Generating k EPR-pairs from an n -party resource state

Motivated by quantum network applications over classical channels, we initiate the study of n -party resource states from which LOCC protocols can create EPR-pairs between any k disjoint pairs of parties. We give constructions of such states where k is not too far from the optimal n/ 2 while the individual parties need to hold only a constant number of qubits. In the special case when each party holds only one qubit, we describe a family of n -qubit states with k proportional to log n based on Reed-Muller codes, as well as small numerically found examples for k = 2 and k = 3 . We also prove some lower bounds, for example showing that if k = n/ 2 then the parties must have at least Ω(log log n ) qubits each.


Introduction 1.Generating EPR-pairs from a resource state
Quantum communication networks combine several quantum computers to enable them to solve interesting tasks from cryptography, communication complexity, distributed computing etc. Building a large-scale quantum communication network is a daunting task that will take many years, but networks with a few small quantum computers are under construction and may start to appear in the next few years [36].These networks are either based on channels that physically communicate quantum states, or rely on classical communication in tandem with shared entanglement, or a combination of both.Communication over classical channels cannot increase entanglement, so in the absence of quantum channels we have to rely on prior entangled states.For example, if two parties share an EPR-pair, 1 √ 2 (|00⟩ + |11⟩), then one party can transmit ("teleport") a qubit to the other via two classical bits of communication, consuming the EPR-pair in the process [4].If we want to enable many qubits to be sent in this way, then we could start with an entangled state where each pair among the n parties shares its own EPR-pair.This would allow any pair to exchange a qubit, but would require us to start with a rather large initial entangled state of n 2 EPR-pairs, and each of the n parties would need to hold n − 1 qubits (see Figure 1 for n = 4).
is 1-pairable: in order to obtain an EPR-pair between two parties Alice and Bob, the other n − 2 parties can measure their qubit in the Hadamard basis and communicate the classical measurement outcomes to Alice and Bob, who convert their remaining 2-qubit state into an EPR-pair if one of them (say Alice) does a Z-gate conditioned on the parity of the n − 2 bits they received.

| ⟩ 𝜓
Figure 2: A cartoon illustrating k-pairability.An entangled resource state ψ is initially distributed among n parties.The parties can implement an arbitary LOCC protocol, that is, any local quantum operations and classical communication.The resource state |ψ⟩ is called k-pairable if for any selection of k disjoint pairs of parties, there exists an LOCC protocol converting |ψ⟩ to a collection of EPR-pairs shared by the selected pairs of parties.In this example k = 2 and n = 4.The final EPR-pairs are indicated by solid arcs connecting the parties.Arrows indicate LOCC protocols converting |ψ⟩ to the three possible desired final states, which correspond to the three possible ways of partitioning the n = 4 vertices into k = 2 disjoint pairs.Our goal is to maximize the pairability parameter k while keeping the number of qubits per party as small as possible.
The GHZ-example has the minimal possible 1 qubit per party, but unfortunately k is only 1 there: we can only create 1 EPR-pair.We are interested in resource states that are k-pairable for larger k ≤ n/2.We give both upper and lower bounds for k-pairability, considering both the situation where we allow m > 1 qubits per party (but not too many), and the situation where we insist that each of the n parties has only the minimal m = 1 qubits.
For k > 1 it is important to note that our definition of k-pairability requires the k pairs to be disjoint, and does not allow overlapping pairs.The main reason for this is that allowing k overlapping pairs would in particular require us to be able to create a star graph of EPRpairs, where one party shares EPR-pairs with k other parties.This can only happen if that one party holds at least k qubits. 1 This lower bound m ≥ k would rule out the constructions we have where m is much smaller than k (for example, m = 1 vs k = Ω(log n) in Section 3).The k-pairability problem with m ≪ k is interesting from the practical standpoint since qubits, especially error-corrected logical qubits, built on top of multiple physical qubits, are expensive and we would prefer to have n-party k-pairable resource states with as few qubits per party as possible.

Motivation
Multi-party resource states are foundational for tasks such as distributed quantum computing [33,32,28], quantum secret sharing [24,28], and multi-party quantum protocols [12,19].One of the most utilized resources in quantum networking is EPR-pairs shared between two parties.Our model aims to capture scenarios involving multiple parties, where it is not known in advance between which parties the quantum resources should be deployed.This situation is similar to a call center, which must dynamically manage incoming calls.Our study concentrates on developing resource states that provide the flexibility to determine the call/connection structure after the resource state has been created.
Imagine for instance a scenario where multiple government agencies need to communicate securely and share sensitive information.The agencies are interconnected in a network where the communication partners may vary depending on the situation.Similarly, a decentralized banking system might use quantum cryptography to secure transactions between multiple parties, ensuring that financial operations remain secure even as the network of participants changes, mirroring fluctuating market conditions.It is important to develop multi-party quantum resource states that can enable secure, flexible quantum communication systems over classical channels, allowing these agencies to establish secure communication channels dynamically, similar to switching call connections based on priority and need.
In this theoretical work we use several simplifying assumptions, most notably that EPR-pairs suffice as the primary resource required for applications.The interesting follow-up work [11,10], discussed at the end of this section, subsequently removed this assumption.

Our results 1: constructions of k-pairable resource states
In Section 2 we first study k-pairable resource states where each of the n parties is allowed to have O(1) qubits (hence |ψ⟩ will have O(n) qubits in total).We show that we can make k as large as n/polylog(n) while each party holds only 10 qubits.Roughly, the idea is to take a special kind of n-vertex expander graphs that guarantee existence of k edge-disjoint paths for any k disjoint pairs, let each edge in the graph correspond to an EPR-pair, and create the k desired EPR-pairs via entanglement-swapping along the edge-disjoint paths.If we allow m = O(log n) qubits per party instead of m = O(1), then we can construct k-pairable resource states with k = n/2, meaning that from our fixed resource state we can create EPR-pairs across any perfect matching of the n parties into disjoint pairs. 2 This result essentially requires only classical off-the-shelf routing arguments.
Since qubits are expensive, especially when lots of error-correction is needed to protect them, we also look at what is possible when each party holds only 1 qubit, which is of course the bare minimum.In this case, we construct n-party (which in this case is the same as n-qubit) resource states for the case k = 1 for arbitrary n (this corresponds to the GHZ-state).For k ≥ 2 it is not clear that k-pairability is a property monotone in n.What we have is that k-pairable states exist for k = 2 for n = 16 and higher powers of 2 (we also give numerical evidence for the existence of a 2-pairable state on n = 10 qubits); for k = 3 for n = 32 and higher powers of 2; and for arbitrary k for n = 2 3k and higher powers of 2. These resource states will be superpositions over the codewords in a Reed-Muller code, and we use the stabilizer formalism to design LOCC protocols for obtaining the desired k EPR-pairs from the resource state.Our construction is efficient in the sense that all steps in the LOCC protocol can be computed in time poly(n).To prove correctness of the protocol we reduce the problem of EPR-pair generation to a version of the polynomial regression problem: constructing a multi-variate F 2 -valued polynomial of fixed degree that takes prescribed values at a given set of points.One of our main technical contributions is developing tools for solving a particular family of such polynomial regression problems.
Our protocols for generating EPR-pairs can be made fault-tolerant if each party encodes their m qubits by some stabilizer-type quantum code [21].Importantly, the encoded versions of our protocols only require logical Clifford gates and Pauli measurements.These operations can be implemented transversally for many stabilizer codes, such as for instance the color codes of [6].Thus our protocols are well-suited for networks of small fault-tolerant quantum computers and applications that require fast communication of qubits between k arbitrary pairs of network nodes.A summary of our protocols can be found in Figure 3.

Our results 2: obstructions
Next we look at obstructions, namely lower bounds on the achievable tradeoff between n, k, and m.First consider the case where we can pair up any k = n/2 disjoint pairs.An ideal resource state would allow us to do this (i.e., be n/2-pairable) with only m = 1 qubits per party.As mentioned above, we have shown that k-pairability with only 1 qubit per party is indeed achievable if k ≪ n/2, but in Section 4 we show it is not achievable if k = n/2: in that case m = Ω(log log n) qubits per party are needed.The proof is by an intricate dimensioncounting argument, which gives upper and lower bounds on the dimension of the space of states that can be reached (with non-zero probability) by LOCC protocols on a fixed nm-qubit resource state |ψ⟩.In Section 5 we extend this approach to the case of partial pairings, so where then k can be at most O n log log n log n = o(n), so achieving something close to complete pairability (i.e., k = Ω(n)) requires a super-constant number of qubits per party.Up to the power of the polylog, this matches our construction of k-pairable states with k = n/polylog(n) and m = 10 and uses entanglement-swapping (see the proof of Lemma 1) to link up the k pairs as desired.This (2n − 2)qubit state is k-pairable for the maximal k = n/2, and n − 1 parties hold the minimal 1 qubit.However, the central party holds n − 1 qubits and has to do all the work in obtaining the k-pairing.In the spirit of the small quantum networks of small quantum computers that we'll have in the near and medium-term future, we prefer constructions where none of the parties needs to hold many qubits.The last row shows the pairability parameter k-the number of EPR-pairs that can be generated by LOCC starting from the respective resource state.For simplicity, we ignore constant factors in the log (n) scaling and ignore minor restrictions on the number of parties n in certain cases, see Sections 2,3 for details.Our proof of k-pairability is analytic in all cases except for n = 10 and 32 where we provide only a computer-aided proof.
qubits per party (Section 1.3).We note here that our lower bounds apply to all possible LOCC-protocols, while our constructions are more lightweight, requiring only Pauli measurements and Clifford operations to create the k EPR-pairs from the n-party resource state.We consider it a good thing that our upper bounds need only fairly restricted operations, while our lower bounds apply even to the general model with more powerful operations.

Related and follow-up work
To the best of our knowledge, the problem of what resource states allow LOCC protocols to construct EPR-pairs between any k pairs of parties has not been studied before.However, we are aware of a number of related works, which we will briefly discuss here. 3These works can be organized into two categories.

Entanglement routing assisted by quantum communication.
Here some parties are allowed to exchange qubits in addition to performing LOCC on the initial resource state.
Schoute et al. [34] consider quantum networks where parties can create EPR-pairs with their immediate neighbors and then use entanglement-swapping combined with efficient routing algorithms to create desired long-distance entanglement.This differs from our approach in allowing the ability to create new EPR-pairs when needed (which requires quantum communication), while we allow only LOCC starting from one fixed entangled resource state.
Hahn, Pappa, and Eisert [23] also study a quite similar problem to ours, but starting from a network where some parties are linked via a quantum channel, while some other parties are not (directly) linked at all.In addition to efficiently generating EPR-pairs they also study generating GHZ-states between specified parties.
Pant et al. [31] study how a network whose nodes are connected via lossy optical links and have limited quantum processing capabilities, can obtain EPR-pairs simultaneously between many pairs of nodes; their limitations per node are analogous to our goal of having only few qubits per party, but they allow quantum communication while we allow only classical communication.

Restricted variants of k-pairability.
Here the parties are only allowed to perform LOCC on the initial resource state.The parties may be able to generate k EPR-pairs for some but not all choices of such pairs.Miguel-Ramiro, Pirker, and Dür [29] consider resource states interpolating between the two extreme cases discussed in our introduction: the GHZ state shared among n parties and n 2 EPR states shared between each pair of parties.This work proposed clustering and merging algorithms that produce resource states with the desired functionality.However, these methods do not appear to provide k-pairable resource states with few qubits per party.
Du, Shang, and Liu [16] study a problem similar to ours but starting from resource states that consist only of pre-shared EPR-pairs between adjacent parties in a given network.Like us, they use entanglement-swapping to create EPR-pairs between distant parties.
Contreras-Tejada, Palazuelos, and de Vicente [13] gave similar constructions as we gave in Section 2 (with EPR-pairs on the edges of an n-vertex graph), but focus primarily on the question for what type of graphs the long-range entanglement survives constant amounts of noise on the edges.
Illiano et al. [25] study 1-pairable states with the additional property that the identity of the one pair that ends up sharing an EPR-pair remains unknown to the other n − 2 parties (in fact one can get this easily from the n-party GHZ-state if the other parties broadcast their measurement outcomes to everyone rather than sending it only to the two parties that want an EPR-pair).
Meignant, Markham, and Grosshans [27] and Fischer and Townsley [18] studied what is roughly a partial "dual" of our problem: how many EPR-pairs between which parties of a given n-party network are necessary and sufficient to generate a classically given n-party graph state?Dahlberg, Helsen, and Wehner [15] show that it is NP-complete to decide whether a classically given n-party stabilizer state can be transformed into a set of EPR-pairs on specific qubits using only single-qubit Clifford operations, single-qubit Pauli measurements and classical communication (such protocols are more restricted than the LOCC we allow in our paper).They also give some algorithms to do the transformation in some special cases [14].
Follow-up work.
Our construction in Section 3 has m = 1 and k = Θ(log n), so the number of qubits it uses to achieve k-pairability with one qubit per party, scales as n = 2 Ω(k) .Claudet, Mhalla, and Perdrix [11] recently improved this exponential scaling to a polynomial one: they show the existence of k-pairable graph states with one qubit per party, using only n = O(k 3 (log k) 3 ) qubits (=parties).Their proof uses the probabilistic method, so is not as constructive as ours.However, very recently this was improved by Cautrèt, Claudet, Mhalla, Perdrix, Savin, and Thomassé [10] to a probabilistic proof with n = O(k 2 ) qubits and an explicit construction with n = O(k 4 ) qubits.

Constructions with multiple qubits per party
In this section we combine classical network-routing strategies and the standard entanglementswapping protocol to construct n-party k-pairable resource states with k nearly linear in n, such that each party holds at most m = O(1) qubits.Increasing the number of qubits per party from a constant to m = O(log n) yields maximally pairable resource states with k = n/2.
Suppose G = (V, E) is a graph with n vertices V = {1, 2, . . ., n}.Vertex i ∈ V represents the i-th party.We place two qubits at every edge (i, j) ∈ E such that in total there are n = 2|E| qubits.Define an n-party resource state where |Φ + i,j ⟩ is an EPR-pair located on edge (i, j).The state |ψ G ⟩ is shared among n parties such that the two qubits located on an edge (i, j) ∈ E are assigned to the parties i and j who share the EPR-pair |Φ + i,j ⟩.Thus each party shares one EPR-pair with each of its neighbors.Accordingly, each party holds at most d qubits, where d is the maximum vertex degree of G. Proof.Suppose Charlie shares an EPR-pair with Alice and another EPR-pair with Bob.The following well-known entanglement-swapping protocol uses LOCC to create an EPR-pair between Alice and Bob.First, Charlie measures the parity of his two qubits in the standard basis {|0⟩, |1⟩}, sends the 1-bit measurement outcome to Bob, and conditioned on it he applies a σ x (bitflip) on his second qubit and Bob applies a σ x to his qubit.This results in a 4-qubit GHZstate 1 √ 2 (|0000⟩ + |1111⟩).Now Charlie measures each of his two qubits in the Hadamard basis {|+⟩, |−⟩}, sends the parity of the two outcomes to Bob, who conditioned on that bit applies a σ z (phaseflip) to his qubit.It may be verified that now Alice and Bob share an EPR-pair.
The creation of the k EPR-pairs using the k edge-disjoint paths is now fairly straightforward: the parties on the path from a i to b i use the EPR-pairs with their neighbors on the path to create an EPR-pair between a i and b i via entanglement-swapping.Because the k paths are edge-disjoint, no edge (=EPR-pair) is used more than once.
Below it will be convenient to relax the edge-disjointness condition in Lemma 1 and consider pairability by nearly edge-disjoint paths.More precisely, suppose p ≥ 1 is an integer.Consider a resource state |ψ G ⟩ ⊗p such that each copy of |ψ G ⟩ is shared among n parties as specified above.Then each party holds at most pd qubits, where d is the maximum vertex degree of G.Each party shares p EPR-pairs with each of its neighbors.An immediate corollary of Lemma 1 is the following.

Corollary 2. The resource state |ψ
the graph G, there exist k paths P 1 , . . ., P k ⊆ E such that the path P i connects vertices {a i , b i } and each edge of G belongs to at most p paths.
To keep the number of qubits per party small, we would like the graph G to have a small vertex degree and, at the same time, allow vertex pairability by (nearly) edge-disjoint paths for any choice of k disjoint vertex pairs.We would like to maximize the pairability parameter k while keeping the vertex degree d as small as possible.Luckily, the problem of constructing such graphs has been already studied due to its importance for classical communication networks.A graph G = (V, E) is said to have edge expansion h if for any subset of vertices S ⊆ V with |S| ≤ |V |/2, the number of edges that have exactly one endpoint in S is at least h|S|.We shall use the following fact.
Fact 1 (Broder, Frieze, Upfal [7]).For any constants d ≥ 3 and h > 1 there exists a constant c > 0 such that the following is true.Suppose G is an n-vertex d-regular graph with edge expansion at least h.Then for any choice of k ≤ n/ log c (n) disjoint vertex pairs in G there exists a family of paths P 1 , . . ., P k connecting the chosen pairs of vertices such that every edge of G belongs to at most two paths.These paths can be found in time poly(n).
It is known [5] that d-regular graphs with edge expansion h > 1 exist for any constant d ≥ 5 and all large enough n.Thus Corollary 2 and Fact 1 imply that for all large enough n there exist k-pairable resource states with k = n/polylogn and at most 10 qubits per party.
Let us say that a graph G is path-pairable if the number of vertices n is even and the condition of Lemma 1 holds for k = n/2.We shall need the following fact stated as Corollary 2 in [22].
Combining Lemma 1 and Fact 2 we infer that m = O(log n) qubits per party suffices for complete pairings, in contrast with the naive resource state where every one of the n 2 pairs shares an EPR-pair and hence each party holds m = n − 1 qubits.Corollary 3.There exists a family of n-party (n/2)-pairable resource states with m = 18 log 18 (n) ≈ 4.3 log 2 (n) qubits per party.

Constructions that use only one qubit per party
In this section we study k-pairability of n-party quantum states under the most stringent restriction: each party holds only one qubit (obviously, k-pairability with k ≥ 1 is impossible if some party has no qubits).
We have already seen that the n-qubit GHZ-state shared by n parties is 1-pairable.Naively, one might think that the GHZ-example is already best-possible and k = 1 is as far as one can get with one qubit per party.Surprisingly, this naive intuition turns out to be wrong.Here we give examples of k-pairable states with one qubit per party for an arbitrary k.We choose the resource state |ψ⟩ as the uniform superposition of codewords of a suitable linear code C of codelength n.The GHZ-example To achieve k-pairability for k ≥ 2 we choose C as the Reed-Muller code RM(k − 1, m) with a suitable parameter m, see below for details. 4 The LOCC protocol converting |ψ⟩ to the desired EPR-pairs can be described by a pair of disjoint subsets X, Z ⊆ [n] such that all qubits contained in Z and X are measured in the standard basis {|0⟩, |1⟩} and the Hadamard basis {|+⟩, |−⟩} respectively.The protocol creates EPR-pairs on 2k qubits contained in the complement Finally, a Pauli correction σ x or σ z is applied to each EPR qubit a 1 , . . ., a k .The correction depends on the measurement outcomes and requires classical communication from parties in X ∪ Z to parties a 1 , . . ., a k .
Our construction is efficient in the sense that the subsets of qubits X and Z can be computed in time O(n) for any given choice of EPR qubits.Furthermore, the initial resource state |ψ⟩ can be prepared by a quantum circuit of size O(n 2 ).While describing the subsets X and Z is relatively simple, proving that the resulting LOCC protocol indeed generates the desired EPRpairs is considerably more complicated in the case k ≥ 2, as compared with the GHZ-example for k = 1.For resource states based on Reed-Muller codes RM(k − 1, m), we will see below that the proof can be reduced to solving a polynomial regression problem: constructing a polynomial f : F m 2 → F 2 of degree k − 1 whose values f (x) are fixed at a certain subset of points x.The number of qubits n = n(k) used by our construction is given by n(2) = 16, n(3) = 32, and n(k) = 2 3k for k ≥ 4 (note that the number of qubits is the same as the number of parties throughout this section).While this scaling n(k) may be far from optimal, the main value of our result is demonstrating that k-pairability with an arbitrary k is possible in principle even in the most restrictive setting with one qubit per party.To the best of our knowledge, this was not known prior to our work.We leave as an open question whether k-pairable states based on Reed-Muller codes can achieve a more favorable scaling n(k) = poly(k) or even the scaling n(k) = O(k polylog(k)) that can be achieved if we allow 10 qubits per party instead of 1 (end of Section 2).Such an improvement may require consideration of more general LOCC protocols that use all three types of Pauli measurements, in the σ x , σ y , σ z bases.
Finally, we describe a numerically-found example of a 10-qubit 2-pairable state with one qubit per party; this is more efficient than the 16-qubit 2-pairable state from the above results.This example is based on a stabilizer-type resource state and an LOCC protocol with Pauli measurements.We also show that no stabilizer state with n ≤ 9 qubits is 2-pairable using only Pauli measurements.In that sense our 10-qubit example is optimal.
The rest of this section is organized as follows.We introduce CSS-type resource states and give sufficient conditions for k-pairability of such states in Section 3.1.Reed-Muller codes and their basic properties are described in Section 3.2.We define resource states based on Reed-Muller codes and describe our LOCC protocol for generating EPR-pairs in Section 3.3.A proof of k-pairability for k = 2, 3, and for an arbitrary k is given in Sections 3.4, 3.5, and 3.6 respectively.Finally, we describe the 10-qubit 2-pairable example in Section 3.7.

Pairability of CSS stabilizer states
To describe our construction we need more notation.Let F n 2 = {0, 1} n be the n-dimensional vector space over F 2 .Given a vector f ∈ F n 2 and a bit index j, let f (j) ∈ {0, 1} be the j-th bit of f .We write f • g = n j=1 f (j)g(j) for the dot product of vectors f, g ∈ F n 2 .Unless stated otherwise, addition of binary vectors and the dot product are computed modulo two.The weight of a vector f ∈ F n 2 is the number of bits j such that f (j) = 1.A linear code of length n is simply a linear subspace 2 is some fixed vector.Suppose our n-qubit resource state |ψ⟩ has the form where C ⊆ F n 2 is a linear code.Such states are known as Calderbank-Shor-Steane (CSS) stabilizer states [9,35,8].It is well-known that the state |C⟩ can be prepared by a quantum circuit of size O(n 2 ) for any linear code C, see for instance [1].We begin by deriving a sufficient condition under which a CSS stabilizer state is k-pairable.Below we assume that each of the n parties holds only one qubit.

Lemma 4 (Pairability of CSS stabilizer states). Suppose C ⊆ F n
2 is a linear code.Suppose for any set of k disjoint pairs of qubits {a 1 , b 1 }, . . ., {a k , b k } there exists a partition of the n qubits into three disjoint subsets {1, 2, . . ., n} = EXZ (2) such that E = {a 1 , b 1 , . . ., a k , b k } and the following conditions hold for all i = 1, 2, . . ., k: Here and below we use shorthand set union notation XY ≡ X ∪ Y whenever X and Y are disjoint sets.The desired EPR-pairs can be generated in three steps.First, each qubit p ∈ Z is measured in the standard basis {|0⟩, |1⟩} and each qubit p ∈ X is measured in the Hadamard basis {+⟩, |−⟩}.Next, each party p ∈ XZ broadcasts their binary measurement outcome to a 1 , . . ., a k .Finally, a Pauli correction is applied to each qubit a i ; this may depend on the measurement outcomes.
Proof of Lemma 4. We assume some familiarity with the stabilizer formalism [9,20,30].Let σ x j and σ z j be single-qubit Pauli operators acting on the j-th qubit tensored with the identity on all other qubits.The resource state |C⟩ has Pauli stabilizers5 Thus we have σ x (f )|C⟩ = σ z ( f )|C⟩ = |C⟩.Suppose f and f obey conditions CSS1, CSS2 for some pair {a i , b i }.Let m p = ±1 be the measurement outcome on a qubit p ∈ XZ.Condition CSS1 implies that the stabilizer σ x (f ) commutes with Pauli operators σ z p on qubits p ∈ Z, which are measured in the standard basis.Thus σ x (f ) and {m p σ x p | p ∈ X} are stabilizers of the final state after the measurement.We infer that the final state is stabilized by Here the second equality follows from CSS1.Likewise, CSS2 implies that the stabilizer σ z ( f ) commutes with Pauli operators σ x p on qubits p ∈ X, which are measured in the Hadamard basis.Thus σ z ( f ) and {m p σ z p | p ∈ Z} are stabilizers of the final state.We infer that the final state is stabilized by Here the second equality follows from CSS2.This is only possible if the final state contains an EPR-pair on the qubits {a i , b i }, up to a Pauli correction σ x a i and/or σ z a i .The correction can be applied via LOCC if each party p ∈ XZ broadcasts their measurement outcome m p to all parties a 1 , . . ., a k .
Thus it suffices to show that for any k ≥ 1 one can choose a sufficiently large n and a linear code C ⊆ F n 2 that satisfies k-pairability conditions CSS1 and CSS2 of Lemma 4. Below we will choose C from the family of Reed-Muller codes [26] to achieve this.

Reed-Muller codes
First, let us record the definition and some basic properties of Reed-Muller codes.Let m ≥ 1 be an integer.A Boolean function f : F m 2 → F 2 can be considered as a binary vector of length n = 2 m which lists the function values f (x) for all inputs x ∈ F m 2 in some fixed (say, the lexicographic) order.For example, if m = 2 and f (x) = 1 + x 1 x 2 then we can consider f as a length-4 binary vector Reed-Muller code RM(r, m) has length n = 2 m and its codewords are the n-bit vectors associated with m-variate degree-r polynomials f : One can choose generators of RM(r, m) as a set of monomials j∈S x j where S runs over all subsets of [m] of size at most r.The monomial associated with the empty set S = ∅ is the constant-1 function.For example, RM(0, m) is the repetition code of length n = 2 m since there are only two degree-0 polynomials: f (x) ≡ 1 and f (x) ≡ 0. We shall use the following facts.
) is also a degree-r polynomial.The map f → f ′ is a bijection of the set of all m-variate degree-r polynomials.
For the proof of Facts 3, 4, 5, see e.g.Chapter 13 of [26].As a consequence of Fact 5, the resource state |C⟩ with C = RM(r, m) is invariant under a permutation of the n = 2 m qubits defined as Here φ : F m 2 → F m 2 is any invertible affine map.In other words, W φ |C⟩ = |C⟩.This generalizes the symmetry of the n-qubit GHZ-state which is invariant under any permutation of the n qubits.
Recall that minimum-weight codewords of a linear code are non-zero codewords whose weight equals the code distance.

Fact 6 (Codewords from affine subspaces). A vector
For the proof see, e.g., Proposition 2 and Corollary 4 in [3].We shall see that verification of conditions CSS1 and CSS2 of Lemma 4 with C = RM(r, m) can be reduced to (multiple instances of) the following problem.
Lemma 5.The polynomial regression problem has a solution f if at least one of the following conditions is satisfied: (1) s < 2 r+1 , or (2) s = 2 r+1 and s i=1 g i = 0.Here the sum s i=1 g i is evaluated modulo two.
Proof.RM(r, m) ⊥ = RM(m − r − 1, m) by Fact 4. The code RM(m − r − 1, m) has distance 2 r+1 , see Fact 3, and thus every 2 r+1 − 1 columns of its parity check matrix are linearly independent.The parity check matrix M of RM(m − r − 1, m) is the generator matrix of its dual, RM(r, m), so the above implies that if s < 2 r+1 , then the rank of the matrix M X formed by the columns of M with indices from X = {x 1 , . . ., x s } is s, so F X 2 is in the span of the rows of M X .If s = 2 r+1 , then the rank of M X is either 2 r+1 or 2 r+1 − 1.If 2 r+1 , we proceed as above.If 2 r+1 − 1, the only linear combination of the columns of M X that gives the zero-vector, is the sum of all columns of M X , and a vector (g 1 , . . ., g s ) ∈ F X 2 can be generated from the rows of M X if and only if s i=1 g i = 0 mod 2.

Resource state and LOCC protocol
Our candidate k-pairable state is a CSS stabilizer state |C⟩ with and a suitable parameter m = m(k).To describe the subsets of qubits X, Z ⊆ F m 2 satisfying conditions CSS1 and CSS2 of Lemma 4, we need one extra piece of notation.

Definition 1. Suppose S ⊆ F m
2 is a non-empty subset.An affine subspace spanned by S, denoted Aff(S), is defined as Thus Aff(S) contains all vectors that can be written as a sum of an odd number of vectors from S. Let n = 2 m be the number of qubits.Suppose our goal is to generate k EPR-pairs on pairs of qubits {a 1 , b 1 }, . . ., {a k , b k }.Define a subset of "EPR qubits" where c 1 , . . ., c k ∈ F m 2 are vectors that will be appropriately defined in Sections 3.4, 3.5, 3.6.The c-vectors may depend on the a's and b's.The set of EPR qubits E is obviously contained in the union of S 1 , . . ., S k .We choose the subsets of qubits X and Z in Lemma 4 as The subsets E, X, Z are pairwise disjoint and F m 2 = EXZ.We illustrate the relationships between these sets in Figure 4.In the GHZ-example one has k = 1 and , that is, the LOCC protocol requires only measurements in the Hadamard basis.In the rest of this section we prove that the vectors c 1 , . . ., c k in Eq. ( 6) can always be chosen such that the subsets X and Z satisfy conditions CSS1 and CSS2 of Lemma 4.     6).These subspaces are chosen such that S i ∩ E = {a i , b i } for all i.We choose X as the complement of EZ.A codeword f ∈ C ⊥ satisfying condition CSS2 for some pair of EPR qubits {a i , b i } is chosen as the characteristic function of the subspace S i , that is, f ( satisfying condition CSS1 is constructed using the polynomial regression, see Lemma 5.

2-pairability
We now need to show how to choose c 1 , . . ., c k .We begin with the simple case k = 2.
The assumption that c / ∈ E implies that the S i are 2-dimensional affine subspaces, and in particular, |S i | = 4 (i = 1, 2).We claim that Indeed, by definition, a i , b i ∈ S i .Suppose a 1 ∈ S 2 .Since all EPR qubits are distinct, the inclusion a 1 ∈ S 2 is only possible if a 1 = c or a 1 = a 2 + b 2 + c.In both cases c ∈ Aff(E), which contradicts the choice of c.Thus a 1 / ∈ S 2 .Applying the same arguments to a 2 , b 1 , b 2 proves Eq. ( 9).
Let us first check condition CSS2 with i = 1 (the same argument applies to i = 2).Choose for all v ∈ EX \ {a 1 , b 1 }, as claimed.This proves condition CSS2.
Let us check condition CSS1 with i = 1 (the same argument applies to i = 2).We can invoke Lemma 5 (polynomial regression) with r = 1 and s = 4 to show that there exists a degree-1 polynomial f : We can use condition (2) of Lemma 5 since s = 2 r+1 = 4.By definition, f is a codeword of We already know that f (a 2 ) = f (b 2 ) = 0 by Eq. ( 10).Since f is a degree-1 polynomial, one has there is an affine subspace S with co-dimension one, which contains Aff(E), but c ̸ ∈ S. Let g be the linear function that is 0 on S and 1 on S.
takes the same values as f , but h(c) = 0, and we apply the above argument for h instead of f .This proves CSS1.

3-pairability
In the case k = 3 we choose m = 5 and C = RM(2, 5).The resource state |C⟩ requires n = 32 qubits.We checked conditions CSS1 and CSS2 of Lemma 4 numerically using exhaustive search over all tuples of EPR qubits and all choices of vectors c 1 , c 2 , c 3 in the definition of subsets X and Z.It was observed that for any tuple {a 1 , b 1 , a 2 , b 2 , a 3 , b 3 } of EPR qubits, there exists at least one choice of the c-vectors such that X and Z obey conditions CSS1 and CSS2.The search space was pruned by exploiting the affine invariance of Reed-Muller codes, see Fact 5. Namely, choose any invertible affine map φ : F m 2 → F m 2 such that φ(a 1 ) = 0 m and φ(b 1 ) = 10 m−1 .Fact 5 implies that a permutation of the n = 2 m qubits described by φ is an automorphism of C. Thus this permutation of qubits leaves the resource state |C⟩ invariant and we can assume w.l.o.g. that a 1 = 0 m and b 1 = 10 m−1 .We also pruned the search over the c-vectors by imposing a constraint c 1 + c 2 + c 3 = 0 which is analogous to the constraint c 1 = c 2 used for k = 2.The remaining search over a 2 , b 2 , a 3 , b 3 took less than one hour on a laptop computer.Note that the affine invariance of Reed-Muller codes also implies that |RM(2, m)⟩ is 3-pairable for all m ≥ 5 since we can always apply an affine map φ as above such that φ(a i ) and φ(b i ) has nonzeros only on the first 5 bits.We note that the choice of parameters r = 2, m = 5 is minimal for 3-pairability of resource states |RM(r, m)⟩, as follows from a simple code distance argument. 6

k-pairability for an arbitrary k (and sufficiently large n)
In this section we prove that the resource state |RM(k − 1, m)⟩ is k-pairable for any k ≥ 2 and m ≥ 3k (note that the number of parties can be any n = 2 m ≥ 2 3k ).First let us exploit the affine invariance of Reed-Muller codes (Fact 5) to convert the set of EPR qubits a 1 , b 1 , . . ., a k , b k into a certain standard form.Choose a linear invertible map φ : F m 2 → F m 2 such that φ(a i ) and φ(b i ) have zeros on the first k bits for all i (recall that we label the n = 2 m qubits by m-bit strings).This is always possible for m ≥ 3k.Since the state |RM(k − 1, m)⟩ is invariant under the permutation of the n = 2 m qubit-labels associated with φ, we can replace a i , b i by φ(a i ) and φ(b i ).Accordingly, from now on we assume that a i and b i have zeros on the first k bits.The linear map φ can be computed in time O(m 3 ) using Gaussian elimination.In addition, we can assume that Indeed, to see this, suppose h ∈ F m 2 is a vector whose first k bits are zero, and none of the vectors a i + h or b i + h belongs to the set {0 m , a 1 + b 1 , . . ., a k + b k }.Using the affine invariance of Reed-Muller codes one can replace a i and b i by a i + h and b i + h.The new vectors a i , b i obey the extra condition Eq. ( 11).The number of bad hs (hs we should not pick) is at most (upper bounding the number of all possible differences between the two sets).The number of hs we can pick from (all those vectors starting with k 0s) is at least 2 2k .Now 2k(k + 1) < 2 2k (which holds for all k ≥ 2) gives the claimed property.Hence, from now on we assume Eq. (11).
We choose vectors c 1 , . . ., c k in Eq. ( 6) as the basis vectors of F m 2 such that the j-th bit of c j is 1 and all other bits of c j are 0, Thus the c-vectors are supported on the first k bits while all a-and b-vectors are supported only on the last m − k bits.Next we use Eqs.(6,7) to define the subsets of qubits X, Z ⊆ F m 2 to be measured in the Hadamard (X) and in the standard (Z) basis, respectively.For convenience, we restate the definitions of X, Z, and S i below.
It remains to prove that X and Z satisfy conditions CSS1, CSS2 of Lemma 4 with Below we shall use the following property.
Proposition 7. The affine subspace S i is k-dimensional and obeys Proof.We have |S i | = 2 k since all c-vectors are linearly independent and have zeros on the last m − k bits, while a i , b i have zeros on the first k bits and Let us check Eq. (13).By definition, S i contains both a i and b i .Suppose i ̸ = j and a j ∈ S i .Then a j is an odd linear combination of vectors {a i , b i , c 1 , c 2 , . . ., c k } \ {c i }.Recall that the last m − k bits of all c-vectors are zero and the first k bits of all a-and b-vectors are zero.Thus a j must be an odd linear combination of vectors a i and b i only.This is only possible if a j = a i or a j = b i .However, we assumed that all EPR qubits a 1 , b 1 , . . ., a k , b k are distinct.Thus a j / ∈ S i .The same argument shows that b j / ∈ S i .
First let us check condition CSS2 with i = 1 (the same argument works for any i).Choose a function f : This proves condition CSS2.
Checking condition CSS1 requires more technical work, and we strongly encourage the reader to first study the proof of a quite general special case in Appendix A, which is much simpler.
As before, we can focus on the case i = 1 (the same argument works for any i).Then condition CSS1 is equivalent to the existence of a degree-(k − 1) polynomial f : Any degree-(k − 1) polynomial f : F m 2 → F 2 can be written as where f T : F m 2 → F 2 is some polynomial of degree k − 1 − |T | that depends only on the variables x k+1 , . . ., x m .It remains to choose the polynomials f T with 0 ≤ |T | ≤ k − 1.We shall use induction on |T | starting with T = ∅.At each induction step we shall use polynomial regression (Lemma 5) to argue that the desired polynomial f T exists (there is no need to construct f Proposition 8. Consider a function f (x) of the form Eq. (15), where the f T (x) are some functions that depend only on the variables x k+1 , . . ., x m .Then f (x) satisfies condition Eq. ( 14) iff: and for every ∅ ̸ = T ⊊ [k] and every x ∈ e(T ): Proof.CSS1 requires that f takes given values on S = S 1 ∪ . . .∪ S k , namely f (a 1 ) = f (b 1 ) = 1, and f must be zero on the rest of S. When we plug these input values into Eq.( 15), it is a straightforward calculation to see that Eq. ( 17) exactly says that f (a i ) = f (b i ) = 1 if and only if i = 1, and Eq. ( 18) exactly says that f (x) = 0 for all x ∈ S \ E.More precisely, Eq. ( 18) for some ∅ ̸ = T ⊊ [k] and x ∈ e(T ) expresses exactly f (y) = 0 for y = χ T + x ∈ S, where χ T is the characteristic vector of T .Eq. ( 16) was engineered so that the above y ranges over all of S \ E.
In the rest of the section we concentrate our efforts on finding a family {f T } T ⊊[k] of polynomials that satisfy Proposition 8. Below we focus on the case when k is even.The analysis for odd k requires only a few minor modifications, as detailed in Appendix B.
For fixed k, a i s and b i s we recursively (in the increasing size of |T |) construct f T , and inductively show that f T has the desired properties.To enable induction, we supplement Eqs.(17,18) with a few extra conditions on the polynomials f T .Let ℓ ≥ 0 be an integer.We will say that a family of polynomials f T : F m 2 → F 2 labeled by subsets T ⊊ [k] with |T | ≤ ℓ is valid if all conditions stated below are satisfied for |T | ≤ ℓ: for every non-empty set T ⊊ [k] and every x ∈ e(T ) Here (I1,I3,I4) are the conditions stated in Proposition 8 and (I2) ensures that a polynomial f (x) constructed from the family {f T } T ⊊[k] according to Eq. ( 15) has degree k − 1.Thus (I1,I2,I3,I4) alone imply CSS1.We shall use induction on ℓ to prove that a valid family of polynomials exists for all ℓ ≤ k − 1.The extra conditions (I5,I6,I7) facilitate analysis of the induction step.
The base case of the induction is ℓ = 0. Then a valid family is a single polynomial f ∅ .Condition (I2) demands that f ∅ has degree d T = k − 1. Conditions (I4) and (I5) can be skipped for T = ∅.Condition (I7) follows trivially from (I3).It remains to check (I3,I6) Note that conditions (I3) and (I6) with T = ∅ are imposed at disjoint set of points, see Eq. (11).Thus (I3) and (I6) are consistent.We fix the value of f ∅ at s = 2k points in (I3) if k ≤ 3, and at s = 3k + 1 points in (I3,I6) if k ≥ 4. We can show that the desired polynomial f ∅ exists using Lemma 5. Below we always apply the lemma to polynomials satisfying condition (I1).This is justified since the first k bits of all vectors a i and b i are zero.If k ≤ 3 then we have s = 2k ≤ 2 d T +1 = 2 k .Thus we can use part (2) of Lemma 5.The extra condition s i=1 g i = 0 of the lemma is satisfied since (I3) fixes the value of f ∅ to 1 at an even number of points.If k ≥ 4 then we have s = 3k + 1 < 2 d T +1 = 2 k and thus we can use part (1) of Lemma 5.
We shall now prove the induction step.Suppose we have already constructed a valid family of polynomials We set f T ≡ 0 to satisfy (I5).Then conditions (I2), (I6), (I7) are satisfied automatically.Condition (I3) can be skipped since ), (I5) can be skipped since |T | is even and T ̸ = ∅.We claim that (I7) follows from (I4).Indeed, we have x ∈ e(T ) iff x = a i or x = b i with i / ∈ T .We have ∈ T , as claimed in (I7).It remains to check (I4,I6).We fix the value of It remains to prove the induction step for ℓ = k − 1. Suppose we have already constructed a valid family of polynomials ) fixes the value of f T (x) at x = 0 m and at x = a i + b i .Since we want f T to be a constant function, it suffices to check that the desired values f T (0 m ) and f T (a i + b i ) are the same.Substituting the desired values from (I4), we have to check that The sum contains terms with Such terms vanish due to (I5).All terms f U with even |U | ≤ k − 4 vanish due to (I6).Thus we can restrict the sum Eq. ( 20) to terms with and Eq. ( 20) is equivalent to Since f U obeys (I7), we have f U (a i ) = f U (b i ), which implies Eq. ( 21).We have now verified (I4).This completes the proof of the induction step.Accordingly, having shown that both conditions CSS1 and CSS1 of Lemma 4 are satisfied, we can now conclude that the resource state |RM(k − 1, m)⟩ is k-pairable.

10-qubit 2-pairable example
The 2-pairable state of Section 3.4 used n = 16 qubits.Extending 2-pairability to states with fewer qubits would be good.Here we give a 10-qubit example and describe Pauli measurements generating k = 2 EPR-pairs for all choices of such pairs (modulo certain symmetries).
We choose the resource state |ψ⟩ as the graph state associated with the 10-vertex "wheel graph" shown in Figure 5: Here E is the set of graph edges and CZ is the controlled-Z gate.
The number of ways to choose two EPR-pairs {a 1 , b 1 } and {a 2 , b 2 } is 3 n 4 = 630 for n = 10 qubits.However, the number of cases we need to consider can be reduced by noting that the graph state |ψ⟩ is invariant under certain permutations of qubits and local Clifford operations.Suppose qubits are labeled by elements of the cyclic group Z 10 = {0, 1, . . ., 9}.Clearly, |ψ⟩ is invariant under the cyclic shift of qubits, j → j + 1 and inversion j → −j.Here and below qubit indexes are computed modulo 10.Consider a permutation φ : Z 10 → Z 10 such that φ(j) = 3j.Let W φ be the 10-qubit unitary that implements the permutation φ.We claim that where H is the Hadamard gate.Indeed, it is known [33] that the graph state |ψ⟩ has stabilizers Thus |ψ⟩ is also stabilized by It follows that H ⊗10 |ψ⟩ is stabilized by where i = φ −1 (j).Thus W † φ H ⊗10 |ψ⟩ is stabilized by S i for all i ∈ Z 10 , which implies Eq. ( 23).Since |ψ⟩ is also invariant under the cyclic shift of qubits, we can assume w.l.o.g. that a 1 = 0.The permutation φ maps 0 to 0 while any qubit b 1 ∈ Z 10 \ {0} can be mapped to either 1, or 2, or 5 by repeated applications of φ.Thus we can assume w.l.o.g. that a 1 = 0 and b 1 ∈ {1, 2, 5}.
For each of the remaining choices of EPR-pairs we numerically examined all 3 6 Pauli measurement bases on qubits Z 10 \ {a 1 , b 1 , a 2 , b 2 } and computed the final post-measurement state of qubits a 1 , b 1 , a 2 , b 2 using the standard stabilizer formalism.To test whether the final state is locally equivalent to the desired EPR-pairs, we checked whether the entanglement entropies of the final state obey S(a i ) = S(b i ) = 1 and S(a i b i ) = 0 for i = 1, 2. The entanglement entropy of a stabilizer state can be extracted from its tableaux as described in [17].Any two-qubit stabilizer state of qubits a i , b i satisfying S(a i ) = S(b i ) = 1 and S(a i b i ) = 0 has to be maximally entangled and thus equivalent to the EPR-pair modulo single-qubit Clifford gates.We found a Pauli basis generating maximally-entangled states on qubits {a 1 , b 1 } and {a 2 , b 2 } in all considered cases, see Figure 6.We also observed that the graph state |ψ⟩ is not 2-pairable if the Pauli bases are restricted to σ x and σ z only.
We verified numerically that no stabilizer state with n < 10 qubits is 2-pairable using LOCC protocols based on Pauli measurements, by checking all possible 9-qubit graph states as listed in [2].The code is available at https://github.com/yashsharma25/generating-k-epr-pairs Figure 6: Measurement patterns for the 10-qubit 2-pairable resource state associated with the "wheel graph".Here '1' and '2' stand for the EPR qubits {a 1 , b 1 } and {a 2 , b 2 } respectively.A qubit labeled by 'X', 'Y', or 'Z' is measured in the Pauli basis σ x , σ y , and σ z respectively.Here we only consider the case a 1 = 0 and b 1 ∈ {1, 2, 5}.All other cases can be obtained by a permutation of qubits that leaves the resource state invariant (modulo a bitwise Hadamard).

Obstructions for complete pairings (k = n/2)
Now we turn from constructions to proving limitations on all possible k-pairable resource states.
Let n be the number of parties as in the previous sections.Since we are talking about complete pairings in this section, we assume here that n is divisible by 2. For a pairing the tensor product |π⟩ of the n/2 EPR-pairs, For our first type of lower bounds we assume that the n parties want to achieve all possible complete pairings on [n].Then we find a super-constant lower bound on the required number m of qubits per party: Theorem 9. Suppose |ψ⟩ is a fixed state of nm qubits shared by n parties such that each party holds m qubits of |ψ⟩.Suppose that for any pairing π of n qubits a transformation |ψ⟩ → |π⟩ ⊗ |w π ⟩ is realizable by an LOCC protocol such that at the end of the protocol the i-th qubit of |π⟩ belongs to the i-th party for all i, and |w π ⟩ is an arbitrary state on the qubits not belonging to |π⟩. 7 Then m = Ω(log log n).
The proof of this theorem is going to be a dimension calculation, but with a twist.Given a starting state |ψ⟩ we estimate the dimension of the space that contains all those states that can be obtained (with positive probability) from |ψ⟩ by an LOCC protocol.We want to compare this with the dimension of the space induced by all possible states that should arise as output, where we let the input range over all possible pairings.This by itself, however, will not yield the desired lower bound.The mathematical idea is that rather than representing each state by itself, we represent it by its r th tensor power, where r will be carefully set in the magnitude of Θ(log n).Let L r = span( |π⟩ ⊗r | π is an n-qubit pairing ) be the linear space induced by the r th tensor powers of all possible output states.Before stating a lower bound on dim(L r ) we prove a lemma: Lemma 10.Let π and ρ be two pairings.Then ⟨π|ρ⟩ = 2 µ−n/2 , where µ is the number of cycles in π ∪ ρ, as a graph on vertex set [n].
Proof.Note that the graph π ∪ ρ (the union of the two perfect matchings π and ρ on the same vertex set [n]) is a collection of cycles.We have where Λ ⊆ {0, 1} n is the set of binary strings, corresponding to the vertex labeling λ of the graph π ∪ ρ such that for every {a i , b i } ∈ π we have λ(a i ) = λ(b i ), and for every In other words, the labeling λ must be constant on each connected component of π ∪ ρ.Therefore, We define an undirected graph G on V by Let us view each π ∈ V as a 1-1 map from A to B. Then (π, ρ) ∈ E(G) if and only if πρ −1 is a permutation on A with at least n/4 cycles.If we fix π, then as ρ varies, πρ −1 runs through all permutations of A = [n/2].Thus, every vertex of G has degree D, where D is the number of permutations of [n/2] having at least n/4 cycles.Let c(n, ℓ) be the unsigned Stirling numbers of the first kind.It is known that c(n, ℓ) is exactly the number of permutations of n elements with ℓ disjoint cycles.Thus The right-hand side above is at most Then, implying the existence of an independent set in G of size at least (n/4−1)!/2 n/2 by a well-known greedy argument: pick a vertex to add to the independent set, remove it and its ≤ D neighbors, and continue with the remaining graph.Using Stirling's formula to estimate the factorials, there is a Let I be an independent set in G of size n n/4 • 2 −Cn (we ignore rounding to an integer for simplicity).Define the linear space From now on we set r = C ′ + log 2 n, where Gershgorin's circle theorem implies, for any (complex) square matrix In order to apply this theorem, we compute for the π-row of our matrix G: Lemma 11 says that for any fixed state |ψ⟩, the possible outputs (over all input pairings π), when taking their r th tensor power with r = Θ(1) + log n, should span a space of dimension ≥ n Θ(log n) .
This number we have to compare with the dimension of the span of r th tensor powers of possible states that can be produced by an LOCC protocol from |ψ⟩.Although LOCC protocols may use unlimited classical communication, they cannot create new entanglement, so all entanglement in their final state is a local linear transformation of the entanglement that already existed in the starting state |ψ⟩.
When each party only possesses m qubits, where m is very small, the variety of states that an LOCC protocol can produce from |ψ⟩ is limited in the way we describe below.
To capture this limitation, notice that any LOCC protocol can be described by a completely positive trace-preserving (CPTP) map, with separable Kraus operators.It follows that for any pairing π there exists a product Kraus operator such that K π i maps m qubits to one qubit for all 1 ≤ i ≤ n and for all pairings π: where the K i are arbitrary operators mapping m qubits to one qubit (K i may depend on i), and |ψ⟩ is our fixed starting state.From Equations ( 25) and ( 24) we get the subspace inclusion L r ≤ M r and hence, using Lemma 11, for some C, C ′ > 0 we have dim(M C ′ +log 2 n ) ≥ n n/4 •2 −C .However, when m = o(log log n) this cannot be the case because of the following upper bound: Proof.Linear operators K i that map m qubits to one qubit can be considered as vectors in a complex space of dimension D = 2 m+1 (use the vectorized form of operators).Crucially, the tensor products K ⊗r i live in the symmetric subspace of C D ⊗r , which has dimension (this is where the big saving occurs: without the information that the vector is in the symmetric subspace, we would have to calculate with D r instead of the above expression, and would get only a trivial bound).It follows that operators of the form K ⊗r = K ⊗r 1 ⊗ • • • ⊗ K ⊗r n span a linear space of operators with dimension at most Thus states of the form (K|ψ⟩) ⊗r = K ⊗r |ψ⟩ ⊗r with a fixed |ψ⟩ span a linear space with dimension upper bounded by Equation (27).Substituting D = 2 m+1 , one gets the statement of the lemma.
It is now an easy calculation to show that with r = Θ(log n), the above lemma together with Lemma 11 gives This implies m = Ω(log log n) and concludes the proof of Theorem 9.

Obstructions for partial pairings
In this section we generalize the result of the previous section to partial pairings and show: Theorem 13.Let n be an integer, k ≤ n/2, and |ψ⟩ be a k-pairable state for n parties where each party has m qubits.Then Proof.For technical reasons we assume that n is divisible by 4. In the proof we also assume that k ≥ n/ log n, since otherwise there is nothing to prove: the expression in parentheses on the right-hand side is always larger than n/ log n.A k-pairing of [n] is We denote the set of k-partial pairings on [n] with Π n,k .As in the previous section, we assume that each party has m qubits, and one of these m is designated as the output qubit, which will hold a qubit of an EPR-pair at the end of the protocol whenever π involves the party in question.The goal is to be able to produce from some fixed initial nm-qubit resource state |ψ⟩, for all π ∈ Π n,k .We note that in the above tensor product the listing order of the qubits depends on π, and we list only the n qubits designated to be output bits.(We list even those designated output qubits of parties that are not covered by the current partial matching π, since they will participate in the output for other πs.)For the remaining n(m − 1) qubits, we assume w.l.o.g. that they end up in the |0⟩-state, and hence are not entangled with the rest.To achieve this the parties can set these qubits to |0⟩ by a local operation.
The proof is a slight variation of our proof for the complete-pairing case.There dim (M r ) was calculated, and similarly to the previous section this dimension upper bounds the dimension of The calculation is very similar to the case of complete pairings: 1. We will find n Θ(k) different πs such that their r th tensor powers, where r = Θ(log n), are linearly independent.(In the complete pairing case it was n Θ(n) different πs.) 2. Setting r = Θ(log n) is still the only reasonable choice.Further, the approach breaks down at m > log log n, so we will be satisfied with investigating m ≤ log log n.With the above parameters for r and m we have 2 m+1 + r − 1 = Θ(r), hence via Lemma 12 we have: 3. Similarly to our argument in the previous section, the dimension of L k,r must lower bound the dimension of 4. Combining 1 and 3, we get Θ(k log n) ≤ Θ(n • 2 m log log n), which implies Theorem 13.
Points 2-4 require no explanation as they just reiterate ideas of the previous section.However, we need to prove Point 1.
First we prove the analogue of Lemma 10 for partial pairings.
Lemma 14.Let π and ρ be two partial pairings with k pairs.Then where µ is the number of cycles in π ∪ ρ, as a graph on vertex set [n].
Proof.We have: where Λ ⊆ {0, 1} n is the set of binary strings, corresponding to the vertex labeling, λ, of the graph π ∪ ρ such that for every {a i , b i } ∈ π we have λ(a i ) = λ(b i ), and for every {a and furthermore every element of vertex set [n] that is not covered by both a π-edge and a ρ-edge (that is, elements not in (∪π) ∩ (∪ρ)) must get label 0. 8 Thus, only the cycles in π ∪ ρ can be labeled two ways, and no more than two ways, since the edges of π and ρ force the condition that all labels over the cycle must be either 0 or 1. (Paths cannot be labeled two ways as the label at their endpoint is fixed to 0.) This calculation of |Λ| gives the formula.
We let A = [n/2], B = [n/2 + 1, n] and define where the second inequality follows from k ≤ n/2.We again create a graph with: Note that G is again regular as in the previous section, since it is vertex-symmetric.Like before, we want to lower bound |V |/(D + 1) where D is the degree of a π ∈ V , which is then a lower bound on the size of a maximal independent set in G.In fact, for an arbitrary fixed π ∈ V we have: The formula for ⟨π|ρ⟩ comes from computing the inner product in the most straightforward way: we notice that both |π⟩ and |ρ⟩ have only two kinds of entries: 0 and 1/ √ 2 k .Then we just identify those entries where both |π⟩ and |ρ⟩ are non-zero and compute the number of such entries.
Let 2L i be the length of the cycle that goes through p i (all cycles have even length, because the edges alternate between π and ρ), and denote: The triplet (P, K, R) with one piece of additional information, which will be defined next, will determine ρ.The number of (P, K, R) triplets is 2 O(n) , since all three of P, K, R can be given as subsets of sets of size at most n (e.g., K is a subset of [n] due to K µ ≤ n).
Let us now understand the magnitude of the additional information9 that together with (P, K, R) determines ρ.It will turn out that this information is ck log n bits, where very crucially, c is less than 1 (in fact, c will be essentially 1/2).This implies an upper bound on D + 1, which in turn implies the following lower bound on the size of the largest independent set in G: Additional data that with (P, K, R) uniquely determines ρ, given that ρ is π's neighbor in G: We shall define an order e 1 , . . ., e k of edges of ρ.We will denote the B-endpoint of e i by q i .Before telling the order, note that the cycles in π ∪ ρ already have a natural order, modulo the (P, K, R) information, namely the i th cycle is the cycle that contains p i .To "extend" this order to the edges we introduce: 1.Among all edges of ρ those edges come earlier that are edges of some π ∪ ρ cycle.
2. If two edges both participate in a π ∪ ρ cycle, but these two cycles are different, then the edge comes first that belongs to an earlier cycle.
We need to tell how to order edges within the same cycle.Also, we need to tell how to order edges that do not belong to any cycle.

Ordering of edges of ρ that belong to a given cycle.
If the cycle is the i th cycle, we simply walk through the the cycle and order the ρ-edges as we encounter them.The walk-through starts from p i with a ρ-edge (which determines that in which orientation we follow the cycle).For instance, consider the first cycle.For this example notice that if e ℓ is a cycle-edge in π ∪ ρ, then {q ℓ − n/2, q ℓ } ∈ π belongs to the same cycle as e ℓ .We get: e 1 is the edge of ρ with A-endpoint p 1 e 2 is the edge of ρ with A-endpoint q 1 − n/2 e 3 is the edge of ρ with A-endpoint q 2 − n/2 Ordering of edges of ρ that do not belong to any cycle: These edges are simply ordered by the numerical value of their A-endpoints: edges with a smaller A-endpoint come earlier.
Let us now assume that Alice has to specify ρ to Bob.First Alice gives Bob the (P, K, R) triplet.Then she starts to tell Bob q 1 , q 2 , . ... (Recall, q i is the B-endpoint of e i .)Two remarkable observations lead to our conclusions.
1.Even though Alice only tells the B-endpoints to Bob, Bob will (recursively) figure out the A-endpoints as well.This is in fact trivial.For instance, the A-endpoint of e 1 is p 1 , which is known to Bob, since (P, K, R) is given to him, etc.When the last cycle is exhausted, Bob knows this (this is after K µ edges had been encountered-the total number of cycleedges; K µ in turn is given as the last element of the K-sequence), and from then on Bob relies on R to get the A-endpoints.
2. When Alice arrives at an edge that closes a π ∪ ρ cycle, she does not need to send the B-endpoint of this edge!It is simply p i + n/2, if the cycle was the i th cycle.In other words, it is the other endpoint of the edge of π incident to p i .Therefore, we just assume that Alice skips telling the B-endpoint of the last edge of every cycle.But how does Bob know that he has arrived at the last edge of the current cycle?He knows this, because the cycle lengths are encoded in K: the length of the i th cycle is K In summary, the information Alice gives to Bob besides (P, K, R) to identify ρ, is the q 1 , q 2 , . . .sequence, but crucially, completely leaving out from this sequence the B-endpoints of all the cycle-closing edges.We have µ cycle-closing edges.Describing any q ℓ takes log n bits, since q ℓ ∈ [n].Therefore: The number of bits Alice needs to send Bob to fully describe a ρ that creates µ cycles with π is: In conclusion, the number of different ρs that form µ cycles with π can be upper bounded by 2 O(n) n k−µ .To upper bound D, recall that µ is allowed to vary from k/2 to k, so D + 1 is upper bounded by ( k 2 + 1)2 O(n) n k/2 + 1.Thus, looking back at Eq. ( 28) and using that k ≤ n, there exists an independent set of size n k/2 2 −O(n) in G. Consequently, we can find a set of that many partial permutations such that if π ̸ = ρ belongs to this set, then the inner product of |π⟩ ⊗r and |ρ⟩ ⊗r is at most 2 −kr/2 .Setting r to be 2 log n (generously, in fact: we care only about the k ≥ n log log n log n case, hence the 2 O(n) factor becomes n o(k) ) and applying Gershgorin's circle theorem in the same fashion as in the proof of Lemma 11 in the previous section, we prove Point 1 and conclude the proof of Theorem 13.
Theorem 13 has the following consequence for the case where each party is restricted to a constant number of qubits: As mentioned in the introduction, up to the power of the polylog this matches our expanderbased construction of k-pairable states where m = 10 and k ≥ n/polylog(n) (Corollary 3).

Conclusion and future work
In this paper we initiated the study of n-party resource states from which LOCC protocols can create EPR-pairs between any k disjoint pairs of parties.These EPR-pairs then enable quantum communication over a classical channel via teleportation.Our focus was on the tradeoff between the number k of to-be-created EPR-pairs (which we want to be large) and the number m of qubits per party (which we want to be small).
This work leaves open several questions for future work: • Our constructions of k-pairable states may be far from optimal in various respects, and it would be interesting to improve them.For example, we already mentioned the followup papers [11,10] which for the case m = 1 reduced the exponential number of qubits n(k) = 2 Ω(k) of our Reed-Muller-based construction of k-pairable states to a polynomial dependence on k.The case m = 2 remains largely open for now, since two qubits per party is not enough to realize entanglement-swapping protocols on expander graphs, see Section 2. All our constructions are based on stabilizer-type resource states.Can one improve the tradeoff between k and m using more general resource states?Can one express the pairability parameter k in terms of some previously studied entanglement measures?
• Regarding lower bounds (obstructions), we showed in Section 4 that a resource state for complete pairings (n = k/2) requires m = Ω(log log n) qubits per party.Can we improve this lower bound to m = Ω(log n) qubits, matching the upper bound we obtained from expander graphs at the end of Section 2? Our lower bounds are actually for a stronger model, applying to LOCC protocols that produce the desired state with positive probability; there may be better upper bounds in this setting, and/or stronger lower bounds for LOCC protocols that are required to succeed with probability 1.
• How well do our resource states behave under noise?Contreras-Tejada, Palazuelos, and de Vicente [13] already proved some negative results here for the type of constructions we gave in Section 2 (with EPR-pairs on the edges of an n-vertex graph), showing that genuine multipartite entanglement only survives constant amounts of noise per edge if the graph has a lot of connectivity.
• We can ask a very similar classical question, where the classical analogue of an EPR-pair is a uniform bit shared between two parties and unknown to all others.Such shared secret bits can then be used for secure communication over public classical channels (via the one-time pad), similarly to how shared EPR-pairs can be used for secure quantum communication over public classical channels (via teleportation).We believe our techniques can be modified to obtain non-trivial results about the question: what classically correlated n-party resource states are necessary and sufficient for LOCC protocols (with public classical communication) to generate such secret shared bits between any k disjoint pairs of parties?One difference is that the straightforward classical analogue of the GHZ-state (a uniformly random bit known to all n parties) is not 1-pairable in this classical sense.A Constructing an f that satisfies condition CSS1, when all a i , b i are independent In this appendix we give a proof for a simpler but instructive special case of how we satisfy CSS1 in Section 3.6.The additional assumption of our special case is to suppose that a 1 , b 1 , . . ., a k , b k ∈ F m 2 are linearly independent.Let L be the linear subspace of F m 2 spanned by c 1 , . . ., c k and a 1 , b 1 , . . ., a k , b k (so in particular, m = 3k).Let x 1 , . . ., x m be (mod 2) variables.Then the above 3k vectors define 3k linear functions over L: every vector x ∈ L can be uniquely written as for some binary coefficients α i , β i , γ i that are functions of x = (x 1 , . . ., x m ).As such, all these functions are linear, since when writing down x + x ′ as above, we add the corresponding coefficients.In the sequel we shall create higher-degree polynomials over x 1 , . . ., x m from these linear functions (e.g., α 1 (x)β 1 (x) is a quadratic function).
Let S ≡ S 1 ∪ S 2 ∪ . . .∪ S k .Note that S ⊆ L. Condition CSS1 (with i = 1) asks for a degree-(k − 1) polynomial f such that f (a 1 ) = f (b 1 ) = 1 and f (x) = 0 for all x ∈ S \ {a 1 , b 1 }. ( Let us show that Eq. ( 29) is satisfied if we choose f as f (x) = (α 1 (x) + β 1 (x))g(x) (mod 2), (30) where The polynomial f defined in Eq. ( 30) has degree k, because α 1 (x) + β 1 (x) has degree 1 and g(x) has degree k − 1.However, we will see that the restriction of f onto S coincides with a degree-(k − 1) polynomial.First, we show that Indeed, extending the sum over M in Eq. ( 31) to all subsets M ⊆ [k] would give a function k j=1 (1+γ j (x)) which is zero mod 2 unless γ j (x) = 0 for all j.The missing monomial k j=1 γ j (x) associated with the subset M = [k] is zero unless γ j (x) = 1 for all j.
By definition of S j , any vector x ∈ S j can be written as a sum of an odd number of vectors from the set {a j , b j , c 1 , . . ., c k } \ {c j }.In particular, γ j (x) = 0 for any x ∈ S j .Thus the restriction of g(x) onto S is zero unless γ j (x) = 0 for all j.In the latter case one has x = a j or The entries are not hard to calculate, and to give a typical example we calculate the (1, 2)entry: There are 8 weight-1 strings of the last 8 bits, and 6 weight-2 strings of the first 4 bits.However, not all elements of the set {a 1 , b 1 , a 2 , . . ., b 4 } can be added to some element of the set {c 1 + c 2 , . . ., c 3 + c 4 }.For instance c 1 + c 2 + a 1 does not occur in EZ, as S 1 does not contain c 1 .It is easy to see that these bad combinations are half of all possible 8 • 6 = 48 combinations, hence we obtain 24 as the (1, 2)-entry of the table.

Consider now the polynomial
These conditions are identical to the ones given in Section 3.6, except for condition (I7) which is now imposed only for |T | ≤ k − 3. Below we assume that k is odd.As before, we shall use induction on ℓ to prove that a valid family of polynomials exists for all ℓ ≤ k − 1.
The base of induction is ℓ = 0. Then a valid family is a single polynomial f ∅ .The construction of f ∅ is identical to the one given in Section 3.6.
We shall now prove the induction step.(38) However, each term f V (0 m ) and f V (a i + b i ) is counted exactly two times: if V = T \ {p, q} then one can choose U = T \ {p} or U = T \ {q}.Since we do all arithmetic modulo two, this implies Eq. (38).Thus (I4) is satisfied.This completes the induction step for odd k.

Figure 3 :
Figure3: Informal summary of our constructions.We consider resource states of different type shared among n parties such that each party holds a fixed number of qubits, ranging between 1 and log (n).The last row shows the pairability parameter k-the number of EPR-pairs that can be generated by LOCC starting from the respective resource state.For simplicity, we ignore constant factors in the log (n) scaling and ignore minor restrictions on the number of parties n in certain cases, see Sections 2,3 for details.Our proof of k-pairability is analytic in all cases except for n = 10 and 32 where we provide only a computer-aided proof.

X
< l a t e x i t s h a 1 _ b a s e 6 4 = " 9 a d 5 i L b b n e I U 3 5 9 F 5 c d 6 d j 0 V r w c l n j u E P n M 8 f u F G M 5 A = = < / l a t e x i t > Z < l a t e x i t s h a 1 _ b a s e 6 4 = " U A e o + R 0 B k z u o Z I 5 S L 5 e W L w P w k h r J e r b d J a 8 G a z m y D X 7 D e v w C g m p 0 5 < / l a t e x i t > F m 2 = EZX < l a t e x i t s h a 1 _ b a s e 6 4 = " G t 7 p z E g 3 3 5 z + Z u d S 2 Z B Y 6 0 w t

Figure 4 :
Figure 4: Measurement pattern for the resource state |C⟩, where C = RM(k − 1, m) and C ⊥ = RM(m − k, m).We consider n = 2 m qubits.Each qubit is labeled by an m-bit string.Qubits are partitioned into three disjoint subsets, EXZ, where E = {a 1 , b 1 , . . ., a k , b k } is the set of EPR qubits, Z is the set of qubits measured in the standard basis {|0⟩, |1⟩} and X is the set of qubits measured in the Hadamard basis {|+⟩, |−⟩}.We choose Z = (S 1 ∪ . . .∪ S k ) \ E, where the S i are k-dimensional affine subspaces of F m2 , see Eq. (6).These subspaces are chosen such that S i ∩ E = {a i , b i } for all i.We choose X as the complement of EZ.A codeword f ∈ C ⊥ satisfying condition CSS2 for some pair of EPR qubits {a i , b i } is chosen as the characteristic function of the subspace S i , that is, f (x) = 1 if x ∈ S i and f (x) = 0 if x ∈ F m 2 \ S i .A codeword f ∈ Csatisfying condition CSS1 is constructed using the polynomial regression, seeLemma 5.

Figure 5 :
Figure 5: 10-vertex "wheel graph".The corresponding 10-qubit graph state is 2-pairable with one qubit per party (to avoid confusion: the center of the picture is not an 11th vertex).

Corollary 15 .
Let |ψ⟩ be a k-pairable state for n parties where each party has m = O(1) qubits.Then k = O n log log n log n .
One can easily check thatWhen w 4 (x) = 0 1 2 3 then g(x) mod 2 = 1 0 0 1 and that the polynomial f (x) = (x 5 + x 6 ) g(x) then takes values on EZ exactly as needed.(For instance, when w 4 = 3 and x ∈ EZ then x 5 + x 6 will always give zero, etc.)B Induction step of Section 3.6: modifications for odd kHere we extend the proof of k-pairability given in Section 3.6 to odd values of k.Suppose ℓ ≥ 0 is an integer.We say that a family of polynomials f T : F m 2 → F 2 labeled by subsets T ⊊ [k] with |T | ≤ ℓ is valid if it satisfies the following conditions.I1: f T depends only on the variables x k+1 , . . ., x mI2: f T has degree k − 1 − |T | I3: f ∅ (a 1 ) = f ∅ (b 1 ) = 1 and f ∅ (a i ) = f ∅ (b i ) = 0 for 2 ≤ i ≤ k I4: f T (x) = U ⊊T f U (x)for any non-empty set T ⊊ [k] and any x ∈ e(T ) I5: f T ≡ 0 if |T | is odd and |T | ≤ k − 3 Suppose we have already constructed a valid family of polynomialsf T with |T | ≤ ℓ − 1.Consider a subset T ⊊ [k] with |T | = ℓ such that 1 ≤ ℓ ≤ k − 2.The case ℓ = k − 1 will be considered afterwards.All terms f V with odd |V | vanish due to (I5) since |V | ≤ |U | − 1 = k − 3.All terms f V with even |V | and |V | ≤ k − 4 vanish due to (I6).Thus we can restrict the sum Eq. (37) to terms with |V | = k − 3 and it suffices to check thatU ⊊T |U |=k−2 V ⊊U |V |=k−3 f V (0 m ) + f V (a i + b i ) = 0.

Lemma 1 .
The resource state |ψ G ⟩ is k-pairable if for any choice of k disjoint pairs of vertices {a 1 , b 1 }, . . ., {a k , b k } in the graph G, there exist k edge-disjoint paths P 1 , . . ., P k ⊆ E such that the path P i connects vertices {a i , b i }.
k and k! ≥ e −k k k one gets has at least k/2 cycles}|To upper bound the size of D, w.l.o.g.let π = {{1, 1 + n/2}, ..., {k, k + n/2}}: we match the first k vertices in the first half with the first k vertices in the second half.We can upper bound the number of neighbors of π by enumerating them, each possibly multiple times.To define a somewhat elaborate enumeration, first notice that the nodes of any cycle in π ∪ ρ must be fully contained in the vertex set ∪π =[1, k] ∪ [1 + n/2, k + n/2].Assume ρ is a neighbor of π such that π ∪ ρ has µ cycles.Pick an (arbitrary) point in every cycle, such that the selected points belong to A. Let these points be 1 ≤ p 1 < • • • < p µ ≤ k, and let the Royal Society of London.Series A: Mathematical, Physical and Engineering Sciences, 452(1954):2551-2577, 1996.DOI:10.1098/rspa.1996.0136.[36] Stephanie Wehner, David Elkouss, and Ronald Hanson.Quantum internet: A vision for the road ahead.Science, 362(6412), 2018.DOI:10.1126/science.aam9288.