RSA public-key system

(1)

An introduction to quantum cryptography, computation and error correction.

Colloquium of the Physics Department, ENS-Paris October 23, 2018

Pierre Rouchon

Centre Automatique et Systèmes, Mines ParisTech, PSL Research University Quantic Research Team (ENS, Inria, Mines)

1 / 43

(2)

Outline

Quantum cryptography and computation RSA public-key system

Quantum mechanics from scratch BB84 quantum key distribution protocol

Shor’s factorization algorithm based on quantum Fourier transform Quantum error correction (QEC)

Classical error correction QEC in discrete-time

Continuous-time QEC and measurement-based feedback Autonomous QEC and coherent feedback

Appendix: two key quantum systems Qubit (half-spin)

Harmonic oscillator (spring)

2 / 43

(3)

Outline

Shor’s factorization algorithm based on quantum Fourier transform

Quantum error correction (QEC) Classical error correction QEC in discrete-time

3 / 43

(4)

RSA public-key system

•Invented by Rivest, Shamir and Adleman in 1977, this protocole relies on the factorization difficulty of RSA integern=pq withpandqlarge prime numbers (typically log₂(n)∼2048).

•3-step protocol based on thepublic key(n,e),witheinvertible modulo (p−1)(q−1)and thesecrete keyd, inverse ofemodulo(p−1)(q−1):

1. Encryption ofM by Alice: M7→A=M^e mod (n)(efficient exponentiation by squaring ≤log₂(e)multiplications mod(n)) 2. Alice sendsAto Bob on a public classical communication channel

(possibly spied by the bad Oscar)

3. Decryption ofAby Bob: M =A^dwhered is known only by Bob¹

1Euler-Fermat theorem combined with Chinese-remainder theorem ensures that for arbitrary integersM andk,M^kϕ(n)+1=M mod(n)where

ϕ(n) =ϕ(pq) = (p−1)(q−1)is the Euler’s totient function (useed=1+rϕ(n)for some integerr).

4 / 43

(5)

RSA problem and integer factorization

I To recoverM from knowingA,e andn, the bad Oscar has to solve A=M^e mod(n). Specialists conjecture that there do-not existC andk >0 and an algorithm starting with input(n,e,A)providing M with less thatC lognk

evaluations of universal classical gates AND,XORandNOT(RSA problem conjectured outside

complexity classP).

I If one has access to the factorizationpq=n, one recovers the secret keyd as the inverse ofemodulo (p−1)(q−1)(Euclidean polynomial algorithm providing the greatest common divisor).

I Factorization, which is in the complexity classNP, is guessed to be outside complexity class P: conjectureP$NP.

Issues around quantum cryptography and computation:

1. unconditionally secure key distribution: BB84 quantum protocol (commercially available, see https://www.idquantique.com/).

2. factorization in " polynomial time"via Shor algorithm (success probabilityO(1)withO

(logn)³

operations)

(quantum computer with 3 log₂n+c logical qubits, far from being available yet for 2048-bit RSA numbersn).

5 / 43

(6)

Outline

6 / 43

(7)

The LKB Photon box

The first experimental realization of a quantum-state feedback:

microwave photons (10 GHz)

Theory: I. Dotsenko,. . . : Quantum feedback by discrete quantum non-demolition measurements: towards on-demand generation of photon-number states. Physical Review A,2009, 80: 013805-013813.

Experiment: C. Sayrin, . . . ,S. Haroche:

Real-time quantum feedback prepares and stabilizes photon number states. Nature,2011, 477, 73-77.

7 / 43

(8)

Three quantum features emphasized by the LKB photon box

² 1. Schrödinger: wave funct. |ψi ∈ H,

d

dt|ψi=−_~ⁱH|ψi, H=H0+uH1,

2. Origin of dissipation: collapse of the wave packetinduced by the measurement of observableO with spectral decomp. P

µλµPµ:

I measurement outcomeµwith proba. Pµ=hψ|Pµ|ψi depending on|ψi, just before the measurement

I measurement back-action if outcomeµ=y:

|ψi 7→ |ψi+= Py|ψi phψ|Py|ψi

3. Tensor product for the description of composite systems (S,M):

I Hilbert spaceH=H^S⊗ H^M

I HamiltonianH=HS⊗IM+Hint+IS⊗HM I observable on sub-systemM only: O=IS⊗OM.

2S. Haroche and J.M. Raimond. Exploring the Quantum: Atoms, Cavities and Photons.Oxford Graduate Texts, 2006.

8 / 43

(9)

Composite system

(S,M): harmonic oscillator⊗

qubit.

I SystemS corresponds to a quantized harmonic oscillator:

H^S = (_∞

X

n=0

ψ_n |ni

(ψ_n)^∞_n=0∈l²(C) )

, where |niis the photon-number state withnphotons (hn1|n2i=δn1,n2).

I MeterM is a qubit, a 2-level system:

H^M =

ψ_g |gi+ψ_e|ei

ψ_g, ψ_e ∈C

I State of the composite system |Ψi∈ H^S⊗ H^M:

|Ψi=X

n≥0

Ψ_ng |ni ⊗ |gi+ Ψ_ne |ni ⊗ |ei

=



 X

n≥0

Ψ_ng |ni



⊗ |gi+



 X

n≥0

Ψ_ne |ni



⊗ |ei, Ψ_ne,Ψ_ng ∈C. Ortho-normal basis: |ni ⊗ |gi,|ni ⊗ |ei

n∈N. _{9 / 43}

(10)

Quantum trajectories (1)

C

B

D R

₁

R

₂

B R

₂

I When atom comes outB, the quantum state |Ψi_B of the composite system is separable: |Ψi_B =|ψi ⊗ |gi.

I Just before the measurement in D, the state is in generalentangled (not separable):

|Ψi_R

2 =USM |ψi ⊗ |gi

= Mg|ψi

⊗ |gi+ Me|ψi

⊗ |ei where USM =UR₂UCUR₁ is a unitary transformation (Schrödinger propagator) defining the measurement operatorsMg andMe on H^S. SinceUSM is unitary, M^†_gMg+M^†_eMe =I.

10 / 43

(11)

Quantum trajectories (2)

Just beforedetectorD the quantum state isentangled:

|Ψi_R

2= (Mg|ψi)⊗ |gi+ (Me|ψi)⊗ |ei Just afteroutcomey, the state becomesseparable³:

|Ψi_D=





M_y rD

ψ|M^†_yMy|ψE|ψi



⊗ |yi.

Outcomey obtained with probabilityP^y =

ψ|M^†yMy|ψ ..

Quantum trajectories(Markov chain, stochastic dynamics):

|ψk+1i=











M_g rD

ψ_k|M^†_gMg|ψ_kE|ψki, yk=g with probability

ψk|M^†gMg|ψk

;

M_e rD

ψ_k|M^†_eM_e|ψ_kE|ψki, yk=ewith probability

ψk|M^†eMe|ψk

;

with state|ψkiand measurement outcomeyk∈ {g,e}at time-stepk:

3Measurement operatorO=IS⊗(|ei he| − |gi hg|).

11 / 43

(12)

Quantum Non Demolition (QND) measurement of photons

⁴

|Ψi_R₂ =UR2UCUR1 |ψi ⊗ |gi

C

B

D R1

R2

B R2

UR₁=IS⊗_|gi+|ei

√2

hg|+_−|gi+|ei

√2

he| UC =e⁻ⁱ

φ0

2N

⊗ |gi hg|+eⁱ

φ0

2N

⊗ |ei he| UR₂=UR₁

UR₁ |ψi ⊗ |gi

= ^√¹₂(|ψi ⊗ |gi+|ψi ⊗ |ei) UCUR₁ |ψi ⊗ |gi

= ^√¹

2

e⁻ⁱ^φ²⁰^N|ψi

⊗ |gi+

eⁱ^φ²⁰^N|ψi

⊗ |ei

|Ψi_R₂=¹₂

e⁻ⁱ

φ₀ 2 N

|ψi

⊗(|gi+|ei) +

eⁱ

φ₀ 2N

|ψi

⊗(− |gi+|ei)

=

−isin(^φ₂⁰N)|ψi

⊗ |gi+

cos(^φ₂⁰N)|ψi

⊗ |ei

ThusMg=−isin(^φ₂⁰N)andMe =cos(^φ₂⁰N).

Quantum Monte-Carlo simulations with MATLAB: QNDphoton.m

4M. Brune, . . . : Manipulation of photons in a cavity by dispersive atom-field coupling: quantum non-demolition measurements and generation of "Schrödinger cat"

states . Physical Review A, 45:5193-5214, 1992.

12 / 43

(13)

Outline

13 / 43

(14)

An idea due to Bennet and Brassard in 1984 (BB84)

GAP Optique 17

Geneva University

Alice's Bit Sequence

0 1 0 - 0 1 1 1 1 - 1 0 - 1 - - 0 1 - - 1 - 1 0 Bob's Bases

Bob's Results Key Alice

Bob

Polarizers Horizontal - Vertical Diagonal (-45 , +45 )° °

H/V Basis

45 Basis°

BB84 protocol

14 / 43

(15)

BB84

A first quantum sequence via a quantum communication channel:

1. Alice sends to Bob a large numberNof linearly polarized photons (i.e. qubits

|ψi=a0|0i+a1|1i) along 4 possible directions:

I horizontal (|0i) or vertical (|1i).

I +π/4 (^|0i+|1i^√

2 ) or−π/4 (^|0i−|1i^√

2 ).

2. For each photon received from Alice, Bob chooses a measurement

I H/V:Z=|0i h0| − |1i h1|

I ±π/4:X =|1i h0|+|0i h1|=_|0i+|1i

√ 2

h0|+h1|√ 2

−_|0i−|1i

√ 2

h0|−h1|√ 2

A second classical sequence via a public communication channel:

1. For each photon, Alice and Bob exchange the type of chosen polarizationZ or X (but not its value).

2. For 50% of the photons sharing the same polarization (aroundN/4), Alice and Bob exchange their values (H/V or±π/4).

3. For 50% of the photons with same polarization (aroundN/4), Alice and Bob keep secret their values

If the exchanged values (H/V or±π/4) coincide, Alice and Bob are convinced that the quantum communication was not spied by the bad Oscar. The remaining values (around N/4 and kept secret) will then form a coding key exploited by Alice and Bob in a classical cryptographic protocol.

Security: Oscar cannot clone the photon emitted by Alice.

15 / 43

(16)

Impossibility of quantum cloning (Wootters and Zurek 1982)

Assume that exists a quantum machine copying the original qubit onto a second clone qubit. The initial wave function of the composite system (original qubit, clone qubit, quantum machine) reads

|Ξi_t=0=|ψi ⊗ |bi ⊗ |fbi.

where|ψi ∈C² is the original state,|bithe initial state of the clone (b for blank) and|fbithe initial state of the cloning machine.

The cloning process is associated to a unitary transformationUT independent of|Ξi_t=0 and satisfying

∀ |ψi, |ψi ⊗ |ψi ⊗ f|ψi

=UT |ψi ⊗ |bi ⊗ |fbi . In particular

|0i ⊗ |0i ⊗ f|0i

=UT(|0i ⊗ |bi ⊗ |fbi) _|0i+|1i

√ 2

⊗_|0i+|1i

√ 2

⊗

f|0i+|1i√ 2

=UT

_|0i+|1i

√ 2

⊗ |bi ⊗ |fbi

Impossible with|Ξi=|0i ⊗ |bi ⊗ |fbiand|Λi=_|0i+|1i

√ 2

⊗ |bi ⊗ |fbi

√1 2 =

hΞ|Λi

> ¹₂ ≥

hΞ|U_T^†UT|Λi sinceUT preserves Hermitian product:

16 / 43

(17)

Outline

Shor’s factorization algorithm based on quantum Fourier transform Quantum error correction (QEC)

Classical error correction QEC in discrete-time

17 / 43

(18)

Factoring algorithm and its reduction to order finding (Shor 1994)

•Input: composite odd numbern.

•Output: a non trivial factoraofnin O (logn)²(log logn)(log log logn)

universal classical/quantum operations.

•Algorithm:

1. Check whethern=a^b witha,b>1 (polynomial classical algorithm); possible return ofa and stop.

2. Otherwise,choose randomlyx∈ {2, . . . ,n−1}. If a=gcd(x,n)>1 (Euclidian division), returna and stop.

3. Otherwisedetermine with a quantum computer the order r of x modulo n(the smallestr >1 such thatx^r =1 mod(n))⁵

I Ifr even and 1<gcd(x^r/2±1,n)<n, then return a=gcd(x^r/2±1,n)and stop.

I Otherwise (probability≤η <1 independent of n) goto step 2.

5Shor’s algorithm is detailed in Chapter 5 of M.A. Nielsen, I.L. Chuang:

Quantum Computation and Quantum Information. Cambridge University Press, 2000.

18 / 43

(19)

A quantum gate appearing in Shor’s order-finding algorithm.

•The canonical`-qubit basis (basis ofC²

` ≡(C²)^⊗^`) is labelled by {0, . . .2^`−1} 3j≡(j₁, . . . ,j_`)∈ {0,1}^` with

|ji=|j₁j₂. . .j_`i=|j₁i ⊗ |j₂i ⊗. . .⊗ |j_`i andj=P`

s=1j_s2^`−s.

•To the data 1<x<n<2^` with gcd(x,n) =1 is associated U a unitary transformationon`-qubits (permutationbetween vectors|ji)

ify≤n−1, U|yi=|xy mod(n)i, otherwiseU|yi=|yi.

•Forr the order ofxmod(n) and anys∈ {0, . . . ,r−1}the`-qubit state

|usi= ^√¹_r

r−1

X

k=0

e^−2iπ^r ^sk

x^k mod(n)

satisfiesU|usi=e^−2iπ^r ^s |usi

and ^√¹_rPr−1

s=0|u_si=|1i.

•Modular exponentiation algorithm to computeU withO(`³)1-qubit gates⁶andCNOT2-qubit gates⁷ (non trivial quantum algorithm...)

6Unitarye^ıθe^−ıαZ/2e^−ıβX/2e^−ıγZ/2with(θ, α, β, γ)∈[0,2π].

7CNOT|y1y2i=|y1z2iwhere{0,1} 3z2=y1+y2 mod(2).

19 / 43

(20)

The quantum Fourier transform

•Computations of the usual discrete Fourier transform C²

` 3(x0, . . . ,x₂`−1)7→(y0, . . . ,y₂`−1)∈C²

`

yj=₂_`/2¹

2^`−1

X

j=0

e

2iπjk

2` xk; xk= ₂_`/2¹

2^`−1

X

j=0

e

−2iπjk 2` yj

requiresO(`2^`)additions and multiplications (FFT).

•It is also a unitary transformation ofC²

` ≡(C²)^⊗^`, the quantum Fourier transform (QFT)

|j1i. . .|j`i=|ji 7→

P2^`−1

k=0 e^2iπ²^`^jk |ki 2^`/2 with the binary decompositionj=P`

s=1js2^`−s.

•The identity underlying thequantum circuit implementing the QFT with O(`²)1-qubit gates and 2-qubit gates:

P2^`−1

k=0 e^2iπ²^`^jk|ki

2^`/2 = |0i+e^2iπ^0.j^`|1i

|0i+e^2iπ^0.j^`−1^j^`|1i

. . . |0i+e^2iπ^0.j¹^...j^`|1i 2^`/2

with binary fraction notations 0.jsjs+1jm=js/2+js+1/4+. . .+jm/2^m−s+1.

20 / 43

(21)

Efficient Circuit for the quantum Fourier transform

With Hadamard gate,H =_|0i+|1i

√ 2

h0|+_|0i−|1i

√ 2

h1|, and Controlled-Rk gate (2-qubit) where Rk =|0i h0|+e^2iπ/2^k|1i h1|, the circuit

followed by a simple swap circuit reversing the order of the`qubits, one gets the QFT:

|j1. . .j`i 7→ |0i+e^2iπ^0.j^`|1i

|0i+e^2iπ^0.j^`−1^j^`|1i

. . . |0i+e^2iπ^0.j¹^...j^`|1i 2^`/2

21 / 43

(22)

Outline

22 / 43

(23)

The simplest classical error correction code

•Single bit error model: the bitb∈ {0,1} flips with probabilityp<1/2 during∆t (for usual DRAM:p/∆t ≤10⁻¹⁴ s⁻¹).

•Multi-bit error model: each bitb_k ∈ {0,1} flips with probability p<1/2 during∆t;no correlation between the bit flips.

•Useredundancyto construct with several physical bitsbk of flip probabilityp, a logical bitbL with a flip probabilitypL<p.

•The simplest solution, the3-bit code(sampling time∆t):

t=0: bL= [bbb]withb∈ {0,1}

t = ∆t: measure the three physical bits ofbL= [b1b2b3] (instantaneous) :

1. if all 3 bits coincide, nothing to do.

2. if one bit differs from the two other ones, flip this bit (instantaneous);

•Since the flip probability laws of the physical bits are independent, the probability that the logical bitbL (protected with the above error correction code) flips during∆t isp_L =3p²−2p³<p sincep<1/2.

23 / 43

(24)

Outline

24 / 43

(25)

The 3-qubit bit flip code

•Local bit-flip errors: each physical qubit|ψi=α|0i+β|1ibecomes X|ψi=α|1i+β|0i⁸with probabilityp<1/2 during∆t.

(for actual super-conducting qubitp/∆t>10³s⁻¹).

•t=0: |ψ_Li=α|0_Li+β|1_Li ∈C⁸with|0_Li=|000iand|1_Li=|111i.

•t= ∆t: |ψ_Libecomes with

1 flip:







α|100i+β|011i α|010i+β|101i α|001i+β|110i

;2 flips:







α|110i+β|001i α|101i+β|010i α|011i+β|100i

;3 flips:α|111i+β|000i.

•Key fact: 4 orthogonal planesPc=span(|000i,|111i),P1=span(|100i,|011i), P2=span(|010i,|101i)andP3=span(|001i,|110i).

•Error syndromes: 3 commuting observablesS1=I⊗Z⊗Z,S2=Z⊗I⊗Z and S3=Z⊗Z⊗I with spectrum{−1,+1}and outcomes(s1,s2,s3)∈ {−1,+1}.

-1-s1=s2=s3:Pc 3 |ψ_Li=

α|000i+β|111i 0 flip

β|000i+α|111i 3 flips ; no correction -2-s16=s2=s3:P₁3 |ψ_Li=

β|100i+α|011i 2 flips ;(X⊗I⊗I)|ψ_Li ∈P_c. -3-s26=s3=s1:P23 |ψLi=

β|010i+α|101i 2 flips ;(I⊗X⊗I)|ψLi ∈Pc. -4-s36=s1=s2:P33 |ψ_Li=

β|001i+α|110i 2 flips ;(I⊗I⊗X)|ψ_Li ∈Pc.

8X=|1i h0|+|0i h1|andZ=|0i h0| − |1i h1|.

25 / 43

(26)

The 3-qubit phase flip code

•Local phase-flip error: each physical qubit|ψi=α|0i+β|1ibecomes Z|ψi=α|0i −β|0i⁹with probabilityp<1/2 during∆t.

•SinceX =HZHandZ=HXH(H²=I), use the3-qubit bit flip code in the frame defined byH:

|0i 7→ |0i+|1i

√

2 ,|+i, |1i 7→|0i − |1i

√

2 ,|−i, X7→HX H=Z=|+ih+|+|−ih−|.

•t= +:|ψ_Li=α|+_Li+β|−_Liwith|+_Li=|+ + +iand|−_Li=|− − −i.

•t= ∆t:|ψ_Libecomes with

1 flip:







α|−+ +i+β|+− −i α|+−+i+β|−+−i α|+ +−i+β|− −+i

;2 flips:







α|− −+i+β|+ +−i α|−+−i+β|+−+i α|+− −i+β|−+ +i

;3 flips:α|− − −i+β|+ + +i.

•Key fact:4 orthogonal planesP_c=span(|+ + +i,|− − −i),P₁=span(|−+ +i,|+− −i, P₂=span(|+−+i,|−+−i)andP₃=span(|+ +−i,|− −+i).

•Error syndromes: 3 commuting observablesS1=I⊗X⊗X,S2=X⊗I⊗XandS3=X⊗X⊗I with spectrum{−1,+1}and outcomes(s₁,s₂,s₃)∈ {−1,+1}.

-1-s1=s2=s3:P_c3 |ψ_Li=

α|+ + +i+β|− − −i0 flip

β|+ + +i+α|− − −i3 flips ; no correction -2-s16=s2=s3:P13 |ψ_Li=

α|−+ +i+β|+− −i 1 flip

β|−+ +i+α|+− −i 2 flips ;(Z⊗I⊗I)|ψ_Li ∈P_c. -3-s26=s3=s1:P23 |ψ_Li=

α|+−+i+β|−+−i 1 flip

β|+−+i+α|−+−i 2 flips ;(I⊗Z⊗I)|ψ_Li ∈P_c. -4-s36=s1=s2:P33 |ψ_Li=

α|+ +−i+β|− −+i1 flip

β|+ +−i+α|− −+i2 flips ;(I⊗I⊗Z)|ψ_Li ∈P_c. 9X=|1i h0|+|0i h1|,Z=|0i h0| − |1i h1|andH=_|0i+|1i

√2

h0|+_|0i−|1i

√2

h1|.

26 / 43

(27)

The Shor code (1995): combination of bit-flip and phase flip codes

•Take the phase flip code|+ + +iand|− − −i. Replace each|+i(resp.|−i) by

|000i+|111i

√

2 (resp.|000i−|111i

√

2 ). New logical qubit |ψ_Li=α|0_Li+β|1_Li ∈C²

9:

|0_Li= |000i+|111i

|000i+|111i

2√

2 ,|1_Li= |000i−|111i

|000i−|111i

2√ 2

•Local errors: each of the 9 physical qubits can have a bit-flipX, a phase flipZ or a bit flip followed by a phase flipZ X=iY ¹⁰with probabilitypduring∆t.

•Denote byX_k (resp.Y_k andZ_k), the local operatorX (resp.Y andZ) acting on physical qubit nok∈ {1, . . . ,9}. Denote byPc =span(|0_Li,|1_Li)the code space.

One get a family of the 1+3×9=28 orthogonal planes:

Pc,

X_kPc

k=1,...,9,

Y_kPc

k=1,...,9,

Z_kPc

k=1,...,9.

•One can always constructerror syndromesto obtain, when there is only one error among the 9 qubits during∆t,the numberkof the qubit and the error type it has undergone(X,Y orZ). These 28 planes are then eigen-planes by the syndromes.

•If the physical qubitk is subject toany kind of local errorsassociated to arbitrary operatorM=gI+aX+bY+cZ (g,a,b,c∈C),|ψ_Li 7→ q ^M^k^|ψ^Lⁱ

hψ_L|M^†

kM_k|ψ_Li, the syndrome measurements will project the corrupted logical qubit on one of the 4 planes Pc,X_kPc,Y_kPc orZ_kPc.It is then simple by using eitherI,X_k,Y_korZ_k, to recover up to a global phase the original logical qubit|ψ_Li.

10X=|1i h0|+|0i h1|,Z=|0i h0| − |1i h1|andY=i|1i |0i −i|0i |1i.

27 / 43

(28)

Many open issues connected to QEC

•For a logical qubit relying onnphysical qubits, the dimension of the Hilbert has to be larger than 2(1+3n)to recover an arbitrary single-qubit error: 2ⁿ≥2(1+3n)imposingn≥5.

•Efficient constructions of quantum error-correcting codes: stabilizer codes, surface codes where the physical qubits are located on a 2D-lattice, topological codes, . . .

•Fault tolerant computations: computing on encoded quantum states;

fault-tolerant operations to avoid propagations of errors during encoding, gates and measurement; concatenation and threshold theorem, . . .

•Error rates for a DRAM bit≤10⁻¹⁴ s⁻¹and for a superconducting qubit≥10³ s⁻¹: high order error-correcting codes; important overhead (around 1000 physical qubits to encode a logical one¹¹); scalability issues;

. . .

11A.G. Fowler, M. Mariantoni, J.M. Martinis, A.N. Cleland: Surface codes:

Towards practical large-scale quantum computation. Phys. Rev.

A,86(3):032324, 2012.

28 / 43

(29)

Outline

29 / 43

(30)

Continuous-time QEC and feedback

•Quantum error correction is afeedback scheme: at each sampling time a measurement is performed and a correction depending only on the measurement outcome is applied.

•From a control engineering view point, QEC is based on astatic output feedbackscheme (feedback without memory) (called alsoMarkovian feedback).

•In usual discrete-time setting, measurement (sensor) and correction (actuator) processes are assumed instantaneous.

•Natural question: how to take into account thefinite band-width of the measurement and correction processes.

•Interest of continuous-time formulations for QEC:

1. measurement and correction are faster than the error rates but not infinitely faster;

2. qubit errors can occur during the measurement and the correction processes (fault-tolerance issues).

|ψireplaced byρ(density operator) obeying to a stochastic master equation (SME).

30 / 43

(31)

Flashback to the LKB photon box

C

B

D R

₁

R

₂

B R

₂

|Ψi_R

2=USM|Ψi_B =USM |ψi ⊗ |gi

= Mg|ψi

⊗ |gi+ Me|ψi

⊗ |ei

withM^†gMg+M^†eMe =I.

•Quantum trajectories(Markov chain, stochastic dynamics):

|ψk+1i=











Mg rD

ψ_k|M^†_gM_g|ψ_kE|ψki, yk=g with probability

ψk|M^†gMg|ψk

;

M_e r

D

ψk|M^†_eMe|ψk

;

with state|ψkiand measurement outcomeyk∈ {g,e}at time-stepk:

31 / 43

(32)

Continuous-time quantum trajectories (diffusive case)

¹²

•The measurement outcomeyk at discrete-time stepk, is replaced by the small among of measurement signaldyt∈Robtained during an infinitesimal time interval[t,t+dt].

•Themeasurement operatorMy_k becomesMdy_t close to identity:

Mdyt =I+

−ⁱ

~H−¹₂ L^†L

dt+dytL

where operatorL(not necessarily Hermitian) describes the measurement process andH is the Hamiltonian corresponding to the coherent evolution.

•The measurement backaction reads

|ψi_t+dt =r ^M^dyt^|ψi^t hψ|_tM^†

dytM_dyt|ψi_t

•Probability density ofdy∈Rknowing|ψi_t: ^e⁻

dy2

√ 2dt

2πdt hψ|_tM^†_dyMdy|ψi_t. Coincides up to orderO(dt^3/2)terms tody=hψ|_t(L+L^†)|ψi_t dt+dW wheredW is a Wiener process (Gaussian of zero mean and variancedt).

Quantum Monte-Carlo simulations with MATLAB: QNDqubit.m(L=σz,H =0)

12For a mathematical exposure: A. Barchielli, M. Gregoratti: Quantum Trajectories and Measurements in Continuous Time: the Diffusive Case. Springer Verlag,2009.

32 / 43

(33)

Why density operators ρ instead of wave functions |ψi

Consider once again the LKB photon-box:

|ψk+1i=











M_g rD

ψ_k|M^†_gM_g|ψ_kE|ψki, yk=g with probability

ψk|M^†gMg|ψk

;

M_e rD

ψk|M^†eMe|ψk

;

E

^|ψ¹^{i hψ}¹^| ^|ψ⁰ⁱ⁼^M^g^|ψ⁰^{i hψ}⁰^|^M^†^g⁺^M^e^|ψ⁰^{i hψ}⁰^|^M^†^e^.

I SetK(ρ),MgρM^†_g+MeρM^†_e for any operatorρ.

I ρ_k expectation of|ψki hψk|knowing|ψ0i:

ρ_k+1=K(ρ_k)andρ₀=|ψ0i hψ0|.

Linear mapK: trace preserving Kraus map (quantum channel).

Density operatorsρ: convex space of Hermitian non-negative operators of trace one.

13|ψi hψ|: orthogonal projector on line spanned by unitary vector|ψi.

33 / 43

(34)

Quantum trajectories for the density operator

ρ Detector efficiencyη∈[0,1]. Outputy∈ {g,e,∅}:

ρ_k₊₁=











Kg(ρ_k)

Tr(Kg(ρ_k)),yk =g with probability Tr(Kg(ρ_k));

Ke(ρ_k)

Tr(Ke(ρ_k)),yk =e with probability Tr(Ke(ρ_k));

K_∅(ρ_k)

Tr(K_∅(ρ_k)),yk =∅with probability Tr(K_∅(ρ_k));

with Kraus maps

Kg(ρ) =ηMgρM^†_g, Ke(ρ) =ηMeρM^†_e K_∅(ρ) = (1−η)

MgρM^†_g+MeρM^†_e .

We still have:

E

^ρ^k⁺¹ ^ρ^k^,^K^(ρ^k^{) =}^M^g^ρ^k^M^†^g⁺^M^e^ρ^k^M^†^e ⁼^X

y

Ky(ρ_k).

34 / 43

(35)

Discrete-time quantum trajectories for open quantum systems

Four features:

1. Bayes law: P(µ/y) =P(y/µ)P(µ)/ P

µ⁰P(y/µ⁰)P(µ⁰) , 2. Schrödinger equationsdefining unitary transformations.

3. Partial collapse of the wave packet: irreversibility and dissipation are induced by the measurement of observables withdegeneratespectra.

4. Tensor product for the description of composite systems.

VDiscrete-time Q. traj. : Markov processesof state ρ, (density op.):

ρ_k+1=

Pm

µ=1η_y,µMµρ_kM^†_µ

Tr(^P^mµ=1ηy,µMµρ_kM^†µ), with proba. Py(ρ_k) =Pm

µ=1η_y,µTr

Mµρ_kM^†_µ associated toKraus maps¹⁴(ensemble average, quantum channel)

E

^(ρ^k⁺¹^|^ρ^k^{) =}^K^(ρ^k^{) =}^X

µ

Mµρ_kM^†_µ with X

µ

M^†_µMµ=I

and left stochastic matrices (imperfections, decoherences)(ηy,µ).

14M.A. Nielsen, I.L. Chuang: Quantum Computation and Quantum Information. Cambridge University Press, 2000.

35 / 43

(36)

Continuous/discrete-time Stochastic Master Equation (SME)

Discrete-time models: Markov chains

ρ_k+1=

Pm

µ=1η_y,µMµρ_kM^†_µ

Tr(^P^mµ=1ηy,µMµρ_kM^†µ), with proba. Py(ρ_k) =Pm

µ=1η_y,µTr

Mµρ_kM^†_µ with ensemble averages corresponding toKraus linear maps

E

^(ρ^k⁺¹^|^ρ^k^{) =}^K^(ρ^k^{) =}^X

µ

Mµρ_kM^†_µ with X

µ

M^†_µMµ=I

Continuous-time models: stochastic differential systems¹⁵ dρt =

−_~ⁱ[H, ρt] +X

ν

LνρtL^†_ν−¹₂(L^†_νLνρt+ρtL^†_νLν) dt

+X

ν

√η_ν

Lνρ_t+ρ_tL^†_ν− Tr

(Lν+L^†_ν)ρ_t ρ_t

dW_ν,t driven byWiener processesdWν,t, with measurements yν,t,

dyν,t=√ην Tr

(Lν+L^†_ν)ρt

dt+dWν,t, detection efficiencies η_ν ∈[0,1]andLindblad-Kossakowski master equations (ην≡0):

d

dtρ=−_~ⁱ[H, ρ] +X

ν

LνρL^†_ν−¹₂(L^†_νLνρ+ρL^†_νLν)

15A. Barchielli, M. Gregoratti: Quantum Trajectories and Measurements in Continuous Time: the Diffusive Case. Springer Verlag, 2009. _{36 / 43}

(37)

Positivity-preserving formulation of diffusive SME

¹⁶

With a single imperfect measurementdyt=√

ηTr (L+L^†)ρt

dt+dWt and detection efficiencyη∈[0,1], the quantum stateρt is usually mixed and obeys to

dρt =

−ⁱ

~[H, ρt] +LρtL^†−¹

2(L^†Lρt+ρtL^†L) dt +√

η

Lρt+ρtL^†− Tr

(L+L^†)ρt

ρt

dWt

driven by the Wiener processdWt

WithIt¯o rules, it can be written as the following "discrete-time" Markov model

ρt+dt = MdytρtM^†_dy

t+ (1−η)LρtL^†dt Tr

Mdy_tρtM^†_dy

t+ (1−η)LρtL^†dt withMdy_t =I+ −ⁱ

~H−¹₂ L^†L dt+√

ηdytL.

ρ0density operator7→for allt>0,ρt density operator

16Such SME precisely describe cutting-edge experiments with superconducting qubits under homodyne and heterodyne continuous-time measurements. See, e.g., the group of Benjamin Huard at ENS-Lyon:http://www.physinfo.fr/index.html.

37 / 43

(38)

Quantum error correction in the diffusive case

QUANTUM WORLD decoherence quantum state

Hilbert space (dissipation) CLASSICAL WORLD

classical input u classical

reference

classical controller

classical output dy

•How to achieve QEC with the above measurement-based feedback scheme where the controller admits a memory (a dynamical system, possibly stochastic).

•In¹⁷QEC is implicitly formulated as feedbackstabilization of the code space Pc underquantum non demolition measurement. Numerical closed-loop simulations indicate promising convergence properties but a precise mathematical convergence analysis is missing. Many open issues such as precise estimates of convergence rates in closed-loop¹⁸

17C. Ahn, A. C. Doherty, and A. J. Landahl. Continuous quantum error correction via quantum feedback control. Phys. Rev. A, 65:042301, March 2002.

18Preliminary results in, e.g., G. Cardona, A. Sarlette, and PR. Exponential stochastic stabilization of a two-level quantum system via strict Lyapunov control.

arXiv:1803.07542.

38 / 43

(39)

Outline

39 / 43

(40)

Coherent feedback (with measurement-based feedback)

•Quantum analogue of Watt speed governor where adissipative mechanical system controls another mechanical system¹⁹

•Coherent feedback where the controller is another quantum systems²⁰:

QUANTUM WORLD CLASSICAL WORLD Hilbert space

classical controller

quantum controller Hilbert space Hilbert space

system S

dissipation

errors

classical input

classical output

quantum measurement classical

reference

quantum interaction

dy

19J.C. Maxwell: On governors. Proc. of the Royal Society, No.100, 1868.

20Optical pumping (Kastler1950), coherent population trapping (Arimondo 1996), dissipation engineering, autonomous feedback: (Zoller, Cirac, Wolf, Verstraete, Devoret, Siddiqi, Lloyd, Viola, Ticozzi, Mirrahimi, Sarlette, ...)

40 / 43