9th Conference on the Theory of Quantum Computation, Communication and Cryptography

Transcription

1 9th Conference on the Theory of Quantum Computation, Communication and Cryptography TQC 2014, May 21 23, 2014, National University of Singapore, Singapore Edited by Steven T. Flammia Aram W. Harrow T Q C L I P I c s Vo l. 2 7 T Q C w w w. d a g s t u h l. d e / l i p i c s

2 Editors Steven T. Flammia Department of Physics University of Sydney Aram W. Harrow Department of Physics Massachusetts Institute of Technology ACM Classification 1998 E.3 Data Encryption, E.4 Coding and Information Theory, F Theory of Computation ISBN Published online and open access by Schloss Dagstuhl Leibniz-Zentrum für Informatik GmbH, Dagstuhl Publishing, Saarbrücken/Wadern, Germany. Online available at Publication date November 2014 Bibliographic information published by the Deutsche Nationalbibliothek The Deutsche Nationalbibliothek lists this publication in the Deutsche Nationalbibliografie; detailed bibliographic data are available in the Internet at License This work is licensed under a Creative Commons Attribution 3.0 Unported license (CC-BY 3.0): In brief, this license authorizes each and everybody to share (to copy, distribute and transmit) the work under the following conditions, without impairing or restricting the authors moral rights: Attribution: The work must be attributed to its authors. The copyright is retained by the corresponding authors. Digital Object Identifier: /LIPIcs.TQC.2014.i ISBN ISSN

3 iii LIPIcs Leibniz International Proceedings in Informatics LIPIcs is a series of high-quality conference proceedings across all fields in informatics. LIPIcs volumes are published according to the principle of Open Access, i.e., they are available online and free of charge. Editorial Board Susanne Albers (Humboldt University Berlin) Chris Hankin (Imperial College London) Deepak Kapur (University of New Mexico) Michael Mitzenmacher (Harvard University) Madhavan Mukund (Chennai Mathematical Institute) Catuscia Palamidessi (INRIA) Wolfgang Thomas (RWTH Aachen) Pascal Weil (Chair, University Bordeaux) Reinhard Wilhelm (Saarland University, Schloss Dagstuhl) ISSN T Q C 1 4

4

5 Contents More Randomness From Noisy Sources Jean-Daniel Bancal and Valerio Scarani Exact Classical Simulation of the GHZ Distribution Gilles Brassard, Luc Devroye, and Claude Gravel On the Parallel Repetition of Multi-Player Games: The No-Signaling Case Harry Buhrman, Serge Fehr, and Christian Schaffner Quantum Communication Complexity with Coherent States and Linear Optics Juan Miguel Arrazola and Norbert Lütkenhaus Bounds on Entanglement Assisted Source-channel Coding Via the Lovász ϑ Number and Its Variants Toby Cubitt, Laura Mančinska, David Roberson, Simone Severini, Dan Stahlke, and Andreas Winter Strong Converse for the Quantum Capacity of the Erasure Channel for Almost All Codes Mark M. Wilde and Andreas Winter Graph-theoretical Bounds on the Entangled Value of Non-local Games André Chailloux, Laura Mančinska, Giannicola Scarpa, and Simone Severini Optimal Bounds for Parity-Oblivious Random Access Codes with Applications André Chailloux, Iordanis Kerenidis, Srijita Kundu, and Jamie Sikora Convexity Properties of the Quantum Rényi Divergences, with Applications to the Quantum Stein s Lemma Milán Mosonyi Quantum Learning of Classical Stochastic Processes: The Completely-Positive Realization Problem Alex Monras Hidden Subgroup Quantum Algorithms for a Class of Semi-Direct Product Groups Wim van Dam and Siladitya Dey Difficult Instances of the Counting Problem for 2-quantum-SAT are Very Atypical Niel de Beaudrap Circuit Obfuscation Using Braids Gorjan Alagic, Stacey Jeffery, and Stephen Jordan Classical Simulation of Yang-Baxter Gates Gorjan Alagic, Aniruddha Bapat, and Stephen Jordan Blindness and Verification of Quantum Computation with One Pure Qubit Theodoros Kapourniotis, Elham Kashefi, and Animesh Datta Device-independent Randomness Extraction for Arbitrarily Weak Min-entropy Source Jan Bouda, Marcin Pawłowski, Matej Pivoluska, and Martin Plesch th Conference on the Theory of Quantum Computation, Communication and Cryptography. Editors: Steven T. Flammia and Aram W. Harrow Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

6 vi Contents Graph Homomorphisms for Quantum Players Laura Mančinska and David Roberson Quantum Linear Network Coding as One-way Quantum Computation Niel de Beaudrap and Martin Roetteler

7 Preface The 9th Conference on the Theory of Quantum Computation, Communication and Cryptography was held at the National University of Singapore, from the 21st to the 23rd May Quantum computation, quantum communication, and quantum cryptography are subfields of quantum information processing, an interdisciplinary field of information science and quantum mechanics. The TQC conference series focuses on theoretical aspects of these subfields. The objective of the conference is to bring together researchers so that they can interact with each other and share problems and recent discoveries. A list of the previous editions of TQC follows: TQC 2013, University of Guelph, Canada TQC 2012, The University of Tokyo, Japan TQC 2011, Universidad Complutense de Madrid, Spain TQC 2010, University of Leeds, UK TQC 2009, Institute for Quantum Computing, University of Waterloo, Canada TQC 2008, University of Tokyo, Japan TQC 2007, Nara Institute of Science and Technology, Nara, Japan TQC 2006, NTT R&D Center, Atsugi, Kanagawa, Japan The conference consisted of invited talks, contributed talks, a poster session, a rump session, and a business meeting. The invited talks were given by Fernando G. S. L. Brandão (University College London, London), Vittorio Giovannetti (NEST, Scuola Normale Superiore, Pisa) and Yaoyun Shi (University of Michigan, Ann Arbor). The conference was possible thanks to the financial support of the Centre for Quantum Technologies, Singapore. We wish to thank the members of the Program Committee and all subreviewers for their precious help. Our warm thanks also go to the members of the Local Organizing Committee, for their considerable efforts in organizing the conference. We would like to thank Marc Herbstritt and Michael Wagner (Dagstuhl Publishing) for their technical help. Finally, we would like to thank the members of the Steering Committee for giving us the opportunity to work for TQC. And, of course, all contributors and participants! November 2014 Steven T. Flammia and Aram W. Harrow 9th Conference on the Theory of Quantum Computation, Communication and Cryptography. Editors: Steven T. Flammia and Aram W. Harrow Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

8

9 Local Organizing Commitee Rahul Jain Centre for Quantum Technologies, NUS, Singapore Hartmut Klauck Nanyang Technological University and Centre for Quantum Technologies, NUS, Singapore Troy Lee (Chair) Nanyang Technological University and Centre for Quantum Technologies, NUS, Singapore Miklos Santha Universite Paris Diderot Paris 7, France and Centre for Quantum Technologies, NUS, Singapore Evon Tan (Secretariat) Centre for Quantum Technologies, NUS, Singapore 9th Conference on the Theory of Quantum Computation, Communication and Cryptography. Editors: Steven T. Flammia and Aram W. Harrow Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

10

11 Program Commitee Koenraad Audenaert University of London, UK Michael Bremner University of Technology Sydney, Australia Xiaodi Wu MIT, USA Jon Yard Microsoft Research, USA Jianxin Chen IQC, University of Waterloo, Canada Giulio Chiribella Institute for Interdisciplinary Information Sciences, Tsinghua University, China Steve Flammia (co-chair) The University of Sydney, Australia Sean Hallgren The Pennsylvania State University, USA Aram Harrow (chair) MIT, USA Masahito Hayashi Nagoya University, Japan and Centre for Quantum Technologies, NUS, Singapore Zhengfeng Ji IQC, University of Waterloo, Canada Robert Koenig IQC, University of Waterloo, Canada Ashley Montanaro University of Bristol, UK Marco Piani University of Waterloo, Canada Beth Ruskai Tufts University, USA Peter Turner University of Tokyo, Japan Frank Verstraete University of Vienna, Austria John Watrous University of Waterloo, Canada Mark Wilde Louisiana State University, USA 9th Conference on the Theory of Quantum Computation, Communication and Cryptography. Editors: Steven T. Flammia and Aram W. Harrow Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

12

13 Steering Commitee Wim van Dam University of California, Santa Barbara, USA Yasuhito Kawano NTT, Japan Michele Mosca IQC and University of Waterloo, Canada Martin Roetteler Microsoft Research, USA Simone Severini University College London, UK Vlatko Vedral University of Oxford, UK National University of Singapore, Singapore 9th Conference on the Theory of Quantum Computation, Communication and Cryptography. Editors: Steven T. Flammia and Aram W. Harrow Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

14

15 More Randomness From Noisy Sources Jean-Daniel Bancal 1 and Valerio Scarani 1,2 1 Centre for Quantum Technologies, National University of Singapore 3 Science Drive 2, Singapore Department of Physics, National University of Singapore 2 Science Drive 3, Singapore Abstract Bell experiments can be used to generate private random numbers. An ideal Bell experiment would involve measuring a state of two maximally entangled qubits, but in practice any state produced is subject to noise. Here we consider how the techniques presented in [1] and [2], i. e. using an optimized Bell inequality, and taking advantage of the fact that the device provider is not our adversary, can be used to improve the rate of randomness generation in Bell-like tests performed on singlet states subject to either white or dephasing noise ACM Subject Classification J.2 Physical Sciences and Engineering Keywords and phrases Randomness, Bell inequalities, Trusted provider assumption Digital Object Identifier /LIPIcs.TQC Introduction It is well known that the violation of a Bell inequality rules out the possibility for the outcomes of a Bell-type experiment to be known in advance [3]. Therefore, these outcomes are certifiably unpredictable. Recent works have shown that the uncertainty present in these outcomes can be quantified, thus allowing one to lower bound the number of random bits that can be extracted from a given Bell-type experiment [4, 5]. This possibility has given rise to a variety of randomness-related studies based on a similarly varied set of working assumptions. For instance, many works considered the case in which the adversary (the actor for whom outcomes are to be certifiably unpredictable) is allowed to distribute the quantum state measured by the authorized parties, and keep a purification of this state. Under this assumption, it was shown that randomness expansion is possible: if the user holds a secret string of finite length, he can expand it into a longer one [6], or, in principle, even an infinite one [8, 7]. Also, the outcomes observed by the user can be certified to contain some amount of randomness even when the adversary, in addition to distributing the state, holds partial information about the initial random string of the user [9]. This possibility, refered to as randomness amplification, was proved recently for initial randomness issued from a generic min-entropy source [10, 11] after a series of partial results [12, 13]. These results show the full power of quantum certification in principle. However, when it comes to realizing such protocols, a number of questions arise. For instance, in which practical situation would one wish to expand a random string if we already have access to a source that can produce initial random strings? Also, in the context of randomness This work was supported by the National Research Foundation (partly through the Academic Research Fund Tier 3 MOE2012-T ) and the Ministry of Education, Singapore. Jean-Daniel Bancal and Valerio Scarani; licensed under Creative Commons License CC-BY 9th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 14). Editors: Steven T. Flammia and Aram W. Harrow; pp. 1 6 Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

16 2 More Randomness From Noisy Sources amplification, it is unclear in which meaningful situation the dependence would exist at all but be bounded. If the adversary is allowed to tamper with the devices, for instance, or even to produce them, then he may have hidden some kind of emitter inside the boxes, in order to retrieve all numbers produced by the boxes (which otherwise work as expected). This simple possibility would compromise any certification of randomness. For these reasons, in the design and assessment of practical realization of randomness protocols, it is very reasonable to work under the assumption that the adversary has no access to the devices used by the authorized partners. This trusted provider assumption was already introduced in the context of randomness protocols in [14], where it was shown that it restricts the adversary to hold only classical side information (i. e. he cannot hold a purification of the quantum state). Note that this contrasts with the case of quantum key distribution (QKD): practical QKD also requires the trusted provider assumption, for the same reason as mentione above, however the adversary can still hold a purification in this case since the quantum state passes in his hands. Another consequence mentioned in [14] is that the initial string used by the user to choose settings for his Bell test need not be private, but can be fully known in advance by the adversary. One thus speaks of randomness generation in this context. It was shown in [1] that additional randomness can be certified under the trusted provider assumption compared to that granted by randomness expansion protocols, by extracting randomness from all the settings. Moreover, this same paper as well as [2] demonstrated that Bell-like inequalities that certify more randomness than usual Bell inequalities (like e. g. CHSH) can be derived from knowledge of the full correlations. In this paper, we analyse the advantage provided by these techniques when the quantum state measured by the user is a singlet states mixed either with white or dephasing noise. White noise typically describes the effect of many small errors in a setup whereas dephasing noise is the dominant noise in SPDC-based sources when the pump power is low. The case of white noise was already partially studied in both [1] and [2]. The analysis given here gathers the information presented in both studies and provides a comparison with the dephasing noise case. Even though our analysis relies on the trusted provider assumption, it is worth noting that some of the results obtained here could also apply to more general adversaries; we refer to [15] for a concise review of adversarial classes relevant to randomness protocols. For the present paper, we assume that the source emits exactly one pair of particles per unit time and that these are detected with certainty. The case of finite detection efficiency was studied in [1], in absence of noise; when the emission is not heralded, more effects come into play, see e. g. [16]. Another assumption that we make here is that the devices used by the user are i.i.d. and that he can use as many of them as he wants. We thus focus on the rate of randomness generation, defined as the number of random bits generated in each use of the devices. 2 Randomness analysis We consider here a usual Bell-type experiment performed by a user [3]. At each round, the user chooses some inputs x, y for his two devices to use as measurement settings, and observes their outcomes a, b. The i.i.d. behavior of the boxes follows the quantum conditional probability P (a, b x, y) Q. In general, these correlation can admit a decomposition {q λ, P λ } such that P (ab xy) = λ q λ P λ (ab xy) (1)

17 J.-D. Bancal and V. Scarani 3 with q λ 0, λ q λ = 1, P λ (ab xy) Q. When this decomposition is not trivial, by knowing in each round which value of λ corresponds to the realization of the box, the adversary can hold a more precise decription of the box s behavior for that run, as given by P λ (ab xy). Following [1, 2], we thus define the adversary s guessing probability on the outcomes observed by the user when using settings x, y and in presence of the decomposition {q λ, P λ } as G x,y ({q λ, P λ }) = λ q λ max a,b P λ(ab xy). (2) The average guessing probability when settings are chosen with probability p(x, y) is then the maximum of G(P ) = xy p(x, y) λ q λ max a,b P λ(ab xy) (3) over all decompositions (1) compatible with the correlations P (ab xy). It was shown in [1] that this quantity can be upper bounded by considering an SDP (Semidefinite Program) relaxation of the set of quantum correlations [17]. In the following section, we thus use this program to evaluate the rate, as given by the min entropy H min (P ) = log 2 (G(P )), (4) at which random bits are generated in the experiment. Note that the particular case of this optimization where randomness is extracted from a fixed choice of settings (p xy = δ x,x0 δ y,y0 ), or where the outcomes of different settings are allowed to by guessed with different decomposition, was also presented independently in [2]. In the following we compare three quantities: 1. The rate of randomness obtained from a fixed set of settings as certified by a CHSH violation. 2. The rate of randomness obtained from a fixed set of settings as certified by an optimized Bell-type expression. 3. The rate of randomness obtained when using all settings with the same probability as certified by an optimized Bell-type expression. Note that here we consider extracting randomness from the pair of outcomes (a, b) rather than from the outcome of a single party. A similar computation could be done by taking only one party s outcome into consideration, but would result in a lower rate. Also, for the first two quantities, the fixed set of settings is chosen as to maximize the rate of randomness. For all results presented next, the numerical computations were performed using the relaxation of the SDP hierarchy at local level 2 [18]. 2.1 White noise First, let us consider the case in which the measured state is ρ(v ) = V φ + φ + + (1 V )1/4, (5) for some visibility V. The settings which provide the largest violation 2 2V of the CHSH inequality S = A 0 B 0 + A 0 B 1 + A 1 B 0 A 1 B 1 2, (6) T Q C 1 4

18 4 More Randomness From Noisy Sources Randomness [bits/run] ratio V V Figure 1 Rate of private randomness generation certified by the measure 1, 2 and 3 for a singlet state mixed with white noise. The inset presents the ratio of the curves to the lowest one. where A x, B y are Alice s and Bob s observables, are the same for all V : A 0 = σ z, A 1 = σ x, B y = σ z + ( 1) y σ x. (7) 2 We thus computed for this state and settings the three different rates of randomness mentioned above. The result is presented in Figure 1. The randomness rate obtained in case 2 (middle curve) can be certified with the help of the following Bell expression: α A 0 B 0 + A 0 B 1 + A 1 B 0 β A 1 B 1, (8) where the values of α and β depend on V (see [2] for a description of this dependence). The inset in Figure 1 shows that the advantage provided by using this optimized Bell expression is however quite limited. The largest amount of randomness is obtained in case 3 when considering the outcomes observed when all settings are used with the same probability (i. e. p(x, y) = 1/4). As mentioned in [1], the improvement, of the order of a factor of 2, is certified with the usual CHSH inequality. 2.2 Dephasing noise Second, we consider measurement of the state ρ(p) = p φ + φ + + (1 p)( ). (9) The optimal violation of the CHSH inequality by this state, S = p 2, is provided by using the following settings [19]: A 0 = σ z, A 1 = σ x, B y = cos χ σ z + ( 1) y sin χ σ x, (10) with χ = arctan(p).

19 J.-D. Bancal and V. Scarani Randomness [bits/run] ratio p p Figure 2 Rate of private randomness generation certified by the measure 1, 2 and 3 for a singlet state mixed with dephasing noise. The inset presents the ratio of the curves to the lowest one. The three randomness rates obtained with these state and settings are presented in Figure 2. Similarly to the previous case, strictly more randomness can be certified in case 3 than in case 2, and in case 2 than in case 1. The inequality that certifies the largest amount of randomness is again CHSH in case 3, and a different inequality in case 2. One can check that this inequality, however, beyond being a correlation inequality presents no special symmetry. In particular, it is not of the form (8). Nevertheless, we note that when the randomness is extracted from a single set of settings, using an optimized inequality provides a larger advantage for this dephasing noise than it did in the case of mixture with white noise (as shown in the inset of Figure 2). 3 Conclusion We have presented an application of the techniques presented in [1, 2] to the case where the measured state is a singlet mixed with either white noise or dephasing noise. While a significant advantage in terms of randomness rate can be obtained in both cases when randomness is extracted uniformly from all settings, the advantage for extraction from a fixed choice of settings is much more significant in the case of dephasing noise. In a practical experiment, characteristics of both white and dephasing noise are expected to appear [20], as well as various other kind of noises and imperfections [16]. The present analysis is not meant to exhaust all the parameter space of a realistic experiment; but it should be clear that the techniques used here can be extended to describe experiments with all their features. We have focused here on the asymptotic rate of randomness generation. It would be interesting to extend our analysis to take into account finite statistics, maybe in a way similar to [14] or [21]. This would allow one to quantify how many random bits can be extracted from a Bell experiment which involves only a finite number of rounds. T Q C 1 4

20 6 More Randomness From Noisy Sources References 1 J.-D. Bancal, L. Sheridan, V. Scarani, New J. Phys. 16, (2014). 2 O. Nieto-Silleras, S. Pironio, J. Silman, New J. Phys. 16, (2014). 3 N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, S. Wehner, Rev. Mod. Phys. 86, 419 (2014). 4 R. Colbeck, Ph. D. thesis, University of Cambridge, arxiv: (2006). 5 S. Pironio, A. Acín, S. Massar, A. Boyer de la Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning, C. Monroe, Nature 464, 1021 (2010). 6 U. V. Vazirani, T. Vidick, arxiv: C. A. Miller, Y. Shi, arxiv: M. Coudron, H. Yuen, arxiv: R. Colbeck, R. Renner, Nature Physics 8, (2012) 10 J. Bouda, M. Pawlowski, M. Pivoluska, M. Plesch, arxiv: K.-M. Chung, Y. Shi, X. Wu, arxiv: R. Gallego, L. Masanes, G. de la Torre, C. Dhara, L. Aolita, A. Acin, Nature Communications 4, 2654 (2013) 13 T. P. Le, L. Sheridan, V. Scarani, Phys. Rev. A 87, (2013). 14 S. Pironio and S. Massar, Phys. Rev. A 87, (2013). 15 Y. Z. Law, T.P. Le, J-D. Bancal and V. Scarani, arxiv: V. Caprara-Vivoli, P. Sekatski, J.-D. Bancal, C.C.W. Lim, B.G. Christensen, A. Martin, R. T. Thew, H. Zbinden, N. Gisin, N. Sangouard, arxiv: M. Navascues, S. Pironio, A. Acín, Phys. Rev. Lett. 98, (2007). 18 T. Moroder, J-D. Bancal, Y-C. Liang, M. Hofmann, O. Gühne, Phys. Rev. Lett. 111, (2013). 19 R. Horodecki, M. Horodecki, P. Horodecki, Phys. Lett. A 200, 340 (1995) 20 J. Kofler, S. Ramelow, M. Giustina, A. Zeilinger, arxiv: Y. Zhang, S. Glancy, E. Knill, Phys. Rev. A 84, (2011).

21 Exact Classical Simulation of the GHZ Distribution Gilles Brassard 1, Luc Devroye 2, and Claude Gravel 3 1 Université de Montréal, CIFAR and ETH-ITS, brassard@iro.umontreal.ca 2 McGill University, lucdevroye@gmail.com 3 Université de Montréal, claude.gravel@bell.net Abstract John Bell has shown that the correlations entailed by quantum mechanics cannot be reproduced by a classical process involving non-communicating parties. But can they be simulated with the help of bounded communication? This problem has been studied for more than twenty years and it is now well understood in the case of bipartite entanglement. However, the issue was still widely open for multipartite entanglement, even for the simplest case, which is the tripartite Greenberger Horne Zeilinger (GHZ) state. We give an exact simulation of arbitrary independent von Neumann measurements on general n-partite GHZ states. Our protocol requires O(n 2 ) bits of expected communication between the parties, and O(n log n) expected time is sufficient to carry it out in parallel. Furthermore, we need only an expectation of O(n) independent unbiased random bits, with no need for the generation of continuous real random variables nor prior shared random variables. In the case of equatorial measurements, we improve earlier results with a protocol that needs only O(n log n) bits of communication and O(log 2 n) parallel time. At the cost of a slight increase in the number of bits communicated, these tasks can be accomplished with a constant expected number of rounds ACM Subject Classification J.2 Physical Sciences and Engineering: Physics Keywords and phrases Entanglement simulation, Greenberger Horne Zeilinger (GHZ) state, Multiparty entanglement, von Neumann s rejection algorithm, Knuth-Yao s sampling algorithm Digital Object Identifier /LIPIcs.TQC Introduction The issue of non-locality in quantum physics was raised in 1935 by Einstein, Podolsky and Rosen when they introduced the notion of entanglement [10]. Thirty years later, Bell proved that the correlations entailed by entanglement cannot be reproduced by classical local hidden variable theories between noncommunicating parties [2]. This momentous discovery led to the natural question of quantifying quantum non-locality. A natural quantitative approach to the non-locality inherent in a given entangled quantum state is to study the amount of resources that would be required in a purely classical theory to reproduce exactly the probabilities corresponding to measuring this state. More formally, we consider the problem of sampling the joint discrete probability distribution of the outcomes obtained by people sharing this quantum state, on which each party applies locally some measurement on his share. Each party is given a description of his own measurement but not informed of the measurements assigned to the other parties. This task would be easy (for a theoretician!) if the parties were indeed given their share of the quantum state, but they are not. Instead, they must simulate the outcome of these measurements without any quantum resources, using as little classical communication as possible. Gilles Brassard, Luc Devroye, and Claude Gravel; licensed under Creative Commons License CC-BY 9th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 14). Editors: Steven T. Flammia and Aram W. Harrow; pp Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

22 8 Exact Classical Simulation of the GHZ Distribution This conundrum was introduced by Maudlin in 1992 in the simplest case of linear polarization measurements at arbitrary angles on the two photons that form a Bell state [17]. Similar concepts were reinvented independently years later by other researchers [5, 20]. This led to a series of results, culminating with the protocol of Toner and Bacon to simulate arbitrary von Neumann measurements on a Bell state with a single bit of communication in the worst case [21]. Later, Regev and Toner extended this result by giving a simulation of the correlations entailed by arbitrary binary von Neumann measurements on arbitrary bipartite states of any dimension using two bits of communication, also in the worst case [19]. Inspired by Ref. [20], Cerf, Gisin and Massar showed that the effect of an arbitrary pair of positive-operator-valued measurements (POVMs) on a Bell state can also be simulated with a bounded amount of expected communication [8]. A more detailed early history of the simulation of quantum entanglement can be found in Ref. [4, Sect. 6]. All this prior work is concerned strictly with the simulation of bipartite entanglement. Much less is known when it comes to simulating multipartite entanglement with classical communication, a topic that is still teeming with major open problems. Consider the simplest case, which is the simulation of independent arbitrary von Neumann measurements on the tripartite GHZ state, named after Greenberger, Horne and Zeilinger [14], which we shall denote Ψ 3 = , or more generally on its n-partite generalization Ψ n = n n. The easiest situation arises in the special case of equatorial measurements (defined in Section 2) on the GHZ state because all the marginal probability distributions obtained by tracing out one or more of the parties are uniform. Hence, it suffices in this case to simulate the n-partite correlation. Once this has been achieved, all the marginals can easily be made uniform [11]. Making the best of this observation, Bancal, Branciard and Gisin have given a protocol to simulate equatorial measurements on the tripartite and fourpartite GHZ states at an expected cost of 10 and 20 bits of communication, respectively [1]. Later on, Branciard and Gisin improved this in the tripartite case with a protocol using 3 bits of communication in the worst case [3]. The simulation of equatorial measurements on Ψ n for n 5 was handled subsequently by Brassard and Kaplan in a paper published in the 2012 edition of this Conference on Theory of Quantum Computation, Communication and Cryptography, with an expected cost of O(n 2 ) bits of communication [6]. This was the best result obtained until now on this line of work. Despite substantial effort, the case of arbitrary von Neumann measurements, even on the original tripartite GHZ state Ψ 3, was still wide open. Here, we solve this problem in the general case of the simulation of the n-partite GHZ state Ψ n, for any n, under the random bit model introduced in 1976 by Knuth and Yao [16], in which the only source of randomness comes from the availability of independently distributed unbiased random bits. Furthermore, we have no needs for prior shared random variables between the parties. An expected number of 6n + 17 perfect random bits suffices to carry out our simulation. The expected communication cost is O(n 2 ) bits, but only O(n log n) time if we count one step for sending bits in parallel according to a realistic scenario in which no party has to send or receive more than one bit in any given step. Furthermore, in the case of equatorial measurements, we improve the earlier best result [6] with an expected communication cost of only O(n log n) bits and O(log 2 n) parallel time. At the cost of a slight increase in the number of bits communicated and the number of required random bits, these tasks can be accomplished with a constant expected number of rounds. More formally, the quantum task that we want to simulate is as follows. Each party i holds one qubit from state Ψ n = n n and is given the description of a von Neumann

23 G. Brassard, L. Devroye, and C. Gravel 9 measurement M i. By local operations, they collectively perform n i=1 M i on Ψ n, thus obtaining one outcome each, say b i { 1, +1}, which is their output. The joint probability distribution p(b) of the b i s is defined by the joint set of measurements (see Section 2). Our purpose is to sample exactly this joint probability distribution by a purely classical process that involves no prior shared random variables and as little communication as possible. Our complete solution builds on four ingredients: (1) Gravel s decomposition of p(b) as a convex combination of two sub-distributions [12, 13]; (2) Knuth and Yao s algorithm to sample exactly probability distributions assuming only a source of unbiased identically independently distributed (i.i.d.) bits [16]; (3) the universal method of inversion [9, for instance]; and (4) our own distributed version of the classic von Neumann s rejection algorithm [18]. We define precisely our problem in Section 2 and we formulate our convex decomposition of the GHZ distribution, which is the key to its simulation. Then, we explain how to sample according to a Bernoulli distribution even when only approximations to the distribution s parameter are available. We also explain how the classic von Neumann rejection algorithm can be used to sample in the sub-distributions defined by our convex decomposition. However, little attention is paid in Section 2 to the fact that the various parameters that define the joint distribution are not available in a single place. Section 3 is concerned with the communication complexity issues. It culminates with a complete protocol to solve our problem, as well as its complete analysis. This is followed by variations on the theme, in which we consider a parallel model of communication, an expected bounded-round solution, and improvements on the prior art for the simulation of equatorial measurements. We conclude with a discussion and open problems in Section 4. 2 Sampling exactly the GHZ distribution in the random bit model Any von Neumann measurement on a single qubit can be conveniently represented by a point on the surface of a three-dimensional sphere, known as the Bloch sphere, whose spherical coordinates can be specified by an azimuthal angle θ [0, 2π) and an elevation angle ϕ [ π/2, π/2]. These parameters defines a Hermitian idempotent operator ( ) sin ϕ e ıθ cos ϕ M = x σ 1 + y σ 2 + z σ 3 = e ıθ, cos ϕ sin ϕ where x = cos θ cos ϕ, y = sin θ cos ϕ j, z = sin ϕ, and σ 1, σ 2 and σ 3 are the Pauli operators. In turn, this operator defines a measurement in the usual way, which we shall also call M for convenience, whose outcome is one of its eigenvalues +1 or 1. The azimuthal angle θ represents the equatorial part of the measurement and the elevation angle ϕ represents its real part. A von Neumann measurement is said to be equatorial when its elevation angle ϕ = 0 vanishes and it is said to be in the computational basis when ϕ = ±π/2. Consider a set of n von Neumann single-qubit measurements M j, represented by their parameters (θ j, ϕ j ), 1 j n. This set of operators defines a joint measurement M = n j=1 M j. In turn, this measurement defines a probability distribution p, which we shall call the GHZ distribution, on the set { 1, +1} n. This distribution corresponds to the probability of all possible outcomes when the n-partite GHZ state Ψ n = n n is measured according to M. It is shown in [12, 13], albeit in the usual computer science language in which von Neumann measurements are presented as a unitary transformation followed by a measurement in the computational basis, that the probability p(b) of obtaining b = (b 1,..., b n ) in { 1, +1} n can T Q C 1 4

24 10 Exact Classical Simulation of the GHZ Distribution be decomposed as p(b) = cos 2( ) θ 2 p1 (b) + sin 2( ) θ 2 p2 (b), where θ = n j=1 θ j and (1) p 1 (b) = 1 ( a1 (b) + a 2 (b) ) 2, p2 (b) = 1 ( a1 (b) a 2 (b) ) 2, (2) 2 2 n a 1 (b) = cos ( n 1 2( ϕj π 2 b j)), a2 (b) = sin ( 1 2( ϕj π 2 b j)). (3) j=1 Hence, we see that distribution p(b) is a convex combination of sub-distributions p 1 (b) and p 2 (b), in which the coefficients cos 2 (θ/2) and sin 2 (θ/2) depend only on the equatorial part of the measurements, whereas the sub-distributions depend only on their real part. Furthermore, the squares of a 1 and a 2 are themselves discrete probability distributions. Sampling p is therefore a matter of sampling a Bernoulli distribution with defining parameter cos 2 (θ/2) before sampling either p 1 or p 2, whichever is the case. Notice that sampling p 2 reduces to sampling p 1 if, say, we replace ϕ 1 by ϕ 1 + 2π. As we shall see, full knowledge of the parameters is not required to sample p exactly. We shall see in subsection 2.1 how to sample a Bernoulli distribution with an arbitrary p [0, 1] as parameter (not the same p as our probability distribution for GHZ) using a sequence of approximants converging to p and using an expected number of only five unbiased identically independently distributed (i.i.d.) random bits. Subsequently, we shall see in subsection 2.2 how to sample p 1 by modifying von Neumann s rejection algorithm in a way that it uses sequences of approximants and unbiased i.i.d. random bits. For simulating exactly the GHZ distribution, an expected number of 6n + 17 perfect random bits is sufficient. 2.1 Sampling a Bernoulli distribution Assume that only a random bit generator is available to sample a given probability distribution and that the parameters that specify this distribution are only accessible as follows: we can ask for any number of bits of each parameter, but will be charged one unit of cost per bit that is revealed. We shall also be charged for each random bit requested from the generator To warm up to this conundrum, consider the problem of generating a Bernoulli random variable Y with parameter p [0, 1]. If U = 0.U 1 U 2... is the binary expansion of a uniform [0, 1) random variable, i.e. U 1, U 2,... is our source of unbiased independent random bits, and if p = 0.p 1 p 2... is the binary expansion of p (in case p = 1 we can proceed as if it were 0.p 1 p 2... with each p i = 1), we compare bits U i and p i for i = 1, 2,... until for the first time U i p i. Then, if U i = 0 < p i = 1, we return Y = 1, and if U i = 1 > p i = 0, we return Y = 0. It is clear that Y = 1 if and only if U < p. Therefore, Y is Bernoulli(p). The expected number of bits required from p is precisely 2. The expected number of bits needed from our random bit source is also 2. Now, suppose that the parameter p defining our Bernoulli distribution is given by p = cos 2 (θ/2), as in the case of our decomposition of the GHZ distribution. None of the parties can know θ precisely since it is distributed as a sum of θ i s, each of which is known only by one individual party. If we could obtain as many physical bits of p as needed (although the expected number of required bits is as little as 2), we could use the idea given above in order to sample according to this Bernoulli distribution. However, it is not possible in general to know even the first bit of p given any fixed number of bits of the θ i s. (For instance, if θ is arbitrarily close to π/2, we need arbitrarily many bits of precision about it before we can tell if the first bit in the binary expansion of cos 2 (θ/2) is 0 or 1). Nevertheless, we can use j=1

25 G. Brassard, L. Devroye, and C. Gravel 11 approximations of p, rather than truncations, which in turn can come from approximations of the θ i s. Definition 1. A k-bit approximation of a quantity v is any ˆv such that v ˆv 2 k. A special case of k-bit approximation is the k-bit truncation ˆv = v2 k /2 k. For convenience, we sometimes use the shorthands k-approximation and k-truncation. Note that the value of k corresponds to the number of bits in the fractional part, without limitation on the size of the integer part. We postpone to Section 3.1 the detail of how these approximations can be obtained in a distributed setting. For the moment, assume that, for any k, we can obtain p(k) so that p(k) p 1/2 k. Then, setting U(k) = 0.U 1... U k, we have that U p if U(k) p(k) 2/2 k whereas U p if U(k) p(k) + 1/2 k. Thus, one can check if U < p by generating only as many bits of U and increasingly good approximations of p as needed. These ideas are formalized in Algorithm 1. It is elementary to verify that the Y generated by this algorithm is Bernoulli(p) because P{U < p} = p if U is a continuous uniform random variable on (0, 1). Algorithm 1 Sampling a Bernoulli random variable with approximate defining parameter 1: Set k 1 2: Set U(0) 0 3: repeat forever 4: Generate an i.i.d. unbiased bit U k 5: Compute U(k) U(k 1) + U k /2 k {hence U(k) = 0.U 1... U k } 6: Obtain p(k) so that p(k) p 1/2 k 7: if U(k) p(k) 2/2 k then 8: return Y = 1 9: else if U(k) p(k) + 1/2 k then 10: return Y = 0 11: else 12: k k : end if 14: end repeat The number of iterations before Algorithm 1 returns a value, which is also its required number of independent unbiased random bits, is a random variable, say K. We have seen above that E{K}, the expected value of K, would be exactly 2 if we could generate arbitrarily precise truncations of p. But since we can only obtain arbitrarily precise approximations instead, which is why we needed Algorithm 1 in the first place, we shall have to pay the price of a small increase in E{K}. P{K > k} P { U(k) p(k) 22 } k P { U p 42 } k 8 2 k. Therefore, E{K} = P{K > k} min (1, 82 ) k = 5. k=0 k=0 2.2 Sampling p 1 (or p 2 ) in the random bit model As mentioned already, it suffices to concentrate on p 1 since one can sample p 2 in exactly the same way provided one of the angles ϕ i is replaced by ϕ i + 2π: this introduces the required T Q C 1 4

26 12 Exact Classical Simulation of the GHZ Distribution minus sign in front of a 2 to transform p 1 into p 2. Let us define α j = cos ( )) ( 1 2( ϕj π 2 = sin 1 )) 2( ϕj + π 2 and β j = cos ( )) ( 1 2( ϕj + π 2 = sin 1 )) 2( ϕj π 2. (4) Consider n Rademacher 1 random variables B j that take value 1 with probability βj 2 and +1 with complementary probability αj 2. The random vector with independent components given by (B 1,..., B n ) is distributed according to q 1 (b) def = βj 2 αj 2, j F b j G b where F b = {j b j = 1} and G b = {j b j = +1} for all b = (b 1,..., b n ) { 1, +1} n. It is easy to verify that q 1 (b) = a1(b) 2 for all b, where a 1 is given in Equation (3). Similarly, the random vector with independent components given by ( B 1,..., B n ) is distributed according to q 2 (b) def = αj 2 βj 2 = a2(b) 2. j F b j G b The key observation is that both q 1 and q 2 can be sampled without any needs for communication because each party j knows his own parameters αj 2 and β2 j, which is sufficient to draw independently according to local Rademacher random variable B j or B j. Moreover, a single unbiased independent random bit s drawn by a designated party suffices to sample collectively from distribution q = q1+q2 2, provided this bit is transmitted to all parties: everybody samples according to q 1 if s = 0 or to q 2 if s = 1. Now, It follows from Equation (2) that p 1 (b) + p 2 (b) = a1(b) 2 + a2(b) 2 = q 1 (b) + q 2 (b) for all b { 1, +1} n, and therefore p 1 (b) q 1 (b) + q 2 (b) = 2q(b). The relevance of all these observations is that we can apply von Neumann s rejection algorithm [18] to sample p 1 (b) since it is bounded by a small constant (2) times an easy-todraw probability distribution (q). For the moment, we assume once again the availability of a continuous uniform random generator, which we shall later replace by a source of unbiased independent random bits. We also assume for the moment that we can compute the α i s, p 1 (b), q 1 (b) and q 2 (b) exactly. This gives rise to Algorithm 2. Algorithm 2 Sampling p 1 using von Neumann s rejection algorithm 1: repeat 2: Generate U uniformly on [0, 1) 3: Generate independent Rademacher random variables B 1,..., B n with parameters α1, 2..., αn 2 4: Generate an unbiased independent random bit S 5: if S = 1 then 6: set B (B 1,..., B n ) 7: else 8: set B ( B 1,..., B n ) 9: end if 10: until (q 1 (B) + q 2 (B)) U p 1 (B) By the general principle of von Neumann s rejection algorithm, probability distribution p 1 is successfully sampled after an expected number of 2 iterations round the loop because 1 A Rademacher random variable is like a Bernoulli, except that it takes value ±1 rather than 0 or 1.

27 G. Brassard, L. Devroye, and C. Gravel 13 p 1 (b) 2q(b) for all b { 1, +1} n. Within one iteration, 2 expected independent unbiased random bits suffice to generate each of the n Rademacher random variables by a process similar to what is explained in the second paragraph of Section 2.1. Hence an expected total of 2n + 1 random bits are needed each time round the loop for an expected grand total of 4n + 2 bits to sample p 1. But of course, this does not take account of the (apparent) need to generate continuous uniform [0, 1) random variable U. It follows that the expected total amount of work required by Algorithm 2 is O(n), provided we count infinite real arithmetic at unit cost. Furthermore, the time taken by this algorithm, divided by n, is stochastically smaller than a geometric random variable with constant mean, so its tail is exponentially decreasing. Now, we modify and adapt this algorithm to eliminate the need for the continuous uniform U (and hence its generation), which is not allowed in the random bit model. Furthermore, we eliminate the need for infinite real arithmetic and for the exact values of q 1 (B), q 2 (B) and p 1 (B), which would be impossible to obtain in our distributed setting since the parameters needed to compute these values are scattered among all parties, and replace them with approximations we postpone to Section 3.2 the issue of how these approximations can be computed. (On the other hand, arbitrarily precise values of the α i s are available to generate independent Rademacher random variables with these parameters because each party will be individually responsible to generate his own Rademacher.) In each iteration of Algorithm 2, we generated a pair (U, B). However, we did not really need U: we merely needed to generate a Bernoulli random variable Y for which P{Y = 1} = P {(q 1 (B) + q 2 (B)) U p 1 (B)}. For this, we adapt the method developed for Algorithm 1. Again, we denote by U(k) the k-bit truncation of U, so that U(k) < U < U(k) + 2 k, except with probability 0. Furthermore, we use L k (L for left) and R k (R for right) to denote k-bit approximations of q 1 (B) + q 2 (B) and p 1 (B), respectively, so that L k ( q 1 (B) + q 2 (B) ) 2 k and R k p 1 (B) 2 k. Then using ε k to denote arbitrary real numbers in the interval ( 1, 1), U(k)L k U(q 1 (B) + q 2 (B)) = Similarly, R k p 1 (B) 1 2 k. = U(k)L k U ( L k + ε k 2 k ) (U(k) U)L k Uε k 2 k L k 2 k k 3 2 k. Thus, we know that Y = 1 whenever U(k)L k + 3/2 k < R k 1/2 k, whereas Y = 0 whenever U(k)L k 3/2 k > R k + 1/2 k. Otherwise, we are in the uncertainty zone and we need more bits of U, q 1 (B) + q 2 (B) and p 1 (B) before we can decide on the value of Y. This is formalized in Algorithm 3 (on next page). It follows from the above discussion that this algorithm can be used to sample random variable Y, which is used as terminating condition in Algorithm 2, in order to eliminate the need for the generation of a continuous uniform random variable U [0, 1) and for the precise values of q 1 (B), q 2 (B) and p 1 (B). Since L k q 1 (B) + q 2 (B) and R k p 1 (B) as k, Algorithm 3 halts with probability 1. Let K be a random variable corresponding to the value of k upon exiting from the repeat forever loop in the algorithm, which is the number of times round the loop and hence the number of bits needed from U and the precision in q 1 (B) + q 2 (B) and p 1 (B) required in order to sample correctly Bernoulli random variable Y. Next, we calculate an upper-bound on E{K}, the expected value of K. T Q C 1 4

28 14 Exact Classical Simulation of the GHZ Distribution Algorithm 3 Generator for the stopping condition in Algorithm 2 1: Note: B { 1, +1} n is given to the algorithm, generated according to q1+q2 2 2: Set k 1 3: Set U(0) 0 4: repeat forever 5: Generate an i.i.d. unbiased bit U k 6: Compute U(k) U(k 1) + U k /2 k {hence U(k) = 0.U 1... U k } 7: Compute L k and R k from B 8: if U(k) L k R k < 4 then 2 k 9: return Y = 1 10: else if U(k) L k R k > 4 then 2 k 11: return Y = 0 12: else 13: k k : end if 15: end repeat If the algorithm has not yet halted after having processed U(k), L k and R k, then we know that Therefore U(q 1 (B) + q 2 (B)) p 1 (B) = ( U(q 1 (B) + q 2 (B)) U(k)L k ) + ( Rk p 1 (B) ) + ( R k + U(k)L k ) U(q 1 (B) + q 2 (B)) U(k)L k + R k p 1 (B) + R k U(k)L k 3 2 k k k = 8 2 k. P{K > k B} P{ U(q 1 (B) + q 2 (B)) p 1 (B) 8/2 k B} { ( p1 (B) = P U 2q(B) k q(b), p 1 (B) 2q(B) + 1 )} k q(b) 8 2 k 1 q(b). ( Thus, using k 0 to denote 3 + log 2 E{K B} = P{K > k B} k=0 1 q(b) ( ) 8 min 1, 2 k q(b) k= k q(b) k<k 0 k k log 2 ( 1 q(b) ) ), (this step requires a messy calculation).

29 G. Brassard, L. Devroye, and C. Gravel 15 Now, we uncondition in order to conclude: ( ) 1 E{K} 5 + q(b) log 2 q(b) b { 1,+1} n = H(q) + 5 (5) n + 5, (6) where H(q) denote the entropy of distribution q = q1+q Communication complexity of sampling In this section, we consider the case in which the sampler of the previous section no longer has full knowledge of the GHZ distribution to be simulated. The sampler, whom we call the leader in a distributed setting, has to communicate through classical channels in order to obtain partial knowledge of the parameters belonging to the other parties. Partial knowledge results in approximation of the parameters involved in sampling the GHZ distribution, but, as we saw in the previous section, we know how to sample exactly in the random bit model using such approximations. 3.1 Sampling a Bernoulli distribution whose parameter is distributed In order to sample the GHZ distribution, we know from Section 2 that we must first sample the Bernoulli distribution with parameter cos 2 (θ/2), where θ = n j=1 θ j. Let us say that the leader is party number 1. Since he knows only θ 1, he must communicate with the other parties to obtain partial knowledge about θ i for i 2. The problem of sampling a Bernoulli distribution with probability cos 2 (θ/2) reduces to learning the sum θ with sufficient precision in order to use Algorithm 1. The problem of computing a k-bit approximation of cos 2 (θ/2) = cos 2( n i=1 θ i/2 ) is relatively easy. Define ϑ = θ/2 and ϑ i = θ i /2 for each i. If the leader obtains an l-bit approximation ˆϑ i of each ϑ i, i 2, and if we define ˆϑ = n ˆϑ i=1 i, we need to find the value of l for which cos 2 ( ˆϑ) is a k-bit approximation of cos 2 (ϑ). It is an elementary exercise in Taylor series expansion to verify that cos 2 (ϑ) cos 2 ( ˆϑ) n/2 l. Hence, it suffices to choose l = k + log 2 n in order to conclude as required that cos 2 (ϑ) cos 2 ( ˆϑ) 2 k. Taking into account the integer part of each ϑ i, which must also be communicated, and remembering that 0 ϑ i 2π since it is an angle 2, the required number of communicated bits in the sequential model is therefore (n 1)(l + 3) = (n 1) ( 3 + k + log 2 n ), which is O(kn+n log n). In our case, the expected value of k is bounded by 5 (see the analysis of the Bernoulli sampling Section 2.1), so that this operation requires an expected communication of O(n log n) bits. 3.2 Approximating a product of bounded numbers Once the leader has produced a bit Z with probability cos 2 (θ/2), he samples either p 1 or p 2, depending on whether he got Z = 0 or Z = 1. The problem of sampling p 2 reduces to sampling p 1 if the leader replaces his own ϕ 1 with ϕ 1 + 2π; thus we concentrate on sampling p 1. Of course, the leader does not know ϕ i for i 2. This problem reduces 2 Actually, 0 ϑ i π since ϑ i is a half angle and one fewer bit is needed to communicate its integer part, but we prefer to consider here the more general case of approximating the cosine square of a sum of arbitrary angles. T Q C 1 4

30 16 Exact Classical Simulation of the GHZ Distribution to learning with sufficient precision the products a 1 (B) = n j=1 cos ( 1 2( ϕj π 2 B j)) and a 2 (B) = n j=1 sin ( 1 2( ϕj π 2 B j)), given that the Bj s are independent Rademacher distributions with parameters αj 2, 1 i n defined in Equation (4). Once these products are known with k + 2 bits of precision, the left and right k-bit approximations L k and R k are easily computed, which allows us to run the modified von Neumann s rejection algorithm from Section 2.2. In this section, we explain how to compute a k-bit approximation to a 1 (B) and a 2 (B) at an expected communication cost of O(kn + n log n) bits. For our specific application of simulating the GHZ distribution, we proved at the end of Section 2.2 (Equation 6) that the expected value of k is bounded by n + 5. It follows that an expected cost of O(n 2 ) bits suffices to carry out the simulation. Given B = (B 1,..., B n ) with the B i s distributed according to non-identical independent Rademachers with parameter cos 2( )) 1 2( ϕi ( )) π 2 or cos 2 1 2( ϕi + π 2, we need to compute k-bit approximations of a 1 (B) and a 2 (B). We use c j and s j to denote cos ( 1 2( ϕj π 2 B j)) and sin ( 1 2( ϕj π 2 B j)), respectively, as well as ĉj and ŝ j to denote their respective l-truncations. We need to determine l such that the products n j=1 ĉj and n j=1 ŝj are k-approximations of a 1 (B) and a 2 (B), respectively. Notice that each party knows exactly his own c j and s j, and hence ĉ j and ŝ j can be transmitted directly to the leader, rather than approximations of the ϕ i s. For each c j, there exists ε j [ 1, 1] such that c j = ĉ j + εj ; thus, using I to denote 2 l {1, 2,..., n}, we have n c j = j=1 A P(I) j A ĉ j j A ε j 2 l = n ĉ j + j=1 A P(I)\I j A ĉ j j A ε j 2 l and hence we can bound the error as follows: n n n (( ) ) ( n 1 c j ĉ j j 2 jl 1 = ) n 2 l 1. j=1 j=1 j=1 ( (1 Setting l = log ) ) k 1/n 1 k + log 2 n + 2, we have n c j j=1 n ĉ j 1 2 k. j=1 Taking account of the need to transmit the l-truncations to both c j and s j, which consists of the sign of these numbers in addition to the first l bits of their binary expansion, the expected communication cost is 2(n 1)(l + 1) bits, which indeed is O(kn + n log n). 3.3 Protocol for sampling the GHZ distribution We are finally ready to glue all the pieces together into Algorithm 4 (on next page), which samples exactly the GHZ distribution under arbitrary von Neumann measurements, thus solving our conundrum. Its correctness is proven below, and it is shown that the expected amount of randomness used in this process is upper-bounded by 6n + 17 bits and an expected O(n 2 ) bits of communication suffice to complete the task. Variations are discussed subsequently. Correctness of the protocol: The part occurring before the first repeat (line 5) samples a Bernoulli with parameter cos 2( n i=1 θ i/2 ), which allows the leader to decide whether to

31 G. Brassard, L. Devroye, and C. Gravel 17 Algorithm 4 Complete protocol for sampling the GHZ distribution in the sequential model 1: The leader, who is party number 1, communicates with the other parties in order to obtain increasingly precise approximations of θ = n i=1 θ i until he can sample random bit Z according to exact Bernoulli random distribution with parameter cos 2 (θ/2) 2: if Z = 1 then 3: The leader adds 2π to his own ϕ-parameter i.e. ϕ 1 ϕ 1 + 2π {to sample p 2 rather than p 1 } 4: end if {Now entering the modified von Neumann s distributed sampler for p 1 } 5: repeat 6: The leader generates a fair random bit S and broadcasts it to the other parties {The bit S determines whether to sample q 1 or q 2 } 7: Locally, each party j generates a random B j { 1, +1} according to an independent Rademacher distribution so that B j = +1 with probability cos 2( )) 1 2( ϕj π 2 {Random variable B = (B 1,..., B n ) is now sampled according to q 1 } 8: if S = 1 then 9: Each party does B j B j {In this case, random variable B = (B 1,..., B n ) is now sampled according to q 2 } 10: end if {Random variable B = (B 1,..., B n ) is sampled according to q = q1+q2 2 } {The leader starts talking with the other parties to decide whether to accept B} 11: Each party computes c j = cos ( 1 2( ϕj π 2 B )) j and sj = sin ( 1 2( ϕj π 2 B )) j 12: The leader sets k 1 13: The leader sets U(0) 0 14: repeat forever 15: The leader generates an i.i.d. unbiased bit U k 16: The leader computes U(k) U(k 1) + U k /2 k {hence U(k) = 0.U 1... U k } 17: The leader requests (k log 2 n )-approx. of c j and s j from each party j 2 18: The leader uses this information to compute (k + 2)-approximations of a 1 (B) and a 2 (B), which are used to compute k-bit approximations L k of a 2 1(B) + a 2 2(B) and R k of p 1 (B) 19: if U(k)L k R k < 4 2 k then 20: Set Y 1 and break from the repeat forever loop. {Vector B is accepted} 21: else if U(k)L k R k > 4 2 k then 22: Set Y 0 and break from the repeat forever loop. {Vector B is rejected} 23: else 24: Set k k + 1 and continue the repeat forever loop {The leader does not yet have enough information to decide whether to accept or reject B. Therefore, he needs to compute the next bit of a 1 (B) and a 2 (B). For this, he needs more information from all the other parties.} 25: end if 26: end repeat 27: until Y = 1 {accepting} 28: The leader informs all the other parties that the simulation is complete and, therefore, that the time has come for each party j (including the leader himself) to output his current value of B j T Q C 1 4

32 18 Exact Classical Simulation of the GHZ Distribution sample B according to p 1 (by leaving his ϕ 1 unchanged) or according to p 2 (by adding 2π to his ϕ 1 ). Notice that the leader does not have to inform the other parties of this decision since they do not need to know if the sampling will be done according to p 1 or p 2. In Section 3.1, we showed how to sample exactly a Bernoulli with parameter cos 2( n i=1 θ i/2 ) when the θ i s are not known to the leader for i 2. The part within the outer repeat loop (lines 5 to 27) is essentially von Neumann s rejection algorithm, which has been adapted and modified to work in a distributed scenario. The leader must first know which of q 1 or q 2 to sample. For this purpose, he generates an unbiased random bit S and broadcasts it to the other parties. Sampling either q 1 or q 2 can now be done locally and independently by each party j, yielding a tentative B j { 1, +1}. The parties will output these B j s only at the end, provided this round is not rejected. Now, each party uses his B j to compute locally c j = cos ( 1 2( ϕj π 2 B )) j and sj = sin ( 1 2( ϕj π 2 B j)), which will be sent bit by bit to the leader upon request, thus allowing him to compute increasingly precise approximations L k and R k of q 1 (B) + q 2 (B) and p 1 (B), respectively. These values are used to determine whether a decision can be made to accept or reject this particular B, or whether more information is needed to make this decision. As shown at the end of Section 2.2 (Equation 6), the expected number of bits needed in L k and R k before we can break out of the repeat forever loop is k n + 5. At that point, flag Y tells the leader whether or not this was a successful run of von Neumann s rejection algorithm. If Y = 0, the entire process has to be restarted from scratch, except for the initial Bernoulli sampling, at line 6. On the other hand, once the leader gets Y = 1, he can finally tell the other parties that they can output their B j s because, according to von Neumann s rejection algorithm, this signals that the vector (B 1,..., B n ) is distributed according to p 1 (or p 2, depending on the initial Bernoulli). Also according to von Neumann s rejection algorithm, we have an expectation of C = 2 rounds of the outer repeat loop before we can thus conclude successfully. Expected communication cost and number of random coins: The expected amount of randomness used in this process is upper-bounded by 6n + 17 bits. This is calculated as follows: the expected number of bits for sampling Bernoulli Z is bounded by 5. This is followed by an expectation of C = 2 rounds of von Neumann s rejection algorithm (the outer repeat loop). In each of these rounds, we need 1 bit for S and expect 2 bits for each of the B j s (hence 2n in total), before entering the repeat forever loop. The expected number of times round this loop is bounded by n + 5, and one more random bit U k is needed each time. Putting it all together, the expected number of random bits is bounded by 5 + 2(1 + 2n + (n + 5)) = 6n The expected amount of communication is dominated by the leader s need to obtain increasingly accurate approximations of c j and s j from all other parties at line 17 in order to compute increasingly accurate approximations of L k and R k, which he needs in order to decide whether or not to break from the repeat forever loop and, in such case, whether or not to accept B as final output. On the k-th time round the loop, the leader needs k log 2 n bits of precision plus one bit of sign about each c j and s j, j 2 (in addition to having full knowledge about his own c 1 and s 1, of course). This would be very expensive if all those bits had to be resent each time round the loop, with increasing values of k. Fortunately, this process works well if the parties send truncations of these values to the leader, because each truncation simply adds one bit of precision to the previous one. Hence, it suffices for the leader to request 2(5 + log 2 n ) bits from each other party at the onset, when k = 1, and only two additional bits per party are needed afterwards for each subsequent trip round the loop

33 G. Brassard, L. Devroye, and C. Gravel Figure 1 Binomial tree structure defining the parallel model. (one for c j and one for s j ). All counted, a total of 2(n 1)(k log 2 n ) bits will have been requested from all other parties by the time we have gone through the repeat forever loop k times. Since the expected value of k upon exiting this loop is bounded by n + 5, the expected number of bits that have to be communicated to the leader to complete von Neumann s rejection algorithm (lines 5 to 27) is bounded by 2(n 1)((n + 5) log 2 n ). This is O(n 2 ) expected bits of communication. The additional amount of communication required to sample Bernoulli Z at step 1 (which is (n 1)(5 + log 2 n) bits) and for the leader to broadcast to all parties the value of S, as well as synchronization bits by which he needs to inform the other parties of success or failure each time round the loop is negligible. All counted, Algorithm 4 needs O(n) bits of randomness and O(n 2 ) bits of communication in order to sample exactly the GHZ distribution under arbitrary von Neumann measurements. Using Equation (5) rather than Equation (6), we shall show in the final journal version of this work that Algorithm 4 needs only O(n log n) bits of communication in order to sample exactly the GHZ distribution under computational-basis von Neumann measurements. Of course, O(n) bits of communication would suffice, even in the worst case, if we knew ahead of time that all measurements are in the computational basis, but our protocol works seamlessly with O(n log n) expected bits of communication even if the measurements are not exactly in the computational basis, and if up to O(log n) of the measurements are arbitrary. 3.4 Variations on the theme We can modify Algorithm 4 in a variety of ways to improve different parameters at the expense of others. Here, we mention briefly three of these variations: the parallel model, bounding the number of rounds, and the simulation of equatorial measurements. The parallel model: Until now, we have considered only a sequential model of communication, in which the leader has a direct channel with everyone else. In this model, communication takes place sequentially because the leader cannot listen to everyone at the same time. However, it is legitimate to consider a parallel model, in which arbitrary many pairs of parties can communicate simultaneously. In this model, any number of bits can be sent and received in the same time step, provided no party has to send or receive more than one bit at any given time. If we make the parties communicate with one another following the binomial tree structure shown in Fig. 1, with the leader at the root, we shall show in the final journal version of this work that the exact simulation of the GHZ distribution under arbitrary independent T Q C 1 4

34 20 Exact Classical Simulation of the GHZ Distribution von Neumann measurements can be accomplished within O(n log n) expected parallel time. The expected total number of bits communicated with this approach is slightly greater than with Algorithm 4, but it remains O(n 2 ). Reducing the number of rounds: Algorithm 4 is efficient in terms of the number of bits of randomness as well as the number of bits of communication, but it requires an expected O(n) rounds, in which the leader and all other parties take turn at sending messages. This could be prohibitive if they are far apart and their purpose is to try to convince examiners that they are actually using true entanglement and quantum processes to produce their joint outputs, because it would prevent them from responding quickly enough to be credible. We leave it for the reader as an exercise to verify that if we change line 24 of Algorithm 4 from k k + 1 to k 2k, the expected number of rounds is decreased from O(n) to O(log n). If in addition we start with k n instead of k 1 at line 12, the expected number of rounds becomes a constant. (Alternatively, we could start with k n at line 12 and step with k k + n at line 24.) Equatorial measurements: Recall that equatorial measurements are those for which ϕ j = 0 for each party j. In this case, the leader can sample according to p 1 or p 2, without any help or communication from the other parties, since he has complete knowledge of their vanished elevation angles. Therefore, he can run steps 5 to 27 of Algorithm 4 all by himself! However, he needs to communicate in step 1 of Algorithm 4 in order to know from which of p 1 or p 2 to sample. The only remaining need for communication occurs in step 28, which has to be modified from The leader informs all the other parties that the simulation is complete to The leader informs all the other parties of which value of B j { 1, +1} he has chosen for them. Only step 1 requires significant communication since the new step 28 needs only the transmission of n 1 bits. We have already seen at the end of Section 3.1 that step 1, which is a distributed version of Algorithm 1, requires an expected communication of O(n log n) bits in the sequential model. This is therefore the complexity of our simulation, which is an improvement over the previously best technique known to simulate the GHZ distribution under arbitrary equatorial von Neumann measurements [6], which required an expectation of O(n 2 ) bits of communication. A more elegant protocol can be obtained if we adapt Equations (1), (2) and (3), which were given at the beginning of Section 2 to define the GHZ probability distribution p(b) for b { 1, +1} n, to the special case of equatorial measurements. Because all the elevation angles ϕ j vanish, these formulas reduce to p(b) = { 2 1 n cos 2( ) θ n sin 2( ) θ 2 if b X if b X where X = {b { 1, +1} n n j=1 } b j = +1. Now, each party j other than the leader can simply choose an independent unbiased Rademacher b j { 1, +1} as final output, without any consideration of his own input θ j nor communication with anyone else, and inform the leader of this choice. It simply remains for the leader to choose his own b 1 in order to make n j=1 b j equal to +1 with probability cos 2 (θ/2) or 1 with probability sin 2 (θ/2). For this, we still need step 1 from Algorithm 4, which requires an expected communication of O(n log n) bits. We shall show in the final journal version of this work that this process can be achieved with only O(log 2 n) expected time steps in the parallel model of communication.

35 G. Brassard, L. Devroye, and C. Gravel 21 4 Discussion and open problems We have addressed the problem of simulating the effect of arbitrary independent von Neumann measurements on the qubits forming the general GHZ state n n distributed among n parties. Rather than doing the actual quantum measurements, the parties must sample the exact GHZ probability distribution by purely classical means, which necessarily requires communication in view of Bell s theorem. Our main objective was to find a protocol that solves this conundrum with a finite amount of expected communication, which had only been known previously to be possible when the von Neumann measurements are restricted to being equatorial (a severe limitation indeed). Our solution needs only O(n 2 ) bits of communication, which can be dispatched in O(n log n) time if bits can be sent in parallel according to a realistic scenario in which nobody has to send or receive more than one bit in any given step. We also improved on the former art in the case of equatorial measurements, with O(n log n) bits of communication and O(log 2 n) parallel time. Knuth and Yao [16] initiated the study of the complexity of generating random integers (or bit strings) with a given probability distribution p(b), assuming only the availability of a source of unbiased identically independently distributed random bits. They showed that any sampling algorithm must use an expected number of bits at least equal to the entropy b p(b) log 2(1/p(b)) of the distribution, and that the best algorithm does not need more than two additional bits. For further results on the bit model in random variate generation, see Ref. [9, Chap. XIV]. The GHZ distribution has an entropy no larger than n, and therefore Knuth and Yao have shown that it could be sampled with no more than n + 2 expected random bits if all the parameters were concentrated in a single place [16]. Even though we have studied the problem of sampling this distribution in a setting in which the defining parameters (here the description of the von Neumann measurements) are distributed among n parties, and despite the fact that our main purpose was to minimize communication between these parties, we were able to succeed with 6n + 17 expected random bits, which is just above six times the bound of Knuth and Yao. The amount of randomness required by our protocols does not depend significantly on the actual measurements they have to simulate. However, some sets of measurements entail a probability distribution p(b) whose entropy H(p) is much smaller than n. In the extreme case of having all measurements in the computational basis, H(p) is a single bit! Can there be protocols that succeed with as few as H(p) + 2 expected random bits, thus meeting the bound of Knuth and Yao, or failing this as few as O(H(p)) expected random bits, no matter how small H(p) is for the given set of von Neumann measurements? Notice that all the protocols presented here require Ω(n) random bits since they ask each party to sample independently at least once a Rademacher random variable, a hurdle that can only be alleviated in the case of measurements in the computational basis. Are our protocols optimal in terms of the required amount of communication? Could we simulate arbitrary von Neumann measurements as efficiently as the case of equatorial measurements, i.e. with O(n log n) bits of communication? We leave this as open question, but point out that Broadbent, Chouha and Tapp have proved an Ω(n log n) lower bound on the worst case communication complexity of simulating measurements on n-partite GHZ states [7], a result that holds even for equatorial measurements, and even under the promise that cos n i=1 θ i = ±1 [15]. As a recent development, which we shall formalize in the final journal version of this work, we have discovered how to simulate more general multipartite states than the GHZ state. For instance, we know how to simulate the so-called W state T Q C 1 4

36 22 Exact Classical Simulation of the GHZ Distribution and more generally W n = 1 n ( 10 n n n n 1 1 ) with O(n 3 ) expected bits of communication and the need of only O(n 2 ) expected unbiased independent random bits. However, we leave for further research the problem of simulating arbitrary positive-operator-valued measurements (POVMs) on the single-qubit shares of GHZ states (or on more general multipartite states), as well as the problem of simulating multipartite entanglement other than equatorial von Neumann measurements on the tripartite GHZ state [3] with worst-case bounded classical communication. Acknowledgements. We wish to thank Marc Kaplan and Nicolas Gisin for stimulating discussions about the simulation of entanglement. Furthermore, Marc has carefully read Ref. [12], in which the decomposition of the GHZ distribution as a convex combination of two sub-distributions was first accomplished, and he has pointed out that the lower bound from Ref. [7] applies even in the case of equatorial measurements. Alain Tapp pointed out that the entropy of the GHZ distribution can be as small as one bit in the case of measurements in the computational basis. We are also grateful for the useful feedback provided by the TQC reviewers. G. B. is supported in part by the Natural Sciences and Engineering Research Council of Canada (Nserc), the Canada Research Chair program, the Canadian Institute for Advanced Research (Cifar), and the Institute for Theoretical Studies (ITS) at the ETH Zürich. L. D. is supported in part by Nserc and Fonds de recherche du Québec Nature et technologies (Frqnt). References 1 J.-D. Bancal, C. Branciard and N. Gisin, Simulation of equatorial von Neumann measurements on GHZ states using nonlocal resources, Advances in Mathematical Physics 2010:293245, J. S. Bell, On the Einstein-Podolsky-Rosen paradox, Physics 1: , C. Branciard and N. Gisin, Quantifying the nonlocality of Greenberger-Horne-Zeilinger quantum correlations by a bounded communication simulation protocol, Physical Review Letters 107:020401, G. Brassard. Quantum communication complexity, Foundations of Physics 33(11): , G. Brassard, R. Cleve and A. Tapp, Cost of exactly simulating quantum entanglement with classical communication, Physical Review Letters 83: , G. Brassard and M. Kaplan, Simulating equatorial measurements on GHZ states with finite expected communication cost, Proceedings of 7th Conference on Theory of Quantum Computation, Communication, and Cryptography (TQC), pp , A. Broadbent, P. R. Chouha and A. Tapp, The GHZ state in secret sharing and entanglement simulation, Proceedings of the Third International Conference on Quantum, Nano and Micro Technologies, pp , N. Cerf, N. Gisin and S. Massar, Classical teleportation of a quantum bit, Physical Review Letters 84(11): , L. Devroye, Non-Uniform Random Variate Generation, Springer-Verlag, New York, A. Einstein, B. Podolsky and N. Rosen, Can quantum-mechanical description of physical reality be considered complete?, Physical Review 47: , N. Gisin, personal communication, 2010.

37 G. Brassard, L. Devroye, and C. Gravel C. Gravel, Structure de la distribution de probabilité de l état GHZ sous l action de mesures de von Neumann locales, M.Sc. thesis, Department of Computer Science and Operations Research, Université de Montréal: jspui/handle/1866/5511, C. Gravel, Structure of the probability distribution for the GHZ quantum state under local von Neumann measurements, Quantum Physics Letters 1(3):87 96, D. M. Greenberger, M. A. Horne and A. Zeilinger, Going beyond Bell s theorem, in Bell s Theorem, Quantum Theory and Conceptions of the Universe, edited by M. Kafatos (Kluwer Academic, Dordrecht), pp , M. Kaplan, personal communication, D. E. Knuth and A. C. Yao, The complexity of nonuniform random number generation, in: Algorithms and Complexity, edited by J. E. Traub, pp , Academic Press, New York, T. Maudlin, Bell s inequality, information transmission, and prism models, PSA: Proceedings of the Biennial Meeting of the Philosophy of Science Association, pp , J. von Neumann, Various techniques used in connection with random digits. Monte Carlo methods, National Bureau Standards 12:36 38, Reprinted in Collected Works, 5: , Pergamon Press, O. Regev and B. Toner, Simulating quantum correlations with finite communication, SIAM Journal on Computing 39(4): , M. Steiner, Towards quantifying non-local information transfer: finite-bit non-locality, Physics Letters A 270: , B. Toner and D. Bacon, Communication cost of simulating Bell correlations, Physical Review Letters 91:187904, T Q C 1 4

38 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case Harry Buhrman 1,2, Serge Fehr 1, and Christian Schaffner 2,1 1 Centrum Wiskunde & Informatica (CWI), Amsterdam, The Netherlands {h.buhrman,s.fehr}@cwi.nl 2 Institute for Logic, Language and Computation (ILLC), University of Amsterdam, The Netherlands c.schaffner@uva.nl Abstract We consider the natural extension of two-player nonlocal games to an arbitrary number of players. An important question for such nonlocal games is their behavior under parallel repetition. For two-player nonlocal games, it is known that both the classical and the non-signaling value of any game converges to zero exponentially fast under parallel repetition, given that the game is non-trivial to start with (i.e., has classical/non-signaling value < 1). Very recent results [7, 5, 10] show similar behavior of the quantum value of a two-player game under parallel repetition. For nonlocal games with three or more players, very little is known up to present on their behavior under parallel repetition; this is true for the classical, the quantum and the non-signaling value. In this work, we show a parallel repetition theorem for the non-signaling value of a large class of multi-player games, for an arbitrary number of players. Our result applies to all multi-player games for which all possible combinations of questions have positive probability; this class in particular includes all free games, in which the questions to the players are chosen independently. Specifically, we prove that if the original game G has a non-signaling value v ns (G) < 1, then the non-signaling value of the n-fold parallel repetition is exponentially small in n. Stronger than that, we prove that the probability of winning more than (v ns (G) + δ) n parallel repetitions is exponentially small in n (for any δ > 0). Our parallel repetition theorem for multi-player games is weaker than the known parallel repetition results for two-player games in that the rate at which the non-signaling value of the game decreases not only depends on the non-signaling value of the original game (and the number of possible responses), but on the complete description of the game. Nevertheless, we feel that our result is a first step towards a better understanding of the parallel repetition of nonlocal games with more than two players ACM Subject Classification E.4 Coding and Information Theory Keywords and phrases Parallel repetition, non-signaling value, multi-player non-local games Digital Object Identifier /LIPIcs.TQC Introduction Background In an m-player nonlocal game G, m players receive respective questions x 1,..., x m, chosen according to some joint probability distribution, and the task of the m players is to provide good answers a 1,..., a m, without communicating with each other. The players are said to win the game if the given answers jointly satisfy some specific property with respect to the given questions. The value of a given game is defined to be the maximal winning probability Harry Buhrman, Serge Fehr, and Christian Schaffner; licensed under Creative Commons License CC-BY 9th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 14). Editors: Steven T. Flammia and Aram W. Harrow; pp Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

39 H. Buhrman, S. Fehr, and C. Schaffner 25 of the players. One distinguishes between the classical, the quantum, and the non-signaling value, depending on whether the players are restricted to be classical, may share entanglement and do quantum measurements, or are allowed to make use of any hypothetical strategy that does not violate non-signaling. An important question for nonlocal games is their behavior under parallel repetition. This question is somewhat understood in the case of two players, where m = 2. Indeed, Raz showed in his celebrated parallel repetition theorem [14] that if the classical value of a two-player game G is v c (G) < 1 then the classical value v c (G n ) of the n-fold parallel repetition of G satisfies v c (G n ) v c (G) n/ log(s), where s denotes the number of possible pairs of answers a 1 and a 2, and v c (G) < 1 only depends on v c (G). Raz s result was improved and simplified by Holenstein [9], who gave an explicit and tighter dependency between v c (G) and v c (G), namely v c (G) = (1 v c(g)) 3. Holenstein also showed that a similar result holds for the non-signaling value of any two-player game: v ns (G n ) v ns (G) n for v ns (G) = (1 v ns(g)) 2. Parallel repetition results for the quantum value of two-player games were first derived for certain special classes of games, like XOR-games [6] or unique games [11], or for a non-standard parallel repetition where the different repetitions of the original game are intertwined with modified versions of the original game [12]. Recently, several results about the parallel repetition of more general quantum games have been obtained [7, 5, 10]. There are further improvements to the above results on two-player games. For instance, Rao [13] showed a concentration result for the classical value of any two-player game, saying that the probability to win more than (v ns (G) + δ) n out of the n repetitions is exponentially small (for any δ > 0). 1 Furthermore, he improved the bound on the classical value under parallel repetition for projection games. A similar improvement on the bound on the classical value under parallel repetition was given by Barak et al. [1] for free games, together with a further improvement, namely a strong parallel repetition theorem (meaning that meaning that v c (G n ) v c (G) Ω(n) ), for free projection games. When considering multi-player nonlocal games with strictly more than 2 players, to the best of our knowledge, very little is known about their behavior under parallel repetition, except for trivial cases. This applies to the classical, the quantum, and the non-signaling value. In [15], Rosen proved a parallel-repetition result for more than 2 players. While her proof strategy is very similar to ours (closely following [9]), a somewhat unnatural definition of multi-player non-signaling correlations is used where no m 1 provers together can signal to the remaining prover. In our (standard) model, one also demands that any subset (of arbitrary size) of provers can not signal to the remaining provers. Another result about multi-player games is by Briët et al. [2] about the related question of XOR repetition. They show the existence of a 3-player XOR game whose classical value of the XOR repetition is bounded from below by a constant (independent of the number of repetitions). Hence, XOR repetition does not hold for this game (but parallel repetition might still hold). Our result does not imply anything about those games, because the non-signaling value of XOR games is always 1. Possible applications of our result could be of cryptographic nature where the hardness of a basic task is amplified by parallel repetition. A likely scenario for applying our results (and our original motivation to study the problem) is position-based quantum cryptography [3, 4], in the spirit of a recent result on parallel repetition of a particular game [17]. However, as 1 Rao claims the concentration result only for the classical value, but the same techniques also apply to the non-signaling value. T Q C 1 4

40 26 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case our result only applies to a restricted class of games, we were not able yet to apply it to in this cryptographic context. Our Results We show a parallel repetition and a concentration theorem for the non-signaling value of m-player games for any m, for a large class of games. The class of games to which our result applies consists of all multi-player games with complete support, meaning that all possible combinations of questions x 1,..., x m must have positive probability of being asked. This class of games in particular includes all free games, in which the questions to the different players are chosen independently. For any m-player game G with complete support, we show that if v ns (G) < 1 then there exists v ns (G) < 1 so that v ns (G n ) v ns (G) n, and the probability of winning more than (v ns (G) + δ) n out of the n repetitions with an arbitrary non-signaling strategy is exponentially small (for any δ > 0). We point out that our parallel repetition result for multi-player games (with complete support) is of a weaker nature than the parallel repetition results for two-player games discussed above, in that in our result the constant v ns (G) depends on the complete description of the game G, and not just on its non-signaling value v ns (G). Still, our result is the first that shows a parallel repetition result for a large class of m-player games with m > 2 for one of the three values (the classical, quantum or non-signaling) of interest. For proving our results, we borrow and extend tools from [9] and [13], and combine them with some new technique. The new technique involves considering strategies that are almost non-signaling, meaning that the non-signaling properties only hold up to some small error. We then show (Proposition 18) and use in our proof that the non-signaling value of a game is robust under extending the quantification over all non-signaling strategies to all almost non-signaling strategies. 2 Preliminaries 2.1 Basic Notation For any m-partite set X = X 1 X m, any m-tuple x = (x 1,..., x m ) X, and any index set I = {i 1,..., i k } {1,..., m}, we write X I to denote the k-partite set X = X i1 X ik, and we write x I to denote the k-tuple x = (x i1,..., x ik ) X I. To denote elements from the n- fold Cartesian product of an m-partite set X as above, we write x = (x 1,..., x n ) X X with x i = (x i 1,..., x i m) X. For i {1,..., m}, we then write x i for x i = (x 1 i,..., xn i ), and for I = {i 1,..., i k } {1,..., m}, x l I is naturally understood as xl I = (xl i 1,..., x l i k ) and x I as x I = (x i1,..., x ik ). Corresponding notation is used for random variables X over X and X over X X. 2.2 Probabilities and Random Variables We consider finite probability spaces, given by a non-empty finite sample space Ω and a probability function P : Ω [0, 1]. A random variable is a function X : Ω X from Ω into some finite set X. The distribution of X, denoted as P X, is given by P X (x) = P [ X = x ] = P [ {ω Ω X(ω)=x} ]. The joint distribution of a pair of random variables X and Y is denoted by P XY, i.e., P XY (x, y) = P [ X =x Y =y ], and the conditional distribution of X given Y is denoted by P X Y and defined as P X Y (x y) = P XY (x, y)/p Y (y) for all x and y with P Y (y) > 0. An event E is a subset of Ω, and the conditional distribution of a random variable X given E is denoted as P X E and given by P X E (x) = P [ X =x E ]/P [ E ].

41 H. Buhrman, S. Fehr, and C. Schaffner 27 The variational (or statistical) distance between two probability distributions P X and Q X for the same random variable X : Ω X over two probability spaces (Ω, P ) and (Ω, Q) (with the same Ω), is defined as P X Q X := 1 P X (x) Q X (x) 2 x X If P X and Q X are ε-close in variational distance, we also write P X ε Q X. Usually, we leave the probability space (Ω, P ) etc. implicit, and understand random variables X, Y,... to be defined by their joint distribution P XY, or by some experiment that uniquely determines their joint distribution. 2.3 Some Useful Facts The following lemma states that the variational distance cannot increase when less information is taken into account. Lemma 1. Let P XY and Q XY be joint distributions for random variables X and Y with respective ranges X and Y, and let P X and Q X be the corresponding marginals. Then, P X Q X P XY Q XY. Proof. P X Q X = 1 P X (x) Q X (x) = 1 ( 2 2 PXY (x, y) Q XY (x, y)) x X x X y Y 1 P XY (x, y) Q XY (x, y) = P XY Q XY. 2 x X y Y The next lemma is due to Holenstein [9] (a simplified version of his Corollary 6). Lemma 2. Let T and U 1,..., U L be random variables with distribution P T U 1 U L = P T P U 1 T P U L T (i.e. the U l s are conditionally independent given T ), and let E be an event. Then L ( P T U l E P T E P U 1 ) l T L log. P [ E ] l=1 The following is Hoeffding Inequality s for sampling without replacement [8]. Theorem 3 (Hoeffding Inequality for sampling without replacement). Let w {0, 1} n be an n-bit string with 1 n n l=1 w i = w. Let the random variables D 1, D 2,..., D K be obtained by sampling K random entries from w without replacement. Then, for any ε > 0, the random variable D := 1 K k D k satisfies P [ D w ε ] exp ( 2ε 2 K ). Finally, we will make use of the Azuma-Hoeffding Inequality, stated below. We first define the notion of a supermartingale. Definition 4 (Supermartingale). A sequence of real valued random variables M 0, M 1,..., M K is called a supermartingale if E[M k M 0 M k 1 ] M k 1 (with probability 1) for every k 1. Theorem 5 (Azuma-Hoeffding Inequality). If M 0, M 1,..., M K is a supermartingale with M k M k 1 + 1, then P [ M K > M 0 + εk ] exp ( ε 2 K/2 ). T Q C 1 4

42 28 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case 2.4 Nonlocal Games Definition 6. An m-player nonlocal game, or simply (m-player) game G consists of two m-partite sets X = X 1 X m and A = A 1 A m, a probability distribution π : X [0, 1] on X, i.e., x π(x) = 1, and a verification predicate V : X A {0, 1}. Definition 7. A strategy for an m-player game G = (X, A, π, V) is a conditional probability distribution q( ) : A X [0, 1], i.e., a q(a x) = 1 for all x X. Definition 8. For any m-player game G = (X, A, π, V) and any strategy q for G, the value of the game with respect to q is given by v[q](g) := x X a A π(x) q(a x) V(x, a). Any m-player game G = (X, A, π, V) and any strategy q for G together naturally define a probability space with random variables X = (X 1,..., X m ) and A = (A 1,..., A m ) with joint probability distribution P XA given by P XA (x, a) = π(x)q(a x). The random variable X describes the choice of the input x X according to π, and the random variable A then describes the reply a A chosen according to the distribution q( x). It obviously holds that P X = π, and P A X ( x) = q( x) for any x X with P X (x) > 0. A subtlety is that for x X with P X (x) = 0, the distribution P A X ( x) is strictly speaking not defined whereas q( x) is. The value of the game with respect to strategy q can be written in terms of these random variables as v[q](g) = P [ V(X, A)=1 ]. In the following we define the classical, quantum and non-signaling values of m-player games. Only the last one will be used in the rest of the paper, but we provide all of them for the sake of completeness. Definition 9. A strategy q for an m-player game G = (X, A, π, V) is classical (or local) if there exists a probability distribution p on a set W and conditional probability distributions q 1,..., q m such that q(a 1,..., a m x 1,..., x m ) = w W p(w) m q i (a i x i, w). The classical value of a game G is defined as v c (G) := sup q v[q](g), where the supremum is over all classical strategies q for G. Definition 10. A strategy q for an m-player game G = (X, A, π, V) is quantum if there exists an m-partite quantum state ψ H A1 H Am and for every x = (x 1,..., x m ) X there exist POVMs E 1 x 1 = {Ex 1 1,a 1 } a1 A 1,..., E m x m = {Ex m m,a m } am A m such that for all a = (a 1,..., a m ) A and x = (x 1,..., x m ) X : i=1 q(a x) = ψ E 1 x 1,a 1 E m x m,a m ψ The quantum value of a game G is defined as v qu (G) := sup q v[q](g), where the supremum is over all quantum strategies q for G. Definition 11. A strategy q for an m-player game G = (X, A, π, V) is non-signaling if for any index subset I {1,..., m} and its complement J = {1,..., m} \ I, it holds that q(a I, a J x I, x J ) = q(a I, a J x I, x J) for all a I A I, x I X I and x J, x J X J. a J A J a J A J The non-signaling value of a game G is defined as v ns (G) := sup q v[q](g), where the supremum is over all non-signaling strategies q for G.

43 H. Buhrman, S. Fehr, and C. Schaffner 29 The following relaxed notion of non-signaling is crucial for the understanding of our parallel-repetition proof. Definition 12. A strategy q for an m-player game G = (X, A, π, V) is ε-almost non-signaling if for any index subset I {1,..., m} and its complement J = {1,..., m} \ I, it holds that q(a I, a J x I, x J ) q(a I, a J x I, x J) ε for all a I A I, x I X I and x J, x J X J. a J A J a J A J 3 A Multi-Player Parallel Repetition Theorem 3.1 The Parallel Repetition of Nonlocal Games Given a game G, the n-fold parallel repetition G n is the game where the referees samples n independent inputs x = (x 1,..., x n ) X X and G n is won if and only if all its sub-games are won. For the sake of notational convenience, we also introduce the following way of denoting the fact that t of the n parallel repetitions are won. Definition 13 (t-out-of-n Parallel Repetition). For any n N and t R, the t-out-of-n parallel repetition of a game G = (X, A, π, V) is given by the game G t/n = (X n, A n, π n, V t/n ) where X n = X X and A n = A A, and for all x = (x 1,..., x n ) X n and a = (a 1,..., a n ) A n n { n 1 if π n (x) := π(x l ) and V t/n (x, a) := l=1 V(xl, a l ) t 0 else l=1. The (standard) n-fold parallel repetition of a game G is given by the game G n := G n/n. Similar to the observation after Definition 8, for any game G and for any strategy 2 q (n) for the t-out-of-n (or the n-fold) parallel repetition, random variables X = (X 1,..., X n ) and A = (A 1,..., A n ), together with their joint distribution P XA, are naturally determined. Note that for any l {1,..., n}, X l is of the form X l = (X1, l..., Xm), l where Xi l represents the question to the i-th player in the l-th repetition of G (and is distributed over X i ). Therefore, for any i {1,..., m}, we write X i for X i = (Xi 1,..., Xn i ), and for any I = {i 1,..., i k } {1,..., m}, XI l should be understood as Xl I = (Xl i 1,..., Xi l k ) and X I as X I = (X i1,..., X ik ). The corresponding holds for A. To simplify notation, for the n-fold repetition of a given game G with a given strategy q (n), we define W l to be the random variable W l := V(X l, A l ) that indicates if the l-th repetition of G is won, and we define W := 1 n n l=1 W l to be the fraction of repetitions that are won. Obviously, v[q (n) ](G t/n ) = P [ W t/n ]. 3.2 Concentration and Parallel Repetition Theorems Our concentration and parallel repetition theorems below hold for all multi-player nonlocal games G up to the following restriction on the distribution π. Definition 14. We say that an m-player game G = (X, A, π, V) has complete support if π(x) > 0 for all x X, i.e., every x X = X 1 X m is a valid input to the game. 2 We write q (n) (rather than e.g. q n ) to emphasize that it is a strategy for an n-fold repetition of G, but it is not (necessarily) the n-fold independent execution of a strategy q for G. T Q C 1 4

44 30 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case An important class of games that satisfy the complete-support property are the so-called free games, as studied for instance in [1]. In a free game, π is required to be a product distribution, i.e., π(x) = π 1 (x 1 ) π m (x m ) for all x = (x 1,..., x m ) X = X 1... X m. Such a game has obviously full support. 3 Theorem 15 (Concentration Theorem). Let G be an arbitrary m-player game with complete support. Then there exists a constant µ > 0, depending on G, such that for any δ > 0, any n N, and for t = (v ns (G)+δ)n: v ns (G t/n ) 8 exp ( δ 4 µn ). As an immediate consequence, we get the following parallel-repetition theorem. Theorem 16 (Parallel-Repetition Theorem). Let G be an arbitrary m-player game with complete support and non-signaling value v ns (G) < 1. Then there exists ν < 1, depending on G, such that v ns (G n ) < 8ν n for any n N. We point out that the constants µ (in Theorem 15) and ν (in Theorem 16) not only depend on the non-signaling value v ns (G) of G, but on the game G itself. The restriction to games with complete support stems from the fact that µ becomes 0 when the smallest probability in the distribution π goes to 0, rendering the bound useless. 3.3 The Proof A central idea of our proof is the robustness of the non-signaling value of a game. We will use the following result from [16, Section 10.4] about the sensitivity analysis of linear programs. Lemma 17. Let A be an m n-matrix, and let A be such that for each nonsingular submatrix B of A, all entries of B 1 are at most in absolute value. Let c be a row n-vector, and let b and b be column m-vectors such that both max x {cx Ax b } and max x {cx Ax b } are finite. Then 4 max x R n{cx Ax b } max x R n{cx Ax b } n c 1 b b. Proposition 18 (Robustness of v ns (G)). Let G be an m-player game with non-signaling value v ns (G). Then, there exists a constant c(g) such that for any ε 0 and for any strategy q for G that is ε-almost non-signaling, the value of G with respect to q is bounded by v[q](g) v ns (G) + c(g) ε. 3 After possibly having restricted the sets X 1,..., X m appropriately. 4 For x = (x 1,..., x n) R n, the norms are defined as x 1 = i x i and x = max i x i.

45 H. Buhrman, S. Fehr, and C. Schaffner 31 Proof. The non-signaling value v ns (G) is the optimal value of the following linear program: maximize π(x) V(x, a) q(a x) x X a A subject to (1) q(a x) 0 for all a A, x X, (2) q(a x) = 1 for all x X, (3) a A a J A J q(a I, a J x I, x J ) q(a I, a J x I, x J) = 0 for all I {1,..., m}, J = {1,..., m} \ I and for all a I A I, x I X I and x J, x J X J. (4) Lemma 17 gives a bound on how much the optimal value of this linear program can vary if we optimize over ε-almost non-signaling strategies instead of a fully non-signaling strategies. Formally, we can express the linear program above in the standard form max{cx Ax b } by expanding the equality constraints (3) and (4) as and inequality constraints. According to Definition 12, ε-almost non-signaling strategies fulfill the constraints (4) only up to an error of at most 2ε. Hence, relaxing the constraints from non-signaling to ε-almost non-signaling amounts to change the b -coordinates corresponding to the non-signaling constraints (4) from 0 to 2ε. Hence, the parameters of Lemma 17 are b b = 2ε, n = X A, c 1 = x X π(x) V(x, a) A and is a finite constant that depends on the number of a A players m and the number of answers A and questions X. 5 Finally, we note that we can apply the lemma, because the objective function is at most one (and thus finite) irrespective of which strategies we are considering. Setting c(g) := 2 X A 2 yields the claim. Lemma 19 (Main Lemma). Let G be a game with complete support. Consider an n-fold repetition G n of G with an arbitrary non-signaling strategy q (n) for G n. Let E be an arbitrary event (in the underlying probability space). Then for any subset S = {v 1,..., v k } {1,..., n}, the probability P [ W V =1 E ] for a randomly chosen V in {1,..., n} \ S is bounded by P [ W V =1 ] E vns (G) + c (G) 1 n k log( 1 P [ E ] where c (G) = 3 2 m c(g)/ min x π(x) is some constant that only depends on G. The following is an immediate consequence. Corollary 20. Let G be a game with complete support. Consider an execution of the n-fold repetition G n with an arbitrary non-signaling strategy for G n. For any l {1,..., n}, let E l be the event that the l-th repetition is accepted, i.e. W l = 1. Then for any subset S = {v 1,..., v k } {1,..., n}, there exists v k+1 {1,..., n} \ S such that P [ ] E vk+1 Ev1... E vk vns (G) + c (G) 1 n k log( ) 1 P [ E v1... E vk ] where c (G) is some constant that only depends on G. ) 5 In our case, the relevant constraint matrix A has n = X A columns and at most 2 ( ( A X + X 2 ) m + X ) rows. Let := max { (B 1 ) ij B a nonsingular submatrix of A }, which depends only m, A, X. T Q C 1 4

46 32 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case Proof (of Lemma 19). Let π > 0 be such that π(x) π for all x X ; by assumption on G, such a π exists. By re-ordering the (strategies of the) n executions, we may assume without loss of generality that S = {n k + 1,..., n}, and we now need to argue about the probability over a random V in {1,..., n k}. To simplify notation, let us define 1 ε := n k log( 1 P [ E ]). Fix a subset I {1,..., m} and let J = {1,..., m} \ I be the complement of I. Consider the distribution n P XI X J A I = P XI A I P XJ X I A I = P XI A I P XJ X I = P XI A I l=1 P X l J X I = P X I A I n l=1 P X l J X I A I where the second equality is due to non-signaling, the third due to the independence of every pair (XI l, Xl J ), and the third again due to non-signaling. We can thus apply Lemma 2 (with T = (X I, A I ) and U l = XJ l ) and obtain (n k) ε = (n k) log ( n k ) 1 P [ E ] P XI X l J A I E P XI A I E P X l J X I A I l=1 n k PX l I Xl J Al I E P X l I Al I E P X l l=1 J Xl I Al I n k = l=1 PX l n k = PX l I Xl J E P A l I Xl I Xl J E P X l I E P A l I Xl I E P X l l=1 I Xl J Al I E P X l I Al I E P X l The first inequality holds by Lemma 2. The second inequality follows from Lemma 1 which states that the distance of the random variables XI l, Xl J, Al I cannot be larger than the distance of all random variables X I, XJ l, A I. The subsequent equality holds due to the non-signaling condition between subsets I and J, and the last equality is a simple re-writing of some probabilities. By means of Lemma 2 (setting T to be a constant), we can also conclude that l P X l I Xl J E P X l, and thus in particular I Xl J l P X l I E P X l, is upper bounded by (n k)ε. Therefore, I noting that P X l = P I Xl XI X J, we can conclude that J J Xl I. n k P XI X J P A l I Xl I Xl J E P XI X J P A l I Xl I E 3(n k)ε. l=1 By summing over all subsets I {1,..., m} (and letting J be its complement), changing the order of the summation, and defining we get ε l := I PXI X J P A l I Xl I Xl J E P XI X J P A l I Xl I E n k ε l 3 2 m (n k)ε. l=1 Note that by definition of ε l, for any choice of I and J = {1,..., m} \ I, it holds that PXI X J P A l I Xl I Xl J E P XI X J P A l I Xl I E εl, J Xl I

47 H. Buhrman, S. Fehr, and C. Schaffner 33 and hence, by the lower bound π on P XI X J, that PA l I Xl I Xl J E ( x I, x J ) P A l I Xl I E ( x I ) ε l π for any x I and x J. For any l {1,..., n k}, consider the strategy q l for (one execution of) G, defined by q l (a x) = P Al X E(a x). By the above, q l l is (ε l /π )-almost non-signaling. Furthermore, by the definition of q l, the probability P [ E l E ] that the l-th repetition of the n-fold repetition of G is accepted equals the probability v[ q l ](G) that a single execution of G is accepted when strategy q l is played. Since q l is (ε l /π )-almost non-signaling, it follows from Proposition 18 that this probability is at most v ns (G) + c(g) ε l /π. The claimed bound on P [ E V E ] for a randomly chosen V in {1,..., n k} now follows from the bound on l ε l, where c (G) is given by 3 2 m c(g)/π. We are now ready to prove our main concentration bound. Proof (of Theorem 15). Let K be some integer parameter, to be defined later. Let V 1,..., V K be a random subset of distinct integers from {1,..., n}, and let D k be the random variable D k = W Vk = V(X V k, A V k ) for any k {1,..., K}. Understanding V 1,..., V K as a sample subset" of the n parallel repetitions of G, D k indicates whether the k-th game in the sample is won. A pair (d 1,..., d k ) {0, 1} k and (v 1,..., v k ) {1,..., n} of k-tuples is called typical if P D1 D k V 1 V k (d 1,..., d k v 1,..., v k ) 2 2K. Let T k be the event that (D 1 D k ) and (V 1 V k ) form a typical pair. Note that the corresponding complementary events satisfy T k T k+1 as well as P [ T k ] = atypical pairs (d 1...d k ),(v 1...v k ) P V1 V k (v 1,..., v k ) P D1 D k V 1 V k (d 1 d k v 1 v k ) < 2 K. Let γ := 1 v ns (G) ε where ε := δ/3. Note that we obviously may assume that δ 1 v ns (G) so that γ > 0. We now define a sequence of random variables M 0,..., M K as follows. Random variable M 0 takes the value 0 with certainty, and M k+1 is inductively defined as M k+1 := { Mk + γ if D k+1 =1 and T k M k (1 γ) otherwise. We want to show that M 0,..., M K forms a supermartingale. We fix k {0,..., K 1} and we fix values (v 1,..., v k ) for the random variables V 1,..., V k. Up to the end of this paragraph, all probabilities etc. are to be understood conditioned on these values. We define E to be the event that D 1,..., D k take on some arbitrary but fixed values (d 1,..., d k ). If the pair (d 1,..., d k ) and (v 1,..., v k ) is atypical, then conditioned on E we have M k+1 = M k +γ 1 < M k and thus E[M k+1 M 0 M k ] < E[M k M 0 M k ] = M k. In the other case, if the pair (d 1,..., d k ) and (v 1,..., v k ) is typical then P [ E ] 2 2K. Furthermore, Lemma 19 implies that P Dk+1 E(1) = P [ E Vk+1 E ] v ns (G) + c (G) log(1/p [ E ])/(n k) v ns (G) + c (G) 2K/(n K). We want this last term to be upper bounded by v ns (G) + ε = 1 γ, which we achieve by choosing K as K := αn where α := min{ε 2 /(3c (G) 2 ), 1/3}, as can easily be verified. It follows that E[M k+1 M 0 M k ] (1 γ)(m k + γ) + γ(m k (1 γ)) = M k (when conditioning on E). Since the argument that the M 0,..., M K form a supermartingale holds independent of the choice of (d 1,..., d k ) and of the choice of (v 1,..., v k ), M 0,..., M K indeed forms a supermartingale in the original probability space (without conditioning on the values for T Q C 1 4

48 34 On the Parallel Repetition of Multi-Player Games: The No-Signaling Case V 1,..., V k ). Therefore, [ K P D k (v ns (G)+2ε)K k=1 ] P [ TK ] + P [ MK (v ns (G)+2ε)Kγ (1 v ns (G) 2ε)K(1 γ) ] 2 K + P [ M K (γ 1 + v ns (G) + 2ε)K ] = 2 K + P [ M K εk ] 2 K + exp( ε 2 K/2) < 2 exp( ε 2 K/2). The first inequality holds by definition of M K, and the second by a simple manipulation of the terms. The equality holds by definition of γ, and the subsequent inequality by the Azuma-Hoeffding Inequality. Finally, the last inequality holds since ε < 1 and exp( 1 2 ) < 2. On the other hand, setting D := 1 K K k=1 D k, we can also write P [ D v ns (G) + 2ε ] P [ W > v ns (G) + δ ] P [ D v ns (G) + 2ε W > vns (G) + δ ] where by the Hoeffding Inequality (and using that ε = δ/3) Therefore, P [ D v ns (G)+2ε W > vns (G) + δ ] 1 exp( 2ε 2 K). P [ W > v ns (G) + δ ] 2 exp( ε2 K/2) 1 exp( 2ε 2 K). In case that exp( 2ε 2 K) < 1 4, we obtain the bound P [ W > v ns (G) + δ ] 8 3 exp( ε2 K/2). (5) Note that in the other case, if exp( 2ε 2 K) 1 4, then 2 exp( ε2 K/2) 1 and the bound (5) holds trivially. Setting µ := 1/(2 3 5 c (G) 2 ), and recalling that ε = δ/3 and K := αn with α chosen as α := min{ε 2 /(3c (G) 2 ), 1/3}, leads to the claim. 4 Conclusion and Open Questions This article initiates the investigation of the behavior of multi-player nonlocal games under parallel repetition. For the case of the non-signaling value, we provide a concentration bound for games with complete support. Our results might serve as a stepping stone for the investigation of the quantum and classical values. Other interesting questions include improving the rate of repetition (e.g. by making it independent of the minimal probability that any question is asked) or finding cryptographic applications, for instance in position-based cryptography. Acknowledgments. We would like to thank Tobias Müller for insightful discussions about the sensitivity of linear programs. HB is supported by a 7th framework EU SIQS grant. CS is supported by an NWO VENI grant. References 1 Boaz Barak, Anup Rao, Ran Raz, Ricky Rosen, and Ronen Shaltiel. Strong parallel repetition theorem for free projection games. In Irit Dinur, Klaus Jansen, Joseph Naor, and

49 H. Buhrman, S. Fehr, and C. Schaffner 35 José D. P. Rolim, editors, Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques, 12th International Workshop, APPROX 2009, and 13th International Workshop, RANDOM 2009, Berkeley, CA, USA, August 21 23, Proceedings, volume 5687 of Lecture Notes in Computer Science, pages Springer, Jop Briët, Harry Buhrman, Troy Lee, and Thomas Vidick. Multipartite entanglement in xor games. Quantum Information & Computation, 13(3-4): , March Harry Buhrman, Nishanth Chandran, Serge Fehr, Ran Gelles, Vipul Goyal, Rafail Ostrovsky, and Christian Schaffner. Position-based quantum cryptography: Impossibility and constructions. In Phillip Rogaway, editor, Advances in Cryptology CRYPTO 2011, volume 6841 of Lecture Notes in Computer Science, pages Springer Berlin / Heidelberg, Harry Buhrman, Serge Fehr, Christian Schaffner, and Florian Speelman. The garden-hose model. In Innovations in Theoretical Computer Science, ITCS 13, Berkeley, CA, USA, January 9 12, 2013, pages ACM, A. Chailloux and G. Scarpa. Parallel Repetition of Entangled Games with Exponential Decay via the Superposed Information Cost. arxiv: , Richard Cleve, William Slofstra, Falk Unger, and Sarvagya Upadhyay. Perfect parallel repetition theorem for quantum xor proof systems. Computational Complexity, 17(2): , I. Dinur, D. Steurer, and T. Vidick. A parallel repetition theorem for entangled projection games. arxiv: , Wassily Hoeffding. Probability inequalities for sums of bounded random variables. Journal of the American Statistical Association, 58(301):13 30, March Thomas Holenstein. Parallel repetition: Simplification and the no-signaling case. Theory of Computing, 5(1): , R. Jain, A. Pereszlényi, and P. Yao. A parallel repetition theorem for entangled two-player one-round games under product distributions. arxiv: , Julia Kempe, Oded Regev, and Ben Toner. Unique games with entangled provers are easy. SIAM J. Comput., 39(7): , July Julia Kempe and Thomas Vidick. Parallel repetition of entangled games. In Proceedings of the 43rd annual ACM symposium on Theory of computing, STOC 11, pages , New York, NY, USA, ACM. 13 Anup Rao. Parallel repetition in projection games and a concentration bound. SIAM J. Comput., 40(6): , Ran Raz. A parallel repetition theorem. SIAM J. Comput., 27(3): , June Ricky Rosen. A k-provers parallel repetition theorem for a version of no-signaling model. Discrete Math., Alg. and Appl., 2(4): , A. Schrijver. Theory of Linear and Integer Programming. Wiley Series in Discrete Mathematics & Optimization. John Wiley & Sons, Marco Tomamichel, Serge Fehr, Jędrzej Kaniewski, and Stephanie Wehner. A monogamyof-entanglement game with applications to device-independent quantum cryptography. New Journal of Physics, 15(10):103002, T Q C 1 4

50 Quantum Communication Complexity with Coherent States and Linear Optics Juan Miguel Arrazola 1 and Norbert Lütkenhaus 1,2 1 Institute for Quantum Computing, University of Waterloo 200 University Avenue West, N2L 3G1 Waterloo, Ontario, Canada 2 Department of Physics and Astronomy, University of Waterloo 200 University Avenue West, N2L 3G1 Waterloo, Ontario, Canada Abstract We introduce a general mapping for encoding quantum communication protocols involving pure states of multiple qubits, unitary transformations, and projective measurements into another set of protocols that employ coherent states of light in a superposition of optical modes, linear optics transformations and measurements with single-photon threshold detectors. This provides a general framework for transforming a wide class of protocols in quantum communication into a form in which they can be implemented with current technology. In particular, we apply the mapping to quantum communication complexity, providing general conditions under which quantum protocols can be implemented with coherent states and linear optics while retaining exponential separations in communication complexity compared to the classical case. Finally, we make use of our results to construct a protocol for the Hidden Matching problem that retains the known exponential gap between quantum and classical one-way communication complexity ACM Subject Classification J.2 Physics, E.4 Formal Models of Communication Keywords and phrases Quantum Communication Complexity, Quantum Optics Digital Object Identifier /LIPIcs.TQC Introduction What information-processing tasks are unachievable in a classical world but become possible when exploiting the intrinsic quantum mechanical properties of physical systems? This question has been a driving force of numerous research endeavours over the last two decades and remarkable progress has been made in our understanding of the advantages that quantum mechanics can provide, as well is in developing the experimental platforms that will allow them to be realized in practice [18, 7, 13, 22]. An example pertains to the field of quantum communication [14], where quantum systems can be used, for instance, to distribute secret keys [4, 5] or reduce the amount of communication required for joint computations [8, 9, 19, 2]. In terms of experimental implementations, only quantum key distribution (QKD) has been routinely demonstrated and deployed over increasingly complex networks and large distances [24, 21]. This is possible largely due to the fact that, fundamentally, QKD can be carried out with sequences of independent signals and measurements [22]. QKD and other cryptographic applications are easier to implement, as imperfections in implementations only need to be overcome to the point of being able to achieve their qualitative goal. Other tasks, such as those in quantum communication complexity, face the additional challenge of demonstrating, in practice, their quantitative improvements over classical alternatives. Moreover, many of these tasks require sophisticated quantum states to be transmitted and measured. As such, there is a large set of quantum communication protocols Juan Miguel Arrazola and Norbert Lütkenhaus; licensed under Creative Commons License CC-BY 9th Conference on the Theory of Quantum Computation, Communication and Cryptography (TQC 14). Editors: Steven T. Flammia and Aram W. Harrow; pp Leibniz International Proceedings in Informatics Schloss Dagstuhl Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany T Q C

51 J. M. Arrazola and N. Lütkenhaus 37 whose potential advantages currently escape the grasp of available technology. Thus, only a few proof-of-principle implementations have been reported [28, 26, 16]. Confronted with these challenges we face two alternatives: We can either strive to improve current technology or we can flip the issue around and ask: Can protocols in quantum communication be adapted to a form that makes them ready to be deployed with available techniques? To adopt the latter strategy is to push for a theoretical reformulation that converts previously intractable protocols into a form that, while conserving their relevant features, eliminates the obstacles affecting their implementation. This is precisely the road that has already been successfully followed for QKD. In this work, we describe in detail an abstract mapping that converts quantum communication protocols that use pure states of multiple qubits, unitary operations, and projective measurements into another class of protocols that use only a sequence of coherent states, linear optics operations, and measurements with single-photon threshold detectors. The new class of protocols requires a number of optical modes equal to the dimension of the original states, but the number of photons can be chosen freely and is typically very small. This results in the signal states occupying a small Hilbert space, so that they can only be used to transmit the equivalent of a number of qubits that is only logarithmic in the number of modes used. We proceed by examining how the mapping may be generally applied in the context of quantum communication complexity and conclude by illustrating a coherent-state protocol for the Hidden Matching problem. 2 Coherent-state Protocols We consider a wide class of quantum communication protocols that require only three basic operations: the preparation of pure states of a fixed dimension, unitary transformations on these states, and projective measurements on a canonical basis. This set of protocols is not completely general since we are not accounting for the possibility of shared entanglement or non-unitary evolution, although these extensions could potentially be considered. The simplest form of a protocol in this class is one in which Alice prepares a state ψ and sends it to Bob, who then applies a unitary transformation U B to that state, followed by a projective measurement on the canonical basis. More complex protocols can be constructed by increasing the number of these basic operations as well as the number of parties. Even though these protocols generally involve states of some arbitrary dimension d, we can always think of them as corresponding to a system of O(log 2 d) qubits. Hence, we refer to them as qubit protocols. An exact implementation of such protocols can be achieved without the use of actual physical qubits by instead considering a single photon in a superposition of optical modes. Any pure state ψ = d k=1 λ k k, with d k=1 λ k 2 = 1, can be equally thought of as the state of a single photon in a superposition of d modes a ψ 0 = d λ k 1 k, (1) k=1 where a ψ = d k=1 λ kb k for a collection of creation operators {b 1, b 2,..., b d } corresponding to d optical modes, and where 1 k is the state of a single photon in the k-th mode. In this picture, unitary operations correspond exactly to linear optics transformations, and measurements in the canonical basis are equivalent to a photon counting measurement in each of the modes. From a practical perspective, the issue with implementing qubit protocols in terms of a single photon in a superposition of modes is that the experimental preparation T Q C 1 4

52 38 Quantum Communication Complexity with Coherent States and Linear Optics of these states also presents daunting challenges. Instead, we are interested in an adaptation of this formulation of qubit protocols into another that is more readily implementable in practice. With this purpose in mind, we outline a method for converting qubit protocols into another class of protocols that, although seemingly disparate, actually retain the essential properties of the original ones. We call these coherent-state protocols since they can be implemented by using only coherent states of light and linear optics operations. The recipe for constructing coherent-state protocols is specified by the following rules: Coherent-state Mapping 1. The original Hilbert space H of dimension d with canonical basis { 1, 2,..., d } is mapped to a set of d orthogonal optical modes with corresponding annihilation operators {b 1, b 2,..., b d }: k b k. (2) 2. A state ψ = d k=1 λ k k is mapped to a coherent state with parameter α in the mode a ψ = d k=1 λ kb k : ψ α, ψ := D aψ (α) 0 d = α λ k k, (3) k=1 where α λ k k is a coherent state with parameter α λ k in the k-th mode. The value of α can be chosen freely but remains fixed. 3. A unitary operation U acting on a state in H is mapped into linear optics transformation corresponding to the same unitary operator U acting on the modes {b 1, b 2,..., b d }. Thus, the transformation of a state is linked to a transformation of the modes as: b 1 ψ b 2 = U ψ. b 1 = U b 2.. (4) b d b d 4. A projective measurement in the canonical basis { 1, 2,..., d } is mapped into a two-outcome measurement in each of the modes: { k k } {F k no-click, F k click}, (5) where F k no-click = 0 0 is a projection onto the vacuum, F k no-click = n=1 n k n k and n k is a state with n photons in the k-th mode. As such, an outcome in a coherent-state protocol corresponds to a pattern of clicks in the modes. For coherent-state protocols, the observation of N clicks correspond to a particular pattern of N outcomes of a qubit protocol. Thus, an immediate interpretation of the outcomes is not provided by the mapping, but instead must be chosen according to the particular context. Since any qubit protocol can be constructed from the basic operations of state preparation, unitary transformations, and projective measurements, the above instructions are sufficient to construct the coherent-state version of any qubit protocol up to an interpretation of the

53 J. M. Arrazola and N. Lütkenhaus 39 j0i 1 Qubit Protocol j0i U Ã.. UB.. j0i log2 d Coherent-State Protocol j i 1 j 1i 1 jvaci U Ã j 2i 2.. U B.. jvaci d j di d TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAA Figure 1 (Color online) In a simple qubit protocol, Alice prepares a state ψ = d λ k=1 k k of log 2 d qubits by applying a unitary transformation U ψ on an inital state 0 := 0 log 2 d. She sends the state to Bob, who applies a unitary transformation U B and measures the resulting state in the computational basis. In the equivalent coherent-state protocol, the initial state corresponds to a coherent state in a single mode and the vacuum on the others. The state α, ψ = d k=1 α λ k k is prepared by applying the transformation U ψ to the optical modes. This state is sent to Bob, who applies the transformation U B and consequently measures each mode for the presence of photons with threshold single-photon detectors. measurement outcomes. As an illustration, a simple qubit protocol and its coherent-state counterpart are depicted in Fig. 1. An immediate appealing property of coherent-state protocols is that their implementation faces much lesser obstacles than their qubit counterparts. Indeed, the fundamental challenge of a quantum-optical implementation of qubit protocols lies in the difficulty of generating entangled states of many qubits and performing global unitary transformations on them. On the other hand, coherent-state protocols face significantly less daunting obstacles. The experimental generation of coherent states is a commonplace task and the construction of linear-optical circuits can, in principle, be realized with simple devices such as beam splitters and phase-shifters [20], though experimental challenges may remain depending on the required unitary operation. Moreover, the platforms for linear optics experiments continue to improve at a fast rate, most notably with the development of integrated optics [25] and time-bin encodings [17, 10]. As we have mentioned already, an advantage of coherent-state protocols is that they employ a coherent state in a superposition of modes, which is equivalent to a tensor product of individual coherent states across the various modes. However, qubit protocols usually require high amounts of entanglement. This seems to indicate that the quantumness of the original qubit protocol has been lost through the mapping. Nevertheless, it is important to realize that this is not the case, as coherent-state protocols showcase a truly quantum property: non-orthogonality. Given two states α, ψ = d k=1 α λ k k and α, ϕ = d k=1 α ν k k, with d α, the individual coherent states in each mode will typically be highly non-orthogonal, i.e. α ν k α λ k 1. Moreover, the presence of single-photon detectors also permit truly quantum phenomena, such as unambiguous state discrimination of non-orthogonal states. In fact, it can be useful to intuitively think of the coherent-state mapping as an exchange T Q C 1 4

54 40 Quantum Communication Complexity with Coherent States and Linear Optics between entanglement and non-orthogonality, since an implementation of qubit protocols with actual physical qubits usually requires entanglement amongst the qubits. In coherent-state protocols, the average photon number, α 2, is a parameter that can be chosen independently of the dimension of the states of the original qubit protocol. This is to be put in contrast with any quantum-optical realization of a qubit protocol, which inevitably requires a number of photons that scales with the dimension of the states. Hence, coherent-state protocols offer an intrinsic saving in the number of photons required for their implementation. The drawback, of course, is that the number of optical modes is exponentially larger than the number of qubits in the original protocol. This means that the mapping is only suitable for its application to protocols that originally require only a small number of qubits. From a theoretical perspective, the relationship between these two types of protocols may provide an insight into the trade-offs between different resources in quantum communication, as well as into the interplay between entanglement and non-orthogonality in quantum mechanics. Now that we have outlined the coherent-state mapping, we continue by describing how these techniques can be applied in the construction of protocols in quantum communication complexity. 3 Quantum Communication Complexity Communication complexity is the study of the amount of communication that is required to perform distributed information-processing tasks. This corresponds to the scenario in which two parties, Alice and Bob, respectively receive inputs x {0, 1} n and y {0, 1} n and their goal is to collaboratively compute the value of a Boolean function f(x, y) with as little communication as possible [27]. Although they can always do this by communicating their entire input, the pertaining question in communication complexity is: What is the minimum amount of communication that is really needed? Likewise, quantum communication complexity studies the case where the parties are allowed to employ quantum resources such as quantum channels and shared entanglement [6, 7]. Remarkably, it has been proven that there exist various problems for which the use of quantum resources offer exponential savings in communication compared to their classical counterparts [9, 19, 2, 12, 8]. As discussed previously, coherent-state protocols require a number of modes that is exponentially larger than the number of qubits of the original protocol. Thus, from a practical perspective, the exponential savings that are possible for certain tasks in quantum communication complexity conveniently balance the exponential increase in the number of modes, making them a natural candidate for the application of the coherent-state mapping. We are first interested in quantifying the amount of communication that takes place in a quantum communication complexity protocol. Informally, this is done by counting the number of qubits that are employed. But what happens if a protocol uses physical systems that are manifestly not qubits? In that case, we quantify the amount of communication in terms of the smallest number of qubits that would be required, in principle, to replicate the performance of the protocol. More precisely, if a quantum communication protocol uses states in a Hilbert space of dimension d, this space can be associated to a system of O(log 2 d) qubits. Therefore, the amount of communication C in a quantum protocol is generally given by C = log 2 [dim(h)] (6)

55 J. M. Arrazola and N. Lütkenhaus 41 where H is the smallest Hilbert space containing all states of the protocol. Moreover, Holevo s theorem [15] guarantees that no more than log 2 d classical bits of information could be transmitted, on average, by a quantum protocol that uses state in a Hilbert space of dimension d. Quantifying communication in qubit protocols is straightforward. For coherent-state protocols, even though the actual Hilbert space associated to all possible signal states is large (distinct coherent states are linearly independent), they effectively occupy a small Hilbert space, as is expressed in the following theorem: Theorem 1. [1] For any state ψ in a Hilbert space of dimension d, let α, ψ be the state associated to it through the coherent-state mapping. Then, for any ɛ > 0, there exists a Hilbert space H α of dimension d α such that log 2 d α = O(log 2 d), α, ψ P Hα α, ψ 1 ɛ, and where P Hα is the projector onto H α. Proof. For a given > 0, let H α be the subspace spanned by the set of Fock states { n 1 n 2... n d } over d modes whose total photon number n = d k=1 n k satisfies n α 2. The dimension of H α is equal to the the number of distinct ways in which n photons can be distributed into the d different modes. Since the photons are indistinguishable, this quantity is given by the binomial factor ( ) n+d 1 d 1 [23]. In the case of Hα, there are 2 different possible values of n, the largest being n = α 2 +. Thus, the dimension d α of this subspace satisfies ( α log 2 d α log 2 [2 2 )] + + d 1 d 1 ( α 2 + ) log 2 [ ( α d 1) ] + log 2 (2 ), (7) which is O(log 2 d) for any fixed α and. Now notice that the number α, ψ P Hα α, ψ is equal to the probability of performing a photon number measurement on α, ψ and obtaining a value satisfying n α 2. Since any coherent state α, ψ has a Poissonian photon number distribution with mean α 2, we can use the properties of this distribution to calculate the probability that the measured number of photons lies within the desired range. This probability satisfies [11] P ( n α 2 ) 2e α 2 ( e α 2 α 2 + ) α 2 + which can be made equal to any ɛ > 0 by choosing accordingly while keeping α fixed. (8) Therefore, the fact that the mean photon number α 2 is fixed in coherent-state protocols leads to the states involved effectively occupying a Hilbert space of dimension that is comparable to that of the original one. This implies that the asymptotic behaviour of the amount of communication is the same for both classes of protocols. Moreover, the effectively unused sections of the entire Hilbert space can still be used, in principle, for other purposes such as the transmission of additional information. We now focus on the bounded-error model in which Alice and Bob have randomness at their disposal and need only determine the value of the function f(x, y) with probability greater or equal to 1 ɛ for all possible values of x and y. They can send quantum states to T Q C 1 4

56 42 Quantum Communication Complexity with Coherent States and Linear Optics each other, apply unitary transformations on these states, and make measurements in the same way as the quantum communication protocols discussed before. Since they are only interested in learning the value of the function, their final measurement can always be thought of as a projective measurement onto two orthogonal subspaces H 0 and H 1, corresponding to f(x, y) = 0 and f(x, y) = 1 respectively. In a coherent-state version of this model, the crucial difference lies in the measurement stage, where the subspaces H 0 and H 1 are mapped onto sets of modes S 0 and S 1. Unlike the qubit protocol, there can be clicks happening in both sets of modes and as a consequence, checking for the presence of clicks does not suffice to determine the value of the function. Instead, in order to decide between both possible values of f(x, y), we opt for the strategy of counting the number of clicks that occur in each set of modes and selecting the one with the largest number of clicks. Let C b be the random variable corresponding to the number of clicks observed in the set of modes S b, with b = 0, 1. The distribution of C b is known as a Poisson-binomial distribution and its expectation value is given by E(C b ) = k S b p α,k := µ b, (9) where p α,k = 1 exp( α λ k 2 ) is the probability of obtaining a click in the k-th mode. This distribution can be difficult to work with in its exact form, so it is usual to approximate it by a Poisson distribution with the same mean. This approximation can be made precise through the following result: Theorem 2. [3] Let C b be a Poisson-binomial random variable with mean µ b. Similarly, let L b be a Poisson random variable with the same mean µ b. Then, for any set A, it holds that Pr(C b A) Pr(L b A) min(1, µ 1 b )τ b, (10) where τ b := k S b (p α,k ) 2 and p α,k is the probability of obtaining a click on the k-th mode. We can use this fact to show that, under certain conditions, a coherent-state version of a bounded-error qubit protocol also gives the correct value of the function with bounded error. Theorem 3. Let a qubit protocol for communication complexity have a probability of success P 1 ɛ. Then the corresponding coherent-state protocol has a probability of success P α > 1 ɛ if there exists a µ = α 2 such that 2e P µ (2eP µ) µ/2 + max µ 0,µ 1 {min(1, µ 1 b )}τ ɛ (11) where µ b is the expected number of clicks in the set of modes S b and τ = k (p α,k) 2. Proof. Without loss of generality, we take f(x, y) = 0 to correspond to the correct value of the function. We can bound the success probability as P α = Pr(C 0 > C 1 ) Pr(C 0 > µ 2 ) Pr(C 1 < µ 2 ) = (1 Pr(C 0 < µ 2 ))(1 Pr(C 1 > µ 2 )). From Theorem 2 we can also write Pr(C 0 < µ 2 ) Pr(L 0 < µ 2 ) + min(1, µ 1 0 )τ 0 ( ) µ/2 2eµ0 e µ0 + min(1, µ 1 0 µ )τ 0,

57 J. M. Arrazola and N. Lütkenhaus 43 where we have bounded the Poisson distribution as in Eq. (8). Similarly we have ( ) µ/2 Pr(C 1 > µ 2 ) 2eµ1 e µ1 + min(1, µ 1 1 µ )τ 1. Putting these together we get ( ( ) ) ( µ/2 2eµ0 P α 1 e µ0 min(1, µ 1 0 µ )τ 0 ( ) µ/2 ( 2eµ0 2eµ1 >1 e µ0 e µ1 µ µ 1 e µ1 ( 2eµ1 µ ) µ/2 min(1, µ 1 1 )τ 1 ) µ/2 min(1, µ 1 0 )τ 0 min(1, µ 1 1 )τ 1 1 e P µ (2eP µ) µ/2 e (1 P )µ (2e(1 P )µ) µ/2 max{min(1, µ 1 µ b )}τ, 0,µ 1 where τ = τ 0 + τ 1 = k (p α,k) 2 and we have used the fact that P µ = k S 0 α 2 p k > k S 0 (1 e α 2 p k ) = µ 0 (12) ) and similarly (1 P )µ > µ 1. Whenever P > 1/2, it holds that e P µ (2eP µ) > e (1 P )µ (2e(1 P )µ) so we can finally write P α > 1 2e P µ (2eP µ) µ/2 max µ 0,µ 1 {min(1, µ 1 b )}τ. (13) From this expression it is clear that whenever condition (11) holds, P α > 1 ɛ as desired. Notice that the quantity 2e P µ (2eP µ) µ/2 can be made arbitrarily small for any P > 1 ɛ by choosing a large enough value of µ = α 2. However, large values of µ result in higher values of the individual click probabilities {p k,α } and consequently larger values of τ = k (p α,k) 2, making it harder for the quantity max µ0,µ 1 {min(1, µ 1 b )}τ to be small. Therefore, condition (11) may only be satisfied when the original probabilities {p i } are very small, as this results in a small τ even when µ is large. Of course, whenever the communicated states lie in a Hilbert space of large dimension, we expect the outcome probabilities to be small and, consequently, the coherent-state protocol to function adequately. We would like to apply the coherent-state mapping to known protocols in quantum communication complexity. In fact, this has already been demonstrated in [1], where, essentially, a coherent-state mapping was used to construct a protocol for quantum fingerprinting. We now discuss how the mapping can be used to construct a protocol for the Hidden Matching Problem. The Hidden Matching Problem. In this communication complexity problem, Alice receives an n-bit string x {0, 1} n as input, with n an even number. Additionally, Bob receives a perfect matching M = {(i 1, j 1 ), (i 2, j 2 ),..., (i n/2, j n/2 )} on the set of numbers {1, 2,..., n}, i.e. a partition into n/2 disjoint pairs. A perfect matching can be visualized as a graph with n vertices and n/2 edges, where each vertex is connected to only one other vertex. Only one-way communication from Alice to Bob is permitted and their goal is to output an element of the matching (i, j) and a bit value b such that b = x i x j, where x i is the i-th bit of the string x. It has been shown that any classical protocol requires Ω( n) bits of communication, even in the presence of errors [2]. On the other hand, there exists an efficient quantum T Q C 1 4

58 44 Quantum Communication Complexity with Coherent States and Linear Optics Figure 2 (Color online) An example of an implementation of a coherent-state protocol for the Hidden Matching problem. Alice receives a string of six bits and Bob receives the matching (1, 6), (2, 5), (3, 4), as represented in the graph. Alice encodes her input values in the phases of six coherent states in different modes and sends them to Bob. His measurement consists of a circuit in which the modes are permutated in accordance with the matching and then interefere pairwise in three balanced beamsplitters. Bob can output a correct solution to the problem based on the detectors that click. protocol that uses only O(log 2 n) qubits of communication and outputs the correct answer with certainty. In this protocol, Alice prepares the state x = 1 n n i=1 ( 1) xi i (14) and sends it to Bob, who measures it in the basis { 1 2 ( i ± j )}, (15) with (i, j) M. The outcome 1 2 ( i + j ) only occurs if x i x j = 0 and similarly, 1 2 ( i j ) only occurs if x i x j = 1. This allows Bob to give a correct output after performing his measurement. Note that Bob s measurement basis is constructed from the canonical basis by applying a Hadamard transformation to the subspaces { i, j }, with (i, j) M. To construct a coherent-state protocol for the Hidden Matching problem, we just have to apply the rules of the mapping. In this case, Alice prepares the state α, x = n ( 1) xi α n i=1 and sends it to Bob. The linear-optical equivalent of a Hadamard gate is a balanced beamsplitter, so Bob s measurement consists of interfering each of the pairs of modes {b i, b j } (with (i, j) M) in a balanced beam-splitter and detecting photons in the outputs as illustrated in Fig. 2. If the incoming states to the input ports of the beam splitter are ( 1) xi α n ( 1) xj α n, (17) the output states will be ( 1 + ( 1) ) xi xj n α ( 1 ( 1) ) xi xj n α. (18) (16)