Pilot-assisted intradyne reception for high-speed continuous-variable quantum key distribution with true local oscillator

We present a pilot-assisted coherent intradyne reception methodology for CV-QKD with true local oscillator. An optically phase-locked reference tone, prepared using carrier-suppressed optical single-sideband modulation, is multiplexed in polarisation and frequency to the 250 Mbaud quantum signal in order to provide optical frequency- and phase matching between quantum signal and local oscillator. Our concept allows for high symbol rates and can be operated at an extremely low excess-noise level, as validated by experimental measurements.


Introduction
Quantum key distribution using continuous variable (CV-QKD) [1][2][3][4][5] is currently regarded as one of the main contenders for a full-scale deployment of quantum cryptography. Its advantages over traditional qubitbased implementations include higher key rates and, more importantly, the ability to use established telecom technology (I/Q-modulation, Mach-Zehnder pulse carving, coherent detection) rather than complex and costly components required for discrete-variable QKD (single-photon sources and -detectors). Unlike counting polarisation-or phase-encoded single photons, in CV-QKD the raw key is established by encoding the quadrature components of weak coherent states |α = |I A + iQ A . The information read-out is performed by coherent detection where the weak quantum signal is mixed with an optically strong reference laser, the socalled local oscillator (LO), at a balanced beamsplitter. The difference in optical power at the output ports of the beamsplitter is then proportional to the quadrature I or Q, depending on the phase Θ of the LO: ∆P ∝ |α LO | (I cos Θ + Q sin Θ). The PIN diodes used for the power measurement can operate at high rates (up to ∼ 10 GHz) and are at the same time highly efficient and low-priced. This compares beneficially to avalanche photo diodes used in discrete-variable QKD which are both limited in the detection rate (by their dead time after a counting event) and quantum efficiency but are at the same time several times as expensive. Moreover, the facilitated integration of balanced detectors onto photonic chips crucially supports the miniaturisation of CV-QKD receivers for ubiquitous quantum-information applications.
The coherent-detection scheme requires for the signal laser and the LO to retain a stable and well-known frequency-and phase relation. One natural and simple way to provide for this requirement is to have the signal and the LO originate from the same laser source, as it was implemented in early realisations of CV-QKD [6][7][8][9]. This (often called 'self-homodyning' or 'in-line local oscillator') approach, however, requires for the LO to be jointly transmitted with the quantum signal which not only severely limits the total LO power available at the receiver (due to channel loss), but also disturbs the quantum-(and other DWDM) channels in the fibre. More importantly even, it opens grave security loopholes due to possible side-channel attacks that an eavesdropper can perform on the LO [10][11][12][13][14][15].
In order to provide for security of the key-exchange procedure and compatibility with telecom fibre infrastructure, it is therefore unavoidable to generate the LO locally at the receiver ('true local oscillator', or sometimes 'local local oscillator', LLO). Since in this scheme the signal and LO laser are mutually independent, the LLO scheme requires a phase-(and frequency) synchronisation to allow for coherent detection. As already widely established in classical communication, carrier-phase recovery does not necessarily require to adjust and lock the relative phase and frequency between the two lasers ahead of measurement. Instead, the measurement can be performed with an arbitrary relative phase, yielding a corresponding rotation of Bob's phase-space coordinates with respect to Alice's. If Bob has knowledge about the phase-and frequency difference between the two lasers, he can counter-rotate his coordinate axes post-measurement and reconcile his data with Alice's reference frame. In standard quadrature-amplitude modulation (QAM) used for telecommunication, the phase-and frequency correction is directly extracted from the data signal. Since in CV-QKD the quantum signal itself is too weak to allow for a precise phase-and frequency measurement, Alice will prepare a strong second signal, represented by a fixed and well-known point in phase space. Originating from the same laser as the quantum states, this reference signal carries all the frequency and phase information that Bob needs in order to estimate the phase-and frequency difference between his laser and Alice's. He will mix his local oscillator with the quantum and reference signal and measure the quadratures of both independently. The measurement of the reference signal allows him to monitor the phase drift over time and to apply the reverse rotation to the individual quantum measurements accordingly.
In recent demonstrations of the above method a time-multiplexed scheme was adopted, where strong reference pulses were temporally interleaved with the quantum signal [16][17][18]. Although straightforward to implement, this method comes with certain impairments. Firstly, in the time-multiplexing scheme the additional synchronization pulses will reduce the rate of the quantum signal since Alice needs to reserve periodic time slots in her pulse train for the reference signal. Secondly, the quadratures of the quantum signal are not measured at exactly the same time as the synchronisation quadratures, i.e. phase changes which are fast compared to the symbol rate will not be compensated. Finally, if the quantum-and the reference signal are measured with the same balanced receivers, the allowed optical power of the reference pulse is restricted by the saturation limit of the PIN diodes (which is usually very low for low-noise receivers as required for CV-QKD). On the other hand, routing of signal-and reference pulses to designated receivers respectively (lownoise for quantum, high-saturation limit for pilot) requires cumbersome and fast switching, when the two are multiplexed in the time degree of freedom only.
In addition to the sequential transmission of signaland reference pulses, Ref. [19] proposes a scheme based on modulation displacement, where each symbol encoded by Alice is added to a fixed and well-known offset in amplitude |∆| and phase θ ∆ . Therefore the transmitted coherent states are represented as |α = |I A |∆| cos θ ∆ + Q A |∆| sin θ ∆ ≡ |α A + ∆ where α A is a weak coherent state carrying the quantum information and the offset ∆ is a stronger coherent state carrying the phase reference. Bob performs simultaneous measurements on the states in the I-and Q-basis (in CV-QKD literature often referred to as 'heterodyne' measurement) and extracts the phase estimation from the displacement of Alice's modulation. Unlike the methods based on time-multiplexing, in this approach the accuracy of the phase estimation is not independent from the modulation variance (since a higher amplitude of the quantum signal will, paradoxically, reduce the SNR of the offset-phase measurement). Moreover, this scheme suffers from the trade-off that the balanced re-ceivers have to operate at low electronic noise (required for CV-QKD security) but at the same time need to have a sufficiently high saturation limit in order to allow for an accurate measurement of the strong offset state.
Starting in 2016, we've been demonstrating that multiplexing of the quantum signal and a pilot tone in the polarisation-and frequency domain [20][21][22] is a promising alternative to sequential modulation of reference pulses. In 2017, a second group demonstrated the advantages of frequency multiplexing [23], however without exploiting the polarisation degree of freedom and without optical suppression of the pilot carrier. In their setup, the frequency-upconverted quantum signal and pilot tone were of the same polarisation and detected using one and the same balanced heterodyne receiver. (Note the different meaning of the term 'heterodyne' in the terminology of telecommunications (data out of baseband) and CV-QKD (simultaneous measurement of both bases). In this article we adhere to the telecom jargon.) In this work we present a complete pilot-assisted coherent intradyne reception methodology (frequency offset between transmitter laser and LO much smaller than the symbol rate, baseband detection of quantum data) in which an optically phase-locked reference tone is multiplexed to the actual quantum signal in both, modulation frequency and polarisation. The quantum signal is generated using quadrature-phaseshift-keying (QPSK) at a symbol rate of R sym = 250 Mbaud; the pilot tone was generated using carrier-suppressed optical single-sideband modulation at f P = 1 GHz. As opposed to Ref. [23], the exploitation of the polarisation degree of freedom allows us to (1) efficiently avoid crosstalk of the strong pilot to the weak quantum signal, (2) perform adequate power-levelling of signal and pilot as well as (3) the use of optimised receivers, accounting for the particular requirements of the weak quantum signal and strong pilot tone, respectively. Moreover, our intradyne-reception architecture can be operated at a much lower sampling rate compared to schemes based heterodyne detection.

Pilot-Tone Assisted Continuous-Variables Detection Scheme with Local Oscillator at Receiver
The experimental transmitter setup is illustrated in Fig. 1. The optical carrier at λ T = 1550.12 nm with a linewidth of 400 kHz (Teraxion PS-LM ) was amplitude-modulated from continuous wave to 250 MHz pulses using a Mach-Zehnder pulse carver (Optilab IML-1550-40-PM ) and, subsequently, fed into a polarisation-multiplexing ('PolMux') IQ modulator (Fujitsu FTM1977HQA). The PolMux allows for independent modulation of the orthogonally polarised pilot tone and quantum signal, preserving their locked frequency and phase relation. Modulation of the quantum tributary yielded a QPSK signal at a symbol rate of R sym = 250 Mbaud. The pilot tone was modulated with a f P = 1 GHz cosine function, representing a fixed symbol, static in phase space. The quantum-and pilot modulators were controlled by an arbitrary-waveform generator (AWG, Keysight M9502A). For preparation of the pilot we performed single-sideband modulation with suppressed optical carrier (oCS-SSB). Figure 2(a) illustrates the frequency spectrum of the pilot tone after SSB with and without carrier suppression. In order to ensure security of the protocol, the quantum signal is supposed to be sufficiently weak (depending on the channel length and noise level: n ∼ 0.1-10). On the other hand, the pilot tone is required to be as strong as possible to allow for an accurate phase measurement. Therefore, we performed a polarisation-dependent attenuation, reducing the optical power of the quantum signal by −23 dB with respect to the pilot tone. This power levelling between pilot and data signal was performed while preserving optical phase locking and facilitated through selective attenuation on the polarisation tributaries using a polarisation controller and a fibre-based polarization beamsplitter. Using a monitor in the reflected path (ρ in Fig. 2(b)), the optical pilot power at 1 GHz is suppressed in order to maximise the pilot (π) and, at the same time, attenuate the quantum signal (τ ) at the output port. The inset in Fig. 2 shows the eye diagram of the QPSK quantum signal with the characteristic dips. The receiver setup is illustrated in Fig. 3. An optically free-running local oscillator (LO, Teraxion PS-NLL) with a narrow linewidth of ∆f < 100 kHz and a power of 12 dBm was used for coherent optical detection. Manual frequency alignment between f T and f LO was performed by current-and temperature-tuning in order to ensure an optical-frequency deviation much smaller than the symbol rate of the quantum data |f T − f LO | < R sym . Coherent intradyne reception of both tributaries was performed by use of a polarisationdiversity 90°hybrid (Kylia COH28-X ) which mixed the quantum signal and pilot tone with the local oscillator and routed them to their designated balanced detectors. Two pairs of balanced detectors (one for each quadrature component of quantum signal and pilot) were used for opto-electronic signal conversion, each pair tailored to the specific needs of the respective signal tributary: The quantum data was detected using low-noise receivers with a bandwidth of 360 MHz, a clearance of 20 dB (Fig. 3(b)) and a common-mode rejection ratio (CMRR) of ∼ 40 dB (Fig. 3(c)), allowing for low excess noise and therefore a higher secure-key rate. A set of high-bandwidth (> 1 GHz) PIN/TIA receivers (Fig. 3(c)) was chosen for the stronger and therefore more robust pilot tone which requires a larger bandwidth and optical saturation limit but can, in return, tolerate more noise than measurements of the quantum signal since the pilot itself is not securitysensitive to eavesdropping attacks. Subsequently, the electrical I/Q signals were post-amplified, acquired in blocks of 2 20 samples (≈ 1.05 megasamples) by a real-time oscilloscope (Agilent Technologies DSO-X 91604A) and fed to offline digital signal processing (DSP).
The individual DSP steps are illustrated in Fig. 4. The first step consists of signal conditioning by means of spectral filtering of noise in the excess base-and pass-bandwidth. The frequency offset between LO (f LO ) and transmitter emission wavelength (f T ) was estimated by comparison of detected and nominal pilot frequency and subsequently corrected. Next, a carrierphase recovery was performed. For this purpose the optical phase drift between the transmitted signal and the LO was quantified by the rotation of the received pilot tone in phase space. Since the quantum signal was optically phase-locked to the pilot and had therefore experienced the same phase changes, the measured I/Q quadratures could be corrected using the rotation of the pilot tone which had been robustly acquired at high signal-to-noise ratio. Finally, a CV-QKD parameter estimation was performed on the recovered quantum QPSK data to determine the excess noise and, therefore, the quality of the pilot scheme.

Continuous-Variable Key-Transmission Performance
The experiment was conducted over four different channel lengths using standard single-mode fibres of total length 1 km, 4 km, 13 km and 40 km, respectively. The first three channels were simulated by fibre spools in the lab, the latter one was provided by a 40 km deployed fibre in the city of Vienna. Figure 5(a) illustrates the observed phase drifts, with peak-drift rates of up to 6.9 rads/µs, that were corrected post-measurement. A phase-space illustration of the results before and after digital signal processing is found in Fig. 5(b).
In order to evaluate the performance of our pilottone concept, we performed the calibration of our measurements as well as the parameter estimation along the lines of Ref. [5]. As primary indicator of the experimental quality we investigated the excess noise ξ, i.e. the quadrature variance in addition to the obligatory quantum shot noise. We define the excess noise referring to the receiver's input port (as opposed to the transmitter), such that the total quadrature variance at Bob is represented as where T is the total channel transmittance, V mod is the modulation variance as applied by Alice (equal to twice the mean photon number per symbol) and N 0 is the quantum shot noise (N 0 = 1 in shot-noise units, SNU). (Note that in our notation the total excess noise comprises the electronic noise of the detectors, in literature often labelled as ν el .) Since we performed simultaneous measurement of I and Q, we split the incoming signal into two arms, one for each quadrature basis. The variance in each arm is therefore For the pilot tone, we performed optical single-sideband modulation with suppressed carrier, driven by a 1 GHz cosine function (see Fig. 2(a)). After recombination of the two branches under orthogonal polarisation, the quantum signal was attenuated (see Fig. 2(b)) to adhere to the security requirements of CV-QKD while at the same time retaining a strong pilot amplitude to allow for a high SNR, as required for accurate phase recovery.
(a) (b)   In this way, the relative phase drift is estimated and applied to compensate the frequency offset and the phase drift of the quantum data. The original QPSK data can be recovered with good quality, as evidenced by the distinguishable constellation points.
where we doubled the electronic detection noise of each basis (ξ det = 2ξ det ) before integration into the total excess noise ξ such that Eq. (2) holds. In contrast to the total variance above, the conditional variance V B|A relates Bob's measurement results to the symbols modulated by Alice (and therefore requires for Alice or Bob to disclose a certain fraction of their data). In general, it is represented as (here in the I-basis) In a discrete-modulation alphabet (like QPSK) V B|A is simply the variance of all measurements that have been associated to one and the same symbol during the bit disclosure. Since the conditional variance in each basis is V B|A = N 0 + ξ/2 SNU = 1 + ξ/2, the excess noise could be computed using As another key parameter, the signal-to-noise ratio (SNR), was determined using Table 1 summarises the numeric experimental results over four distances using optical carrier-suppressed single sideband modulation (oCS-SSB) of the pilot, processing 2 20 samples (≈ 1.05 megasamples) for each measurement. In order to find the proper conversion of our measurements from voltages to shot-noise units, we performed a sample of calibration measurements (eight shot-noise measurements and four measurements of the electronic noise). Table 1 lists the noise results for the case where the conversion was performed using the averaged calibration measurements as well as the results that we obtained when we, pessimistically, only used the one calibration measurement that yielded the highest conditional variance, and hence the largest excess noise ξ. Moreover, for both calibration approaches, we list the total measured excess noise as well as the excess noise excluding the intrinsic detection noise of the balanced receivers ξ det . This is relevant for the relaxed assumption that the receivers in Bob's lab are regarded as trusted devices and therefore do not contribute to Eve's information. As indicated by the  Fig. 6. This noise disparity indicates the limitations of oSSB without suppressed carrier where a non-zero frequency offset ∆f between the receiver (LO) and the strong optical carrier of the pilot causes a detrimental beat note in the low-frequency regime. Note that the numeric excessnoise results listed in Table 1 refer to input port of the receiver R, i.e. ξ := ξ RX = T ξ T X = 2ξ , where RX and T X denote receiver and transmitter, and ξ is the measured excess noise in one of the two bases, I and Q.
For the sake of comparison, a self-homodyne reception scheme has been evaluated as well. For this purpose the optical carrier of the transmitter was reused as LO for coherent optical detection at the receiver side rather than using an independent, local LO. Comparing the self-homodyning results with the ones obtained using our pilot-assisted intradyne-detection scheme with suppressed optical carrier, we observed no penalty whatsoever in terms of excess noise.
Our results indicate that the novel method of polarisation-and frequency multiplexing allows for higher symbol rates and, at the same time, lower excess noise compared to the currently more established time-multiplexing schemes [16][17][18]. The method was demonstrated for QPSK modulation of the quantum signal but can, however, be implemented just as well for any modulation alphabet, including continuous Gaussian modulation for which the security analysis is understood best. The estimated final secure-key rate depends on several additional parameters which are beyond scope of this local-LO demonstration: the reconciliation efficiency β, the frame-error rate FER, the fraction of the raw key ν that has to be disclosed during parameter estimation, the effects of finite blocklengths, and finally, the actual modulation alphabet that is used in the respective implementation of the scheme. To give an example, assuming β = 0.97, FER = 0.05, ν = 0.25, Gaussian modulation, coherent attacks, relaxed security assumptions (detection noise not attributed to Eve) and averaged calibration, our experimental parameters obtained for the 40 km deployed fibre (R sym = 250 Mbaud, V mod = 12.5, SNR = 0.62, ξ tot = 0.026, ξ tot − ξ det = 0.0047) correspond to an asymptotic secure-key rate of 3.0 Mbits/s over 40 km.

Conclusion
We reported a novel reception method for CV-QKD with a free-running true local oscillator. We used a pilot tone of strong optical amplitude, multiplexed in frequency and polarisation to the quantum data, to establish the necessary phase reference. Experimental evaluation with a symbol rate of 250 Mbaud and over a transmission distance of up to 40 km yielded a low excess noise, confirming the robustness of the method. Not only closes our scheme the security loophole opened by a transmitted LO -the novel approach of polarisation-and frequency multiplexing furthermore allows for higher symbol rates compared to timemultiplexing methods and for the deployment of optimised detectors for the quantum signal (low noise)    Table 1: Measurement results after raw-key transmission over four channel lengths. The amount of excess noise that is attributed to the eavesdropper depends not only on whether one operates under the trusted-detector assumption (ξ Eve = ξtot − ξ det ), but also on the way the calibration is performed: For the averaged calibration we used the mean of all the calibration measurements, for the worst-case calibration we only used the most disadvantageous one. The noise results indicate a strong advantage of optical carrier suppression over SSB without suppressed carrier (two bottom lines). Note that all excess-noise figures describe the quadrature variance in addition to the shot noise at the receiver side and that the measured excess noise in each basis is ξ/2. Figure 6: Illustration of the measured excess noise at optical single-sideband modulation with suppressed optical carrier (green) and oSSB without carrier suppression (blue). The lower diamonds describe the noise results after averaged calibration, the upper ones represent the noise of the same measurement, but under worst-case calibration. The red area on the bottom represents the measured detection noise which can, under relaxed security assumptions, be regarded as trusted noise. In this case the noise attributed to an eavesdropper is ξtot − ξ det (right axis).
and pilot (high bandwidth and saturation limit), respectively. Moreover, the cross-polarised preparation of signal and pilot tone as well as the suppression of the optical pilot carrier proved to be efficient methods to avoid crosstalk from the strong reference signal to the quantum channel. The raw-key transfer could be performed at a low-noise level, introducing no noise penalty with respect to inherently phase-stabilised selfhomodyning. Due to the demonstrated advantages, we believe that the proposed pilot-tone scheme is a promising candidate for any future implementation of highperformance CV-QKD transceivers.