Three problems from quantum optics

Institute of Theoretical Physics and Astrophysics Faculty of Science, Masaryk University Brno, Czech Republic Three problems from quantum optics (habilitation thesis) Tomáš Tyc Brno 005

Contents 1 Introduction 5 1.1 Quantum state sharing.................................... 5 1. Homodyne detection..................................... 7 1.3 Fermion coherent states................................... 7 Some important terms and concepts of quantum optics 9.1 Field operators and quadratures.............................. 9. Linear mode transformation................................. 10.3 Coherent states of light................................... 1.4 POVM............................................. 13 3 Quantum state sharing 14 3.1 Continuous-variable quantum state sharing in the Schrödinger picture......... 15 3.1.1 Encoding the quantum secret............................ 15 3.1. Extraction of the quantum secret.......................... 16 3.1.3 Example: the (,3) threshold scheme........................ 17 3.1.4 Optimizing the secret extraction.......................... 18 3.1.5 Finite squeezing in dealer s encoding procedure.................. 19 3. Heisenberg picture of continuous-variable quantum state sharing............ 0 3..1 Encoding the secret................................. 0 3.. Extraction of the secret state by players 1 and................. 1 3..3 Extraction of the secret state by players 1 and 3................. 3.3 Experimental realization of the (, 3) threshold scheme.................. 3 3.4 Conclusion.......................................... 3 4 Homodyne detection 5 4.1 Homodyne detection as a phase-sensitive method..................... 5 4. Why homodyne detection measures the field quadrature................. 6 4.3 POVM calculation using the SU() Wigner functions................... 7 4.4 POVM calculation using the Glauber-Sudarshan P -representation....................................... 9 4.4.1 Properties of the series expressing the probability Pm j.............. 30 4.5 Strong local oscillator.................................... 3 4.6 Conclusion.......................................... 3 5 Fermion coherent states 34 5.1 Introduction.......................................... 34 5. The options for introducing coherent states of light.................... 34 5.3 Fermion analogy of the boson coherent state........................ 36 5.4 Properties of fermion correlators.............................. 37 3

5.4.1 Correlators of chaotic states............................. 39 5.5 Conclusion.......................................... 39 4

Chapter 1 Introduction This thesis is concerned with three problems from the field of quantum optics. In their choice I was not motivated by attempting to explain quantum optics systematically but I rather talk about problems I was working on in the past five years. The thesis is based on a set of articles that have been published in international physical journals and are attached at the end of the thesis. The first topic, quantum secret sharing, deals with protection of quantum information that is physically realized by a quantum-optical system. The second topic, theory of homodyne detection, is concerned with the description of one of the most important detection methods in quantum optics. The third topic, fermion coherent states, deals with generalization to fermion fields of coherent states, one of the key concepts of quantum optics. Each of these topics is described briefly below and in detail in a separated chapter. I have tried to write this thesis clearly so that a physicist not specialized in quantum optics can understand it, and also that it can be of some use to a non-physicist. To some extent the thesis re-tells the papers it is based on; at the same time, I have tried to include all the important results and explain the steps that led to them so that a reader does not have to look into the papers too often. This is also the reason why I have included Chapter that explains some important terms and concepts of quantum optics that are used in this thesis. As I said, all the topics this thesis deals with are directly connected to quantum optics. This area of physics is, as is clear from its name, the quantum theory of light. In many situations light behaves as a wave governed by the laws of classical physics but sooner or later one comes across a situation where the classical description is completely unsatisfactory and the quantum nature of light presents itself in the full extent. It is enough just to sit down by a fireplace and think what is the color of the light emitted by the glowing coals. Classical physics would give us a completely wrong answer in the form of the ultraviolet catastrophe [1] while quantum optics allows to find the spectral composition of the emitted light in a full agreement with the observation. And of course, quantum optics offers much more. The consequences of the quantum nature of light are vast and many of them are very practical. We just remind of the laser, which is a source of light commonly used for precise measurements, communication, reading information media, for medical therapy etc., and which can work thanks to the quantum properties of light. Also, quantum optics enables realization of various cryptographic protocols, the security of which is guaranteed by the very laws of nature and not e.g. by just computational difficulty. Last but not least, it is in quantum optics where the laws of quantum physics often appear in a crystalline pure form and so it enables us to deeper understand the rules that the world around us is governed by. 1.1 Quantum state sharing At the present time, the importance of quantum optics for practical implementation of quantum information protocols is growing as quantum states of light belong to the best carriers of quantum 5

Three problems from quantum optics information []. Moreover, the experimental effort for realizing certain quantum-information protocols such as quantum teleportation has been most successful in quantum optics [3, 4, 5]. Quantum information theory is a fast-developing interdisciplinary field that offers options that would otherwise be impossible or very difficult [6]. For example, quantum cryptography provides nowadays a practically usable method for an unconditionally secure information transfer without the risk of eavesdropping [7, 8]. At the same time, processing of quantum information in quantum computers enables solving problems that would take an incomparably longer time on a classical computer (e.g. billions of years compared to a few minutes) [9, 10], and simulating quantum systems that is highly ineffective on a classical computer [11]. There are several algorithms that have been proposed for quantum computers that are designed for solving very specific problems such as large number factorization or search in a database [1]. However, these algorithms have a relatively limited use and so new algorithms that would exploit the full potential of quantum computers are still to be discovered. Similarly, quantum computers themselves are waiting for their practical realization. Quantum information differs significantly from its counterpart, the classical information. The basic unit of quantum information is a quantum bit (qubit). A qubit can have, just as a classical bit, the values 0 and 1, but it can also be in a so-called superposition of these two values. The superposition is a way of simultaneous existence of the two options that a human has no direct experience of, which makes it hard to imagine. A qubit is realized practically by a two-level quantum system, e.g. the spin state of an electron, photon polarization or even by the options there is a photon in mode k and there is no photon in mode k. In principle, one can perform similar logical operations with qubits as with classical bits. However, it is not possible to copy (or clone) them, which is a fundamental difference compared to classical information that can be copied arbitrarily. The impossibility of copying quantum information is an important consequence of linearity of the laws of quantum physics and it became known as the no-cloning theorem [13]. It is also connected to the fact that it is not possible to read quantum information completely even if one possesses the system carrying it; there is always some information that escapes, no matter what measurements one performs on the system [14]. With the expansion of quantum information theory, there is a growing interest for its storage, transfer and protection against misuse. More specifically, quantum teleportation enables to transfer quantum information between stations where it cannot be be sent physically (i.e., that are not connected by a so-called quantum channel) [3, 5]. On the other hand, for protecting quantum information one can use the protocol of quantum state sharing that enables the access to the information only based on collaboration between several participants; without such collaboration, the access is denied completely. In the last few years I have been working on the theory of quantum state sharing. With co-workers I have achieved several results, the most important of which was proposing optical quantum state sharing scheme and its experimental realization at the Australian National University in Canberra. Theory of quantum state sharing and the experimental realization is discussed in Chapter 3. It is based on the following articles: (1) Tomáš Tyc and Barry C. Sanders, How to share a continuous-variable quantum secret by optical interferometry, Physical Review A 65, 04310 (00) () Tomáš Tyc, David Rowe and Barry Sanders, Efficient sharing of a continuous-variable quantum secret, Journal of Physics A 36, 765 (003) (3) Andrew M. Lance, Thomas Symul, Warwick P. Bowen, Tomáš Tyc, Barry C. Sanders and Ping Koy Lam, Continuous variable (,3) threshold quantum secret sharing schemes, New Journal of Physics 5, 4 (003) (4) Andrew M. Lance, Thomas Symul, Warwick P. Bowen, Barry C. Sanders, Tomáš Tyc, Timothy C. Ralph and Ping K. Lam, Continuous Variable Quantum State Sharing via Quantum Disentanglement, Physical Review A 71, 33814 (005). 6

Chapter 1. Introduction 1. Homodyne detection Modern quantum optics is, to a large extent, an experimental discipline for which the precise measurement of a quantum state of light is of a key importance. One of the essential detection methods is the homodyne detection based on interference of the measured light beam with a beam of well-known properties (the so-called local oscillator). Homodyne detection is a phase-sensitive method and it enables a direct measurement of quadratures, basic quantities used for describing the quantized electromagnetic field. Many important quantum-optical experiments are literally based on homodyne detection that has become a standard experimental tool. Homodyne detection is the ultimate detection method in experiments with squeezed light, in quantum teleportation and cryptography with so-called continuous variables and in many other situations. Therefore it is surprising that until recently the full quantum description of homodyne detection was missing, especially the knowledge of POVM (its meaning will be explained in Chapter, Sec..4). The theory of homodyne detection was based on indirect calculations employing characteristic functions and quadrature moments of the electromagnetic field [15, 16, 17, 18, 19, 0], but no direct derivation of the probability distribution of homodyne detector output was known. When I discussed this problem with colleagues at a conference in Vienna in 000, we decided to work on finding the POVM for homodyne detection and directly calculating the corresponding probability distribution. In the following two years we have managed to find the POVM including correction terms that enables to describe the detection even in the non-ideal conditions of a weak local oscillator. This result is important both for theoretical understanding of homodyne detection and for practical application in which a weak reference field has to be used. Theory of homodyne detection that I have developed in collaboration with Barry Sanders is explained in Chapter 4 and it was published in the paper (5) Tomáš Tyc and Barry C. Sanders, Operational formulation of homodyne detection, Journal of Physics A 37, 7341 (004). 1.3 Fermion coherent states For describing the quantized electromagnetic field, quantum optics uses an extended mathematical formalism that is sometimes very elegant. One of the most important representations of quantum states and operators is provided by coherent states of light that possess many useful physical and mathematical properties [1]. These states exhibit high coherence, they are close to classical states of light, do not change their character when subject to a linear mode transformation at a beam splitter etc. Thanks to the so-called overcompleteness of the set of coherent states they can be employed even for describing situations in which coherent states themselves do not take part, and simplify calculations significantly. Coherent states became best known in their connection with the electromagnetic field. Photons, the quanta of this field, belong to bosons, the group of particles that tend to gather in the same quantum state. This property is a consequence of their quantum indistinguishability it is not possible, even in principle, to distinguish two particles of the same sort. For the other type of particles, the fermions, quantum indistinguishability has just the opposite effect: it is not possible to find more than one fermion in the same state. This is expressed by the Pauli exclusion principle, one of the most fundamental statements in quantum physics. Thanks to the common properties of all bosons, one can easily extend coherent states to arbitrary boson fields. This raises a natural question: is it possible to generalize the concept of coherent states also to fermion fields, for example electrons or neutrons? Such a generalization is indeed possible and was performed several decades ago [, 3, 4] based on the so-called Grassmann numbers. However, the analogy with boson coherent states is just partial and not direct. The largest problem is that the algebra of non-commuting Grassmann numbers provides coherent states without any physical interpretation. Therefore I was thinking about introducing 7

Three problems from quantum optics fermion coherent states in a direct analogy to the boson case without employing the Grassmann numbers. When discussing this with my colleagues at Macquarie University in Sydney, we attacked this problem and have achieved several results. We have shown that the desired generalization is not possible and that the Grassmann variables are probably the only possibility how to introduce fermion coherent states meaningfully. A side effect of our effort was deriving several theorems that are valid for fermion correlation functions and that have no analogy for boson fields. The problem of fermion coherent states is discussed in Chapter 5 that is based on the paper (6) Tomáš Tyc and Barry C. Sanders, Investigating complex fermion coherent states, at the present time in the review process in New Journal of Physics. 8

Chapter Some important terms and concepts of quantum optics In this chapter we remind of some important terms that will be used in this thesis. We do not intend to provide a complete introduction but rather mention some basic quantities and relations between them so that a reader who is not trained in the area of quantum optics could read the following chapters without having to look often into a quantum optics textbook..1 Field operators and quadratures Basic quantities used for describing the quantized electromagnetic field are creation and annihilation operators â, â that are generally called field operators. The creation and annihilation operator raises and lowers, respectively, the number of quanta (photons) in the field. If n denotes the state with n photons (n th Fock state), then it holds â 0 = 0, â n = n n 1 (n = 1,, 3,... ) (.1) â n = n + 1 n + 1 (n = 0, 1,,... ) The creation and annihilation operators satisfy the commutation relations [â i, â j ] = δ ijˆ1, [â i, â j ] = 0, [â i, â j ] = 0, (.) where the indexes i, j distinguish individual modes, that is, the ways of the possible field oscillations. It is well-known that the electromagnetic field is equivalent to a system of harmonic oscillators and a single mode corresponds to a single harmonic oscillator. We will not show here this equivalence as it is explained in most textbooks of quantum optics (see e.g. [1]). For a given mode of the field one can define dimensionless position and momentum operators of the corresponding oscillator as ˆx = â + â, ˆp = â â i. (.3) The operators ˆx and ˆp satisfy the canonical commutation relation [ˆx, ˆp] = i 1 that follows from the relations (.). The quantities ˆx and ˆp are called quadratures of the field and they are fundamental for describing quantum-optical phenomena with so-called continuous variables. The word continuous is related to the fact that the spectrum of the quadratures is continuous in contrast to the discrete spectrum of the photon-number operator ˆn = â â. Instead of ˆx and ˆp, scaled quadratures ˆX ± are 1 We take the Planck constant to be equal to unity; otherwise the commutator would be equal to i 9

Three problems from quantum optics often used that are defined as ˆX + = ˆx and ˆX = ˆp. Along with ˆx and ˆp one can also define a general quadrature ˆx ϕ = ˆx cos ϕ + ˆp sin ϕ = âe iϕ + â e iϕ (.4) as a linear combination of ˆx and ˆp that can be interpreted as a rotated position in the phase space of the given mode. Continuous-variable quantum information protocols correspond to analog systems in the classical information theory, while discrete-variable protocols correspond to digital systems. As the digital technology has some clear advantages over the analog technology, discrete variables are often preferred also in quantum information theory. However, continuous variables have other advantages such as possibility of manipulating with quantum information by linear optical elements. For the mathematical description of mode transformation one can employ the continuous basis of the Hilbert space, namely the basis of the eigenstates x of the quadrature operator ˆx such that ˆx x = x x. (.5) Some operations with the states x may be problematic from the rigorous mathematical point of view as these states cannot be properly normalized, which is the case of some calculations in Chapter 3. However, it turns out that by a relatively simple way, namely introducing the so-called Gelfand triplet [5, 6] one can make the explained theory mathematically rigorous.. Linear mode transformation It is well-known that physical quantities that characterize a quantum system can change in time. The time evolution of a quantum system can be described in two different ways, namely using the Schrödinger and Heisenberg pictures. The Schrödinger description views the operators corresponding to physical quantities as fixed and the evolution is given by changing the quantum state in the Hilbert space. On the other hand, the Heisenberg description considers the quantum state to be fixed and the evolution is ascribed to the operators of the physical quantities. Both approaches are equivalent, and none of them should be regarded as more correct. The time evolution of a given mode of the electromagnetic field proceeds spontaneously due to the nonzero energy of the mode and due to its interaction with various optical elements. The spontaneous evolution is of little interest as it is given by a uniform phase change; we will concentrate on the evolution caused by the optical elements. A beam splitter, phase shifter and squeezer are typical such elements. They have one or two input modes and the same number of output modes that can be considered as the transformed input modes. In the Schrödinger picture the elements transform the quantum state while in the Heisenberg picture they transform the field operators describing the modes. An important class of mode transformations is formed by linear canonical (symplectic) transformations for which the output quadratures can be expressed as linear combinations of the input quadratures. We consider here a special case only, namely the so-called point transformations, for which the positions and momenta transform separately and do not mix. Such as general transformation of m modes can be expressed in the Heisenberg picture as m m ˆx i = T ij ˆx j, ˆp i = S ij ˆp j (i = 1,..., m), (.6) j=1 j=1 where the matrices T and S satisfy S = (T 1 ) T. The corresponding transformation in the Schrödinger picture changes the eigenstate of the quadratures ˆx 1,..., ˆx m according to x 1 1 x x m m m m m det T T 1k x k T k x k T mk x k. (.7) k=1 1 k=1 k=1 m 10

Chapter. Some important terms and concepts of quantum optics The indexes at the kets... label the modes of the field and the factor det T ensures the correct normalization of the states or, in other words, the unitarity of the transformation (.7). As can be seen by comparing Equations (.6) and (.7), the eigenvalues in the Schrödinger picture transform in the same way as the quadratures in the Heisenberg picture. This must be so because the eigenvalues are measurable quantities and both pictures have to provide an equivalent description. There is a special class of so-called passive transformations among (.6) and (.7) for which the matrices T and S are orthogonal. These transformations can be realized experimentally by passive optical elements only, i.e., linear mode couplers (usually beam splitters) and phase shifters. On the other hand, realizing a non-orthogonal transformation requires employing active elements such as optical parametric oscillators and it is much more challenging experimentally. The simplest example of passive mode transformation is a phase shift that does not, however, belong to the the point transformations as it mixes position and momentum, and therefore we will not consider it here. Another example is mixing two modes on a beam splitter (e.g. a half-silvered glass) that can be expressed as ( ) ( ) ( ) ˆx 1 cos θ/ sin θ/ ˆx1 ˆx =. (.8) sin θ/ cos θ/ ˆx For a symmetric beam splitter with both transmissivity and reflectivity equal to 50%, it holds θ = π/ and therefore ˆx 1 = ˆx 1 ˆx, ˆx = ˆx 1 + ˆx. (.9) The simplest example of the active transformation is a single-mode squeezing operation: ˆx = ˆx s, ˆp = sˆp, (.10) where s is the squeezing factor. For s > 1, the operation (.10) squeezes the quadrature ˆx and for s < 1 it squeezes ˆp. In practice the squeezing operation is realized e.g. by a degenerate downconversion in an optical parametric oscillator (OPA) pumped by a beam of double frequency. With some probability amplitude a pump photon in the nonlinear crystal realizing OPA can change into a pair of photons of the mode being transformed, and the opposite process is also possible. If one transforms the vacuum, that is, the state with the wavefunction ψ vac (x) = x vac = 1 4 π e x / (.11) by the single-mode squeezer, then the output state in the Schrödinger picture will be s ψ s (x) = x s = 4 e s x /. (.1) π Clearly, this state differs from the vacuum (.11) for s ±1 and hence its expansion in the Fock basis n s must have nonzero coefficients for some n > 0. Therefore the state s contains photons that were added by the transformation (.10), which is where the name active comes from. Is is not hard to show that n s 0 for n even and n s = 0 for n odd. This is related to the realization of the squeezing transformation mentioned above photons emerge in pairs and if there was no photon in the field initially, there can only be an even number of them after the squeezing operation. One can show [7] that an arbitrary matrix T from Eq. (.6) can be decomposed as T = O DO 1, where the matrices O 1 and O are orthogonal and the matrix D = diag (d 1,..., d m ) is diagonal. Therefore the transformation (.6) or (.7) can be realized in three steps (see Figure.1): the first and last steps are passive transformations corresponding to the matrices O 1 and O, respectively. The middle step consists of m single-mode squeezing operations corresponding to the diagonal elements of the matrix D and scaling the quadrature ˆx i and ˆp i by the factor d i and 1/d i, respectively. Thus the number of active elements needed for realizing an arbitrary symplectic transformation of m modes does not exceed the number of modes. 11

Three problems from quantum optics 1 3 m PI S S S S PI 1 3 m Figure.1: Decomposition of a general symplectic transformation of m modes: first the modes are combined in a passive interferometer (PI), then each mode undergoes a squeezing transformation (S) individually and finally the modes are combined in another passive interferometer..3 Coherent states of light Coherent states play an important role in quantum optics for their numerous useful physical and mathematical properties. First of all, they are states that are closest to classical states of light and that exhibit large coherence. Coherent states have the minimum product of uncertainties of the quadratures ˆx and ˆp; in both x-, and p-representations they are Gaussian wavepackets. Another useful property of coherent states is their elegant transformation on a linear mode coupler. Coherent states also have interesting mathematical properties that enable constructing representations very useful for describing quantized electromagnetic field. One of them is the Glauber-Sudarshan P -representation [8, 9, 30] that will be discussed in a moment. Thanks to their physical and mathematical properties, coherent states are useful for various optical measurements, as local oscillators for homodyne detection, for pumping down-converters and squeezers, as testing states for quantum teleportation, quantum state sharing etc. With respect to what we just said about the importance of coherent states, it may be surprising that they have not yet been realized at optical frequencies as was emphasized by K. Mølmer [31] and B. C. Sanders and T. Rudolph [3]. Hence, coherent states are a convenient fiction rather than a physical reality. For example, laser light is not in a coherent state as one often hears in the community of quantum opticians, but rather in a mixture of coherent states with equal amplitude and with the phase distributed uniformly over the interval 0, π) [1]. However, when describing an experiment with a laser source using coherent states instead of their mixtures, one does not make a serious mistake; the result expected by the theory is the same in both cases because the measured beam and the reference beam (local oscillator) are derived from the same source and hence have a fixed relative phase. This way, most experiments that one should, strictly speaking, describe using mixtures of coherent states can equivalently be described using pure coherent states. Coherent states can be defined by several equivalent ways that will be discussed in Chapter 5; here we mention just the most common definition. Coherent state is the eigenstate of the annihilation operator â, i.e., the state satisfying â α = α α for some complex number α. This definition yields immediately the expansion of the coherent state in the Fock basis: α = e α / n=0 α n n! n. (.13) The photon number distribution in the coherent state α is Poissonian with both the mean and variance equal to α. It is an important property of coherent states that they provide the following decomposition of the unit operator: ˆ1 = 1 β β d β, (.14) π where the integration runs over the whole complex plane. At the same time, no two coherent states are orthogonal as α β = e α β. These two properties have an interesting consequence any 1

Chapter. Some important terms and concepts of quantum optics state ψ from the Hilbert space can be expressed as a superposition of coherent states by an infinite number of ways. To show this, assume that ψ itself is a coherent state. Then α = δ (β α) β d β (.15) certainly holds, where δ (β) = δ(re β) δ(im β) is the two-dimensional Dirac delta-function. At the same time, using the unit operator expansion (.14) one arrives at α = 1 β β α d β = 1 e β α ( β + α )/ β d β. (.16) π π Equations (.15) and (.16) give two different and valid expansions of the state α in terms of coherent states. Similarly, a general density matrix ˆρ of the mode can be expressed in many different ways as follows, ˆρ = ρ(β, γ) β γ d β d γ. (.17) There is so much freedom in the choice of the function ρ(β, γ) that it enables something seemingly impossible: one can choose it such that ρ(β, γ) = 0 for β γ, that is, the density matrix can be expressed in terms of coherent states in a diagonal way: ˆρ = P (β) β β d β. (.18) P (β) is the so-called Glauber-Sudarshan P -function; it has some unusual properties and for many states it is a distribution rather than an ordinary function. This is quite natural with respect to the very strong requirement of diagonality of ρ(β, γ). For a coherent state ˆρ = α α one has P (β) = δ (β α), for a thermal state with the mean photon number N it is P (β) = 1 πn e β /N and for a Fock state n the P -function is proportional to the n th derivative of the Dirac delta-function δ (β). The P -function forms the basis for mathematical description of homodyne detection as will be discussed in Chapter 4..4 POVM POVM (positive operator-valued measure) is a set of positive-semidefinite Hermitian operators ˆΠ i that characterizes completely a given quantum-mechanical measurement. If ˆρ is the density matrix of the system, the probability of the i th measurement output is given by p i = Tr (ˆρ ˆΠ i ). The operators ˆΠ i satisfy the unit operator decomposition ˆΠ i i = ˆ1. The POVM is a generalization of a projective quantum-mechanical measurement. A general measurement can be performed by adding an ancilla system in a known state to the measured system and making a projective measurement on the composite system [33]. 13

Chapter 3 Quantum state sharing Quantum state sharing is an important quantum-information protocol. Its goal is to protect a quantum information (called quantum secret) that is distributed among a group of parties (called players) against its misuse by unauthorized groups of players and to enable the access to this information to other, authorized groups. Initially, the dealer who owns the quantum information in the form of a quantum state of a given system encodes this state into an entangled state of n quantum systems and distributes these systems to the individual players. The encoding is performed in such a way that for any authorized group of players there exists a unitary operation that the players can apply to their systems (called shares) and in this way obtain one system in the same state as was the original secret. This is called secret reconstruction or extraction. On the other hand, the density matrix of the systems of the players from any unauthorized group is independent of the secret and hence the unauthorized groups cannot get any information about the secret, no matter what operations they perform with their shares. At first sight, it might seem odd that such a protocol can exist at all. It is important to note that the quantum secret may be in a mixed state and it can even be entangled with another quantum system. In this case, the entanglement is recovered after the secret extraction. This way it is possible to share e.g. just a component of a quantum state of a larger system. The method of the secret encoding is a public information and it is closely related to the so-called access structure, which is the set of all authorized groups of players that should be able to extract the secret. The access structure cannot be arbitrary but it must satisfy certain conditions. An obvious rule is that when adding a player to an authorized group, it remains authorized. Another condition says that there cannot exist two separated (disjoint) authorized groups of players. If this were possible, one could create two copies of the extracted secret from a single original secret state, and this way effectively clone a quantum state. However, cloning quantum states is impossible, as has been shown by W. K. Wootters and W. H. Zurek [13] (the no-cloning theorem). The condition does not apply to classical secret sharing, which the classical analogy of quantum state sharing; the secret in this case is a classical information that can be copied or cloned arbitrarily. Among quantum state sharing schemes there is an important class of the so-called self-dual access structures with the following property: for every division of all players into two groups, exactly one group is authorized. It turns out that any access structure that is not self-dual can be derived from some self-dual one by discarding one or more shares [34]. Therefore exploring only self-dual structures is sufficient for describing quantum state sharing. Another important class of access structures are the so-called threshold schemes for which it is only the number of players in the group that determines whether the group is authorized or not. For the (k, n) threshold scheme there are n players in total and any k of them are authorized to extract the secret. It can be seen easily that self-dual structures are those for which n = k 1 holds; in the following we will consider these structures only. Quantum state sharing can be implemented is quantum systems described by both discrete and 14

Chapter 3. Quantum state sharing (a) (b) (c) Figure 3.1: Three examples of access structures; only the minimal authorized sets are shown. The access structure in (a) is not allowed in quantum state sharing as two disjoint groups of players can access the secret; however, it is allowed in classical secret sharing; the access structure in (b) is allowed also in the quantum case, and (c) shows the access structure of the (, 3) threshold scheme in which any two players can access the secret. continuous variables. In discrete variables where the secret is realized as qubits (or more generally qudits), the encoding can effectively be designed by employing properties of matrices over finite number fields, and the theory of quantum state sharing is well developed [35, 36, 34]. The theory of quantum state sharing with continuous variables was developed by me, B. C. Sanders and D. J. Rowe at Macquarie University in Sydney [37, 38]. Later we have, together with co-workers at Australian National University in Canberra, proposed [39] and realized successfully [40, 41] an experiment that demonstrated quantum state sharing for the first time. The proposed scheme was designed for optical implementation and the quantum systems carrying the secret and the shares were realized as modes of the electromagnetic field. The fundamental quantities used for describing the quantum system are the field quadratures that have been discussed in Sec..1. Originally, we have formulated the theory of continuous-variable quantum state sharing in the Schrödinger picture [37, 38] in analogy to the discrete-variable case. However, later the Heisenberg picture was preferred [39, 40, 41] (to compare both pictures, see Sec..). In the following section we will describe the Schrödinger approach and in Sec. 3. the Heisenberg approach to continuous-variable quantum state sharing. 3.1 Continuous-variable quantum state sharing in the Schrödinger picture In the following we explain continuous-variable quantum state sharing in the Schrödinger picture on the example of the (k, k 1) threshold scheme that has total k 1 players and any k of them can extract the secret. Generalization of the protocol to an arbitrary access structure is straightforward. 3.1.1 Encoding the quantum secret The first step in the protocol is the encoding of the quantum secret into an entangled state of k 1 modes of the field and distributing these modes to the players. The initial state of the dealer is formed by k 1 modes of the electromagnetic field: the first of them is the quantum secret ψ = ψ(x) x dx (3.1) R and the remaining k are squeezed vacuum states. Half of them, that is k 1, are squeezed in the quadrature ˆp, so they are the states from Eq. (.1) with s < 1, and the other half are squeezed in the quadrature ˆx so they are the states s with s > 1. In order for the secret extraction to be perfect, the squeezing must be infinite, which corresponds to the limits s 0 and s, respectively. In this case one can express both states as x dx and 0. (3.) R 15

Three problems from quantum optics In the following we will assume this ideal case of infinite squeezing. The more realistic situation of finite squeezing will be discussed in sections 3.1.5 and 3. that talks about the (, 3) threshold scheme and its experimental realization. In the ideal situation of infinite squeezing, the initial state of the dealer is Φ 0 = ψ(x 1 ) x 1 1 x x k k 0 k+1 0 k 1 d k x, (3.3) R k and the indexes of the kets mark modes of the field. The dealer then applies a particular symplectic transformation (see Eq. (.7)) to the state Φ 0 to create the following entangled state: Φ = ψ(x 1 ) L 1 (x) 1 L (x) L k 1 (x) k 1 d k x. (3.4) R k Here x denotes the set of variables x 1, x,..., x k and L i (x) with i = 1,..., k 1 are linear combinations of the variables x 1, x,..., x k that satisfy a certain condition that ensures that any k players can extract the secret. The condition is that any k elements from the k-element set {x 1, L 1,..., L k 1 } must be linearly independent. By a proper choice of L 1 (x),..., L k 1 (x) one can ensure that the transformation Φ 0 Φ is orthogonal. This means that the dealer does not need active operations for encoding the quantum secret but only for creating the initial squeezed states. 3.1. Extraction of the quantum secret Next we show how a group of k players can extract the quantum secret. Without loss of generality we can assume that the first k players collaborate, in the opposite case we can relabel the players. When thinking about the linear combinations L 1 (x),..., L k 1 (x) of the variables x 1,..., x k, it is useful to view these objects as vectors in a k-dimensional vector space V with the basis vectors x 1,..., x k. This makes our considerations much clearer. It then follows from our assumptions about x 1, L 1 (x),..., L k 1 (x) from last section that the vectors L 1, L,..., L k as well as the vectors x 1, L k+1,..., L k 1 are linearly independent. At the same time, in both groups there are k vectors, which is the same number as the dimension of the vector space V. Therefore there must exist a non-singular matrix T such that T L 1 L. L k = x 1 L k+1. L k 1 holds. The existence of the matrix T implies the existence of a unitary operator Û(T ) acting on the modes 1,,..., k as follows: (3.5) Û(T ) L 1 1 L L k k = det T x 1 1 L k+1 L k 1 k. (3.6) Now, if players 1,,..., k apply the operation Û to their shares, the total state of all shares will be Û Φ = J det T ψ(x 1 ) x 1 1 L k+1 L k 1 k L k+1 k+1 L k 1 k 1 dx 1 dl k+1 dl k 1 R k = J det T ψ 1 Θ,k+1 Θ 3,k+ Θ k,k 1. (3.7) In the integral in Eq. (3.7) we changed the integration variables x 1,..., x k to x 1, L k+1,..., L k 1, we have denoted the Jacobian of this transformation by J and have defined a two-mode state Θ ij x i x j dx. (3.8) R 16

Chapter 3. Quantum state sharing Eq. (3.7) shows that the first player s share is left in the state ψ, so the secret is extracted in its original form in mode 1. The shares of players, 3,..., k form strongly entangled pairs Θ ij with the shares of players k + 1,..., k 1 who did not participate in the extraction process. The state Θ ij is the EPR (Einstein-Podolsky-Rosen) state that A. Einstein and co-workers used in 1935 in their famous paper [4] attacking completeness of quantum mechanics. As can be seen from Eq. (3.8), in the EPR state the quadratures ˆx i, ˆx j are perfectly correlated; at the same time, the quadratures ˆp i, ˆp j are perfectly anticorrelated. The EPR state Θ ij plays an important role in many continuous-variable quantum-information protocols, e.g. in quantum teleportation [3, 4, 5]. It still remains to show that unauthorized groups cannot obtain any information about the quantum secret. For this it is enough to know that the access structure of the (k, k 1) threshold scheme is self-dual, so the complement of any unauthorized group is a group that can extract the secret perfectly. This itself denies any information leakage to the unauthorized group as such a leakage would prevent the authorized group from perfect extraction of the secret. This is because any information about a quantum state that escapes to the environment changes the state of the system. This is a general property of quantum states and it forms the basis for important quantum-information protocols, in particular of quantum key distribution [7]. To show that a group of k 1 players cannot get any information about the secret, one can also calculate the trace of the total state of all shares Φ Φ over the shares of the remaining k shares. It is not hard to show that the resulting density matrix is independent of the secret ψ, so it cannot provide any information about it. 3.1.3 Example: the (,3) threshold scheme In this section we illustrate the quantum state sharing protocol on the example of the (, 3) threshold scheme in which there are three players in total and any two of them can obtain the quantum secret by collaboration. This scheme is important in that it has been realized experimentally, which will be discussed in Sec. 3. in detail. The initial state of the dealer Φ 0 consists of the quantum secret ψ and two states squeezed infinitely in the quadratures ˆp and ˆx, respectively: Φ 0 = ψ(x 1 ) x 1 1 x 0 3 dx 1 dx. (3.9) R The dealer chooses the following linear combinations L 1, L, L 3 according to Eq. (3.4): L 1 = x 1 + x, L = x 1 x, L 3 = x (3.10) and employing a passive transformation (.7) with the orthogonal matrix T = 1 1 1 1 1 1 1 0 1 he encodes Φ 0 into the three-share entangled state Φ = ψ(x 1 ) x 1 + x x 1 R x 1 (3.11) x 3 dx 1 dx. (3.1) The dealer then distributes the shares to the players. Players 1 and can extract the secret via a passive transformation (.7) with the matrix T 1 = 1 ( 1 1 1 1 ). (3.13) 17

Three problems from quantum optics The resulting state Φ 1 = ψ(x 1 ) x 1 1 x x R 3 dx 1 dx (3.14) clearly contains the quantum secret ψ in mode 1. Players 1 and 3 can extract the secret via an active transformation (.7) with the matrix ( ) 1 T 13 = 1, (3.15) which yields the state Φ 13 = ψ(x 1 ) x 1 x 1 1 x x R 1 x dx 1 dx (3.16) 3 = ψ(x 1 ) x 1 1 L L 3 dx 1 dl (3.17) R and hence the secret is again reconstructed in mode 1. The secret extraction from components and 3 is almost identical to the extraction from components 1 and 3, so we will not discuss it. 3.1.4 Optimizing the secret extraction On order to realize the k-mode transformation (3.6) for extracting the quantum secret, the collaborating players have to employ k active optical elements (squeezers) in general (see Sec..). However, it would be highly desirable to reduce the number of active elements in some way because of their high experimental cost and difficulty. In out work [38] we have shown that the transformation (3.6) is not the only one that enables the secret extraction, and by optimizing the extraction procedure one can reduce the number of active elements down to two, independent of the number of collaborating players k. To understand this, we return to Eqs. (3.6) and (3.7) and note that even though the variable x 1 is still present in the linear combinations L k+1,..., L k 1, by changing the integration variables to x 1, L k+1,..., L k 1 it was possible formally eliminate it. In this way the quantum secret in the first mode has been disentangled from all the other modes. The same would be achieved, however, if the matrix T from Eq. (3.5) was replaced by a matrix T that satisfies T L 1 L. L k = x 1 M (L k+1,..., L k 1 ). M k (L k+1,..., L k 1 ), (3.18) where M,..., M k are linear combinations of the vectors L k+1,..., L k 1. Also in this case the first mode is disentangled from all the other modes and yields the quantum secret. The only difference is that the modes of the collaborating players,..., k would no more form EPR pairs with the modes of the non-collaborating players but rather a more complicated entangled state. Equation (3.18) provides a large freedom thanks to the possibility of choosing the linear combinations M i (the only condition is that the matrix T is non-singular). To minimize the number of squeezing elements, we tried to find the T to be close to some orthogonal matrix. We have shown that the matrix T can be found in the form T = α β 0... 0 0 γ 0... 0 0 0.. I k 0 0 O. (3.19) 18

Chapter 3. Quantum state sharing Here O is an orthogonal matrix, I k is the unit matrix of dimension k, the numbers α and β are determined by vectors L 1,..., L k 1, and γ is a free parameter. Hence, one can decompose the extraction transformation ( into ) a passive operation corresponding to the matrix O and a two-mode α β transformation R (as the remaining k modes are no more transformed). For the twomode transformation R one needs just two squeezing elements and it can be decomposed according 0 γ to Sec.. as R = O DO 1 Altogether, the transformation T can be realized in three steps (see Fig. 3.): first comes the passive operation O 1 O followed by two single-mode squeezing operations corresponding to D and the last step is another passive operation O. Hence no more than two active operations are needed to extract the quantum secret. Furthermore, by choosing γ one can minimize the overall squeezing cost of the two squeezers. 1 3 k PI S S PI T Figure 3.: The optimum extraction of the quantum secret: the k modes are first combined in a passive interferometer, then the first two of them are squeezed individually and finally the two modes are combined in a passive interferometer. One of the outputs is then the extracted secret T. 3.1.5 Finite squeezing in dealer s encoding procedure Until now we have assumed that the dealer uses k infinitely squeezed states for his encoding procedure (see Sec. 3.1.1). In practice this is not possible, however, as the mean number of photons and mean energy are infinite in an infinitely squeezed state. Nowadays one can achieve the squeezing factor of the order of several units only, so an important question arises of how the protocol will work if the squeezing employed by the dealer is finite. In this case the secret will not be extracted perfectly but will be degraded increasingly with decreasing amount of squeezing used by the dealer. At the same time, the protection of the secret against unauthorized groups will no more be perfect, and some information can escape to them. In order to quantify the quality of the secret extraction, it is useful to express the density matrix ˆρ out of the extracted secret with the help of the density matrix ˆρ of the original secret. In our work [38] we have derived the following relation between the two matrices in the x-representation: ρ out (x, x ) = s exp [ u (x x ) ] π v 4s ρ(x y, x y) exp [ s y ] R v dy. (3.0) Here s denotes the squeezing parameter of the squeezed vacuum states employed by the dealer and u, v are parameters depending on the dealer encoding operation and the choice of the collaborating players. The factor in front of the integral in Eq. (3.0) reduces the magnitude of the non-diagonal elements of the density matrix and the integral itself convolutes the secret density matrix with a Gaussian, which both degrades the secret. It would be even more advantageous to express this degradation in terms of the Wigner function W (x, p) that provides description equivalent to that of the density matrix, but symmetrical with respect to quadratures ˆx and ˆp. It turns out that the Wigner function of the extracted secret W out (x, p) is a two-dimensional convolution of the original Wigner function with a Gaussian function of x, p. As the parameters u and v differ in general for different groups of collaborating players, the degradation of the extracted secret differs as well. It this sense, the protocol is unjust as some 19

Three problems from quantum optics Figure 3.3: The encoding of the secret in the (, 3) threshold scheme: the dealer first creates squeezed ancilla states by squeezing the vacuum states in two optical parametric oscillators (OPA), and combines them on a symmetric beam splitter. One of the outputs is then combined with the quantum secret state on another beam splitter. This way the dealer obtains three shares that he distributes to the players. groups can extract the secret better than other ones 1. I believe that for a large number of players one cannot design a just protocol because the dealer does not have enough parameters to vary in order to satisfy the large number of conditions requiring equal secret degradation for all authorized groups of players. 3. Heisenberg picture of continuous-variable quantum state sharing During the period of theoretical preparation of the quantum state sharing experiment at the Australian National University it turned out that the Heisenberg picture is more advantageous in some aspects than the Schrödinger picture for describing the protocol, in particular for the easier treatment of finitely squeezed states in the dealer s process. In this section we describe the (, 3) threshold scheme in the Heisenberg picture that has been realized experimentally. Formally, the transition from the Schrödinger to Heisenberg pictures is simple and it is explained in the basic course of quantum mechanics. However, in a particular calculation it may not be trivial and we will not perform this transition here, but rather describe quantum state sharing in the Heisenberg picture directly. When using the Heisenberg picture, one has to consider both quadratures ˆx and ˆp of the transformed modes. This is in contrast with the Schrödinger picture where we used the x-representation and did not consider the momenta at all as the wavefunction provided a complete information about a pure quantum state. 3..1 Encoding the secret As has been said in Sec. 3.1.3, the dealer owns initially the quantum secret (we will label its quadratures by the index S) and two ancilla squeezed states, one squeezed in the quadrature ˆp and the other one squeezed in ˆx. We will label the quadratures of these squeezed states by the indexes sqz1 and sqz. Due to the squeezing, the uncertainties of ˆp sqz1 and ˆx sqz are lower than would be for the vacuum state 0, so p sqz1 < 1/ and x sqz < 1/ hold. The dealer encodes the secret by the 1 For example, in the (, 3) threshold scheme discussed in Sec. 3.1.3 players 1 and can still extract the secret perfectly even if the dealer employs finite squeezing, while players 1 and 3 or and 3 cannot. 0