Thesis
Reference
Practical and fundamental issues on quantum correlations
BRANCIARD, Cyril
Abstract
The role that quantum correlations play in Quantum Information Science and the prospects of new developments and newe applications encourage physicists to search for a deeper understanding of these correlations, and of their non-locality. This thesis follows this line of research. After illustrating their practical applications in the field of Quantum Key Distribution, we present more fundamental studies. We thus analyze two different alternative models for non-local correlations : Leggett's model, and a model that attempt to explain the correlations with some hypothetical superluminal "spooky action at a distance". We also tackle the problem of quantifying the non-locality of quantum correlations, with two different approaches.
Finally, we address the intriguing question, wheter the quantum world could somehow be brought closer to our direct perception, and if quantum correlations could be revealed with the naked eye.
BRANCIARD, Cyril. Practical and fundamental issues on quantum correlations. Thèse de doctorat : Univ. Genève, 2009, no. Sc. 4115
URN : urn:nbn:ch:unige-40413
DOI : 10.13097/archive-ouverte/unige:4041
Available at:
http://archive-ouverte.unige.ch/unige:4041
Disclaimer: layout of this document may differ from the published version.
Universit´e de Gen`eve Facult´e des Sciences
Groupe de Physique Appliqu´ee Professeur N. Gisin
Practical and Fundamental issues on
Quantum Correlations
Th` ese
pr´esent´ee `a la Facult´e des sciences de l’Universit´e de Gen`eve pour obtenir le grade de Docteur `es sciences, mention physique
par
Cyril BRANCIARD
de France
Th`ese N°4115
Gen`eve
Atelier d’impression ReproMail 2009
If at first the idea is not absurd, then there is no hope for it.
Albert Einstein
Abstract
Quantum correlations exhibit what is certainly one of the most intriguing and fascinating features of quantum theory: non-locality. Two entangled particles cannot be seen as two separate quantum systems, with individual properties attached to each of them, but need to be described as a single system.
In the last 25 years, it has been realized that quantum correlations could have very interesting applications, in particular for communications and information pro- cessing. This has lead to the emergence of a new research field, that of quantum information science. The prospects of new developments and of new applications encourage physicists to search for a deeper understanding of these correlations, and of their non-locality.
This thesis is devoted to such a study. We first illustrate the role that quantum correlations play in Quantum Key Distribution (QKD) by analysing some quantum cryptographic protocols: standard qubit-based QKD protocols, as well as a new kind of distributed-phase-reference protocol that is quite promising for rapid and long-distance QKD.
Motivated by these practical applications, we then move on to more fundamental studies. We first present the analysis of two different models of non-local corre- lations: Leggett’s model proposes an alternative description for such correlations, which is proven to be incompatible with quantum theory; the second model supposes that the correlations are due to some hypothetical superluminal spooky action at a distance, and we present an experiment that allows one to put a stringent bound on the speed of such a spooky action.
As non-locality is the key feature of quantum correlations, the problem of quanti- fying it naturally arises. In this prospect, we describe the Elitzur-Popescu-Rohrlich (EPR2) approach, and derive a new lower bound on the local content of two-qubit non-maximally entangled pure states; for a whole family of such states, this bound coincides with the previously known upper-bound. We also consider n-partite cor- relations, and propose a new approach to quantify their multi-partite non-locality, by comparing them to correlations obtained with classical communication models.
We finally consider the intriguing question, whether the quantum world could somehow be brought closer to our direct perception. It appears indeed realistic to perform quantum optics experiment with human-eye detectors, and thus to reveal entanglement with the naked eye!
R´ esum´ e
Les corr´elations quantiques pr´esentent une caract´eristique qui est certainement un des aspects les plus fascinants et intrigants de la th´eorie quantique : la non- localit´e. Deux particules intriqu´ees ne peuvent en effet ˆetre consid´er´ees comme deux syst`emes quantiques distincts, dot´es de propri´et´es individuelles, mais doivent ˆetre d´ecrites comme un seul et mˆeme syst`eme, formant un tout.
Au cours des 25 derni`eres ann´ees, il a ´et´e r´ealis´e que les corr´elations quan- tiques pouvaient avoir des applications particuli`erement int´eressantes, notamment en mati`ere de communications et de traitement de l’information. Un nouveau do- maine de recherche a ´emerg´e, celui de l’information quantique. La perspective de nouveaux d´eveloppements et de nouvelles applications encourage les physiciens `a
´etudier ces corr´elations afin de mieux les comprendre, ainsi que la non-localit´e dont elles font preuve.
Cette th`ese est consacr´ee `a une telle ´etude. Nous illustrons tout d’abord le rˆole des corr´elations quantiques dans le domaine de la Distribution Quantique de Cl´e (QKD : Quantum Key Distribution), au travers de l’analyse de certains protocoles de QKD : des protocoles standards bas´es sur l’´echange de qubits, ainsi qu’un nouveau type de protocole `a r´ef´erence de phase distribu´ee, qui semble prometteur pour faire de la QKD rapide et `a longue distance.
Motiv´es par ces applications pratiques, nous nous tournons ensuite vers des probl´ematiques de nature plus fondamentale. Nous pr´esentons tout d’abord l’analyse de deux types de mod`eles de corr´elations non-locales : le mod`ele de Leggett d’une part, qui propose une description alternative pour de telles corr´elations, et que l’on montre ˆetre incompatible avec la th´eorie quantique ; un second mod`ele d’autre part, qui suppose que les corr´elations sont dues `a une action fantˆome `a distance, et pour lequel nous pr´esentons une exp´erience qui a permis de borner la vitesse de cette hypoth´etique action fantˆome.
La non-localit´e ´etant la caract´eristique essentielle des corr´elations quantiques, nous nous posons naturellement la question de comment la quantifier. Dans ce but, nous d´ecrivons l’approche d’Elitzur-Popescu-Rohrlich (EPR2), et d´eterminons une nouvelle borne inf´erieure pour le contenu local des ´etats purs, non maximalement intriqu´es, de deux qubits ; pour toute une famille d’´etats, cette borne co¨ıncide avec la borne sup´erieure que l’on connaissait. Nous consid´erons ensuite des corr´elations entre n syst`emes, pour lesquelles nous proposons une nouvelle approche permettant de quantifier leur non-localit´e multipartite, en les comparant aux corr´elations que l’on peut obtenir avec des mod`eles `a base de communication classique.
Nous posons enfin la question intrigante de savoir si le monde quantique peut d’une certaine mani`ere ˆetre rendu plus accessible `a notre perception directe. Il appa-
rait en effet r´ealiste d’imaginer des exp´eriences d’optique quantique o`u l’œil humain serait utilis´e comme d´etecteur de photons. L’intrication pourrait ainsi ˆetre observ´ee
`a l’œil nu !
Contents /
Table des mati` eres
Abstract i
R´esum´e ii
I English version 1
Introduction 3
1 Quantum correlations in Quantum Key Distribution 6
1.1 Security of the BB84 and SARG protocols . . . 6
1.1.1 Single-photon implementations . . . 7
1.1.2 Upper bounds for the security in practical implementations . . 7
1.2 Security of QKD using two-way classical communication or weak co- herent pulses . . . 8
1.2.1 QKD protocols with two-way post-processing . . . 9
1.2.2 QKD protocols using weak coherent pulses . . . 9
1.3 Conclusion . . . 10
2 Upper bounds for the security of the COW protocol 11 2.1 The Coherent-One-Way protocol . . . 11
2.2 Studies of a few specific attacks on the COW protocol . . . 12
2.2.1 Collective Beam-Splitting Attack . . . 12
2.2.2 Zero-error attacks based on Unambiguous State Discrimination 13 2.2.3 Non-zero-error attacks on single or pairs of pulses . . . 14
2.3 Outlook . . . 15
3 Testing Leggett’s model for non-local correlations 17 3.1 Quantum correlations from “simpler” ones . . . 17
3.1.1 Decomposing non-local correlations . . . 18
3.1.2 Bell’s locality . . . 18
3.1.3 Leggett’s model . . . 18
3.2 Violation of Leggett’s model by Quantum Mechanics . . . 19
3.2.1 General inequality for non-signaling models . . . 20
3.2.2 Derivation of a simple Leggett-type inequality . . . 20
3.2.3 Experimental falsification of Leggett’s model . . . 21
3.3 On the tolerable amount of individual properties . . . 22
3.3.1 A straightforward generalization of Leggett’s model . . . 23
3.3.2 Any model`a la Leggett must have vanishing marginals . . . . 23
3.4 Conclusion . . . 23
4 Testing the speed of spooky action at a distance 24 4.1 Principle of the experiment . . . 24
4.2 Experimental results . . . 27
4.3 Conclusion . . . 28
5 On the EPR2 approach to quantum non-locality 30 5.1 The EPR2 approach for two-qubit pure states . . . 31
5.1.1 Correlations of two-qubit pure states . . . 31
5.1.2 Previously known results and conjecture . . . 32
5.2 Reformulation of the problem to prove the conjecture . . . 33
5.3 Proposal for a new EPR2 decomposition . . . 33
5.4 Prospects . . . 35
6 Quantifying multipartite non-locality 40 6.1 Definitions . . . 41
6.2 Quantifying multipartite non-locality through communication models 41 6.3 Multipartite non-locality of quantum states. . . 43
6.4 Conclusion . . . 44
7 Can one see entanglement ? 45 7.1 Threshold detectors can in principle detect entanglement . . . 45
7.2 Human eye detectors can detect and distinguish clones obtained via stimulated emission . . . 46
7.2.1 Distinguishing the amplified single-photon qubits . . . 47
7.2.2 Bell-type experiment in the micro-macro scenario . . . 48
7.3 Prospects . . . 50
Outlook 51
II Version fran¸caise 53
Introduction 55
8 Les correlations quantiques au cœur de la QKD 58 9 Des mod`eles alternatifs de corr´elations non-locales 60
10 Quantifier la non-localit´e 62
11 Voir l’intrication 64
Perspectives 66
Bibliography / Bibliographie 67
Publication list / Liste de publications 73
Acknowledgements / Remerciements 75
III Published articles / Articles publi´ es 77
Part I
English version
Introduction
The discovery of quantum mechanics is a very interesting story. Passionate debates between the greatest physicists of the early 20th century contributed to construct a beautiful theory, with an extraordinary predictive power. However, the theory that emerged contained so counter-intuitive features, that it could not satisfy everyone.
Spooky action at a distance?
In their renowned 1935 paper [1], Einstein, Podolsky and Rosen (EPR) showed in- deed that quantum mechanics predicted very strong correlations to exist between distinct and separated parts of a physical system: by measuring one part of the system, one could instantly attribute definite properties to the distant part; proper- ties which, according to quantum theory, did not exist a priori. These correlations, due to what Schr¨odinger would soon after call entanglement [2] between the two sub-systems, thus seemed to imply some spooky action at a distance; the father of general relativity and his co-authors considered this physically unacceptable. They concluded that, if quantum mechanics were to respect locality and separability, then it was necessarilyincomplete.
This question of incompleteness was debated on a purely metaphysical level, though most physicists at the time were happy enough with Bohr’s answer and with the Copenhagen interpretation of quantum mechanics, which essentially ignored the problem. There were more important problems to tackle back then, and only a few people shared Einstein’s philosophical concerns.
It took 30 years before Bell showed, with his famous theorem [3], an incom- patibility between the quantum predictions and the predictions of alternative local theories that would somehow complete quantum mechanics. Correlations that can be explained by local hidden variables are bound to satisfy so-calledBell inequalities:
under Bell’s locality assumption, a measurable quantity I cannot exceed the local bound IL: I ≤ IL. Quantum correlations can however violate this inequality, and reach a value IQ > IL. Bell’s extraordinary breakthrough allowed one to turn the metaphysical controversy into experimental metaphysics, as termed by Shimony [4]:
one could then imagine experiments to test quantum mechanics versus local hidden variable theories.
Another 20 years of efforts were necessary before the realization of a sufficiently convincing experiment by Aspect and co-workers [5], whose conclusion was in favor with quantum mechanics: the violation of a Bell inequality had indeed been observed (up to a few minor loopholes), which allowed them to conclude that quantum theory
could not be completed in the sense that Einstein wished.
Quantum correlations as a resource
This could have been the end of the story. The existence of entanglement and non- locality had been demonstrated, but this was up to then no more than a laboratory curiosity.
In the early 1990s however, it was realized that entanglement could actually be of practical use. Ekert rediscovered and shed a new light on quantum cryptography (invented a few years earlier by Bennett and Brassard [6]), when he realized that one could make use of non-locality to distribute a secret key between two distant partners [7]: the security of the key can be ensured by the violation of a Bell in- equality. Entanglement was also shown to allow for quantum teleportation [8], and to bring a great advantage in computational problems [9].
This new perception of entanglement, now seen as a useful resource for commu- nication and information processing, has revived the study of quantum correlations and of non-locality itself, which has now emerged as a new and very dynamic re- search field. Bell’s sentence “correlations cry out for explanation” [10] is even more relevant today!
Outline of this thesis
This thesis follows on in a similar spirit to the scientific developments of the last 25 or so years, described above. We start with studies on quantum cryptography, which highlight the practical applications that quantum correlations can have. This motivates us to try to get a better understanding of quantum correlations, and leads us to tackle more fundamental questions about their nature, about the possible explanations that can be given for their non-locality, and on how to quantify their non-locality. We finally wonder whether one could somehow bring them closer to our direct perception. The goal we are pursuing is to become more familiar with the often counter-intuitive but all the more fascinating features of the quantum world.
The content of this manuscript is organized as follows:
The first two chapters are devoted to the use of quantum correlations in the field of Quantum Key Distribution (QKD). In Chapter 1 we highlight the role of these correlations in standard qubit-based QKD protocols, while in Chapter 2 we describe studies of some attacks on a distributed-phase-reference type of QKD protocol de- veloped in Geneva: the Coherent-One-Way protocol.
Moving on to more fundamental issues, Chapter 3 presents a study of Leggett’s model [11]. This model proposes an alternative structure for non-local correlations, but is shown to be incompatible with quantum predictions. We present new inequal- ities for testing Leggett’s model, derived in a very simple way, by only assuming the non-negativity of probability distributions. The simplest of these inequalities has been experimentally violated. We also show that more general models `a la Leggett must have vanishing marginals in order to reproduce the correlations of the singlet
state.
Chapter 4 challenges another possible explanation for the non-locality of quantum correlations, which could be due to some spooky action at a distancepropagating at finite speed. An experiment is performed, which allows us to derive bounds on the speed of this hypotheticalspooky action, in any reference frame. The bounds we get are orders of magnitude larger than the speed of light.
Chapter 5 investigates the local and non-local contents of bipartite quantum cor- relations using an approach due to Elitzur, Popescu and Rohrlich [12]. We consider correlations stemming from Von Neumann measurements on pure non-maximally entangled two-qubit states; the definite value of their local content is found for a wide range of states.
In Chapter 6 we considern-partite correlations. A method is proposed to quantify the multipartite non-locality of such correlations, by comparing them to correlations obtained with models that allow classical communication between the parties. We apply our method to two families of multipartite quantum states.
Chapter 7 finally addresses the intriguing question, whether entanglement could possibly be “seen”, i.e., detected by the naked human eye. We shall see that the realization of Bell-type experiments with human-eye detectors appears indeed realis- tic, using for instance multi-photon states obtained by cloning single-photon qubits via stimulated emission. This would be a fascinating way to experience quantum phenomena more directly!
Each chapter presents a particular line of research, and gives a summary of some results obtained in each direction. The chapters can be read independently from one another. Most of the results presented in this thesis (except for those of Chapter 5) have been published in the papers listed on page 73, and attached to this dissertation.
The more interested reader is encouraged to refer to these publications for further details.
The reader will be assumed to be familiar with the basics of quantum information theory. If this is not the case, he might find it useful to refer for instance to [13]
for a general introduction to the subjects dealt with in this thesis, or to [14, 15] for more technical information.
Chapter 1
Quantum correlations in Quantum Key Distribution
The general idea of quantum cryptography is to use the laws of quantum physics to ensure the security of cryptographic protocols. In Quantum Key Distribution (QKD) more specifically [16, 17], one distributes quantum correlations between two partners, traditionally called Alice and Bob, from which they will try to extract a secret key (i.e., a secret random string of bits) via classical post-processing1. If the protocol successfully generates a secure key, the key can then be used in any other cryptographic primitive (e.g., for data encryption or authentication).
Inspired by earlier ideas of Wiesner [18], Bennett and Brassard invented in 1984 the first QKD protocol, BB84 [6]. It was proposed as aprepare and measureprotocol:
Alice encodes classical bits into quantum systems (quantum bits, orqubits) that she sends to Bob, who measures them. Ekert rediscovered QKD a few years later when he realized that the non-locality of quantum correlations could allow the distribution of a secret key [7]: he proposed an entanglement-basedprotocol, in which Alice and Bob share an entangled pair of qubits, and whose security was precisely based on the violation of a Bell inequality.
Ekert’s work thus highlighted the role of quantum correlations in QKD, and more specifically of their non-local characteristics. It is now clear that quantum correlations are at the core of QKD. Here we shall illustrate this by presenting studies that we conducted on the security of standard discrete-variable QKD protocols [A,B].
1.1 Security of the BB84 and SARG protocols
In a first study [A], we investigated the security of the SARG protocol [19, 20], and compared it to the well-known BB84 protocol. The two protocols use the same four states for the encoding of the classical bit (more precisely, two complementary bases), but the information is encoded in two different ways : in the SARG protocol, the
1After the quantum correlations are distributed, Alice and Bob both have a “raw key”. Typ- ically, after a sifting step, they perform error correction and privacy amplification to turn their keys into a pair of identical and secret ones.
classical bits are encoded in non-orthogonal states, so that it is more robust against photon-number-splitting attacks [21, 22]. We studied the security of the SARG protocol in two regimes: in single-photon implementations, and in more practical implementations with weak coherent laser pulses.
1.1.1 Single-photon implementations
We first derived a condition on the quantum bit error rate (QBER) for the security of the SARG protocol in a single-photon implementation, against the most general attacks allowed by quantum mechanics (so-called coherent attacks2). For that, we used the results presented in [23, 24]; see section 1.2 below for further details on these results. The SARG protocol was found to be secure against coherent attacks for a QBER smaller than 10.95 %, while the similar bound is 12.4 % for BB84.
In order to derive an upper bound for the tolerable QBER, we considered indi- vidual attacks. We found out that although the quantum states sent by Alice are the same, the optimal individual attack on the BB84 is not optimal on the SARG protocol. We proposed a new attack that performs better, and that gives an upper bound of 14.9 %. For BB84, the optimal individual attack gives an upper bound of 14.6 %.
1.1.2 Upper bounds for the security in practical implemen- tations
In practical implementations, it is usually more convenient for Alice to send weak coherent pulses (attenuated laser pulses) instead of single photons. This is the case that we considered next. We let Alice optimize the mean number of photons µ as a function of the distance, and we allowed the eavesdropper, Eve, to choose among a broad class of incoherent attacks that includes various forms of photon-number- splitting attacks. As we nevertheless restricted the class of attacks, we thus obtained upper bounds on the secure key rate that can be reached. The optimizations on the mean number of photons and on Eve’s attack were done numerically. The results were compared to those obtained for BB84 with the same approach [25].
The SARG protocol was found to perform better than BB84 both in secret key rate and in maximal achievable distance. More precisely, we found that the optimal mean number of photons goes as µopt ∼ 2√
t as a function of the transmission t of the quantum channel, while the much smaller µopt ∼ t holds for BB84 under identical conditions. As a consequence, the secret key rate (proportional to the detection rate µt) decreases ast3/2 instead of the faster t2 decrease of BB84. The limiting distance
2One usually distinguishes betweenindividual,collectiveandcoherentattacks: in an individual attack, the eavesdropper, Eve, acts independently and identically on each quantum system sent by Alice, and she measures her ancillary system before the classical post-processing; in a collective attack, she still attacks each quantum system independently and identically, but she can act coherently on her ancillae at any time of the protocol; in a coherent attack, she can act coherently on all quantum systems at any time. The coherent attacks are the most general ones: they are so general that they cannot be efficiently parametrized. As we shall see, one can often show that considering collective attacks is actually sufficient.
is also increased in SARG with respect to BB84, approximately by 10 km for typical values of the parameters of the detector and of the channel.
Note that in the two cases above, we could show that Alice and Bob can sometimes increase the secret key rate by voluntarily adding some noise to their correlations, before they perform error correction and privacy amplification to their raw keys.
This noisy pre-processing can indeed decrease Eve’s information more than Bob’s information on Alice’s key.
Our analysis above shows that once quantum correlations have been distributed, different ways of encoding and decoding the classical information can lead to different performances in QKD. It is quite interesting to keep this in mind, in order to make the best possible use of the quantum correlations that are available to Alice and Bob.
1.2 Security of QKD using two-way classical com- munication or weak coherent pulses
In [B] we studied the security against coherent attacks of generic QKD protocols that involve two-way classical post-processing, as well as QKD schemes implemented with weak coherent laser pulses instead of single-photon pulses. We could extend the information-theoretic techniques introduced in [23, 24] to these two cases.
Let us first briefly review these techniques. To apply them, we need to consider the entanglement-basedversion of the QKD protocol under study: instead of having Alice sending qubits to Bob in a definite state, one can assume that Alice sends the second qubit of a 2-qubit entangled state. She can then prepare Bob’s system at a distance by applying an encoding operator to the qubit she kept, and then measuring it in the computational basis. We also assume that Alice and Bob symmetrize the protocol by applying a randomly chosen permutation to rearrange the order of their qubit pairs, and, additionally, by applying at random to each of the qubit pairs either the identity or the correlated bit-flip operation σx⊗σx.
This description of the protocol allows one to derive a lower bound for the secret key rater that can be extracted with one-way communication from Alice to Bob, in the limit of infinitely long keys. The formula involves only two-qubit systems, and writes [23]
r ≥ sup
U←X
σABinf∈ΓQ
S(U|E)−H(U|Y), (1.1)
where ΓQis the set of all two-qubit Bell-diagonal states σAB which can result from a collective attack3 by Eve and which are compatible with the parameters estimated by Alice and Bob (in particular, the QBER);Sand Hdenote the von Neumann and the Shannon entropies, respectively; X andY denote the classical outcomes of Alice and Bob’s measurements of σAB in the computational basis, and E is any system
3This proves in particular that coherent attacks are not more powerful than collective attacks.
This can also be proven by invoking the powerful exponential quantum De Finetti theorem [26, 27].
that purifies σAB; finally, the supremum runs over all classical mappings from X to U (such as the above-mentioned noisy pre-processing, for instance).
1.2.1 QKD protocols with two-way post-processing
We could apply the above techniques to the case of QKD protocols where, before the classical post-processing of the raw key, Alice and Bob additionally perform an advantage distillationprocedure [28, 29, 30], which requires two-way communication between Alice and Bob. This sub-protocol consists in Alice publicly announcing to Bob the positions of m bits which have all the same value (without telling which value). Bob checks whether he also has the same values for these positions; if this is the case, they keep the common value of the bits as a new raw-key bit, otherwise they discard all the m bits.
This advantage distillation process can be described quantum mechanically. We could show that analyzing its action on two-qubit Bell-diagonal states was actually sufficient, and we could then apply the bound (1.1) to the states thus obtained. For the 6-state protocol [31, 32] for instance, we showed that a positive secret key rate can be extracted as long as the QBER is lower than 27.6 % (form→ ∞). We thus recovered the previously known threshold, that Chau had obtained by considering the advantage distillation procedure, followed by a XOR transformation [30]. Inter- estingly, our analysis shows that the key rate can be much larger when the XOR transformation is replaced by a noisy pre-processing applied to single bits.
1.2.2 QKD protocols using weak coherent pulses
We then considered generic protocols in practical implementations, where Alice does not send single photons to Bob, but weak coherent pulses instead, as in section 1.1.2 above.
We described again the protocols as entanglement-based schemes, and the con- cavity of the entropy allowed us to derive bounds of the form (for simplicity, we forget here about the possible pre-processing U ←X):
r≥ inf
σ∈ΓRµ,Qµ
X∞
n=0
RnS(X|E, n)−RµS(X|Y) , (1.2) where the set ΓRµ,Qµ contains all states which can result from a collective attack by Eve and are compatible with the average sifting rateRµ and the average QBERQµ, where Rn is the sifting rate due to the n-photon pulses only, and where S(X|E, n) is the entropy of X conditioned on E and on the fact that the pulse contained n photons. The average of n is only taken over the terms for the entropy conditioned on Eve’s system, but not on the term for the entropy conditioned on Bob’s system:
this is because Eve might be able to measure the photon number, whereas this is not the case for Bob. It is worth mentioning also that since the (conditional) entropy of the classical variable X cannot be negative, the lower bound above can be further lower-bounded by restricting the sum to a finite number of its terms.
For BB84 for instance, Eve can have full information on the pulses that contain n ≥ 2 photons. Her corresponding uncertainties thus vanish, and we find in par- ticular the same bound as in [33], derived with other techniques. For the SARG protocol on the other hand, Eve does not have full information on the multi-photon pulses, and taking into account the 2-photon contribution allowed us to derive higher bounds than previously known [34]. Comparing the two protocols in the untrusted- device scenario (where Eve is assumed to have some control over Bob’s detectors), we found again a similar relation as in section 1.1.2 above, for the case of a noiseless channel, with a key rate scaling as t2 for BB84 and t3/2 for SARG. For noisy chan- nels however, the bound for SARG diminishes more rapidly than for BB84, and was found to also scale as t2 for a quantum channel with a visibility V = 0.95.
Note finally that we could also use the same techniques to study the decoy-states implementations of QKD protocols [35, 36, 37]. The idea of the decoy states is that they allow a direct estimation of the parameters Rn (and the corresponding error rates Qn) in (1.2), which Eve can no longer freely optimize. We estimated again the bounds for BB84 and SARG, and found that SARG was outperformed by BB84 when decoy states are used.
1.3 Conclusion
The examples presented here illustrate the role of quantum correlations in QKD, and the fact that different ways to make use of them can lead to different performances for the QKD protocols. Learning more about quantum correlations will give new insights on QKD and will certainly prove useful with regards to the development of this technology and of other possible applications.
It is important to realize that the key feature of quantum correlations that QKD exploits is their non-locality: the fact that the correlations cannot be explained by local hidden variables [3] implies in particular that no spy can have access to this non-existing information! Actually, cryptographic protocols only based on non-local correlations can be devised, and the security can be proven by just restricting the adversary to obey the no-signaling principle [38, 39, 40, 41, 42, 43]. An interest- ing scenario, somehow intermediate between this “no-signaling cryptography” and standard QKD as studied here, is that of device-independent QKD [44, 45]: Eve is still restricted to obey quantum theory, but no assumption is made on the physical systems held by Alice and Bob. In the spirit of Ekert’s protocol [7], the security is based on the violation of a Bell inequality. This again highlights the necessity of sharing non-local correlations to create a secret key.
Chapter 2
Upper bounds for the security of the Coherent-One-Way protocol
The first proposals for quantum key distribution protocols, such as the BB84 proto- col [6] and several variations thereof, were based on the use of independent quantum systems (most often, qubits) to encode different classical bits. In practical implemen- tations, one would usually use photons to carry the quantum states, often obtained from weak laser pulses (as we have seen in the previous chapter).
However, convenient telecom laser sources emit either a continuous train of pulses (mode-locked lasers), or a continuous wave that can be formatted by an intensity modulator into trains of pulses. This observation lead to devising new protocols for efficient QKD, so called distributed-phase-reference protocols, based on continuous trains of weak coherent pulses, and in which the intervention of an adversary is monitored by measuring the coherence between successive non-empty pulses. These new protocols provide new challenges for theorists to analyze their security against the most general attacks: the tools, which have been developed in the last decade to tackle this problem for more standard QKD protocols, cannot be applied in any straightforward way when the schemes move away from the symbol-per-symbol type of coding.
The Coherent-One-Way (COW) protocol is an example of a distributed-phase- reference protocol, proposed in Geneva in 2004 [46, 47] and developed in the last few years [48, 49]. Here we present security analyses for the COW protocol against different kinds of attacks, which give upper bounds on the secure key rates that can be obtained with this protocol.
2.1 The Coherent-One-Way protocol
The idea of the COW protocol is to have a very simpledata linein which the raw key is created, protected by the observation of quantum interferences in a monitoring line. We review here its features, and refer to [46, 47, 48, 49] for a more comprehen- sive discussion of motivations and practical issues. The protocol is schematized in Figure 2.1.
t B D B
D M1 D M2 1 t − B
Alice Bob
Laser IM
bit 0
bit 1 decoy
Figure 2.1: Schematic description of the COW protocol. A continuous, phase- stabilized coherent laser beam is sent through an intensity modulator (IM) that shapes discrete pulses, while preserving the coherence. See text for all other details.
The source, on Alice’s side, produces a train of equally spaced weak coherent pulses. A non-empty pulse is written |αi, its mean photon number µ =|α|2. Each logical bit is encoded in a sequence of one non-empty and one empty pulse: the bit value 0 is coded in the sequence |0i|αi, the bit value 1 in the sequence |αi|0i. These two states are not orthogonal because of the vacuum component, and can be unambiguously discriminated in an optimal way by just measuring the time of arrival in the data line. The quantum bit error rate Q is, as usual, the probability that Bob accepts the wrong value of the bit. To estimate the loss of coherence in the channel (and thence Eve’s information), a fraction 1−tB of the light is sent into the monitoring line, consisting of an unbalanced interferometer. The phase between the two arms is chosen so that two consecutive non-empty pulses sent by Alice should always interfere constructively in one output port (and be detected with probability pDM1 > 0) and destructively in the other one (pDM2 = 0). The departure from this ideal situation is measured by the visibility V = ppDM1−pDM2
DM1+pDM
2
of the interference pattern observed for two consecutive non-empty pulses. Note that there is no a priorirelation between Q and V.
In the original version of the protocol, Alice also sends decoy sequences |αi|αi with probability f, in order to prevent a subtle form of photon-number-splitting attack [21, 22]. These sequences do not code for a bit value.
2.2 Studies of a few specific attacks on the COW protocol
2.2.1 Collective Beam-Splitting Attack
The Beam-Splitting Attack (BSA) translates the fact that all the light that is lost in the channel between Alice and Bob, characterized by its transmission coefficient t, must be given to the eavesdropper, Eve. The attack consists in Eve simulating the losses 1−t by putting a beam-splitter just outside Alice’s laboratory, and then
forwarding the remaining photons to Bob through a lossless line. Since it simulates exactly Bob’s expected optical mode, the BSA introduces no errors (i.e.,Q= 0 and V = 1) and is therefore impossible to detect.
The information that Eve can extract from her data depends on the way she processes them. For each bit she wants to estimate, she has to distinguish the two states |0, αEi and |αE,0i, where αE =√
1−t α. The case where Eve performs the same measurement as Bob was considered in [46, 47]; in [C,D], we allowed Eve to keep her systems in a quantum memory, and to extract the largest possible information out of them on the final key, after Alice and Bob have run the classical one-way post-processing. This corresponds to acollective attack, for which case Devetak and Winter have shown [50] that Eve’s information is upper bounded by the Holevo quantity
χAE =S(ρE)− 1
2S(ρE|A=0α)− 1
2S(ρE|A=α0) (2.1) where S is the von Neumann entropy, ρE|A=0α = |0, αEih0, αE| is Eve’s state con- ditioned on what Alice sent (similarly for ρE|A=α0), and ρE = 12ρE|A=0α+12ρE|A=α0. Denoting by h the binary entropy function, we find
χAE =h³1− |h0, αE|αE,0i|
2
´=h³1−e−µ(1−t) 2
´ . (2.2)
The Devetak-Winter bound then reads, for the secret key rate r:
r=rsif t(IAB −χAE) =rsif t
h
1−h³1−e−µ(1−t) 2
´i
, (2.3)
where rsif t is the sifting rate, i.e. the probability that Alice and Bob accept a bit:
here, including the detection efficiency η of Bob’s detector DB, the sifting rate per pair of pulses isrsif t = (1−f)µttBη. As there are no errors, Alice and Bob’s mutual information for each sifted bit is IAB = 1.
The key rate (2.3), as a function of the distance between Alice and Bob and after optimizing the mean number of photon µ, will be shown in Figures 2.2 and 2.3 in comparison with the following two classes of attacks.
2.2.2 Zero-error attacks based on Unambiguous State Dis- crimination
Another class of zero-error attacks (Q = 0, V = 1) was introduced and analyzed in [C]. These attacks exploit the fact that in the COW protocol, the coherence is checked only between successive pulses; in particular, no coherence is checked between all that comes before and all that comes after an empty pulse. Therefore, if Eve can be sure that a given pulse was empty, she can make an attack that breaks the coherence at the location of that pulse. More generally, Eve can try to distinguish a sequence of n pulses that begins and ends with an empty pulse: if she succeeds, she can send photons in this n-slot partial mode. These attacks are thus based on the unambiguous state discrimination (USD) of that n-slot sequence.
0 20 40 60 80 100 120 140 160 10−1
100
Distance (km)
µ
µopt for the collective BS attack µopt for our USD attack
0 20 40 60 80 100 120 140 160
10−7 10−6 10−5 10−4 10−3 10−2 10−1 100
Distance (km)
Secret key rate
r(µopt) for the collective BS attack r(µopt) for our USD attack
Figure 2.2: Optimal mean photon number µ (left-hand side) and corresponding secret-key rate r per pair of pulses (right-hand side) for the collective BSA and for the combination of 3-pulse and 4-pulse USD attacks, as a function of the distance between Alice and Bob. Parameters: η = 0.1; 0.25 dB km−1 of losses; f = 0.1;
tB ≃1.
More specifically, we studied such USD attacks on three pulses, in which sequences
|0α0i are discriminated, and on four pulses pulses, which discriminate sequences
|0αα0i. We could show that if the fraction of decoy sequences used in the protocol is small enough (f .0.236), Eve could reproduce the detection rates of all individual detectors of Bob by combining these USD attacks. We refer to [C] for all the calculations. The optimal mean number of photon µ and the secret key rate r obtained when considering this attack are shown on Figure 2.2. One can see that this attack outperforms the BSA for distancesd&100 km, giving an optimalµand a secret key rate that scale, respectively, as √
t and t3/2.
However, many limitations can be found to these USD attacks. Indeed, they are not entirely undetectable: even though all detection rates are reproduced, one could check other statistical parameters (such as the probabilities of detecting certain specific sequences), which would behave in an unexpected way. Also, Alice and Bob could simply choose f >0.236, and the attack that we studied would become impossible.
Be that as it may, it is important to be aware of these possible attacks, all the more so as there is no claim of optimality in the specific combination of USD attacks that we considered. Our results show that it is important that Alice and Bob include several tests of their statistics in the COW protocol.
2.2.3 Non-zero-error attacks on single or pairs of pulses
Let us now present another class of collective attacks that somehow generalizes the BSA by introducing errors (Q≥0, V ≤1). The idea is that Eve attaches ancillary quantum systems to each pulse or to each pair of pulses, and applies transformations
of the form (for the case of a two-pulse attack):
|αk−1, αkiA⊗ |EiE → |Ψ(αk−1, αk)iB,E (2.4) where αk−1, αk ∈ {0, α}. Errors will be due to the fact that Eve gets entangled to the system that goes to Bob, in order to gain more information. These attacks have been studied in [D], in the long distance regime (for µt ≪ 1): this allowed us to neglect multi-photon components on Bob’s side, and to parameterize Eve’s attack in finite dimensional Hilbert spaces. The problem was then to optimize Eve’s choice of states |Ψ(αk−1, αk)iB,E under the constraint that (2.4) has to be a unitary transformation, and so as to maximize her information for a given amount of errors that she introduces.
In the original version of the COW protocol, the pairing of the pulses that defines the logical bits is decideda priori by Alice, and is known to Eve. When performing the above attack on two successive pulses, Eve can therefore choose whether she wants to attack two pulses that together define one bit, or that are across a bit separation. This observation lead us to also consider modified versions of the COW protocol, in which the pairing of the pulses is not known a priori by Bob, nor Eve:
in the COWm1 version, Alice still pairs consecutive pulses, while in the COWm2 version, she is allowed to pair any two pulses. In this last case, as Eve has no reason to attack successive pulses together, we considered one-pulse attacks.
The resulting secret key rates per pulse1 are illustrated on Figure 2.3, for the case V = 0.98, Q= 0. Again, we refer to [D] for details on the calculations. As expected, the COWm1 and COWm2 versions perform slightly better2 than the original COW protocol. It is also interesting to note that the secret key rates that we get still behave linearly witht, as it was the case for the BSA. This makes the protocol quite efficient, and very suitable for long-distance QKD [48, 49].
Note finally that we also studied in [D] the same attacks on the Differential- Phase-Shift (DPS) [52, 53] protocol, which is another distributed-phase-reference protocol that shares very similar features with the COW protocol. We found indeed a very similar behavior against the attacks under study, with a secret key rate that also scales linearly with t.
2.3 Outlook
By analyzing specific attacks on a protocol, one finds limitations on the secret key rates that can be obtained. The attacks studied here on the COW protocol also allow one to get a feeling on how the protocol should perform. In particular, we expect to find secret key rates that scale linearly with the transmission coefficient t, just like for other protocols robust against photon-number-splitting attacks; however,
1To be consistent with the results presented in [D], we now show the key rate per pulse, contrary to the previous subsection where it was defined per pair of pulses. There is simply a factor of 2 between the two definitions.
2Note however, that there also exists attacks to which COWm2 in particular is more vulnerable.
See [51].
0 20 40 60 80 100 10−5
10−4 10−3 10−2
Distance (km)
Secret key rate
BSA on COW, V = 1 2PA on COW @ V = 0.98 2PA on COWm1 @ V = 0.98 1PA on COWm2 @ V = 0.98
Figure 2.3: Secret key raterper pulse, for the BSA and for 2-pulse (2PA) and 1-pulse attacks (1PA) on the three protocols COW, COWm1 and COWm2, for V = 0.98 andQ= 0, as a function of the distance (valid for large distances only). Parameters:
η= 0.1; 0.25 dB km−1 of losses;f ≃0 (for COW);tB≃1.
the above USD attacks show that a careful analysis of the detection statistics is necessary to get this key rate.
Proving the security of the COW protocol against the most general attacks re- mains work in progress. One should certainly get inspiration from the techniques that have been developed to prove the security of more standard protocols (for a review, see [17]), and adapt these tools to the specificities of distributed-phase- reference schemes. Also, it might prove useful to consider modified and more sym- metric versions of the COW protocol, as was done in [D], to which it might be possible to apply a De Finetti kind of argument [27].
Chapter 3
Testing Leggett’s model for non-local correlations
Quantum theory predicts that nature can produce non-local correlations, in the sense that they violate Bell inequalities [3]. This fascinating feature has been widely confirmed, up to a few standard loopholes, in many beautiful experiments [54] with entangled photons or ions (see for example [5, 55, 56, 57, 58]). However, while the quantum formalism provides precise rules to calculate these correlations, it doesn’t give any explanation on how they occur, or where they come from.
To get a hint on what is essential to quantum correlations, it is interesting to look for alternative non-local models that either reproduce or can be shown to be incompatible with the quantum predictions. In this prospect, Leggett proposed in 2003 such an alternative model [11], and precisely proved its incompatibility with quantum theory: he derived inequalities that are necessarily satisfied by his model, but that can be violated quantum mechanically.
Here we present a simple approach to this model, along with new inequalities for testing it. We also go beyond Leggett’s model, and show that one cannot ascribe even partially defined individual properties to the components of a maximally entangled pair.
3.1 Quantum correlations from “simpler” ones
We shall use here the formal description of a correlation, which can be written as a conditional probability distribution P(α, β|~a,~b), where α, β are the outcomes observed by two partners, Alice and Bob, when they perform measurements labeled by~a and~b, respectively. On the abstract level,~a and~b are merely inputs freely and independently chosen by Alice and Bob. On a more physical level, Alice and Bob hold two subsystems described by an entangled quantum state; in the simple case of qubits, the inputs are naturally characterized by vectors on the Bloch sphere, hence the notation~a,~b.
3.1.1 Decomposing non-local correlations
How should one understand nonlocal correlations, in particular those correspond- ing to entangled quantum states? A natural approach consists in decomposing P(α, β|~a,~b) into a statistical mixture of hopefully simpler correlations:
P(α, β|~a,~b) = Z
dλρ(λ) Pλ(α, β|~a,~b) . (3.1) We shall be concerned here with the case of binary outcomes α, β = ±1, though generalizations are possible. In the binary case, the correlations can conveniently be written as
Pλ(α, β|~a,~b) = 1 4
³1 +α MλA(~a,~b) +β MλB(~a,~b) +αβ Cλ(~a,~b)´
. (3.2)
This expression allows one to clearly distinguish the marginals MλA(~a,~b) =X
α,β
α Pλ(α, β|~a,~b) , MλB(~a,~b) = X
α,β
β Pλ(α, β|~a,~b), (3.3) and the correlation coefficient
Cλ(~a,~b) =X
α,β
αβ Pλ(α, β|~a,~b). (3.4) We shall only be interested in correlations Pλ which, like quantum correlations, do neither allow signaling from Alice to Bob, nor from Bob to Alice, i.e. correlations fulfilling the so-calledno-signaling condition. This condition has a simple form here:
Alice’s marginal is independent of Bob’s input,MλA =MλA(~a) and symmetrically for Bob’s marginal, MλB =MλB(~b). Accordingly, in non-signaling correlations, only the correlation coefficient in (3.2),Cλ(~a,~b), can be nonlocal, while the marginals depend only on local variables.
3.1.2 Bell’s locality
Bell’s locality assumption that Pλ(α, β|~a,~b) factorizes into PλA(α|~a)· PλB(β|~b) can then be simply expressed as
Cλ(~a,~b) =MλA(~a)·MλB(~b) . (3.5) However, it is well known that quantum correlations violate Bell inequalities [3], and therefore they cannot be of that form.
3.1.3 Leggett’s model
In 2003 Leggett proposed another model of the form (3.1) to help us understand quantum correlations [11]. The basic assumption is that locally everything happens as if each single quantum system would always be in a pure state; non-locality can
only come from the correlation between the measurement results, expressed by the term Cλ(~a,~b). In our formalism this translates directly to the assumption that the supplementary variables λ describe the hypothetical pure states of Alice and Bob’s qubits, denoted by normalized vectors~u, ~v on the Bloch sphere:
λ =|~ui ⊗ |~vi , (3.6)
and the local marginals have the usual form as predicted by quantum physics:
MλA(~a) =h~u|~a ~σ|~ui=~u·~a , (3.7) MλB(~b) =h~v|~b ~σ|~vi=~v·~b . (3.8) If the qubits are encoded in the polarization of photons, as in Leggett’s initial idea, then the assumption is that each photon should be perfectly polarized (in the directions ~u and~v), and the local marginals should fulfil Malus’ law.
Let us recall that, in orthodox quantum theory, the singlet state is such that the properties of the pair are sharply defined (the state is pure), but the properties of the individual qubits are not. In this perspective, Leggett’s model is an attempt of keeping the correlations while reintroducing sharp properties at the individual level as well.
3.2 Violation of Leggett’s model by Quantum Me- chanics
As shown by Leggett himself [11], his model cannot reproduce the correlations of the singlet state, and this incompatibility with quantum predictions can be experi- mentally tested. The proof of incompatibility relies on the violation of what we shall call Leggett-type inequalities: these criteria say that, under Leggett’s assumptions (3.7–3.8), a measurable quantity L necessarily satisfies L ≤ Lmax, while quantum theory predicts that L > Lmax can be observed for suitable measurements.
The first experimental test of Leggett’s model was presented in 2007 by Gr¨oblacher et al.[59]. However, in order to reach a conclusion regarding the falsification of the model, they needed an additional assumption. Indeed, Leggett’s original inequali- ties, and in particular the version used in [59], suppose that data are collected from infinitely many measurement settings. To circumvent this problem, Gr¨oblacher et al. assumed the rotation invariancy of the system being measured, and then claimed a violation of their inequality.
It was soon realized how one could do without this unnecessary assumption:
inspired by the way that inequality was derived, we could indeed come up with a finite version of it, directly testable [E] (see also [60] for a similar derivation). This allowed us to demonstrate the first really conclusive experimental falsification of Leggett’s model.
Here we shall derive a new Leggett-type inequality [F], in a much simpler way than it was done for the first inequalities that had been published and tested [11, 59, 60],[E]. Our inequality has been experimentally tested, and allowed a clear refutation of Leggett’s model.
3.2.1 General inequality for non-signaling models
In order for the decomposition (3.1) to be a valid mixture of correlations, all distri- butions Pλ should be non-negative. When writing Pλ(~a,~b) in the form of eq. (3.2), one can see that the non-negativity implies the general constraints
−1 +|MλA(~a) +MλB(~b)| ≤Cλ(~a,~b)≤1− |MλA(~a)−MλB(~b)| (3.9) or equivalently, in a more compact form:
|MλA(~a)±MλB(~b)| ≤1±Cλ(~a,~b) . (3.10) Constraints on the marginals MλA orMλB thus imply constraints on the correlation coefficients Cλ, and vice versa.
Let us now consider one measurement setting ~a for Alice and two measurement settings~b,~b′ for Bob, and let’s combine the previous inequalities (3.10) that we get for (~a,~b) and (~a,~b′). Using the triangle inequality, one gets
|Cλ(~a,~b)±Cλ(~a,~b′)| ≤2− |MλB(~b)∓MλB(~b′)|. (3.11) These constraints must hold for all probability distributions Pλ. After inte- gration over the λ’s, one gets, for the averaged correlation coefficients C(~a,~b) = R dλρ(λ)Cλ(~a,~b):
|C(~a,~b)±C(~a,~b′)| ≤2− Z
dλρ(λ) |MλB(~b)∓MλB(~b′)|. (3.12)
3.2.2 Derivation of a simple Leggett-type inequality
Now we derive an inequality satisfied by Leggett’s model, which can be experimen- tally tested. Inequality (3.12) implies, for the particular form of eq. (3.8) for Bob’s marginals:
|C(~a,~b) +C(~a,~b′)| ≤2− Z
dλρ(λ)|~v·(~b−~b′)| . (3.13) Let’s consider three triplets of settings1 (~ai,~bi,~b′i), with the same angleϕbetween all pairs (~bi,~b′i), and such that~bi−~b′i = 2 sinϕ2~ei, where{~e1, ~e2, ~e3}form an orthogonal basis (see Figure 3.1). After combining the three corresponding inequalities (3.13), using the fact that P3
i=1|~v·~ei| ≥ 1 and the normalization R
dλρ(λ) = 1, we finally get the Leggett-type inequality
1 3
3
X
i=1
|C(~ai,~bi) +C(~ai,~b′i)| ≡ L3(ϕ) ≤ 2− 2 3|sinϕ
2| . (3.14)
1Note that other choices of measurement settings can lead to other Leggett-type inequalities, which might be more robust, but would bring more settings into play [F].
Figure 3.1: Alice’s and Bob’s settings~ai,~biand~b′i used to test inequality (3.14). The three directions~ei of~bi−~b′i (thin dotted arrows) must be orthogonal.
The correlation coefficients C(~a,~b) can be experimentally estimated; for the sin- glet state, quantum mechanics predicts CΨ−(~a,~b) = −~a·~b. Thus, when~ai is judi- ciously chosen to be along the direction of~bi+~b′i, the quantum mechanical prediction for L3(ϕ) is
LΨ−(ϕ) = 2|cosϕ
2| , (3.15)
which violates inequality (3.14) for a large range of values ϕ. More specifically, for a pure singlet state, the violation occurs for |ϕ| < 4 arctan13 ≃ 73.7◦, and the maximal violation is obtained for |ϕ|= 2 arctan13 ≃36.9◦. In the case of imperfect interference visibility V ( ˜LΨ−(ϕ) = 2V|cosϕ2|), a violation can still be observed as long asV > Vth(3) =q
1−(13)2 = 2√32 ≃94.3%.
An important feature of Leggett-type inequalities compared to Bell inequalities is that the bound is not a fixed number, independent of quantum physics. Instead, the bound in Leggett-type inequalities, like the model itself, depends on the quantum measurements that are performed. Consequently all experimental data aiming at disproving Leggett’s model should present evidence that the settings used in the experiment have been properly adjusted.
3.2.3 Experimental falsification of Leggett’s model
We tested our Leggett-type inequality (3.14) with pairs of polarization-entangled photons obtained via a non-collinear type-II parametric down conversion process in a Barium-beta-borate crystal.
We chose the following Bloch vectors, as shown on Figure 3.1:
~a1 =~x , ~b1,~b′1 =³ cosϕ
2,±sinϕ 2,0´
,
~a2 =~y , ~b2,~b′2 =³
0,cosϕ
2,±sinϕ 2
´
, (3.16)
~a3 =~z , ~b3,~b′3 =³
±sinϕ
2,0,cosϕ 2
´,
1.4 1.5 1.6 1.7 1.8 1.9 2
−90° −60° −30° 0 30° 60° 90°
L
3upper bound for Leggett’s model
QM
(pure singlet)
experiment
ϕ
Figure 3.2: Experimental values for L3 over a range of separation angles ϕ (points with error bars) violate the bound given by Legget’s model (solid line), and follow qualitatively the expected value for the quantum mechanical prediction (dashed line).
so that
~bi−~b′i = 2 sinϕ
2~ei, with (~e1, ~e2, ~e3) = (~y, ~z, ~x). (3.17) The x axis in this notation corresponds to ±45◦ linear, the y axis to circular, and the z axis to horizontal/vertical polarization, the latter coinciding with the natural basis of the parametric down conversion process in the nonlinear optical crystal.
For given measurement settings, we estimated the correlation coefficientsC(~a,~b), and computed the values of L3(ϕ) over a larger range ofϕ with an integration time of T = 15 s per setting. The results are shown on Figure 3.2. The variation of L3 with ϕ is compatible with the quantum mechanical prediction for a singlet with residual colored noise and an orientation uncertainty of the quarter wave plate of 0.2◦ (recall that in Leggett-type inequalities, it is important to adjust the settings accurately). The largest violations of (3.14) are found for ϕ =±25◦ with 40.6 and 38.1 standard deviations, respectively.
Clearly, the experimental data agree with quantum mechanics and falsify Leggett’s model.
3.3 On the tolerable amount of individual prop- erties
The falsification of Leggett’s model proves that it is impossible to reconstruct quan- tum correlations from hypothetical, more elementary correlations in which individual
properties would be sharply defined. We are going to argue that a much stronger statement holds, namely, that individual properties cannot even be partially defined.
3.3.1 A straightforward generalization of Leggett’s model
Let us first consider the following straightforward generalization of Leggett’s model:
we now allow the “local states” λ to be mixed states, e.g. photons with a degree of polarization η. So, we replace (3.7–3.8) by MλA(~a) =η ~u·~a, MλB(~b) =η ~v·~b, with 0< η ≤1. For this model one can derive a generalized version of the Leggett-type inequality (3.14):
L3(ϕ) ≤ 2− 2
3η|sinϕ
2| (3.18)
which, for any value of η > 0, is violated by LΨ−(ϕ) = 2|cosϕ2| for angles ϕ small enough.
Experimentally, one cannot expect to conduct a meaningful comparison between those two predictions down to η = 0 due to imperfections in the state preparation.
From the measurement shown in Figure 3.2, however, we can extract the maximal excess of L3 with respect to the generalized model bound (3.18) for various degrees of purityη. Forη= 0.56, we can start to claim experimental evidence of a violation with a statistical significance of 3.65 standard deviations, thus putting a lower bound for this class of models.
3.3.2 Any model `a la Leggett must have vanishing marginals
It is then natural to conjecture that no model of the form (3.1), with non-signaling correlations Pλ, can reproduce the quantum correlations of the singlet state, unless MλA(~a) =MλB(~b) = 0 (3.19) for all measurements~a and~b (except perhaps for a few λ’s in a zero-measure set, which could possibly depend on ~a,~b). We have indeed been able to prove this conjecture for models with discrete λ’s: please refer to the Methods section of [F]
for the proof.
This is in good agreement with the results of Colbeck and Renner [61], who have derived general inequalities to falsify such models with non trivial marginals.
3.4 Conclusion
Our conclusion is that quantum correlations cannot be reconstructed from “simpler”
correlations in which the individual properties would be even partially defined: any non-signaling model with non-vanishing marginals for the singlet state is incompat- ible with quantum predictions.
Nature is really such that, in some cases, individual properties are completely lost while global properties are sharply defined.
