An exponential separation between theentanglement and communication capacities

of a bipartite unitary interactionAram W. Harrow

Department of Computer ScienceUniversity of Bristol,

Bristol, BS8 1UB, United Kingdoma.harrow@bris.ac.uk

Debbie W. LeungDepartment of Combinatorics and Optimization,

and Institute for Quantum Computing,University of Waterloo,

Waterloo, Ontario, N2L 3G1, Canadawcleung@iqc.ca

Abstract—We consider asymptotic capacities of bipartite uni-tary gates. We present a gate with exponentially larger entangle-ment capacity than the total communication capacity. The keytool in our proof, which may be of independent interest, is acommunication-efficient protocol for testing whether a bipartitequantum state belongs to a short list of candidate states.

I. INTRODUCTION

Consider a bipartite unitary quantum gate U acting on quantumsystems A and B that are held respectively by two partiesAlice and Bob. (For example, the SWAP or the CNOT gate.) Theability of specific instances of such bipartite gates to generateentanglement or to communicate between Alice and Bob underspecific circumstances has been studied, and a partial list ofresults is given by [1].

Reference [2] formalizes the notion of a “quantum bidi-rectional channel” and defines the capacity of a bipartitequantum operation as the optimal asymptotic rate of producinga certain resource, without restriction on the local informationprocessing ability. These channels may or may not be uni-tary. The philosophy in [2] is similar to Shannon’s study ofthe capacities of classical two-way communication channels[3]. For unitary bidirectional channels (which we just call“gates” from now on), [2] obtains exact expressions for someentanglement and classical capacities and bounds for others.For example, the gate U is nonlocal (not a tensor product)if and only if each of the nonlocal capacities is positive.Thus, nonlocal gates are qualitatively equivalent among oneanother and universal for all nonlocal data processing tasks,if efficiency is not of concern. Another finding of [2] isthat the entanglement capacity is an upper bound on variouscommunication capacities, such as the total unassisted classicalcommunication capacity.

Beyond the proven bounds, it is unclear a priori whetherthese different capacities are quantitatively related, except forin special cases. (1) If U is very close to the identity gate, thenall capacities are small. (2) For gates like the CNOT or SWAP,it happens that all the capacities of interest are known andthey are indeed tightly related. (3) Furthermore, when U is atwo-qubit gate (that is, A and B are both two-dimensional),

the forward communication capacity (from Alice to Bob)equals that from Bob to Alice. Also, both U and U † have thesame entanglement capacity. The above special cases supporta somewhat natural belief – the level of nonlocality of a gateis reflected roughly equally in each capacity – thus a gate thatcommunicates much in the forward direction also does so inthe backward direction, and a highly entangling gate can alsodisentangle or communicate a lot.

But such beliefs turn out to be false. Reference [6] findsa gate U that has entanglement capacity exponentially largerthan that of U †, and has exponentially larger forward com-munication capacity than the backward one. In this paper, wedemonstrate the remaining separation – an exponential onebetween entanglement capacity and communication capacity.Together with the results of [6], this indicates that most unitarygate capacities of interest can vary nearly independently.

We now state our result more precisely. First we define somenotations. Following [2], define E(U) to be the asymptoticrate of entanglement that can be generated using U ; that is,for any δ, ε > 0 and n large enough, n uses of U can generaten(E(U) − δ) ebits with error ≤ ε. (One ebit is the amountof entanglement in one EPR pair 1√

2(|00〉 + |11〉).) Similarly

C→(U) is the rate at which U can communicate classical bitsfrom Alice to Bob, and C←(U) the rate from Bob to Alice.If free entanglement is allowed (typically, but not necessarily,in the form of an arbitrary number of shared EPR pairs) thenwe denote the (entanglement-assisted) classical capacities byCE→(U) and CE←(U). Finally, let the bidirectional communi-cation capacity C+(U) be the maximum of C1 + C2 for allpairs (C1, C2) such that U can asymptotically send C1 bitsfrom Alice to Bob and C2 bits from Bob to Alice at the sametime. Similarly we can define CE+ (U) by allowing unlimitedentanglement. Note that max(C→(U), C←(U)) ≤ C+(U) ≤C←(U)+C→(U) (and similarly for the entanglement assistedcapacities).

Since any protocol for sending classical information usinga unitary gate can also be used to generate at least as muchentanglement [2], we have that E(U) ≥ C+(U). Beforethis paper, it was unknown whether this inequality was ever

978-1-4244-2270-8/08/$25.00 ©2008 IEEE 381

tight. Our main result is an example of a gate U for whichthe entanglement capacity E(U) is exponentially larger thanCE+ (U) (which in turn is at least as large as any of the othercommunication capacities).

The proof is obtained by demonstrating a simulation ofthe gate that uses only static resources (i.e. shared entangledstates) and a small amount of communication. A key toolis a new communication-efficient protocol for nonlocal stateidentification, which we define to be the problem of testingwhether a state shared by Alice and Bob equals a particularstate or not.

II. THE GATE U

For our gate U , A and B each have d+1 dimensions (orequivalently, n = log(d+1) qubits) and a basis given by{|0〉, · · · , |d〉}. Let |Φ〉 = 1√

d

(

|11〉 + · · · |dd〉)

, P =

|00〉〈00| + |Φ〉〈Φ| and Q = I − P . Define

U = |00〉〈Φ| + |Φ〉〈00| +Q.

In other words, U swaps |00〉 with |Φ〉 and leaves the rest ofthe space (i.e. the support of Q) unchanged. Note that U = U †.

By construction, U can certainly create or remove log d ≈ nebits. However, since it leaves most of the space unchanged,it does not appear to be very useful for communication. Weformalize this intuition with:

Theorem 1: For any c > 2 and for all n sufficientlylarge, CE→(U) ≤ 2c log n.

Here U is implicitly parameterized by n. We will prove Thm. 1in the next section. Since U is symmetric with respect tothe two inputs, the same bound applies to CE←(U) and soCE+ (U) ≤ 4c log n. Together with the lower bound on theentanglement capacity, we have

CE+ (U) ≤ 4c log n� n− 1

2n − 1≤ E(U)

for sufficiently large n. Thus the entanglement capacity isexponentially larger than CE+ (U), which is the most generousmeasure of communication capacity.

III. UPPER BOUNDS OF CAPACITIES VIA GATE SIMULATION

Our proof consists of (1) a simulation protocol W that usesstatic resources and some communication to approximate Uand (2) a continuity bound that tells us how accurate Whas to be if the capacities of U and W are to differ by nomore than a vanishing function of n. (3) The heart of Wis an approximate nonlocal state identification protocol Ma

whose accuracy increases with the amount of communicationavailable.

Together, the continuity bound translates to an asymptoticsufficiency of ≈ 4 log n qubits of communication in W (eachway), which provides an upper bound for the capacity of Wand also of U .

A. The simulation protocol WDefine |φ−〉 = 1√

2

(

|Φ〉 − |00〉)

. Note that U has only 1nontrivial eigenvalue, −1, and the corresponding eigenvectoris |φ−〉. Let Mi be the ideal coherent measurement that maps|φ−〉|0〉 → |φ−〉|0〉 and |φ〉|0〉 → |φ〉|1〉 for all 〈φ|φ−〉 = 0.Mi is a 2-outcome measurement with POVM elementsM0 = |φ−〉〈φ−|,M1 = I − |φ−〉〈φ−|. W simulates U bycalling an approximate protocol Ma for Mi, which usesm− 1 copies of |φ−〉. W has 5 steps:

1) Adjoins ancillas |φ−〉⊗m−1.2) Applies Ma. The outcome 0/1 is stored in a qubit C

in Bob’s possession (WLOG). We will prove later thatMa differs from Mi in the diamond norm [7] by nomore than O(m−1/2) using the catalyst |φ−〉⊗m−1 andlog(m) qubits of (forward) communication.

3) The gate Diag(−1, 1) is applied to C, so that |0〉 ismapped to −|0〉 and |1〉 mapped to |1〉.

4) Reverse Ma in step 1, so as to coherently erase theoutcome in C. This step requires log(m) + 1 qubits of(backward) communication.

5) Discards the ancillas and system C.

Steps 1-4 defines an isometry, V , with a growing output sizeof mn qubits. Step 5 equalizes the input/output dimensions ofU and W .

Since V uses only 2 log(m) qubits of forward communica-tion, it must have CE→(V ) ≤ 2 log(m).

The protocol W is not unitary, but the capacity CE→(W )of noisy bidirectional quantum channels was studied in [8],which gave a simple formula:

CE→(W ) = supρXAA′BB′

I(X;BB′)W (ρ) − I(X;BB′)ρ. (1)

Here A,B are the registers acted on by W , A′, B′ are ancillasof arbitrary dimension, X is a classical register, I(X;Y ) =H(X)+H(Y )−H(XY ) is the quantum mutual information ofthe state given by the subscript. H(R) = H(σ) = −trσ log σis the von Neumann entropy for the reduced density matrixσ on the system R. When one of the registers X is classical,the state on XY represents an ensemble of quantum stateson Y labeled by basis states of X , and the quantum mutualinformation is the Holevo information [9]. Eq. (1) can beinterpreted to mean that CE→(W ) equals the largest single-shot increase in mutual information possible when applyingW to any ensemble of bipartite states. Together with the factthat mutual information is nonincreasing when we trace outa subsystem, this implies that step (4) cannot increase thecapacity, and CE→(W ) ≤ CE→(V ).

Note that if Ma = Mi, W = U . Thus, to upper boundthe communication capacity of U , we need to express thedifference in the capacities of two bipartite quantum operationsin terms of their difference.

B. Continuity boundFor a superoperator S, let ‖S‖�:=maxψ≥0,trψ=1 ‖(I ⊗

S(ψ)‖1 denote the diamond-norm of S. We have the

382

following continuity bound:

Lemma 1: If N1, N2 are bidirectional channels withoutputs in C

d+1 ⊗ Cd+1 such that ‖N1 −N2‖� ≤ ε, then

|CE→(N1) − CE→(N2)| ≤ 8ε log(d+1) + 4H2(ε) (2)

where H2 is the binary entropy function.

Proof outline: Due to Eq. (1), the bound is essentially acontinuity result for quantum mutual information. The crucialchallenge is the lack of dimensional bounds on the ancillarysystems A′B′, so that Fannes inequality [10] does not providethe needed continuity result.

The above Lemma is proved in Lemma 1 of [6] whichuses a result by Fannes and Alicki [11] that generalizesFannes inequality [10] to conditional entropy. This generalizedinequality provides an upper bound that is independent of thesize of the conditioned system. The proximity of the stateevaluated is ensured by the small distance between the TCPmaps in diamond norm (which includes the ancillas).

We note that Lemma 1 in [6] is stated for isometric N1 andN2 but the proof there only uses Eq. (1), which was shownby [8] to hold for general noisy bidirectional channels. Thisestablishes our Lemma for arbitrary operations N1,N2.

C. Procedure for nonlocal state identification Ma

We start with an informal description of the task, ignoringlocality constraints. Suppose we want to know whether ornot an unknown incoming state |β〉 is equal to some otherstate |α〉, and we have possession of m−1 copies of |α〉.One method is to project |α〉⊗m−1|β〉 onto the symmetricsubspace of (Cd)⊗m (defined as the span of all vectors ofthe form |ψ〉⊗m for |ψ〉 ∈ C

d). The projector onto this spaceis given by 1

m!

∑

π∈Smπ, where Sm is the group of operators

that permute the m registers. This measurement succeeds withprobability 〈α|⊗m−1〈β| 1

m!

∑

π∈Smπ |α〉⊗m−1|β〉. A fraction

1m of the permutations fix the mth register. For each such π,〈α|⊗m−1〈β|π|α〉⊗m−1|β〉 = 1. The remaining 1− 1

m fractionof the permutations swaps the mth register with one of theothers. In this case 〈α|⊗m−1〈β|π|α〉⊗m−1|β〉 = |〈α|β〉|2.Thus the success probability is 1

m + (1− 1m )|〈α|β〉|2 =

|〈α|β〉|2+ 1m (1−|〈α|β〉|2), and this simulates the measurement

with operators {|α〉〈α|, I − |α〉〈α|} up to error at most 1/m.Observe that instead of π ranging over all m! permutations,

it would suffice to take only the m cyclic permutations. Forthe bipartite setting, this will allow us to save dramatically oncommunication.

We now describe the bipartite protocol and derive a carefulbound on the accuracy.

Let |s〉 = 1√m

∑m−1j=0 |j〉 and S be a register pre-

pared in state |s〉. Let Y act on S ⊗ (Cd)⊗m by map-ping |j〉|ψ1〉|ψ2〉 · · · |ψm〉 to |j〉|ψ1−j〉|ψ2−j〉 · · · |ψm−j〉, witharithmetic in mod m. That is, S controls a cyclic permutationof the m registers, taking the first register to the j th one if thestate of S is |j−1〉.

With a slight abuse of notation, let Mi and Ma be the idealand approximate coherent state identification protocols for

some bipartite state |α〉, with the answer residing with Bob.The state to be measured lives in systems AB. Alice and Bobalready share |α〉⊗m−1 in A2B2⊗· · ·AmBm. Ma is given by:

1) Alice prepares a register S in the state |s〉.2) Alice applies Y on S ⊗A⊗A2 · · ·Am (i.e. she applies

the S-controlled cyclic permutation on her halves of them bipartite systems).

3) Alice sends S to Bob using log(m) qubits of forwardcommunication.

4) Bob performs Y on S ⊗ B ⊗ B2 · · ·Bm thereby com-pleting the S-controlled cyclic permutation on the mbipartite systems.

5) Bob coherently measures S with POVM {|s〉〈s|, I −|s〉〈s|}. The final outcome is written to a register C inBob’s possession.

6) Bob performs Y † on S ⊗B ⊗B2 · · ·Bm.7) Bob sends S to Alice using log(m) qubits of backward

communication.8) Alice applies Y † on S ⊗A⊗A2 · · ·Am.

We now show that ‖Ma − Mi‖� ≤√

2√m

. Consider the state|φ〉 =

√p |a0〉R|α〉AB +

√1−p |a1〉R|α⊥〉AB , where R is a

reference system that may be entangled with the incomingsystems AB, 〈α⊥|α〉AB = 0, and |a0〉, |a1〉 are unit vectorsthat are not necessarily orthogonal to one another. This is themost general initial state. Evolving |φ〉 according to Ma givesa final state |fin〉 =

√p |a0〉|α〉⊗m|s〉|0〉 +

√

1−p |a1〉|α⊥〉|α〉⊗m−1|s〉|1〉 + |err〉

where |err〉 =√

2m3/2

∑

jj′

√

1−p |a1〉|α〉⊗j−j′ |α⊥〉|α〉⊗m−1−(j−j′)|j′〉|−〉

and |−〉 = 1√2

(

|0〉−|1〉)

. The first two terms in |fin〉 isprecisely the state |cor〉 obtained by applying Mi to |φ〉.The last term |err〉 represents the deviation. The derivationis routine and is included in the appendix. When calculating|〈cor|err〉|, only terms with j = j ′ contribute to the innerproduct. There are m such terms, all being the same, givingthe bound |〈cor|err〉| ≤

√1−p√m

and matching precisely theprobability of failure given by the informal argument. It alsogives |〈cor|fin〉| ≥ 1 −

√1−p√m

≥ 1 − 1√m

. We are now readyto apply the well known relation

12‖ |a〉〈a| − |b〉〈b| ‖1 =

√

1 − |〈a|b〉|2 ≤√

2 (1−|〈a|b〉|)

to bound ‖Ma −Mi‖� which is equal to

= sup|φ〉

‖(I ⊗Ma)(|φ〉〈φ|) − (I ⊗Mi)(|φ〉〈φ|)‖1

= sup|φ〉

‖ |cor〉〈cor| − |fin〉〈fin| ‖1 ≤√

2√m.

Before returning to the proof of Thm. 1, note that the non-local state identification protocol generalizes straightforwardlyto more than two remote parties (say, k). One way to do thisis for one party to create |s〉 which is then circulated among

383

all parties and back. Another way is to have the k partiessharing |s〉 = 1√

m

∑m−1j=0 |j〉⊗k, each sends his share to the

party designated to have the answer, and has the share returnedto complete the protocol.

D. Completing the proof of Thm. 1

In the previous section, we have derived the accuracy ofthe approximate nonlocal state identification in terms of thecommunication cost to be ε =

√2√m

. Recall that if we replaceMa by Mi in W , we obtain an exact simulation of U . Bythe triangular inequality and the two uses of the approximatemeasurement, ‖U−W‖� ≤ 2ε. Consider Eq. (2) again. Sincelog(d+1) = n, the difference in the capacities of U and W issuppressed if m = nc for c > 2. More precisely,

CE→(U) ≤ CE→(W ) + 16ε log(d+1) + 4H2(2ε)

≤ CE→(V ) + 16n2−c + 8√

2ε

≤ 2c log n+ 16n2−c + 13.5n−c/4

where each term is bounded by the corresponding term inthe subsequent line (and H2(x) ≤ 2

√x). It follows that

the total communication capacity, even when assisted by freeentanglement, is asymptotically upper bounded by 4c log n.

E. A more efficient simulation

We design W to use the nonlocal measurement Ma twiceas subroutines to simplify the explanation and analysis. But wecan instead insert a few steps (labeled by *) into one executionof Ma to simulate U , and call this protocol W ′:

1) Alice and Bob adjoin ancillas |φ−〉⊗m−1 in systemsA2B2 ⊗ · · ·AmBm.

2) Alice prepares a register S in the state |s〉.3) Alice applies Y on S ⊗ A ⊗ A2 · · ·Am. (i.e. the S-

controlled cyclic permutation on her halves of the mbipartite systems).

4) Alice sends S to Bob using log(m) qubits of forwardcommunication.

5) Bob performs Y on S ⊗ B ⊗ B2 · · ·Bm thereby com-pletely the S-controlled cyclic permutation on the mbipartite systems.

6) Bob coherently measures S with POVM {|s〉〈s|, I −|s〉〈s|}. The final outcome is written to a register C inBob’s possession.

7) * Bob applies the gate Diag(−1, 1) to C, so that |0〉 ismapped to −|0〉 and |1〉 mapped to |1〉.

8) * Repeat step (6) so as to undo it.9) Bob performs Y † on S ⊗B ⊗B2 · · ·Bm.

10) Bob sends S to Alice using log(m) qubits of backwardcommunication.

11) Alice applies Y † on S ⊗A⊗A2 · · ·Am.This uses only log(m) qubits of communication, and

‖U − W ′‖� ≤ ε. The upper bound on communication rateis essentially halved.

IV. DISCUSSION

Our simulation procedure allows us to simulate any bipartitegate with r non-trivial eigenvalues using O(r log(r/ε)) qubitsof communication. This is accomplished by testing the stateheld by Alice and Bob sequentially against each of the r corre-sponding eigenvectors. Each individual test needs to have errorε/r so that the total error can be bounded by ε. For gates ond×d-dimensional systems the resulting gate simulation is moreefficient than the trivial O(log d)-cost simulation wheneverr � d2/ log d. This suggests that our simulation proceduremay be near optimal unless we make more assumptions aboutthe gate to be simulated.

Our nonlocal state identification protocol generalizes to kparties as long as they form a connected set under the availablecommunication structure.

Regarding unitary gate capacities, we have shown thatCE+ (U) can scale like the logarithm of E(U). However, it isunknown how much further this result could be improved. Forour example, it is possible that CE+ (U) can be upper-boundedby a constant even as n → ∞. Moreover, it is possible thateven stronger separations are possible. Bound 1 of [2] impliesthat CE+ (U) > 0 whenever E(U) > 0, but even for fixeddimension no nonzero lower bound on CE+ (U) is known. Thedifficulty is that the proof in [2] relates CE+ (U) to the amountof entanglement which one use of U can be create fromunentangled inputs. This quantity can be arbitrarily smallerthan E(U) even for fixed dimensions.

REFERENCES

[1] C. H. Bennett, S. Braunstein, I. L. Chuang, D. P. DiVincenzo, D.Gottesman, J. A. Smolin, B. M. Terhal, W. K. Wootters, unpublished(1998). J. Eisert, K. Jacobs, P. Papadopoulos, and M.B. Plenio, Phys.Rev. A 62 (2000) 052317, quant-ph/0005101v1. D. Collins, N. Linden,and S. Popescu, Phys. Rev. A 64, 032302 (2001), quant-ph/0005102v1.J. I. Cirac, W. Dur, B. Kraus, M. Lewenstein, Phys. Rev. Lett. 86 544(2001). quant-ph/0007057. P. Zanardi, C. Zalka, and L. Faoro, Phys.Rev. A 62, 030301 (2000), quant-ph/0005031. W. Dur, G. Vidal, J. I.Cirac, N. Linden, and S. Popescu, Phys. Rev. Lett. 87 137901 (2001).quant-ph/0006034. B. Kraus and J.I. Cirac, Phys. Rev. A 63, 062309(2001), quant-ph/0011050. M. S. Leifer, L. Henderson, and N. Linden,Phys. Rev. A 67, 012306 (2003), quant-ph/0205055.

[2] C. H. Bennett, A. Harrow, D. W. Leung, and J. A. Smolin, “On thecapacities of bipartite Hamiltonians and unitary gates,” IEEE Trans. Inf.Theory 49, 1895 (2003), quant-ph/0205057.

[3] C. E. Shannon, “Two-way communication channels,” Proc. 4th BerkeleySymp. Math. Stat. Prob. (UC Press, Berkeley, 1961).

[4] A. W. Harrow and D. W. Leung, “Bidirectional coherent classicalcommunication,” Quant. inf. Comp., 5 380 (2005). quant-ph/0412126.

[5] D. W. Berry and B. C. Sanders, “Relation between classical com-munication capacity and entanglement capability for two-qubit unitaryoperations,” Phys. Rev. A 68, 032312 (2003), quant-ph/0207065.

[6] A. Harrow and P. W. Shor, “Time reversal and exchange symmetries ofunitary gate capacities,” quant-ph/0511219v1.

[7] A. Kitaev, A. Shen, and M. Vyalyi, “Classical and Quantum Computa-tion,” AMS (2000).

[8] A. M. Childs, D. W, Leung, and H.-K. Lo, “Two-way quantum commu-nication channels,” Int. J. Quant. Inf., 4 63-83 (2006), quant-ph/0506039.

[9] A. S. Holevo, “Bounds for the Quantity of Information Transmittedby a Quantum Communication Channel,” Problems of InformationTransmission, 9 177-183 (1973).

[10] M. Fannes, “A continuity property of the entropy density for spin latticesystems,” Comm. Math. Phys. 31 291 (1973).

[11] R. Alicki and M. Fannes, “Continuity of quantum mutual information,”J. Phys. A, 37 L55 (2004), quant-ph/0312081.

384

APPENDIX

Deriving the state evolved by Ma

We use all the notations defined in the main text. In the proof of ‖Ma − Mi‖� ≤√

2√m

, we claim that the output state ofapplying Ma to the most general initial state |φ〉 =

√p |a0〉R|α〉AB +

√1−p |a1〉R|α⊥〉AB is of a certain form. Here is a

justification of this fact. The state after attaching the ancillas is:√p |a0〉|α〉⊗m|s〉 +

√

1−p |a1〉|α⊥〉|α〉⊗m−1|s〉 .After Alice applies Y , communicates S to Bob, and Bob applies Y :

√p |a0〉|α〉⊗m|s〉 +

√

1−p |a1〉 1√m

∑

j

|α〉⊗j |α⊥〉|α〉⊗m−1−j |j〉 .

Now Bob attaches |0〉C and makes the coherent measurement on S, taking |s〉|0〉C → |s〉|0〉C and |s⊥〉|0〉C → |s⊥〉|1〉C forall 〈s⊥|s〉 = 0. To write down the resulting state, we should rewrite each |j〉 in the Fourier basis which includes |s〉. But toobtain just a bound, we can simply express |j〉 = 1√

m|s〉 +

√m−1√m

|sj〉 where 〈sj |s〉 = 0. The measurement on S thus resultsin the state

√p |a0〉|α〉⊗m|s〉|0〉 +

√

1−p |a1〉 1√m

∑

j

|α〉⊗j |α⊥〉|α〉⊗m−1−j(

1√m|s〉|0〉 +

√m−1√m

|sj〉|1〉)

.

Here, the second occurrence of the |s〉|0〉 term (the one in the parenthesis) represents an erroneous measurement outcome. Weadd and subtract 1√

m|s〉|1〉 in the parenthesis:

√p |a0〉|α〉⊗m|s〉|0〉 +

√

1−p |a1〉 1√m

∑

j

|α〉⊗j |α⊥〉|α〉⊗m−1−j(

1√m|s〉(|0〉−|1〉) + |j〉|1〉

)

.

Rearranging, we get: √p |a0〉|α〉⊗m|s〉|0〉 +

√

1−p |a1〉 1√m

∑

j

|α〉⊗j |α⊥〉|α〉⊗m−1−j |j〉|1〉

+√

1−p |a1〉 1√m

∑

j

|α〉⊗j |α⊥〉|α〉⊗m−1−j√

2√m|s〉|−〉

where the first line is what an ideal measurement will produce (with unit norm), and the second line represents an error term(and it is not orthogonal to the ideal portion, since the sum is also normalized). Now, Bob applies Y † and sends S back toAlice, who then applies Y †, resulting in the final state |fin〉 = |cor〉 + |err〉 where

|cor〉 =√p |a0〉|α〉⊗m|s〉|0〉C +

√

1 − p |a1〉|α⊥〉|α〉⊗m−1|s〉|1〉C|err〉 =

√2

m3/2

∑

jj′

√

1 − p |a1〉|α〉⊗j−j′ |α⊥〉|α〉⊗m−1−(j−j′)|j′〉|−〉C

as claimed.We can bound ‖|err〉‖2 by inspecting the expression right after the rearrangement, which gives ‖|err〉‖2 ≤

√2(1−p)√m

. This

implies |〈cor|fin〉| ≥ 1−|〈cor|err〉| ≥ 1−√

2(1−p)√m

. Alternatively, we can explicitly calculate |〈cor|err〉| using their expressionsgiven above. Only the j = j′ terms contribute to the inner product. But there are m such terms, all being the same, giving theslightly better bound |〈cor|err〉| ≤

√1−p√m

and matching the probability of failure given by the informal argument.

385