Remote blind state preparation with weak coherent pulses in the field

TL;DR

This paper demonstrates a practical, long-distance remote blind quantum state preparation protocol using weak coherent pulses, enabling secure quantum cloud computing over 100 km fiber with high fidelity.

Contribution

The authors propose and experimentally verify a resource-efficient remote blind qubit preparation protocol suitable for long-distance quantum communication.

Findings

Successfully generated 1000 secure qubits with high fidelity

Demonstrated protocol over 100 km fiber in the field

Fidelity exceeds quantum no-cloning limit

Abstract

Quantum computing has seen tremendous progress in the past years. Due to the implementation complexity and cost, the future path of quantum computation is strongly believed to delegate computational tasks to powerful quantum servers on cloud. Universal blind quantum computing (UBQC) provides the protocol for the secure delegation of arbitrary quantum computations, and it has received significant attention. However, a great challenge in UBQC is how to transmit quantum state over long distance securely and reliably. Here, we solve this challenge by proposing and demonstrating a resource-efficient remote blind qubit preparation (RBQP) protocol with weak coherent pulses for the client to produce, using a compact and low-cost laser. We demonstrate the protocol in field, experimentally verifying the protocol over 100-km fiber. Our experiment uses a quantum teleportation setup in telecom wavelength and generates $1000$ secure qubits with an average fidelity of $(86.9\pm1.5)\%$, which exceeds the quantum no-cloning fidelity of equatorial qubit states. The results prove the feasibility of UBQC over long distances, and thus serving as a key milestone towards secure cloud quantum computing.

Figures

Tables

Table 1. Table 1: Experimental parameters for simulation. ϵ italic-ϵ \epsilon , failure probability; ϵ d subscript italic-ϵ 𝑑 \epsilon_{d} , decoy failure probability; S 𝑆 S , size; η d subscript 𝜂 𝑑 \eta_{d} , detector system efficiency; P d ​ a ​ r ​ k subscript 𝑃 𝑑 𝑎 𝑟 𝑘 P_{dark} , detector dark count rate; μ S ​ P ​ D ​ C subscript 𝜇 𝑆 𝑃 𝐷 𝐶 \mu_{SPDC} , SPDC’s mean photon pair per pulse; α 𝛼 \alpha , loss coefficient of optical fiber.

$ϵ$	${ϵ}_d$	$S$	${\eta }_d$	$P_{dark}$	${\mu }_{SPDC}$	$\alpha$
${10}^{-10}$	${10}^{-10}$	${10}^3$	$0.105$	$4\times {10}^{-7}$	$0.002$	$0.2dB/km$

Table 2. Table 2: Details of the experimental results for S = 1000 𝑆 1000 S=1000 for various distances L. N is the lower bound of required pulse number, Q μ subscript 𝑄 𝜇 Q_{\mu} , Q ν subscript 𝑄 𝜈 Q_{\nu} and Q 0 subscript 𝑄 0 Q_{0} are the gains for the signal states, decoy states and vacuum states, respectively. The error bars represent one standard deviation.

L (km)	$N$	$Q_{\mu }$	$Q_{\nu }$	$Q_0$
0	$7.8769\times {10}^{10}$	$\left(1.1286\pm 0.0003\right)\times {10}^{-5}$	$\left(6.1794\pm 0.0034\right)\times {10}^{-7}$	$\left(1.7951\pm 0.0034\right)\times {10}^{-8}$
26	$2.1564\times {10}^{11}$	$\left(1.1312\pm 0.0003\right)\times {10}^{-5}$	$\left(1.3192\pm 0.0012\right)\times {10}^{-7}$	$\left(1.4389\pm 0.0031\right)\times {10}^{-8}$
50	$4.5295\times {10}^{11}$	$\left(1.0666\pm 0.0002\right)\times {10}^{-5}$	$\left(4.1489\pm 0.0067\right)\times {10}^{-8}$	$\left(1.7397\pm 0.0025\right)\times {10}^{-8}$
76	$1.0822\times {10}^{12}$	$\left(1.5522\pm 0.0009\right)\times {10}^{-6}$	$\left(2.5001\pm 0.0052\right)\times {10}^{-8}$	$\left(1.2888\pm 0.0022\right)\times {10}^{-8}$
100	$1.8853\times {10}^{12}$	$\left(5.8679\pm 0.0042\right)\times {10}^{-7}$	$\left(2.9827\pm 0.0041\right)\times {10}^{-8}$	$\left(1.2303\pm 0.0015\right)\times {10}^{-8}$

Table 3. Table 3: The reconstructed density matrices for eight polarization states θ i ∈ R { k ​ π \ 4 : 0 ≤ k ≤ 7 } subscript 𝑅 subscript 𝜃 𝑖 conditional-set \ 𝑘 𝜋 4 0 𝑘 7 \theta_{i}\in_{R}\{k\pi\backslash 4\colon 0\leq k\leq 7\} after QND measurement over each distance L.

L (km)	$k=0$	$k=1$	$k=2$	$k=3$	$k=4$	$k=5$	$k=6$	$k=7$
0	$\left(93.9\pm 1.3\right)\%$	$\left(93.5\pm 1.1\right)\%$	$\left(96.0\pm 1.2\right)\%$	$\left(95.7\pm 0.7\right)\%$	$\left(95.8\pm 1.3\right)\%$	$\left(95.1\pm 0.9\right)\%$	$\left(95.9\pm 1.3\right)\%$	$\left(95.2\pm 0.8\right)\%$
26	$\left(94.1\pm 1.4\right)\%$	$\left(93.3\pm 0.9\right)\%$	$\left(95.1\pm 1.3\right)\%$	$\left(93.8\pm 1.1\right)\%$	$\left(93.0\pm 1.4\right)\%$	$\left(93.7\pm 1.0\right)\%$	$\left(96.6\pm 1.3\right)\%$	$\left(94.5\pm 0.8\right)\%$
50	$\left(91.4\pm 0.8\right)\%$	$\left(95.4\pm 0.9\right)\%$	$\left(92.2\pm 0.7\right)\%$	$\left(91.2\pm 1.1\right)\%$	$\left(90.8\pm 0.8\right)\%$	$\left(94.5\pm 1.0\right)\%$	$\left(91.5\pm 0.7\right)\%$	$\left(90.0\pm 1.3\right)\%$
76	$\left(91.7\pm 1.6\right)\%$	$\left(90.4\pm 2.4\right)\%$	$\left(92.9\pm 1.1\right)\%$	$\left(92.7\pm 2.2\right)\%$	$\left(92.4\pm 1.4\right)\%$	$\left(90.2\pm 2.0\right)\%$	$\left(91.8\pm 1.4\right)\%$	$\left(91.0\pm 1.9\right)\%$
100	$\left(85.8\pm 1.3\right)\%$	$\left(86.8\pm 1.8\right)\%$	$\left(86.9\pm 1.5\right)\%$	$\left(86.4\pm 1.7\right)\%$	$\left(85.9\pm 1.3\right)\%$	$\left(88.7\pm 1.8\right)\%$	$\left(86.9\pm 1.3\right)\%$	$\left(87.7\pm 1.6\right)\%$

Equations

$$N\ge \frac{18\log (S/ϵ)}{{\eta }^4},$$

$$N\ge \frac{2.1S\log (S/ϵ)}{\eta }.$$

$$p_{f}^{1}=\frac{{\left({\begin{array}[]{c}{{M_{\mu}}-M_{\mu}^{1}}\\ m\end{array}}\right)}}{{\left({\begin{array}[]{c}{{M_{\mu}}}\\ m\end{array}}\right)}}\simeq\left(\frac{{M_{\mu}}-M_{\mu}^{1}}{M_{\mu}}\right)^{m}={(1-{p_{1}})^{m}}.$$

$$P_f=S{p}_f^1=S(1-p_1{)}^m\le ϵ$$

$$M_{\mu }^1\ge M_{\mu }[1-\exp (\frac{S\log (ϵ/S)}{M_{\mu }})].$$

$$m>\frac{\log (ϵ/S)}{\log (1-p_1)}.$$

$$N=\frac{M_{\mu }}{p_{\mu }{Q}_{\mu }}>\frac{S}{p_{\mu }{Q}_{\mu }}\cdot \frac{\log (ϵ/S)}{\log (1-p_1)}.$$

$$\begin{array}{rl}& Q_{\mu }=1-e^{-\eta \mu }\simeq \eta \mu ,\\ & Q_1^{\mu }\simeq \eta \mu e^{-\mu }.\end{array}$$

$$N>\frac{S}{p_{\mu }\eta \mu }\cdot \frac{\log (ϵ/S)}{\log (1-e^{-\mu })}$$

$$N>\frac{2.1S\log (S/ϵ)}{\eta }$$

$$\begin{array}{rl}{M}_{\mu }^1& \ge M_{\mu }^{1,L}\\ =& \frac{N{p}_{\mu }{\mu }^2{e}^{-\mu }}{\mu \nu -{\nu }^2}[Q_{\nu }^{-}{e}^{\nu }-Q_0^{+}-\frac{{\nu }^2}{{\mu }^2}(Q_{\mu }^{+}{e}^{\mu }-Q_0^{-})],\end{array}$$

$$Q_{\lambda }^{\pm }=Q_{\lambda }\pm \sqrt{Q_{\lambda }\log (1/{ϵ}_d)/(2N_{\lambda })}$$

$$N>\frac{S}{p_{\mu }{Q}_{\mu }^{+}}\cdot \frac{\log (S/ϵ)}{(1-p_1^{-})},$$

$$\frac{\partial N}{\partial \mu }=0,\frac{\partial N}{\partial \nu }=0,\frac{\partial N}{\partial p_{\mu }}=0,\frac{\partial N}{\partial p_{\nu }}=0,$$

$$\begin{array}{rl}& \text{min :}N,\\ & \text{s.t. :}S(1-\frac{M_{\mu }^{1,L}}{M_{\mu }^{+}}{)}^{\frac{M_{\mu }^{-}}{S}}\le ϵ.\end{array}$$

$$\Psi (\overline{t_s},\overline{t_i})=⟨vac|\widehat{E_s}({\bar{t}}_s)\widehat{E_i}({\bar{t}}_i)|\Psi ⟩,$$

$$\widehat{E_s}=\frac{1}{\sqrt{2\pi }}\int d\omega f_s(\omega )e^{-i\omega {\overline{t}}_s},$$

$$\widehat{E_i}=\frac{1}{\sqrt{2\pi }}\int d\omega f_i(\omega )e^{-i\omega {\overline{t}}_i},$$

$$\begin{array}{rl}{\Psi }_{j,k}(\overline{t_{sj}},\overline{t_{ik}})=& \alpha \int d{\omega }_{p}d{\omega }_{sj}d{\omega }_{ik}{f}_p({\omega }_p)f_{sj}({\omega }_s)f_{ik}({\omega }_i)\\ & \delta ({\omega }_{sj}+{\omega }_{ik}-{\omega }_p)e^{i[{\omega }_{sj}{\overline{t}}_{sj}+{\omega }_{ik}{\overline{t}}_{ik}]},\end{array}$$

$$\begin{array}{rl}{\Psi }_{i_1,s_2,s_3}=& t^2{\Psi }_{12}({\overline{t}}_{s12},{\overline{t}}_{i1}){\Psi }_3({\overline{t}}_{s23})\\ & -r^2{\Psi }_{13}({\overline{t}}_{s13},{\overline{t}}_{i1}){\Psi }_2({\overline{t}}_{s22}),\end{array}$$

$$\begin{array}{rl}{P}_{i_1,s_2,s_3}=& {\eta }^3\int d{\overline{t}}_{i1}d{\overline{t}}_{s2}d{\overline{t}}_{s3}H({\overline{t}}_{i1}-t_0,\Delta T)\\ & H({\overline{t}}_{s2}-t_0,\Delta T)H({\overline{t}}_{s3}-t_0,\Delta T)|\Psi (i_1,s_2,s_3){|}^2,\end{array}$$

$$V_{HOM}=\frac{1}{\sqrt{\frac{1}{2}+\frac{\frac{{\sigma }_1^2}{{\sigma }_2^2}({\sigma }_p^2+{\sigma }_1^2)+\frac{{\sigma }_1^2}{{\sigma }_p^2}(2{\sigma }_2^2+{\sigma }_1^2)+\frac{{\sigma }_p^2{\sigma }_2^2}{{\sigma }_1^2}+3{\sigma }_2^2}{4({\sigma }_p^2+2{\sigma }_1^2)}}},$$

$${\phi }_1=N(|00{⟩}_{s,i}+{\alpha }_1|11{⟩}_{s,i}+{\alpha }_1^2|22{⟩}_{s,i}+O({\alpha }_1)),$$

$${\phi }_2=e^{-\frac{|{\alpha }_2{|}^2}{2}}(|0⟩+{\alpha }_2|1⟩+\frac{{\alpha }_2^2}{\sqrt{2!}}|2⟩+O({\alpha }_2)),$$

$$\begin{array}{rl}& V_{HOM}\approx \\ & \frac{4{\bar{n}}_2+2{\bar{n}}_2^2(2-\eta )+8{\bar{n}}_1(1-\frac{{\eta }_i}{2}){\bar{n}}_2(2-\eta )}{4{\bar{n}}_2+3{\bar{n}}_2^2(2-\eta )+12{\bar{n}}_1(1-\frac{{\eta }_i}{2}){\bar{n}}_2(2-\eta )+8{\bar{n}}_1},\end{array}$$

$$\begin{array}{rl}& V_{HOM}\approx \\ & \frac{2{\bar{n}}_2+\frac{{\bar{n}}_2^2}{2}(2-\eta )+2{\bar{n}}_1(1-\frac{{\eta }_i}{2}){\bar{n}}_2(2-\eta )}{2{\bar{n}}_2+\frac{3{\bar{n}}_2^2}{4}(2-\eta )+3{\bar{n}}_1(1-\frac{{\eta }_i}{2}){\bar{n}}_2(2-\eta )+4{\bar{n}}_1},\end{array}$$

Full text

As physicist Richard Feynman realized three decades ago Feynman (1982), quantum computation holds the promise of exponential speed up over classical computers in solving certain computational tasks. Quantum computation has been an area of wide interest and growth in the past couple of years Harrow and Montanaro (2017); Mohseni et al. (2017). Because of implementation complexity, it is speculated that the future quantum computers are accessed via the cloud service for common users. Indeed, the recent effort on quantum cloud service clo demonstrates the path towards this speculation. Blind quantum computing (BQC) Childs (2005); Arrighi and Salvail (2006); Broadbent et al. (2009) is an effective method for a common user (namely the Client), who has limited or no quantum computational power, to delegate computation to an untrusted quantum organization (namely the Server), without leaking any information about the user’s input and computational task.

Various BQC protocols have been proposed in theory Morimae and Fujii (2012); Giovannetti et al. (2013); Mantri et al. (2013); Reichardt et al. (2013); Fitzsimons and Kashefi (2017); Aharonov et al. (2017). In addition, several experiments have been reported to demonstrate the feasibility of BQC with photonic qubits Barz et al. (2012, 2013); Fisher et al. (2014); Greganti et al. (2016); Gehring et al. (2016); Huang et al. (2017). See Ref. Fitzsimons (2017) for a review. Notably, the universal BQC (UBQC) Broadbent et al. (2009) (see Fig. 1(a)), built upon the model of measurement-based quantum computation Raussendorf and Briegel (2001), does not require any quantum computational power or quantum memory for Client. The security or blindness of the UBQC protocol is information-theoretic, i.e., Server cannot learn anything about Client’s computation except its size. The only non-classical requirement for Client is that she can prepare qubits with a single photon source perfectly. Nonetheless, practical single photon sources are not yet readily available, despite a lot of effort Aharonovich et al. (2016).

To resolve the state-preparation issue, the recent remote blind qubit preparation (RBQP) protocol, proposed in Dunjko et al. (2012), enables preparing blind qubits with weak coherent pulses (WCPs), generated from a compact and low-cost laser diode, instead of perfect single photon source. In this protocol, Client prepares a sequence of WCPs with random polarization ${\theta_{i}}{\in_{\mathop{\rm R}\nolimits}}\{{{k\pi}\mathord{\left/{\vphantom{{k\pi}4}}\right.\kern-1.2pt}4}:0\leq k\leq 7\}$ and sends them to Server through a quantum channel. Server performs quantum non-demolition (QND) measurements on each of received WCPs and declares the results to Client. Client checks the reported number of vacuum events: if the number is smaller than a preset threshold, she asks Server to perform the interlaced 1-D cluster computation (I1DC) subroutine Dunjko et al. (2012) on the non-vacuum pulses. The RBQP protocol is completed with a polarization angle $\theta$ which is only known by Client and a single qubit in the state $|+_{\theta}\rangle$ held by Server. Running the RBQP protocol $S$ times will result in a computational size of $S$ single qubits. For a channel with transmittance $\eta$, this requires a total number of $N$ WCPs Dunjko et al. (2012),

[TABLE]

where $\epsilon$ denotes the failure probability. Nonetheless, the RBQP is inefficient for small $\eta$, i.e., $N$ scales as ${\rm O}({1\mathord{\left/{\vphantom{1{{\eta^{4}}}}}\right.\kern-1.2pt}{{\eta^{4}}}})$. It is thus demanding to design an efficient protocol for the future quantum network, where Client can access Server over a long distance.

We propose a refined RBQP protocol by employing the decoy state method, which is originally invented in the field of quantum key distribution Lo et al. (2005); Wang (2005). Our protocol can greatly reduce the required number of WCPs from ${\rm O}({1\mathord{\left/{\vphantom{1{{\eta^{4}}}}}\right.\kern-1.2pt}{{\eta^{4}}}})$ to ${\rm O}({1\mathord{\left/{\vphantom{1\eta}}\right.\kern-1.2pt}\eta})$. Furthermore, instead of generating one single qubit in each run, our protocol allows a client to generate S qubits simultaneously in a single instance. In our protocol, Client randomly modulates the intensity of each WCP according to intensity choice $\mu$ (signal), $\nu$ (decoy) and [math] (vacuum). Client runs the same as the initial RBQP, but with a different post-processing. With the reported QND results for each intensity, Client performs the decoy-state analysis to estimate the lower bound of the number of single-photon events Lo et al. (2005); Wang (2005). If the bound is larger than her preset threshold, Client asks Server to discard all the decoy pulses and randomly divided the remaining $M_{\mu}$ signal pulses into $S$ groups, each group containing $m=M_{\mu}/S$ signal pulses. Server performs the I1DC subroutine Dunjko et al. (2012) on each group and returns the measurement results to Client. The protocol completes with $S$ single qubits held by Server, of which the polarization angles are only known to Client. By doing so, in the limit that the probability of sending a signal state is approximately 1, the lower bound of $N$ in our protocol is,

[TABLE]

Comparing with Eq. (1), $N$ scales as ${\rm O}({1\mathord{\left/{\vphantom{1\eta}}\right.\kern-1.2pt}\eta})$, which is far less than that of the original protocol. We remark that any failure to detect a photon is subjected to the loss, which does not affect the security. We have also derived the analysis after considering the finite-data effect and show the details of these results in Appendix A.

A key challenge to implement RBQP is the realization of QND measurement. QND is a crucial technology in quantum information and it has been investigated widely in matter-based platforms Guerlin et al. (2007); Reiserer et al. (2013). However, these matter-based realizations require challenging techniques, such as strong light-matter interactions and optical wavelength conversion, which are not mature for real-life applications. Here, we solve the challenge by designing an experimentally feasible scheme based on linear optics and teleportation-based method Jacobs et al. (2002); Wang et al. (2015); Hiroki et al. (2015); Sun et al. (2016); Valivarthi et al. (2016). We move the QND to the field test over 100-km fiber by using two independent photon sources. The scheme of our experiment is shown in Fig. 2(a). We construct a quantum link in the field at the city of Shanghai, in which Client sends the polarization-encoding (POL) WCPs with decoy states to Server who performs QND measurements. The field distance between Client and Server is about 199 m.

Fig. 2(b) shows details of our experimental realization. Client possesses a gain-switched distributed feedback laser (DFB) to generate laser pulses at a repetition frequency of 250 MHz. Each pulse is carved into 37 ps pulse duration after passing through the first intensity modulator (IM). To generate the two decoy states, intensities of the pulses are randomly modulated by the second IM. Key bits are encoded into polarization states of the WCPs by a loop–interferometer–based polarization encoding scheme which consists of a polarization beam displacer (PBD) and phase modulator (PM). After attenuation, Client sends the weak coherent pulses to Server through a standard telecom coiled fiber.

Server prepares Einstein-Podolsky-Rosen (EPR) pairs of signal (s) and idler (i) photons in the quantum state of $|\Phi^{+}\rangle_{si}=\frac{1}{\sqrt{2}}(|H\rangle_{s}|H\rangle_{i}+|V\rangle_{s}|V\rangle_{i})$ via spontaneous parametric down-conversion (SPDC) process. The signal and idler photons are singled out by an inline dense wavelength division multiplexing filter (DWDM). The signal photons are used to take a Bell state measurement with the received photons from Client. These photons are detected by high-quality superconducting nanowire single-photon detectors (SNSPDs), where the detection events are registered by a field programmable gate array (FPGA). Note that after fiber polarization beam splitters (FPBSs), we use four fiber beam splitters (FBSs) and eight SNSPDs to mimic photon-number-resolving detectors Divochiy et al. (2008). This allows us to probabilistically detect 2-or-more inbound photons from the WCP. The idler photons undergo a quantum state tomography measurement for the quantification of the quality of the prepared qubits.

To implement the protocol, there are several technical challenges. First, a high-speed and high-fidelity polarization modulation is required to prepare eight polarization states $\theta_{i}$. We use a loop-interferometer-based scheme to realize the polarization modulation at a rate of 250 MHz with an average fidelity of ($99.42\pm 0.09)\%$ Agnesi et al. (2019). Second, it requires a high-visibility interference between two independent sources, i.e., the EPR pairs and the WCPs which experiences a long-distance transmission. To do so, we synchronize the two independent sources with a 12.5 GHz microwave clock and exploit two fiber Bragg gratings (FBG) filters with a bandwidth of 3.3 GHz to suppress the spectral distinguishability. Third, we optimize the average photon number from the WCP to obtain an optimal interference visibility. Finally, we detect the photons with a combination of four FBSs to decrease the multi-photons effect and eight high-efficiency and low-dark-count SNSPDs to maximize the interference visibility. See Appendix B for further details. These efforts allow us to achieve a high QND measurement fidelity of about $95\%$, which is much higher than those reported in previous works, e.g., $75\%$ in Valivarthi et al. (2016).

We characterize the QND test by performing quantum-state-tomography measurements on the teleported quantum states. We run our protocol over a distance of 100 km fiber, and measure the density matrices of eight teleported states at Server. These results are shown in Fig 3. The average fidelity is characterized as $(86.9\pm 1.5)\%$, which exceeds the maximum value of $2/3$ achievable in classical teleportation, and the quantum phase-covariant no-cloning bound of $85.4\%$ Bruß et al. (2000); Du et al. (2005). This result indicates the high fidelity of our QND measurement.

We run the whole system with fibers at distances 0 km 26 km, 50 km, 76 km and 100 km. Experimental parameters, including the intensities and probability distributions of signal and decoy pulses, are optimized numerically (see Appendix A). In each run, we generate $S=1000$ qubits which could be made blind via the I1DC. The experimental results are shown in Fig. 4(a). We can see that the required $N$ of our protocol is much lower than that of the original protocol Dunjko et al. (2012). In particular, at the distance of 100 km, it is up to 20 orders of magnitudes lower than that of the original protocol. At 0 km, the loss primarily comes from the inefficient QND measurement. Such a huge effective loss due to an inefficient QND measurement causes that the original RBQP protocol requires at least $N\sim 10^{26}$ pulses. In contrast, our decoy-state based protocol requires only $N\sim 10^{10}$ pulses. This number of pulses can be generated in less than a minute using our implementation system. Even at 100 km distance, our experiment only needs about 2 hours to generate $S=1000$ blind qubits. The average fidelities of the eight polarization states $|+_{\theta_{i}}\rangle$ for different distances are shown in Fig. 4(b).

In the RBQP, as shown in Fig. 1(b), the signal WCPs should be stored in a quantum memory after the QND measurement and the I1DC is applied afterwards. We simulate this procedure by storing the density matrixes of the signal states and performing the I1DC subroutine on a personal computer (see Appendix C). Our simulation results show that at the fiber length of 0 km, the average fidelity of the $1000$ blind qubits is $(81.9\pm 2.0)\%$. This fidelity can be improved if the client uses error correction code for encoding. A full implementation demands a high-performance quantum memory. In our setup, to generate 1000 blind qubits at 100 km would require a storage time of $\sim$2 hours and near unity process fidelity, which is still beyond the current quantum memory technology. Nevertheless, long storage time, large bandwidth and high fidelity quantum memories have been achieved, recently Zhou et al. (2012); Zhong et al. (2015); Yang et al. (2016); Jiang et al. (2019). These subjects are important for future studies.

In summary, we have proposed a decoy-state RBQP protocol and reduce the required number of WCPs $N$ from ${\rm O}({1\mathord{\left/{\vphantom{1{{\eta^{4}}}}}\right.\kern-1.2pt}{{\eta^{4}}}})$ to ${\rm O}({1\mathord{\left/{\vphantom{1\eta}}\right.\kern-1.2pt}\eta})$ to generate $S$ blind qubits. We have demonstrated a key step of our protocol by implementing the QND with two independent photon sources in the field, up to 100 km fiber. The fidelity of the generated qubits is above $86\%$. Our RBQP protocol with WCP and photonic experiment lead a heuristic exploration for UBQC over long-distance quantum networks, and they will be a crucial step for the commercialization and widespread adoption of secure quantum computation in cloud.

Appendix A Remote blind qubit state preparation with decoy states

A.1 Detailed steps

Here, we show the details of the two-decoy states method, where, besides the signal state $\mu$, the client prepares two decoy states: weak decoy $\nu$ and vacuum decoy [math]. The protocol goes as follows:

(i) Client prepares $N$ phase-randomized WCPs, in which $\{{N_{\mu}},{N_{\nu}},{N_{0}}\}$ are the number of pulses for signal state and decoy states with intensity $\{\mu,\nu,0\}$ and probability $\{{p_{\mu}},{p_{\nu}},{p_{0}}\}$. Each pulse is randomly polarized with polarization ${\theta_{i}}{\in_{\mathop{\rm R}\nolimits}}\{{{k\pi}\mathord{\left/{\vphantom{{k\pi}4}}\right.\kern-1.2pt}4}:0\leq k\leq 7\}$. Client sends the pulses to Server through a quantum channel with a transmittance no less than $\eta$.

(ii) After Server receives the pulses, he performs QND measurements and reports the measurement results to the client. Client performs the decoy states analysis to estimate the lower bound of the number of single-photon events, i.e., Client calculates the gain of signal and decoy states from the reported results of Server and then estimates the lower bound of the gain of single-photon events following the method proposed in Ma et al. (2005). Client checks the estimated number of single-photon events: if the number is greater than her predetermined threshold of Eq. (11), she continues; otherwise the protocol aborts.

(iii) If the protocol is not aborted, Client then asks Server to discard all the decoy states. Server is now left with $M_{\mu}$ signal states he received. Client then asks the server to randomly divide these $M_{\mu}$ signal states into S groups, each group containing $m=M_{\mu}/S$ signal states. Server performs the I1DC subroutine Dunjko et al. (2012) on each group of the signal states and returns the measurement results to Client. The protocol is completed with $S$ single qubits held by Server, of which the polarization angles are only known to Client.

A.2 Security analysis

The security (i.e., blindness) of our protocol lies in the fact that in the I1DC subroutine as long as the server is ignorant of the polarization angle of at least one photon of the 1D cluster, he is totally ignorant of the polarization angle of the final qubit Dunjko et al. (2012). Therefore the task of the client is to make sure that there is at least one single photon in each group. We now show how to choose a proper $N$ so that the probability that the protocol fails ${P_{f}}$ is bounded by ${P_{f}}\leq\epsilon$ for given transmittance $\eta$ and computation size $S$.

Suppose there are $M_{\mu}^{1}$ single photon states in the $M_{\mu}$ signal states received by Server. We define $p_{1}$ as the single photon ratio in the signal states ${p_{1}}\equiv\frac{{M_{\mu}^{1}}}{{{M_{\mu}}}}$, and $p_{f}^{1}$ as the probability that one of the groups fails, i.e. there is no single photon in that group. Then $p_{f}^{1}$ can be estimated by

[TABLE]

The second equation above is due to the assumption that $M_{\mu},~{}(M_{\mu}-M_{\mu}^{1})\gg m$. The probability that the protocol fails $P_{f}$ now can be bounded by

[TABLE]

Hence we have the bound for the number of single-photon events

[TABLE]

Also we can derive the required number of signals $N$. From Eq. (4), we have

[TABLE]

Because ${M_{\mu}}=N{p_{\mu}}{Q_{\mu}}$, we obtain the lower bound of

[TABLE]

Here, $Q_{\mu}$ denotes the gain of signal states, which is estimated by Client from Server’s feedback.

To evaluate the lower bound of $N$, the key point is lower bound $p_{1}$. We achieve this using decoy state method. If the Client can prepare infinite decoy states, the client can estimate the single-photon events perfectly. For long distance, i.e., $\eta\ll 1$, we have

[TABLE]

Now $N$ is given by

[TABLE]

By solving $\frac{{\partial N}}{{\partial\mu}}=0$, we obtain the optimal value of $\mu$ to be $\mu_{opt}=0.7$. In the limit that $p_{\mu}\simeq 1$, we have the bound for $N$ as

[TABLE]

However, in practice, the client has finite resources and all real-life experiments are done in a finite time. This means that we would use finite decoy states with considering finite statistics. Here, we achieve this using two decoy-state method proposed in Ma et al. (2005). The lower bound of single-photon events is given by

[TABLE]

where $Q_{\lambda}^{+}$ and $Q_{\lambda}^{-}$ denotes respectively the upper bound and the lower bound for the gain of an intensity choice $\lambda\in\{\mu,\nu,0\}$ due to finite statistics. They are bounded by Hoeffding inequality:

[TABLE]

where ${{\epsilon_{d}}}$ is the failure probability in decoy-state analysis.

The lower bound of $N$ is

[TABLE]

where $p_{1}^{-}=M_{\mu}^{1,L}/NQ_{\mu}^{+}$.

A.3 Numerical simulation and optimization

We perform a simulation based on the experimental parameters of our setup listed in Table 1.

To find the optimal values $\{\mu,~{}\nu,~{}p_{\nu},~{}p_{\mu}\}$ for given $\eta$, $S$, and $\epsilon$. In principle, we can done by solving

[TABLE]

which is a complicatedly mathematical problem. Instead, we do it by numerically solving the following routine:

[TABLE]

Here, $M_{u}^{\pm}$ represent the upper and lower bound of signal states due to finite effects, which are given by $M_{\mu}^{\pm}={M_{\mu}}\pm\sqrt{{M_{\mu}}\cdot\log(1/{\varepsilon_{d}})/2}$.

Appendix B Experimental details

B.1 Single photon polarization state modulation

We use a loop-interferometer-based polarization encoding scheme, shown in Fig. 5, to achieve states $|+_{\theta_{i}}\rangle=\frac{1}{\sqrt{2}}(|H\rangle+e^{i\theta_{i}}|V\rangle)$ at a rate of 250 MHz with high-fidelity. The photons on the state of $|+\rangle$, prepared by a polarization beam spliter (PBS), a half wave plate and polarization controller, incident into a loop interferometer via the port 1 of a polarization beam displacer (PBD), and then is split to two orthogonal components (i.e., horizontal (H) and vertical (V)). The two polarization components are coupled into the slow axis of the polarization maintained fiber pigtails of the phase modulator (PM) . The PM manipulates eight phases $\theta_{i}$ to the vertical component randomly via eight random voltages amplitudes generated by a 25 GHz arbitrary waveform generator (AWG). After routing the PM, the polarization of the two components is exchanged via an Faraday rotator (FR). Hence, when recombined on the PBD and the photon states are output from the port 3. We test the performance of our scheme by reconstructed the eight states using quantum state tomography measurement Daniel et al. (2001). As shown in Fig. 6, we realize each state with high fidelity, and the average fidelity is up to $(99.42\pm 0.09)\%$.

B.2 Polarization Einstein-Podolsky-Rosen sources

As depicted in the figure 2 of the main text, we generate polarization Einstein-Podolsky-Rosen (EPR) pairs in the Bell state $|\Phi^{+}\rangle_{si}=\frac{1}{\sqrt{2}}(|H\rangle_{s}|H\rangle_{i}+|V\rangle_{s}|V\rangle_{i})$ via spontaneous parametric down-conversion (SPDC) process in a Sagnac loop, here $s$ denotes signal photon and $i$ denotes idler photon. An 1558 nm gain-switched distributed feed-back laser (DFB) emits 2 ns laser pulse at 250 MHz. All the laser pulses are generated from vacuum fluctuation, so the source is phase-independent. A 40 GHz intensity modulation (IM) modulates the pulses into 80 ps laser pulses. Both the DFB laser and the IM are driven by a pules pattern generator (PPG). The laser pulses are amplified by an erbium-doped fibre amplifier (EDFA) and frequency-doubled in a periodically poled MgO doped Lithium Niobate (PPMgLN) crystal. We remote the remanent 1558 nm pulse with a low-pass filter (LF). The 779 nm pump laser is focused into a 2.5 cm long type-0 PPMgLN crystal to generate polarization-entangled photon pairs, with the beam waist of 54 um by using an aspheric lens and an off-axis parabolic mirror (OPM). The polarized photon pairs are non-degenerated at 1556 nm and 1560 nm, and are coupled into a single-mode optical fibre for spatial mode cleaning. The pump laser is removed by a silicon pellet (SiP). We create the entangled photon-pair source of $|\Phi^{+}\rangle_{si}=\frac{1}{\sqrt{2}}(|H\rangle_{s}|H\rangle_{i}+|V\rangle_{s}|V\rangle_{i})$ by adjusting the 780 nm half wave plate ((HWP) and the phase compensator (PC). The signal and idler photons are singled out by inline dense wavelength division multiplexing filters (DWDM).

To characterize the generated entangled state, we measure the polarization correlations between signal and idler photons. We set HWPs in the signal and idler path. By setting angle of HWP, we measure a coincidence rate as a function of the two polarizers with an average number of pairs per pulse of 0.002, we obtain a high average visibility of $(99.1\pm 0.4)\%$, shown in Fig. 7.

B.3 Bell states measurement and projection measurement

Our Bell states measurement (BSM) setup is able to distinguish the Bell states of $|\Psi^{-}\rangle=\frac{1}{\sqrt{2}}(|HV\rangle-|VH\rangle)$ and $|\Psi^{+}\rangle=\frac{1}{\sqrt{2}}(|HV\rangle+|VH\rangle)$. Photons from Client and from EPR pairs interference at the first beam splitter (BS). The photons at state $|\Psi^{-}\rangle$ exit from different ports of the BS. The photons at state $|\Psi^{+}\rangle$ exit from the same port of the BS, and then exit from different ports of the polarization beam splitter (PBS). We employ a BS after each port of PBS to reduce a portion of the contributions from the multi-photon pair events. The photons are detected by superconducting nanowire single photon detectors (SNSPDs) and the detection results are analyzed by a ?eld programmable gate array (FPGA) in real time. Furthermore, we characterize the quantum non-demolition (QND) test by performing quantum-state-tomography measurements on the teleported quantum states. To ensure that Client and Server have a shared reference frame of polarization, we aligned rectilinear bases (H and V) manually using fiber polarization controllers (FPCs), and employ a phase compensator in the path of the teleported photons to compensate the difference phase.

B.4 The interference of independent photons

In the scheme, it requires the interference of independent photons with a high quantum-interference visibility. This remains challenges for eliminating distinguishability and reducing multiple photons effect between weak coherent pulses and EPR sources. We use a three-photon Hong-Ou-Mandel interference (HOM) to estimate the interference.

To suppress distinguishability in spectrum, we discuss the relationship between the visibility and the bandwidth of the optical filters using the model shown in Fig. 8. To do this, we modify the calculation in Ref. Rarity1995. An effective 2-photon wave function at the detectors can be defined by,

[TABLE]

where $\hat{E_{s,i}}$ are electric field operators. They are given by,

[TABLE]

here, $\hat{t}=t-\tau$ represents the moment when the photons emerge, $\tau$ is the relative delay between the inputs of the BS. Before the BS, the wavefunction is given by

[TABLE]

with $j=2,3$ and $k=1$. $|\alpha|^{2}$ is simply the probability of photon conversion in a pump pulse, the spectral functions $f_{p}$, $f_{sj}$ and $f_{ik}$ are limited by the filters. Then, we can express the effective wave function at detectors as,

[TABLE]

where $t$ and $r$ represent the transmissivity and the reflectivity of the BS. In ideal condition, $t=r=\frac{1}{\sqrt{2}}$ . We ignore the $irt$ terms as only one of detector $D_{2s}$ and $D_{3s}$ can detect the photons and the coincidence of the three detectors will be zero. Thus the probability $P(i_{1},s_{2},s_{3})$ of detecting a threefold coincidence detection among all three detectors can be calculated from,

[TABLE]

where $\eta$ is effective detector efficiencies for three detectors and $H(\overline{t}_{x}-t_{0},\Delta T)$ is a normalized detector response function centered on $t_{0}$ that falls to zero when $\overline{t}_{x}-t_{0}>\Delta T~{}(\Delta T\approx 1ns)$. Then with a similar procedure used in Ref. Rarity1995, assuming a Gaussian spectral profile, the visibility of a HOM dip is given by

[TABLE]

$\sigma_{p}$ is the bandwidth of the filter for the pump, $\sigma_{1}$ is for the idler, and $\sigma_{2}$ is for and signal photons and the weak coherence pulse. In our experiment, we choose $\sigma_{p}\approx 54~{}pm$, $\sigma_{1}=\sigma_{2}=\sigma_{3}\approx 27~{}pm$, thus, the computed visibility is about $98.4\%$.

To ensure a temporal overlap, we synchronize two independent sources with a microwave clock. A PPG at Client’s side generates a 12.5 GHz sinusoidal signal. The signal drives an IM to modulate the continuous wave laser beam emitted by a DFB into 12.5 GHz laser pulses. The laser pulses are sent to Server and converted to an electrical signal using a 10 GHz detector. The electrical signal is amplified with a 40 GHz microwave amplifier and then used as the synchronization signal at Server’s side. After synchronization, the root mean square (RMS) value of the time jitter between the two sources is 4 ps, which is much smaller than the 133 ps coherent time of the photons.

To decrease the multi-photons effect, we optimize the mean photon number $\bar{n}_{1}$ of Server’s EPR pairs generated per pulse and the mean photon number $\bar{n}_{2}$ of Client’s weak coherence pulses for each fibre length. To model the interference visibility, we write the EPR state with thermal distribution,

[TABLE]

here $\mid\alpha_{1}\mid^{2}=\overline{n}_{1}$, $N$ is a normalising factor. The weak coherent state can be wrote with Poissonian distribution,

[TABLE]

here $\mid\alpha_{2}\mid^{2}=\overline{n}_{2}$. Then we follow a similar procedure as in Ref. Fulconis2007. Considering the probability of triple coincidence, the visibility is given by

[TABLE]

here $\eta$ is the detection efficiency for HOM, $\eta_{i}$ is the detection efficiency for the idler photon. Considering we reduce the contributions from the multi-photon-pair events, the visibility can be wrote as,

[TABLE]

In addition, the single-mode fiber ensure the indistinguishability in the spatial degree of freedom. In our experiment, $\eta\approx 0.105$, $\eta_{i}\approx 0.08$, we optimize the mean photon number per pulsed for each distance, take 0 km as an example, we set $\bar{n}_{1}=0.0020$ and $\bar{n}_{2}=0.0645$ , consider both spectrum distinguishability and multiple photons effect, in theory $V_{HOM}=92.5\%$, and we get experimental result with $V_{HOM}=(90.2\pm 0.4)\%$, shown in Fig. 9.

Appendix C I1DC subroutine simulation

To generate blind qubits, Server has to conduct the I1DC subroutine Dunjko et al. (2012) after Client telling him where the signal pulses are. However before he performing the operation, the qubits need to be stored in quantum memory, which is beyond our power. So we gather information about the states received by Server, and then simulate this subroutine in a classical way. The I1DC subroutine runs as follows: Assume there are n signal qubits left in Server’s side. Devide the n signal qubits into S groups, each group contains k qubits. For the k qubits:

1. For i=1 to k-1

(a) Apply the unitary $ctrl-Z(H\otimes I)$ to qubits i and i+1.

(b) Measure qubit i in the Pauli-X basis, get the outcome $y_{i}$.

2. Report the measurement results $y=(y_{1},...,y_{(k-1)})$ and the remaining qubit i=k in state $|+_{\theta_{k}}\rangle$.

Through tomography, we obtain the density matrixes $(\rho_{1},\rho_{2},...)$ of the signal states at Server’s side. With these density matrixes we can conduct the I1DC simulation. In the experiment for 0 km, we get 4384 signal pulses, which means for 1000 groups, each group will contain 4 or 5 pulses. Applying I1DC to each group, we will get 3 or 4 measurement results $y=(y_{1},y_{2},...)$ and a density matrix $\rho_{experiment}$ of the remaining qubit. Furthermore, we compare the remaining qubit $\rho_{experiment}$ with the idea state $\rho_{idea}$ by calculating the fidelity. Here $\rho_{idea}$ is obtained by assuming a perfect QND measurement. Finally, we get fidelity of $(81.94\pm 1.95)\%$.

Appendix D Details of experimental results

In our experiment, we have run the system at different distances of 0 km, 26 km, 50 km, 76 km and 100 km for preparing 1000 blind single qubits. Considering both the QND fidelity and the required number N, we optimized the signal and decoy states intensities for each distance. Details of results are listed in Tables LABEL:tab:res. The gains are obtained from the BSM results, and the lower bound of the required number N are calculated by using Eq. (9). Furthermore, the fidelities of the quantum states after QND measurement are calculated with the reconstructed density matrices via relation $F_{\theta_{i}}=\langle\Phi_{QND}|\Phi_{\theta_{i}}|\Phi_{QND}\rangle$ shown in Tables 3. The uncertainties are calculated using a Monte Carlo routine assuming Poissonian errors.