Quantum process tomography of a high-dimensional quantum communication channel

The characterization of quantum processes, e.g. communication channels, is an essential ingredient for establishing quantum information systems. For quantum key distribution protocols, the amount of overall noise in the channel determines the rate at which secret bits are distributed between authorized partners. In particular, tomographic protocols allow for the full reconstruction, and thus characterization, of the channel. Here, we perform quantum process tomography of high-dimensional quantum communication channels with dimensions ranging from 2 to 5. We can thus explicitly demonstrate the effect of an eavesdropper performing an optimal cloning attack or an intercept-resend attack during a quantum cryptographic protocol. Our study shows that the process matrix enables a more detailed understanding of the channel conditions compared to a coarse-grained measure, such as quantum bit error rates. This full characterization technique allows us to distinguish eavesdropping attempts and optimize the quantum key distribution performance under asymmetric experimental conditions.


INTRODUCTION
Quantum information science has witnessed the emergence of a wide range of new technologies and applications [1]. Quantum cryptography [2], quantum computation [3] and quantum sensing [4] are examples of promising venues for a possible next technological revolution. In order to construct complex quantum machines or quantum networks, a full characterization of its building blocks is critical. A method for reconstructing the action of a component in a quantum system is known as quantum process tomography (QPT) [5,6]. Previously, QPT has been performed to characterize several quantum physical systems, such as liquid-state NMR [7,8], photonic qubits [9], atoms in optical lattices [10], trapped ions [11], solid-state qubits [12], continuous-variable quantum states [13], semiconductor quantum dot qubits [14] and, recently, nonlinear optical systems [15]. Another class of important quantum systems that can benefit from full characterization are quantum channels and components for quantum key distribution (QKD) and quantum communications [16,17], where, so far, quantum channels may be categorized as optical fibre [18], line-of-sight free-space [19] and ground-to-satellite (satellite-to-ground) [20] links.
The benefits of fully characterizing quantum communication channels lie at a better understanding of possible error sources and, more importantly, on the detection of the potential presence of an eavesdropper, namely Eve, tapping into the quantum channel. Usually, her presence is revealed in the form of noise introduced in the channel. The authorized partners, typically referred to as Alice and Bob, may estimate noise levels in the channel to assess the amount of leaked information to Eve. After this error assessment, Alice and Bob may perform classical post-processing protocols, such as privacy amplification [21], in order to remove Eve's leaked information. Conventional methods for secure key rate analysis rely on symmetry assumptions to associate an average (coarse-grained over all preparation and measure-ment settings) bit error rate parameter to a reduction in secure key rates. However, experimental errors often tend to break symmetries which motivates numerical techniques towards QKD [22].
While usual QKD schemes rely on encoding quantum information in two-level systems, i.e. qubits, a particular class of QKD schemes is known as high-dimensional QKD protocols [23,24]. High-dimensional schemes have the potential advantage of tolerating larger noise levels in the channel and carrying more than one bit of information per carrier. So far, a full characterization of high-dimensional processes based on QPT has not been achieved experimentally. With the emergence of high-dimensional quantum information, QPT will become an essential tool for the characterization of complex experiments dealing with high-dimensional quantum states. As a physical implementation, the orbital angular momentum (OAM) of photons represents a promising route for highdimensional encoding due to the maturity of its generation and detection schemes [25,26]. OAM states, corresponding to helical wavefronts of the form exp(i ϕ), where the OAM value is an integer and ϕ is the azimuthal coordinate, may be realized using single phase elements. Computer-generated holograms displayed on a spatial light modulator (SLM) provide a simple and versatile method for generating and manipulating these modes [27]. High-dimensional QKD has been demonstrated experimentally using OAM in the laboratory [28][29][30], in intra-city free-space links [31][32][33] and, recently, in other types of quantum links [34].
Here, we demonstrate the benefits of a full characterization of a quantum channel through quantum process tomography. This full characterization will allow us to complement the numerical approach in [22] to optimize secure key rates under specific experimental conditions and to develop new protocols lacking symmetry that may outperform existing approaches. Moreover, we characterize the effect of an eavesdropper performing a high-dimensional optimal cloning attack and two types of intercept-resend attack. We further show, that from Alice's preparation stage consists of a single photon source (not shown) that feeds the heralded photons to a generation apparatus consisting of a spatial light modulator (SLM-A). Alice's photon is subsequently sent into the quantum channel which is considered as a black box with quantum process E.
The output of the blackbox is fed to Bob's detection stage consisting of a spatial light modulator (SLM-B) and a single-mode optical fibre (SMF), via performing phase-flattening. We experimentally consider three different types of processes for our quantum channel: an ideal channel with no attack, the case of an optimal cloning attack and the case of an intercept-resend attack. In particular, the configuration of the optimal cloning scheme consist of an SLM (SLM-E1) which generates a completely mixed that is fed to the Hong-Ou-Mandel type interferometer at a balanced beam splitter (BS1). The cloned photons are then sent into a second beam splitter (BS2) in order to spatially separate them. Eve can use a second SLM (SLM-E2) to measure the state of her cloned photon while sending the other cloned photon to Bob. The experimental configuration of the intercept resend consists of two SLMs (SLM-E1 and SLM-E2) sandwiching a SMF.
the experimentally reconstructed process, we may determine the source of the errors present in our high-dimensional quantum communication channel.

RESULTS
Theory of quantum process tomography: Let us set the stage by introducing the basic concepts of QPT. The goal of QPT is to determine the completely positive map E representing the action of the system on any d-dimensional input state ρ in . The output state is then given by ρ out = E (ρ in ). The process is typically represented as, where theÂ m operators form a complete basis typically given by the Pauli operators or the Gell-Mann operators in higher dimensions. The trace-preserving positive Hermitian d 2 × d 2 matrix χ mn , defined as the process matrix, completely and uniquely characterizes the action of the process E. We may note that QPT may also be performed for non-trace-preserving maps [35]. A convenient alternative description of processes is given by the Choi-Jamiolokowski isomorphism (CJI), which states that every completely positive map can be represented as an operator living in a d 2 -dimensional Hilbert space. Such an operator, known as the Choi matrix ρ E , can be defined as the result of the channel acting upon one part of a maximally entangled state, |Φ , The output state is thus given accordingly, where T denotes the transposition,1 is the d-dimensionalidentity operator and Tr in [·] represents the partial trace over the input state's Hilbert space. In order to perform QPT, a set of tomographically complete states are sent into the channel and state tomography is performed on the output states. In our case, we consider states belonging to mutually unbiased bases (MUB) in dimension d, which are known for dimensions that are powers of prime numbers [36]. A MUB projector is given by The completeness and orthogonality relations are respectively given by, α,m With the help of the CJI, one can derive Born rule-like expressions for probabilities, This equation underlies the relation between quantum process tomography and quantum state tomography. The Choi matrix, ρ E , is experimentally reconstructed using the maximum-likelihood estimation. Better algorithms have also been recently proposed for QPT [37]. Finally, the process matrix is directly obtained from the Choi matrix.
Experimental results: Our experiment consists of three components: the generation stage, the quantum channel and the detection stage, which are owned by Alice, Eve and Bob, respectively. We implement the prepare-and-measure QKD scheme with heralded single-photons using the OAM degree of freedom, see Fig. 1. The single photon pairs, consisting of the signal and idler, are generated by spontaneous parametric downconversion (SPDC) at a type I β-barium borate (BBO) crystal. The nonlinear crystal is pumped by a quasicontinuous wave laser operating at a wavelength of 355 nm. The generated photon pairs are coupled to single-mode optical fibres (SMF) in order to filter their spatial modes to the fundamental Gaussian mode. A coincidence rate of 30 kHz is measured, directly at the source, within a coincidence time window of 2 ns. We use the detection of the idler photon as the heralding trigger for the signal photon, thereby realizing a FIG. 2. Process matrix of high-dimensional quantum channels. The real part of the experimentally reconstructed process matrices are presented for dimensions ranging from 2 to 5 in the case of (a-d) an ideal quantum channel, (e-h) a universal symmetric optimal quantum cloning attack, (i-l) a universal intercept-resend attack and (m-p) an intercept-resend attack only using two MUB. The theoretical results are represented by the wire-grid.
heralded single photon source with a measured second-order coherence of g (2) (0) = 0.015 ± 0.004. The heralded signal photon is sent to SLM-A corresponding to Alice's generation stage. The OAM states are produced using a phase-only holography technique [27]. Alice's heralded photon is subsequently sent over the quantum channel, considered here as a black box between Alice and Bob. At Bob's receiver, we perform a state-projection over the required states, which we realize by a mode filter implemented through a phase-flattening hologram and coupling into a SMF [38,39]. In particular, Alice and Bob perform QPT using MUB [40], which are experimentally realized using OAM states. The computational bases (α = 1) are given by {| ; = −d/2, ..., d/2; 0} and {| ; = −(d − 1)/2, ..., (d − 1)/2} for even and odd dimen-sions, respectively, for symmetry considerations. The second basis is given by the discrete Fourier transform, i.e.
The explicit form of the other MUB elements can be found elsewhere [41].
Ideal quantum communication channel: In the case of an ideal quantum channel, i.e. no eavesdropper, the real parts of the experimentally reconstructed process matrices are shown in Fig. 2-a-d for dimensions ranging from d = 2 to 5. Ideal processes, whereẼ(ρ) = ρ, are described by process matrices given byχ i j = δ 0i δ 0 j . Deviations of our reconstructed ideal process matrices from the theory are attributed to imperfections in generation and detection of the distributed quantum states, i.e. the OAM modes. As higher dimensions are considered, larger crosstalk among the OAM modes is observed, which further deteriorates the experimentally reconstructed process matrix. In order to describe the quality or performance of the quantum channel, several figures of merit are available to describe our process [42]. One such figure is the process fidelity which is defined as F P = Tr(χ expχ ). For the ideal quantum channel, F P can be directly obtained from the process matrix χ exp , i.e. F P = χ i=0, j=0 . Moreover, the average fidelity,F, of the process can be defined as the state fidelity between the output and the input averaged over all possible states with the convenient relationF = (dF P + 1)/(d + 1). Similarly, the average purity is defined as the purity of the outgoing states averaged over all possible states and describes the level of mixture introduced by the process. It can be related to the average fidelity according toP = (1 − 2F + dF 2 )/(d − 1), respectively. The experimentally obtained process fidelities, average fidelities and average purities for the ideal channel are shown in Fig. 3 for dimensions ranging from d = 2 to 5.
Having quantified the experimental imperfections, we can now investigate the case of an imperfect quantum channel. As a starting point, we consider a general class of trace-preserving processes which creates mixtures from some input state. The result of such an action on an input state, say ρ in = |0 0|, is given by the out- where F = ψ in | ρ out |ψ in is the state fidelity. It can be shown that the process matrix associated to this decoherence process is given by, Optimal quantum cloning attack: A special case of such a process is the so-called universal optimal cloning attack. In this scenario, Eve sends the incoming photon to an optimal cloning machine which produces two imperfect copies of the incoming photon, out of which she keeps one and sends the other to Bob. Later on, Eve may decide to perform a measurement on her copy in order to obtain information from Alice and Bob's shared photon. For the case of universal optimal cloning, Eve's copying machine has the effect of symmetrically introducing errors on the outgoing state. The cloning fidelity is defined as F cl = 1/2 + 1/(1 + d). Universal optimal cloning machines have been realized experimentally using the symmetrization method [43][44][45][46][47], where both cloned photons possess the same cloning fidelity. At the heart of the symmetrization technique for optimal cloning is the Hong-Ou-Mandel interference effect [48]. For indistinguishable photons incident at the input port of a balanced beam splitter, a two-photon interference effect occurs which forbids the photons to exit the beam splitter from different output ports. Surprisingly, a slight modification of the Hong-Ou-Mandel experiment leads to a universal optimal symmetric cloning machine. In this case, the second photon needs to be in a d-dimensional completely mixed state and is fed into the second input port of the beam splitter at exactly the same time. As the representation of the mixed state is the same in any bases, this scheme is universal, i.e. works for any state of the Hilbert space. When the two photons exit the beam splitter from the same output port, optimal cloning has been successful. A second beam splitter is then used to separate the two photons, e.g. one photon goes to Bob and the other one stays at Eve. We then experimentally perform the universal optimal cloning machine in the quantum channel for dimensions up to 5 and perform, again, a full characterization of the attack on the channel through QPT, see Fig. 2-e-h and Fig. 3.
Intercept-resend attack: Another eavesdropping scheme that achieves processes with lower average fidelities is the so-called intercept-resend attack, see Fig 2-i-l. In contrast to the above described optimal cloning attack, Eve directly measures the received photon information, where she randomly performs her measurement in bases uniformly chosen at random (intercept). She then prepares a photon in the observed state and transmits it to Bob (resend). When considering the intercept-resend over all MUB, the fidelity of the states at the output of the channel is given by F ir = 2/(1 + d). We experimentally perform the intercept-resend attack in our quantum channel by means of two SLMs, i.e. SLM-E1 and SLM-E2, with a SMF in between. The first SLM (SLM-E1) along with the SMF acts as the intercept section, while the second SLM (SLM-E2) acts as the resend. In the universal case, Eve randomly chooses α = 1, ..., d + 1 and m = 1, ..., d and simultaneously displays phase elements equivalent to ψ (α) m and ψ (α) m on the SLM-E1 and SLM-E2, respectively. Next, we consider a non-symmetric process that introduces noise in a way that is not independent of the input state. An example of such an attack is the intercept-resend strategy considering 2 MUB, which corresponds to the seminal BB84 QKD protocol [2]. In this case, Alice and Bob encode their random bits only in 2 MUB. Hence, Eve may only consider those 2-MUB for her intercept-resend attack. In this case, the process matrix has a different form from that introduced earlier for symmetric decoherence. Using the same experimental configuration as that presented previously, we perform the intercept-resend attack considering the computational and the discrete Fourier transform bases. The real part of the theoretical process matrices for the 2-MUB intercept-resend attack are shown in Fig. 2-mp. Interesting structures in the process matrices can be seen, demonstrating yet again the illustrative power of QPT and the process matrix in characterizing quantum processes, such as quantum channels in quantum communication settings.

SECRET KEY RATES
Finally, we show that the full characterization enables an enhanced estimation of the information leakage to an adversary eavesdropper. This results in a more accurate and favourable estimation of the achievable secret key rate, K, of the channel for a given QKD protocol. The first step to calculate the secret key rate of a channel is by evaluating the quantum bit error rate (QBER), e b , from the raw key shared by Alice and Bob. Analytical formulae are derived to obtain the secret key rate as a function of the QBER. For instance, the BB84 protocol [2] in dimension d has the following simple analytical formula, d-dimensional BB84 protocol to tomographically complete measurements is known as the six − state protocol for the specific case of d = 2. For dimensions that are power of prime numbers, all d + 1 MUB are adopted. The secret key rate of this (d + 1) MUB protocol as a function of the QBER is given by, Nonetheless, using such analytical formulae has a number of drawbacks. First, it only considers sifted data and assumes perfect unbiasedness among different MUB. This assumption may increase the resulting secret key rate, but does not consist of an adequate representation of the channel and may lead to an underestimation of Eve's leaked information. Moreover, the secret key rate is obtained from a coarse-graining of the individual QBER per measurement settings. Thus, given this single parameter, a pessimistic estimation of the secret key rate is obtained due to the limited knowledge of the channel. Following the method described in [22], a more appropriate mean by which the secret key rate of a channel may be estimated is by considering the Devetak-Winter formula [49]. To do so, we recast our prepare-and-measure QKD protocol into an entanglement-based scheme using the source-replacement scheme [50], where Alice and Bob share pairs of entangled photons represented by the density matrix ρ AB . The secretkey rate is then obtained according to, where ρ ABE is the tripartite density matrix shared by Alice, Bob and Eve, respectively; C is the set of physical density Hence, every additional experimental measurement is included in the minimization, which results in a greater, or equal, secret key rate. In the limiting case where we have a full characterization of the channel, ρ AB is fully reconstructed and is given by the Choi matrix, ρ E , mentioned earlier. Thus the secret key rate may be directly calculated from ρ AB , = {|0 0|,1 − |0 0|}, where the former corresponds to a sorting-type measurement and the latter corresponds to a filter-type measurement, i.e. "click" or "no-click". We note that in the case of a filter-type configuration, the secret key rate is upper-bounded by 1 bit per sifted photon. By doing so, we demonstrate the flexibility of our method which allows one to incorporate specific details about the experimental configuration and study its effect on the overall achievable secret key rate from a given QKD system. For the full characterization of our high-dimensional quantum channel via QPT with no explicit eavesdropping strategy applied, we calculate the corresponding secret key rate and compare it to a coarse-grained estimation of the channel, see Fig. 4. We observe that for larger dimensions, the coarse-grained secret key rate performs poorly compared to the achievable secret key rate obtained from a full characterization of the channel. This may be due to the fact that as one considers higher-dimensional states, the symmetry assumption involved in coarse-graining is increasingly not fulfilled. Therefore, full characterization of quantum channels may offer a means by which the full potential of high-dimensional protocols is exploited. In highly asymmetric scenarios, which is often the case due to systematic errors such as misalignments, full characterization may even surpass the performance of coarse-grained protocols even when considering the lower sifting efficiency of tomographic protocols.
In summary, full characterization of quantum processes via QPT is an invaluable tool for high-dimensional quantum information processing. In particular, the complexity resulting from the generation and detection of the high-dimensional states involved may be fully characterized. In the study of quantum channels for quantum communications, full characterization via QPT turns out to be a beneficial resource that allows one to take full advantage of the potential highdimensional nature of the protocols at play to increase the overall secret key rate.