Assisted Postselective Quantum Transformations and an Improved Photon Number Splitting Attack Strategy

Abstract

Postselective transformations of quantum states is a broader class of operations than deterministic quantum channels. Here, we describe the possibility of increasing the success probability of postselective operations by using additional information, which has a form of pure quantum states and should not be changed in case of success. We describe the conditions under which assistance becomes useful, and provide application of our method which improves the efficiency of photon number splitting attack for a variant of SARG04 quantum key distribution protocol. In our attack scenario, one extra photon, which is unchanged, plays the role of assistance.

1. Introduction

The question of what can be done and what cannot be done plays key role in quantum theory. For example, the no-cloning theorem [1], which states that arbitrary quantum state cannot be cloned, plays essential role in quantum key distribution [2,3]. Nevertheless, if one does not require the transformation to be deterministic, the class of possible operations becomes significantly broader [4]. An important example is unambiguous state discrimination (USD) [5,6,7], which performs perfect discrimination with nonunit success probability. Hence, there are many transformations which are possible with some probability, but cannot be performed deterministically. In the sequel, we will call such transformations postselective, as after their application the participants know whether they succeed or not. A reasonable task is to find bounds for success probability for some postselective transformations [4,8].

It might happen that participants have additional information which may help to perform the required transformation, i.e., to enlarge the possible success probability. Here, we consider this additional information has the form of pure quantum states, and let us impose additional requirement that these states should not be changed in case of success, thus playing the role of a catalyst.

We are therefore concerned with the question how helpful can be a particular assistance. In Section 2, we will give several examples of useful assistance, and provide a sufficient condition for being useful, namely, linear independence. We also consider the problem of requesting sufficient assistance for the desired enlargement of success probability, which implies that, for minor improvements, only small assistance is enough.

The practical example when such kind of assistance is helpful is the case of eavesdropping in quantum key distribution. The eavesdropper might possess several photons, each in the same state, but in case of zero-error attack, they must leave one photon for the receiver side without being modified, in case of success. Hence, this photon is exactly the kind of assistance being studied. Hence, it helps to enlarge success probability for the transformation on the remaining photons. We will consider this example in detail in Section 3, thus providing practical application for our results. Finally, we conclude in Section 4.

2. Enlarging Success Probability with Assistance

2.1. Examples for Assisted Transformations

Before providing general results, let us first consider several examples when additional information may help to increase the success probability of the given transformation.

Example 1.

Unambiguous discrimination between two states. Consider two non-orthogonal pure states, $|{\phi }_0\rangle$, and $|{\phi }_1\rangle$, with $\langle {\phi }_0|{\phi }_1\rangle =cos\alpha$ for some $\alpha \in (0,\frac{\pi }{2})$. The operation of unambiguous state discrimination [5,6,7] either provides full knowledge or yields an inconclusive result. It may be described with the positive operator-valued measure (POVM),

$$M_0=\frac{I-|{\phi }_1\rangle \langle {\phi }_1|}{1+cos\alpha },M_1=\frac{I-|{\phi }_0\rangle \langle {\phi }_0|}{1+cos\alpha },M_{?}=I-M_0-M_1.$$

(1)

This symmetric measurement yields conclusive result (0 or 1) with success probability

$$p_{\mathrm{USD}}=p(0|0)=\mathrm{Tr}(M_0|{\phi }_0\rangle \langle {\phi }_0|)=1-cos\alpha =p(1|1),$$

and this measurement is error-free, i.e., $p(0|1)=p(1|0)=0$. Hence, if one sacrifices unit success probability, error-free discrimination between non-orthogonal states becomes possible.

Now, consider additional assistance, which has the form of two quantum states, $|{\epsilon }_0\rangle$ and $|{\epsilon }_1\rangle$, with $\langle {\epsilon }_0|{\epsilon }_1\rangle =cos\epsilon$. These states are attached to the original states, so the states which should be discriminated become

$$\begin{array}{c}\hfill |{\psi }_0\rangle =|{\phi }_0\rangle \otimes |{\epsilon }_0\rangle ,\end{array}$$

(2)

$$\begin{array}{c}\hfill |{\psi }_1\rangle =|{\phi }_1\rangle \otimes |{\epsilon }_1\rangle .\end{array}$$

(3)

These states are clearly easier to distinguish, and total success probability becomes

$$p_{\mathrm{USD}}^{\prime }=1-\langle {\psi }_0|{\psi }_1\rangle =1-cos\alpha cos\epsilon >p_{\mathrm{USD}}.$$

Hence, this assistance allows us to increase the success probability for USD. Let us impose the additional requirement that assistance should not be affected in the case of success, hence the total transformation for USD in case of success reads

$$\begin{array}{c}\hfill |{\phi }_0\rangle \otimes |{\epsilon }_0\rangle \to |e_0\rangle \otimes |{\epsilon }_0\rangle ,\end{array}$$

(4)

$$\begin{array}{c}\hfill |{\phi }_1\rangle \otimes |{\epsilon }_1\rangle \to |e_1\rangle \otimes |{\epsilon }_1\rangle ,\end{array}$$

(5)

where $\langle e_0|e_1\rangle =0$. The orthogonality of output states allows us to prepare any output state, including the one with attached states $|{\epsilon }_0\rangle$ or $|{\epsilon }_1\rangle$, which mean maintaining the assistance states. Hence, this assistance plays the role of catalyst, and is not affected in case of success.

Example 2.

Unambiguous discrimination between multiple copies of linearly dependent states. The next example shows how an impossible task becomes possible with assistance. It is widely known that USD cannot be performed for linearly dependent states. The simple reason is that the system in the subspace of lower rank cannot be mapped on the subsystem of higher rank. But in ref. [9], Chefles addressed the issue of unambiguous discrimination between multiple copies of linearly dependent states $\{|{\psi }_j\rangle {\}}_{j=1}^N$ in D-dimensional Hilbert space $\mathcal{H}$. It was shown that for a certain number C of copies, namely $C\ge N-D+1$, the states become linearly independent, hence possible for USD. Similarly to Example 1, additional $C-1$ systems may be considered as assistance, and in case of success, they can be restored perfectly, and the transformation reads

$$|{\psi }_j\rangle \otimes |{\psi }_j{\rangle }^{\otimes C-1}\to |e_j\rangle \otimes |{\psi }_j{\rangle }^{\otimes C-1},\forall j\in 1,\cdots ,N,$$

(6)

where $|e_j\rangle$ again form an orthonormal basis.

Example 3.

Soft filtering of two states. As an example besides USD, let us consider a probabilistic increase in the distinguishability [10], which may be viewed as a partial application of USD [11]. Stinesprind representation for soft filtering of two states $\{|{\phi }_0\rangle ,|{\phi }_1\rangle \}$ reads

$$\begin{array}{c}\hfill |{\phi }_0\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_0\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |f\rangle ,\end{array}$$

(7)

$$\begin{array}{c}\hfill |{\phi }_1\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_1\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |f\rangle ,\end{array}$$

(8)

where $|s\rangle$ and $|f\rangle$ are mutually orthogonal auxillary vectors, which provide information about success or failure of the operation, and $|0\rangle$ is some vector in the output state. This operation either maps the states $\{|{\phi }_0\rangle ,|{\phi }_1\rangle \}$ to more distinguishable states $\{|{\psi }_0\rangle ,|{\psi }_1\rangle \}$ with success flag $|s\rangle$, or destroys the states and yields failure outcome $|f\rangle$. Unitarity condition results in the following success probability:

$$p_{\mathrm{succ}}=\frac{1-cos\alpha }{1-cos\beta },$$

(9)

where $cos\alpha =\langle {\phi }_0|{\phi }_1\rangle$, and $cos\beta =\langle {\psi }_0|{\psi }_1\rangle$.

Let us now consider soft filtering assisted by the states $\{|{\epsilon }_0\rangle ,|{\epsilon }_1\rangle \}$, Stinespring representation becomes

$$\begin{array}{c}\hfill |{\phi }_0\rangle \otimes |{\epsilon }_0\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_0\rangle \otimes |{\epsilon }_0\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |0\rangle \otimes |f\rangle ,\end{array}$$

(10)

$$\begin{array}{c}\hfill |{\phi }_1\rangle \otimes |{\epsilon }_1\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_1\rangle \otimes |{\epsilon }_1\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |0\rangle \otimes |f\rangle ,\end{array}$$

(11)

and success probability (with $cos\epsilon =\langle {\epsilon }_0|{\epsilon }_1\rangle$) reads

$$p_{\mathrm{succ}}^{\prime }=\frac{1-cos\alpha cos\epsilon }{1-cos\beta cos\epsilon },$$

(12)

which is larger than original success probability (9) for any $cos\epsilon <1$. Hence, the assistance allows us to increase success probability.

Note that the requirement that assistance should not be affected plays important role, because without this requirement, the transformation would read

$$\begin{array}{c}\hfill |{\phi }_0\rangle \otimes |{\epsilon }_0\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_0\rangle \otimes |0\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |0\rangle \otimes |f\rangle ,\end{array}$$

(13)

$$\begin{array}{c}\hfill |{\phi }_1\rangle \otimes |{\epsilon }_1\rangle \to \sqrt{p_{\mathrm{succ}}}|{\psi }_1\rangle \otimes |0\rangle \otimes |s\rangle +\sqrt{1-p_{\mathrm{succ}}}|0\rangle \otimes |0\rangle \otimes |f\rangle ,\end{array}$$

(14)

and its success probability

$$p_{\mathrm{succ}}^{″}=\frac{1-cos\alpha cos\epsilon }{1-cos\beta },$$

(15)

is larger than $p_{\mathrm{succ}}^{\prime }$ given by (12). Such an effect does not take place for USD operation, because in case of success the output signals are perfectly distinguishable, and it is a “free” operation to restore the assistance states. In case of soft filtering, this restoring is not free, and the overall success probability is lower.

2.2. Improvement with Linearly Independent Assistance

Let us now use the results of ref. [8] to formalize the advantage from assistance. In the sequel, we consider postselective operations with the same success probability for each state, which is particular case of ref. [8] results.

Consider the sets $\{|{\phi }_i\rangle {\}}_{i=1}^N$ and $\{|{\psi }_i\rangle {\}}_{i=1}^N$ of pure quantum states in Hilbert space $\mathcal{H}$ for input and output, respectively. Their Gram matrices read

$$G_A={\left\{\langle {\phi }_i|{\phi }_j\rangle \right\}}_{i,j=1}^N,$$

(16)

$$G_B={\left\{\langle {\psi }_i|{\psi }_j\rangle \right\}}_{i,j=1}^N.$$

(17)

Consider the transformation (i.e., quantum instrument [12]) which, in case of success, performs the following mapping

$$|{\phi }_i\rangle \to |{\psi }_i\rangle ,\forall i\in 1,\cdots ,N.$$

(18)

Theorem 1 in ref. [8] states that there exists quantum instrument which performs map (18) with success probability

$$p_{\mathrm{succ}}=2^{-D_{\max }(G_B\parallel G_A)},$$

(19)

where quantum max-relative entropy $D_{\max }(\rho \parallel \sigma )$ [13] is defined as

$$D_{\max }(\rho \parallel \sigma )=-{log}_{2}max\{\lambda :\sigma -\lambda \rho \ge 0\},$$

or, if $\sigma$ is invertible,

$$D_{\max }(\rho \parallel \sigma )={log}_2{\lambda }_{\max }({\sigma }^{-\frac{1}{2}}\rho {\sigma }^{-\frac{1}{2}}).$$

Hence, non-negativity of the matrix $G_A-p_{\mathrm{succ}}{G}_B$ is a sufficient condition for $p_{\mathrm{succ}}$ to be the success probability for some operation which performs (18).

With assistance $\{|{\epsilon }_i\rangle {\}}_{i=1}^N$, the map (18) takes the form

$$|{\phi }_i\rangle \otimes |{\epsilon }_i\rangle \to |{\psi }_i\rangle \otimes |{\epsilon }_i\rangle ,\forall i\in 1,\cdots ,N,$$

(20)

and the condition for new success probability $p_{\mathrm{succ}}^{\prime }$ becomes

$$G_A\circ G_E-p_{\mathrm{succ}}^{\prime }{G}_B\circ G_E,$$

(21)

where $G_E={\left\{\langle {\epsilon }_i|{\epsilon }_j\rangle \right\}}_{i,j=1}^N$ is the assistance Gram matrix, and $A\circ B={\left\{a_{ij}{b}_{ij}\right\}}_{i,j=1}^N$ is the element-wise (Hadamard) product.

Hence, the role of assistance for transformations between pure states is the increase in minimal eigenvalue ${\lambda }_{\min }$ of the matrix

$$A_p=G_A-p{G}_B$$

after Hadamard product with the assistance Gram matrix $G_E$:

$${\lambda }_{\min }\left(A_p\circ G_E\right)>{\lambda }_{\min }\left(A_p\right).$$

(22)

It is clear that assistance cannot decrease success probability, since the assistance subsystem may just be not involved onto transformation.

Let us now show that assistance with linearly independent states is helpful for every transformation.

Theorem 1.

Linearly independent assistance increases success probability $p_{\mathrm{succ}}$ for any transformation with $p_{\mathrm{succ}}<1$.

Proof. 

Maximal success probability $p_{\mathrm{succ}}<1$ implies that the matrix $G_A-p_{\mathrm{succ}}{G}_B$ is non-negative and degenerate, hence the matrix

$$G_f=\frac{G_A-p_{\mathrm{succ}}{G}_B}{1-p_{\mathrm{succ}}}$$

(23)

is the Gram matrix for some set of linearly dependent states $\{|f_i\rangle \}$. Let us now show that $G_f\circ G_E$ is nondegenerate, if $G_E$ is the Gram matrix for some linearly independent assistance $\{|{\epsilon }_i\rangle \}$.

Assume the contrary: let $G_f\circ G_E$ be degenerate. Hence, the set $\{|f_i\rangle \otimes |{\epsilon }_i\rangle \}$ is linearly dependent, and there exists the set of coefficients $\left\{c_i\right\}$ such that

$$\sum c_i|f_i\rangle \otimes |{\epsilon }_i\rangle =0,\sum |c_i|>0.$$

Without loss of generality, assume that $c_0\ne 0$, and consider the coefficients $d_i=c_i\langle f_0|f_i\rangle$, for which

$$\sum d_i|{\epsilon }_i\rangle =\sum c_i\langle f_0|f_i\rangle |{\epsilon }_i\rangle =0.$$

Now, taking into account that $d_0\ne 0$, we have found the coefficients $\left\{d_i\right\}$ such that

$$\sum d_i|{\epsilon }_i\rangle =0,\sum |d_i|>0,$$

which contradicts linear independence of $\{|{\epsilon }_i\rangle \}$. Hence, $G_f\circ G_E$ is nondegenerate, and it is the Gram matrix for linearly independent set $\{|f_i\rangle \otimes |{\epsilon }_i\rangle \}$, which implies $\lambda ={\lambda }_{\min }(G_f\circ G_E)>0$. Hence, if we rewrite (23) with assistance,

$$G_f\circ G_E=\frac{G_A\circ G_E-p_{\mathrm{succ}}{G}_B\circ G_E}{1-p_{\mathrm{succ}}},$$

(24)

we can easily see that $p_{\mathrm{succ}}$ may be enlarged to make $G_f\circ G_E$ degenerate. □

Let us take a closer look at this theorem to find the increased success probability value. Equation (23) can be written as

$$G_A=p_{\mathrm{succ}}{G}_B+(1-p_{\mathrm{succ}})G_f,$$

(25)

which is connected with the unitarity condition for every pair of states at the input and at the output:

$$\langle {\phi }_i|{\phi }_j\rangle =p_{\mathrm{succ}}\langle {\psi }_i|{\psi }_j\rangle +(1-p_{\mathrm{succ}})\langle f_i|f_j\rangle ,i,j=1,\cdots ,N.$$

Hence, $G_f$ plays the role of the Gram matrix for the set of states in case of failure. With assistance, this expression takes the form

$$G_A\circ G_E\ge p_{\mathrm{succ}}{G}_B\circ G_E+(1-p_{\mathrm{succ}})G_f\circ G_E,$$

(26)

and let us now find the new success probability $p_{\mathrm{succ}}^{\prime }$. Let $\lambda$ be the minimal eigenvalue for $G_f\circ G_E$, and, for linearly independent assistance, it is positive, thus $G_f\circ G_E-\lambda I$ is non-negative, and we can rewrite (26) as

$$G_A\circ G_E\ge p_{\mathrm{succ}}{G}_B\circ G_E+(1-p_{\mathrm{succ}})(G_f\circ G_E-\lambda I)+(1-p_{\mathrm{succ}})\lambda I,$$

which, if we use notation

$$G_{fE}^{\prime }=\frac{G_f\circ G_E-\lambda I}{1-\lambda },$$

results in

$$G_A\circ G_E\ge p_{\mathrm{succ}}{G}_B\circ G_E+(1-\lambda )(1-p_{\mathrm{succ}})G_{fE}^{\prime }+(1-p_{\mathrm{succ}})\lambda I,$$

where $G_{fE}^{\prime }$ now is Gramian matrix for the vectors in case of failure, and the term $(1-p_{\mathrm{succ}})\lambda I$ can be used to modify the success probability. Indeed, if we denote

$$G_{BE}^{\prime }=\frac{p_{\mathrm{succ}}{G}_B\circ G_E+(1-p_{\mathrm{succ}})\lambda I}{p_{\mathrm{succ}}+(1-p_{\mathrm{succ}})\lambda },$$

the final unitarity condition becomes

$$G_A\circ G_E=(p_{\mathrm{succ}}+(1-p_{\mathrm{succ}})\lambda )G_{BE}^{\prime }+(1-\lambda )(1-p_{\mathrm{succ}})G_{fE}^{\prime },$$

hence, the new success probability reads

$$p_{\mathrm{succ}}^{\prime }=p_{\mathrm{succ}}+(1-p_{\mathrm{succ}})\lambda ,$$

which is greater than $p_{\mathrm{succ}}$ as $\lambda >0$. When success probability of initial transformation is 1, it is deterministic, and cannot be improved with our method.

For linearly dependent assistance, both options are possible: it might be helpful, and might be not. Example 2 with multiple copies of linearly dependent states demonstrates both effects: when the number of copies is insufficient, assistance is not helpful, but for a sufficiently large number of copies, it works fine and makes USD operation possible (i.e., increases its success probability from zero to non-zero value). Other example of linearly dependent assistance will be given in Section 3.

2.3. Requesting for Assistance

Let us now consider the problem of requesting a relatively small assistance to achieve the desired success probability. Consider a set of input states $\{|{\phi }_i\rangle \}$, a set of output states $\{|{\psi }_i\rangle \}$, and the corresponding maximal success probability $p_{\mathrm{succ}}$. Now, let the desired success probability be $p^{\prime }>p_{\mathrm{succ}}$. The question arises as to what is sufficient assistance for achieving this success probability increase. It is trivial that the set of orthogonal states is a perfect assistance, but let us find a small assistance, which tends to the set of coinciding vectors when $p^{\prime }-p_{\mathrm{succ}}$ tends to zero.

Since $p^{\prime }$ is greater than maximal success probability $p_{\mathrm{succ}}$, it follows from ref. [8] that the operator $A_{p^{\prime }}=G_A-p^{\prime }{G}_B$ has negative eigenvalues. Let ${\lambda }_{\min }$ be the minimal eigenvalue of $A_{p^{\prime }}$. Now, observe that $B=A_{p^{\prime }}-{\lambda }_{\min }I$ has the same eigenvectors as $A_{p^{\prime }}$, and all its eigenvalues are non-negative. Let us thus consider assistance with Gram matrix $G_E$ such that

$$B\propto A_{p^{\prime }}\circ G_E,$$

(27)

because it would imply that

$$G_A\circ G_E-p^{\prime }{G}_B\circ G_E\ge 0,$$

which means the possibility to implement this transformation with success probability $p^{\prime }$.

Let us now find $G_E$ for (27). This element-wise product should increase diagonal elements, which is equivalent to decreasing all the other elements, taking into account that non-negativity is the main priority. Hence, let us consider $G_E$ where all diagonal elements equal 1, and all off-diagonal elements equal $c\in (0,1)$. Minimal eigenvalues for such matrix are $1-c$; hence, is it non-negative.

It is now straightforward to see that, since diagonal elements of $A_{p^{\prime }}$ equal $1-p^{\prime }$,

$$A_{p^{\prime }}\circ G_E=c{A}_{p^{\prime }}+(1-c)(1-p^{\prime })I,$$

and, after Hadamard product with $G_E$, the minimal eigenvalue becomes $c{\lambda }_{\min }+(1-c)(1-p^{\prime })$, which turns to zero when

$$c=\frac{1-p^{\prime }}{1-p^{\prime }-{\lambda }_{\min }},$$

(28)

hence, we have found c for $G_E$ which meets requirement (27). Assistance provided by the Gram matrix $G_E$ is “small”, as for small values of required improvement $p^{\prime }-p_{\mathrm{succ}}$, ${\lambda }_{\min }$ takes small negative values, thus inner products c for the assistance states given by (28) (which are the elements of the Gram matrix) are also close to identity, which means “small” assistance. For $p^{\prime }=p_{\mathrm{succ}}$, all elements of the Gram matrix equal 1, hence assistance is just a set of coinciding states, which is the same as “no assistance”.

Let us now summarize the result above as follows.

Theorem 2.

Let $\{|{\phi }_i\rangle \}$ and $\{|{\psi }_i\rangle \}$ be the sets of input and output states with the Gram matrices $G_A$ and $G_B$, respectively. Let $p^{\prime }$ be the desired success probability, and let ${\lambda }_{\min }$ be the minimal eigenvalue of $G_A-p^{\prime }{G}_B$. Then, the assistance states $\{|{\epsilon }_i\rangle \}$ are sufficient to achieve success probability $p^{\prime }$, if

$$\langle {\epsilon }_i|{\epsilon }_j\rangle =\frac{1-p^{\prime }}{1-p^{\prime }-{\lambda }_{\min }},\forall i\ne j.$$

As a simple example of such construction, let us again consider unambiguous discrimination between two non-orthogonal states (Example 1). Here, the input and output Gram matrices $G_A$ and $G_B$ are

$$G_A=\left(\begin{array}{cc}1& cos\alpha \\ cos\alpha & 1\end{array}\right),G_B=\left(\begin{array}{cc}1& 0\\ 0& 1\end{array}\right),$$

(29)

and if the desired success probability $p^{\prime }$ is above $1-cos\alpha$, the minimal eigenvalue of

$$A_{p^{\prime }}=G_A-p^{\prime }{G}_B=\left(\begin{array}{cc}1-p^{\prime }& cos\alpha \\ cos\alpha & 1-p^{\prime }\end{array}\right)$$

becomes negative and equals $1-p^{\prime }-cos\alpha$. Hence, assistance needed to ensure this success probability, has the Gram matrix

$$G_E=\left(\begin{array}{cc}1& c\\ c& 1\end{array}\right),$$

where, according to (28),

$$c=\frac{1-p^{\prime }}{cos\alpha },$$

which agrees with the expression $p^{\prime }=1-cos\alpha cos\epsilon$ in Example 1, as $c=cos\epsilon$.

3. Improved Photon Number Splitting Attack in Quantum Key Distribution

Let us now consider a possible application of the proposed method, namely an improvement in the photon number splitting (PNS) attack [14,15] efficiency.

In PNS attack scenario, available when phase-randomized coherent states are used by the legitimate users, the eavesdropper uses quantum nondemolition (QND) measurement to determine the number of photons in each pulse. Then, the eavesdropper blocks the pulse or sends one photon to Bob, after certain actions, which may include (see, e.g., ref. [16]) storing some photons in the eavesdropper’s quantum memory, unambiguous discrimination between the states, and some other actions.

Let us consider the case of zero-error attacks, which mean that the photon which reaches Bob, should not cause errors, when it is not blocked. This photon then plays exactly the role of assistance, since it may be blocked or should remain in the same state. Our idea is to include this protocol in the transformation performed by the eavesdropper (Eve). Such a transformation was already mentioned in ref. [16] in case of USD transformation, but here we propose a more general and, for some cases, more effective operation.

Let us now briefly describe the protocol under study which is a version of SARG04 protocol [16,17]. This protocol uses four states $\{|0_a\rangle ,|1_a\rangle ,|0_b\rangle ,|1_b\rangle \}$, separated in two bases, a and b, with the following configuration:

$$\begin{array}{c}\hfill |0_a\rangle =\left(\begin{array}{c}cos\frac{\eta }{2}\\ sin\frac{\eta }{2}\end{array}\right),|1_a\rangle =\left(\begin{array}{c}cos\frac{\eta }{2}\\ -sin\frac{\eta }{2}\end{array}\right),\\ \hfill |0_b\rangle =\left(\begin{array}{c}sin\frac{\eta }{2}\\ -cos\frac{\eta }{2}\end{array}\right),|1_b\rangle =\left(\begin{array}{c}sin\frac{\eta }{2}\\ cos\frac{\eta }{2}\end{array}\right).\end{array}$$

(30)

The motivation of this configuration is the following: if Eve stores one photon in her quantum memory, she cannot extract full information because states within each basis are not orthogonal, unlike BB84 protocol. And, unlike the “4 + 2” protocol [14], Eve cannot perform a filtering operation [16] which maps the states (30) on the states of BB84 protocol [18], for which full information extraction becomes available. Every transformation which makes the states of a-basis orthogonal, makes the states of b-basis less distinguishable, as shown in ref. [16].

Let us describe an example of attack, which provides Eve with full information, proposed in ref. [16]. This attack is based on selective filtering operation $F_a$ with Kraus operators $F_a=\{F_a^{OK},F_a^{fail}\}$ which, for a-basis, read

$$F_a^{OK}=\frac{1}{\sqrt{1+cos\eta }}\left(|+\rangle \langle 1_a^{\perp }|+|-\rangle \langle 0_a^{\perp }|\right),F_a^{fail}=\sqrt{I-{\left(F_a^{OK}\right)}^{†}{F}_a^{OK}},$$

(31)

where $|\pm \rangle =\frac{1}{\sqrt{2}}(|0\rangle \pm |1\rangle )$, and the state $|i_a^{\perp }\rangle$ is orthogonal to $|i_a\rangle$. The similar operation $F_b=\{F_b^{OK},F_b^{fail}\}$ works for b-basis.

The following attack was proposed in ref. [16]:

So, now Eve has to consider two different filters $F_a$ and $F_b$ that make the states in set a and set b orthogonal, respectively. If she wants to receive all the information about the bit sent by Alice, she has to block all the pulses with less than three photons. When the pulse contains three photons, she applies $F_a$ to the first one, $F_b$ to the second one, and only when both of them are conclusive, she forwards the third photon to Bob.

We consider this PNS-like attack scenario as not completely effective, since there is one extra photon available at the moment of attack, which is not involved in the eavesdropping transformation. Hence, this photon can be considered as a good example of assistance, as it is not needed in case of failure, but should maintain its initial state in case of success. Hence, we will describe the improved version of the attack scenario quoted above.

In the sequel, we will consider the described protocol with states configuration (30), but let us note that the more conventional version of four-states SARG04 protocol, also described in refs. [16,17], is slightly different: it uses the value $\eta =\frac{\pi }{4}$, and random choice of the basis among four (instead of two) options. The proposed attack is not effective against this four-state version, but may, after certain modification, be effective against a version of SARG04 with a larger number of states, described in Section IV of ref. [16].

Let us now describe a postselective transformation, which uses assistance and is more effective than the attack scenario proposed in ref. [16]; namely, it has larger success probability for Eve to obtain full information.

The Gram matrix of the input three-photon states $\{|0_a{0}_a{0}_a\rangle ,|1_a{1}_a{1}_a\rangle ,|0_b{0}_b{0}_b\rangle ,|1_b{1}_b{1}_b\rangle \}$ reads

$$G_{\mathrm{input}}=G\circ G\circ G,$$

(32)

where

$$G=\left(\begin{array}{cccc}1& cos\eta & 0& sin\eta \\ cos\eta & 1& sin\eta & 0\\ 0& sin\eta & 1& -cos\eta \\ sin\eta & 0& -cos\eta & 1\end{array}\right)$$

(33)

is the Gram matrix for single-photon states (30).

The condition for success probability $p_{\mathrm{succ}}$ therefore reads

$$G\circ G\circ G-p_{\mathrm{succ}}{G}_E\circ G\ge 0,$$

(34)

where $G_E$ is the Gram matrix for output states of the eavesdropper, and the last G plays the role of assistance. The goal of Eve is to make the states within each basis (a and b) orthogonal, which in terms of the Gram matrix $G_E$ elements means $g_{12}=g_{21}=g_{34}=g_{43}=0$. Let us consider the following parameters:

$$p_{\mathrm{succ}}=1-{cos}^3\eta ,$$

(35)

$$G_E=\left(\begin{array}{cccc}1& 0& 0& \frac{{sin}^2\eta }{p_{\mathrm{succ}}}\\ 0& 1& \frac{{sin}^2\eta }{p_{\mathrm{succ}}}& 0\\ 0& \frac{{sin}^2\eta }{p_{\mathrm{succ}}}& 1& 0\\ \frac{{sin}^2\eta }{p_{\mathrm{succ}}}& 0& 0& 1\end{array}\right).$$

(36)

It follows from $cos\eta <1$ that ${cos}^3\eta <{cos}^2\eta$, which implies that ${sin}^2<1-{cos}^3\eta$, hence $G_E$ is non-negative. Now, it is straightforward to see that

$$G_{\mathrm{input}}-p_{\mathrm{succ}}{G}_E\circ G=\left(\begin{array}{cccc}{cos}^3\eta & {cos}^3\eta & 0& 0\\ {cos}^3\eta & {cos}^3\eta & 0& 0\\ 0& 0& {cos}^3\eta & -{cos}^3\eta \\ 0& 0& -{cos}^3\eta & {cos}^3\eta \end{array}\right)$$

is non-negative, thus success probability $p_{\mathrm{succ}}$ can be achieved. Hence, Eve can make orthogonal the states in her quantum memory, which corresponds to both bases a and b, and the success probability is $1-{cos}^3\eta$.

Let us observe that $p_{\mathrm{succ}}$ is the best possible success probability for transformation, which makes the states $\{|0_a{0}_a{0}_a\rangle ,|1_a{1}_a{1}_a\rangle \}$ orthogonal, as $p_{\mathrm{succ}}=1-\langle 0_a{0}_a{0}_a|1_a{1}_a{1}_a\rangle$, so this success probability cannot be improved. Hence, we have constructed a transformation which performs filtering for both bases which success probability equals the one for filtering in just one basis. The only important requirement is that this transformation should involve the third photon, which preserves its original state in case of success.

It is straightforward to see that our proposition allows for much higher success probability than original PNS-like attack scenario quoted above. Filtering of one photon has success probability $1-cos\eta$, which is the same as for USD. For both photons, success probability becomes $p_{\mathrm{succ}}^{\prime }={(1-cos\eta )}^2$, a value much smaller than $1-{cos}^3\eta$. For example, for $\eta =\frac{\pi }{4}$, the values are

$$p_{\mathrm{succ}}^{\prime }={(1-cos\eta )}^2\approx 0.0858,p_{\mathrm{succ}}=1-{cos}^3\eta \approx 0.6464,$$

and our proposition demonstrates dramatic improvement. Here, we again see that collective transformations over several photons are more effective than individual operations [19,20,21]. Let us also note that in general case this attack may be combined with single-photon attack [22], when Eve is not allowed to block all the pulses with less than three photons.

In [16], a PNS attack with unambiguous state discrimination is also studied, which utilized unambiguous discrimination between the four signals, each containing three photons in the same state. This operation has success probability $1/2$. It is also not an optimal attack, since USD performs extra work: it discriminates between all the states, and does not uses basis announcement which happens later. But, taking into account the basis announcement, Eve’s task is simplified: she just needs to make the states within each basis well-distinguishable, which happens in our case.

Let us once again stress that here we consider a variant of SARG04, which demonstrates the motivation of its basis configuration. The final version of SARG04 uses a more integrated communication between legitimate users, not just basis announcement (a or b). The described attack, which performs information extraction in two bases, is no more effective (unlike the USD attack described by the authors of the SARG04 protocol), and becomes an example of assistance-based version of PNS-attack, which demonstrates that for some of the QKD protocols, the photon which is sent to Bob, should also be involved in Eve’s transformation, and it might improve the eavesdropping efficiency. Such improvement does not happen for decoy state BB84 protocol [23], as only single-photon pulses contribute the key in this protocol, but it should be taken into account for other coherent states quantum key distribution protocols.

4. Conclusions

In this work, we study postselective quantum transformations, and consider the case of external assistance which takes the form of quantum states. These states should not be damaged in case of success, hence they may be regarded as a sort of catalyst for original transformations.

We considered the transformation where success probability is the same for every state, leaving more general case for further study.

We have shown that assistance with linearly independent states is always helpful, as it allows us to increase a non-unit success probability for any transformation. It is an example of helpful integration with environment, which is usually the case for postselective state transformations [8,24].

We also considered the problem of requesting a sufficient assistance, which should be small for small success probability improvement. We demonstrated that the proposed method is effective for the example of unambiguous state discrimination between two states, as the requested sufficient assistance turns out to be necessary as well.

We also considered a practical example, a PNS-like eavesdropping for a variant of SARG04 quantum key distribution protocol. Here, as the eavesdropper deals with a certain number of photons, the photon which is sent to the receiver meets the conditions of assistance. While the protocol states configuration resists making the states in both bases orthogonal, we show that such orthogonalization happens with much higher success probability when the third photon is also involved. We consider PNS-like attack scenarios in quantum cryptography to be important practical application for our study.