Homomorphic encryption of linear optics quantum computation on almost arbitrary states of light with asymptotically perfect security

TL;DR

This paper introduces a homomorphic encryption scheme for linear optics quantum computation on light states with fixed photon numbers, ensuring asymptotically perfect security and practical implementation using current technology.

Contribution

It presents a novel encryption protocol for quantum states of light that maintains data secrecy during computation, applicable to universal linear optics quantum computing.

Findings

Achieves asymptotically perfect information-theoretic secrecy.

Uses random coherent displacements for data obfuscation.

Experimental implementation is feasible with current technology.

Abstract

Future quantum computers are likely to be expensive and affordable outright by few, motivating client/server models for outsourced computation. However, the applications for quantum computing will often involve sensitive data, and the client would like to keep her data secret, both from eavesdroppers and the server itself. Homomorphic encryption is an approach for encrypted, outsourced quantum computation, where the client's data remains secret, even during execution of the computation. We present a scheme for the homomorphic encryption of arbitrary quantum states of light with no more than a fixed number of photons, under the evolution of both passive and adaptive linear optics, the latter of which is universal for quantum computation. The scheme uses random coherent displacements in phase-space to obfuscate client data. In the limit of large coherent displacements, the protocol exhibits asymptotically perfect information-theoretic secrecy. The experimental requirements are modest, and easily implementable using present-day technology.

Equations

$$\hat{U}{\hat{a}}_i^{†}{\hat{U}}^{†}\to \sum _{j=1}^m{U}_{i,j}{\hat{a}}_j^{†},$$

$$\hat{U}\left[\underset{i=1}{\overset{m}{⨂}}{\hat{E}}_i(k)\right]=\left[\underset{i=1}{\overset{m}{⨂}}{\hat{E}}_i^{\prime }(k)\right]\hat{U},$$

$$\hat{D}(\alpha )=\exp \left[\alpha {\hat{a}}^{†}-{\alpha }^{\ast }\hat{a}\right].$$

$$|\alpha ⟩=e^{-\frac{|\alpha {|}^2}{2}}\sum _{n=0}^{\infty }\frac{{\alpha }^n}{\sqrt{n!}}|n⟩,$$

$$\hat{U}\hat{D}(\vec{\alpha })=\hat{D}(\vec{\beta })\hat{U},$$

$$\vec{\beta }=U\cdot \vec{\alpha }.$$

$$\hat{D}(-\vec{\beta })\hat{U}\hat{D}(\vec{\alpha })=\hat{U},$$

$$\hat{D}(\alpha )\hat{S}(r{e}^{i\theta })=\hat{S}(r{e}^{i\theta })\hat{D}(\gamma ),$$

$$|{\psi }_{\mathrm{in}}⟩=\sum _{j=0}^n{\lambda }_j|j⟩,{\hat{\rho }}_{\mathrm{in}}=|{\psi }_{\mathrm{in}}⟩⟨{\psi }_{\mathrm{in}}|,$$

$$\Vert \rho -{\rho }^{\prime }{\Vert }_1\le 4\sqrt{\mu /n}+4\mu /n.$$

$$ϵ=\frac{1}{{\sigma }^2}\left(\frac{n}{4}+\frac{1}{2}{\left(1+\frac{1}{2{\sigma }^2}\right)}^n+4(n+1)\right).$$

$$H_j(x)=(-1{)}^n{e}^{x^2}\frac{d^j}{d{x}^j}{e}^{-x^2},$$

$${\psi }_j(x)=e^{-x^2/2}\frac{1}{\sqrt{2^{j}j!\sqrt{\pi }}}{H}_j(x).$$

$$|j⟩={\int }_{-\infty }^{\infty }{\psi }_j(x)|x⟩dx,$$

$$⟨x_1|x_2⟩=\delta (x_1-x_2).$$

$${\hat{\rho }}_{\mathrm{in}}$$

$${\mathcal{E}}_{\mathrm{enc}}(\hat{\rho })={\int }_{\alpha \in \mathbb{C}}\mu (\alpha )\hat{D}(\alpha )\hat{\rho }\hat{D}(\alpha {)}^{†}{d}^2\alpha ,$$

$${\hat{\rho }}_{\mathrm{enc}}$$

$$\times |x_1+u⟩⟨x_2+u|dud{x}_{1}d{x}_2.$$

$$⟨a|{\hat{\rho }}_{i,i}|a⟩$$

$$0$$

$$\le xy\sum _{q=0}^{\min (a,i)}\left(\genfrac{}{}{0ex}{}{a+k}{q+k}\right)\left(\genfrac{}{}{0ex}{}{i+k}{q+k}\right)y^{2q+k}{x}^{a+i+k},$$

$$⟨a|{\hat{\rho }}_{i+1,i+1}|a⟩-⟨a|{\hat{\rho }}_{i,i}|a⟩$$

$$=$$

$$+(xy)x^{a+i+1}\sum _{k=1,\dots ,\min \{a,i\}}\left(\genfrac{}{}{0ex}{}{a}{k}\right)\left(\genfrac{}{}{0ex}{}{i}{k-1}\right)y^{2k}.$$

$$\frac{1}{{\sigma }^2}\left(\frac{n}{4}+\frac{1}{2}{\left(1+\frac{1}{2{\sigma }^2}\right)}^n+4(n+1)\right),$$

$$H_n(x)=(-1{)}^n{e}^{x^2}\frac{d^n}{d{x}^n}{e}^{-x^2},$$

$${\psi }_n(x)=e^{-x^2/2}\frac{1}{\sqrt{2^{n}n!\sqrt{\pi }}}{H}_n(x).$$

$$D(\alpha )=\exp (\alpha {\hat{a}}^{†}-{\alpha }^{\ast }\hat{a}),$$

$$a$$

$$[{\hat{X}}_1,{\hat{X}}_2]$$

$$=\frac{1}{2i}\left([{\hat{a}}^{†},{\hat{a}}^{†}-\hat{a}]+[\hat{a},{\hat{a}}^{†}-\hat{a}]\right)$$

$$=\frac{1}{2i}\left([{\hat{a}}^{†},-\hat{a}]+[\hat{a},{\hat{a}}^{†}]\right)$$

Full text

I Introduction

In the upcoming quantum era, it is to be expected that client/server models for quantum computing will emerge, owing to the high expected cost of quantum hardware. This necessitates the ability for a client (Alice), possessing data she wants processed, to outsource the computation to a host (Bob), who possesses the costly quantum computer. In such a model, security will be a major concern. The types of applications to which quantum computing will initially be most relevant will contain sensitive data, whether it be strategically important information, or valuable intellectual property, or confidential personal information. This raises the important question of how Alice can outsource computation of her data such that no adversary Eve, or even the server Bob, can read her data – she trusts no one!

Homomorphic encryption is a cryptographic protocol that achieves this objective. Alice sends encrypted data to Bob, who processes it in encrypted form, before returning it to Alice. The essential feature is that computing the data does not require first decrypting it – it remains encrypted throughout the computation, ensuring that even if Bob is compromised, Alice retains integrity of her data.

Classical homomorphic encryption has only been described very recently Gentry (2009); Van Dijk et al. (2010); Gentry et al. (2012), and a number of results for homomorphic quantum computation have been described Rohde et al. (2012a); Broadbent and Jeffery (2015); Ouyang et al. (2018); Tan et al. (2016, 2018a); Lai and Chung (2018); Dulek et al. (2016); Alagic et al. (2017). In the case of universal quantum computation, such protocols require a degree of interaction between Alice and Bob. However, it was shown in Rohde et al. (2012a) that under certain restricted, non-universal models for quantum computation, homomorphic encryption may be implemented passively, without any client/server interaction, and requiring only separable, non-entangling encoding/decoding operations. In that protocol, in which single photons encode data, random polarisation rotations on Alice’s input photonic state obfuscate data from Bob. And in Tan et al. (2018a), a similar protocol was presented using phase-key encoding, whereby random rotations in phase-space obfuscate Alice’s data, encoded into coherent states.

These two protocols are limited in their security by the fact that the rotations in phase-/polarisation-space are correlated across all inputs, thereby limiting the entropy of the encoded input states, and hence its security. For example, with $m$ optical modes, polarisation-key encoding is only able to hide $O(\mathrm{log}(m))$ bits of information, falling far short of our utopian ideal of perfect information theoretic security (i.e hiding all $m$ bits of information in the case of 0 or 1 photons per mode).

The polarisation- and phase-key homomorphic encryption techniques are specific examples of a more general framework for encryption, whereby the encoding and decoding operations commute with the computation, thereby mitigating the need for elaborate interactive protocols.

Here we consider an alternate technique that supersedes both polarisation- and phase-key encoding – displacement key encoding, whereby random coherent displacements obfuscate optically-encoded quantum information. This idea has been recently explored by Marshall et al. Marshall et al. (2016), where it was argued heuristically why the scheme might be secure. Based on experimental data generated, Marshall et al. numerically showed that the mutual information between the encrypted and the unencrypted data can be made small as the variance of the random displacements increases. This encouraging evidence suggests that a displacement key encoding might offer perfect security in the asymptotic limit. However, obtaining analytical bounds to quantify the security of the scheme has been recognized to be a challenging issue, yet to be solved.

In this paper, we rigorously obtain explicit bounds on the security of using a displacement key encoding, thereby confirming the intuition of Ref. Marshall et al. (2016). Moreover, the displacement key encoding improves on the earlier polarisation- and phase-key techniques in two important respects. First, we demonstrate that by choosing the encoding displacement operators to be independent on each optical mode and to follow a Gaussian distribution with an increasing variance, any pair of encoded codewords will become increasingly close in trace-distance and thereby increasingly indistinguishable. Our encoding scheme is a weak information-theoretic security encryption scheme with secrecy error that is twice of this maximum trace distance, and this security definition has been introduced in (Lai and Chung, 2019, Definition 5). We also remark that the trace-distance metric we use is preferable to the mutual information used in Ref. Marshall et al. (2016), because the trace distance directly quantifies the indistinguishability of quantum states while the mutual information does not. Second, our technique is applicable to linear optics computations acting on quantum states of light with no more than a fixed number of photons. Constraining quantum states to have no more than a fixed number of photons is reasonable, because quantum states that are bounded in energy can always be well approximated by quantum states that bounded in photon number, given that sufficiently many photons is considered. This is far more general than polarisation-key encoding, which applies to single-photon input states, or phase-key encoding, which applies to input coherent states.

II Commutative homomorphic encryption of passive linear optics

A linear optics network Kok et al. (2007), comprising only beamsplitters and phase-shifters, implements a photon-number-preserving unitary map on the photonic creation operators,

[TABLE]

where $\hat{a}^{\dagger}_{i}$ is the creation operator for the $i$th mode, there are $m$ optical modes, and $U$ is an $\mathrm{SU}(m)$ matrix characterising the linear optics network.

Bob possesses both the hardware and software for implementing the computation ($\hat{U}$), which Alice would like applied to her input state ($|\psi\rangle_{\text{in}}$), yielding the computed output state ($|\psi\rangle_{\text{out}}=\hat{U}|\psi\rangle_{\text{in}}$).

Before sending her input state to Bob, Alice, who has limited quantum resources, wishes to encode her input state using operations separable across all modes, similarly for decoding, i.e we rule out entangling gates for Alice. To achieve this, we require the commutation relation,

[TABLE]

to hold, where $\hat{E}_{i}(k)$ ($\hat{E}_{i}^{\prime}(k)$) is the encoding (decoding) operation, with key $k$. Since Alice has limited classical computational power, she should determine the encoding/decoding operations efficiently with a classical computer, and implement these operations efficiently. The model is summarised in Fig. 1.

The most natural examples of schemes complying with this model are ones where systems encoding quantum information comprise two subsystems: a primary one in which the computation is taking place; and, a secondary independent one, which does not directly couple with the primary and is unaffected by the computational operations. This allows us to exploit the secondary subsystem (e.g polarisation) to control the entropy of our codewords, without affecting the computation in the primary subsystem (e.g photon-number).

III Displacement-key encoding

Phase-space displacement operations satisfy the required commutation relation of Eq. (2). The displacement operation adds coherent amplitude to an optical state, thereby translating it in phase-space. This process is described by the unitary displacement operator, given by,

[TABLE]

Displacement operations are easily experimentally implemented using a low-reflectivity beamsplitter and a coherent state (well approximated by a laser source) (Kok and Lovett, 2010, Eq (9.15)), of the form,

[TABLE]

(see Fig. 2). The displacement amplitude is directly proportional to the coherent state amplitude and the beamsplitter reflectivity. A special case of displaced states are displaced vacuum states, which are identically coherent states of the same amplitude, $\hat{D}(\alpha)|0\rangle=|\alpha\rangle$.

The commutation relation between displacement operators and linear optics evolution relates the output displacement amplitudes $\vec{\beta}=(\beta_{1},\dots,\beta_{m})$ to the input displacement amplitudes $\vec{\alpha}=(\alpha_{1},\dots,\alpha_{m})$, and is given by

[TABLE]

where $\hat{D}(\vec{\beta})=\bigotimes_{j=1}^{m}\hat{D}(\beta_{j})$, $\hat{D}(\vec{\alpha})=\bigotimes_{j=1}^{m}\hat{D}(\beta_{j})$, and $\vec{\beta}$ relates to $\vec{\alpha}$ according to the unitary map

[TABLE]

The computation required for Alice to determine her decoding operations from her encoding operations is simple matrix multiplication, which is efficiently computable Arora and Barak (2009). Thus, our condition on the complexity of encoding/decoding is satisfied.

An input tensor product of displacement operations with amplitudes $\vec{\alpha}$ on multiple modes may be be reversed by applying inverse displacement operations with amplitudes $\vec{\beta}$ at the output, $\hat{D}(\vec{\beta})^{\dagger}=\hat{D}(-\vec{\beta})$. Specifically,

[TABLE]

allowing the computation, $\hat{U}|\psi_{\mathrm{in}}\rangle$, to be recovered from the encoded computation, $\hat{U}\hat{D}(\vec{\alpha})|\psi_{\mathrm{in}}\rangle$, via application of the inverse of the encoding operation.

Our scheme extends trivially to the case where the server is asked to perform any Gaussian operation, rather than only passive linear optical evolution. This is because displacements similarly commute with squeezing as one can see from

[TABLE]

and all Gaussian operations can be expressed as linear-squeezing-linear evolutions according to the Bloch-Messiah decomposition Bloch and Messiah (1962); Braunstein (2005), together with displacements, where $\hat{S}(re^{i\theta})$ denotes a squeezing operator with $r\geq 0$, $\theta\in\mathbb{R}$ and $\gamma=\alpha\cosh r+\alpha^{*}e^{i\theta}\sinh r$.

The decryption circuit that Alice uses is identical in structure to her encryption operation, and Alice does not need to able to perform arbitrary linear optical operations that potentially requires up to $m(m-1)/2$ beamsplitters. Rather, Alice’s decryption circuit on $m$ modes always requires only $m$ beamsplitters. Because of this, Alice’s decryption circuit has exactly the same structure as her encryption circuit. Both the encryption and decryption circuits can then in principle be implemented using $m$ Mach-Zehnder interferometers, and such an optical circuit is independent of Bob’s LOQC. To find out what coherent states to input into the beamsplitters for the decryption, Alice needs only to know (1) her own secret encrypting displacements, and (2) the unitary that Bob’s linear optical circuit implements.

Unlike phase-key or polarisation-key encoding, where the encoding operations applied to each mode must be identical for the encryption/decryption commutation relation to hold, for displacements the amplitudes may be chosen independently for each mode, while still preserving the desired commutation relation. Intuitively, one would anticipate that the ability to choose keys independently for each mode would improve security, since the elimination of correlations between input encoding operations allows the entropy of the encoded state to be greatly increased, thereby making codewords less distinguishable.

We examine this protocol in the context of input data comprising of arbitrary pure quantum states of light with no more than $n$ photons. In the photon-number basis this implies that,

[TABLE]

where $|j\rangle=\frac{1}{\sqrt{j!}}(\hat{a}^{\dagger})^{j}|0\rangle$ is a photon-number (Fock) state and $\hat{a}^{\dagger}$ is the photonic creation operator, and $|\psi_{\mathrm{in}}\rangle$ has unit norm so that $\sum_{j=0}^{\infty}|\lambda_{j}|^{2}=1.$

We consider states supported on no more than $n$ photons, because such states can well approximate states of bounded energy in the following sense.

Lemma 1**.**

Let $\rho=\sum_{j}p_{j}|\phi_{j}\rangle\langle\phi_{j}|$ be a density operator where every $|\phi_{j}\rangle$ has expected energy at most $\mu$. Let $n\geq\mu$. Then there exists a density operator $\rho^{\prime}=\sum_{j}p_{j}|\phi^{\prime}_{j}\rangle\langle\phi^{\prime}_{j}|$ where $|\phi_{j}\rangle$ has at most $n$ photons and expected energy at most $\mu$ for every $j$, such that

[TABLE]

One can see that the approximation error becomes small when $n$ becomes large for fixed $\mu$. The proof of Lemma 1 follows trivially from Lemma 12 and Lemma 13 in the appendix. Lemma 12 and Lemma 13 show respectively that the trace-distance between states can be related to the Euclidean norms, and the approximation error for pure states can be bounded using a connection with Markov’s inequality.

IV Security proof

The main result of our paper is the following theorem, which implies that our encoding scheme in the limit of large coherent displacements has weak information-theoretic security.

Theorem 2**.**

The trace-distance between arbitrary encrypted states with at most $n$ photons is at most $\epsilon$, where

[TABLE]

Our scheme thus is a weak information-theoretic security encryption scheme with secrecy error at most $2\epsilon$.

Our proof employs a continuous-variable (CV) representation for optical states Braunstein and Pati (2012). We omit some intermediate mathematical steps in the main text, delegating the complete step-by-step derivation to the appendix.

Photon-number (Fock) states are related to the $x$ and $p$ quadrature CVs using Hermite functions (Arfken et al., 2013, Section 18.1). The Hermite polynomials are defined as,

[TABLE]

and the corresponding Hermite functions as,

[TABLE]

These provide the direct relation between discrete variable (DV) and CV representations of optical states. Most importantly, for Fock states we have,

[TABLE]

where $x$ is a position eigenstate in phase-space. The position eigenstates form a complete basis, satisfying,

[TABLE]

Our input state from Eq. (9) can therefore be expressed in the position basis as

[TABLE]

Let Alice’s encoding operation be represented by the quantum process $\mathcal{E}_{\mathrm{enc}}$, which applies a random complex-valued displacement, chosen from a normal distribution with zero mean and standard deviation $\sigma$. Experimentally, $\sigma$ is bounded by the energy output of coherent laser sources. An unknown encoding operation can be represented as a quantum process,

[TABLE]

where $\mu(\alpha)=\frac{e^{-|\alpha|^{2}/(2\sigma^{2})}}{2\pi\sigma^{2}}$ is a Gaussian measure and $d^{2}\alpha=d(\Re(\alpha))d(\Im(\alpha))$ indicates that the integral is performed over the real and imaginary parts of $\alpha$. Then our encrypted state $\hat{\rho}_{\mathrm{enc}}=\mathcal{E}_{\mathrm{enc}}(\rho_{\mathrm{in}})$ can be interpreted as a weighted mixture over all possible displacement amplitudes associated with the entire key-space. Displacing a position eigenstate by $\alpha=u+iv$ shifts its position by $v$ and appends a phase that depends on its position, $u$ and $v$. After performing the integral over the imaginary part of the complex number $\alpha=u+iv$, we get

[TABLE]

The security of the scheme can be quantified using the trace-distance between any pair of its encrypted inputs. When the trace-distance between a pair of states in an encryption scheme approaches zero, the resolution of this pair of states as perceived by Eve or Bob vanishes. Such a scheme is said to exhibit weak information-theoretic security Lai and Chung (2019), and we proceed to show that our encryption scheme indeed exhibits such a form of security.

To show that the trace-distance between almost arbitrary input states with no more than a fixed number of photons approaches zero as the standard deviation of the random displacements grows, we require detailed information of every matrix element $\langle a|\hat{\rho}_{\mathrm{enc}}|b\rangle$. To get a handle on $\langle a|\hat{\rho}_{\mathrm{enc}}|b\rangle$, it suffices to consider $\langle a|\hat{\rho}_{i,j}|b\rangle$ where $\hat{\rho}_{i,j}=\mathcal{E}(|i\rangle\langle j|)$ because $\hat{\rho}_{\mathrm{enc}}=\sum_{0\leq i,j\leq n}\lambda_{i}^{*}\lambda_{j}\hat{\rho}_{i,j}$. Since $\langle a|$ and $|b\rangle$ can be both expressed in terms of Hermite polynomials in the position basis, we find that $\langle a|\hat{\rho}_{i,j}|b\rangle$ is just an integral of the product of four Hermite polynomials. To evaluate these integrals, we recall that any Hermite polynomial $H_{j}(x)$ can be expressed as the coefficient of $t^{j}$ in the Gaussian generating function $e^{-x^{2}/2+2xt-t^{2}}e^{-x^{2}/2}j!$ (Arfken et al., 2013, Eq. 18.5). Hence, $\langle a|\hat{\rho}_{i,j}|b\rangle$ may be evaluated by writing all of the Hermite polynomials in terms of their Gaussian generating functions, performing the Gaussian integrals, and then reading off the respective coefficients. In doing so, we find the exact form of $\langle a|\hat{\rho}_{i,j}|b\rangle$ in Lemma 4 of the appendix. Namely, $\langle a|\hat{\rho}_{i,j}|b\rangle$ is only non-zero when $b-a=j-i$. Moreover, we have that

[TABLE]

and when $k\geq 1$, we find in Lemma 11 of the appendix that

[TABLE]

where $y=\frac{1}{2\sigma^{2}}$ and $x=\frac{2\sigma^{2}}{1+2\sigma^{2}}$. Now let $T$ denote the difference between two encrypted inputs. Let us write $T=D+O$ in the Fock basis, where $D$ is the diagonal of $T$. From this decomposition of $T$, we will obtain an upper bound on the trace norm of $T$. First we prove that the trace norm of $D$ is $O(\sigma^{-2})$. To see this, we show in Lemma 7 of the appendix that

[TABLE]

We can use this fact to show in Lemma 8 of the appendix that $\|\hat{\rho}_{i+1,i+1}-\hat{\rho}_{i,i}\|_{1}\leq 2^{i}\sigma^{-2}$ for $\sigma^{2}\geq 2$, from which it follows from a telescoping sum that trace-distance between any pair of encrypted Fock states is at most $2^{n-1}n\sigma^{-2}$. Next, we upper bound the trace norm of $O$. To see this, note that the Gersgorin circle theorem Varga (2004) implies that $\|O\|_{1}$ is at most the sum of the absolute values of all its matrix elements. By applying a summation of Eq. (19) over the indices $a$ and $k$ and by doing the summation in $a$ first, we can use simple binomial identities to find that $\|O\|_{1}\leq 8(n+1)\sigma^{-2}$. Together, with the triangle inequality on the trace norm of $D+O$, this allows us to show that the trace-distance between arbitrary encrypted states with at most $n$ photons is at most,

[TABLE]

which asymptotes to zero for large maximum coherent amplitudes in the encoding operations. This thereby proves Theorem 2.

When the client Alice has as her input to the scheme a separable state on $m$ modes, where each mode has at most $n$ photons, it is easy to see using a telescoping bound on the modes that the trace-distance between arbitrary multi-mode separable states is at most $m$ times of the value in (21). Coherent states with mean photon number of up to $10^{8}$ can be easily generated in a cavity mode of a pumped laser (Hanamura et al., 2007, Section 4.1). Since the intensity of a laser can be attenuated with an variable attenuator, this corresponds to having $|\alpha|$ value that ranges between 0 and $10^{4}$, which allows one to create random displacements with $\sigma=10^{4}$. If each mode has at most 15 photons, then using (19), we find that the trace-distance between arbitrary encrypted states on a single mode is at most $6.8\times 10^{-7}$.

V Adaptive linear optics

Thus far, we have exclusively considered passive linear optics, where there is no measurement or feedforward. However, feedforward – the ability to measure a subset of the optical modes, and use the measurement outcome to dynamically control the subsequent linear optics network – is an essential ingredient in many linear optics quantum information processing protocols. For example, when employing single-photon encodings for qubits, it is well known that universal quantum computing is possible with the addition of fast-feedforward Knill et al. (2001), which is known to require non-linearity Bartlett and Sanders (2002). On the other hand, it is strongly believed that without non-linearity such as feedforward, such schemes cannot be made universal Bartlett and Sanders (2002).

Let us understand intuitively how feedforward and non-linearities can enable two different notions of universality in quantum optical computing. The first notion is CV universality Braunstein and Pati (2012), where Braunstein and Lloyd show using Baker-Campbell-Hausdorff arguments how one can in principle implement Hamiltonian evolutions that are arbitrary polynomials of quadrature operators. To achieve this notion of CV universality, it suffices to implement Gaussian unitaries which our scheme can handle natively, along with any non-Gaussian operation which can be achieved using non-linearities. The second notion of universality is involves DV encoded within CV states, and achieving universal DV quantum computation. In this notion of DV universality with CV states, non-linearities can help to initialize non-Gaussian states, which are resource states to be consumed during gate teleportation to produce a non-Gaussian gates. To perform the gate teleportation, one entangles the resource state with a target mode where the non-Gaussian gate is to be computed, and subsequently measures the resource state. One then applies a Gaussian gate on the target mode, conditioned on the measurement outcome. For instance, on a GKP encoding Gottesman et al. (2001), a combination of non-Gaussian gates with Gaussian gates can be universal, and such gates can be achieved with feedforward operations with non-linearities.

Can we accommodate for fast-feedforward in the displacement-key homomorphic encryption protocol? Yes we can. Without loss of generality, let us imagine that we wish to measure just one mode and feedforward the measurement outcome to a subsequent round of linear optics, to be once again executed by Bob. For server Bob to perform this measurement, he would have to know the appropriate decryption operator for that mode. However, he does not have this by virtue of the protocol, and Alice cannot provide it to him, lest he misuses it to compromise security.

The only avenue to accommodating the feedforward is to make the protocol interactive. That is, whenever Bob requires a measurement result, to proceed with the computation he outsources the measurement of that mode back to Alice, who returns to him a classical result. This doesn’t undermine the viability of the protocol, since Alice is already assumed to have the ability to apply decoding operations, which are by definition separable and can therefore be performed on a per-mode basis.

It is clear that any computation requiring feedforward will necessarily require turning the encryption protocol into an interactive one between Alice and Bob. While this is undesirable, it is to be expected given that no-go proofs have been provided against universal, non-interactive, fully homomorphic protocols Yu et al. (2014); Newman and Shi (2017); Lai and Chung (2018).

VI Robustness

One might wonder how the robustness of our displacement-key encoding scheme to noise compares with the robustness of phase-key and polarization key encoding schemes. In short, because the demands on the structure of the input states of the client Alice is relatively mild, she can use bosonic quantum codes on a single mode Gottesman et al. (2001); Michael et al. (2016). If Alice uses GKP states Gottesman et al. (2001), so that small imperfections in displacements can be be corrected while the large random displacements can still obfuscate her data from Bob. To constrain the photon number per mode, one can use approximate versions Matsuura et al. (2019) of GKP states. In contrast, bosonic quantum coding schemes are not immediately compatible with the previous phase-key Tan et al. (2018b) and polarization-key schemes Rohde et al. (2012b). For the polarization-key encoding which encrypts boson sampling, without quantum error correction, simulating boson sampling classically remains classically hard with very little noise Rohde and Ralph (2012) but becomes classically simulable when there is too much noise Rahimi-Keshari et al. (2016). The phase-key scheme Tan et al. (2018b) is only robust to loss errors when the computed states remains entirely classical, and become vulnerable to loss errors once they become entangled into cat states.

VII Conclusion

We have presented a technique for homomorphic encryption of almost arbitrary optical states under the evolution of linear optics. The scheme requires only separable displacement operations for encoding and decoding, yet provides perfect secrecy in the limit of large displacement amplitudes. For passive linear optics, the protocol requires no client/server interaction, remaining entirely passive. For adaptive linear optics, an interactive protocol is required. The technology for implementing the encoding scheme is readily available today, making near-term demonstration of elementary encrypted optical quantum computation viable.

VIII Acknowledgments

Y.O. thanks Jake Iles-Smith for insightful discussions. P.P.R is funded by an ARC Future Fellowship (project FT160100397). This research was supported in part by the Singapore National Research Foundation under NRF Award No. NRF-NRFF2013-01. ST acknowledges support from the Air Force Office of Scientific Research under AOARD grant FA2386-15-1-4082 and FA2386-18-1-4003. ST conducted part of this writing while she was a Guest Researcher at the Niels Bohr International Academy. Y.O. acknowledges support from Singapore’s Ministry of Education, and the US Air Force Office of Scientific Research under AOARD grant FA2386-18-1-4003.

Appendix A Preliminaries

A.1 Hermite polynomials

Define the Hermite polynomials as

[TABLE]

and the corresponding Hermite functions as

[TABLE]

A.2 The action of a displacement operator on a position eigenstate

The displacement operator can be written as

[TABLE]

where $\alpha=u+iv$ is a complex number, with $u,v\in\mathbb{R}$. Now the position and momentum operators which admit representations as $x$ and $\frac{1}{i}\frac{d}{dx}$ respectively can also be written as dimensionless quadratures $X_{1}$ and $X_{2}$ respectively which can be related to the ladder operators via the equalities

[TABLE]

which implies that $\hat{X}_{1}=\frac{1}{\sqrt{2}}(\hat{a}^{\dagger}-\hat{a})$ and $\hat{X}_{2}=\frac{1}{i\sqrt{2}}\left(\hat{a}^{\dagger}-\hat{a}\right)$ respectively. Then

[TABLE]

Since $[\hat{X}_{1},\hat{X}_{2}]=i$ the dimensionless quadrature operators $\hat{X}_{1}$ and $\hat{X}_{2}$ indeed satisfy the canonical commutation relations. We then write the displacement operator in terms of the quadrature operators to get

[TABLE]

Now recall that the BCH formula for operators $A,B$ whose commutator is proportional to the identity operator is $e^{i(A+B)}=e^{iA}e^{iB}e^{-\frac{i^{2}}{2}[A,B]}=e^{iA}e^{iB}e^{[A,B]/2}$. Hence

[TABLE]

Now let $|x\rangle_{1}$ denote an eigenstate of the quadrature operator $\hat{X}_{1}$ with eigenvalue $x$, so that $\hat{X}_{1}|x\rangle_{1}=x|x\rangle_{1}$. Then it is clear that $e^{i\theta X_{1}}|x\rangle_{1}=e^{i\theta x}|x\rangle_{1}$. The position eigenstate can be written in the momentum basis, which is also its Fourier basis, so

[TABLE]

where $|p\rangle_{2}$ denotes an eigenstate of the second quadrature operator $\hat{X}_{2}$ with eigenvalues $p$. Hence

[TABLE]

Hence it follows that

[TABLE]

Appendix B Representation of the encrypted state

Lemma 3**.**

Let $|\psi\rangle=\sum_{i=0}^{n}\lambda_{i}|i\rangle$ for any $\lambda_{i}\in\mathbb{C}$ such that $\langle\psi|\psi\rangle=1$. Let $\mathcal{E}$ be the encryption operation that randomly displaces with a complex number $u+iv$, where $u$ and $v$ are chosen independently from normal distributions with mean 0 and standard deviation $\sigma$. Let $\rho_{\mathrm{enc}}=\mathcal{E}(|\psi\rangle\langle\psi|)$. Then

[TABLE]

Proof.

Note the Fock states can be written in the position basis, so that for all non-negative integers $i$ we have

[TABLE]

Then $|\psi\rangle\langle\psi|=\sum_{i=0}^{n}\sum_{j=0}^{n}\lambda_{i}\lambda_{j}^{*}|i\rangle\langle j|$. Expanding this out in the position basis, and dropping the labels on the first quadrature eigenstates, we get

[TABLE]

Then for real $u$ and $v$, we get

[TABLE]

Encrypting the state $|\psi\rangle\langle\psi|$ and changing the variable with respect to $u$ then gives

[TABLE]

We can perform the integral with respect to $v$ to arrive at

[TABLE]

Simplifying the above and relabeling the variables in the integration then gives the result. ∎

Appendix C Integrals of products of Hermite polynomials

The following lemma gives a bound for the exponential suppression of a certain integral of products of Hermite polynomials in the orders of the some of the Hermite polynomials. The key tools used here are generating functions for the Hermite polynomials, and this leads to a significant improvement of bounding the absolute value of the integral of product of Hermite functions over that in Ref. Ouyang and Ng (2013).

Now let us define the integral

[TABLE]

so that

[TABLE]

If we encrypt another state of the form $\sum_{i=0}^{n}\mu_{i}|i\rangle$, then the difference between the two matrix elements will be

[TABLE]

Define $\hat{\rho}_{i}=\mathcal{E}(|i\rangle\langle i|)$, and define $\hat{\rho}_{i,j}=\mathcal{E}(|i\rangle\langle j|)$. Then

[TABLE]

Clearly for $\rho=\sum_{i,j}\lambda_{i}\lambda_{j}^{*}|i\rangle\langle j|$, by linearity of the encryption operation,

[TABLE]

We use the method of generating functions to evaluate the exact form for the integral $I_{a,b,i,j}$.

Lemma 4**.**

Let $a,b,i,j$ be non-negative integers and $\sigma>0$. Let $x=\frac{2\sigma^{2}}{1+2\sigma^{2}}$ and $y=1/(2\sigma^{2})$ . Then

[TABLE]

Proof.

Let $I=I_{a,b,i,j}$. The generating function of the Hermite polynomial is given by

[TABLE]

Hence, using the notation $[t^{n}]f(t)$ to denote the coefficient of $t^{n}$ in an analytical function $f(t)$, we get

[TABLE]

Recall that

[TABLE]

Now

[TABLE]

Hence

[TABLE]

This integral can be easily performed. We make use of the identity

[TABLE]

where $a>0$. Using this identity repeatedly, we can show that

[TABLE]

where $\alpha=1/(1+2\sigma^{2})$ and

[TABLE]

By writing the exponential in $F$ as a product of four exponentials, and using the Taylor series expansion for each, we have

[TABLE]

By extracting the coefficients, we get

[TABLE]

Clearly, $i_{1}+i_{2}+i_{3}+i_{4}=\frac{a+b+i+j}{2}$. Thus

[TABLE]

for $\alpha=1/(1+2\sigma^{2})$. Note that

[TABLE]

Now note that $i_{1}=a-i_{2}$, $i_{1}=b-i_{3}$, $i_{4}=i-i_{2}$ and $i_{4}=j-i_{3}$, which implies that

[TABLE]

Therefore

[TABLE]

Making appropriate substitutions then completes the proof. ∎

Appendix D Towards the proof of the indistinguishability bound

The key result that we rely on is the result from Lemma 4 which gives an exact form for $I_{a,b,i,j}$ in terms of $y=1/(2\sigma^{2})$ and $x=\frac{2\sigma^{2}}{1+2\sigma^{2}}$. Now let $b=a+k$ for $k\geq 0$. Then observe that $I_{a,b,i,j}=0$ unless $j=i+k$. Hence we restrict our attention to this case. Then we have

[TABLE]

To see this, Lemma 4. Recall that the subscripts for the summation in Eq (43) must satisfy the equalities

[TABLE]

We can then get

[TABLE]

Hence $b-a=j-i.$ So if $b=a+k$, then $(a+k)-a=j-i$ which implies that $k=j-i$ and hence $j=i+k$. Hence whenever $j\neq i+k$, there will be nothing in the summation of (43) to sum over, and the summation in that case evaluates to zero.

Before we proceed, we provide the proofs of several simple but useful technical lemmas. The first technical lemma we need is the following combinatorial identity.

Lemma 5**.**

Let $0<x<1$, and let $k$ be a non-negative integer. Then $\sum_{a\geq k}x^{a}\binom{a}{k}=\frac{x^{k}}{(1-x)^{k+1}}$.

Proof.

First note that by relabeling the index for the summation, the sum in the lemma is equal to $\frac{1}{k!}\sum_{a\geq 0}x^{a+k}(a+k)\dots(a+1)=\frac{x^{k}}{k!}\frac{d^{k}}{dx^{k}}\sum_{a\geq 0}x^{a+k}$. By use the generating function $1/(1-x)$ which holds because $|x|<1$, the summation becomes $\frac{x^{k}}{k!}\frac{d^{k}}{dx^{k}}\frac{x^{k}}{1-x}$. Simplifying this using the fact that $1-x^{k}=(1-x)(1+\dots+x^{k+1})$ yields the result. ∎

The next technical lemma we need also involves binomial coefficients.

Lemma 6**.**

Let $x=(2\sigma^{2})/(1+2\sigma^{2})$, and let $i$ and $k$ be non-negative integers such that $0\leq k\leq i-1$. Then $\binom{i+1}{k}x-\binom{i}{k}=\binom{i}{k}\left(\frac{kx}{i-k+1}-\frac{1}{2\sigma^{2}+1}\right).$

Proof.

Note that $\binom{i+1}{k}x-\binom{i}{k}=\frac{kx}{i-k+1}-\frac{1}{2\sigma^{2}+1}$ is equal to $\binom{i}{k}\left(\frac{(i+1)x}{i-k+1}-1\right)$. Next it is easy to see that $\frac{i+1}{i-k+1}=1+\frac{k}{i-k+1}$. Hence

[TABLE]

which proves the result. ∎

Note the trivial fact that $\sum_{k\geq 0}x^{k}=1+2\sigma^{2}$. Let us consider the case of $k=0$ first, which corresponds to $i=j$. Hence we consider the non-zero matrix elements of $\hat{\rho}_{i}$, which are $\langle a|\hat{\rho}_{i}|a\rangle$ for $a=0,1,\dots,$. Notice then that we have

[TABLE]

We are then in a position to bound the trace distance between $\hat{\rho}_{i+1}$ and $\hat{\rho}_{i}$ for every integer $i$. In the lemma that follows, we only consider positive integer $i$, because the case of $i=0$ has already been shown earlier.

Lemma 7**.**

Let $i$ and $a$ be any non-negative integer. Let $x=(2\sigma^{2})/(1+2\sigma^{2})$ and $y=1/(2\sigma^{2})$ for $\sigma>0$. Then

[TABLE]

Proof.

To prove this, we consider two scenarios. In one scenario, $a$ is small in the sense that $a\leq i$. In the other scenario, $a>i$.

When $a\leq i$, using Lemma 6, we have the following

[TABLE]

Using the expansion for $\langle a|\hat{\rho}_{i}|a\rangle$, we then get

[TABLE]

Now we proceed to consider the case when $a>i$. Then we can use Lemma 6 again to get

[TABLE]

Hence we get

[TABLE]

and the result follows from (67) and (68). ∎

The trace distance between $\hat{\rho}_{i+1}$ and $\hat{\rho}_{i}$ is suppressed with increasing $\sigma$, as we shall now show.

Lemma 8**.**

The trace distance between $\hat{\rho}_{i+1}$ and $\hat{\rho}_{i}$ is

[TABLE]

Proof.

Since $\hat{\rho}_{i+1}$ and $\hat{\rho}_{i}$ are diagonal matrices in the number basis, we have

[TABLE]

Using Lemma 7 for the exact form of $\langle a|\rho_{i+1}|a\rangle-\langle a|\hat{\rho}_{i}|a\rangle$, we get

[TABLE]

where $\binom{a}{k}=0$ for all $k>a$. The first summation above is trivial to bound because the trace of a density matrix must be one, so one must have $\sum_{a\geq 0}\langle a|\hat{\rho}_{i}|a\rangle=1$. For the second summation, we can use Lemma 5 to get

[TABLE]

Since $x/(1-x)=2\sigma^{2}=y^{-1}$ and $1/(1-x)=2\sigma^{2}+1$ for $x=(2\sigma^{2})/(1+2\sigma^{2})$, we get

[TABLE]

Now $\sum_{k=1}^{i+1}\binom{i}{k-1}y^{k}=y\sum_{k=0}^{i}\binom{i}{k}y^{k}=y(1+y)^{i}$. Thus using the fact that $x\leq 1$, $\frac{1}{2\sigma^{2}+1}\leq\frac{1}{2\sigma^{2}}$ and $y=1/(2\sigma^{2})$, we get

[TABLE]

and the result follows. ∎

Clearly then by the telescoping sum, the trace distance between any pair of encrypted diagonal states can be easily bounded.

Lemma 9**.**

Let $n$ be any positive integer, and let $i$ and $j$ be non-negative integers such that $i<j\leq n$. Then for $\sigma>0$, the trace distance between $\hat{\rho}_{i}$ and $\hat{\rho}_{j}$ is at most

[TABLE]

Proof.

One just needs to write $(\hat{\rho}_{i}-\hat{\rho}_{i+1})+\dots+(\hat{\rho}_{j-1}-\hat{\rho}_{j}).$ There are at most $n$ such bracketed terms, so using the triangle inequality with Lemma 8 gives

[TABLE]

This proves the result. ∎

We now proceed to obtain a bound on the off-diagonal matrix elements $\rho_{i,j}$. Without loss of generality, assume that $j=i+k$ for $k\geq 0$. To analyze this case, we first consider the following technical lemma that is easy to verify.

Lemma 10**.**

Let $a,i,i_{2}$ and $k$ be non-negative integers, and let $i_{2}\leq a,i$. Then

[TABLE]

Proof.

It is easy to see that $\binom{a}{k}\binom{i}{k}=\binom{a+k}{k}\binom{i+k}{k}\frac{\binom{i_{2}+k}{k}^{2}}{\binom{a+k}{k}\binom{i+k}{k}}.$ Next observe that since $i_{2}\leq a$ and $i_{2}\leq i$, we have $\frac{\binom{i_{2}+k}{k}^{2}}{\binom{a+k}{k}\binom{i+k}{k}}\leq 1$. ∎

Using Lemma 10 we can arrive derive bounds for the off-diagonal matrix elements $\hat{\rho}_{i,j}$.

Lemma 11**.**

Let $i,k$ be non-negative integers and let $j=i+k$. Then for $\sigma>0$,

[TABLE]

Proof.

Using the exact form for the matrix element $\langle a|\hat{\rho}_{i,j}|a+k\rangle$ as given in Lemma 4 and Lemma 10 to bound the binomial coefficients therein, we get

[TABLE]

where $y=1/(2\sigma^{2})$ and $x=(2\sigma^{2})/(1+2\sigma^{2})$. Using Lemma 4 again, we get

[TABLE]

Using the fact that $\hat{\rho}_{i+k}$ has unit trace, we easily get $\sum_{a\geq 0}|\langle a|\hat{\rho}_{i,j}|a+k\rangle|\leq(y/x)^{k}=\left(\frac{1+2\sigma^{2}}{4\sigma^{4}}\right)^{k}$. ∎

We are now ready to prove the main result.

Proof of Theorem 2.

First we prove that without loss of generality, we can let the any two input states to our scheme $\rho$ and $\rho^{\prime}$ be pure states. Now consider the case where $\rho$ and $\rho^{\prime}$ are mixed states. Then both of these states can always be written as

[TABLE]

such that $p_{j}=p_{j}^{\prime}$ for every $j\geq 1$. In this decomposition, the states $|\phi_{j}\rangle$ and $|\phi_{k}\rangle$ need not be distinct even when $j\neq k$. Similarly, $|\phi^{\prime}_{j}\rangle$ and $|\phi^{\prime}_{k}\rangle$ need not be distinct even when $j\neq k$. Here, we must have $p_{j}$ to be non-negative and $\sum_{j\geq 1}p_{j}=1.$ Then we use the linearity of the quantum channel $\mathcal{E}$ to see that

[TABLE]

Applying the triangle inequality for the trace norm, we get

[TABLE]

It hence follows that

[TABLE]

From (83), we can see that we can maximize over the trace distance between encrypted pure states to maximize $\|\mathcal{E}(\rho)-\mathcal{E}(\rho^{\prime})\|_{1}$. It thus suffices to consider $\rho=|\phi\rangle\langle\phi|$ and $\rho^{\prime}=|\phi^{\prime}\rangle\langle\phi^{\prime}|$ to be pure states in this security proof, where $|\phi\rangle=\sum_{i\geq 0}\lambda_{i}|i\rangle$ and $|\phi^{\prime}\rangle=\sum_{i\geq 0}\mu_{i}|i\rangle$. We make this assumption with loss of generality in the remainder of this proof.

Consider the matrix

[TABLE]

Now let $D$ be the diagonal component of $T$ and $O$ be the off-diagonal component of $T$. By the triangle inequality, we will have $\|T\|_{1}=\|D+O\|_{1}\leq\|D\|_{1}+\|O\|_{1}$. We now proceed to bound the diagonal component.

By definition, we have

[TABLE]

Using Lemma 4, we know that $I_{a,b,i,j}=0$ whenever $i\neq j$. Therefore, the above expression for $D$ simplifies to yield

[TABLE]

Hence it follows that

[TABLE]

where

[TABLE]

Since $\omega$ and $\omega^{\prime}$ are mixed states that are diagonal in the Fock basis, we can use (83) to see that

[TABLE]

Using Lemma 9,

[TABLE]

For the off-diagonal elements we can use the Gersgorin Circle Theorem (GCT). First, note that for any $i$ and $j$, $|\lambda_{i}\lambda_{j}^{*}-\mu_{i}\mu_{j}^{*}|\leq 2$. From the GCT the 1-norm of $O$ is at most the sum of the absolute values of all of its matrix elements. Notice that

[TABLE]

Hence we obtain from the GCT that

[TABLE]

where we have used the triangle inequality in the second inequality above. Using the fact that $I_{a,a+k,i,j}$ is only non-zero when $j-i=k$, and similarly for $I_{a+k,a,i,j}$, we get

[TABLE]

Combining this with the fact that $I_{a,a+k,i,i+k}=I_{a+k,a,i+k,i}^{*}$ we get

[TABLE]

Using Lemma 11 with $\sigma^{2}>0$ for the geometric sum, this becomes $\|O\|_{1}\leq 4\sum_{i=0}^{n}\sum_{k\geq 1}\sigma^{-2k}\leq\frac{4(n+1)\sigma^{-2}}{1-\sigma^{-2}}\leq 8(n+1)\sigma^{-2}$. The result then follows. ∎

Appendix E Multi-mode security

The security of our scheme on multiple modes arises from a telescoping sum on the modes, when the multi-mode state is a separable state. To see this explicitly, let the encryption operator on $m$ modes be $\mathcal{E}$. Because the random displacements are chosen independently for every mode, we have

[TABLE]

where $\mathcal{E}_{j}$ denotes an encryption operator on the $j$th mode. Now let $\mathcal{I}$ denote the identity channel on a single mode. Then for any two $m$-mode states $\rho=\rho_{1}\otimes\dots\otimes\rho_{m}$ and $\tau_{1}\otimes\dots\otimes\tau_{m}$ with a tensor product structure, we can write

[TABLE]

where $A_{j}=\mathcal{E}_{j}(\rho_{j})$ and $B_{j}=\mathcal{E}_{j}(\tau_{j})$. Using the telescoping sum, we have

[TABLE]

By applying the triangle inequality for the trace norm of each of the above bracketed terms, then we get

[TABLE]

Using the multiplicativity of the trace norm under the tensor product and the fact that every quantum state has a trace norm equal to one so that $\|A_{j}\|_{1}=\|B_{j}\|_{1}$, we find that

[TABLE]

If every single mode state $\rho_{j}$ and $\tau_{j}$ have at most $n$ photons, and every mode is randomly displaced independently with displacement vector taken from a complex Gaussian distribution of standard deviation $\sigma$ and mean 0, using the above inequality, we can see that the trace distance between the encrypted states $A_{1}\otimes\dots\otimes A_{m}$ and $B_{1}\otimes\dots\otimes B_{m}$ is simply at most $m$ times of the trace distance between arbitrary displacement-encrypted single mode states with at most $n$ photons.

Appendix F Bounded photon number and bounded energy

In this section, we prove that a quantum state with bounded expected energy is well approximated by a quantum state with a bounded number of photons. Using $\hat{n}=\sum_{n\geq 0}n|n\rangle\langle n|$ to denote the number operator, the expected energy of an arbitrary state $\rho$ supported on the Fock basis is defined to be

[TABLE]

First we prove a lemma that reduces the problem of bounding the trace-norm of the difference of density matrices to evaluating bounds on Euclidean norms, which is reminiscent of (Ouyang, 2019, Lemma 2).

Lemma 12**.**

Let $\rho=\sum_{j}p_{j}|\phi_{j}\rangle\langle\phi_{j}|$ and $\rho^{\prime}=\sum_{j}p_{j}|\phi^{\prime}_{j}\rangle\langle\phi^{\prime}_{j}|$ be density operators. Furthermore, let $|\epsilon_{j}\rangle=|\phi^{\prime}_{j}\rangle-|\phi_{j}\rangle$. Then

[TABLE]

Proof.

By definition, $|\phi^{\prime}_{j}\rangle=|\phi_{j}\rangle+|\epsilon_{j}\rangle$. Hence,

[TABLE]

By the triangle inequality, we have

[TABLE]

Now we use the definition of the trace norm where for any operator $A$, we have $\|A\|_{1}=\max_{U}\{\operatorname{Tr}(AU):\|U\|_{\infty}\leq 1\}$ where $\|U\|_{\infty}$ denotes the maximum singular value of $U$. For Hermitian operators, it suffices to consider the maximization of $U$ over unitary operators. For $\||\epsilon_{j}\rangle\langle\epsilon_{j}|\|_{1}$, the optimal $U$ is just the identity operator, and hence $\||\epsilon_{j}\rangle|<\epsilon_{j}|\|_{1}=\langle\epsilon_{j}|\epsilon_{j}\rangle$. To evaluate $\||\epsilon_{j}\rangle\langle\phi_{j}|\|_{1}$, consider the unitary operator $U$ that swaps the normalized states $|\epsilon_{j}\rangle/\sqrt{\langle\epsilon_{j}|\epsilon_{j}\rangle}$ and $|\phi_{j}\rangle$. Then we can see $\||\epsilon_{j}\rangle\langle\phi_{j}|\|_{1}=\langle\epsilon_{j}|\epsilon_{j}\rangle/\sqrt{\langle\epsilon_{j}|\epsilon_{j}\rangle}$. A similar argument applies for evaluating $\||\phi_{j}\rangle\langle\epsilon_{j}|\|_{1}$, and the result follows. ∎

Now we present a lemma regarding approximating a pure state with another pure state that has at most $n$ photons.

Lemma 13**.**

Let $|\phi\rangle$ be any pure state supported on the Fock basis that has expected energy $\mu$. Let $n$ be an integer such that $n\geq\mu$. Then there exists a state $|\psi\rangle$ that has at most $n$ photons and $\||\phi\rangle-|\psi\rangle\|\leq 2\sqrt{\mu/n}.$

Proof.

In the Fock basis, we have $|\phi\rangle=\sum_{j=0}^{\infty}\lambda_{j}|j\rangle$ where $\lambda_{j}$ are complex numbers and $\sum_{j=0}^{\infty}|\lambda_{j}|^{2}=1$. Now consider $|\psi\rangle=\sum_{j=0}^{n}\lambda_{j}|j\rangle+x|n+1\rangle$ for some complex number $x$ such that $|x|^{2}=1-\sum_{j=0}^{n}|\lambda_{j}|^{2}$. Hence it follows from the triangle inequality that

[TABLE]

where $|\epsilon\rangle=\sum_{j=n+1}^{\infty}\lambda_{j}|j\rangle$. Since $\|x|n+1\rangle\|=|x|$ and

[TABLE]

we get

[TABLE]

Now let $X$ denote a random variable that is equal to $j$ with probability $|\lambda_{j}|^{2}$. It then follows that

[TABLE]

By definition of the expected energy, we know that

[TABLE]

Since $X$ is a non-negative random variable, we can use Markov’s inequality, so that for any real number $b$ such that $b\geq 1$, we have

[TABLE]

Since $n\geq\mu$, we have

[TABLE]

Hence it follows that

[TABLE]

∎