

strength is Nin (Ļ) = 1/2. In this case the inequality (20.4) is valid for any value of

2

the eļ¬ective classical intensity |Ī²in (t)| , no matter how large.

This result demonstrates that high-gain, phase-insensitive ampliļ¬ers are intrinsi-

cally noisy. This noise is generated by fundamental quantum processes that are at

work even in the absence of the technical noiseā”e.g. insertion-loss noise and Johnson

noise in the associated electronic circuitsā”always encountered in real devices.

Reduction of ampliļ¬er noiseā—

20.1.2

In the discussion of squeezing in Section 15.1 we have seen that quantum noise can be

unequally shared between diļ¬erent ļ¬eld quadratures by using nonlinear optical eļ¬ects.

This approachā”which can yield essentially noise-free ampliļ¬cation for one quadrature

by dumping the unwanted noise in the conjugate quadratureā”is presented in the

present section.

Ā¼Āæ

Telecommunications

There is an alternative scheme, based on the special features of cavity quantum

electrodynamics, in which the signal propagates through a photonic bandgap. This

is a three-dimensional structure in which periodic variations of the refractive index

produce a dispersion relation that does not allow propagating solutions in one or more

frequency bandsā”the bandgapsā”so that vacuum ļ¬‚uctuations and the associated noise

are forbidden at those frequencies (Abram and Grangier, 2003).

In the discussion of linear optical ampliļ¬ers in Chapter 16, we derived the in-

equality (16.147) which shows that the ampliļ¬er noise for a phase-conjugating am-

pliļ¬er is always larger than the vacuum noise, i.e. Namp > 1/2. On the other hand,

the noise added by a phase-transmitting ampliļ¬er can be made as small as desired

by allowing G (Ļ) to approach unity. Thus noise reduction can be achieved with a

phase-transmitting ampliļ¬er, provided that we are willing to give up any signiļ¬cant

ampliļ¬cation.

Achieving noise reduction by giving up ampliļ¬cation scarcely recommends itself

as a useful strategy for long-haul communications, so we turn next to phase-sensitive

ampliļ¬ers. In this case, the lower bound (16.147) on ampliļ¬er noise is replaced by the

ampliļ¬er uncertainty principle (16.169). The resemblance between eqn (16.169) and

the standard uncertainty principle for canonically conjugate variables is promising,

since the latter is known to allow squeezing.

Furthermore, the ampliļ¬er uncertainty principle has the additional advantage that

the lower bound is itself adjustable; indeed, it can be set to zero. Even when this is

not possible, the noise in one quadrature can be reduced at the expense of increasing

the noise in the conjugate quadrature. We ļ¬rst demonstrate two examples in which

the ampliļ¬er noise actually vanishes, and then discuss what can be achieved in less

favorable situations.

The phase-sensitive, traveling-wave ampliļ¬er described in Section 16.3.2 is intrinsi-

cally noiseless, so the lower bound of the ampliļ¬er uncertainty principle automatically

vanishes. For applications requiring the generally larger gains possible for regenerative

ampliļ¬ers, the phase-sensitive OPA presented in Section 16.2.2 can be modiļ¬ed to

provide noise-free ampliļ¬cation.

For the phase-sensitive OPA, the ampliļ¬er noise comes from vacuum ļ¬‚uctuations

entering the cavity through the mirror M2, as shown in Fig. 16.2. Thus the ampliļ¬er

noise would be eliminated by preventing the vacuum ļ¬‚uctuations from entering the

cavity. In an ideal world, this can be accomplished by making M2 a perfect reļ¬‚ector,

i.e. setting Īŗ2 = 0 in eqns (16.47)ā“(16.49). Under these circumstances, eqn (16.49)

reduces to Ī· (Ļ) = 0, so that the ampliļ¬er is noiseless.

In these examples, the noise vanishes for both of the principal quadratures, i.e.

A1 (Ļ) = A2 (Ļ) = 0. According to eqn (16.167), this means that the signal-to-noise

ratio is preserved by ampliļ¬cation. This is only possible if the lower bound in eqn

(16.170) vanishes, and this in turn requires G1 (Ļ) G2 (Ļ) = 1. Consequently, the price

for noise-free ampliļ¬cation is that one quadrature is attenuated while the other is

ampliļ¬ed.

In the real worldā”where traveling-wave ampliļ¬ers may not provide suļ¬cient gain

and there are no perfect mirrorsā”other options must be considered. The general idea is

to achieve high gain and low noise for the same quadrature. For this purpose, the signal

Ā¼ Quantum information

should be carried by modulation of either the amplitude or the phase of the chosen

c c

quadrature, e.g. Xin (Ļ); and the input noise should be small, i.e. āXin (Ļ) 1/2.

In the high-gain limit, the lower bound in eqn (16.169) is proportional to

G1 (Ļ) G2 (Ļ); consequently, the ampliļ¬er noise in the conjugate quadrature is nec-

essarily large. This is not a problem as long as the noisy quadrature is strongly rejected

by the detectors in use. The degree to which these objectives can be attained depends

on the details of the overall design.

20.1.3 Reduction of branching noise

The information encoded in an optical signal is often intended for more than one

recipient, so that it is necessary to split the signal into two or more identical parts,

usually by means of a directional coupler. These junction pointsā”which are often

called optical tapsā”may also be used to split oļ¬ a small part of the signal for

measurement purposes.

Whatever the motive for the tap, it is in eļ¬ect a measurement of the radiation

ļ¬eld. A measurement of any quantum system perturbs it in an uncontrollable fashion;

consequently, the optical tap must add noise to the signal. A succession of taps will

therefore degrade the signal, even if there is no associated ampliļ¬er noise.

In fact, we have already met with this eļ¬ect, in the guise of the partition noise

at a beam splitter. The explanation that partition noise arises from vacuum ļ¬‚uctu-

ations entering through the unused port of the beam splitter suggests that injecting

a squeezed vacuum state into the unused port might help with the noise problem.

This idea was initially proposed in 1980 (Shapiro, 1980) and experimentally realized

in 1997 (Bruckmeier et al., 1997). We discuss below a simple model that illustrates

this approach.

The idea is to add two elements, shown in Fig. 20.1, to the simple beam splitter

described in Section 8.4: (1) a squeezed-light generator (SQLG); and (2) a pair of

variable retarder plates (see Exercise 20.1). The SQLG, which is the essential part

of the modiļ¬ed beam splitter, injects squeezed light into the previously unused input

port 2. The function of the variable retarder plates, which are placed at the input port

2 and the output port 2 , is to simplify the overall scattering matrix.

The phase transformations, a2 ā’ eiĪø a2 and a2 ā’ eiĪø a2 , imposed by the retarder

plates are more usefully described as rotations of the input and output quadratures

through the angles Īø and Īø . Combining the phase transformations with eqn (8.63)ā”as

outlined in Exercise 20.2ā”yields the scattering matrix

ā ā

i ReiĪø

T

S = ā iĪø ā i(Īø+Īø ) . (20.5)

i Re Te

ā

The phases of the beam splitter coeļ¬cients have been chosen so that t = T is real and

ā

r = i R is pure imaginary, where T and R are respectively the intensity transmission

and reļ¬‚ection coeļ¬cients.

The SQLG is designed to emit a squeezed state for the quadrature

1 ā’iĪ²

e a2 + eiĪ² aā ,

X2 = (20.6)

2

2

Ā¼

Telecommunications

Fig. 20.1 Modiļ¬ed beam splitter for noiseless

branching. The OPA injects squeezed light into

port 2 and the phase plates are used to obtain

a convenient form for the scattering matrix.

so an application of eqn (15.39) produces the variances

eā’2r e2r

V (X2 ) = , V (Y2 ) = , (20.7)

4 4

where Y2 is the conjugate quadrature and r is the magnitude of the squeezing para-

meter. For the special values Īø = ā’Ļ/2 and Īø = Ļ/2 the inputā“output relations for

the amplitude quadratures are

ā ā

X1 T āR X1

ā

= , (20.8)

ā’R

X2 X2

T

where the quadratures for the input channel 1, and the output channels 1 and 2 are

deļ¬ned by the angle Ī² used in eqn (20.6).

Let us now specialize to a balanced beam splitter, and assume that the signal is

carried by X1 . The squeezed state satisļ¬es X2 = 0; consequently, the two output

signals have the same average:

1

X1 = X2 = ā X1 . (20.9)

2

Since the input signal X1 and the SQLG output are uncorrelated, the variances of the

output signals X1 and X2 are also identical:

Ā¼ Quantum information

eā’r

1

V (X1 ) = V (X2 ) = V (X1 ) + . (20.10)

2 8

The 50% reduction of the output variances compared to the input variance does

not mean that the output signals are quieter; it merely reļ¬‚ects the reduction of the

ā

amplitudes by the factor 1/ 2. This can be seen by deļ¬ning the signal-to-noise ratios,

2 2

| Xm | | Xm |

SNR (Xm ) = , SNR (Xm ) = (m = 1, 2) , (20.11)

V (Xm ) V (Xm )

and using the previous results to ļ¬nd

SNR (X1 )

SNR (X1 ) = SNR (X2 ) = . (20.12)

1 + eā’r / [4V (X1 )]

In the limit of strong squeezing, this coupler almost exactly preserves the signal-

to-noise ratio of the input signal. Consequently, the output signals are faithful copies

of the input signal down to the level of the quantum ļ¬‚uctuations. The injection of the

squeezed light into port 2 has eļ¬ectively diverted almost all of the partition noise into

the unobserved output quadratures Y1 and Y2 .

This scheme succeeds in splitting the signal without adding any noise, but at the

cost of reducing the intensity of the output signals by 50%. This drawback can be

overcome by inserting a noiseless ampliļ¬er, e.g. the traveling-wave OPA described in

Section 16.3.2, prior to port 1 of the beam splitter. The gain of the ampliļ¬er can

be adjusted so that each of the split signals has the same strength and the same

signal-to-noise ratio as the original signal.

20.2 Quantum cloning

At ļ¬rst glance, it may seem that the noiseless beam splitter of Section 20.1.3 produces

a perfect copy or clone of the input signal. This impression is misleading, since only the

expectation values and variances of the particular input quadrature X1 are faithfully

copied; indeed, the variance of the output conjugate quadrature Y1 is much larger than

the variance of Y1 .

This observation suggests a general question: To what extent does quantum theory

allow cloning? In the following section, we will review the famous no-cloning theorem

(Dieks, 1982; Wootters and Zurek, 1982), which outlaws perfect cloning of an unknown

quantum state.

We should note that this work was not done to answer the question we have

just raised. It was a response to a proposal by Herbert (1982) for a superluminal

communications scheme employing EPR correlations. The connection between no-

cloning and no-superluminal-signaling is a recurring theme in later work (Ghirardi

and Weber, 1983; Bussey, 1987).

The no-cloning theorem quickly became an important physical principle which

was, for example, used to argue for the security of quantum cryptography (Bennett

and Brassard, 1984). The ļ¬nal step in the initial development was the extension of the

result from pure to mixed states (Barnum et al., 1996).

Ā¼

Quantum cloning

This was immediately followed by the work of BuĖek and Hillery (1996) who began

z

the investigation of imperfect cloning. We will study the degree of cloning allowed by

quantum theory in Section 20.2.2.

In the study of quantum information, the systems of interest are usually described

by states in a ļ¬nite-dimensional Hilbert space Hsys . For the special case of two-state

systemsā”e.g. a two-level atom, a spin-1/2 particle, or the two polarizations of a

photonā”Hsys is two-dimensional, and a vector |Ī³ in Hsys is called a qubit. The

generic description of qubits employs the so-called computational basis {|0 , |1 }

deļ¬ned by

Ļz |0 = |0 , Ļz |1 = ā’ |1 . (20.13)

In this notation a general qubit is represented by |Ī³ = Ī³0 |0 + Ī³1 |1 .

In the more general case, dim (Hsys ) = d > 2, the state is called a qudit. We will

follow the usual convention by referring to the systems under study as qubits, but

it should be kept in mind that many of the results also hold in the general ļ¬nite-

dimensional case. In the interests of simplicity, we will only treat closed systems un-

dergoing unitary time evolution.

For the applications considered below, it is often necessary to consider one or more

ancillary (helper) systems in addition to the system of interest. The reservoirs used

in the treatment of dissipation in Chapter 14 are an example of ancillary systems or

ancillas. In that case the unitary evolution of the closed sampleā“reservoir system was

used to derive the dissipative equations by tracing over the ancilla degrees of freedom.

Another common theme in this ļ¬eld is the assumption that the total system consists

of a family of distinguishable qubits. The Hilbert space H for the system is H =

HQ ā— Hanc , where Hanc and HQ are respectively the state spaces for the ancillas and

the family of qubits. This abstract approach has the great advantage that the results

do not depend on the speciļ¬c details of particular physical realizations, but there are,

nevertheless, some implicit physical assumptions involved.

If the qubits are particles, thenā”as we learnt in Section 6.5.1ā”the Hilbert space

HQ for two qubits is

(Hsys ā— Hsys )sym for bosons ,

HQ = (20.14)

(Hsys ā— Hsys )asym for fermions .

For massive particlesā”e.g. atoms, molecules, quantum dots, etc.ā”a way around this

complication is to choose an experimental arrangement in which each particleā™s center-

of-mass position can be treated classically. In these circumstances, as we saw in Section

6.5.2, the symmetrization or antisymmetrization normally required for identical par-

ticles can be ignored. In this model, a qubit located at ra is described by a copy of

Hsys , called Ha . The vectors |Ī³ a in Ha represent the internal states of the qubit.

For a family of two qubits, located at ra and rb , the space HQ is the unsymmetrized

tensor product: HQ = Ha ā— Hb . The Bell states, ļ¬rst deļ¬ned in Section 13.3.5 for

photons, are represented by

Ā¼ Quantum information

1

ĪØĀ± = ā {|1, 0 Ā± |0, 1 ab } ,

ab

ab

2

(20.15)

1

Ā±

= ā {|0, 0 Ā± |1, 1 ab } ,

Ī¦ ab

ab

2

where

ā” |u |v b .

|u, v (20.16)

ab a

More features of the Bell states can be found in Exercise 20.3.

In the general case of qubits located at r1 , . . . , rN the qubit space is

N

HQ = Ha , (20.17)

a=1

and a generic state is denoted by |u1 , . . . , uN 12Ā·Ā·Ā·N . When no confusion will result, the

notation is simpliļ¬ed by omitting the subscripts on the kets, e.g. |u, v ab ā’ |u, v . The

application of these ideas to photons requires a bit more care, as we will see below.

20.2.1 The no-cloning theorem

For closed systems, we can assume that every physically permitted operation is de-

scribed by a unitary transformation U acting on the Hilbert space H describing the

qubits and the ancillas. To set the scene for the cloning discussion, we assume that

there is a set of qubits, |B b , all in the same (internal) blank state |B , and a cloning

device which is initially in the ready state |R anc ā Hanc .

If we only want to make one copyā”this is called 1 ā’ 2 cloningā”the total initial

state is

|Ī³, B, R ā” |Ī³ a ā— |B b ā— |R anc = |Ī³ a |B b |R anc . (20.18)

The cloning assumption is that there is a unitary operator U such that

U |Ī³, B, R = |Ī³, Ī³, RĪ³ = |Ī³ |Ī³ |RĪ³ , (20.19)

a b anc

where |RĪ³ anc is the state of the cloner after it has cloned the state |Ī³ a . In this

approach, cloning is not the creation of a new particle, but instead the imposition of

a speciļ¬ed internal state on an existing particle.

After this preparation, the no-cloning theorem can be stated as follows (Scarani

et al., 2005).

Theorem 20.1 There is no quantum operation that can perfectly duplicate an un-

known quantum state.

We will use a proof given by Peres (1995, Sec. 9-4) that exhibits a contradiction

following from the assumption that a cloning operation does exist, i.e. that there is a

unitary operator satisfying eqn (20.19).

Ā¼

Quantum cloning

Since the cloning device is supposed to work in the absence of any knowledge of

the initial state, it must be possible to use U to clone a diļ¬erent state |Ī¶ , so that

U |Ī¶, B, R = |Ī¶, Ī¶, RĪ¶ . (20.20)

A direct use of the unitarity of U yields

Ī³, Ī³, RĪ³ | Ī¶, Ī¶, RĪ¶ = Ī³, B, R| Ī¶, B, R = Ī³ |Ī¶ , (20.21)

where we have imposed the convention that the initial states |R anc , |Ī³ a , |B b , and

|Ī¶ a are all normalized and that the inner product between internal states does not

depend on the location of the qubit.

Using the explicit tensor products in eqns (20.19) and (20.20) produces the alter-

native form

2

Ī³, Ī³, RĪ³ | Ī¶, Ī¶, RĪ¶ = RĪ³ |RĪ¶ Ī³ |Ī¶ . (20.22)

For non-orthogonal qubits, |Ī³ and |Ī¶ , equating the two results leads to

RĪ³ |RĪ¶ Ī³ |Ī¶ = 1 . (20.23)

The inner product RĪ³ |RĪ¶ automatically satisļ¬es | RĪ³ |RĪ¶ | 1, and we can

always choose |Ī³ and |Ī¶ so that | Ī³ |Ī¶ | < 1; therefore, there are states |Ī³ and |Ī¶

for which eqn (20.23) cannot be satisļ¬ed. This contradiction proves the theorem.

This elegant proof shows that the impossibility of perfect cloning of unknown, and

hence arbitrary, states is a fundamental feature of quantum theory; indeed, the only

requirement is that quantum operations are represented by unitary transformations.

In this respect it is similar to the Heisenberg uncertainty principle, for which the sole

requirement is the canonical commutation relation [q, p] = i .

We should emphasize, however, that this argument only excludes universal clon-

ing machines, i.e. those that can clone any given state. This leaves open the possibility

that speciļ¬c states could be cloned. In fact the argument does not prohibit the cloning

of each member of a known set of mutually orthogonal states.

The application of this theorem in the context of quantum optics raises some

problems. The proof rests on the assumption that the qubits are distinguishable and

localizable, but photons are indistinguishable, massless bosons that cannot be precisely

localized and are easily created and destroyed. Thus it is not immediately obvious that

the proof of the no-cloning theorem given above applies to photons.

A second problem arises from the observation that stimulated emissionā”which

produces new photons with the same wavenumber and polarization as the incident

photonsā”would seem to provide a ready-made copying mechanism. Why is it that

stimulated emission is not a counterexample to the no-cloning theorem? In the follow-

ing paragraphs we will address these questions in turn.

Since photons are indistinguishable bosons, we cannot add any identifying subscript

to a photonic qubit |Ī³ , and the two-qubit space is the two-photon Fock space, H(2) .

The simplest way to deļ¬ne a photonic qubit is to choose a speciļ¬c wavevector k, and

set |Ī³ = Ī“ā |0 , where

Ī³ks aā .

Ī“ā = (20.24)

ks

s

Since s takes on two values, the state |Ī³ qualiļ¬es as a qubit.

Ā½Ā¼ Quantum information

Cloning this qubit can only mean that a second photon is added in the same mode;

therefore, the cloning transformation (20.19) for this case would be

1

U Ī“ā |0 |R = ā Ī“ā 2 |0 |RĪ³ . (20.25)

anc anc

2

By contrast to the distinguishable qubit model, the polarization state is not imposed

on an existing photon in a blank state; instead, a new photon is created with the same

polarization as the original. Despite this signiļ¬cant physical diļ¬erence, a similar proof

of the no-cloning theorem can be constructed by following the hints in Exercise 20.4.

The proof of the no-cloning theoremā”either the standard version starting with

eqn (20.19) or the photonic version treated in Exercise 20.4ā”does not suggest any

speciļ¬c mechanism that prevents cloning. Finding a mechanism of this sort for photons

turns out to be related to the second problem noted above. Could stimulated emission

provide a cloning method?

The discussion of stimulated emission starts with a photon incident on an atom in

an excited state. In this case, the nonzero ratio A/B = k 3 /Ļ 2 = 0 of the Einstein

A and B coeļ¬cients provides the essential clue: stimulated emission is unavoidably

accompanied by spontaneous emission. Since the spontaneously emitted photons have

random directions and polarizations, they will violate the cloning assumptions (20.25).

This argument eliminates cloning machines based on excited atoms, but what about

parametric ampliļ¬ers, such as the traveling-wave OPA in Section 16.3.2, in which

there are no population inversions and, consequently, no excited atoms? This possible

loophole was closed by the work of Milonni and Hardies (1982), in which it is shown

that stimulated emission is necessarily accompanied by spontaneous emission, even in

the absence of inverted atoms.

In the context of quantum optics, the impossibility of perfect, universal cloning

can therefore be understood as a consequence of the unavoidable pairing of stimulated

and spontaneous emission.

The no-cloning theorem does not exclude devices that can clone each member of a

known set of orthogonal states. For example, two orthogonal polarization states can be

cloned by exploiting stimulated emission. For this purpose, suppose that the sum over

polarizations in eqn (20.24) refers to the linear polarization vectors eh (horizontal)

and ev (vertical ).

The cloning device consists of a trap containing a single excited atom, followed by

a polarizing beam splitter. The PBS is oriented so that h- and v-polarized photons

are sent through ports 1 and 2 respectively. For an initial state |1kh , the ļ¬rst-order

perturbation calculation suggested in Exercise 20.5 shows that the combination of

stimulated and spontaneous emission produces an output state proportional to

ā

2 |2kh + |1kh , 1kv . (20.26)

Since the PBS sends the unwanted v-polarized photon through port 2, the only two-

photon state emitted through port 1 is the desired cloned state |2kh . The argument

is symmetrical under the simultaneous exchange of h with v and port 1 with port 2;

therefore, the device is equally good at cloning v-polarized photons.

Ā½Ā½

Quantum cloning

This design produces perfect clones of each state in the basis, but only if the

basis is known in advance, so that the PBS can be properly oriented. As usual, the

experimental realization is a diļ¬erent matter. This idea depends on having detectors

that can reliably distinguish between one and two photons in a given mode, but such

detectors areā”to say the leastā”very hard to ļ¬nd.

Since classical theory is an approximation to quantum theory, we are left with a

ļ¬nal puzzle: How is it that the no-cloning theorem does not prohibit the everyday

practice of amplifying and copying classical signals? To understand this, we observe

that for an incident state with ni photons, the total emission probability for the

ampliļ¬er is proportional to ni +1, where ni and 1 respectively correspond to stimulated

and spontaneous emission.

If ni = 1, the two processes are equally probable, but if ni 1, then stimulated

emission dominates the output signal. Thus the classical copying process can achieve

its aim, despite the fact that it cannot create a perfect clone of the input.

Quantum cloning machinesā—

20.2.2

The ideal cloning operation in eqn (20.19) wouldā”if only it were possibleā”produce

an exact copy of a qubit without damaging the original. In their seminal paper on

imperfect cloning, Hillery and BuĖek posed two questions: (1) How close can one come

z

to perfect cloning? (2) What happens to the original qubit in the process?

Attempts to answer these questions have generated a large and rapidly developing

ļ¬eld of research. In the remainder of this section, we will give a very brief outline of the

basic notions, and discuss one optical implementation. For those interested in a more

detailed account, the best strategy is to consult a recent review article, e.g. Scarani

et al. (2005) or Fan (2006).

A Cloning distinguishable qubitsā—

The unattainable ideal of perfect cloning is replaced by the idea of a quantum cloning

machine (QCM), which consists of a chosen ancillary state |R anc in Hanc and a

unitary transformation U acting on H = HQ ā— Hanc . We will only discuss the simplest

case of 1 ā’ 2 cloning, for which the action of U on the initial state |Ī³, B, R deļ¬nes

the cloned state

|Ī³; Ī³ ā” U |Ī³, B, R . (20.27)

In general, the vector |Ī³; Ī³ represents an entangled state of the ancilla and the two

qubits, so the state of the qubits alone is described by the reduced density operator

Ļab = Tranc |Ī³; Ī³ Ī³; Ī³| , (20.28)

where the trace is deļ¬ned by summing over a basis for the ancillary space Hanc . The

states of the individual qubits are in turn represented by the reduced density operators

Ļa = Trb Ļab and Ļb = Tra Ļab . (20.29)

The task is to choose |R anc and U to achieve the best possible result, as opposed

to imposing the form of |Ī³; Ī³ a priori. This eļ¬ort clearly depends on deļ¬ning what is

meant by ā˜best possibleā™.

Ā½Ā¾ Quantum information

Of the many available measures of success, the most commonly used is the ļ¬delity:

Fa (Ī³) = a Ī³ |Ļa | Ī³ , Fb (Ī³) = b Ī³ |Ļb | Ī³ , (20.30)

a b

which measures the overlap between the mixed state produced by the cloning operation

and the original pure state. A QCM is said to be a universal QCM if the ļ¬delities

are independent of |Ī³ , i.e. the machine does equally well at cloning every state.

A nonuniversal QCM is called a state-dependent QCM. The QCM is a sym-

metric QCM if the ļ¬delities of the output states are equal, i.e. Fa (Ī³) = Fb (Ī³), and

it is an optimal QCM if the ļ¬delities are as large as quantum theory allows.

The unitary operator U for a QCM is linear, so its action on the general input

state |Ī³, B, R is completely determined by its action on the special states |0, B, R

and |1, B, R , where 0 and 1 label the computational basis vectors deļ¬ned by eqn

(20.13). For the BuĖekā“Hillery QCM, the ancilla consists of a single qubit, |R anc =

z

R0 |0 anc + R1 |1 anc , and the transformation U is deļ¬ned by

2 1+

|0 a |0 b |1 anc ā’

U |0, B, R = ĪØ ab |0 anc , (20.31)

3 3

2 1+

|1 a |1 b |1 anc +

U |1, B, R = ā’ ĪØ ab |1 anc . (20.32)

3 6

The Bell state |ĪØ+ ab is deļ¬ned in eqn (20.15). In Exercise 20.6, these explicit

expressions are used to evaluate the reduced density operators Ļa and Ļb which yield

the ļ¬delities Fa (Ī³) = Fb (Ī³) = 5/6. Thus the BuĖekā“Hillery QCM is universal and

z

symmetric. It has also been shownā”see the references given in Scarani et al. (2005)ā”

that it is optimal.

Cloning photonsā—

B

In order to carry out an actual experiment, the abstractions of the preceding discus-

sion must be replaced by real hardware. Furthermore, the application of these ideas

in quantum optics also requires a more careful use of the theory. Both of these con-

siderations are illustrated by an experimental demonstration of a cloning machine for

photons (Lamas-Linares et al., 2002).

The basic idea, as shown in Fig. 20.2, is to use stimulated emission in a type

II down-conversion crystal, which is adjusted so that the down-converted photons

propagating along certain directions are entangled in polarization (Kwiat et al., 1995b).

1

Pump

Fig. 20.2 Schematic for a photon cloning ma-

2

chine. The type II down-converter produces

1

nondegenerate signal and idler modes with

Down-

wavevectors k1 (mode 1) and k2 (mode 2). The

converter

photons are entangled in polarization.

Ā½Āæ

Quantum cloning

The pump beam and the single photon to be injected into the crystal are both derived

from a Tiā“sapphire laser producing 120 fs pulses. The pump is created by frequency-

doubling the laser beam, and the single-photon state is generated by splitting oļ¬ a

small part of the beam, which is then attenuated below the single-photon level.

With this method, there is still a small probability that two photons could be

injected. If no down-conversion occurs, the transmitted two-photon state will appear as

a false count for cloning. These false counts can be avoided by triggering the detectors

for the k1 -photons with the detection of the conjugate k2 -photon, which is a signature

of down-conversion.

To model this situation, we ļ¬rst pick a pair of orthogonal linear polarizations, eh

and ev , for each of the wavevectors. The production of polarization-entangled signal

and idler modes is then described by the interaction Hamiltonian

HSS = ā„¦P aā 1 v aā 2 h ā’ aā 1 h aā 2 v + HC . (20.33)

k k k k

By following the hints in Exercise 20.7, one can show that this Hamiltonian is invariant

under joint and identical rotations of the two polarization bases around their respective

wavevectors.

The cloning eļ¬ect is consequently independent of the polarization of the input

photon; that is, this should be a universal QCM. It is therefore suļ¬cient to con-

sider a particular input state, say |1k1 v = aā 1 v |0 , which evolves into |Ļ• (t) =

k

exp (ā’iHSS t/ ) |1k1 v . The relevant time t is limited by the pulse duration of the

pump, which satisļ¬es ā„¦P tP 1; therefore, the action of the evolution operator can

be approximated by a Taylor series expansion of the exponential in powers of ā„¦P t:

|Ļ• (t) ā {1 ā’ iHSS t/ + Ā· Ā· Ā· } |1k1 v

ā

= |1k1 v ā’ iā„¦P t 2 |2k1 v , 1k2 h ā’ |1k1 v , 1k1 h , 1k2 v + Ā· Ā· Ā· . (20.34)

This result for |Ļ• (t) displays the probabilistic character of this QCM; the most

likely outcome is that the injected photon passes through the crystal without producing

a clone. The cloning eļ¬ect occurs with a probability determined by the ļ¬rst-order

ā

term in the expansion. The factor 2 in the ļ¬rst part of this expression represents the

enhancement due to stimulated emission.

According to von Neumannā™s projection rule, the detection of a trigger photon with

wavevector k2 and either polarization leaves the system in the state

P2 |Ļ• (t)

|Ļ• (t) = , (20.35)

red

Ļ• (t) |P2 | Ļ• (t)

where

P2 = |1k2 v 1k2 v | + |1k2 h 1k2 h | (20.36)

is the projection operator describing the reduction of the state associated with this

measurement. Combining eqns (20.34) and (20.36) yields

2 1

|Ļ• (t) = ā’i |2k1 v , 1k2 h ā’ |1k1 v , 1k1 h , 1k2 v . (20.37)

red

3 3

Ā½ Quantum information

The probability of detecting two photons in the mode k1 v is 2/3 and the probability

of detecting one photon in each of the modes k1 v and k1 h is 1/3. The factor of two

between the probabilities is also a consequence of stimulated emission.

The indistinguishability of the photons guarantees that the QCM is symmetric, but

it also prevents the deļ¬nition of reduced density operators like those in eqn (20.29).

In this situation, the cloning ļ¬delity can be deļ¬ned as the probability that an output

photon with wavevector k1 has the same polarization as the input photon. This hap-

pens with unit probability for the ļ¬rst term in |Ļ• (t) red and with probability 1/2 in

the second term; therefore, the ļ¬delity is

2 1 1 5

Ć— (1) + Ć—

F= = . (20.38)

3 3 2 6

The theoretical model for this QCM therefore predicts that it is universal, symmetric,

and optimal.

In the experiment, the incident photon ļ¬rst passes through an adjustable optical

delay line, which is used to control the time lapse āT between its arrival and that of

the laser pulse that generates the down-converted photons. Stimulated emission should

only occur when the photon wave packet and the pump pulse overlap. The results of

the experiment, which are shown in Fig. 20.3, support this prediction.

The number of counts, N (2, 0), with two photons in the mode k1 v and no photon in

the mode k1 h is shown in Fig. 20.3 as a function of the distance cāT , for three diļ¬erent

polarization statesā”curves (a)ā“(c)ā”of the injected photon. As expected, there is a

pronounced peak at zero distance. The corresponding plots (d)ā“(f) of N (1, 1)ā”the

number of counts with one photon in each polarization modeā”show no such eļ¬ect.

The experimental ļ¬delity can be derived from the ratio

Npeak (2, 0)

R= (20.39)

Nbase (2, 0)

between the peak value and the base value of the N (2, 0) curve. At maximum overlap

between the incident single-photon wave packet and the pump pulse (cāT = 0), the

probability of the (2, 0)-conļ¬guration is

Npeak (2, 0)

P (2, 0) = , (20.40)

Npeak (2, 0) + Npeak (1, 1)

which becomes

R

P (2, 0) = (20.41)

R + Npeak (1, 1) /Nbase (2, 0)

when expressed in terms of R.

The base values Nbase (1, 1) and Nbase (2, 0) represent the situation in which there

is no overlap between the single-photon wave packet and the pump pulse. In this case,

the detection of the original photon and a down-converted photon in the spatial mode

k1 are independent events. Down-conversion produces k1 v and k1 h photons with equal

Ā½

Quantum cloning

Linear 0o

(a) (d)

1200

500

1000

Counts (100s)

400

800

300

600

200

400

N(2,0) N(1,1)

100 200

0 0

ā’100 ā’50 ā’100 ā’50

0 50 100 0 50 100

Linear 45o

(b) (e)

1000

500

Counts (100s)

800

400

600

300

400

200

N(2,0) N(1,1)

200

100

0 0

ā’100 ā’50 0 50 100 ā’100 ā’50 0 50 100

Left circular

(c) (f)

800

400

Counts (100s)

600

300

400

200

N(2,0) N(1,1)

200

100

0

0

ā’100 ā’50 ā’100 ā’50

0 50 100 0 50 100

Position (Āµm) Position (Āµm)

Fig. 20.3 Plots (a)ā“(c) show N (2, 0) as a function of cāT for linear at 0ā—¦ (vertical), linear

at 45ā—¦ , and left circular polarizations respectively. Plots (d)ā“(f) show N (1, 1) for the same

polarizations. (Reproduced from Lamas-Linares et al. (2002).)

probability; therefore, the probability that the polarizations of the two k1 -photons are

the same is 1/2. This implies that

Nbase (1, 1) = Nbase (2, 0) . (20.42)

The apparent disagreement between eqn (20.42) and the data in the plot pairs (a) and

(d), (b) and (e), and (c) and (f) is an artefact of the detection method used to count

the (2, 0)-conļ¬gurations; see Exercise 20.7.

The data show that Npeak (1, 1) = Nbase (1, 1); therefore

R

P (2, 0) = , (20.43)

R+1

Ā½ Quantum information

and

1

P (1, 1) = . (20.44)

R+1

Applying the argument used to derive eqn (20.38) leads to

1 1 R + 1/2

R

Ć—1+ Ć— = . (20.45)

F=

R+1 R+1 2 R+1

The data yield essentially the same ļ¬delity, F = 0.81 Ā± 0.01, for all polarizations. This

is close to the optimal value F = 5/6 0.833; consequently, this QCM is very nearly

universal and optimal.

20.3 Quantum cryptography

The history of cryptographyā”the art of secure communication through the use of

secret writing or codesā”can be traced back at least two thousand years (Singh, 1999),

and the importance of this subject continues to increase. In current practice, the

message is expressed as a string of binary digits M , and then combined with a second

string, known as the key, by an algorithm or cipher. The critical issue is the possibility

that the encrypted message could be read by an unauthorized person.

For most applications, it is suļ¬cient to make this task so diļ¬cult that the message

remains conļ¬dential for as long as the information has value. The commonly employed

method of public key cryptography enforces this condition by requiring the solution

of a computationally diļ¬cult problem, e.g. factoring a very large integer. This kind of

encryption is not provably secure, since it is subject to attack by cryptanalysis, e.g.

through the use of better factorization algorithms or faster computers.

In classical cryptography, the only provably secure method is the one-time pad,

i.e. the key is only used once (Gisin et al., 2002). In one version of this scheme, the

key shared by Alice and Bob is a randomly generated number K which must have a

binary representation at least as long as the message. Since the binary digits of K are

random, the key itself contains no information. Alice encrypts her message as the signal

S = M ā• K, where ā• indicates bit-wise addition without carry, i.e. addition modulo

2. This means that corresponding bits are added according to the rules 0 + 0 = 0,

0 + 1 = 1, and 1 + 1 = 0.

The bits of S are as random as those of K, so the signal carries no information

for Eve, the lurking eavesdropper. On the other hand, Bob can decipher the message

by bit-wise subtraction of K from S to recover M . The security of the messages is

weakened by repeated use of the key. For example, if two messages M 1 and M 2 are

sent, then the identity K ā• K = 0 implies

S1 ā• S2 = M 1 ā• K ā• M 2 ā• K

= M1 ā• M2 ā• K ā• K

= M1 ā• M2 . (20.46)

The bits in M 1 and M 2 are not random; therefore, Eve gains some information about

the messages themselves. With enough messages, the encryption system could be bro-

ken.

Ā½

Quantum cryptography

The use of a one-time pad solves the problem of secure communication, only to raise

a new problem. How is the key itself to be safely transmitted through a potentially

insecure channel? If Alice and Bob have to meet for this purpose, she might as well

deliver the message itself.

One of the most intriguing discoveries in recent years (Wiesner, 1983; Bennett and

Brassard, 1984, 1985) is that the peculiar features of quantum theory oļ¬er a solution

to the problem of secure transmission of cryptographic keys. Once this is done, the

message itself can be sent as a string of classical bits. Thus quantum cryptography

really reduces to the secure transmission of keys, i.e. quantum key distribution.

A quantum method for distributing a key evidently involves encoding the key in the

quantum states of some microscopic system. Since the electromagnetic ļ¬eld provides

the most useful classical communication channel, it is natural to use a property of

photons, e.g. polarization, to carry the information in a quantum channel.

As a concrete illustration, consider orthogonal linear polarizations eh (k) and ev (k)

that deļ¬ne the basis of single-photon states:

B = |h = aā |0 , |v = aā |0 . (20.47)

kh kv

One can then encode 0 as |h and 1 as |v . We will see below that a scheme based on

B alone is too simple to foil Eve, so we add a second basis

h = aā |0 , |v = aā |0

B= , (20.48)

kv

kh

where the new polarization basis

1

eh (k) = ā [eh (k) + ev (k)] ,

2

(20.49)

1

ev (k) = ā [ev (k) ā’ eh (k)]

2

is the ļ¬rst polarization basis rotated through 45ā—¦ . The creation operators and the

single-photon basis states transform just like the polarization vectors. The correspond-

ing encoding for B is: 0 ā” h and 1 ā” |v .

The two basis sets have the essential property that no member of one basis is

orthogonal to either member of the other. The bases are also as diļ¬erent as possible,

2

in the sense that | s |s | = 1/2 for s = h, v and s = h, v. Pairs of bases related in this

way are said to be mutually unbiased, and they are a feature of many quantum key

distribution schemes.

20.3.1 The BB84 protocol

We now consider the BB84 protocol, named after Bennett and Brassard and the year

they proposed the scheme (Bennett and Brassard, 1984). In the initial step, Alice sends

a string of photons to Bob. For each photon, she uses a random number generator to

choose a polarization from the four possibilities in B and B. At this stage, the only

restriction is that Bob and Alice must be able to establish a oneā“one correspondence

between the transmitted and received photons.

Ā½ Quantum information

Bob, who is equipped with an independent random number generator, chooses one

of the basis sets, B or B, in which to measure each incoming photon. If Alice sends |h

or |v and Bob happens to choose B, his measurement will pick out the correct state,

and his bit assignment will exactly match the one Alice sent. If, on the other hand,

Bob chooses B, then a measurement on |h will yield h or |v with equal probability.

Thus if Alice sent 0, Bob will assign 1 half the time. Since Bob will make the wrong

choice of basis about half the time, his average error rate will be 25%. The bit string

resulting from this procedure is called the raw key.

An error rate of 25% would overwhelm any standard error correction scheme, but

the BB84 protocol provides another option. For each bit, Bob announcesā”through

the insecure public channelā”his choice of measurement basis, but not the result of

his measurement. Alice replies by stating whether or not the encoding basis and the

measurement basis agree for that bit. If their bases agree, the bit is kept; otherwise,

it is discarded. The remaining bit string, which is about half the length of the raw

string, is called the sifted key.

The ļ¬rst experimental demonstration of this scheme was a table top experiment

in which the signals from Alice to Bob were carried by faint pulses of light containing

less than one photon on average (Bennett et al., 1992). The distance between sender

and receiver in this experiment was only 30 cm, but within a few years quantum key

distribution was demonstrated (Muller et al., 1995, 1996) over a distance of 23 km with

signals carried by a commercial optical ļ¬ber network.

In order to understand the quantum basis for the security of the BB84 protocol,

let us ļ¬rst imagine an alternative in which the bits are encoded in classical pulses of

polarized light. If Eve intercepts a particular pulse, so that it does not arrive at Bobā™s

detector, then Alice and Bob can agree to discard that bit from the string. This lowers

the bit rate for transmitting the key, but Eve gains no information.

Thus it is not enough for Eve to detect the pulse; she must also make a copy

for herself and send the original on to Bob. This tactic would provide information

about the key without alerting Alice and Bob. In the classical case, this procedure

isā”at least in principleā”always possible. For example, Eve could split oļ¬ a small

part of each pulse by means of a strongly unbalanced beam splitter, and record the

polarization. The remaining pulse could then be ampliļ¬ed to match the original, and

sent on to Bob.

Eve faces the same problem for the quantum BB84 protocol. She must make a

copy of each single-photon state sent by Alice, and then send the original on to Bob.

Furthermore, she must be able to do this for photons described by either of the bases

B or B. Since the basis vectors in B are not orthogonal to the basis vectors in B, this

is precisely what the no-cloning theorem says cannot be done.

Furthermore, when Eve intercepts a signal and sends a new signal on to Bob,

she is boundā”again according to the no-cloning theoremā”to make a certain number

of errors on average. If she carries out this strategy too often, Alice and Bob will

become aware of her activity. According to this ideal description, the BB84 protocol

is invulnerable to attack.

In practiceā”as one might expectā”things are more complicated. Transmission of

the key will be degraded by technical imperfections as well as Eveā™s machinations. It

Ā½

Entanglement as a quantum resource

is also possible for Eve to gain some knowledge of the key by means of the imperfect

cloning methods discussed in Section 20.2.2, without necessarily revealing her presence

to Alice and Bob. The techniques for countering such attacks are primarily classical

in nature (Gisin et al., 2002), so we will not pursue them further.

Thus the no-cloning theoremā”which was originally introduced as a purely negative

statement about quantum theoryā”is the conceptual basis for the security of quantum

key distribution protocols. In this connection, it is important to realize that the classi-

cal proof of the absolute security of the one-time pad depends on the assumption that

the bits of K are truly random. For this reason, the choices made by Alice and Bob

must be equally random.

This turns out to be a rather delicate issue. The standard random number gen-

erators for computers are deterministic programs of ļ¬nite length; consequently, their

output cannot be truly random. The ultimate security of BB84, or any other quantum

key distribution protocol, therefore depends on generating a truly random sequence

of numbers by some physical means. The behavior of a single photon at a beam split-

ter provides a natural way to satisfy this need. A single photon incident on an ideal

balanced beam splitter with 100% detectors at each output port willā”according to

quantum theoryā”generate a perfectly random sequence of ļ¬rings in the detectors.

Associating 0 with one detector and 1 with the other deļ¬nes a perfect coin ļ¬‚ip.

As always, reality is more complicated; for example, the dead time of real detectors

can impose a strong anti-correlation between successive bits. This eļ¬ect limits the bit

rate of quantum random number generation to a few megahertz (Gisin et al., 2002).

Leaving these practical issues aside, we see that the security of quantum key distribu-

tion is guaranteed by the perfectly random nature of individual quantum events. This

is a historically unique situation; the security of quantum cryptography ultimately

depends on the validity of quantum theory itself.

20.4 Entanglement as a quantum resource

The quantum eļ¬ects on communications studied in the previous sections are primarily

a source of diļ¬culties. The use of phase-sensitive ampliļ¬ers to eliminate the quantum

noise added by ampliļ¬cation, and the injection of squeezed light to minimize branching

noise at an optical coupler are responses to these diļ¬culties.

The role of the no-cloning theorem in providing a basis for the secure transmission

of a cryptographic key is usually presented in a positive light, but this is a partisan

view. For the frustrated Eve, the no-cloning theorem is still a negative result.

In these applications, quantum theory may provide new options, but it does not

provide any new resources. For example, the qubits used by Alice and Bob in the key

distribution protocol each carry only one classical bit, sometimes called a cbit.

It is the fundamental quantum property of entanglement that provides a novel

communications resource. In the present section, we will consider two examples, quan-

tum dense coding and quantum teleportation, which employ this resource. In both

cases the ancilla is an entangled qubit pair provided by an external source, and Alice

and Bob are each provided with one qubit of the pair. Local operations carried out

by Alice and Bob on their respective qubits change the entangled state in a nonlocal

way, and detection of these changes can be used to transfer information.

Ā¾Ā¼ Quantum information

Before considering the speciļ¬c applications, we must discuss some special features

arising from the use of photons to carry the qubits. The abstract language used above

implicitly assumes that the qubits are distinguishable quantum systems with deļ¬nite

locations. Since photons are indistinguishable bosons that cannot be precisely local-

ized, there appears to be a conceptual problem.

The ļ¬rst point to note is that the indistinguishability of photons renders state-

ments like ā˜Bob carries out a local operation on his photonā™ meaningless. The correct

statement is ā˜Bob carries out a local operation on a photon.ā™ This brings us to the

second point: the word ā˜localā™ in ā˜local operationā™ applies to the hardware that realizes

the theoretical manipulation, not to the photon.

We made this remark for detectors in Section 6.6.2, but it applies equally to retarder

plates, beam splitters, etc. These classical devicesā”unlike photonsā”are both distin-

guishable and localizable. On the other hand, the physical operations they perform are

represented by unitary operators that apply to the entire state of the electromagnetic

ļ¬eld. By virtue of the peculiar properties of entangled states, this means that local

operations can have nonlocal eļ¬ects.

In the experiments we will discuss, the photons in the pair are ideally described

by plane waves, with wavevectors kA (directed toward Alice) and kB (directed to-

ward Bob), and equal frequencies, ĻA = ĻB . An example is shown in Fig. 20.4. The

polarization-entangled, two-photon state emitted by the source is therefore a super-

position of the states |1kA s , 1kB s , where s, s = h, v.

We will only consider situations with ļ¬xed directions for the wavevectors, so the

shorthand notation

2 bits 2 bits

OUT IN

ALICE

1 photon

(Bell BOB

state (encoder)

measurer)

Fig. 20.4 Quantum dense coding: a source

1 photon k) 1 photon k*

of polarization-entangled photons provides a

communications resource. Bobā™s local opera-

Source of

tions on a photon alter the nonlocal entangled polarization-

state, so that a single photon sent from Bob to entangled

photons

Alice allows her to receive two bits of informa-

tion.

Ā¾Ā½

Entanglement as a quantum resource

ā” aā Ī³ s a ā Ī³ |0 for (Ī³, s) = (Ī³ , s ) ,

s Ī³ , sĪ³ k k s

(20.50)

1

|sĪ³ , sĪ³ ā” ā aā 2 s |0 ,

k

2Ī³

with Ī³, Ī³ ā {A, B}, s, s ā {h, v}, is adequate.

A third point related to local operations is that these plane waves are idealizations

of Gaussian wave packets with ļ¬nite transverse widths. This means that the realistic

kA -mode is eļ¬ectively zero at Bobā™s location, and the kB -mode is eļ¬ectively zero at

Aliceā™s location. The mathematical consequence is that Bobā™s local manipulations are

represented by unitary operators that only act on the kB -mode, i.e. on the second

argument of the two-photon state |sA , sB . By the same token, Aliceā™s operations

only act on the ļ¬rst argument. This is formally similar to performing operations on

distinguishable qubits, but we emphasize that it is the modes that are distinguishable,

not the photons.

20.4.1 Quantum dense coding

The common currency for classical digital communication and computation is the bit,

i.e. the binary digits 0 and 1, which are physically represented by classical two-state

systems. For storage, e.g. in a magnetic storage device, 0 and 1 can be respectively

represented by a spin-down state (a downwards-pointing net magnetization), and a

spin-up state of a magnetic resolution element. For transmission, 0 and 1 are typically

represented by two resolvable voltages V0 and V1 .

In either case, the two states of a macroscopic system encode the binary choice

between 0 and 1; that is, one bit of information is carried by a classical two-state

system. Conversely, the one-to-one relation between the two states of the classical

system and the two logical states 0 and 1 assures us that a classical, two-state system

can carry at most one bit of information.

For a two-state quantum system the outcome is quite diļ¬erent. A surprising result

of quantum theory is that two bits of information can be transmitted by sending

a single qubit. This apparent doubling of the transmission rate is called quantum

dense coding.

A A generic model for quantum dense coding

A thought experiment (Bennett and Wiesner, 1992) to implement quantum dense

coding is sketched in Fig. 20.4. In this scenario, Bob has received two bits of classical

information through his input port IN, and he wants to communicate this news to

Alice. Since there are four possible two-bit messages, an encoding scheme with four al-

ternatives is needed. The resource Bob will use is the pair of entangled qubits provided

by the source.

Bob can carry out local operations to change the original two-qubit state into any

one of the four Bell states, chosen according to a prearranged mapping of the four

possible messages onto the four Bell states. Once this is done, Bob sends the qubit in

his apparatus to Alice, so that she has the entire entangled state at her disposal. Alice

then performs a Bell state measurement, i.e. an observation that determines which

Ā¾Ā¾ Quantum information

of the four Bell states describes the two-qubit state. By means of this measurement

Alice acquires the two bits of information sent by Bob.

The fact that Alice obtains the message after receiving the qubit sent by Bob

suggests that the two classical bits were somehow packed into this single qubit. This

is an essentially classical point of view that does not really ļ¬t the present case. Alice

receives two qubits, one from the original source of the entangled state and one sent

by Bob. The qubit from the original source may well have been sent long before Bobā™s

actions, so it seems eminently reasonable to assume that it carries no information.

On the other hand, Bobā™s qubit by itself also carries no information. For example,

if the ever resourceful Eve manages to intercept Bobā™s qubit, she will learn absolutely

nothing. Furthermore, if Aliceā™s qubit from the source does not arrive, then she also

will learn nothing from receiving Bobā™s qubit. This should make it clear that the

information is carried, nonlocally, by the entangled state itself.

The real advantage of this scheme is that Bob can send two bits with a single

operation. This is twice the rate possible for a classical channel; consequently, quantum

dense coding might better be called quantum rapid coding.

B Quantum dense coding with photons

In an experimental demonstration of quantum dense coding (Mattle et al., 1996), a

polarization-entangled, two-photon state is generated by means of down-conversion in

a type II crystal, as shown for example in Fig. 13.5. The two down-converted photons

have the same frequency, but diļ¬erent propagation directions, selected by means of

irises. The source is adjusted so that it emits the state

i 1

|Ī˜ = ā |hA , vB + ā |vA , hB . (20.51)

2 2

Bob allows the input photon in the kB -mode to pass successively through a half-

wave and a quarter-wave retarder. These devices are reviewed in Exercise 20.8. The

experimentally adjustable parameter for each retarder is the angle Ļ‘ between the

fast axis and the horizontal polarization vector eh . The unitary operations needed to

generate the four Bell states,

1 1

Ī¦Ā± ā” ā |hA , hB Ā± ā |vA , vB , (20.52)

2 2

1 1

ĪØĀ± ā” ā |hA , vB Ā± ā |vA , hB , (20.53)

2 2

correspond to diļ¬erent settings of the retarder angles, Ļ‘Ī»/2 and Ļ‘Ī»/4 .

The source of entangled pairs has been arranged so that the emitted state |Ī˜

scatters into the Bell state |ĪØ+ , for the settings Ļ‘Ī»/2 = Ļ‘Ī»/4 = 0. Using the operations

discussed in Exercise 20.9, Bob encodes his two bits by choosing the two angles Ļ‘Ī»/2

and Ļ‘Ī»/4 , and then sends the photon to Alice. Bobā™s local operations have changed the

entangled state, but Alice can only detect these changes by a Bell state measurement

that requires both photons.

This means that Alice cannot begin to decode the message before she receives the

photon sent by Bob, as well as the photon from the source. In common with all other

Ā¾Āæ

Entanglement as a quantum resource

communication schemes, the time required for transmission of information by quantum

dense coding is restricted by the speed of light.

The next step is for Alice to decode the message, which turns out to be quite

a bit more diļ¬cult than encoding it. Linear optical techniques are constrained by a

no-go theorem, which states that the four Bell states cannot be distinguished with a

probability greater than 50% (Calsamiglia and Lutkenhaus, 2001). Indeed, the Bell

state analysis used in the particular experiment discussed above could not distinguish

between the states |Ī¦+ and |Ī¦ā’ .

However, for entangled photon pairs produced by down-conversion, there is a way

around this prohibition. The proof of the no-go theorem involves the assumption that

the Bell states are not entangled in any degrees of freedom other than the polarization;

consequently, the no-go theorem can be circumvented by the use of hyperentangled

states (Kwiat and Weinfurter, 1998). The example discussed in Section 13.3.5ā”in

which the photons are entangled in both polarization and momentumā”is one candi-

date.

An alternative, and experimentally easier, scheme exploits the fact that down-

conversion automatically produces photon pairs that are entangled in both energy

and polarization. As we have seen in Section 13.3.2-B, energy entanglement implies

that the two photons are produced at essentially the same time.

This feature is the basis for a complete Bell state analysis. In addition to its intrinsic

interest, this scheme illustrates the application of various theoretical and experimental

techniques; therefore, we will discuss it in some detail. A schematic diagram illustrating

the idea for this measurement is shown in Fig. 20.5.

As one can see from Exercise 20.10, the Bell state |ĪØā’ has the curious property

that it is unchanged by scattering from a balanced beam splitter, i.e. |ĪØā’ = |ĪØā’ .

This implies that the photons exhibit anti-pairing, i.e. one photon exits through each

of the two output ports. The other Bell states display the opposite behavior; whenever

|ĪØ+ or |Ī¦Ā± are incident, the photons are paired, as discussed in Section 10.2.1. In

other words, both scattered photons are emitted through one or the other of the two

output ports.

This diļ¬erence allows |ĪØā’ to be distinguished from the remaining Bell states:

when |ĪØā’ is incident, detectors in the A and B arms of the apparatus will both ļ¬re

so that a coincidence count is registered. For the other Bell states, only the detectors

in one arm will ļ¬re, so there will be no coincidence counts between the two arms. This

eļ¬ect only depends on the behavior at the beam splitter, so it would work even if the

photons were not hyperentangled.

Fig. 20.5 Schematic of an experiment for a

) *4.- * complete Bell state analysis using hyperentan-

gled photons. (1) The beam splitter (BS) iden-

2*5 Ā¬ Ā«

tiļ¬es Ā¬ĪØā’ . (2)Ā¬ The birefringent elements (BR-

*5 Ā«

FEs) identify Ā¬ĪØ+ . (3) TheĀ¬ polarizing Ā¬ beam

* *4.- ) Ā« Ā«

ā’

from Ā¬Ī¦+ .

splitters (PBSs) distinguish Ā¬Ī¦

(Adapted from Kwiat and Weinfurter (1998).)

Ā¾ Quantum information

Next we turn to the task of distinguishing |ĪØ+ from |Ī¦Ā± . This is accomplished

by means of the two birefringent elements, which have optic axes aligned along the h-

and v-polarizations. The two down-converted photons are emitted simultaneously in

matched wave packets with widths of the order of 15 fs, but the h- and v-components

experience diļ¬erent group velocities due to the diļ¬erence between the indices of re-

fraction for the two polarizations.

The resulting separation between the two wave packets means that the detections

of the two photons will also be separated in time. In principle, it is only necessary

to separate the two packets by an amount greater than their widths, but in practice

the delay must be larger than the resolution timeā”of the order of 1 nsā”of the detec-

tors. The detection events for |Ī¦Ā± are expected to be simultaneous, since |Ī¦Ā± is a

superposition of states with pairs of photons having the same polarization.

The ļ¬nal task of separating |Ī¦+ and |Ī¦ā’ begins with the action of the beam

splitter:

i

Ī¦Ā± ā’ Ī¦Ā± = ā {|hA , hA Ā± |vA , vA } + (A ā” B) . (20.54)

22

Applying eqn (8.2) to each polarization produces the scattering matrix for a birefrin-

gent element of length L:

Sks,k s = eiĻs Ī“kk Ī“ss , (20.55)

where Ļs = ns (Ļ) L/c is the phase shift for the s-polarization. Propagation through

the birefringent elements therefore produces

ie2iĻ0 iĪ“

Ī¦Ā± e |hA , hA Ā± eā’iĪ“ |vA , vA

ā + (A ā” B) ,

= (20.56)

22

where Ļ0 = (Ļh + Ļv ) /2, and Ī“ = Ļh ā’ Ļv .

For both |Ī¦+ and |Ī¦ā’ two photons will strike a single detector, so the two

states are still not distinguished. The last trick is to send the light into a polarizing

beam splitter oriented along the 45ā—¦ -rotated basis B deļ¬ned in eqn (20.48). In Exercise

20.11, it is shown that expressing |Ī¦Ā± in the new basis yields

ā

i 2iĻ0

hA , hA + |v A , v A ā’ + (A ā” B) ,

Ī¦+ = e cos Ī“ 2i sin Ī“ hA , v A

2

(20.57)

ā

i 2iĻ0

Ī¦ā’ hA , hA + |v A , v A ā’ + (A ā” B) .

= e i sin Ī“ 2 cos Ī“ hA , v A

2

(20.58)

Coincidence counts between the detectors at the output ports of the PBS will arise

from hA , v A , but not from hA , hA and |v A , v A . Since the coeļ¬cients depend on

the phase diļ¬erence Ī“, the two outcomesā”coincidence counts or counts in one detector

onlyā”can be separated by choosing Ī“ to achieve destructive interference for one of the

terms. For example, adjusting L so that

(nh ā’ nv ) Ļ

Ī“= L = nĻ (20.59)

c

Ā¾

Entanglement as a quantum resource

leads to the greatly simpliļ¬ed states

i 2iĻ0 n

hA , hA + |v A , v A + (A ā” B)

Ī¦+ = e (ā’) (20.60)

2

and

i

Ī¦ā’ = ā e2iĻ0 (ā’)n+1 hA , v A + (A ā” B) . (20.61)

2

In this case |Ī¦ā’ produces coincidence counts between the h- and v-counters, while

|Ī¦+ leads to two-photon counts in one or the other of the detectors.

The procedure outlined above constitutes a complete Bell measurement, but the

two photons must be hyperentangled. This Bell state analysis also makes substantial

demands on the photon counters. A demonstration experiment based on this scheme

has recently been carried out (Schuck et al., 2006). The result was that the four Bell

states could be identiļ¬ed with a probability in the range of 81%ā“89%. This is already

substantially greater than the 50% bound imposed by the no-go theorem for linear

optics, and further improvements of the experimental technique are to be expected.

20.4.2 Quantum teleportation

In quantum dense coding, the apparently arcane and counterintuitive property of

entanglement is precisely what allows Bob to transmit two classical bits of information

by means of local operations carried out on a single qubit. We next consider an even

more remarkable demonstration of the power of entanglement. In this scenario, Alice

has received a qubit in an unknown state |Ī³ T ā HT ā”where HT is the internal state

space of the qubitā”and she wants to transmit this quantum information to Bob by

sending him two classical bits. This is the inverse of the quantum dense coding problem,

and the method used to accomplish this magic feat is called quantum teleportation

(Bennett et al., 1993).

If Alice were sent an unknown classical signal, she could simply make a copy and

send it to Bob, but the no-cloning theorem prohibits this action for an unknown

quantum signal. What, then, is Alice to do in the quantum case? Let us ļ¬rst consider

what can be done without the aid of any ancilla. In this situation, the only available

option is to measure the value of some observable OT = n Ā· ĻT , where n is a unit

ńņš. 23 |