Eberhard limit for photon-counting Bell tests and its utility in quantum key distribution

Loophole-free Bell tests are the gold standard of entanglement testing [1, 2, 3, 4, 5]. They provide definitive proof that multiple parties share quantum entanglement which can then be used for applications such as device-independent quantum key distribution (DI-QKD)[6, 7, 8, 9, 10, 11, 12, 13], quantum metrology[14, 15, 16, 17] and device-independent randomness generation[18, 19, 20]. If instead there exists some loopholes, the proof is not definitive but relies on some extra assumptions. For example, the detection loophole is opened by filtering out some measurement results (usually when a photon is lost) i.e. performing post-selection. The proof of entanglement is then not definitive but based on additional fair-sampling assumptions [21, 22]. In particular, QKD without loophole-free Bell tests are then vulnerable to attacks by exploiting these extra security assumptions, and commercial devices have been routinely hacked as a result [23, 24].

Closing the detection loophole is experimentally demanding and requires minimizing losses to increase the detection efficiency above some threshold. The crucial first steps towards experimental tests which closed the detection loophole were enabled by pivotal works by Eberhard, who demonstrated that using non-maximally entangled states can greatly lower the strict efficiency requirements [25]. Specifically, using a maximally entangled polarization Bell pair $\frac{1}{\sqrt{2}}(\ket{\textrm{HV}}+\ket{\textrm{VH}})$, the detection loophole is closed only for detector efficiencies $\eta>2(\sqrt{2}-1)\approx 82.8\%$, whereas using a non-maximally entangled state $\sqrt{1-g^{2}}\ket{\textrm{HV}}+g\ket{\textrm{VH}}$, one can approach the limit $\eta>2/3$ as $g\to 0$. Paradoxically, this is when the state approaches the separable $\ket{HV}$, so that it becomes less tolerant to other types of noise. In practice, the optimal value of $g$ then depends on the relative importance of different sources of imperfection. The first experiments exploiting the Eberhard inequality chose a value of $g=0.297$ [26].

Nowadays loophole-free Bell tests are becoming more common [1, 2, 3, 4], with the first fully DI-QKD demonstrations being performed [27]. However, until now all these Bell tests have been performed for 2-qubit polarization/spin singlet states and using the typical CHSH test based on polarization/spin measurements[28], precluding the possibility of testing the entanglement of some more exotic states, such as multiphoton/qudit states. Bell tests for multiphoton states of light based on photon-counting experiments were first theorised in the 1990s[29, 30, 31, 32] and have since been expanded on in a number of papers [33, 34, 35, 36], including a proposal for DI-QKD based on these tests [37]. These tests work for a variety of important states such as two-mode squeezed vacuum[33], generalized Holland-Burnett states[37] and hybrid-entangled Schrödinger cat states[38].

In this work we investigate whether these photon-counting tests form a universal test for entanglement in the photon-number degree of freedom. We demonstrate that any entangled state with high photon-number correlations can violate one of a number of Bell inequalities without employing any post-selection or filtering of results, thus having the possibility of closing the detection loophole. This requires low losses and high efficiency detectors, however we demonstrate that states which asymptotically approach the vacuum state have the maximum possible efficiency tolerance $\eta>2/3$, matching that obtained by Eberhard for polarization/spin measurements. Moreover, this tolerance is not limited to the CHSH tests introduced in the original papers, but is also a property of the multiple output CGLMP inequalities[39], opening up loophole-free Bell tests to both more exotic states and more exotic inequalities. Finally, we demonstrate that the Eberhard inequality found in this paper has utility for DI-QKD protocols, allowing one to increase both the loss tolerance and key rates using less than maximally entangled states.

Figure 1 depicts a Bell test for a two-mode state of light $\ket{\Psi}$. The two modes are spatially separated, with one mode being sent to Alice and the other to Bob. Each party interferes their mode with a coherent state $\ket{\alpha}$ and $\ket{\beta}$, on variable beam splitters with reflectivities $r_{a}$ and $r_{b}$ respectively. Finally they use photon-number-resolving (PNR) detectors to measure the number of photons $i$, $j$ in the two transmitted modes behind the beam splitters. The combination of the complex amplitude $\alpha$ and reflectivity $r_{a}$ form a ‘measurement setting’ for Alice, while $\beta$ and $r_{b}$ form the corresponding setting for Bob. In the limits $|\alpha|,|\beta|\to\infty$ and $r\to 0$ the beam splitter interactions are equivalent to displacement operators $D(-\delta_{\alpha})$ and $D(-\delta_{\beta})$ where $\delta_{\alpha}=i\alpha\arcsin(\sqrt{r_{a}})\approx i\alpha\sqrt{r_{a}}$ and $\delta_{\beta}$ defined similarly. By collecting measurement statistics for $m\geq 2$ settings per party, Alice and Bobs can prove entanglement of their shared state, either by showing violation of a Bell inequality or via linear programming methods.

Since the coherent states have a finite probability to contain any number of photons, $i,j$ can be any integer, and the number of measurement outcomes is unbounded. To make use of known Bell inequalities it is thus necessary to reduce these to a finite number of outcomes, $\Delta$. The simplest case $m=2,\Delta=2$ has been analyzed in the previous literature [29, 30, 31, 32]. One way to reduce the output to two outcomes is for Alice (Bob) to assign a measurement outcome of $a=1$ $(b=1)$ when zero photons are transmitted and an outcome of $a=-1$ $(b=-1)$ when non-zero photons are transmitted. The probability for a joint measurement of zero photons is then

which is simply the two-mode Q-function of the state $Q(\delta_{\alpha},\delta_{\beta})$ (we neglect the usual factors of $\pi$). Moreover, the marginal probability that Alice detects zero photons

is just the Q-function of her reduced state, $Q_{a}(\delta_{\alpha})$, and Bob’s probability $p(j=0)$ is defined similarly. Here $\textrm{Tr}_{b}$ is a trace over Bob’s modes. If Alice and Bob choose $\delta_{\alpha}$ and $\delta_{\beta}$ randomly from the sets $[\delta_{\alpha_{1}},\delta_{\alpha_{2}}]$ and $[\delta_{\beta_{1}},\delta_{\beta_{2}}]$ respectively, the CHSH inequality[28] for this zero/non-zero test can then be expressed entirely in terms of Q-functions as follows

$|B_{Q}|\leq 2$, where $Q_{xy}=Q(\delta_{\alpha x},\delta_{\beta y})$, $Q_{ax}=Q_{a}(\delta_{\alpha x})$ and $Q_{by}=Q_{b}(\delta_{\beta y})$.

Another simple way to obtain two outcomes is for Alice (Bob) to assign a measurement outcome of $a=1$ $(b=1)$ when an even number of photons are transmitted and an outcome of $a=-1$ $(b=-1)$ when an odd number are transmitted. This even/odd test can also be directly related to a quasi-probability distribution, since the quantum correlation $\langle ab\rangle$ is given directly by the two-mode Wigner function

The CHSH inequality for this test is then

$|B_{W}|\leq 2$, where $W_{xy}=W(\delta_{\alpha x},\delta_{\beta y})$.

Perhaps the most simple way to generalize the above tests is to extend the number of outcomes $\Delta$ beyond two. This requires the following general formula to measure arbitrary photon numbers $i,j$

where $D_{im}(\delta_{\alpha})=\bra{i}D(\delta_{\alpha})\ket{m}$ is the transition element of the displacement operator between two Fock states

Using Eq. (6) we can evaluate inequalities in the scenario $m=2$, $\Delta=3$. The facet-defining inequalities here are the CGLMP inequalities[39], plus the usual projections onto CHSH. Instead of separating into zero/non-zero outcomes as before, we can now separate into zero photons, single photons and two or more photons, forming our three outcomes per party. The CGLMP inequality for this scenario may be written as

$I\leq 2$, where

Notice that all of the described photon-counting Bell tests take into account every possible experimental outcome, including cases where photons are lost, so that no post-selection or fair sampling assumptions are required. This allows the possibility for these tests to close the detection loophole without any modifications.

To determine whether such tests work as a universal test for entanglement-verification in the photon number regime, we consider states of the form $\sum_{m,n=0}^{d}C_{mn}\ket{m}\ket{n}$. We first considered the perfectly correlated states $C_{mn}=C_{nn}\delta_{mn}$, and performed an exhaustive search over all complex values $C_{nn}$ for $d\leq 4$. By numerically maximizing the CHSH violation over all four complex displacements, we found that the test worked to prove entanglement for the vast majority of states, the only exception being states with very weak levels of entanglement i.e. those that are close to separable states. Thus we may conjecture that the photon-counting Bell tests work for all perfectly correlated pure entangled states, and since these tests do not require any post-selection or filtering of results, they have the possibility of closing the detection loophole. To illustrate this point, we plot in Fig. 2 the results for states of up to $d=2$ photons, with real coefficients $C_{nn}$. $C_{00}$ and $C_{11}$ are varied while $C_{22}$ is fixed by the normalization condition $C_{22}=+\sqrt{1-C^{2}_{00}-C^{2}_{11}}$. The positive square root can be taken without loss of generality since the negative square root is equivalent to flipping the sign of all other coefficients, as the state would change only by a global phase.

Fig. 2(a) shows the CHSH value for the zero/non-zero test. One observes that the test succeeds mostly everywhere, notably except along the line $C_{00}=0$, i.e. states which have no vacuum component. The test also fails for states like $C_{00}+\epsilon C_{22}$, $\epsilon\ll 1$ i.e. states that are close to vacuum with no single photon component. Everywhere else this test works well, and can yield fairly high violations of local realism. The greatest violation of 2.69 is found for the states $(\pm\ket{00}\pm\ket{11})/\sqrt{2}$. Although these states are maximally entangled in 2 dimensions, the basis states are not qubits but Fock states which are infinite dimensional. Fig. 2(b) shows the CHSH value for the even/odd test, where one observes that it is much weaker than the zero/non-zero test. One advantage however is that, unlike the zero/non-zero test, it can succeed for states with no vacuum component $C_{00}=0$. This test instead fails for states with a definite photon number parity e.g. along the line $C_{11}=0$, as could be expected. Performing both of these tests can then eliminate the weaknesses of the individual tests, leading to fairly large CHSH violations for the vast majority of photon-number correlated states, as shown in Fig. 2(c). In contrast, states without perfect correlation, $C_{mn}\neq 0$ for $m\neq n$, cannot always be verified by these tests. In general, as the levels of entanglement and photon-number correlations increase, the more likely the test will succeed.

The amount of CHSH violation does not give a complete picture, however. A crucial factor for experimental tests is how tolerant the Bell inequality violation is to photonic losses. These losses may be modelled by interfering the state with vacuum on a fictional beamsplitter of reflectivity $1-\eta$ and tracing out the reflected beam, equivalent to a photon being successfully transmitted with probability $\eta$. With these losses considered solely to occur after the displacement operation, $\eta$ can be interpreted as the detection efficiency of the two detectors. Fig. 2(d) shows the loss tolerance of the zero/non-zero test for the 2-photon states. Interestingly, one observes that as one approaches the vacuum state $C_{00}\to 1$, the loss tolerance approaches $\eta>2/3$, exactly the Eberhard limit. Placing the losses in the source i.e. before the displacement operation, leads to very similar conclusions with only a slightly more strict limit $\eta>0.71$. From a mathematical point of view the fact that we can reach the Eberhard limit is not too surprising, since the state in this limit can be approximated as something like $\sqrt{1-g^{2}}\ket{00}+g\ket{11}$ which is mathematically identical to the 2-qubit state originally considered by Eberhard. However, it is interesting that this limit can be approached through this completely different measurement scheme, with routine optical experimental devices[40, 41], and with entanglement in photon-number rather than polarization or spin. The even/odd test has a much worse loss tolerance, as seen in Fig. 2(e). Although it also displays Eberhard level loss tolerance in the same limit, it drops rapidly as we leave the vicinity of the vacuum state $\ket{00}$, so that it is not really visible in this figure.

For a concrete example we can consider the two-mode squeezed vacuum state $\ket{\psi}=\frac{1}{\cosh g}\sum_{n=0}^{\infty}(-e^{i\phi}\tanh g)^{n}\ket{n}\ket{n}$ which is a qudit state of in principle infinite dimension. The photon-counting Bell tests have been considered for these states in the early papers[29, 30, 31, 32], althought they didn’t find the greatest violation of the Bell inequalities and didn’t realise its large loss tolerance in the low squeezing limit $g\to 0$.

The relevant Q-functions for the TMSV state are

with $Q_{b}(\beta)$ defined analogously, while the two-mode Wigner function is

The CHSH parameters for both tests, $|B_{Q}|$ and $|B_{W}|$ were numerically maximized by a combination of differential evolution, Nelder-mead and simulated annealing methods, using Eqs. (3) and (5). For the zero/non-zero test, the optimal choice of measurement settings $[\delta_{\alpha_{1}},\delta_{\alpha_{2}}],[\delta_{\beta_{1}},\delta_{\beta_{2}}]$ maximizing $|B_{Q}|$ were found to have the form $[x,-y],[xe^{i\phi},-ye^{i\phi}]$, where $x$ and $y$ are positive real numbers which depend on the amount of squeezing $g$. This choice of relative phases can be understood as those maximizing $Q(\delta_{\alpha 1},\delta_{\beta 2})$ and $Q(\delta_{\alpha 2},\delta_{\beta 1})$ while minimizing $Q(\delta_{\alpha 2},\delta_{\beta 2})$. The relative phase between $\delta_{\alpha_{1}}$ and $\delta_{\alpha_{2}}$ is then fixed, forcing $Q(\delta_{\alpha 1},\delta_{\beta 1})$ to be minimized. For the even/odd test, the optimal settings maximizing $|B_{W}|$ have the same form, with similar reasoning, in this case maximizing/minimizing the various Wigner functions rather than the Q functions.

The results are shown in Fig. 3(a) as a function of parametric gain, $g$. One sees that the zero/non-zero test is optimal for the more experimentally relevant low gain regime, shown by the fact that $|B_{Q}|>|B_{W}|$, reaching an optimal value of $|B_{Q}|=2.45$ at $g=0.74$. Increasing $g$ further, the zero/non-zero test weakens due to the fact that zero photon events become increasing unlikely. The even/odd test dominates here $|B_{W}|>|B_{Q}|$, and reaches a maximum value $|B_{W}|=2.32$ in the limit of high gain $g\to\infty$. Since the TMSV state becomes the original EPR state in this limit, in theory the even/odd test becomes a solution to the EPR paradox as originally proposed. However, as pointed out in the original analysis [30], there is difficulty both reaching, and performing the relevant measurements in, this limit. These results further highlight the general features we noticed before. The zero/non-zero test works better for low photon-number states i.e. low squeezing $g$, and the even/odd test works better for high photon-number states i.e. high squeezing $g$. Additionally, we also consider the CGLMP inequality with 3 outputs, distinguishing between 0, 1 and 2 or more photons. This performs similarly to the zero/non-zero test, although the Bell inequality violation is slightly lower. Furthermore from Fig. 3(b), one sees that all three tests reach the Eberhard level loss tolerance $\eta>2/3$, although the zero/non-zero test has a loss tolerance which decays much less rapidly than the other two, so is more practical for testing the non-locality of the two-mode squeezed vacuum state. The reason for this is that losing a photon is catastrophic for the even/odd test since it changes an even result to an odd one and vice-versa. In contrast the zero/non-zero test is more robust since a non-zero result can remain non-zero. The fact that the CGLMP inequality also displays Eberhard level loss tolerace in the low squeezing regime, opens up the possibility of loophole-free Bell inequality tests using higher dimensional inequalities. Unfortunuately, the loss tolerance degrades faster with parametric gain than the zero/non-zero CHSH test, so that it appears to have limited practical use for the two-mode squeezed vacuum state in particular.

The Eberhard limit is reached when we consider detector losses i.e. with the losses occurring after the displacement operation, however we have also considered losses in the source i.e. with losses occurring before the displacement operation. The loss tolerance in this case is shown as the dashed lines in Fig. 3(b). The conclusions are not much changed, except that we reach a slightly worse maximum loss tolerance of $\eta>0.71$.

As an example of the utility of this Eberhard limit for photon-counting, we can consider a DI-QKD protocol based upon these tests, similar to what has been considered in[37]. There, a proposal was considered in which generalized Holland-Burnett states (i.e. the output of two Fock states interfering on a beam splitter) are distributed between two parties, and the zero/non-zero Bell test was used to establish a shared secret key. We now consider the non-maximally entangled state $\sqrt{1-\epsilon}\ket{00}+\sqrt{\epsilon}\ket{11}$ and demonstrate that using non-maximal entanglement can yield increased key rates and loss tolerances for key distribution. For $\epsilon=1/2$ this state becomes $\frac{1}{\sqrt{2}}(\ket{00}+\ket{11})$ which leads to the same Bell inequality violation $~{}2.69$ and loss tolerance $~{}15\%$ as the state considered in [37]. We have already seen that lowering $\epsilon$ from this symmetrical value can increase the loss tolerance of the Bell tests, approaching the Eberhard limit, but it remains to be seen whether it can also increase the loss tolerance of the DI-QKD protocol as a whole, since in general the loss tolerance of DI-QKD is even more strict than the loophole-free Bell test itself.

We consider a simple DI-QKD scenario based on CHSH violation as outlined in[6, 7, 8, 11]. In addition to the two measurement settings per party used in the CHSH test $[\delta_{\alpha_{1}},\delta_{\alpha_{2}}]$ and $[\delta_{\beta_{1}},\delta_{\beta_{2}}]$, Alice now uses a third setting $\delta_{\alpha_{0}}$. Each time the entangled state is distributed to them, Alice performs a measurement randomly choosing between her three settings, and Bob randomly chooses between his two settings. After a number of trials $N\to\infty$, they publicly communicate the settings used for each trial. A number of results using settings from the sets $[\delta_{\alpha_{1}},\delta_{\alpha_{2}}]$ and $[\delta_{\beta_{1}},\delta_{\beta_{2}}]$ are also communicated publicly and used to evaluate the CHSH inequality, while a small sample, $N^{\prime}$ of results using the combination $\delta_{\alpha_{0}}$ and $\delta_{\beta_{1}}$ are kept secret and form the raw key shared between Alice and Bob. Violation of the CHSH inequality guarantees that Eve cannot obtain full information about the key, providing information-theoretic security of communications where they key is used in a one-time-pad.

After performing classical privacy amplification and error correction on their raw key of length $N^{\prime}$, they obtain the final key of reduced length $KN^{\prime}$ where the key rate $K$ is given by[42]

Here $I(A_{0}:B_{1})$ is the mutual information between Alice and Bob (when using settings $\delta_{\alpha_{0}},\delta_{\beta_{1}}$), specifying the fraction of bits that are kept after performing error correction, while $I(B_{1}:E)$ is the mutual information between Bob and Eve, giving the number of bits that are sacrificed for privacy amplification. Assuming Eve performs optimal collective attacks against the protocol, the key rate can be lower bounded[8, 9, 10] by

where $h(x)$ is the binary entropy function, $B$ is the obtained CHSH inequality value, and $H(A_{0}|B_{1})$ is the conditional entropy between Alice and Bob. There are also methods for upgrading security against collective attacks to security against the most general coherent attacks [11]. Having loophole-free Bell inequality violation $B>2$ is required, but not sufficient, to obtain a finite key rate $K>0$, since the entropy $H(A_{0}|B_{1})$ must also be minimized. For this reason, we cannot obtain a loss tolerance of $\eta>2/3$ for DI-QKD, but by using non-maximally entangled states, the loss tolerance can still be improved.

By numerically maximizing Eq. (15) with respect to the three settings of Alice and two settings of Bob, we have calculated the key rate that Alice and Bob may obtain by distributing the state $\sqrt{1-\epsilon}\ket{00}+\sqrt{\epsilon}\ket{11}$, for varying levels of photonic loss. The results for the maximally entangled state $\epsilon=1/2$ are shown in the blue line Fig. 4, where one observes that after 7% loss, the key rate drops to zero, indicating a rather strict efficiency requirement of 93%. However, this can be improved considerably by instead distributing non-maximally entangled states. For each value of loss we have found the optimal value of $\epsilon$ and calculated the key rates, which are shown as the orange line in Fig. 4. Compared to maximally entangled states, the loss tolerance is increased from 7% to 10.5%, a 50% improvement.

We have demonstrated the Eberhard inequality for photon-counting Bell tests, showing that detection loophole-free Bell tests are possible with efficiencies as low as 2/3, for photon-number entangled states which are generally multiphoton. We have shown this for two types of CHSH tests, based on discriminating between zero/non-zero photons, and even/odd numbers of photons respectively, but we have also shown it for CGLMP inequalities with more than two outputs. This opens up loophole-free Bell tests, and applications such as QKD, to more exotic states and types of entanglement than typical polarization/spin singlet states. The Eberhard limit for CGLMP inequalities could also allow detection loophole-free tests other than CHSH for the first time. The CHSH tests considered have been shown to work for states that are perfectly correlated in photon number, although for states without perfect correlation it can sometimes fail. Generally the more correlated in photon number states are, the more likely they are to violate these photon counting Bell tests, although a complete set of criteria to understand which states should violate these tests is still sought after.

To highlight the utility of the Eberhard level of loss tolerance for photon-counting Bell tests, we have shown that the loss tolerances and key rates of DI-QKD protocols can be drastically improved by the distribution of photon-number entangled states which are not maximally entangled. DI-QKD represents the ultimate level of cryptography which is immune to any eavesdropping at either the source or detection, and DI-QKD proposals based on photon number entanglement is an active area of research[37] since it has been shown to yield high key rates and immunity to large transmission losses. Thus our work represents a key step toward realization of this ambitious goal.