Quantum correlations for anonymous metrology

Transcription

1 Quantum correlations for anonymous metrology A. J. Paige, 1, Benjamin Yadin, 2, and M. S. Kim 1 1 QOLS, Blacett Laboratory, Imperial College London, London SW7 2AZ, UK. 2 Department of Atomic and Laser Physics, Clarendon Laboratory, University of Oxford (Dated: December 12, 2018) We introduce the tas of anonymous metrology, which involves hiding who made a measurement whilst allowing access to the result. With unsecure classical information processing it requires quantum resources. We establish the resourceful states, give forms for them, and determine their correlations. We separate the cases of having a trustworthy and untrustworthy source of states. The former requires quantum discord, using correlated modes of asymmetry. The latter entails entanglement with additional symmetry, and enables truly untraceable interactions. With no quantum resources this tas appears impossible, since if θ is classically recorded in one of the laboratories then Charlie may access it and learn the systems location. We formalize this statement later. HowarXiv: v1 [quant-ph] 11 Dec 2018 Quantum correlations can provide significant advantages over classical resources in performing certain nonlocal tass. Teleportation of an unnown quantum state [1], super dense coding [2], and quantum ey distribution [3], are a few examples amongst other contexts [4 7]. This has notably included their relevance to the power of quantum computation [8 12], their uses in metrology [13 17], and their roles in non-local information tass lie quantum state merging [18 20]. Quantum correlations can also be used to hide information non-locally [21 25], with recent studies investigating non-locally hiding computations [26], and when it is possible to mas quantum information [27]. In this Letter, we introduce the tas of anonymous metrology, which involves encoding a continuous parameter in a state whilst hiding where the encoding happened. We identify the quantum states that enable the tas and separately treat the two cases of having a trustworthy or untrustworthy source of states. We term the resourceful states as wealy anonymous (WA) and strongly anonymous (SA) respectively, and give physical intuition for the distinction by demonstrating how the SA states allow the location of the encoding to be not just hidden but quantum mechanically delocalised. We derive general forms for the WA and SA states, using the notion of modes of translational asymmetry [28, 29] for the former, and for the latter showing equivalence to the entangled maximally correlated states [30] extended by degeneracy. We then determine the nature of the quantum correlations in these states. In general, quantum correlations exist in different strengths, from discord [5] to full Bell nonlocality [31], and understanding their respective utilities remains to be fully explored. To this end, we find that WA states require a form of discord that we term aligned discord, while SA states require a stronger type of correlation, correspondingly termed aligned entanglement. Defining anonymous metrology We introduce the tas of anonymous metrology by way of an example, illustrated in Fig. 1. Alice and Bob are in spatially sep- a.paige16@imperial.ac.u benjamin.yadin@gmail.com arated laboratories, and one of them receives a system, the location of which they must eep hidden (e.g. some valuable diamond). Charlie wants them to probe it with a (finite-dimensional) quantum system to give him information about some continuous parameter θ (such as a refractive index). Alice and Bob can perform classical information processing and communication, but these are considered unsecure as Charlie can potentially hac and eavesdrop on them. They have no quantum channel, and their quantum operations are limited to acting on their quantum systems with single-system measurements (for tomography), and parameter-dependent unitary interactions U A (θ), V B (θ), (defined by local Hamiltonians H A, G B ) between the hidden system and a quantum system. Charlie is assumed to now the details of their setup. The tas is to enable Charlie to learn θ, but in a manner where he cannot wor out where the hidden system is. FIG. 1. Illustration of the anonymous metrology tas. Initially A and B share the state ρ AB, and one of them is given the system to hide (illustrated by a diamond). They engineer the unitary U A, or V B, to encode θ into the shared state, then both halves are sent to C.

2 2 ever, we now allow Alice and Bob to request copies of a bipartite quantum state ρ AB. This can enable them to perform the tas. To see this we consider the Bell state ψ + AB = 1 2 ( 00 AB + 11 AB ). Alice can apply the unitary operator U A (θ) = e iθ 1 A 1, to produce ψ(θ) AB = 1 2 ( 00 AB + e iθ 11 AB ). But similarly Bob can apply V B (θ) = e iθ 1 B 1, and for all θ he produces exactly the same state. This indicates the solution to their problem. The one who has the hidden system interacts their half of the quantum state with it, to realize the relevant encoding unitary (they may need to use a rescaling such that θ [0, 2π)), and then they both send their halves of the state to Charlie. Given multiple copies Charlie can determine θ to arbitrary precision but there is no way he can tell if it was U A or V B that changed the state, so he cannot learn the system s location. Clearly the Bell state is a resource for this tas, but we shall show that a number of quantum states are, and in some cases they do not even need to be entangled. Anonymity and encoding conditions For anonymous metrology there are two relevant sets of useful states, and the appropriate choice between them depends on the source of the states that Alice and Bob receive. First we consider the situation where a trustworthy fourth party, who will never share information with Charlie, is sending quantum states to them. In this case, Alice and Bob request copies of a state ρ AB, that they choose from the set of all states which satisfy two conditions. The first is that they can find continuously parametrised unitaries U A (θ), V B (θ) such that, for θ in some interval, U A (θ)ρ AB U A (θ) = V B(θ)ρ AB V B (θ). (1) This is termed the wea anonymity condition, since it ensures that for a given parameter the same state is produced no matter who actually encoded it. The second condition is that there is an interval from which different phases produce different states, i.e. given θ φ in this interval, we have U A (θ)ρ AB U A (θ) U A(φ)ρ AB U A (φ). (2) We term this the encoding condition since it ensures that different parameters are mapped to different states, so in principle Charlie can always learn the parameter to a desired accuracy given sufficient copies. If however it is Charlie himself who is sending the states (or the fourth party is untrustworthy) then anonymity with these states is not assured. The most dangerous situation is when Charlie holds a third system and nows the joint pure state ψ ABC, but Alice and Bob only now the state ρ AB = Tr C ( ψ ABC ψ ). Now to eep the encoding anonymous they need to be able to find unitaries such that U A (θ) ψ ABC = V B (θ) ψ ABC (3) (up to an irrelevant global phase). We use this to derive a condition on the states ρ AB that they can choose. Using the Schmidt decomposition ψ ABC = j λ j φ j AB χ j C (in terms of an orthogonal product basis) we expand Eq. (3), and project onto χ j C, to see that U A (θ) φ j AB = V B (θ) φ j AB. Now writing ρ AB = j λ j 2 φ j AB φ j, and acting from the left with U A (θ), we arrive at U A (θ)ρ AB = V B (θ)ρ AB. (4) This is termed the strong anonymity condition. Reversing the argument is straightforward. Hence we see that the state ψ ABC has unitaries that satisfy Eq. (3) if and only if ρ AB = Tr C ( ψ ABC ψ ) has unitaries that satisfy Eq. (4). It is clear that Eq. (4) implies Eq. (1), but not vice versa, so the condition (4) is stronger. With this we now formally establish appropriate terminology. Definitions: A state ρ AB is a wealy anonymous (WA) state if there exist unitaries U A (θ) = e iθh A, and V B (θ) = e iθg B that satisfy the conditions given by Eq. (1) and (2). The subset of these that also satisfy the condition of Eq. (4) are strongly anonymous (SA) states. Pure States For pure states the WA and SA conditions are equivalent, and furthermore we find that a pure state is WA/SA if and only if it is entangled. To prove sufficiency we use the Schmidt decomposition to write ψ AB = j λ j φ j A χ j B. Entangled states have λ j 0, for at least two values of j, so without loss of generality we tae λ 0 0 and λ 1 0. We now choose the unitaries U A (θ) = e iθ φ1 φ1 A, and V B (θ) = e iθ χ1 χ1 B, to satisfy the conditions. Hence all pure entangled states can do WA/SA encoding. To prove that for pure states entanglement is necessary we consider a separable state ψ AB = φ A χ B. The anonymous condition requires that we can find unitaries such that U A (θ) φ A χ B = φ A V B (θ) χ B. Applying the et φ A we get φ U A (θ) φ χ B = V B (θ) χ B, and projecting this equation onto itself we arrive at φ U A (θ) φ = 1. This implies U A (θ) only imparts an unobservable global phase, so violates the encoding condition. Hence entanglement is necessary for pure states. For the general case of mixed states the situation is more complicated and we turn to this shortly, after presenting a different non-local tas that helps to physically illustrate the true distinction between the WA and SA cases. Delocalised interaction Hiding the location of a system from Charlie somewhat resembles hiding which-path information. So what if Alice and Bob are tased with measuring a system that is put in a superposition of going to Alice and Bob? Can they perform measurements on the system without acquiring which-path information and thus without decohering the spatial superposition? Formalizing the problem, we consider quantizing the path degree of freedom P of the system to be measured; it is put into some superposition a L + b R of going left to Alice and right to Bob. They probe the system with a shared state ρ AB, described by the controlled unitary W (θ) = L P L U A (θ) + R P R V B (θ). The final

3 3 state of P remains unchanged when it factors out. This is found to recover the SA condition Eq. (4) see Appendix A for details. This emphasizes the fact that the SA condition ensures that no information exists on where the interaction too place. The measurement was quantum mechanically delocalised by the correlations. We now move from operational considerations to investigate the form of the resourceful states. Form of WA states In order to arrive at a form for the WA states, it is useful to employ modes of translational asymmetry [28, 29]. Given our unitary action U A,θ (.) = U A (θ)(.)u A (θ), a given state can be decomposed into modes as ρ A = ω ρ(ω) A, where U A,θ(ρ (ω) A ) = e iωθ ρ (ω) A. This is ain to Fourier decomposition of a function. We can select out modes with the twirling superoperator P ω A = lim θ 0 1 2θ 0 θ0 θ 0 dθe iωθ U A,θ. (5) One can verify that PA ω(ρ A) = ρ (ω) A. We similarly define PB ω, using V B,θ(.) = V B (θ)(.)v B (θ). The twirling operators satisfy the relation U A,θ PA ω = eiωθ PA ω, and a completeness relation ω Pω A = 1. We can rewrite the WA condition of Eq. (1) in terms of superoperators by simply multiplying by e iωθ 2θ 0, integrating θ 0 θ 0 dθ, and taing the limit θ 0, to get P ω Aρ AB = P ω Bρ AB. (6) We prove the converse by acting on this equation with U A,θ V B,θ, to get e iωθ V B,θ PA ωρ AB = e iωθ U A,θ PB ωρ AB. The e iωθ terms cancel, and then summing over ω using the completeness relations we return to V B,θ ρ AB = U A,θ ρ AB. Hence Eq (6) is an equivalent statement to Eq. (1). We also note that the encoding condition Eq. (2) becomes that there has to be some ω 0 for which PA ωρ AB 0. From Eq. (6) we can now explicitly write the form of the WA states. First we define ρ (ω1,ω2) AB = i,i,j,j, E i =E i+ω 1, E j =E j+ω 2 c ii jj i A i j B j, (7) where H A i = E i i, with H A the Hamiltonian generator of U A,θ, and similarly for B. Then the WA states are of the form ρ AB = ω ρ (ω,ω) AB, (8) where we require non-zero terms for ω 0 so that encoding is possible. This shows that WA states are those with correlated modes of asymmetry, which indicates a connection with the resource of quantum coherence [32]. We can view WA states as having correlated coherence in the eigenbasis of the unitaries. There is a formal similarity with the correlated coherence defined in [33 36]. Form of SA states We now derive the general form of SA states. Here, woring with modes of asymmetry is not as straightforward (see Appendix B), so we use a different approach. Rearranging the anonymity condition of Eq. (4) to (U A (θ) V B (θ))ρ AB = 0, and taing matrix elements in the eigenbasis of the local unitaries, we get (u i (θ) v i (θ)) ii ρ AB jj = 0. The matrix elements that are not forced to vanish are those for which u i (θ) = v i (θ). Initially it is simplest to consider the non-degenerate case so that u i (θ) u j (θ), i j and similarly for the v i. Under this condition the largest set of non-zero matrix elements is achieved by pairing every u i (θ) with a v i (θ) such that u i (θ) = v i (θ). Since relabeling is physically irrelevant we can write the non-zero matrix elements as ii ρ AB jj, and so we write the state as ρ AB = i,j ρ ij ii jj. This is the form of so-called maximally correlated states [30]. Note that we need at least one non-zero off-diagonal ρ ij = ρ ji, to ensure that the encoding condition of Eq. (2) is satisfied. We can lift our restriction to the degenerate case simply by introducing a new label, such that we write states that are degenerate under U A as iλ. We then can write the form of SA states as ρ AB = ρ ijλλ µµ iλ, iλ AB jµ, jµ. (9) i,j,λ,λ,µ,µ Hence the SA states are a generalisation of the maximally correlated states, where we note we only include the entangled ones. Having established the forms of useful states (see Appendix C for the generalisation to multipartite cases), we now discuss the quantum correlations. Quantum correlations required In the tass of anonymous metrology and delocalised measurement, we shall show that information is being hidden by the quantum correlations of the states. The main candidates are entanglement and discord, which can be defined mathematically by prescribing specific forms for the correlated states. A bipartite state is entangled if it cannot be written in the separable form ρ AB = i p iρ (i) A ρ(i) B. A bipartite state is discordant if, for some local basis, it cannot be written in any of the three forms ρ AB = i,j p ij i i A j j B, ρ AB = i p i i i A ρ B i, and ρ AB = j p jρ A j j j B, termed Classical-Classical (CC), Classical-Quantum (CQ), and Quantum-Classical (QC) respectively. Entangled states are a subset of discordant states. As shown below, the WA and SA states form subsets of the nown sets of correlated states. This indicates the resource is a quantum correlation subject to some additional symmetry constraint. We therefore use the terms aligned discord and aligned entanglement for the WA and SA resources, respectively. For aligned discord we establish that discord is necessary but not sufficient, and entanglement is neither necessary nor sufficient. For

4 4 aligned entanglement we show entanglement is necessary but not sufficient. These results are illustrated in Figure 2. FIG. 2. Schematic summary of the relations between all quantum states (Q), and those that are discordant (D), aligned discordant (AD), entangled (E), and aligned entangled (AE). WA Hamiltonian condition Before proving these results, we recast the WA conditions in terms of Hamiltonians, to describe families of unitaries that encode a continuous parameter. If we were to demand Eq. (1) and (2) without enforcing the requirement of encoding a continuous parameter, then an anonymous encoding would be given by the classically correlated state ρ AB = 1 2 ( ), with bit flip unitaries U A = σa x, and V B = σb x. Note that for the SA case there is no such distinction. Writing U A (θ) = e iθh A, and V B (θ) = e iθg B, we see that the wea anonymity condition of Eq. (1) is equivalent to requiring that there exist local Hermitian operators H A, G B, for which [H A G B, ρ AB ] = 0. (10) Similarly the encoding condition of Eq. (2), becomes [H A, ρ AB ] 0. (11) We can wor with these conditions to intrinsically restrict to continuous parameter encodings. Aligned discord To prove discord is necessary we start with a CQ state ρ AB = a λ a ψ a ψ a ρ B a, and we tae that for some choice of Hermitian operators H A and G B we have [H A, ρ AB ] = [G B, ρ AB ]. We project A onto ψ c ψ c and use the fact that ψ c [H A, ψ a ψ a ] ψ c = 0 to get λ c [G B, ρ B c ] = 0, c. From this it follows that [H A, ρ AB ] = 0. Hence we can only satisfy the anonymity condition if we violate the encoding condition. Essentially the same argument wors for a QC state and hence it is true for all non-discordant states. This proves that discord is necessary for WA states. The fact entanglement is not necessary is proved by the example of the Werner state [37] ρ W = a ψ ψ + 1 a 4 1. The WA conditions can always be satisfied using e iθ 1 1, except when a = 1, but the state is not entangled for values of a 1 3. To prove that neither entanglement nor discord are sufficient we use a two-qubit example. We construct a state that is entangled and discordant but is not of the appropriate form as given in Eq. (8). To do this we first define ρ 1 = ( a a 11 )( a a 11 ) and ρ 2 = ( b b 10 )( b b 10 ). Now the example is formed by taing ρ = mρ 1 + (1 m)ρ 2. Picing the values a = 0.45, b = 0.4, m = 0.35, one can show that the resulting state is entangled (therefore discordant), but cannot satisfy the WA conditions (see Appendix D for details). Proof for discord alone can be given by the simpler example 1 2 ( ). Aligned entanglement The fact entanglement is necessary for SA states follows from the form presented in Eq. (9), since any state of this form is entangled. The fact that it is not sufficient also follows, since not all entangled states can be written in this form, for example the Werner state. See Appendix E for a detailed account. Note the Werner state example also shows that the SA states are not simply the entangled WA states, but a strict subset of them. It also proves that steerability and Bell non-locality are not sufficient for aligned entanglement since for a > 1 2 the state is steerable [38], and for a > 1 2 it is Bell non-local [39]. Robustness The anonymous metrology protocol has robust anonymity. If Alice and Bob verify that their state ρ AB is close to a WA/SA state σ AB, in terms of trace distance T (ρ AB, σ AB ) ɛ, then this bounds Charlie s ability to correctly guess who applied the unitary. For the WA case we have T (U A ρ AB U A, V Bρ AB V B ) 2ɛ, and for the SA case we have T (U A ψ ABC, V B ψ ABC ) 2 ɛ ɛ 2. See Appendix F for details. This means that given a single copy, the probabilities for Charlie to correctly guess are bounded as P W A ɛ, and P SA ɛ ɛ 2. In general Alice and Bob send multiple copies, which Charlie could use to improve his guess. However using the property of the fidelity that F (ρ n 1, ρ n 2 ) = F (ρ 1, ρ 2 ) n, and the Fuchs-van de Graff inequality 1 F T 1 F 2 [40], we find that T (ρ n 1, ρ n 2 ) 1 [1 T (ρ 1, ρ 2 )] 2n. Hence robustness for many copies follows. Figure of merit Following similar considerations, we now define a general figure of merit for any bipartite state ρ used for anonymous metrology. Building from the previous section we find we can bound the increase in Charlie s guessing probability to δ by limiting the number of log(1 (2δ) copies sent to be no more than n δ = 2 ) 2 log min θ F (ρ U,ρ V ), where ρ U and ρ V are the states Charlie is trying to discriminate between. The minimisation of the fidelity over θ ensures privacy for the whole considered range of parameter values. The usefulness of a state in parameter estimation may be quantified by the quantum Fisher information (QFI) F [41], which sets a lower limit on the uncertainty θ with which a parameter θ can be estimated via the

5 5 quantum Cramér-Rao bound: θ (nf) 1/2 for n measurements. For a unitary encoding U A (θ)ρu A (θ), the QFI is parameter-independent and we denote it as F(ρ; U A ). Since the QFI can depend on which side the encoding is done, we define the average F(ρ; U, V ) = 1 2 (F(ρ; U A) + F(ρ; V B )). We now combine F, and n δ to form the general figure of merit n δ F. This captures the amount of parameter information that can be transferred to Charlie with δ anonymity. From this we identify the state dependent F(ρ;U,V ) part as the ratio log min θ F (ρ U,ρ V ). The larger this quantity, the better a state is for anonymous metrology. Note that this figure of merit depends on the choice of unitaries too, for a function purely of the state, we must maximise over all possible choices of Hamiltonian. Conclusions We have shown that quantum mechanics enables a metrology protocol whereby a parameter may be determined while hiding the location where it was encoded. We have determined the exact nature of the quantum correlations responsible for this phenomenon, according to the level of privacy required. With a trusted source of states, discord is needed, while entanglement provides privacy with an untrusted source. The useful correlations have a particular symmetry, and are named aligned discord and entanglement respectively. We note that the difference between the WA and SA tass resembles device-dependent versus deviceindependent cryptography, where the former requires access to discord and the latter requires entanglement [42]. It is significant that in the case of a trusted source of quantum states only discord is needed, since this reduces the technological challenge in realizing protocols. Unlie entanglement, discord and any benefits it brings are typically more robust to noise [43, 44]. The SA states are more practically challenging, but they bring additional operational power. There is an apparent connection between aligned discord/entanglement and quantum coherence. This is made most clear by the redefinition of the WA states in terms of modes of asymmetry given in Eq. (6). This suggests an interesting potential lin between the anonymity resources and the resource of quantum coherence [45 48]. The anonymity resources should arguably be viewed as a hybrid of coherence and correlation. One could describe it as correlated coherence, though this appears distinct from the correlated coherence of [33 36]. Our results highlight an operational boundary within the hierarchy of quantum correlations, providing a novel nonclassical tas whereby different types of correlation are at play depending on the desired level of anonymity. We expect our wor to stimulate further explorations of this boundary and its applications to secure quantum communication. Acnowledgments The authors acnowledge discussions with Thomas Hebdige, and Hyujoon Kwon. AP is funded by the EPSRC Centre for Doctoral Training in Controlled Quantum Dynamics, BY is funded by an EPSRC Doctoral Prize, and MSK by the Royal Society and Samsung GRO project. [1] C. H. Bennett, G. Brassard, C. Crépeau, R. Jozsa, A. Peres, and W. K. Wootters, Phys. Rev. Lett. 70, 1895 (1993). [2] C. H. Bennett and S. J. Wiesner, Phys. Rev. Lett. 69, 2881 (1992). [3] A. K. Eert, Phys. Rev. Lett. 67, 661 (1991). [4] R. Horodeci, P. Horodeci, M. Horodeci, and K. Horodeci, Rev. Mod. Phys. 81, 865 (2009). [5] K. Modi, A. Brodutch, H. Cable, T. Patere, and V. Vedral, Rev. Mod. Phys. 84, 1655 (2012). [6] G. Adesso, T. R. Bromley, and M. Cianciaruso, J. Phys. A 49, (2016). [7] A. Bera, T. Das, D. Sadhuhan, S. S. Roy, A. Sen(De), and U. Sen, Rep. Prog. Phys. 81, (2018). [8] R. Jozsa and N. Linden, Proc. Roy. Soc. 459, 2011 (2003). [9] G. Vidal, Phys. Rev. Lett. 91, (2003). [10] A. Datta, A. Shaji, and C. M. Caves, Phys. Rev. Lett. 100, (2008). [11] B. Daić, V. Vedral, and Č. Bruner, Phys. Rev. Lett. 105, (2010). [12] A. Datta and A. Shaji, Int. J. Quant. Inf. 9, 1787 (2011). [13] V. Giovannetti, S. Lloyd, and L. Maccone, Phys. Rev. Lett. 96, (2006). [14] Z. Huang, C. Macchiavello, and L. Maccone, Phys. Rev. A 94, (2016). [15] K. Modi, H. Cable, M. Williamson, and V. Vedral, Phys. Rev. X 1, (2011). [16] D. Girolami, T. Tufarelli, and G. Adesso, Phys. Rev. Lett. 110, (2013). [17] D. Girolami, A. M. Souza, V. Giovannetti, T. Tufarelli, J. G. Filgueiras, R. S. Sarthour, D. O. Soares-Pinto, I. S. Oliveira, and G. Adesso, Phys. Rev. Lett. 112, (2014). [18] M. Horodeci, J. Oppenheim, and A. Winter, Nature 436, 673 (2005). [19] D. Cavalcanti, L. Aolita, S. Boixo, K. Modi, M. Piani, and A. Winter, Phys. Rev. A 83, (2011). [20] V. Madho and A. Datta, Phys. Rev. A 83, (2011). [21] D. P. DiVincenzo, D. W. Leung, and B. M. Terhal, IEEE Trans. Info. Theor. 48, 580 (2002). [22] D. P. DiVincenzo, P. Hayden, and B. M. Terhal, Foundations of Physics 33, 1629 (2003). [23] M. Christandl and S. Wehner, in International Conference on the Theory and Application of Cryptology and Information Security (Springer, 2005) pp [24] J. Bouda and J. Sprojcar, in Quantum, Nano, and Micro Technologies, ICQNM 07. First International Conference on (IEEE, 2007) p. 12. [25] G. Brassard, A. Broadbent, J. Fitzsimons, S. Gambs, and A. Tapp, in International Conference on the Theory

6 6 and Application of Cryptology and Information Security (Springer, 2007) pp [26] F. Shahandeh, A. P. Lund, and T. C. Ralph, arxiv: [27] K. Modi, A. K. Pati, A. Sen(De), and U. Sen, Phys. Rev. Lett. 120, (2018). [28] I. Marvian and R. W. Speens, Phys. Rev. A 94, (2016). [29] I. Marvian and R. W. Speens, Phys. Rev. A 90, (2014). [30] E. M. Rains, Phys. Rev. A 60, 179 (1999). [31] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner, Rev. Mod. Phys. 86, 419 (2014). [32] A. Streltsov, G. Adesso, and M. B. Plenio, Rev. Mod. Phys. 89, (2017). [33] T. Kraft and M. Piani, J. Phys. A 51, (2018). [34] K. C. Tan, H. Kwon, C.-Y. Par, and H. Jeong, Phys. Rev. A 94, (2016). [35] T. Ma, M.-J. Zhao, S.-M. Fei, and M.-H. Yung, arxiv: [36] Y. Sun, Y. Mao, and S. Luo, Eur. Phys. Lett. 118, (2017). [37] R. F. Werner, Phys. Rev. A 40, 4277 (1989). [38] H. M. Wiseman, S. J. Jones, and A. C. Doherty, Phys. Rev. Lett. 98, (2007). [39] R. Horodeci, P. Horodeci, and M. Horodeci, Phys. Lett. A 200, 340 (1995). [40] C. A. Fuchs and J. D. Van Graaf, IEEE Trans. Inf. Theory 45, 1216 (1999). [41] D. Petz and C. Ghinea, arxiv: [42] S. Pirandola, Sci. Rep. 4, 6956 (2014). [43] T. Werlang, S. Souza, F. F. Fanchini, and C. J. Villas Boas, Phys. Rev. A 80, (2009). [44] C. Weedbroo, S. Pirandola, J. Thompson, V. Vedral, and M. Gu, N. Jour. Phys. 18, (2016). [45] T. Baumgratz, M. Cramer, and M. B. Plenio, Phys. Rev. Lett. 113, (2014). [46] E. Chitambar and G. Gour, Phys. Rev. Lett. 117, (2016). [47] A. Winter and D. Yang, Phys. Rev. Lett. 116, (2016). [48] B. Yadin, J. Ma, D. Girolami, M. Gu, and V. Vedral, Phys. Rev. X 6, (2016). [49] A. Peres, Phys. Rev. Lett. 77, 1413 (1996). [50] P. Horodeci, Phys. Lett. A 232, 333 (1997). [51] S. D. Bartlett, T. Rudolph, and R. W. Speens, Rev. Mod. Phys. 79, 555 (2007). [52] M. A. Nielsen and I. L. Chuang (Cambridge University Press, Cambridge, 2010) Chap. 9. Appendix A: Delocalised measurement Alice and Bob want to measure a system that has been put into a spatial superposition, without decohering it. We consider the unitary that they jointly perform. Alice sets up her lab such that if the particle comes to her then she performs the controlled unitary U A, and Bob does similarly with V B (we leave the θ-dependence implicit). Together this gives the full unitary as We act with this on the initial state W = L P L U A 1 B + R P R 1 A V B, ρ = (a L + b R ) P (a L + b R ) ρ AB. Writing the new state as a matrix in the L, R basis we have [ ρ a = 2 U A ρ AB U A ab U A ρ AB V ] B a bv B ρ AB U A b 2 V B ρ AB V. (A3) B We see that if U A ρ AB U A = V Bρ AB V B = V Bρ AB U A, then we can factor out and write our state in the product form ρ = (a L + b R ) P (a L + b R ) U A ρ AB U A. Factorisation is also possible with any phase factor on the right-hand side of Eq. (A4), resulting in a relative phase appearing in system P. This phase may be absorbed into the definition of U A. (A1) (A2) (A4) (A5) Appendix B: SA condition with twirling superoperators Starting from the SA condition U A (θ)ρ AB = V B (θ)ρ AB, we act from the right with V B (θ). We then multiply by e iωθ 2θ 0, integrate θ 0 θ 0 dθ, and tae the limit θ 0. Defining the split twirling operator P ω AB(.) = lim θ 0 1 2θ 0 θ0 θ 0 dθe iωθ U A (θ)(.)v B (θ), (B1)

7 7 we arrive at P ω ABρ AB = P ω Bρ AB. (B2) To go the other way we first note that by summing over ω we have ω Pω AB ρ AB = ρ AB, even though PAB ω does not satisfy a completeness relation. This allows us to perform essentially the same argument as in the WA case. First we define the superoperator W AB,θ (.) = U A (θ)(.)v B (θ), and note that W AB,θPAB ω = eiωθ PAB ω. We then act on Eq. (B2) with W AB,θ V B,θ, cancel the e iωθ terms and sum over ω to arrive bac at the original SA conditions. However, the split twirling operator is not an established tool, and it does not appear straightforward to go from these expressions to a form for the useful states. Appendix C: Form for multipartite states 1. WA case To generalise the WA states is straightforward. We consider the case of n subsystems labeled 1, 2,..., n and demand that the anonymity condition holds between every pair of subsystems. Now the WA condition in terms of the twirling superoperators becomes P ω α ρ 12...n = P ω β ρ 12...n, for all α, β in the set 1, 2,..., n. In direct analogy to the bipartite case we have ρ (ω1,...,ωn) 1...n = i,i,...,,, E i =E i+ω 1,..., E =E +ω n c ii... i 1 i... n, (C1) (C2) and now we can write the WA states as ρ 12...n = ω ρ (ω,ω,...,ω) 12...n, (C3) where as before we require non-zero terms for ω 0 so that encoding is possible. 2. SA case For the SA state we generalise the condition to be U α ρ 12...n = U β ρ 12...n, for all α, β in the set 1, 2,..., n. We apply the same approach as before, taing matrix elements in the eigenbasis of the unitaries. Woring in the non-degenerate case with the same approach as before we find each of these equations gives us an expression for the allowed non-zero terms lie iil...n jj l,,, n, and iil...n j jl,,, n. Taing all such conditions together we see the only non-zero terms allowed are of the form iii...i jjj...j. And so we have the form ρ 12...n = i,j ρ ij ii...i jj...j. (C4) One can then extend to allow for degeneracy in the same way as before by introducing degeneracy labels. Appendix D: Proof discord and entanglement not sufficient for aligned discord Here we prove by examples that discord and entanglement are not sufficient for a state to be a WA state. The proof uses the explicit forms of WA states for two qubits, so we first discuss this. For a two qubit bipartite state ρ AB, where the eigenvalues of ρ A = Tr B (ρ AB ), are non-degenerate and similarly for ρ B, such that they have unique eigenvectors, then the WA states are those that, when written in the eigenbasis of their reduced density matrices, have the form

8 8 α 0 0 ɛ α β β ɛ 0 ρ = 0 0 γ 0 or 0 ɛ γ 0, ɛ 0 0 δ δ where ɛ 0. (These two forms are related by a relabelling of the eigenbasis of ρ A.) We can arrive at this by considering the general form given in Eq. (6), however here we present a constructive proof from the Hamiltonian WA conditions of Eq. (10) and (11). First note the local Hamiltonian H A must share an eigenbasis with ρ A and similarly for G B. Using this local eigenbasis we tae matrix elements of Eq. (10) to get (h i g j h i + g j ) ij ρ AB i j = 0, where h, g are the local Hamiltonian eigenvalues. From this equation we see that the diagonal terms ij ρ AB ij are unconstrained. To see what other terms are free to be non-zero we need to consider when we can mae (h i g j h i + g j ) = 0. Since we have 2 qubits we have 4 eigenvalues to set: h 0, h 1, g 0, g 1. The encoding condition Eq. (11) enforces h 0 h 1 and g 0 g 1, and that ρ AB has at least one off-diagonal term, since H A 1 B is diagonal and diagonal matrices commute with each other. We now have two options, choose h 0 = g 0, and h 1 = g 1, or h 0 = g 1, and h 1 = g 0. The first case allows the terms 00 ρ AB 11, and 11 ρ AB 00, to be non-zero and the second case allows 01 ρ AB 10, and 10 ρ AB 01. Putting this all together we arrive at the forms stated in Eq. (D1). The facts that entanglement and discord are not sufficient are proved by a two qubit example that is not of the form given in Eq. (D1) but is entangled (and therefore discordant). First we define ρ 1 = ( a a 11 )( a a 11 ) and ρ2 = ( b b 10 )( b b 10 ). Now we can form ρ = mρ 1 + (1 m)ρ 2. Choosing a, b 1 2 ensures we have unique local eigenvectors. Picing the fairly arbitrary values a = 0.45, b = 0.4, m = 0.35, we find the matrix in its local eigenbasis is approximately , where we are quoting values only to one significant figure. This is not in one of the viable forms given in Eq. (D1). Taing the partial transpose it has a negative eigenvalue. Thus by the Peres-Horodeci criterion [49, 50] the state is entangled. Since entangled states are always discordant, this example proves neither discord nor entanglement are sufficient. However if one wanted to show it just for discord, the simpler example 1 2 ( ), suffices. This concludes the proof. For completeness we present an alternative way to arrive at Eq. (D1), using tools from asymmetry theory [51]. We can write the WA anonymity condition as a symmetry constraint by using the G-twirling superoperator. We have (D1) (D2) where we define Taing the two-qubit case we write We then find G(ρ AB ) = U A (θ) V B (θ) = U A,θ V B,θ ρ AB = lim θ 0 G(ρ AB ) = ρ AB, 1 2θ 0 θ0 [ ] [ ] e iaθ 0 e ibθ = θ 0 dθ U A,θ V B,θ ρ AB e ibθ e iaθ e i(a b)θ 1 e ibθ e iaθ e i(a b)θ e ibθ 1 e i(a+b)θ e iaθ e iaθ e i(a+b)θ 1 e ibθ e i(a b)θ e iaθ e ibθ 1. ρ AB, where denotes the entrywise product in the computational basis. When we integrate to perform the G-twirling, the two choices of either a = b, or a = b, give the two forms of viable density matrix, as in Eq. (D1). (D3) (D4) (D5) (D6)

9 9 Appendix E: Proof entanglement necessary but insufficient for aligned entanglement Starting from the form given in Eq. (9) we find that entanglement is necessary for aligned entanglement. To see this we write ρ AB = i,j α ij ii AB jj, where we have dropped the degeneracy labels. In order to not violate the encoding condition of Eq. (2) we must have a and l for which l, and α l = e iφ l α l 0. We can apply the local unitary e iφ l A, without affecting the entanglement, and we absorb the phases into the α l, and α l, such that now they are both real and positive. We then perform the partial transpose to get ρ T B AB = i,j α ij ij AB ji, and see that the state l l, is an eigenvector, with the negative eigenvalue α l. Hence by the Peres-Horodeci criterion [49, 50], aligned entangled states are always entangled. Below we also give an alternative proof that wors from the SA conditions without maing use of the form from Eq. (9). To prove that entanglement is not sufficient we use the Werner state example ρ = a ψ ψ + 1 a 4 1, and show the only way this can satisfy the strong anonymity condition of Eq. (4) is if it violates the encoding condition. The anonymity condition becomes au A (θ) ψ ψ + 1 a 4 U A(θ) = av B (θ) ψ ψ + 1 a 4 V B(θ). We now act from the right with ψ, and we get through to U A (θ) ψ = V B (θ) ψ. Substituting this into the original condition we have U A (θ) 1 B = I A V B (θ). This implies U A (θ) = 1 A, and hence we must violate the encoding condition. This is true for 0 < a < 1, and thus is true for values of a for which the state is entangled. Hence entanglement is not sufficient for aligned entanglement. Now we present a proof that entanglement is necessary for SA states without maing explicit use of the form given in Eq. (9). First we state and prove a useful lemma. Given a probability distribution {p j }, and a set of complex numbers {Z j }, where Z j 1. Then j p jz j = e iξ, iff Z j = e iξ, j where we only consider j for which p j 0. To see this is true, note any complex number on the boundary of the unit dis cannot be expressed as a convex combination of other complex numbers in the unit dis. This should be convincing but for completeness we give a more formal proof. For a set of non-zero complex numbers ζ j, we have j ζ j j ζ j, with equality iff arg(ζ j ) = arg(ζ ), j,. This is just a restatement of the polygon inequality (generalisation of the triangle inequality) for complex numbers. We now write j p jz j = j ζ j. Now we have j ζ j = j p j Z j j p j = 1, where we used Z j 1, so the equality holds when Z j = 1 j. We now have j ζ j j ζ j 1, but j ζ j = e iξ = 1, and so the three terms are all equal. The conditions on the inequalitites then tell us every Z j has unit magnitude and the same argument and we see this argument must be ξ giving us Z j = e iξ. The converse is trivial. We can now prove entanglement is necessary for SA states. We first obtain from anonymity condition Tr(U A (θ)v B (θ)ρ AB) = 1. With a separable state ρ AB = j p jρ (j) A ρ(j) B, the condition becomes j p jtr(u A (θ)ρ (j) A )Tr(V B (θ)ρ(j) B ) = 1. We have Tr(U A(θ)ρ (j) A ) 1, and Tr(V B(θ)ρ (j) B ) 1, via the above lemma we have Tr(U A (θ)ρ (j) A )Tr(V B (θ)ρ(j) B ) = 1. This can only be true if Tr(U A(θ)ρ (j) A ) = 1, so Tr(U A(θ)ρ (j) A ) = eiφ(j). Using the eigendecomposition ρ (j) A = q(j) ψ(j) ψ(j), this becomes q(j) ψ(j) U A(θ) ψ (j) = eiφa(j). Again using the lemma we have ψ (j) U A(θ) ψ (j) = eiφa(j). This implies U A (θ) ψ (j) = eiφa(j) ψ (j). We now see that this violates the encoding condition since U A (θ)ρ AB U A (θ) = j, p jq (j) eiφa(j) ψ (j) ψ(j) e iφa(j) ρ (j) B = ρ AB. We have therefore shown that all separable states cannot satisfy the SA conditions and hence entanglement is necessary. Appendix F: Error and robustness 1. WA case Alice and Bob use a selection of the copies they receive to verify that the state they are using ρ AB is close, in terms of trace distance, to a WA state σ AB. Formally we say they verify that T (ρ AB, σ AB ) ɛ. (F1) We now show that this leads to a bound on T (U A ρ AB U A, V Bρ AB V B ). This quantifies Charlie s ability to distinguish whether Alice or Bob applied their unitary, since the maximal probability of correctly guessing the state is P = (1 + T (U A ρ AB U A, V Aρ AB V A ))/2 [52]. Starting from Eq. (F1) we use the fact that trace distance is preserved under unitaries to write T (U A ρ AB U A, σ AB) ɛ, (F2)

10 10 T (V B ρ AB V B, σ AB) ɛ, (F3) where we have defined σ AB = U Aσ AB U A = V Bσ AB V B, using the fact σ AB is a WA state. We now use the triangle inequality T (A, C) T (A, B) + T (B, C), to arrive at T (U A ρ AB U A, V Bρ AB V B ) 2ɛ. (F4) 2. SA case Again Alice and Bob use some of their states to establish Eq. (F1). However, for the SA case we need to consider distinguishability for the fully purified states, so we need to bound T (U A (θ) ψ ABC, V B (θ) ψ ABC ). First consider the fidelity between the two states U A ψ ABC, and V B ψ ABC. This fidelity is given by F (U A ψ ABC, V B ψ ABC ) = ψ ABC V B U A ψ ABC = Tr(V B U Aρ AB )). (F5) Now consider 1 Tr(V B U Aρ AB ) 1 Tr(V B U Aρ AB ), = Tr(σ AB V B U Aρ AB ), = Tr(V B U A(σ AB ρ AB )), Tr( V B U A(σ AB ρ AB ) ), = Tr( σ AB ρ AB ), = 2T (ρ AB, σ AB ), where in the third line we used that fact that σ AB is an SA state. From this we have Tr(V B U Aρ AB ) 1 2T (ρ AB, σ AB ) 1 2ɛ, and using this with Eq. (F5) leads to a bound on the fidelity of F (U A ψ ABC, V B ψ ABC ) 1 2ɛ. (F6) We now change this to an inequality in terms of the trace distance by using the fact that for pure states T (ψ, φ) = 1 F (ψ, φ)2, to arrive at T (U A ψ ABC, V B ψ ABC ) 2 ɛ ɛ 2. (F7)