## An introduction to quantum cryptography, computation and error correction.

Colloquium of the Physics Department, ENS-Paris October 23, 2018

Pierre Rouchon

Centre Automatique et Systèmes, Mines ParisTech, PSL Research University Quantic Research Team (ENS, Inria, Mines)

1 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform Quantum error correction (QEC)

Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

2 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

3 / 43

### RSA public-key system

•Invented by Rivest, Shamir and Adleman in 1977, this protocole relies
on the factorization difficulty of RSA integern=pq withpandqlarge
prime numbers (typically log_{2}(n)∼2048).

•3-step protocol based on thepublic key(n,e),witheinvertible modulo (p−1)(q−1)and thesecrete keyd, inverse ofemodulo(p−1)(q−1):

1. Encryption ofM by Alice: M7→A=M^{e} mod (n)(efficient
exponentiation by squaring ≤log_{2}(e)multiplications mod(n))
2. Alice sendsAto Bob on a public classical communication channel

(possibly spied by the bad Oscar)

3. Decryption ofAby Bob: M =A^{d}whered is known only by Bob^{1}

1Euler-Fermat theorem combined with Chinese-remainder theorem ensures
that for arbitrary integersM andk,M^{kϕ(n)+1}=M mod(n)where

ϕ(n) =ϕ(pq) = (p−1)(q−1)is the Euler’s totient function (useed=1+rϕ(n)for some integerr).

4 / 43

### RSA problem and integer factorization

I To recoverM from knowingA,e andn, the bad Oscar has to solve
A=M^{e} mod(n). Specialists conjecture that there do-not existC
andk >0 and an algorithm starting with input(n,e,A)providing
M with less thatC lognk

evaluations of universal classical gates AND,XORandNOT(RSA problem conjectured outside

complexity classP).

I If one has access to the factorizationpq=n, one recovers the secret keyd as the inverse ofemodulo (p−1)(q−1)(Euclidean polynomial algorithm providing the greatest common divisor).

I Factorization, which is in the complexity classNP, is guessed to be outside complexity class P: conjectureP$NP.

Issues around quantum cryptography and computation:

1. unconditionally secure key distribution: BB84 quantum protocol (commercially available, see https://www.idquantique.com/).

2. factorization in " polynomial time"via Shor algorithm (success probabilityO(1)withO

(logn)^{3}

operations)

(quantum computer with 3 log_{2}n+c logical qubits, far from being
available yet for 2048-bit RSA numbersn).

5 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

6 / 43

The LKB Photon box

The first experimental realization of a quantum-state feedback:

microwave photons (10 GHz)

Theory: I. Dotsenko,. . . : Quantum feedback by discrete quantum non-demolition measurements: towards on-demand generation of photon-number states. Physical Review A,2009, 80: 013805-013813.

Experiment: C. Sayrin, . . . ,S. Haroche:

Real-time quantum feedback prepares and stabilizes photon number states. Nature,2011, 477, 73-77.

7 / 43

### Three quantum features emphasized by the LKB photon box

^{2}1. Schrödinger: wave funct. |ψi ∈ H,

d

dt|ψi=−_{~}^{i}H|ψi, H=H0+uH1,

2. Origin of dissipation: collapse of the wave packetinduced by the measurement of observableO with spectral decomp. P

µλµPµ:

I measurement outcomeµwith proba. Pµ=hψ|Pµ|ψi depending on|ψi, just before the measurement

I measurement back-action if outcomeµ=y:

|ψi 7→ |ψi+= Py|ψi phψ|Py|ψi

3. Tensor product for the description of composite systems (S,M):

I Hilbert spaceH=H^{S}⊗ H^{M}

I HamiltonianH=HS⊗IM+Hint+IS⊗HM I observable on sub-systemM only: O=IS⊗OM.

2S. Haroche and J.M. Raimond. Exploring the Quantum: Atoms, Cavities and Photons.Oxford Graduate Texts, 2006.

8 / 43

### Composite system

(S,M): harmonic oscillator⊗### qubit.

I SystemS corresponds to a quantized harmonic oscillator:

H^{S} =
(_{∞}

X

n=0

ψ_{n} |ni

(ψ_{n})^{∞}_{n=0}∈l^{2}(C)
)

, where |niis the photon-number state withnphotons (hn1|n2i=δn1,n2).

I MeterM is a qubit, a 2-level system:

H^{M} =

ψ_{g} |gi+ψ_{e}|ei

ψ_{g}, ψ_{e} ∈C

, where |gi(resp. |ei) is the ground (resp. excited) state (hg|gi=he|ei=1 andhg|ei=0)

I State of the composite system |Ψi∈ H^{S}⊗ H^{M}:

|Ψi=X

n≥0

Ψ_{ng} |ni ⊗ |gi+ Ψ_{ne} |ni ⊗ |ei

=

X

n≥0

Ψ_{ng} |ni

⊗ |gi+

X

n≥0

Ψ_{ne} |ni

⊗ |ei, Ψ_{ne},Ψ_{ng} ∈C.
Ortho-normal basis: |ni ⊗ |gi,|ni ⊗ |ei

n∈N. _{9 / 43}

### Quantum trajectories (1)

### C

### B

### D R

_{1}

### R

_{2}

*B* *R*

_{2}

I When atom comes outB, the quantum state |Ψi_{B} of the
composite system is separable: |Ψi_{B} =|ψi ⊗ |gi.

I Just before the measurement in D, the state is in generalentangled (not separable):

|Ψi_{R}

2 =USM |ψi ⊗ |gi

= Mg|ψi

⊗ |gi+ Me|ψi

⊗ |ei
where USM =UR_{2}UCUR_{1} is a unitary transformation (Schrödinger
propagator) defining the measurement operatorsMg andMe on
H^{S}. SinceUSM is unitary, M^{†}_{g}Mg+M^{†}_{e}Me =I.

10 / 43

### Quantum trajectories (2)

Just beforedetectorD the quantum state isentangled:

|Ψi_{R}

2= (Mg|ψi)⊗ |gi+ (Me|ψi)⊗ |ei
Just afteroutcomey, the state becomesseparable^{3}:

|Ψi_{D}=

M_{y}
rD

ψ|M^{†}_{y}My|ψE|ψi

⊗ |yi.

Outcomey obtained with probabilityP^{y} =

ψ|M^{†}yMy|ψ
..

Quantum trajectories(Markov chain, stochastic dynamics):

|ψk+1i=

M_{g}
rD

ψ_{k}|M^{†}_{g}Mg|ψ_{k}E|ψki, yk=g with probability

ψk|M^{†}gMg|ψk

;

M_{e}
rD

ψ_{k}|M^{†}_{e}M_{e}|ψ_{k}E|ψki, yk=ewith probability

ψk|M^{†}eMe|ψk

;

with state|ψkiand measurement outcomeyk∈ {g,e}at time-stepk:

3Measurement operatorO=IS⊗(|ei he| − |gi hg|).

11 / 43

### Quantum Non Demolition (QND) measurement of photons

^{4}

|Ψi_{R}_{2} =UR2UCUR1 |ψi ⊗ |gi

C

B

D R1

R2

*B* *R*2

UR_{1}=IS⊗_{|gi+|ei}

√2

hg|+_{−|gi+|ei}

√2

he|
UC =e^{−i}

φ0

2N

⊗ |gi hg|+e^{i}

φ0

2N

⊗ |ei he|
UR_{2}=UR_{1}

UR_{1} |ψi ⊗ |gi

= ^{√}^{1}_{2}(|ψi ⊗ |gi+|ψi ⊗ |ei)
UCUR_{1} |ψi ⊗ |gi

= ^{√}^{1}

2

e^{−i}^{φ}^{2}^{0}^{N}|ψi

⊗ |gi+

e^{i}^{φ}^{2}^{0}^{N}|ψi

⊗ |ei

|Ψi_{R}_{2}=^{1}_{2}

e^{−i}

φ_{0}
2 N

|ψi

⊗(|gi+|ei) +

e^{i}

φ_{0}
2N

|ψi

⊗(− |gi+|ei)

=

−isin(^{φ}_{2}^{0}N)|ψi

⊗ |gi+

cos(^{φ}_{2}^{0}N)|ψi

⊗ |ei

ThusMg=−isin(^{φ}_{2}^{0}N)andMe =cos(^{φ}_{2}^{0}N).

Quantum Monte-Carlo simulations with MATLAB: QNDphoton.m

4M. Brune, . . . : Manipulation of photons in a cavity by dispersive atom-field coupling: quantum non-demolition measurements and generation of "Schrödinger cat"

states . Physical Review A, 45:5193-5214, 1992.

12 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

13 / 43

### An idea due to Bennet and Brassard in 1984 (BB84)

**GAP Optique** 17

**Geneva University**

Alice's Bit Sequence

0 1 0 - 0 1 1 1 1 - 1 0 - 1 - - 0 1 - - 1 - 1 0 Bob's Bases

Bob's Results
Key
**Alice**

**Bob**

Polarizers Horizontal - Vertical Diagonal (-45 , +45 )° °

H/V Basis

45 Basis°

BB84 protocol

14 / 43

### BB84

A first quantum sequence via a quantum communication channel:

1. Alice sends to Bob a large numberNof linearly polarized photons (i.e. qubits

|ψi=a0|0i+a1|1i) along 4 possible directions:

I horizontal (|0i) or vertical (|1i).

I +π/4 (^{|0i+|1i}^{√}

2 ) or−π/4 (^{|0i−|1i}^{√}

2 ).

2. For each photon received from Alice, Bob chooses a measurement

I H/V:Z=|0i h0| − |1i h1|

I ±π/4:X =|1i h0|+|0i h1|=_{|0i+|1i}

√ 2

h0|+h1|√ 2

−_{|0i−|1i}

√ 2

h0|−h1|√ 2

A second classical sequence via a public communication channel:

1. For each photon, Alice and Bob exchange the type of chosen polarizationZ or X (but not its value).

2. For 50% of the photons sharing the same polarization (aroundN/4), Alice and Bob exchange their values (H/V or±π/4).

3. For 50% of the photons with same polarization (aroundN/4), Alice and Bob keep secret their values

If the exchanged values (H/V or±π/4) coincide, Alice and Bob are convinced that the quantum communication was not spied by the bad Oscar. The remaining values (around N/4 and kept secret) will then form a coding key exploited by Alice and Bob in a classical cryptographic protocol.

Security: Oscar cannot clone the photon emitted by Alice.

15 / 43

### Impossibility of quantum cloning (Wootters and Zurek 1982)

Assume that exists a quantum machine copying the original qubit onto a second clone qubit. The initial wave function of the composite system (original qubit, clone qubit, quantum machine) reads

|Ξi_{t=0}=|ψi ⊗ |bi ⊗ |fbi.

where|ψi ∈C^{2} is the original state,|bithe initial state of the clone (b for
blank) and|fbithe initial state of the cloning machine.

The cloning process is associated to a unitary transformationUT independent
of|Ξi_{t=0} and satisfying

∀ |ψi, |ψi ⊗ |ψi ⊗ f|ψi

=UT |ψi ⊗ |bi ⊗ |fbi . In particular

|0i ⊗ |0i ⊗ f|0i

=UT(|0i ⊗ |bi ⊗ |fbi)
_{|0i+|1i}

√ 2

⊗_{|0i+|1i}

√ 2

⊗

f|0i+|1i√ 2

=UT

_{|0i+|1i}

√ 2

⊗ |bi ⊗ |fbi

Impossible with|Ξi=|0i ⊗ |bi ⊗ |fbiand|Λi=_{|0i+|1i}

√ 2

⊗ |bi ⊗ |fbi

√1 2 =

hΞ|Λi

> ^{1}_{2} ≥

hΞ|U_{T}^{†}UT|Λi
sinceUT preserves Hermitian product:

16 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform Quantum error correction (QEC)

Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

17 / 43

### Factoring algorithm and its reduction to order finding (Shor 1994)

•Input: composite odd numbern.

•Output: a non trivial factoraofnin
O (logn)^{2}(log logn)(log log logn)

universal classical/quantum operations.

•Algorithm:

1. Check whethern=a^{b} witha,b>1 (polynomial classical
algorithm); possible return ofa and stop.

2. Otherwise,choose randomlyx∈ {2, . . . ,n−1}. If a=gcd(x,n)>1 (Euclidian division), returna and stop.

3. Otherwisedetermine with a quantum computer the order r of
x modulo n(the smallestr >1 such thatx^{r} =1 mod(n))^{5}

I Ifr even and 1<gcd(x^{r/2}±1,n)<n, then return
a=gcd(x^{r/2}±1,n)and stop.

I Otherwise (probability≤η <1 independent of n) goto step 2.

5Shor’s algorithm is detailed in Chapter 5 of M.A. Nielsen, I.L. Chuang:

Quantum Computation and Quantum Information. Cambridge University Press, 2000.

18 / 43

### A quantum gate appearing in Shor’s order-finding algorithm.

•The canonical`-qubit basis (basis ofC^{2}

` ≡(C^{2})^{⊗}^{`}) is labelled by
{0, . . .2^{`}−1} 3j≡(j_{1}, . . . ,j_{`})∈ {0,1}^{`} with

|ji=|j_{1}j_{2}. . .j_{`}i=|j_{1}i ⊗ |j_{2}i ⊗. . .⊗ |j_{`}i andj=P`

s=1j_{s}2^{`−s}.

•To the data 1<x<n<2^{`} with gcd(x,n) =1 is associated U a
unitary transformationon`-qubits (permutationbetween vectors|ji)

ify≤n−1, U|yi=|xy mod(n)i, otherwiseU|yi=|yi.

•Forr the order ofxmod(n) and anys∈ {0, . . . ,r−1}the`-qubit state

|usi= ^{√}^{1}_{r}

r−1

X

k=0

e^{−2iπ}^{r} ^{sk}

x^{k} mod(n)

satisfiesU|usi=e^{−2iπ}^{r} ^{s} |usi

and ^{√}^{1}_{r}Pr−1

s=0|u_{s}i=|1i.

•Modular exponentiation algorithm to computeU withO(`^{3})1-qubit
gates^{6}andCNOT2-qubit gates^{7} (non trivial quantum algorithm...)

6Unitarye^{ıθ}e^{−ıαZ/2}e^{−ıβX/2}e^{−ıγZ/2}with(θ, α, β, γ)∈[0,2π].

7CNOT|y1y2i=|y1z2iwhere{0,1} 3z2=y1+y2 mod(2).

19 / 43

### The quantum Fourier transform

•Computations of the usual discrete Fourier transform
C^{2}

` 3(x0, . . . ,x_{2}`−1)7→(y0, . . . ,y_{2}`−1)∈C^{2}

`

yj=_{2}_{`/2}^{1}

2^{`}−1

X

j=0

e

2iπjk

2` xk; xk= _{2}_{`/2}^{1}

2^{`}−1

X

j=0

e

−2iπjk 2` yj

requiresO(`2^{`})additions and multiplications (FFT).

•It is also a unitary transformation ofC^{2}

` ≡(C^{2})^{⊗}^{`}, the quantum Fourier
transform (QFT)

|j1i. . .|j`i=|ji 7→

P2^{`}−1

k=0 e^{2iπ}^{2}^{`}^{jk} |ki
2^{`/2}
with the binary decompositionj=P`

s=1js2^{`−s}.

•The identity underlying thequantum circuit implementing the QFT with
O(`^{2})1-qubit gates and 2-qubit gates:

P2^{`}−1

k=0 e^{2iπ}^{2}^{`}^{jk}|ki

2^{`/2} = |0i+e^{2iπ}^{0.j}^{`}|1i

|0i+e^{2iπ}^{0.j}^{`−1}^{j}^{`}|1i

. . . |0i+e^{2iπ}^{0.j}^{1}^{...j}^{`}|1i
2^{`/2}

with binary fraction notations 0.jsjs+1jm=js/2+js+1/4+. . .+jm/2^{m−s+1}.

20 / 43

### Efficient Circuit for the quantum Fourier transform

With Hadamard gate,H =_{|0i+|1i}

√ 2

h0|+_{|0i−|1i}

√ 2

h1|, and
Controlled-Rk gate (2-qubit) where Rk =|0i h0|+e^{2iπ/2}^{k}|1i h1|,
the circuit

followed by a simple swap circuit reversing the order of the`qubits, one gets the QFT:

|j1. . .j`i 7→ |0i+e^{2iπ}^{0.j}^{`}|1i

|0i+e^{2iπ}^{0.j}^{`−1}^{j}^{`}|1i

. . . |0i+e^{2iπ}^{0.j}^{1}^{...j}^{`}|1i
2^{`/2}

21 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

22 / 43

### The simplest classical error correction code

•Single bit error model: the bitb∈ {0,1} flips with probabilityp<1/2
during∆t (for usual DRAM:p/∆t ≤10^{−14} s^{−1}).

•Multi-bit error model: each bitb_{k} ∈ {0,1} flips with probability
p<1/2 during∆t;no correlation between the bit flips.

•Useredundancyto construct with several physical bitsbk of flip probabilityp, a logical bitbL with a flip probabilitypL<p.

•The simplest solution, the3-bit code(sampling time∆t):

t=0: bL= [bbb]withb∈ {0,1}

t = ∆t: measure the three physical bits ofbL= [b1b2b3] (instantaneous) :

1. if all 3 bits coincide, nothing to do.

2. if one bit differs from the two other ones, flip this bit (instantaneous);

•Since the flip probability laws of the physical bits are independent, the
probability that the logical bitbL (protected with the above error
correction code) flips during∆t isp_{L} =3p^{2}−2p^{3}<p sincep<1/2.

23 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

24 / 43

### The 3-qubit bit flip code

•Local bit-flip errors: each physical qubit|ψi=α|0i+β|1ibecomes
X|ψi=α|1i+β|0i^{8}with probabilityp<1/2 during∆t.

(for actual super-conducting qubitp/∆t>10^{3}s^{−1}).

•t=0: |ψ_{L}i=α|0_{L}i+β|1_{L}i ∈C^{8}with|0_{L}i=|000iand|1_{L}i=|111i.

•t= ∆t: |ψ_{L}ibecomes with

1 flip:

α|100i+β|011i α|010i+β|101i α|001i+β|110i

;2 flips:

α|110i+β|001i α|101i+β|010i α|011i+β|100i

;3 flips:α|111i+β|000i.

•Key fact: 4 orthogonal planesPc=span(|000i,|111i),P1=span(|100i,|011i), P2=span(|010i,|101i)andP3=span(|001i,|110i).

•Error syndromes: 3 commuting observablesS1=I⊗Z⊗Z,S2=Z⊗I⊗Z and S3=Z⊗Z⊗I with spectrum{−1,+1}and outcomes(s1,s2,s3)∈ {−1,+1}.

-1-s1=s2=s3:Pc 3 |ψ_{L}i=

α|000i+β|111i 0 flip

β|000i+α|111i 3 flips ; no correction
-2-s16=s2=s3:P_{1}3 |ψ_{L}i=

α|100i+β|011i 1 flip

β|100i+α|011i 2 flips ;(X⊗I⊗I)|ψ_{L}i ∈P_{c}.
-3-s26=s3=s1:P23 |ψLi=

α|010i+β|101i 1 flip

β|010i+α|101i 2 flips ;(I⊗X⊗I)|ψLi ∈Pc.
-4-s36=s1=s2:P33 |ψ_{L}i=

α|001i+β|110i 1 flip

β|001i+α|110i 2 flips ;(I⊗I⊗X)|ψ_{L}i ∈Pc.

8X=|1i h0|+|0i h1|andZ=|0i h0| − |1i h1|.

25 / 43

### The 3-qubit phase flip code

•Local phase-flip error: each physical qubit|ψi=α|0i+β|1ibecomes
Z|ψi=α|0i −β|0i^{9}with probabilityp<1/2 during∆t.

•SinceX =HZHandZ=HXH(H^{2}=I), use the3-qubit bit flip code in the
frame defined byH:

|0i 7→ |0i+|1i

√

2 ,|+i, |1i 7→|0i − |1i

√

2 ,|−i, X7→HX H=Z=|+ih+|+|−ih−|.

•t= +:|ψ_{L}i=α|+_{L}i+β|−_{L}iwith|+_{L}i=|+ + +iand|−_{L}i=|− − −i.

•t= ∆t:|ψ_{L}ibecomes with

1 flip:

α|−+ +i+β|+− −i α|+−+i+β|−+−i α|+ +−i+β|− −+i

;2 flips:

α|− −+i+β|+ +−i α|−+−i+β|+−+i α|+− −i+β|−+ +i

;3 flips:α|− − −i+β|+ + +i.

•Key fact:4 orthogonal planesP_{c}=span(|+ + +i,|− − −i),P_{1}=span(|−+ +i,|+− −i,
P_{2}=span(|+−+i,|−+−i)andP_{3}=span(|+ +−i,|− −+i).

•Error syndromes: 3 commuting observablesS1=I⊗X⊗X,S2=X⊗I⊗XandS3=X⊗X⊗I
with spectrum{−1,+1}and outcomes(s_{1},s_{2},s_{3})∈ {−1,+1}.

-1-s1=s2=s3:P_{c}3 |ψ_{L}i=

α|+ + +i+β|− − −i0 flip

β|+ + +i+α|− − −i3 flips ; no correction
-2-s16=s2=s3:P13 |ψ_{L}i=

α|−+ +i+β|+− −i 1 flip

β|−+ +i+α|+− −i 2 flips ;(Z⊗I⊗I)|ψ_{L}i ∈P_{c}.
-3-s26=s3=s1:P23 |ψ_{L}i=

α|+−+i+β|−+−i 1 flip

β|+−+i+α|−+−i 2 flips ;(I⊗Z⊗I)|ψ_{L}i ∈P_{c}.
-4-s36=s1=s2:P33 |ψ_{L}i=

α|+ +−i+β|− −+i1 flip

β|+ +−i+α|− −+i2 flips ;(I⊗I⊗Z)|ψ_{L}i ∈P_{c}.
9X=|1i h0|+|0i h1|,Z=|0i h0| − |1i h1|andH=_{|0i+|1i}

√2

h0|+_{|0i−|1i}

√2

h1|.

26 / 43

### The Shor code (1995): combination of bit-flip and phase flip codes

•Take the phase flip code|+ + +iand|− − −i. Replace each|+i(resp.|−i) by

|000i+|111i

√

2 (resp.|000i−|111i

√

2 ). New logical qubit |ψ_{L}i=α|0_{L}i+β|1_{L}i ∈C^{2}

9:

|0_{L}i= |000i+|111i

|000i+|111i

|000i+|111i

2√

2 ,|1_{L}i= |000i−|111i

|000i−|111i

|000i−|111i

2√ 2

•Local errors: each of the 9 physical qubits can have a bit-flipX, a phase flipZ or a
bit flip followed by a phase flipZ X=iY ^{10}with probabilitypduring∆t.

•Denote byX_{k} (resp.Y_{k} andZ_{k}), the local operatorX (resp.Y andZ) acting on
physical qubit nok∈ {1, . . . ,9}. Denote byPc =span(|0_{L}i,|1_{L}i)the code space.

One get a family of the 1+3×9=28 orthogonal planes:

Pc,

X_{k}Pc

k=1,...,9,

Y_{k}Pc

k=1,...,9,

Z_{k}Pc

k=1,...,9.

•One can always constructerror syndromesto obtain, when there is only one error among the 9 qubits during∆t,the numberkof the qubit and the error type it has undergone(X,Y orZ). These 28 planes are then eigen-planes by the syndromes.

•If the physical qubitk is subject toany kind of local errorsassociated to arbitrary
operatorM=gI+aX+bY+cZ (g,a,b,c∈C),|ψ_{L}i 7→ q ^{M}^{k}^{|ψ}^{L}^{i}

hψ_{L}|M^{†}

kM_{k}|ψ_{L}i, the
syndrome measurements will project the corrupted logical qubit on one of the 4 planes
Pc,X_{k}Pc,Y_{k}Pc orZ_{k}Pc.It is then simple by using eitherI,X_{k},Y_{k}orZ_{k}, to
recover up to a global phase the original logical qubit|ψ_{L}i.

10X=|1i h0|+|0i h1|,Z=|0i h0| − |1i h1|andY=i|1i |0i −i|0i |1i.

27 / 43

### Many open issues connected to QEC

•For a logical qubit relying onnphysical qubits, the dimension of the
Hilbert has to be larger than 2(1+3n)to recover an arbitrary
single-qubit error: 2^{n}≥2(1+3n)imposingn≥5.

•Efficient constructions of quantum error-correcting codes: stabilizer codes, surface codes where the physical qubits are located on a 2D-lattice, topological codes, . . .

•Fault tolerant computations: computing on encoded quantum states;

fault-tolerant operations to avoid propagations of errors during encoding, gates and measurement; concatenation and threshold theorem, . . .

•Error rates for a DRAM bit≤10^{−14} s^{−1}and for a superconducting
qubit≥10^{3} s^{−1}: high order error-correcting codes; important overhead
(around 1000 physical qubits to encode a logical one^{11}); scalability issues;

. . .

11A.G. Fowler, M. Mariantoni, J.M. Martinis, A.N. Cleland: Surface codes:

Towards practical large-scale quantum computation. Phys. Rev.

A,86(3):032324, 2012.

28 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

29 / 43

### Continuous-time QEC and feedback

•Quantum error correction is afeedback scheme: at each sampling time a measurement is performed and a correction depending only on the measurement outcome is applied.

•From a control engineering view point, QEC is based on astatic output feedbackscheme (feedback without memory) (called alsoMarkovian feedback).

•In usual discrete-time setting, measurement (sensor) and correction (actuator) processes are assumed instantaneous.

•Natural question: how to take into account thefinite band-width of the measurement and correction processes.

•Interest of continuous-time formulations for QEC:

1. measurement and correction are faster than the error rates but not infinitely faster;

2. qubit errors can occur during the measurement and the correction processes (fault-tolerance issues).

|ψireplaced byρ(density operator) obeying to a stochastic master equation (SME).

30 / 43

### Flashback to the LKB photon box

### C

### B

### D R

_{1}

### R

_{2}

*B* *R*

_{2}

|Ψi_{R}

2=USM|Ψi_{B} =USM |ψi ⊗ |gi

= Mg|ψi

⊗ |gi+ Me|ψi

⊗ |ei

withM^{†}gMg+M^{†}eMe =I.

•Quantum trajectories(Markov chain, stochastic dynamics):

|ψk+1i=

Mg rD

ψ_{k}|M^{†}_{g}M_{g}|ψ_{k}E|ψki, yk=g with probability

ψk|M^{†}gMg|ψk

;

M_{e}
r

D

ψ_{k}|M^{†}_{e}M_{e}|ψ_{k}E|ψki, yk=ewith probability

ψk|M^{†}_{e}Me|ψk

;

with state|ψkiand measurement outcomeyk∈ {g,e}at time-stepk:

31 / 43

### Continuous-time quantum trajectories (diffusive case)

^{12}

•The measurement outcomeyk at discrete-time stepk, is replaced by the small among of measurement signaldyt∈Robtained during an infinitesimal time interval[t,t+dt].

•Themeasurement operatorMy_{k} becomesMdy_{t} close to identity:

Mdyt =I+

−^{i}

~H−^{1}_{2}
L^{†}L

dt+dytL

where operatorL(not necessarily Hermitian) describes the measurement process andH is the Hamiltonian corresponding to the coherent evolution.

•The measurement backaction reads

|ψi_{t+dt} =r ^{M}^{dyt}^{|ψi}^{t}
hψ|_{t}M^{†}

dytM_{dyt}|ψi_{t}

•Probability density ofdy∈Rknowing|ψi_{t}: ^{e}^{−}

dy2

√ 2dt

2πdt hψ|_{t}M^{†}_{dy}Mdy|ψi_{t}.
Coincides up to orderO(dt^{3/2})terms tody=hψ|_{t}(L+L^{†})|ψi_{t} dt+dW
wheredW is a Wiener process (Gaussian of zero mean and variancedt).

Quantum Monte-Carlo simulations with MATLAB: QNDqubit.m(L=σz,H =0)

12For a mathematical exposure: A. Barchielli, M. Gregoratti: Quantum Trajectories and Measurements in Continuous Time: the Diffusive Case. Springer Verlag,2009.

32 / 43

### Why density operators ρ instead of wave functions |ψi

Consider once again the LKB photon-box:

|ψk+1i=

M_{g}
rD

ψ_{k}|M^{†}_{g}M_{g}|ψ_{k}E|ψki, yk=g with probability

ψk|M^{†}gMg|ψk

;

M_{e}
rD

ψ_{k}|M^{†}_{e}M_{e}|ψ_{k}E|ψki, yk=ewith probability

ψk|M^{†}eMe|ψk

;

Assume known|ψ0ianddetector out of order(y =∅): what about|ψ1i?
I Expectation value of|ψ1i hψ1|knowing|ψ0i:^{13}

## E

^{|ψ}

^{1}

^{i hψ}

^{1}

^{|}

^{}

^{}

^{|ψ}

^{0}

^{i}

^{}

^{=}

^{M}

^{g}

^{|ψ}

^{0}

^{i hψ}

^{0}

^{|}

^{M}

^{†}

^{g}

^{+}

^{M}

^{e}

^{|ψ}

^{0}

^{i hψ}

^{0}

^{|}

^{M}

^{†}

^{e}

^{.}

I SetK(ρ),MgρM^{†}_{g}+MeρM^{†}_{e} for any operatorρ.

I ρ_{k} expectation of|ψki hψk|knowing|ψ0i:

ρ_{k+1}=K(ρ_{k})andρ_{0}=|ψ0i hψ0|.

Linear mapK: trace preserving Kraus map (quantum channel).

Density operatorsρ: convex space of Hermitian non-negative operators of trace one.

13|ψi hψ|: orthogonal projector on line spanned by unitary vector|ψi.

33 / 43

### Quantum trajectories for the density operator

ρ Detector efficiencyη∈[0,1]. Outputy∈ {g,e,∅}:ρ_{k}_{+1}=

Kg(ρ_{k})

Tr(Kg(ρ_{k})),yk =g with probability Tr(Kg(ρ_{k}));

Ke(ρ_{k})

Tr(Ke(ρ_{k})),yk =e with probability Tr(Ke(ρ_{k}));

K_{∅}(ρ_{k})

Tr(K_{∅}(ρ_{k})),yk =∅with probability Tr(K_{∅}(ρ_{k}));

with Kraus maps

Kg(ρ) =ηMgρM^{†}_{g}, Ke(ρ) =ηMeρM^{†}_{e}
K_{∅}(ρ) = (1−η)

MgρM^{†}_{g}+MeρM^{†}_{e}
.

We still have:

## E

^{ρ}

^{k}

^{+1}

^{}

^{}

^{ρ}

^{k}

^{}

^{,}

^{K}

^{(ρ}

^{k}

^{) =}

^{M}

^{g}

^{ρ}

^{k}

^{M}

^{†}

^{g}

^{+}

^{M}

^{e}

^{ρ}

^{k}

^{M}

^{†}

^{e}

^{=}

^{X}

y

Ky(ρ_{k}).

34 / 43

### Discrete-time quantum trajectories for open quantum systems

Four features:1. Bayes law: P(µ/y) =P(y/µ)P(µ)/ P

µ^{0}P(y/µ^{0})P(µ^{0})
,
2. Schrödinger equationsdefining unitary transformations.

3. Partial collapse of the wave packet: irreversibility and dissipation are induced by the measurement of observables withdegeneratespectra.

4. Tensor product for the description of composite systems.

VDiscrete-time Q. traj. : Markov processesof state ρ, (density op.):

ρ_{k+1}=

Pm

µ=1η_{y,µ}Mµρ_{k}M^{†}_{µ}

Tr(^{P}^{m}µ=1ηy,µMµρ_{k}M^{†}µ), with proba. Py(ρ_{k}) =Pm

µ=1η_{y,µ}Tr

Mµρ_{k}M^{†}_{µ}
associated toKraus maps^{14}(ensemble average, quantum channel)

## E

^{(ρ}

^{k}

^{+1}

^{|}

^{ρ}

^{k}

^{) =}

^{K}

^{(ρ}

^{k}

^{) =}

^{X}

µ

Mµρ_{k}M^{†}_{µ} with X

µ

M^{†}_{µ}Mµ=I

and left stochastic matrices (imperfections, decoherences)(ηy,µ).

14M.A. Nielsen, I.L. Chuang: Quantum Computation and Quantum Information. Cambridge University Press, 2000.

35 / 43

### Continuous/discrete-time Stochastic Master Equation (SME)

Discrete-time models: Markov chainsρ_{k+1}=

Pm

µ=1η_{y,µ}Mµρ_{k}M^{†}_{µ}

Tr(^{P}^{m}µ=1ηy,µMµρ_{k}M^{†}µ), with proba. Py(ρ_{k}) =Pm

µ=1η_{y,µ}Tr

Mµρ_{k}M^{†}_{µ}
with ensemble averages corresponding toKraus linear maps

## E

^{(ρ}

^{k}

^{+1}

^{|}

^{ρ}

^{k}

^{) =}

^{K}

^{(ρ}

^{k}

^{) =}

^{X}

µ

Mµρ_{k}M^{†}_{µ} with X

µ

M^{†}_{µ}Mµ=I

Continuous-time models: stochastic differential systems^{15}
dρt =

−_{~}^{i}[H, ρt] +X

ν

LνρtL^{†}_{ν}−^{1}_{2}(L^{†}_{ν}Lνρt+ρtL^{†}_{ν}Lν)
dt

+X

ν

√η_{ν}

Lνρ_{t}+ρ_{t}L^{†}_{ν}− Tr

(Lν+L^{†}_{ν})ρ_{t}
ρ_{t}

dW_{ν,t}
driven byWiener processesdWν,t, with measurements yν,t,

dyν,t=√ην Tr

(Lν+L^{†}_{ν})ρt

dt+dWν,t, detection efficiencies
η_{ν} ∈[0,1]andLindblad-Kossakowski master equations (ην≡0):

d

dtρ=−_{~}^{i}[H, ρ] +X

ν

LνρL^{†}_{ν}−^{1}_{2}(L^{†}_{ν}Lνρ+ρL^{†}_{ν}Lν)

15A. Barchielli, M. Gregoratti: Quantum Trajectories and Measurements in
Continuous Time: the Diffusive Case. Springer Verlag, 2009. _{36 / 43}

### Positivity-preserving formulation of diffusive SME

^{16}

With a single imperfect measurementdyt=√

ηTr (L+L^{†})ρt

dt+dWt and detection efficiencyη∈[0,1], the quantum stateρt is usually mixed and obeys to

dρt =

−^{i}

~[H, ρt] +LρtL^{†}−^{1}

2(L^{†}Lρt+ρtL^{†}L)
dt
+√

η

Lρt+ρtL^{†}− Tr

(L+L^{†})ρt

ρt

dWt

driven by the Wiener processdWt

WithIt¯o rules, it can be written as the following "discrete-time" Markov model

ρt+dt = MdytρtM^{†}_{dy}

t+ (1−η)LρtL^{†}dt
Tr

Mdy_{t}ρtM^{†}_{dy}

t+ (1−η)LρtL^{†}dt
withMdy_{t} =I+ −^{i}

~H−^{1}_{2} L^{†}L
dt+√

ηdytL.

ρ0density operator7→for allt>0,ρt density operator

16Such SME precisely describe cutting-edge experiments with superconducting qubits under homodyne and heterodyne continuous-time measurements. See, e.g., the group of Benjamin Huard at ENS-Lyon:http://www.physinfo.fr/index.html.

37 / 43

### Quantum error correction in the diffusive case

QUANTUM WORLD decoherence quantum state

Hilbert space (dissipation) CLASSICAL WORLD

classical input u classical

reference

classical controller

classical output dy

•How to achieve QEC with the above measurement-based feedback scheme where the controller admits a memory (a dynamical system, possibly stochastic).

•In^{17}QEC is implicitly formulated as feedbackstabilization of the code space
Pc underquantum non demolition measurement. Numerical closed-loop
simulations indicate promising convergence properties but a precise
mathematical convergence analysis is missing. Many open issues such as
precise estimates of convergence rates in closed-loop^{18}

17C. Ahn, A. C. Doherty, and A. J. Landahl. Continuous quantum error correction via quantum feedback control. Phys. Rev. A, 65:042301, March 2002.

18Preliminary results in, e.g., G. Cardona, A. Sarlette, and PR. Exponential stochastic stabilization of a two-level quantum system via strict Lyapunov control.

arXiv:1803.07542.

38 / 43

### Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

39 / 43

### Coherent feedback (with measurement-based feedback)

•Quantum analogue of Watt speed governor where adissipative
mechanical system controls another mechanical system^{19}

•Coherent feedback where the controller is another quantum systems^{20}:

QUANTUM WORLD CLASSICAL WORLD Hilbert space

classical controller

quantum controller Hilbert space Hilbert space

system S

dissipation

errors

classical input

classical output

quantum measurement classical

reference

quantum interaction

dy

dy

19J.C. Maxwell: On governors. Proc. of the Royal Society, No.100, 1868.

20Optical pumping (Kastler1950), coherent population trapping (Arimondo 1996), dissipation engineering, autonomous feedback: (Zoller, Cirac, Wolf, Verstraete, Devoret, Siddiqi, Lloyd, Viola, Ticozzi, Mirrahimi, Sarlette, ...)

40 / 43