Close
About
FAQ
Home
Collections
Login
USC Login
Register
0
Selected
Invert selection
Deselect all
Deselect all
Click here to refresh results
Click here to refresh results
USC
/
Digital Library
/
University of Southern California Dissertations and Theses
/
Quantum and classical steganography in optical systems
(USC Thesis Other)
Quantum and classical steganography in optical systems
PDF
Download
Share
Open document
Flip pages
Contact Us
Contact Us
Copy asset link
Request this asset
Transcript (if available)
Content
QUANTUM AND CLASSICAL STEGANOGRAPHY IN OPTICAL SYSTEMS
by
Bruno Avritzer
A Dissertation Presented to the
FACULTY OF THE USC GRADUATE SCHOOL
UNIVERSITY OF SOUTHERN CALIFORNIA
In Partial Fulfillment of the
Requirements for the Degree
DOCTOR OF PHILOSOPHY
(PHYSICS)
December 2024
Copyright 2024 Bruno Avritzer
Dedication
To my parents, Orna and Alberto Avritzer.
ii
Acknowledgements
I would like to thank my parents, whose support kept me aloft in the completion of my degree, and my
many friends from before and during my time at USC who helped make the time spent feel worthwhile. I
especially want to thank David, with whom I have watched a significant portion of 21st century television;
David, who was the first person to give me honest feedback about my cooking; Hilarie, who I have lost
more games of League with than probably anyone alive; Remy, who introduced me to 3D printing, which
is becoming too large a part of my personality; Nic, Vinay, and Seolhwa, who inspire me to push myself
to greater academic and personal heights; Aryan and Saeedeh, who are always so positive that even after
sitting through Eternals we still came back to watch Multiverse; Tiff, who dragged me around Little Tokyo
and big Tokyo and made sure I knew at least some of the attractions in a city where I spent 3 years of my
life; and Ansar, Will, and Sidarth, who kept me anchored to the person I was at many points where I felt I
would lose sight of myself. I would like to thank my uncle Oren and aunt Michelle, who took me in when I
knew no one in Los Angeles and made me feel as though I had some grounding in a city which still baffles
me. I could not have made it this far without all of these wonderful people and David.
I would like to thank all the members of my research group for helping create a stimulating environment for discussion. When I started in the Brun group, it was small, but it has grown into probably the
most broad, diverse, and friendly research group I have ever seen. I would like to thank my professors at
USC, especially Ben Reichardt and Paolo Zanardi, who deepened my knowledge of quantum information
significantly from what I had learned in my undergraduate degree, and Daniel Lidar, whose quantum error
iii
correction course impressed upon me the lengths of rigor to which theoretical physics ought to aspire. I
only regret that the intensity of the course waned due to the onset of the global pandemic in March of
2020.
I would like to thank Jonathan Habif and Haley Weinstein, my ever-patient and conscientious collaborators, who took the idea which my advisor and I had conceived of and developed, and brought it to life
as an experiment. In doing so they rekindled my lost passion for the experimental side of physics, thanks
to which that I was able to land my position before graduation, and I am very grateful to them.
Most of all, I would like to thank my advisor, Todd Brun. When I began my doctoral studies, I did so
without any specific project in mind, with little research experience, and unsure if I would see it through. In
my first year of graduate school, the global pandemic began and so I made little progress on these questions.
When I began to work with Todd, I went through a variety of possible projects until he introduced me to the
subject of quantum steganography, which had originated with a previous student, Bilal Shaw. This put me
on the path to be a productive graduate student, and Todd waited with great patience as I came to acquire
this capability. When I left Los Angeles to work on my Ph.D. from my family’s home, Todd supported
me where many advisors would not have. On top of all this, I can count on a single hand the number of
times Todd has been wrong on any subject I have asked him about, and a lot of my best work was done
immediately after speaking with Todd. Each conversation I’ve had with him was not only illuminating,
but inspiring and unfailingly positive. By the time I was in my fourth year, I had had a handful of friends
ask me whether I had ever thought of leaving the program, and I could honestly say I had not had any
such thoughts. I could not have asked for a better advisor.
iv
Table of Contents
Dedication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ii
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii
List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x
1: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Fundamental Quantum Physics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1.1 Properties of Quantum States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1.2 Operators on a Hilbert Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1.3 Schrodinger’s Equation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1.4 Density Operators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2 Information and Quantum Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.3 Quantum States and Optical Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.3.1 Common Optical Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2: Quantum Steganography via Coherent and Fock State Encoding in an Optical Medium . . 15
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2 Important Measures for Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.3 Disguising coherent states as thermal noise in a channel . . . . . . . . . . . . . . . . . . . 17
2.4 Mappings for Quantum Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.4.1 Fock State Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.4.2 Distribution Coherent State Methods . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.4.3 Pairwise Coherent State Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.4.4 Vertical Angles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.4.5 Redefined Rayleigh Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4.5.1 Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
2.4.5.2 Bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.5 Numerical simulation and performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.6 Particular Encoding Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.6.1 Fock State Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.6.2 Coherent State Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.6.2.1 Distribution Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
2.6.2.2 Pairwise Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2.7 Discussion and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
2.8 Additional Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.8.1 Proof of Eq. (2.14) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.8.2 Discretizing the Circle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2.8.3 Derivation of Vertical Angle Bound with no Key . . . . . . . . . . . . . . . . . . . 34
2.8.4 Encoding Method for Fock States . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
v
2.8.5 Practical Fidelity Bounds for the Fock Encoding . . . . . . . . . . . . . . . . . . . . 37
3: Experimental Demonstration of Coherent State Steganography . . . . . . . . . . . . . . . . 39
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.2 Thermal State Emission from an EDFA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.3 Measurement and Reconstruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.4 Alternative Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
3.5 Error Correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.6 Full Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.7 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.8 Possible Vulnerabilities and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
4: Steganographic Entanglement Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.2 Idle Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.3 Channel with Eavesdropper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.3.1 Werner Model of the Eavesdropper . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.3.1.1 State Teleportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.3.1.2 Superdense Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4.3.2 Wiretap Model of the Eavesdropper . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
4.3.2.1 State Teleportation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
4.3.2.2 Superdense Coding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
4.4 Fuchs-Van de Graaf Lower Bound for a Mixture of Two States . . . . . . . . . . . . . . . . 60
4.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
5: Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
vi
List of Figures
1.1 The Harmonic Oscillator eigenstates ψn(x) (blue) along with the associated energy levels
n +
1
2
ℏω(green) and the potential energy 1
2
x
2
(red). . . . . . . . . . . . . . . . . . . . . . 5
1.2 The Wigner function of a thermal state (which is Gaussian) and the Harmonic Oscillator
1 Photon state |1⟩ (non-Gaussian). The latter displays negativity, a signal of nonclassical
behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.3 The Wigner function of an α = 1 coherent state, before and after quadrature squeezing
of about 5dB. As we can see, although the variance in one direction σ
2
x may decrease, σ
2
p
increases correspondingly such that the uncertainty relation σxσp ≥
ℏ
2
is still satisfied.
Note that post-squeezing, the coherent state is still Gaussian. . . . . . . . . . . . . . . . . . 13
2.1 A plot of the lower bound on the communication rate for the vertical angle (key) encoding
scheme compared to the “Distribution” (no key) scheme. . . . . . . . . . . . . . . . . . . . 21
2.2 in this setup, a beam splitter combines the coherent states denoted by |r⟩ and |β⟩, with
nc and nd denoting detectors that measure the incidence of photons. The value of the
homodyne measurement is given by m = nc − nd. . . . . . . . . . . . . . . . . . . . . . . 22
2.3 Two views of the plot of perr as a function of rc = −
mc
2β
√
n¯
and n¯. The optimal value of rc
is between .4 and .5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
2.4 The division of the thermal state in terms of r (adapted from [7]) (a) and the associated
communication rates for various values of n¯ and f. In descending order, the plots display
the optimized value of the communication rate per bit of secret key (b), and both the
communication rate (c) and rate per bit of key (d) when the quantity to be optimized is
simply the communication rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
2.5 The communication rate R, key rate K, and quotient R
K
for encoded transmission using
homodyne-type (orange) and Helstrom-type (blue) measurements at a variety of f and n¯
values. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
2.6 A comparison of the communication rates using the Fock and coherent state encodings. In
the Fock case this results from the theoretical optimum measurement based on the binary
symmetric channel capacity and in the latter from optimal homodyne measurements
and generalized measurements that approach the Helstrom bound. In the coherent state
cases, the results are derived from sampling from the constituent distributions, since an
analytical result is not as straightforward to obtain. . . . . . . . . . . . . . . . . . . . . . . 31
vi
2.7 This figure illustrates the process Alice uses to construct the encoded message as described
above on Pascal’s Triangle. First, she calculates that the message is transmissible using 8
bits, since 41<56 (green), as above. Then, she determines the message (41) is in the largest
21 numbers, and so she boxes 21 and the first digit is 1 so she moves right. Then she
determines 41 is neither in the largest 6, nor 6+5, nor 6+5+4 messages, and so circles the
numbers 6, 10, and 15, and moves left each time, with each circle signifying a zero (the
intermediate numbers 4, 5, and 6 are also highlighted since it is useful to keep track of
their values). These steps are repeated until Alice reaches the right edge of the triangle, at
which point she knows all remaining digits are 0. As this figure shows, this is an efficient
encoding, as only a linear amount of combinations in the starting position need to be
computed. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.1 The gain spectrum of amplified spontaneous emissions from an EDFA as a function of
frequency, from [40]. The gain flattens the farther you get from the center wavelength,
which makes the injection of states further from the center less conspicuous. . . . . . . . . 40
3.2 The setup diagram for the experiment Weinstein and Habif performed. . . . . . . . . . . . 41
3.3 A comparison of the decoding performance of our scheme between homodyne, heterodyne,
and ideal detection (simulated using Strawberryfields [34][15]). As we can see, homodyne
detection outperforms heterodyne detection. . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.4 The calculated trace distance, error probability, and communication rate under ideal
conditions for the phase encoding described above (not including key consumption).
We compare the Helstrom-optimal measurements with the theoretical calculations done
above (nmax = 170) and simulations using the StrawberryFields package [34][15], and
find them to be in good agreement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.5 A 100x100 black and white image of a USC Trojan transmitted without error correction,
using coherent state steganography (top). The bit error probability during this transmission
was 0.21, which is in good agreement with our calculation of 0.16 for an ideal detection
scheme based on Equation 3.3 with n¯ ≈ 1.5. We also show the results of the reconstruction
procedure for a set of coherent states, a real thermal state with n¯ ≈ 1.26, and an
artificial thermal state created by sampling Rayleigh-distributed coherent states, with a
reconstructed n¯ ≈ 1.02. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.1 The percentage increase in the entanglement of formation as a function of the base
squeezing level r of the resource state. Note that r rather than n¯ = sinh2
(r) is the limiting
parameter in the “low-energy” regime, as an n¯ of 20 corresponds to a squeezing level of
r ≈ 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.2 (a) The Wigner function of the odd cat state with α = −1.5i, (b) average Wigner
function and teleportation fidelity of the cat state with α = −1.5i using a TMSV state
with squeezing parameter r = 1.15 and noise channel ξp, and (c) the upper and lower
Fuchs–Van de Graaf bounds [23] for the result of the teleportation using ξp. These results
were obtained using the StrawberryFields package [34, 15]. A derivation of the Fuchs–Van
de Graaf lower bound is provided in Appendix 4.4 (the upper bound does not hold formally
except when p = 0 but is provided for illustrative purposes). These bounds become tighter
as the state becomes more and less pure, respectively. . . . . . . . . . . . . . . . . . . . . . 51
4.3 (a) the fidelities of GKP state teleportation and (b) Wigner function for θ = 0 with
r = 1.15 using the channel ξp for θ =
nπ
8
, where |ψ⟩ = cos θ
2
|0⟩+ sin θ
2
|1⟩ (black) and the
Fuchs-Van de Graaf lower bound (red). We can see that the average teleportation fidelity
is higher for the GKP state than for the above cat states at the same level of squeezing. . . 52
viii
4.4 Average result of teleportation of the odd α = −1.5i cat state (top row) compared to the
original cat state (bottom row), where the TMSV states are being wiretapped (a) by an
eavesdropper with transmissivity η = .9. Average fidelity in this case is about .58 and
negativity can clearly be observed in the state. The same follows for (b) η = .75, with a
fidelity of .47, and at (c) η = .5, with a fidelity of .34, we can no longer observe negativity. 54
4.5 Using the StrawberryFields package, we were able to simulate the results of two-qubit
quantum state tomography on the teleported GKP state using a TMSV state with a
high squeezing parameter r = 3.2. The procedure (with a wiretap of transmissivity
.1) is displayed in the above figure; the CNOT in the diagram is a logical CNOT, the p
displacement is in the imaginary (p) direction, and the measurements at the end are for
measuring the Bell inequality violations. The reconstructed matrix was mapped to the
nearest density operator in Frobenius norm by taking its positive-semidefinite part, which
had a fidelity of .584 with the original two-qubit Bell state and displayed an entanglement
of formation of .838. It was verified to be entangled by the Peres-Horodecki criterion
[30]. It was also possible to measure Bell inequality violations by applying a 3π/4 Pauli
Y rotation on the first qubit before the Pauli measurement, either with or without the
wiretap, as seen in the table above. With a loss of 0.1, we are not able to observe a
Bell inequality violation, but we are able to observe a violation when the loss is instead
0.01. This demonstrates that under ideal conditions, qubit entanglement can be shared
steganographically. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
4.6 The maximum measurement probability (pmax) at which a quantum advantage for
superdense coding is still possible, as a function of n¯ = sinh2
(r) of the mimicked thermal
state under the Werner channel. The value of pmax cannot actually be negative, but that
region of the plot indicates that no quantum communication advantage is possible below
r = 1.89. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
4.7 The circuits for continuous variable teleportation (top) and superdense coding (bottom)
under the wiretap model. In the former case, Eve can only interfere with Alice and Bob’s
operation of the circuit, but in the latter case, since two correlated bits of information pass
through the channel, Eve can in principle detect quantum correlations via a Bell-type or
other joint measurement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
ix
Abstract
Quantum Steganography is an alternative to quantum cryptography in which the channel is hidden instead
of the message. As such, it is viable in contexts where it is desirable to avoid the appearance that information is being transmitted in a channel at all. In this thesis, we will develop the machinery to understand
quantum steganography in optical systems, propose methods for classical and quantum steganographic
communication in optical systems, and discuss experimental implementations of these protocols, along
with practical considerations for their implementation. We will discuss how to transmit classical messages and continuous variable entanglement, and even discrete variable entanglement in the form of GKP
qubits, while making the transmission appear identical to thermal noise. We will discuss the experimental
implementation of this steganography protocol by mimicking noise produced by an Erbium-Doped Fiber
Amplifier, a common optical component. In collaboration with Dr. Jonathan Habif and Haley Weinstein of
the University of Southern California, we have demonstrated the covert transmission of a binary encoded
image file in this fashion, and in this thesis we will discuss the theoretical aspects of that demonstration.
x
Chapter 1
Introduction
1.1 Fundamental Quantum Physics
Every schoolboy learns that Niels Bohr was the first to discover the orbitals of the Hydrogen atom, and
many that he was one of the fathers of the then-burgeoning quantum theory. What is often less appreciated is why the difference between the atomic orbital theory, which is usually presented as incomplete in
a popular science setting, and the existing theory of the time, was such an upheaval of physics as to place
Bohr firmly among the greats of quantum physics alongside such figures as Einstein and Heisenberg. Commonly, a strong appreciation of Bohr’s contribution comes when one is introduced, in an undergraduate
quantum physics class, to the full mathematical sophistication of the quantum description of the Hydrogen
atom and its power as a predictor of physical behavior. This is a trait most of the significant contributions
to quantum theory of the 1900s-1930s have in common.
A similarly ubiquitous feature of modern society, and one which requires quantum theory to describe
in detail, is the use of photonic systems which underpin much of our communications infrastructure. This
thesis will treat the quantum description of photonic systems in detail, but first we must discuss the basic
quantum description of light which was one of the first results of early quantum mechanics.
Nowadays, we know that light is made up of photons. But what is a photon? It was Einstein who
initially postulated [21] that when one shines a light on a material, the energy of the light that is emitted
from it can only have a certain discrete range of values: for example, 1, 2, or 3eV, but not 2.5eV. This is
known as quantization, and the particles that travel with that energy are called photons. They are the
quantized units, or quanta, of light.
To formalize the notion of quanta, we can consider them as mathematical objects, for example functions
f(x) in a functional space (a space which indexes all possible functions f) or vectors ⃗v in a vector space.
Usually in quantum information we take the latter approach, and label vectors using |v⟩ rather than ⃗v. For
example, a photon containing 3eV of energy might be represented by the vector ⃗v3 = |v3⟩ = (0, 0, 1) or
the photon containing 1eV might be represented by |v1⟩ = (1, 0, 0), and likewise 2eV by |v2⟩ = (0, 1, 0).
Since a photon in our example contains a discrete, definite amount of energy, and these energy values are
mutually exclusive, the inner product or dot product of these vectors < ⃗vi
, ⃗vj >=< |vi⟩, |vj ⟩ > must
be (and is) the Kronecker delta δij . But if we have n orthogonal vectors, they can span the vector space
of dimension n, which as it has a well-behaved inner product defined on its elements, is a metric space
(in quantum physics we usually consider a certain type of metric space called a Hilbert space which has
additional useful properties that are not relevant at this time). Therefore we are free to name these vectors
|1eV ⟩, |2eV ⟩, |3eV ⟩ or equivalently |1⟩, |2⟩, |3⟩ and think no more about what their actual coordinates
are in the vector (Hilbert) space. The energy label provides all the necessary information about the vector
and therefore about the quantum state. This is called the energy (eigen)basis of the Hilbert space.
1
1.1.1 Properties of Quantum States
We have described how one might represent quantized objects in a Hilbert space H. This raises several
questions, however. In a vector space, one can add two vectors to produce a new vector. What happens if
you add a photon with 2eV of energy to a photon with 1eV of energy? Or rather, what happens when one
takes a linear combination of the vectors representing those objects c1 |1⟩ + c2 |2⟩? Notice that the result
is not equivalent to |3⟩ for any choice of c1, c2. This is called a superposition of the 1eV and 2eV states of
the photon.
To understand the superposition state’s physical meaning, we must consider subsets of the Hilbert
space. Suppose we have a state |ψ⟩ = √
1
3
(|1⟩ + |2⟩ + |3⟩). If we project the vector onto the |1⟩ axis, we
can see that the projection is P1 |ψ⟩ = √
1
3
|1⟩. This projector is usually written as P1 = |1⟩ ⟨1|, where ⟨1|
is the Hermitian conjugate of |1⟩ and the product here is the outer product (more on this later). As we can
see, |1⟩ ⟨1|i ̸= 1⟩ = 0, and |1⟩ ⟨1|1⟩ = 1, where ⟨i|j⟩ =< ⃗vi
, ⃗vj >= ⃗vi
· ⃗vj = δij is another notation for
the inner product. Since we have projected onto the |1⟩ axis, repeated application of P1 does not change
the state: P
n
1
|ψ⟩ = P1 |ψ⟩ = √
1
3
|1⟩.
What physical process does the application of this operator represent? Measurement seems to fit the
bill. If someone were to measure the energy of a photon and then repeat the measurement, with no intermediate actions on the photon, the result would be the same. We can see that this operator has the same
property, so it can be used to represent a measurement (in this case a measurement of energy, with result
1eV). Specifically, this is called a projective measurement. The possible outcomes of an energy measurement on |ψ⟩ are 1eV, 2eV, and 3eV, and since the vector is equally weighted in the direction of each, they are
equally likely. Since this is a unit vector, the probability of the measurement result is simply given by |ci
|
2
as these must sum to 1 — this is how superpositions of states are represented, for reasons of mathematical
simplicity. This introduces the normalization condition: a valid quantum state, as expressed by the measurement outcomes behaving in a physical way, must be a vector of norm 1, known as normalized. Now we
understand the interpretation of superposition: the superposition defines the probabilities of measuring a
given photon to have different amounts of energy. It is our way of quantifying the observer’s uncertainty
about the photon’s state when measured.
1.1.2 Operators on a Hilbert Space
Now that we have defined photons and objects in the Hilbert space, we can consider various things that
could happen to a photon or the vectors that represent it. For example, a photon can be measured, excited,
or pass through a system, or a vector can be rotated, translated, or rescaled by a constant. These actions
are represented by operators which take one vector representing a photonic state to another vector representing a photonic state. Therefore, they must be represented by n×n matrices, where n is the dimension
of the Hilbert space we are considering.
We have already met the projection operator |1⟩ ⟨1|. If we take the outer product of these two vectors,
we can see that the matrix form of it is
P1 =
1 0 0
0 0 0
0 0 0
. (1.1)
As we can see, this is not an operator which preserves the vector norm. Excitation of a photon is represented by the operator a
† = |2⟩ ⟨1| + |3⟩ ⟨2| (for simplicity we are assuming that a photon cannot be
excited beyond 3eV in this system), and the relaxation of the photon by a. These are called the raising and
lowering operators of the system, respectively. This operator, as we can see, also does not preserve the
norm.
2
The class of operators which does preserve the vector norm is the set of unitary matrices U = e
iH,
where H is some Hermitian matrix. Just as in Euler’s formula e
iθ = cos θ + isin θ, a complex exponential
corresponds to a rotation, and just as a polar rotation preserves the norm of a vector, a Unitary rotation
matrix preserves the norm of the state vector. But how does the Hermitian operator correspond to a
rotation angle?
First, we must discuss the definition of a Hermitian matrix. Hermitian matrices have the property that
HT = H∗
. This implies that the diagonal is real, and also that all eigenvalues of the matrix are real. This
is a convenient class of operators to represent measurable quantities like energy! After all, they can be
diagonalized with coefficients corresponding to the real energy values in the basis of the Hilbert space
as e.g. E = 1 |1⟩ ⟨1| + 2 |2⟩ ⟨2| + 3 |3⟩ ⟨3|, and so they will project basis vectors onto themselves and
multiply them by the corresponding energy value. These can work for quantities other than energy also,
such as position and momentum. The Hermitian matrix observable corresponding to the energy is called
the Hamiltonian of the system, and is usually represented by H.
The above spectral decomposition is why we can regard the Hermitian matrix as a rotation angle. Let
us take the matrix exponential of a Hermitian matrix
H =
X
j
λj |j⟩ ⟨j| , (1.2)
where the exponential of a matrix is understood using a Taylor expansion and repeated matrix multiplication. We have
e
iH =
X
n
P
j
iλj |j⟩ ⟨j|
n
n!
=
X
j
X
n
iλn
j
n!
|j⟩ ⟨j| =
X
j
e
iλj
|j⟩ ⟨j| (1.3)
where we have used orthogonality ⟨j|k⟩ = δjk. This shows us the nature of the rotation: the matrix
e
iH performs a rotation on each of the basis vectors according to its eigenvalues λj , and a d-dimensional
Hermitian matrix can be uniquely identified by its spectrum up to an additional Unitary transformation
(this is easy to prove, and of course a composition of two Unitaries is also Unitary). So we see that while
multiplying a state vector by H does not preserve the norm, multiplying it by U = e
iHt for some constant
t does, as it is just a rotation. This is called the unitary time-evolution operator, and the time here is t.
To “measure” an observable O which can be diagonalized as O =
P
j
oj |j⟩ ⟨j| — that is, to find the
result of a measurement of that observable — it suffices to take P
j
⟨ψ| oj |j⟩ ⟨j|ψ⟩ =
P
j
| ⟨j|ψ⟩ |2oj . This
gives us the mean value conditioned on the available information, or “expected value”, of the measurement
result, E(O). For example, if we consider |ψ⟩ = √
1
3
(|1⟩ + |2⟩ + |3⟩), and the energy E as defined above,
we have ⟨ψ| E |ψ⟩ = 2, which is as we expect. On the other hand, if |ψ⟩ = |1⟩, then ⟨ψ| E |ψ⟩ = 1, since
the system state is different. From this we can see the source of the earlier claim about the correspondence
between |cj |
2 = | ⟨j|ψ⟩ |2
and the probabilities of measurement outcomes.
1.1.3 Schrodinger’s Equation
Schrodinger’s equation is very simple:
H |ψ⟩ = E |ψ⟩. (1.4)
This is the time-independent Schrodinger equation, and it says that the vector |ψ⟩ is an eigenvector of the
operator H with eigenvalue E. This is not informative unless we understand the Hamiltonian, however.
Let us examine the Hamitonian for the Harmonic oscillator. The total energy of the Harmonic oscillator is
known to be E = H = T + U =
1
2
kx2 +
p
2
2m
. That is the classical Harmonic oscillator. For the quantum
3
harmonic oscillator, x and p are operators and observables. So the Schrodinger Equation for the Harmonic
oscillator is
1
2
kx2
|ψ⟩ +
p
2
2m
|ψ⟩ = E |ψ⟩. (1.5)
It is possible to solve this equation for |ψ⟩ if we can find a relationship between x and p, and there is such
a relationship in the functional basis, but there is a more useful way to solve it. That way is to transform
the expression for H into a form where the relationship is simpler. This is where the raising and lowering
operators from before come into the mix. It is possible to define new raising and lowering operators a and
a
†
:
a =
r
mω
2ℏ
x +
ip
mω
= cn |n − 1⟩ ⟨n| (1.6)
and if we consider the action of the lowering operator on an element of that quantized subspace, we can
see that in order for a to have the correct action on |1⟩ and |0⟩, a |n⟩ =
√
n |n⟩ is a suitable solution. It
turns out to be the correct solution once we examine the action of the ladder operators on the number
states |n⟩. The new Hamiltonian is then
H = ℏω
a
†
a +
I
2
= ℏω
X
n,m
√
n2 |n⟩ ⟨n − 1|m − 1⟩ ⟨m| +
I
2
!
= ℏω
X
n
n +
1
2
|n⟩ ⟨n| (1.7)
which makes it clear why a
†a = N is called the number operator. Now we get to solving the Schrodinger
equation. Actually, we have already solved it! Solving an eigenvalue problem consists of finding the
eigenstates of the operator, which in this case are just |n⟩. We can see this from the decomposition of H
above. The function representation of |n⟩ can be determined by using the representation p = iℏ
∂
∂x , which
gives us
ψn(x) = e
− mωx2
ℏ
mω
πℏ
1/4 Hn
x
q
2mω
ℏ
√
2
nn!
(1.8)
where Hn(x) is the nth Hermite polynomial.
1.1.4 Density Operators
We have already introduced certain operators such as the Hamiltonian, but another important operator is
the density operator ρ. The density operator is an alternative representation of a quantum state that also
enables us to represent classical uncertainty about the state. If we have a state vector |ψ⟩ =
P
n
cn |n⟩, we
can consider the projector onto the vector |ψ⟩:
ρ = |ψ⟩ ⟨ψ| =
X
n
X
m
c
∗
n
cm |m⟩ ⟨n| (1.9)
and because of the way we have constructed ρ, we know it is a Hermitian operator. There are actually two
more constraints we require of every density operator: the elements on the diagonal must sum to 1 (this
corresponds to normalization, and another way of saying it is that Tr(ρ) = 1, where the Trace of a matrix is
the sum of its diagonal elements) and that it must be positive semidefinite, meaning it has only nonnegative
eigenvalues. The latter condition is also motivated by the above representation; the representation of
a quantum state in any operator eigenbasis is equivalent, and so if we had a negative eigenvalue, the
measurement of the observable corresponding to the eigenbasis would occur with a negative probability
for the component with a negative eigenvalue. Since negative probabilities are unphysical, this cannot be
4
Figure 1.1: The Harmonic Oscillator eigenstates ψn(x) (blue) along with the associated energy levels
n +
1
2
ℏω(green) and the potential energy 1
2
x
2
(red).
allowed. The main reason to use the density operator formalism is that it allows us to represent states that
cannot be represented in the vector formalism. Consider the thermal state
ρth =
e
−βH
Tr(e−βH)
(1.10)
which can be expressed for the Harmonic Oscillator using a Taylor expansion as
ρ =
1
N
X
n
e
−
ℏω(n+ 1
2
)
kBT |n⟩ ⟨n|
!
(1.11)
where N is the normalization. We can see that such a state is diagonal in the number basis and contains
multiple terms, and therefore cannot be expressed as ρ = |ψ⟩ ⟨ψ| for any choice of |ψ⟩; it can therefore
not be expressed in the state vector representation. This is an example of a mixed state, and it is not
an unnatural one, as the thermal state arises often in statistical mechanics and in real physical systems.
States which can be expressed in the vector basis are known as pure states. There is a simple criterion
to determine whether a state is pure: you can compute the purity, Tr(ρ
2
), which has a maximum value
of 1 for any pure state and 1
d
, where d is the dimension of the Hilbert space, for the “maximally mixed”
state, which as we will later see is proportional to the identity operator. This completes the basic quantum
formalism we need to develop to understand optical quantum steganography.
1.2 Information and Quantum Information
We now turn to the information part of covert communication. To understand how to communicate information, we must discuss the nature of information itself. The essence of information is uncertainty. A
coin can communicate 1 bit of information, either 1 or 0, heads or tails, but only if there is a possibility for
it to be received in either state. It does not, however, have to be a coin. Any object that can have a binary
set of outcomes can communicate one bit of information.
This fact is well illustrated by the idea of superposition. If we have a state |ψ⟩ = √
1
2
(|0⟩ + |1⟩) and we
measure in the {|0⟩, |1⟩} basis, it is basically equivalent to flipping a coin and contains the same amount
of information. This is a bit, and if we encode it into something with a quantum degree of freedom, it is
usually called a qubit (quantum bit), which is also a unit of information.
But what if we were to flip two coins? Then there would be four outcomes: 00, 01, 10 and 11. We
could label these with the numbers 0, 1, 2, and 3, and write the state of the two-coin system as |ψ⟩ =
1
2
(|0⟩ + |1⟩ + |2⟩ + |3⟩) and that would be a valid representation of the state of the two-coin system. We
could implement this using the harmonic oscillator/photon system as described above, and represent coin
operations using operators on the photonic system. This is called a qudit, with d being the number of basis
states (in this case, d = 4 and it is sometimes referred to as a ququart).
Although 2 coins can be represented in this way, they are more commonly represented by 2 qubits.
In the qudit system, in order to define a state |3⟩ which is an eigenstate of some operator, one loses the
straightforward connection between the 1 coin and 2 coin states. This especially becomes a problem when
there are many bits in play. Instead, we define the systems |ψ⟩
1 = √
1
2
(|0⟩
1 + |1⟩
1
) and |ψ⟩
2 = √
1
2
(|0⟩
2 +
|1⟩
2
) along with the tensor product operation ⊗ (also sometimes called the exterior or Kronecker product)
which allows us to take the product of two ket vectors. The product is defined as
a1
a2
a3
⊗
b1 b2
=
a1b1 a1b2
a2b1 a2b2
a3b1 a3b2
(1.12)
and this operation is defined for both the product of a ket and bra |ψ⟩ ⊗ ⟨ϕ| (which produces an operator)
and for two of either|ψ⟩⊗|ϕ⟩ or⟨ψ|⊗⟨ϕ| (which produces a vector in a larger Hilbert space). This operation
is often omitted in writing, e.g. |ψ⟩ ⟨ψ| instead of |ψ⟩⊗⟨ψ|. This definition of the tensor product is the only
one which preserves the essential properties of quantum states, and it can be extended to apply to density
operators or inverted by means of the partial trace operation TrB(ρA ⊗ρB) = TrB(ρA ⊗
P
ij cij |i⟩ ⟨j|) =
(IρA ⊗
P
k
P
ij ⟨k|i⟩ cij ⟨j|k⟩) = ρA ⊗ (
P
k
ckk) = ρA. We can now represent two independent coins
represented by |ψ⟩ and |ϕ⟩ by |ψ⟩ ⊗ |ϕ⟩. Using this structure, we can represent classical bits. But we can
also observe that certain states cannot be written as |ψ⟩ ⊗ |ϕ⟩ for any choices of |ψ⟩ and |ϕ⟩. For example,
the Bell state
|ψ+⟩ =
1
√
2
(|00⟩ + |11⟩) (1.13)
cannot be written as a tensor product of any two states. It therefore represents a kind of correlation called
entanglement. This entanglement represents an unspecified physical correlation between the “coins” or
correlated subsystems. In the same way that a measurement on the √
1
2
(|0⟩ + |1⟩) state gives us one bit
of information, the two-state measurement of |ψ+⟩ gives us one ebit, or entangled bit. This is a unit of
quantum information.
We understand the potency of a bit in terms of computing algorithms and representations of data. It is
possible to think of an ebit as a fundamental unit for the representation of certain quantum data. A more
straightforward explanation is derived from the exchange relation between ebits and classical bits. This
is done through a protocol called superdense coding. First, one party prepares the |ψ+⟩ state and shares
one of the subsystems, or “coins”, with a second party. This establishes a correlated source of information,
akin to a channel, between these two parties. Then, the first party applies an operator to their half of the
system, which takes the state to one of the following 4 states (which are called Bell states):
|ϕ+⟩ =
1
√
2
(|00⟩ + |11⟩)
|ϕ−⟩ =
1
√
2
(|00⟩ − |11⟩)
|ψ+⟩ =
1
√
2
(|01⟩ + |10⟩)
|ψ−⟩ =
1
√
2
(|01⟩ − |10⟩)
(1.14)
by means of a unitary acting on the first system alone. The unitaries in this case are the so-called Pauli
Matrices:
X =
0 1
1 0
, Y =
0 −i
i 0
, Z =
1 0
0 −1
, I =
1 0
0 1
(1.15)
of which the former is not to be confused with the X operator corresponding to position, which is an
infinite-dimensional operator. One may notice that the Bell states are eigenstates of the tensor product of
the above operators XX and ZZ, and that Pauli operations on only the first qubit can map any Bell state
to any other Bell state. This is very important for superdense coding.
After applying a Pauli operator to their subsystem to encode their choice of bit, the first party then
sends their subsystem to the second, who performs a measurement on both parts of the ebit called a Bell
measurement, which projects the state onto the Bell basis. Since the Bell states are mutually orthogonal, it
is possible to perform such an operation. This measurement can perfectly distinguish between all 4 above
states, and thus extracts 2 bits of classical information from the ebit — it can perfectly identify the Pauli
that was applied to the first qubit. Now we see the power of an ebit in classical information terms. The
cost comes in the difficulty of maintaining an ebit for a significant period of time.
7
The above quantum states represent an ebit, or a fully entangled state, but there are also less entangled
states. The degree of entanglement of a state is a measure of its information content, and it can be measured
by the state’s entropy. In general, the entropy S of system which can be in state i with probability pi
is
given by
S = −
X
i
pi
log2 pi
(1.16)
and is a strictly nonnegative quantity. If the system has only one possible state, with pi = 1, then it can
transmit no information and the entropy is simply 0 (imagine “flipping” a coin with only one side). If
the system has two equally likely states, then the entropy is log2 2 = 1, which corresponds to one bit of
information. If there are two outcomes, p0 = 1/3 and p1 = 2/3, then S = .918 < 1. In general, if there are
k possible states with probabilities pk, one can show using Lagrange multipliers that pk = 1/k maximizes
the value of the entropy. We can now see that the entropy is actually a measurement of uncertainty. The
more certain we are about the state of a system, the less its entropy, and the less information it can convey.
A pure quantum state, for a given observable in whose basis it can be expressed as a superposition, is
actually a probability distribution over eigenstates of that observable, so the entropy framework can be
applied to it as well. Any quantum state can be represented as a density matrix, and its probability values
are conveniently located on the diagonal, so it is convenient to define the von Neumann state entropy in
terms of the density matrix:
S(ρ) = −Tr(ρ log2 ρ) (1.17)
where the above is a matrix logarithm. In the eigenbasis, this simplifies to
S(ρ) = −
X
i
λi
log2 λi
(1.18)
where λi are the eigenvalues, which correspond to probabilities of the system being in each state. In the
case of a system with 2 states, the entropy was maximized by pi =
1
2
, which corresponds to a mixed state
ρ =
1
2
(|0⟩ ⟨0| + |1⟩ ⟨1|). In fact, such a state is called “maximally mixed” since it has the highest entropy of
any state in the operator space. As we recall, the purity Tr(ρ
2
) of such a state is 1
d
, in this case 0.5, and we
can see that this is indeed the case. One can also observe that the maximally mixed state is the partial trace
of the maximally entangled state |ψ+⟩ ⟨ψ+|. As such, the von Neumann entropy of the partial trace of a
state characterizes its level of entanglement, and the amount of information its entanglement can convey. It
is therefore also known as the entanglement entropy in this context. This is a potentially sensible measure
because an entangled state such as |ψ+⟩ may be a pure state, and thus the entropy S (|ψ+⟩ ⟨ψ+|) = 0 as it
has only one eigenvalue, and yet when we look at only one subsystem there is a high level of uncertainty
about the state which is ultimately related to its information content. So we can conclude that the von
Neumann entropy of the partial trace, also called the entanglement entropy, is a sensible measurement of
quantum information content in a pure bipartite quantum state.
The last step that remains is to draw the connection between the entanglement entropy and the entanglement of the state itself. We have said previously that entropy is a measure of information content,
and therefore an extension to the bipartite case may be useful for characterizing entanglement, but we
have not explained what this means, and in what sense states are more entangled than others. Previously
we examined the superdense coding protocol. One might imagine that for a “less entangled” state, the
communication rate would be lower as this state has a lower information content. This in fact turns out
to be the case. Compared to the Bell state, we can consider a mixture of a Bell state and a different state,
such as the two-qubit Werner state [57]
ρW =
1
2
|ψ−⟩ ⟨ψ−| +
1
8
I =
5
8
|ψ−⟩ ⟨ψ−| +
1
8
|ψ+⟩ ⟨ψ+| +
1
8
|ϕ−⟩ ⟨ϕ−| +
1
8
|ϕ+⟩ ⟨ϕ+| (1.19)
8
which has components from every Bell state. It is easy to see that this has the effect of obfuscating the
message we intended to send by making the desired measurement outcomes less likely, and somewhat less
obvious that there is no different set of operators or measurements that recovers the communication rate of
the protocol discussed above. The reason is that in the Bell state case, we were able to project onto a basis
which spans the space, and is therefore able to extract the maximum amount of information — any attempt
to do so here would have to use rotated versions of the Bell states, which is not fundamentally different
than the case we have already examined. However, we still get the right outcome from this protocol over
50% of the time, so the communication rate of the channel is nonzero.
For the specific class of Werner states, the coefficient of the pure state ( 1
2
in the above example) can be
directly tied to the level of entanglement — in fact, it is straightforward to show using the Peres-Horodecki
criterion [30] that ρW is an entangled state only when the coefficient of |ψ−⟩ ⟨ψ−| is at least 1
3
, and indeed
1
3 +
1
6 =
1
2
is the probability of receiving the correct measurement outcome using superdense coding,
which exceeds the classical probability of 0.5 only if the underlying state is entangled. It is also the case
that as this coefficient increases, the probability of making the correct measurement increases, suggesting a
greater degree of entanglement. It is in this sense that we can consider some states to be “more entangled”
than others.
The above analysis represents a special case for which we can compare mixed and pure state entanglement by using superdense coding efficiency as a metric. In general, this approach does not work — in fact,
it was shown in [25] that determining whether a mixed state is entangled at all is an NP-Hard problem in
the general case. In the pure state case, however, we can make a similar argument which generalizes well.
Consider the state |ϕ±⟩ = √
1
2
(|00⟩ ± |11⟩). We can take a simple superposition state
|Ψ⟩ =
r
2
3
|ϕ+⟩ +
1
√
3
|ϕ−⟩ =
1
√
2
r
2
3
+
r
1
3
!
|00⟩ +
r
2
3
−
r
1
3
!
|11⟩
!
=⇒ ρΨ =
2
3
|ϕ+⟩ ⟨ϕ+| +
1
3
|ϕ−⟩ ⟨ϕ−| +
√
2
3
(|ϕ+⟩ ⟨ϕ−| + |ϕ−⟩ ⟨ϕ+|)
(1.20)
which is a pure state, and for which the entanglement entropy is therefore a meaningful measure. Since
the coefficients are not equal, we can see that this is not a maximum entropy state. We can also see that
because the coefficients are not equal, the state of the system is not definitively in one Bell state, and thus
the same phenomenon as before occurs — there is a nonzero chance of an incorrect measurement outcome
when doing superdense coding. If we increase the coefficient of |ϕ+⟩, the entanglement entropy increases,
and the superdense coding efficiency also increases. It has been shown in e.g. [29] that this approach is
not limited to these particular states.
Thus we have accomplished our goal of making the connection between information, entropy, and
purity of quantum states clearer.
1.3 Quantum States and Optical Systems
It may not be obvious how the above machinery connects to optical steganography. The most obvious
connection is that of the harmonic oscillator to photonic emission. If an indefinite number of same energy
photons are emitted into a particular mode, a Hamiltonian with a constant energy spacing ∆E = ℏω perfectly fits the harmonic oscillator Hamiltonian we have developed earlier. The spacing allows for different
eigenstates of the harmonic oscillator |n⟩ corresponding to the emission of n photons. Now we must make
the connection between an optical system and harmonic oscillators.
The typical model of a laser cavity is a two level system subject to stimulated emission. This is a
phenomenon that occurs when an excited system interacts with a photon which has an energy equal to its
9
Hamiltonian’s energy gap. When this happens, the excited system may return to a lower state and emit a
photon in the process. In a real laser, there are many such excited systems which operate independently.
The number of emitted photons from the laser in a given unit of time, also known as a temporal mode, is
well-modeled by a Poisson distribution over energy eigenstates:
|α⟩ =
X∞
n=0
α
n
e
−
|α|
2
2
√
n!
|n⟩ (1.21)
which is known as a coherent state of parameter α. This parameter can in general be complex: α = reiθ
,
where r is the amplitude and θ is the phase of the coherent state. These parameters can be altered using
an attenuator and a phase shifter, respectively. If we wish to alter both at once, the required operation is
called a displacement operator, and it is signified by D(γ), as in D(β − α)|α⟩ = |β⟩. It turns out that
these states are also eigenstates of the ladder operator:
a |α⟩ = α |α⟩ (1.22)
and therefore, when α is either purely real or purely imaginary, either its x or p coordinate is proportional
to the eigenvalue, respectively, since the ladder operator would then be proportional to the Harmonic
Oscillator X and P operators. Note, however, that a coherent state is not an eigenstate of the X nor of
the P operator. If we consider the real and imaginary, or x and p axes, we can consider the coherent states
as points in that space. However, the coherent state is a physical state, and as such its Wigner function
has a finite variance σ
2
x = σ
2
p = ℏ/2. Therefore, the coherent states are not themselves eigenstates of the
x and p operators, as the latter have 0 variance in one direction, and in fact coherent states are not even
mutually orthogonal. We can evaluate the inner product
⟨β|α⟩ =
X
mn
(β
∗
)
mα
n
e
−
|α|
2+|β|
2
2
√
n!m!
⟨m|n⟩ = e
−
|α|
2+|β|
2−2β
∗α
2 (1.23)
which shows us that the states are not mutually orthogonal. They do, however, form a (over)complete basis,
since they are eigenstates of independent linear combinations of operators which form a complete basis,
those being X and P. The operators X and P are complementary, which is why they are able to serve
as axes in the parametrization of the Harmonic Oscillator. To better understand this complementarity, we
introduce the commutator of two operators
[A, B] = AB − BA (1.24)
which is also sometimes called the Lie Bracket. One of the fundamental postulates of quantum mechanics
is the canonical commutation relation
[X, P] = iℏ (1.25)
which holds for any two variables which are dual in the sense of the Fourier transform. An important
consequence of this is the uncertainty relation [45]
σxσp ≥
1
2i
⟨[X, P]⟩ =
ℏ
2
(1.26)
which holds for any observables but is saturated by the coherent states. One can say that the coherent states
live in the “phase space” of the harmonic oscillator, analogous to the phase space of classical mechanics
(with the commutator taking the place of the Poisson bracket). To actually represent a superposition
10
Figure 1.2: The Wigner function of a thermal state (which is Gaussian) and the Harmonic Oscillator 1
Photon state |1⟩ (non-Gaussian). The latter displays negativity, a signal of nonclassical behavior.
or mixture of coherent states in the phase space, one can consider normalized discrete or continuous
superpositions and mixtures:
|ψcat⟩ =
1
N
(|α⟩ + |−α⟩)
ρth =
1
N
Z
d
2αe−c|α|
2
|α⟩ ⟨α|
(1.27)
of which the latter state, due to the Gaussian weighting in the integral, is called a Gaussian state (the
former is a non-Gaussian state, and is pure, unlike the latter thermal state). This state can be thought of
as a Gaussian distribution over coherent states in the phase space. The above distribution is called the
Sudarshan P-Distribution, and it can be shown that when it is Gaussian, a related distribution called the
Wigner function is also Gaussian. The Wigner function of the thermal state is given by
Wth(x, p) = 2
π(2¯n + 1)e
−
x
2+p
2
2¯n+1 (1.28)
where n¯ is the average number of photons in the thermal state mode, and as we can see from the expression
above and from Figure 1.2, this is a Gaussian function. The Wigner function has many useful properties.
One is that negativity in the Wigner function is a key signature (but not a requirement) for entanglement
and other nonclassical behavior — it can actually be used as a measure of nonclassicality in certain contexts
[31]. Observe that the thermal state Wigner function is Gaussian, and therefore nonnegative, and it is
indeed not entangled. It is possible for a state’s Wigner function to be nonnegative, and yet for the state
11
to be entangled; this is, however, only possible for states with Gaussian Wigner functions [32]. Another
property of the Wigner function is that it comprises a joint probability distribution over the quadratures.
That is,
Z ∞
−∞
dpW(x, p) = Pr(X = x) (1.29)
and likewise for p. This is the normalization condition for Wigner functions; although the Wigner function
may be negative at a point, the probabilities associated with it must all be nonnegative as they correspond
to probabilities of quadrature measurement outcomes.
1.3.1 Common Optical Operations
Perhaps the most fundamental optical component is the beam splitter. When a beam of coherent light,
such as that produced by a laser, passes through the beam splitter, it splits into two beams propagating
in different directions. In mathematical terms, a beam splitter applies a two-mode unitary UBS such that
UBS(|α⟩ ⊗ |0⟩) = |α/2⟩ ⊗ |α/2⟩. Specifically, this is called a 50-50 beam splitter, because it divides
the states equally. It can also be used to combine states, as it accepts two input states (one can imagine
shooting one state at each side of the diagonal piece of glass, at a 90 degree angle from each other). Beam
splitters can be used to create optical entanglement, for example as in [37]. The idea of that work is to
send two photons emitted from two different sources into the beamsplitter, timed so that it is impossible
to tell which photon came from which source without measuring. If these photons were in two different
states, for example |0⟩ and |1⟩, then you would have an entangled state √
1
2
(|0⟩ |1⟩ + |1⟩ |0⟩) as the output,
since it would be impossible without measuring to check in which direction (sometimes called a port)
the photon was emitted. Beam splitters can also generate quadrature entanglement. This requires us to
introduce the notion of squeezing. Previously we stated that the coherent states saturate the uncertainty
principle bound. The explicit calculation gives the result of σx =
p
Var(X) = q
ℏ
2mω
and σp =
q
ℏmω
2
.
However, we can consider a state which has a greater variance in one quadrature, but lesser in the other,
such that the product remains ℏ
2
. This is called a squeezed coherent state, and is defined by |α, r⟩, where r
is called the squeezing parameter. The operation of squeezing takes a state which has a distribution in the
phase space, such as the coherent state distribution which is Gaussian in x and p, and compresses it in one
direction while lengthening it in the other, as in Figure 1.3. This procedure is often implemented by means
of an Optical Parametric Amplifier (OPA) or an Optical Parametric Oscillator (OPO), as in [54]. When
this is done to the vacuum state, the result is suitable for producing highly concentrated entanglement
via a beam splitter. The procedure is simple: generate two squeezed vacuum states which are squeezed in
different quadratures, then pass them through a 50-50 beam splitter. The result is two output modes in a
Two-Mode Squeezed Vacuum (TMSV) state
WTMSV (x, y, p, q) = 4 exp
−e
2r
(p − q)
2 − e
−2r
(p + q)
2 − e
−2r
(x − y)
2 − e
2r
(x + y)
2
π
2
ρTMSV =
1
cosh(r)
X∞
n=0
tanhn
(r)|nn⟩
(1.30)
which is clearly an entangled state in n. This is not, however, qubit entanglement as we have more than
two possible number eigenstates. The TMSV state is the continuous equivalent of the Bell state, in the
sense that it is maximally entangled for a given level of squeezing, and one can see that as r → ∞ the
superposition coefficients become equal and the state tends to a qudit equivalent of a Bell state (also called
a GHZ state) with d → ∞. However, the amount of entanglement in this state is constrained by the
amount of squeezing the physical system is able to produce, in the sense that the entanglement of the state
1
Figure 1.3: The Wigner function of an α = 1 coherent state, before and after quadrature squeezing of about
5dB. As we can see, although the variance in one direction σ
2
x may decrease, σ
2
p
increases correspondingly
such that the uncertainty relation σxσp ≥
ℏ
2
is still satisfied. Note that post-squeezing, the coherent state
is still Gaussian.
13
cannot be increased by “passive” operations which preserve the photon number of the state (operations
which do not preserve photon number can be decomposed according to the Bloch-Messiah decomposition
as a product of passive operations and single-mode squeezing).
The final question we must discuss in this introduction is that of measurement. In a theory setting,
it is simple for us to say that an experimenter measures an observable and records a result. Later, we
will expound on experimental apparatuses in more detail, but now it is important to introduce the most
common types of optical measurements: the photon-counting, Homodyne, and Heterodyne measurements.
These are not ideal measurements in most cases, but are experimentally realistic with the technology of
the present day.
The first of these is self-explanatory, but also powerful. Taken in conjunction with a beamsplitter,
it allows for post-selection, which is a critically important optical operation. A beam splitter is a piece
of glass, ideally with no dissipation within it, so it cannot destroy photons. If a three photon state goes
through a beam splitter, which implements a unitary, and one detects a single photon in one output port,
the other port must contain two photons. This allows us to implement the photon addition and subtraction
operators, a and a
†
, provided we throw away all samples where we do not detect the appropriate results.
This can be used to probabilistically increase the entanglement of a state — after all, if there are more
photons involved, there is more information in the state, all else being equal. It can also be used to enhance
the Wigner negativity of the state, as in [54].
The second measurement, homodyne detection, involves a projection onto what are usually eigenstates of the x or p quadrature operator, although a superposition along any line through the origin in
phase space is also possible. It is implemented indirectly using a beam splitter and photon-counting measurements, as we shall later discuss. The final measurement type is the heterodyne measurement, in which
the measurement operators are projectors onto |α⟩ and may return any |α⟩ as a result.
This concludes the introduction of this thesis, and all concepts necessary to comprehend the following
work.
14
Chapter 2
Quantum Steganography via Coherent and Fock State Encoding in an
Optical Medium
2.1 Introduction
Covert communication is often associated with military or espionage applications, but some of the earliest applications were for personal use. In Ancient Egypt, hieroglyphs were used by royal scribes to send
the pharaoh’s messages covertly. In Roman times, the Caesar cipher, where each letter in a message was
“shifted” by a predetermined amount (akin to a secret key), was devised [59], this approach being refined into the Vigenere encoding around the 15th Century [1]. Over time, developments became more
mathematically and technologically advanced. Famously, the use of the Enigma machine in World War
2 enabled the Germans to communicate covertly until the cipher was cracked by the Allied effort, giving
them a strategic information advantage for the rest of the war [16, 2].
The Allies were able to replicate, understand, and reproduce the technology of the Enigma machine in
order to crack its cipher; thus the practical application of quantum computers and quantum information
devices, which represent an additional level of technological sophistication, are evident. The question we
would like to explore is how to leverage quantum computers and quantum information, a present and
future technological advantage, to communicate covertly in a variety of situations.
The main scenario we will consider is one where the eavesdropper has access to the full contents of
the messages being transmitted, but is made to believe they are innocuous, unlike in cryptography where
the encrypted text is often nonsensical without a key and so arouses suspicion. This reflects a difference in the situation: in cryptography, the messages are often read secretly, while in steganography the
eavesdropper is not secret and maintains everything out in the open. In many ways, this is advantageous—
consider the wartime example. If the goal is not to arouse suspicion, it can be markedly more suspicious
and dangerous to send messages of gibberish through wartime censors than to have a chat with your friend
on the phone about normal topics—only this chat contains some hidden information. Other examples of
steganography are an invisible watermark that can only be revealed with a procedure no one would think
to do spontaneously [2], or a secret encoding of information in an audio file [6]. Some steganographic
encodings are readable by anyone who thinks to look for them, relying on the concealment of the covering message, while others may require a shared secret key between the sender and receiver, just like
many cryptosystems. Steganography can even be combined with cryptography as they are effectively independent measures—for example, by using any methods we describe in this paper to transmit an already
cryptographically encoded message. This will, in general, require more shared secret key.
A large amount of work has been done on quantum cryptography [19, 22, 42]. The field of quantum
steganography (and, broadly, covert communication) is smaller, but also includes a substantial body of
relevant theoretical work. It has recently been shown that over n uses of additive white Gaussian noise
15
(AWGN), a number of bits proportional to √
n can be communicated covertly [11] which was later generalized in [10]. Furthermore, a number of methods have been devised for such communications using
quantum systems, as in [24, 36, 53]. In this paper we will study the encoding of information in quantum
states transmitted over an optical channel in such a way that it imitates thermal noise. This follows the
broad approach of Brun and Shaw in [48, 49] (for qubit channels), and has been studied for optical channels in [60]. Like the latter, our work follows the “secrecy” approach typical of steganography, in which
the message is protected by the fact that its existence is concealed. This is as opposed to the “security”
approach of standard cryptography, as well as methods such as spread spectrum and chaotic communication that are not generally secret at an information-theoretic standard [44, 8]. Steganography, as studied
in this paper, provides formal guarantees of secrecy based on metrics of fidelity and trace distance, unlike the aforementioned approaches, while also functioning in narrow-band. Compared to [60], our work
is experimentally simpler, though its practical performance at scale remains to be demonstrated. It also
does not require any assumptions about the ability of the eavesdropper to detect the noise beyond their
expectation of a thermal state, which enables a potentially greater ability to communicate (as quantified
by the communication rate and rate of secret key consumption). This current chapter only treats classical
communication, but it shows the kind of methods that could be used in future quantum steganographic
encodings for entanglement distribution or quantum communication, perhaps drawing on techniques similar to those in [50]. We will discuss these points in more detail in a later chapter. In this chapter, we prove
secrecy by calculating the trace distance or fidelity between the “innocent” (thermal) state and the average state containing hidden information. This approach is sufficient to demonstrate the effectiveness of a
steganographic method, and is simpler than the proofs needed to show security in cryptography.
In Sections 2.2 and 2.3 we develop the machinery required to understand the communication process;
in Section 2.4 we develop and analyze some simple encodings; and in Sections 2.5 and 2.6 we do a more
detailed analysis of their implementation and efficiency. Section 2.7 summarizes the results and discusses
future work.
2.2 Important Measures for Steganography
In steganographic protocols such as those we will propose in later sections, there is a key trade-off that
must be taken into account: that of the effective communication rate achievable in the channel as opposed
to the similarity of the targeted “innocent” state with the actual channel state. In some schemes, such as
the Fock encoding we will discuss later, these can be quantified by just two measures: the communication
rate (which is given by R = 1+perr log perr+(1−perr) log(1 − perr) for a binary channel with a probability
perr of mistaking one symbol for another) and the trace distance between the channel state ρ containing
hidden information, represented by the density operator corresponding to the state of the channel over
which information is being transmitted, and the “innocent” thermal state ρth. This trace distance is given
by
D(ρ, ρth) = 1
2
||ρ − ρth||, (2.1)
where the above norm is the trace norm. Alternatively, one can use the state fidelity
F(ρ, ρth) =
Tr q√
ρρth√
ρ
2
(2.2)
as another measure of distance that functions similarly to the trace norm, although it is not a metric on
the set of density matrices in the formal sense. The trace distance can be used to directly compute the
minimum probability of mistaking ρ for ρth using a positive operator-valued measurement (POVM), and
is therefore conceptually useful as a representation of secrecy. However, the fidelity is often easier to
16
calculate, and can be used to bound the trace distance [23] — it also can be interpreted as a probability of
mistaking one state for another when at least one of the states is pure. In particular, if the fidelity is 1 (or
approaching 1), the trace distance is 0 (or approaching 0) and the two states cannot be distinguished by
any measurement.
In schemes where additional practical constraints are imposed to facilitate communication (for example, reducing the choice of possible states used in encoding to make distinguishing them easier, as in some
of the coherent state protocols discussed below), we can assume that the sender and receiver draw on a
pre-shared secret key, unknown to the eavesdropper. This key could be, for example, a secret string of
random bits. This key usage can be quantified by a secret key rate K, the number of bits of secret key
consumed per channel use. The ratio R/K or difference R − K of the rates give additional measures of
the usefulness of the scheme for steganographic communication.
These measures can help us evaluate the effectiveness of different potential protocols. On one extreme,
if Alice and Bob simply send the “innocent” state at every time interval (i.e. with probability 1), the fidelity
metric will have its highest possible value, which is 1. However, this encoding has no communication rate,
R = 0. On the other hand, if Alice and Bob use a naive encoding that maps the input bits 0 and 1 to a
fixed pair of orthogonal states, it will generally be impossible to have good fidelity with the thermal state,
and Eve can easily detect that communication is happening. The goal of a good steganographic protocol is
to encode the message—a string of input bits—into a sequence of states, such that after averaging over all
possible messages (and also the pre-shared secret key, if any), the fidelity with a string of thermal states is
close to 1, but Bob can also retrieve the encoded string with high probability.
The protocols we will consider deal with cases where the fidelity (or trace distance) is very close to 1,
at least in an asymptotic sense; the communication rate is nonzero; and the system can be implemented
physically via the transmission of physically realizable states. The first example we will discuss is a protocol
using coherent states.
2.3 Disguising coherent states as thermal noise in a channel
A coherent state is a state of a quantum oscillator or field mode. It is defined, for some complex α, as
|α⟩ =
X∞
n=0
α
n
e
−|α|
2/2
√
n!
|n⟩, (2.3)
which is the result of acting with the displacement operator D(α) = e
αa†−α
∗a on the |0⟩ state of a harmonic oscillator. A thermal state is given for the same type of system by
ρth =
1
Z
X∞
n=0
e
−
ℏω(n+1/2)
kBT |n⟩ ⟨n| , (2.4)
where
Z =
X∞
n=0
e
−
ℏω(n+1/2)
kBT =
1
2
csch
ℏω
2kBT
(2.5)
is the partition function.
If we describe the thermal state of a mode in a channel in terms of the average number of photons
transmitted, known as
n¯ =
e
ℏω
kBT − 1
−1
, (2.6)
17
we can reformulate the expression for ρth in a simpler way:
ρth =
1
n¯ + 1
X∞
n=0
n¯
n¯ + 1n
|n⟩ ⟨n| . (2.7)
We want to represent this using coherent states over the phase space described by |α⟩ =
reiθ
, as in
the Glauber P-Representation [55]:
ρth =
1
N
Z
d
2αe−c|α|
2
|α⟩ ⟨α|
=
1
N
Z ∞
0
rdr Z 2π
0
dθe−cr2
reiθE Dreiθ
=
2π
N
X∞
n=0
1
n!
Z ∞
0
r
2n+1e
−(c+1)r
2
|n⟩ ⟨n|
=
π
N
X∞
n=0
1
(c + 1)n+1 |n⟩ ⟨n| ,
(2.8)
=⇒
π
N(c + 1)n+1 =
1
n¯
n¯
n¯ + 1n+1
, (2.9)
=⇒ c =
1
n¯
, N = πn, ¯ (2.10)
=⇒ ρth =
1
πn¯
Z ∞
0
dr Z 2π
0
dθre− r
2
n¯
reiθE Dreiθ
. (2.11)
We can integrate over θ and consider this as a probability distribution over coherent states |r⟩ with p(r) =
2
n¯
re− r
2
n¯ , i.e., a Rayleigh distribution:
Rayleigh
r;
r
n¯
2
!
=
2
n¯
re− r
2
n¯ . (2.12)
The median of this distribution is given by r1/2 =
√
n¯ ln 2, which is a convenient point of separation if we
want to send binary messages.
Because the set of coherent states is over-complete, the existence of a coherent-state representation is
guaranteed. A related question is how well a set of coherent states with a set of M randomly-chosen radii
{rj} and uniformly random phases can approximate a thermal state. This gives a mixture
ρc =
1
M
X
M
j=1
e
−r
2
j
X
n
r
2n
j
n!
|n⟩ ⟨n| . (2.13)
The answer is remarkably simple:
p
F(ρth, ρc) ≥ 1 −
n¯
2M
=⇒ ||ρth − ρc|| ≤ r
4¯n
M
−
n¯
2
M2
,
(2.14)
18
where F is the average fidelity p
F(ρth, ρc) = Tr q
ρ
1/2
th ρcρ
1/2
th
. This is relevant for “Pairwise” protocols we will discuss later.
Another important bound is on the same kind of setup, but without averaging over θ. If we instead
discretize the circle over θ—that is, we consider a set of states |αjk⟩ =
rje
2πik
L
E
for sufficiently large
L—we can do at least as well as the above result. A proof of both these bounds is contained in Section 2.8.
2.4 Mappings for Quantum Steganography
In this chapter we consider four main approaches to encoding information steganographically as states
of light: the Fock state encoding, which requires no shared key; an encoding in coherent states without
shared key; and two other encodings into coherent states that do require shared key: the Vertical Angles
encoding and the Redefined Rayleigh Distribution encoding.
2.4.1 Fock State Methods
The scheme for Fock state methods is straightforward and has one clear advantage: Fock states are more
easily distinguishable than coherent states, so the communication capacity is higher, although the problem
of realizing an arbitrary Fock state in an experimental setting is also more challenging than for coherent
states. The protocol we will describe requires only the preparation of multiphoton Fock states, and may
be done using probabilistic operations such as photon addition. As such, it can in principle be done using
only single photon sources, single photon detectors, and beam splitters, although when n¯ is high this
may become experimentally difficult due to low observation probability. It should be noted that in that
regime, the coherent state methods described in this paper perform more competitively with the Fock state
methods due to the greater ease of distinguishing between different coherent states at a higher amplitude.
This method, however, requires an encoding system from binary digits to Fock states which depends on
the value of n¯, and is described in detail in Section 2.6 and Section 2.8. If we are dealing with Fock states
in a noiseless channel, the problem is one of translating regular binary strings into binary strings with a
certain number of 1s and 0s determined by n¯. It is worth noting as an experimental consideration that, in
cases where n¯ is low, the weight of the encoded text will be low on average and a sophisticated encoding
may not be necessary. In cases where n¯ is very large, that may not be the case, and it would require us
to define different Fock states as encoding the binary 1 or 0, according to the Boltzmann weights of such
Fock states (for example, we might define all states below a certain value of n as belonging to 0, and the
others to belong to 1). In Section 2.6 we will consider a more intermediate case for communication of a
message of length N bits and derive bounds on its efficiency.
2.4.2 Distribution Coherent State Methods
Since Equation 2.14 describes the average fidelity, it makes sense to examine different approaches to optimize this quantity, taking into account the non-orthogonality of the coherent states being measured. In
all cases we will draw from distributions defined by
ρ0(r) = 2
n¯
re− r
2
n¯ , 0 < r < r 1
2
,
ρ1(r) = 2
n¯
re− r
2
n¯ , r 1
2
< r < ∞,
(2.15)
representing the transmission of 0 and 1 from the sender.
19
First, we consider the “distribution” case, which does not require key, where Alice draws a coherent
state randomly from ρ0 or ρ1 and Bob has to try and guess which distribution it came from. Bob’s ability
to do this is bounded by the trace distance between the states ρ0 and ρ1. This is difficult to evaluate, but
can be evaluated in terms of the cumulative distribution function of the Poisson processes,
Qn = 2−(¯n+1)Xn
k=0
(cr2
1/2
)
k
k!
(2.16)
for a process with λ = (¯n + 1) ln 2 = cr2
1/2
and Q˜
n for λ = ¯n ln 2, with N1
2
the median of the Poisson
process (a full derivation is included in Section 2.8):
1
2
ρ0 − ρ1
=
1
2(n + 1)
X∞
n=0
n¯
n¯ + 1n
|1 − 2Qn|
= 2
1 + (2QN 1
2
− 1)
n¯
n¯ + 1N 1
2
+1
− Q˜N 1
2
!
.
(2.17)
From this we can calculate the probability of error perr and the communication rate R. Since the Poisson
process is discrete, this curve has some kinks when N increases, as seen in figure 2.1. When n¯ is large,
the states ρ0 and ρ1 are almost orthogonal; but when n¯ is O(1) or smaller, the two states have significant
overlap and are not perfectly distinguishable. In this case error correction may be necessary, and matching
the thermal state may still require shared secret key, as discussed in Section 2.6. We consider two variations
of this idea below.
2.4.3 Pairwise Coherent State Methods
A related method is to partition the thermal state as above and select a finite set of states from each half to
send. As we showed above, this finite set approximates the thermal state very well and can be distinguished
more easily from each other. This method may be easier to implement practically, as only sampling from
a subset of ρth is sufficient, but requires more secret key than the distribution methods, which will be
quantified in Section 2.6.
2.4.4 Vertical Angles
In this approach, Alice and Bob choose α0 and α1 ahead of time to have opposite phases θ, i.e. α0 = r0e
iθ
and α1 = r1e
i(θ+π) = −r1e
iθ, where θ can be chosen arbitrarily. These states correspond to the binary
0 or 1 and are drawn from the distributions ρ0 and ρ1. This specific protocol is more useful for the low-n¯
case. Knowledge of the two possible states constitutes a secret key, and the θ correlation helps distinguish
the distributions by minimizing the overlap
| ⟨α0|α1⟩ | = e
−
|α0−α1|
2
2 = e
−
|r0+r1|
2
2 .
This is maximized for r0 = 0, r1 = r 1
2
which gives
| ⟨α0|α1⟩ | ≤ e
−
r
2
1/2
2 = 2− n¯
2 , (2.18)
20
R Comparing Rates with and without key
Figure 2.1: A plot of the lower bound on the communication rate for the vertical angle (key) encoding
scheme compared to the “Distribution” (no key) scheme.
=⇒ perr =
1
2
1 −
|α0⟩ ⟨α0| − |α1⟩ ⟨α1|
=
1
2
1 −
p
1 − | ⟨α0|α1⟩ |2
≤
1
2
1 −
p
1 − 2−n¯
.
(2.19)
The associated communication rate is R = 1 + perr log2
(perr) + (1 − perr) log2
(1 − perr) which can be seen
in figure 2.1.
We can think of this setup as using a key, since Alice and Bob must have prior information linking
the two α values, in contrast to the aforementioned no-key case. Using this key allows a greater rate of
communication, since the overlap between the coherent states representing 0 and 1 is minimized. We can
see this in figure 2.1.
2.4.5 Redefined Rayleigh Distributions
The final approach involves simply drawing r0 and r1 from the corresponding distributions, communicating them over a channel, and attempting to determine which distribution was sampled from based on
21
Figure 2.2: in this setup, a beam splitter combines the coherent states denoted by |r⟩ and |β⟩, with nc and
nd denoting detectors that measure the incidence of photons. The value of the homodyne measurement is
given by m = nc − nd.
the channel measurement. This approach is equivalent to determining the overlap of the distributions ρ0
and ρ1, where we are once again randomizing θ, but the two are not simultaneously diagonal in any basis
and so the optimal measurement to distinguish them is not easy to find with no key. In this section we
consider a specific type of measurement and attempt to optimize for a variable parameter mc which will
distinguish between the two states ρ0 and ρ1, although in Section 2.6 we will also consider measurements
that saturate the Helstrom bound [28]
perr ≥
1
2
−
1
2
||(1 − f)ρ0 − f ρ1|| (2.20)
when discriminating between two states ρ0 and ρ1 occurring with probabilities 1 − f and f, respectively.
There is one notable difference between this approach and the previous. For easy distinction, we can
without loss of generality choose θ = 0 for our analysis and redefine the distribution ρ˜1 as spanning
(−∞, −r1/2
] to make it easier to distinguish from ρ˜0, as this essentially rotates ρ1 about the origin by
π and creates the greatest possible distance between the means and medians of ρ0 and ρ1 by such an
operation, while not fundamentally changing the nature of any calculations we will perform.
2.4.5.1 Setup
The coherent state-based protocols we are considering use a balanced homodyne measurement of a state
|r⟩. This state is coupled to an oscillator by means of the beam splitter shown in figure 2.2. If we have
the operators a and a
†
, of which |r⟩ is an eigenket of a, and likewise b and b
†
for |β⟩, once the states pass
through the beam splitter the outcome is characterized by the new operators c =
a√
+b
2
and d =
a√−b
2
. As
such, the desired observable is given by m = nc − nd = c
†
c − d
†d = a
†
b + b
†a.
22
2.4.5.2 Bounds
We can derive bounds using the generalized Markov inequality,
P(X − µ > λ) ≤
Mn(X)
λn
(2.21)
for even n, where X is a random variable, µ is its mean, and Mn(X) is its nth moment.
Applying this to the distributions for r1 and r0, we have for a cutoff value mc ∈ [2βr¯1, 2βr¯0] that
P(m − m¯1 > λ) ≤
Mn(m1)
λn
,
P(m − m¯0 < λ) ≤
Mn(m0)
λn
,
(2.22)
where here m¯ 1 and m¯ 0 refer to the mean expected m values for each distribution, 2βr¯1 and 2βr¯0, respectively.
There is an explicit formula:
Mn(X) = Xn
k=0
n
k
(−1)n−kE[Xk
](E[X])n−k
. (2.23)
We also have the explicit formula for moments of m, under the approximation b ≈ β (since only the
leading order terms in β matter for sufficiently large real β):
E(mk
) = Z
p(r)β
k
D
r|(a + a
†
)
k
|r
r|(a + a
†
)
k
|r
E
dr
=
4β
k
n¯
Z
dr(re− r
2
n¯ )Fk(r) ,
(2.24)
where
Fk(r) =
Pk/2
j=0
k!23j−k/2
(2j)!(k/2−j)!r
2j
, k even
P(k−1)/2
j=0
k!23j− k−3
2
(2j+1)!( k−1
2 −j)!r
2j+1
, k odd.
(2.25)
A derivation of the above is obtained by acting with ⟨r|D(α)|r⟩ = e
2iβr−
β
2
2 and equating the Taylor
expansions of both sides to each order in β. This provides a means to evaluate the higher-moment Markov
bound
perr =
1
2
[p(m − m > m ¯ c − m¯ |1) + p(m − m < m ¯ c − m¯ |0)]
≤
1
2
Mn(m1)
(mc − m¯ 1)
n
+
Mn(m0)
(mc − m¯ 0)
n
.
(2.26)
23
2.5 Numerical simulation and performance
We expect that for a coherent state, the distribution of m will be Gaussian [47]. It is straightforward to
compute the mean and variance of m in the case where r is randomly sampled from the distributions
without constraint, rather than being one of two possibilities:
m¯ = 2βr, ¯
r¯0 =
4
n¯
Z
√
nln ¯ 2
0
r
2
e
− r
2
n¯ dr ≈ .516√
n, ¯
r¯1 = −
4
n¯
Z −
√
nln ¯ 2
−∞
r
2
e
− r
2
n¯ dr ≈ −1.256√
n, ¯
r¯
2
0 =
4
n¯
Z
√
nln ¯ 2
0
r
3
e
− r
2
n¯ dr ≈ .307¯n,
r¯
2
1 =
4
n¯
Z −
√
nln ¯ 2
−∞
r
3
e
− r
2
n¯ dr ≈ 1.693¯n
=⇒ ∆r
2
0 ≈ .041¯n ;∆r
2
1 ≈ .131¯n.
(2.27)
Likewise,
Var(m) = E(m2
) − (E(m))2
= 4β
2∆r
2 + β
2 + ¯r
2,
Var(m0) = (.164¯n + 1)β
2 + .307¯n,
Var(m1) = (.524¯n + 1)β
2 + 1.693¯n.
(2.28)
Sampling from a normal distribution with these parameters is simple, so we can empirically determine
the optimal value of mc by simulating the transmission homodyne measurement procedure directly. The
results are displayed in figure 2.3.
The above refers to the case where r is randomly sampled from the distributions without constraint,
rather than being one of two possibilities. In latter case, where the key designates one of two specific states
to be distinguished between by homodyne measurement for each transmitted bit (one state |r0⟩ from ρ0
and one |r1⟩ from ρ1), the optimal value calculation for mc ≈ β(r0 + r1) is more straightforward—it
derives from optimizing the accumulated probability
Z mc
−∞
e
−
(m−2βr1)
2
2(r
2
1
+β2)
p
r
2
1 + β
2
−
e
−
(m−2βr0)
2
2(r
2
0
+β2)
p
r
2
0 + β
2
dm (2.29)
at mc—and gives the result
perr =
1
4
2 + erf
p
mc − 2βr0
2(β
2 + r
2
0
)
!
− erf
p
mc − 2βr1
2(β
2 + r
2
1
)
! !,
(2.30)
which does not exceed 1/2. We will compare this to the Helstrom bound once we derive a bound for Fock
state communication in Section 2.6, so they can all be seen side-by-side.
24
Figure 2.3: Two views of the plot of perr as a function of rc = −
mc
2β
√
n¯
and n¯. The optimal value of rc is
between .4 and .5.
25
2.6 Particular Encoding Methods
2.6.1 Fock State Methods
Continuing from the discussion in section 2.4, if we denote any Fock states |n⟩ with n ≥ 1 as the binary
1, we must have a quantity of nz =
N
n¯+1 0s and N − nz =
Nn¯
n¯+1 1s in the encoded string, which comes
directly from the Fock state representation of ρth. Thus the problem is one of encoding from the set of
all binary strings of length N to the set of binary strings with such a ratio, of which there are N
nz
. It is
straightforward to calculate the channel capacity using such an encoding, as the number of bits we can
encode is simply Nh
1
n¯+1
—this provides evidence for the simplicity of the cases of extreme n¯ as noted
in section 2.4.
We can approach this rate using a “by value” encoding. Think of an N-bit string as representing an
integer w, and encode this as the wth smallest bit string (by value) that satisfies the above criteria for the
number of 0s and 1s. We can use a theorem called the “Christmas Stocking Theorem” [3] to efficiently
generate the encoding, going from either the least or most significant bit. This theorem states that
X
k−1
i=0
n + i
i
=
k + n
k − 1
(2.31)
which provides a straightforward way of counting down digits. More details and examples are contained
in Section 2.8.
2.6.2 Coherent State Methods
We want to emulate the statistics of the thermal state using coherent states sampled from our distributions,
ρ1 and ρ0. If we have an equal number of 0s and 1s in the message, this is straightforward: we can
sample from the distributions and simply transmit the result. There is a catch, however: since the coherent
states are not orthogonal, there is a probability of mistaking ρ1 for ρ0 at the time of measurement, which
produces something similar to a Pauli X error. We can protect against this by using error correction and
encoded keywords; however, this requires secret key, since the encoded messages will no longer appear to
be sampled from ρth.
For example, if we use a simple 3-bit Hamming code, there are only 2 codewords (000 and 111) and 8
possible, equally-likely bit-strings we would expect to see if sampling from ρth. We can make these strings
appear random again by doing a bitwise XOR with a random 3-bit string, selected by generating a random
number between 0 and 7. This scrambled codeword will still protect against a bit-flip error, but it requires
that Bob also know the random number that was chosen. So such a scheme requires Alice and Bob to share
a secret key in advance. If we wish to cut down on the amount of secret key used, we could use a shared
seed for a pseudorandom number generation protocol, such as the rabbit cipher, which is thought to be
cryptographically secure [12]. However, this would reduce the secrecy below the information-theoretic
level we have been assuming up to this point.
2.6.2.1 Distribution Method
We can quantify the results of the coherent state encoding. Supposing that, instead of splitting the coherent
distribution in half radially, we split it so that a fraction of the density f is on the right and denotes a binary
1, and a fraction 1 − f on the left denotes the binary 0, we can find the optimal communication rate in
terms of f. The results in Fig. 2.4 show that asymptotically, no secret key is needed for sufficiently large n¯,
when we use an f-value closer to 0. Interestingly, there is a trade-off between the optimal communication
2
f
Rate per
Key
f
Communication
Rate
f
Rate per
Key
f
1-f
Probability Density of a Rayleigh Distribution
Figure 2.4: The division of the thermal state in terms of r (adapted from [7]) (a) and the associated communication rates for various values of n¯ and f. In descending order, the plots display the optimized value
of the communication rate per bit of secret key (b), and both the communication rate (c) and rate per bit
of key (d) when the quantity to be optimized is simply the communication rate.
27
rate in terms of minimizing perr, and making the states as easy as possible to disguise. The key rate K
required here is given by
K = h(f) − h((1 − f)p(0|0) + f p(0|1))
+ fh(p(0|1)) + (1 − f)h(p(0|0))
≥ 0
(2.32)
where the probabilities p(b|a) refer to the probability that Bob measures a state he decides is from ρb given
that Alice sent a state from ρa. We will derive expressions for these quantities below.
2.6.2.2 Pairwise Method
We can also consider this approach from the perspective of using a finite set of states—what we called the
“pairwise” protocol earlier. If we use a set of size M, with fM drawn from ρ1 and (1 − f)M drawn from
ρ0, we should still maintain a fidelity scaling of F ≥ 1 −
n¯
2M , since the overall statistics are still the same
as before.
If we add factors of 1 − f in front of p(1|0) and f in front of p(0|0) in the expression we previously
derived in 2.30 for perr under homodyne measurement, with these weightings we now have
mc ≈ β(r0 + r1) +
β log
1
f − 1
2(r0 − r1)
(2.33)
and
perr =
1
4
f
erf
p
mc − 2βr0
2β
2 + r
2
0
!
+ 1!
−(1 − f)
erf
p
mc − 2βr1
2β
2 + r
2
1
!
+ 1! !.
(2.34)
We see that for f = 1/2 the value of mc reverts to β(r0 + r1).
For optimal generalized (Helstrom) measurements, we consider the quantity
M = (1 − f)|α0⟩ ⟨α0| − f |α1⟩ ⟨α1| (2.35)
If we orthogonalize the basis using η = ⟨α0|α1⟩ ∈ R, we can express this as
M = (1 − f − f|η
2
|)|α0⟩ ⟨α0| − f(1 − |η|
2
)
α
⊥
0
E Dα
⊥
0
−fηp
1 − |η|
2 |α0⟩
D
α
⊥
0
− fηp
1 − |η|
2
α
⊥
0
E
⟨α0|
(2.36)
with
|α1⟩ = η |α0⟩ +
p
1 − η
2
α
⊥
0
E
. (2.37)
Then we have that in this basis
p(0|0) = Tr
|α0⟩ ⟨α0|v0⟩ ⟨v0|
= | ⟨α0|v0⟩ |2
p(0|1) = Tr
|α1⟩ ⟨α1|v0⟩ ⟨v0|
= | ⟨α1|v0⟩ |2
(2.38)
where vi
is the eigenvector of M corresponding to the αi eigenspace.
28
From these quantities we can roughly determine the rate of this communication method, which is
limited by the entropy difference between the encoded and decoded information:
R ≈ h(q) − h(q|xi) (2.39)
and the key rate is set by the entropy difference between a simulated binary symmetric channel and the
mutual information of the actual channel
K = h(f) − R (2.40)
where q = (1 − f)p(0|0) + f p(0|1) = P
i
pip(0|xi). Then, we can plot the associated quantities, such as
K, R, and R
K
, and we see in Fig. 2.5 that the ratio is fairly small for the homodyne measurement case but
not for the Helstrom case.
We will also need additional shared secret key to specify which pair of states is being used for each
transmitted bit. To specify a pair of states, one for each bit value, requires an additional log
(1 − f)(f)M2
bits of key. The communication rate, however, remains the same as described above. Note that the asymptotic communication rate per bit of key can be demonstrated analytically to exceed 1 by examining the
limiting behavior of the expression for R
K
.
Note that the value of n¯ manifests itself in the specific coherent states that will be drawn from the
distributions, rather than being directly visible in the binary transmitted bits as in the Fock case. If the
message does not contain a roughly equal number of 1s and 0s, we can use an encoding, such as the
one described in Section 2.8, to compensate for that. However, in that case the message should first be
compressed, which increases the entropy of the transmitted string; and if need be, a sublinear amount of
secret key can be used to make the message string indistinguishable from a purely random bit string [52,
51].
2.7 Discussion and Future Work
As we can see in Fig. 2.6, the Fock state encoding is superior in the noiseless case and also doesn’t require
key. Moreover, it is straightforward and the encoding has a clean visual representation based on Pascal’s
triangle (as shown in Section 2.8). However, coherent states are more resistant to noise and are easier
to generate in the lab, although they perform noticeably worse under either ideal (Helstrom limit) or
homodyne measurements. In both cases, however, it is viable to communicate information covertly using
the above-described methods for any channel parameter n¯, and even in the coherent case the amount of
secret key required is low compared to, for example, a one-time pad.
There are many possible future directions to explore to build on this work. An interesting problem is
that of modeling noisy channels—for example, one with an existing thermal noise background—and the
transmission of coherent states through such a channel (which is a well-understood problem) [55]. Such a
study would provide a more thorough grounding for this work’s study of coherent state methods, which
are suboptimal in the noiseless case we have examined.
Another important problem is that of transmitting quantum information, including entanglement. In
this chapter we have only considered classical information transmission. It is unclear what kinds of encodings can be used for quantum information and how well they preserve the entanglement of the system,
both in the noisy and the noiseless case. Such a work might also delve into the potential applications of
this communication method to teleportation and superdense coding protocols, for example, and methods
of making those more secure under the type of schemes covered in this paper.
A final promising area of study could be different key utilization protocols, with the goal of utilizing the
inherent noise protection assumptions of steganography to efficiently scale the encryption process, and
2
Figure 2.5: The communication rate R, key rate K, and quotient R
K
for encoded transmission using
homodyne-type (orange) and Helstrom-type (blue) measurements at a variety of f and n¯ values.
30
Figure 2.6: A comparison of the communication rates using the Fock and coherent state encodings. In
the Fock case this results from the theoretical optimum measurement based on the binary symmetric
channel capacity and in the latter from optimal homodyne measurements and generalized measurements
that approach the Helstrom bound. In the coherent state cases, the results are derived from sampling from
the constituent distributions, since an analytical result is not as straightforward to obtain.
31
using other quantum communications as a vehicle for encoding steganographic information. This aims
to get around this work’s requirement that secret key is needed for non-orthogonal state discrimination
by exploiting the information difference between Alice, Bob, and Eve to communicate a secret key seed,
without compromising the communication rate derived above.
2.8 Additional Results
2.8.1 Proof of Eq. (2.14)
We start from the fidelity between
ρc = ρ =
1
M
X
M
j=1
e
−r
2
j
X
n
r
2n
j
n!
|n⟩ ⟨n| (2.41)
and the thermal state ρth:
p
F(ρ, ρth) = Trq
ρ
1/2
th ρρ
1/2
th . (2.42)
If we define the quantity ∆ρ = ρ − ρth, then we know immediately that E(∆ρ) = 0 since E(ρ) = ρth.
Then since [ρth, ρ] = 0, we can write
√
F = Tr
ρthq
I + ρ
−1
th ∆ρ
(2.43)
which can be lower-bounded by taking the binomial expansion of the square root. We can then take the
ensemble average:
E
Tr
ρth
I +
1
2
ρ
−1
th ∆ρ −
1
2
(ρ
−1
th ∆ρ)
2
= 1 −
1
2
Tr(ρ
−1
th E(∆ρ
2
))
=
3
2
−
1
2
Tr(ρ
−1
th E(ρ
2
))
(2.44)
where here
ρ
2 =
1
M
X
M
j=1
e
−r
2
j
X
n
r
2n
j
n!
|n⟩ ⟨n|
2
=
1
M2
X
jk
ρjρk. (2.45)
We have that the ρj are independent and that for each one E(ρj ) = ρth, so if we consider the cases only
where all rj are equal, which we’ll call ρ1, we have
E(ρ
2
) = M2 − M
M
ρ
2
th +
1
M
E(ρ
2
1
) (2.46)
which makes the result of Eq. (2.44)
√
F ≥ 1 +
1
2M
−
1
2M
Tr(ρ
−1
th E(ρ
2
1
)). (2.47)
32
We can now finally evaluate this trace term:
Tr(ρ
−1
th E(ρ
2
1
))
= (¯n + 1)E
e
−2r
2 X∞
n=0
n¯ + 1
n¯
n
r
4n
(2n)!2
!
=
X∞
n=0
2
(n!)2
n¯ + 1
n¯
n+1 Z ∞
0
e
−(2+1/n¯)r
2
r
4n
dr
=
X∞
n=0
(2n)!
(n!)2
n¯ + 1
2¯n + 1
n¯ + 1
n¯(2 + 1/n¯)
2
n
=
1
2π
n¯ + 1
2¯n + 1
X∞
n=0
n¯ + 1
n¯(2 + 1/n¯)
2
n Z 2π
0
(4cos2ϕ)
n
dϕ
=
1
2π
n¯ + 1
2¯n + 1 Z 2π
0
X∞
n=0
(¯n + 1)4cos2ϕ
n¯(2 + 1/n¯)
2
n
dϕ
= ¯n + 1
(2.48)
where we have used that
(2n)!
(n!)2
=
1
2π
Z 2π
0
(4cos2ϕ)
n
dϕ. (2.49)
This makes the final result of Eq. (2.44)
√
F ≥ 1 −
n¯
2M
(2.50)
in the average case.
2.8.2 Discretizing the Circle
The second bound is when the circle is discretized over θ. This encoding gives us that for j = 1...M and
k = 0...L − 1 and N = ML
|αjk⟩ =
rje
2πik
L
E
=
X
jk
X∞
n=0
e
−r
2
j
/2
(rje
2πik/L)
n
√
n!
|n⟩. (2.51)
Then we have
ρc =
1
N
X
n,n′
X
jk
e
−r
2
j
r
n+n
′
j
√
n!n′
!
e
2πik(n−n
′
)/L |n⟩
n
′
=
1
N
X
n,n′
X
j
e
−r
2
j
r
n+n
′
j
√
n!n′
!
1 − e
2πi(n−n
′
)
1 − e
2πi(n−n′)/L |n⟩
n
′
=
1
N
X∞
n=0
X
j
e
−r
2
j
r
2n
j
n!
|n⟩ ⟨n|
(2.52)
33
since the geometric series sums to δnn′. We can now evaluate the fidelity:
√
F
= Tr
vuut
X∞
n=0
1
N(¯n + 1)
n¯
n¯ + 1n
1
n!
X
j
e
−r
2
j r
2n
j
|n⟩ ⟨n|
.
(2.53)
This gives the same bound as before:
√
F ≥ 1 −
n¯
2N
(2.54)
If we instead consider the distributions ρ1 and ρ0, we can easily show, at least, that √
F → 1 as N → ∞
(since the integrals over the distributions are hard to compute) starting from Eq. (2.44):
√
F = 1 +
1
2N
−
1
2N
Tr
ρ
−1
th E[ρ
2
i
]
E[ρi
] = 2
n¯
Z r1/2
0
r
4n+1e
−(2+1/n¯)r
2
dr
+
Z −∞
−r1/2
r
4n+1e
−(2+1/n¯)r
2
dr
≤
2
n¯
Z ∞
0
r
4n+1e
−(2+1/n¯)r
2
dr
=⇒ −n¯ − 1 ≤ Tr(ρ
−1
th E[ρi
]) ≤ n¯ + 1
=⇒
√
F ≥ 1 −
n¯
2N
.
(2.55)
2.8.3 Derivation of Vertical Angle Bound with no Key
We start with the two states, given c = 1 + 1/n¯:
ρ0 =
4
n¯
Z r1/2
0
X∞
n=0
e
−(1+1/n¯)r
2 r
2n+1
n!
|n⟩ ⟨n|
=
2
−n¯
n¯ + 1
X∞
n=0
1
c
n
Xn
k=0
(cr2
1/2
)
k
k!
!
|n⟩ ⟨n|
(2.56)
and
ρ1 =
4
n¯
Z ∞
r1/2
X∞
n=0
e
−(1+1/n¯)r
2 r
2n+1
n!
|n⟩ ⟨n|
=
2
−n¯
n¯ + 1
X∞
n=0
1
c
n
X∞
k=n+1
(cr2
1/2
)
k
k!
!
|n⟩ ⟨n| .
(2.57)
The fidelity between these two states is given by
√
F = Tr√
ρ0ρ1 =
2
n¯ + 1
X∞
n=0
n¯
n¯ + 1n p
Qn(1 − Qn) (2.58)
where Qn = 2−(¯n+1) Pn
k=0
(cr2
1/2
)
k
k!
is the nth cumulant of the Poisson process with parameter λ = cr2
1/2
.
3
We can rewrite the trace distance as
1
2
||ρ0 − ρ1|| =
1
n¯ + 1
N
X1/2
n=0
n¯
n¯ + 1n
(1 − 2Qn)
+
X∞
n=N1/2
n¯
n¯ + 1n
(2Qn − 1)
(2.59)
where N1/2
is such that Qn < 1/2 iff n < N1/2
.
We take each term in the sum in turn:
1
n¯ + 1
N
X1/2
n=0
n¯
n¯ + 1n
(1 − 2Qn)
=
1 −
n¯
n¯ + 1N1/2+1!
−
2
−n¯
n¯ + 1
N
X1/2
k=0
((¯n + 1) ln 2))k
k!
(
n¯
n¯+1 )
k −
n¯
n¯+1 )
N1/2+1
1 −
n¯
n¯+1 !
= 1 + (2QN1/2 − 1)
n¯
n¯ + 1N1/2+1
− Q˜N1/2
,
(2.60)
where Q˜
n is the CDF for the Poisson process with λ = ¯n ln 2.
The second sum is
1
n¯ + 1
X∞
k=N1/2+1
n¯
n¯ + 1n
(2Qn − 1)
=
X∞
n=N1/2+1
n¯
n¯ + 1nXn
k=0
((¯n + 1) ln 2)k
k!
−
n¯
n¯ + 1N1/2+1
= −
n¯
n¯ + 1N1/2+1
+
2
−n¯
n¯ + 1
N
X1/2
k=0
((¯n + 1) ln 2)k
k!
X∞
n=N1/2+1
n¯
n¯ + 1n
+
X∞
k=N1/2+1
((¯n + 1) ln 2)k
k!
X∞
n=k
n¯
n¯ + 1n
= 1 + (2QN1/2 − 1)
n¯
n¯ + 1N1/2+1
− Q˜N1/2
.
(2.61)
35
Figure 2.7: This figure illustrates the process Alice uses to construct the encoded message as described
above on Pascal’s Triangle. First, she calculates that the message is transmissible using 8 bits, since 41<56
(green), as above. Then, she determines the message (41) is in the largest 21 numbers, and so she boxes
21 and the first digit is 1 so she moves right. Then she determines 41 is neither in the largest 6, nor 6+5,
nor 6+5+4 messages, and so circles the numbers 6, 10, and 15, and moves left each time, with each circle
signifying a zero (the intermediate numbers 4, 5, and 6 are also highlighted since it is useful to keep track
of their values). These steps are repeated until Alice reaches the right edge of the triangle, at which point
she knows all remaining digits are 0. As this figure shows, this is an efficient encoding, as only a linear
amount of combinations in the starting position need to be computed.
Combining these sums gives us the final result:
1
2
||ρ0 − ρ1|| = 2
1 + (2QN 1
2
− 1)
n¯
n¯ + 1N 1
2
+1
− Q˜N 1
2
!
(2.62)
2.8.4 Encoding Method for Fock States
Elaborating on the results of Section V, we can imagine a particular encoding method for Fock state communication. Let’s consider a particular example. Suppose n¯ = .56 and Alice wants to communicate the
six-bit string 101001, which we can think of as the binary expression for the number 41. (Note that this
protocol requires Bob to know the size of the message being communicated). If Alice wants to know how
many bits she needs to encode an x-bit number with M
n¯+1 zeroes, she solves the equation
M
M
n¯+1
= 2x+1 − 1. (2.63)
Alice can transmit her string with M = 8 bits: the condition is that
M
M
n¯+1
= 2Mh(
1
n¯+1 ) ≥ |m|, (2.64)
where we use |m| to denote the value of the message, which is 41. Therefore, Alice’s message should
consist of 5 bits of 0, 3 bits of 1, and we can verify that
8
3
= 56 > 41.
3
As we will show, 41 is encoded by the binary string 10001100, which is the binary expression for
140, the 41st-smallest number with an 8 bit string representation (possibly with leading zeroes) with the
appropriate ratio of 1s to 0s. To find this string, we follow a process derived from the “Christmas Stocking
Theorem” mentioned above, which we detail in figure 2.7. First, consider that if we are using N bits, nz
of which are 0, there are N−1
nz
strings with 1 in the first spot. There are N−2
nz−1
strings with 0 in the first
spot and 1 in the second spot. And so on. Alice can subtract these from 56 total possible strings to find the
string in question. For example, the first
7
5
= 21 bits have a 1 at the start, and 41 > 56 − 21 so Alice’s
message must start with 1, denoted by the blue square over the 21 in the figure. Then there are
6
5
= 6
strings with 11, so the second bit she sends must be 0, since 41 ≤ 56 − 6 (denoted by the red square over
the 6 in the figure). 56 − 6 − 5 − 4 = 41 so the string so far is 10001. Actually, at this point we have
reached the 41st largest string so Alice’s message is the largest such string with that prefix, 10001100=140,
and the remaining digits are in red in the figure since they correspond to the trailing 0s now that we have
allocated all the 1s.
Once Alice knows that this is the encoded string she wants to send, she generates 8 Fock states in a
ratio of 5:3 zeroes to ones (where “one” here refers to a mode greater than 0, with the appropriate statistics
to emulate the thermal state). Then she sends one of the |1+⟩ states for every position corresponding
to 1 in the string 10001100 and a |0⟩ state for each 0. Bob measures the Fock states and should receive
1001100 as the most likely string, after inverting the above algorithm, which is straightforward. Eve should
see something that looks like a thermal state: after all, it is bitwise random and has the required overall
statistics.
2.8.5 Practical Fidelity Bounds for the Fock Encoding
In practice, the Fock state encoding is not exactly equivalent to a thermal state. While we would like to
send the state
ρ =
1
n¯ + 1
|¯0⟩ ⟨¯0| +
n¯
n¯ + 1
|¯1⟩ ⟨¯1| , (2.65)
in practice we have a finite number of bits, so we are sending either the state
ρ
′ =
1
N
j N
n¯ + 1
k
|¯0⟩ ⟨¯0| +
l Nn¯
n¯ + 1
m
|¯1⟩ ⟨¯1|
, (2.66)
or the state
ρ
′′ =
1
N
l N
n¯ + 1
m
|¯0⟩ ⟨¯0| +
j Nn¯
n¯ + 1
k
|¯1⟩ ⟨¯1|
, (2.67)
(whichever maximizes the fidelity). Another way of writing this is, e.g.,
ρ
′ =
j
N
n¯+1 k
N
|0⟩ ⟨0|
+
1
N(¯n + 1)
X∞
n=1
Nn¯
n¯ + 1 n¯
n¯ + 1n−1
|n⟩ ⟨n| .
(2.68)
We would like to compute, as a function of n¯,
maxσ∈{ρ
′
,ρ′′}F(ρ, σ)
= max(Tr(
√
ρσ))
= max
TrsX
n
1
n¯ + 1
n¯
n¯ + 1n
cn |n⟩ ⟨n|
!
= e.g. s
⌊
N
n¯+1 ⌋
N(¯n + 1) +
X∞
n=1
1
n¯ + 1s
⌈
Nn¯
n¯+1 ⌉n¯
N(¯n + 1)
n¯
n¯ + 1n
≥ 1 −
1
8
(
(1 −
⌊
N
n¯+1 ⌋(¯n+1)
N
)
2
n¯ + 1
+
n¯(1 −
⌈
Nn¯
n¯+1 ⌉(
n¯+1
n¯
)
N
)
2
n¯ + 1
) −
n¯+1
n¯
2
16N3
= 1 −
1
8
(
l
Nn¯
n¯+1 m2
n¯+1
n¯ +
j
N
n¯+1 k2
(¯n + 1)
N2
− 1) −
n¯+1
n¯
2
16N3
≥ 1 −
1
8
(
Nn¯
n¯+1 + 1)2
(
n¯+1
n¯
) +
N
n¯+12
(¯n + 1)
N2
− 1
−
n¯+1
n¯
2
16N3
= 1 −
1
8
2N + 1
N2
+
1
N2n¯
−
1
16
n¯+1
n¯
2
N3
, n¯ ≥ 1,
≥ 1 −
1
8
2N + ¯n + 1
N2
−
1
16
(¯n + 1)2
N3
, n <¯ 1,
(2.69)
where the third order correction is due to Taylor’s theorem. The above chain of inequalities shows that
when N is fairly large, the fidelity between the encoded state and the thermal state is very close to 1.
At the cost of sharing some additional secret key, Alice and Bob can actually make the fidelity (almost)
perfect. The gap in fidelity between the encoded state and the thermal state results from using integer
approximations to N/(¯n + 1) and Nn/¯ (¯n + 1). But Alice and Bob can, in principle, randomly choose
the numbers of 0s and 1s to be used in the encoding, from the binomial distribution with probabilities
corresponding to the thermal state: p(0) = 1/(¯n + 1) and p(1) = ¯n/(¯n + 1). By averaging over this
choice, one can match the thermal state perfectly.
Chapter 3
Experimental Demonstration of Coherent State Steganography
3.1 Introduction
The following section summarizes experimental considerations and results from a collaboration with Haley
Weinstein and Jonathan Habif of the Information Sciences Institute at the University of Southern California. Weinstein and Habif performed the experiment, which involves the transmission of a single black and
white image file using coherent states designed to mimic a thermal state, and so I will focus this section
on the relevant theoretical work that facilitated the experiment.
So far we have treated a theoretical single (or dual) mode of a radiation field. In practice, however, it is
necessary to identify a physical component producing a thermal state in order to mimic the thermal state,
and these components often produce multi-mode emissions.
3.2 Thermal State Emission from an EDFA
In this experiment, we have used an Erbium-Doped Fiber Amplifier[41], or EDFA, which is a phaseinsensitive linear amplifier. Its operating principle is that of a two-level system, and it can emit via stimulated or spontaneous emission depending on how it is driven. As we have previously discussed, the
stimulated emissions of a laser are coherent states, but the weakly-driven amplified spontaneous emission of an EDFA causes thermal state emission with a frequency distribution as in Fig. 3.1, which is also
illustrative of the behavior of the power spectral density. This thermal emission occurs in a wide band,
meaning over a wide range of frequencies, but in the experiment we have generated coherent states using a narrow-band laser attenuated to match the average energy of the EDFA (n¯ ≈ 1.5). A band-pass
filter eliminates a portion of the EDFA’s emission profile, and the coherent states are injected in its place.
This is the mechanism by which we reconcile the broadband EDFA emission with the narrow-band (really,
single-mode) coherent state generation which we have described in the previous chapters. We now have
a facsimile of a thermal state, but one which can convey secret information via steganography.
3.3 Measurement and Reconstruction
A major issue is the question of demonstrating the effectiveness of the protocol in terms of secrecy. In
a theoretical setting we can calculate the result of a process and compare its fidelity to a target state for
steganographic purposes, but in practice an infinite-dimensional density matrix is impossible to perfectly
characterize. The method we use is that of continuous variable iterative tomography via homodyne measurement, as in [35]. This provides a metric indicating how closely the mixture of coherent states matches
the thermal state, since we cannot access the state directly.
39
Figure 3.1: The gain spectrum of amplified spontaneous emissions from an EDFA as a function of frequency,
from [40]. The gain flattens the farther you get from the center wavelength, which makes the injection of
states further from the center less conspicuous.
Normally, qubit tomography is done via maximum likelihood estimation of the density matrix elements. An elementwise reconstruction can be made to satisfy the conditions of the density operators by
using a form ρ =
LL†
Tr(LL†)
where L is a lower triangular matrix with real diagonal entries (the Cholesky
decomposition) which is guaranteed to be positive semidefinite, and doing a maximum likelihood reconstruction of the ensuing matrix elements based on the data points. However, the number of variables to be
optimized over scales with the square of the number of basis states involved. For example, if we impose a
cutoff above the n = 10 Fock matrix element, we still have to optimize over 100 variables, which is quite
costly. The iterative procedure both eliminates this issue and is simpler to implement.
The last question in this procedure is how to extrapolate from the homodyne measurements, which
are projectors onto the basis of quadrature eigenstates, measured using homodyne projection with a phase
angle of θ, onto elements of the |n⟩ eigenbasis. This is covered in [35] as well, and it is done using the
expression
⟨n|x, θ⟩ = e
inθe
−x
2
2
π
1/4 Hn(x
√
2)
√
2
nn!
(3.1)
which as we can see, is closely connected to the solution of the Harmonic Oscillator we saw earlier.
We have created this artificial thermal state using a finite set of states as described in the previous
chapter, in this case 100 states, which has an average fidelity of F ≥ 1 −
n¯
200 > 0.99 in theory. While in
theory a fidelity of .99 is easily distinguishable over the thousands of transmissions needed to send a file,
such as an image, through this channel, in practice if a limited subset of observations are made, especially
using actually feasible current technology, it is plausible that this fidelity is high enough to not arouse
suspicion.
The setup used for this demonstration was a homodyne tomography setup, which is included in Figure
3.2 for completeness.
40
Figure 3.2: The setup diagram for the experiment Weinstein and Habif performed.
3.4 Alternative Encoding
Since we are using homodyne tomography, it is logical to optimize the encoding process for homodyne
discrimination. Since homodyne detection is able to more accurately discriminate phase than intensity
values, we adapted the encoding correspondingly: rather than imposing an intensity cutoff value rc on
the density profile ρth to divide the two distributions, we instead imposed a cutoff θc = π in the phase
parameter after randomizing over phase. As we can see in Figure 3.3, homodyne detection outperforms
heterodyne detection for this encoding.
We have
ρ0 =
2
πn¯
Z π
0
Z ∞
0
dθdr re− r
2
n¯
reiθE Dreiθ
ρ1 =
2
πn¯
Z 2π
π
Z ∞
0
dθdr re− r
2
n¯
reiθE Dreiθ
reiθE
=
X∞
n=0
e
− r
2
2
r
n
e
iθn
√
n!
|n⟩
ρ0 − ρ1 =
2
πn¯
Z π
0
−
Z 2π
π
X
n,n′
Z ∞
0
r
n+n
′+1e
−r
2
(1+ 1
n¯
)
e
iθ(n−n
′
)
√
n!n′
!
dθdr |n⟩
n
′
=
X
(n−n′) odd
4i
n − n′
Γ
1 +
n + n
′
2
(1 + 1
n¯
)
−
n+n
′
2 −1
πn¯
√
n!n′
!
|n⟩
n
′
(3.2)
which allows us to provide a good approximation for the trace distance by constructing this matrix up to
a large value of n and computing its eigenvalues.
41
Figure 3.3: A comparison of the decoding performance of our scheme between homodyne, heterodyne,
and ideal detection (simulated using Strawberryfields [34][15]). As we can see, homodyne detection outperforms heterodyne detection.
42
Figure 3.4: The calculated trace distance, error probability, and communication rate under ideal conditions
for the phase encoding described above (not including key consumption). We compare the Helstromoptimal measurements with the theoretical calculations done above (nmax = 170) and simulations using
the StrawberryFields package [34][15], and find them to be in good agreement.
As we are using a homodyne measurement, we need to calculate:
perr = p(1|0) + p(0|1) = Z
Re(α)<0
Z ∞
0
p(m|α)p(α)dmd2α +
Z
Re(α)>0
Z 0
−∞
p(m|α)p(α)dmd2α
p(m|α) = r
2
π
e
−2(m−Re(α))2
perr =
r
2
π
3n¯
2
Z ∞
0
Z ∞
0
Z 3π
2
π
2
re− r
2
n¯ e
−2(m−r cos θ)
2
dθdrdm
+
Z 0
−∞
Z ∞
0
Z 5π
2
3π
2
re− r
2
n¯ e
−2(m−r cos θ)
2
dθdrdm
=
π − 2 arctan√
2¯n
2π
(3.3)
which can be seen in Fig. 3.4.
This is a theoretical estimation for an ideal detector, but as we see in the following section, it is not too
far off the mark.
4
3.5 Error Correction
As we discussed in a previous chapter, it is not possible to reliably discriminate between coherent states
since they are not mutually orthogonal. With the above protocol, an incorrect determination acts like a
bit-flip error in the secret communication. These errors can be corrected using error correcting codes.
However, this introduces correlations between bits which must then be disguised. We have chosen to do
this using a one-time pad with the minimal required length. The minimal required length is a function of
the error correction protocol chosen. For a repetition code, all but the first bit (which is presumed to be
random) must be randomized.
Note that this assumption that the message bits are essentially random need not be the case in a generic
message. For example, an image with many black pixels in the same place will not be random under every
possible encoding. However, if we apply a compression algorithm to the message before encoding this
effectively randomizes the bits, which also has the advantage of shortening the message we need to send.
The compression algorithm we have chosen is the Lempel-Zip-Markov chain Algorithm (LZMA) [4], which
is implemented in the Python base libraries and attributed to Igor Pavlov. When applied to the Trojan image
from Figure 3.5, the percentage of 1 bits was over 49% (and under 50%), despite the percentage being under
30% prior to the encoding. There is a cost to this: as implemented, LZMA decoding rejects any encoded
data which is not in the LZMA format, which can be broken by bit-flip errors such as the ones described
above. This helps determine what the logical error rate should be for this demonstration: a factor below
the size of the message being sent, in this case 10−7 or so. Of course, it is possible to adjust this to match
the constraints of the system in question. Other compression algorithms may also avoid this condition.
For the bit-flip channel, it was recently proven [5] that Reed-Muller codes under certain decoding
conditions saturate the capacity of the binary symmetric channel. Therefore, we performed a search over
the space of Reed-Muller codes of order r < 3 to determine the optimal code to use for the given physical
and desired logical error rate. Since all Reed-Muller codes are linear block codes, it is always possible
to create from them a systematic encoding, which simplifies the randomization process — since LZMA
randomizes the input bits, only the correction bits at the end need to be randomized, and we require 1 bit
of key for each bit that needs to be randomized. From experiments, it was determined that the setup has
an error rate of perr ≈ 0.21. With the above target logical error rate and given physical error rate, we
determined that the optimal code in terms of overhead and rate is the 64 bit repetition code.
3.6 Full Procedure
Although we have determined that for our experiment the 64 bit repetition code is most suitable, we will
detail the communication process here for a generic linear block code, without the use of additional key to
aid with discrimination. The steps for transmitting a binary message M using a linear block code which
encodes k bits into n > k bits are are:
1. First, take the generator matrix of the code and put it into row-reduced echelon form. Let the rank of
the generator matrix be r, and therefore we will need n − r bits of key for each k bits of message.
2. Encode the first k bits of M using the new generator matrix. In every k bits of M, the first r are already
encoded. For the other n − r bits, we need to generate secret key, and in this demonstration we have
simply used a one-time pad of binary symbols. For greater efficiency, a pseudorandom cipher can be used.
3. For each 0 bit, draw a random angle between 0 and π. For each 1 bit, draw a random angle between
π and 2π. An amplitude which is Rayleigh distributed with mode µ =
p
n/¯ 2 also needs to be drawn for
each bit. The corresponding coherent state is then sent through the channel. If we want to use additional
key, we draw the angle θ but either encode the phase as θ or θ+π, and transmit the value of θ. This allows
us to use the optimal phase angle for homodyne detection by aligning the discrimination with the states
we are sending.
44
Figure 3.5: A 100x100 black and white image of a USC Trojan transmitted without error correction, using
coherent state steganography (top). The bit error probability during this transmission was 0.21, which
is in good agreement with our calculation of 0.16 for an ideal detection scheme based on Equation 3.3
with n¯ ≈ 1.5. We also show the results of the reconstruction procedure for a set of coherent states, a
real thermal state with n¯ ≈ 1.26, and an artificial thermal state created by sampling Rayleigh-distributed
coherent states, with a reconstructed n¯ ≈ 1.02.
4. Set up a homodyne detector that will discriminate the phase angle of the coherent states. Based on this,
we decide if the state represents a 0 or a 1. The dividing line here should be the average of the medians of
the two distributions ρ0 and ρ1, to a good approximation, as discussed in the previous chapter. It should
also be rotated by −θ if we are using key.
5. Invert the previous encoding steps. First, we must invert the one-time pad, which will give us our error
corrected message. We must then decode this message using the decoding algorithm of the code we have
used for the error correction procedure.
6. Repeat this procedure for each subset of M of length k.
3.7 Results
At the time of publication, the transmission of a 100x100 image using coherent steganography and the
above scheme, with key but without error correction, has been realized. The coherent mixture and a
thermal state were both imaged using homodyne tomography, and the fidelity between the two was above
0.97, a remarkably high figure in this context and considering the fluctuations due to noise of up to 0.5
photons with n¯ ≈ 1.5. The fidelity with the theoretical states was also above 0.99. This same mixture of
coherent states was used to transmit in 40 milliseconds, without the LZMA encoding, the aforementioned
image, which was then reconstructed as above. Figure 3.5 shows the performance of this scheme in greater
detail.
45
3.8 Possible Vulnerabilities and Future Work
Although the above work allows for a near-complete characterization of the state, it does not take into
account temporal variations in the emission. Since any realistic detector functions on the principle of detecting photons over some small time interval ∆t and exciting a photocurrent, it is naturally insensitive
to correlations under the order ∆t (which may nonetheless occur). These correlations can in principle be
picked up by an eavesdropper, and so although our reconstruction scheme allows us to access a representation of the density operator, we are not able to rule out attacks which involve looking at time correlations
beyond this scale. While it is possible to measure the correlation function of the light, this measurement
is itself subject to error and cannot definitively rule out the possibility of an eavesdropper detecting the
communication. In a future work, we will create a more detailed temporal model of realistic EDFA emission, and adjust the encoding accordingly, so that we can account for and mitigate, if not fully rule out,
this vulnerability.
We have also not considered errors in the message’s transmission which may be induced by an eavesdropper. Actually, this is somewhat unnatural. If the eavesdropper is to be taken seriously, we must account
for the effects of their eavesdropping on our communication beyond the likelihood of discovery. For example, the eavesdropper could be performing homodyne detection on the channel, for example in the P
basis. If we later perform homodyne detection in the X basis, since [X, P] ̸= 0, we lose phase information
and the message may be distorted. In the following chapter, we will discuss such scenarios in more detail
as with entangled states it is hard not to disturb the state in question, but we have not addressed them in
the context of classical communications. It should be noted that while coherent states, as eigenstates of a,
are resistant to many types of noise and disturbances, Fock states are often more vulnerable.
46
Chapter 4
Steganographic Entanglement Sharing
4.1 Introduction
Steganography, meaning “concealed writing”, refers to the practice of concealing information within an
apparently harmless medium. For example, one might write a letter in which every third word can be
combined to spell a hidden sentence. In this way, we can present a paragraph which is not suspicious to
an eavesdropper intercepting our letter while still communicating our true message to another party with
whom we have agreed a scheme in advance.
“Concealed writing” need not refer to literal writing, however. Steganography can be performed in
any medium which can be used for communication. In a prior chapter we considered a one-way optical
channel through which various states of light, such as coherent states, could be transmitted, and in which a
potential eavesdropper might expect to see only thermal noise. We showed in that chapter that the thermal
state can be mimicked perfectly using either coherent or Fock states with an appropriate encoding — this
extends to any state which can be neatly diagonalized in the basis of coherent or Fock states, respectively.
We then showed in the subsequent chapter that this scheme actually works in practice, subject to caveats
regarding the ability to experimentally determine the true density matrix of a system.
However, the individually generated Fock and coherent states as discussed in the previous chapter are
only suitable for sending classical information. In this chapter, we will develop protocols for transmitting
quantum information while mimicking a thermal state in the presence of an active eavesdropper. We will
further analyze these protocols to determine under what monitoring conditions a quantum advantage is
achievable, and quantify that advantage where possible.
The protocols we will develop are not necessarily limited to the mimicry of thermal states. In principle,
any single-mode state which is not a pure state can be mimicked by a subsystem of an entangled two-mode
state, and a channel which contains only pure states is not a physically realizable system as there will
always be some noise. So it is always possible to share some entanglement covertly via steganography,
even if the noise model is not thermal; the thermal state is just the subsystem which corresponds to the
greatest amount of entanglement in the bipartite state, and also has the property of being easy to mimic
with lab-generated states. We will focus our attention on the thermal noise model for the bulk of this paper
for those reasons.
4.2 Idle Channel
Recall that the thermal state for a harmonic oscillator is given by
ρth =
1
Z
X∞
n=0
e
−
ℏω(n+1/2)
kBT |n⟩ ⟨n| , (4.1)
47
where
Z =
X∞
n=0
e
−
ℏω(n+1/2)
kBT =
1
2
csch
ℏω
2kBT
(4.2)
is the partition function.
If we describe the thermal state of a mode in a channel in terms of the average number of photons
transmitted, known as
n¯ =
e
ℏω
kBT − 1
−1
, (4.3)
we can reformulate the expression for ρth in a simpler form:
ρth =
1
n¯ + 1
X∞
n=0
n¯
n¯ + 1n
|n⟩ ⟨n| . (4.4)
In this case, the thermal state is expressed in the Fock basis of harmonic oscillator energy eigenstates. The
two mode squeezed vacuum (TMSV) state is a two-mode maximally entangled state given by
ρTMSV = sech2
(r)
X∞
m=0
X∞
n=0
(tanh(r))n+m |nn⟩ ⟨mm| (4.5)
in the Fock basis |nn⟩ = |n⟩A
|n⟩B
, where r is the squeezing parameter. It is maximally entangled in
the sense that it is impossible to increase the entanglement level of the state using “passive” Gaussian
operations, meaning those which preserve the photon number of the state. If we take the partial trace of
the above over the first subsystem, we have
TrA(ρTMSV) = 1
cosh2
(r)
X∞
n=0
sinh2n
(r)
cosh2n
(r)
|n⟩ ⟨n| (4.6)
which is exactly a thermal state with n¯ = sinh2
(r). As such, if we transmit one mode of the entangled
state through a channel, it is identical to the thermal state with appropriate parameter and therefore a
suitable primitive for steganographic entanglement sharing with a fidelity of 1.
There is a clear limitation, however: the n¯ of the channel we are trying to imitate sets a limit on how
squeezed the resource state can be, and therefore on how much entanglement can be transmitted in each
channel use. Specifically, for the entanglement of formation EF of a state we would like to mimic the
thermal state, we have
EF ≤ S(ρth) = (¯n + 1) log(¯n + 1) − n¯ log ¯n (4.7)
where equality occurs for the TMSV state, which is pure. Likewise, if the channel state to be mimicked is
a mixed state with entropy S but not thermal, the above expression EF ≤ S holds.
A natural concern is that the TMSV state may be prepared imperfectly due to experimental limitations,
for example using a scheme such as that in [20] The quality factor of the microring resonator may be
degraded due to fabrication imperfections, so that the squeezing level is r
′
rather than r. What then is the
fidelity between the idealized thermal state and the actual thermal state produced? The answer is quite
straightforward assuming only this limitation:
√
F =
1
p
(1 + ¯n)(1 + ¯m) −
√
n¯m¯
= sech(r − r
′
) (4.8)
48
Fidelity
.90
.95
.99
.999
.99999
0 1 2 3 4 5
0 r
20
40
60
80
100
%increase in EF
Figure 4.1: The percentage increase in the entanglement of formation as a function of the base squeezing
level r of the resource state. Note that r rather than n¯ = sinh2
(r) is the limiting parameter in the “lowenergy” regime, as an n¯ of 20 corresponds to a squeezing level of r ≈ 2.
which is bounded below by 1 −
(r−r
′
)
2
2
. This bound has another interpretation: it tells us how much
fidelity we need to sacrifice to transmit a state which is more entangled than what the channel permits.
For example, we can exceed the base squeezing level by up to 0.87dB of squeezing and still maintain a
fidelity of .99. This increase in EF can be very significant, as can be seen in Figure 4.1. Additionally,
since the fidelity is nondecreasing under partial trace (and the trace distance is likewise nonincreasing),
the fidelity of TMSV state preparation provides another bound on the thermal state fidelity:
Fch ≥ Fprep, (4.9)
meaning that if it is possible to prepare a TMSV state with fidelity Fprep, the fidelity Fch of the channel
state with the thermal state Eve is expecting is at least Fprep.
4.3 Channel with Eavesdropper
The above calculation would, in the classical case, constitute a suitable mapping for steganographic communication. However, since the resource we are sharing is an entangled state, there is an additional complication. Steganography assumes the existence of an eavesdropper, who can observe the channel in some
way. This observation can have the effect of disturbing the transmission of entanglement, as often happens
in a quantum key distribution protocol. Therefore, in this case it is more critical to provide some models
of the eavesdropper and describe the efficacy of communication under those circumstances.
49
4.3.1 Werner Model of the Eavesdropper
In the classical case we considered as an adversary an all-powerful eavesdropper, whose powers were
restricted only by the laws of physics. This applies only to the eavesdropper’s ability to perform arbitrary measurements on the channel state, of course. A comparably aggressive model is the probabilistic
eavesdropper channel
ξp(ρAB) = pTrB(ρAB) ⊗ TrA(ρAB) + (1 − p)ρAB (4.10)
which represents the full destruction of entanglement in the shared state when observed by the eavesdropper, an event that occurs with probability p. One interpretation of this is that Eve removes the state
from the channel, perfectly determines (through unspecified means, as this is unphysical) what state she
has acquired, and sends that state to Bob. Note that from Bob’s point of view, it is impossible to determine
whether Eve has tampered with the state at all. This is in contrast to a channel which sends the state to
TrB(ρAB) ⊗ |0⟩ ⟨0| rather than the thermal state: it is not only possible to detect an eavesdropper with
this vacuum channel, but the vacuum state is often more useful as a resource for e.g. teleportation. Surprisingly, even with this aggressive channel active, it is possible to perform useful quantum tasks with the
distributed entanglement even for relatively high values of p.
4.3.1.1 State Teleportation
In the case of TMSV state transmission, the channel above is explicitly given by
ξp(ρTMSV) = pρth ⊗ ρth + (1 − p)ρTMSV, (4.11)
which is a sort of continuous variable analog of the Werner channel [57], and has been studied previously
in [33]. In that work, it was demonstrated that coherent state teleportation could be performed with an
asymptotic (in r) average fidelity of 1 − p, which for p < .5 is an improvement over the classical case.
It is remarkable that a channel which is so frequently and completely disturbed is still able to provide a
quantum advantage!
It turns out that this result extends to the teleportation of nonclassical states. The (odd) cat state is a
highly nonclassical state which is given by
|ψ(α)⟩ =
|α⟩ − |−α⟩
N
(4.12)
where |α⟩ is a coherent state and N is the appropriate normalization. Such a state can be used for bosonic
error correction [27] and for Gottesman-Kitaev-Preskill (GKP) state preparation [26]. This continuous
variable state can be teleported using the Braunstein-Kimble teleportation scheme [14], which is analogous
to the qubit teleportation scheme. First, a maximally entangled TMSV state is prepared. Then, one mode
of that state is interfered with the state to be teleported using a 50-50 beamsplitter. That state is projected
onto a maximally entangled basis, in this case the by measuring x and p quadratures of the two output
ports. Finally, the measurement results are used to apply a correction to the state of the other mode using
a displacement operator. Although the steps are similar to qubit teleportation, there is a flaw: the TMSV
state is not maximally entangled in the x-p quadrature basis except in the limit of infinite squeezing (it is
maximally entangled only for a given level of squeezing). There is a second flaw: projections onto the Bell
basis produce a discrete outcome, while quadrature measurements produce a continuous outcome which
is less robust to error. These factors make continuous variable teleportation somewhat less reliable than
discrete variable teleportation with comparable resources.
A key signature of the cat state’s nonclassical nature is the negativity of the cat state Wigner function.
Figure 4.2 shows that for values of p up to .5 the Wigner function shows robust negativity after being
50
(a) (b)
(c)
Figure 4.2: (a) The Wigner function of the odd cat state with α = −1.5i, (b) average Wigner function
and teleportation fidelity of the cat state with α = −1.5i using a TMSV state with squeezing parameter
r = 1.15 and noise channel ξp, and (c) the upper and lower Fuchs–Van de Graaf bounds [23] for the result
of the teleportation using ξp. These results were obtained using the StrawberryFields package [34, 15]. A
derivation of the Fuchs–Van de Graaf lower bound is provided in Appendix 4.4 (the upper bound does not
hold formally except when p = 0 but is provided for illustrative purposes). These bounds become tighter
as the state becomes more and less pure, respectively.
51
(a)
(b)
Figure 4.3: (a) the fidelities of GKP state teleportation and (b) Wigner function for θ = 0 with r = 1.15
using the channel ξp for θ =
nπ
8
, where |ψ⟩ = cos θ
2
|0⟩ + sin θ
2
|1⟩ (black) and the Fuchs-Van de Graaf
lower bound (red). We can see that the average teleportation fidelity is higher for the GKP state than for
the above cat states at the same level of squeezing.
52
teleported, which is not achievable by classical means. This indicates that the average performance of this
highly noisy channel is significantly better for this task than an unmonitored classical channel, up to about
p = .5. The teleportation fidelity in this case is given by
F = pFth + (1 − p)FTMSV (4.13)
where
FTMSV =
1
1 + e−2r
−
1 + e
−4z
2
− e
−4e−2rz
2
1+e−2r − e
−4z
2
1+e−2r
2(1 + e−2r)(1 − e−2z
2
)
2
(4.14)
is the fidelity of teleportation using the TMSV state [14] and Fth is the fidelity of teleportation using the
thermal state for a cat state of magnitude |α| = z, which we have determined numerically.
Another type of state which we can teleport is a GKP state. Such a state encodes a qubit using a lattice,
usually a square lattice, distributed in phase space:
|0L⟩ ∝ X∞
k=−∞
x = 2k
√
ℏπ
E
|1L⟩ ∝ X∞
k=−∞
x = (2k + 1)√
ℏπ
E
(4.15)
for the standard lattice spacing length √
πℏ, where |x⟩ is the eigenstate of the X quadrature operator with
eigenvalue x. In practice, this state is not physically realizable, so for the purposes of this chapter we will
instead use the realistic GKP state given by |0⟩
ϵ = e
−ϵnˆ
|0⟩GKP for ϵ = .1, where nˆ is the Fock number
operator, except where otherwise noted; this replaces the delta functions above with Gaussians. The GKP
state is a good candidate for teleportation because it is naturally robust to the types of displacement errors
that occur in the teleportation protocol, and such errors can moreover be actively corrected. Furthermore,
if we can teleport, with high qubit fidelity, one mode of an encoded Bell state, we can use this CV channel to
transmit qubit entanglement. With that comes the ability to do entanglement concentration or distillation,
which are well-understood in the qubit case.
To justify why Bell state qubits can be teleported in this fashion, we can make the following argument.
It is easy to devise a protocol to transmit half of a qubit Bell pair using a second, shared Bell pair as a
resource. In the limit of infinite squeezing r → ∞, continuous variable teleportation has the same efficacy
as discrete variable teleportation — it is effectively a maximally-entangled state, since the uncertainty of
the quadrature observable is 0 (the same is true of continuous-variable superdense coding). Therefore the
only impediment to qubit teleportation is the error resulting from the finite squeezing of the TMSV states,
and possibly from loss in the channel. It is shown in [61] that these errors form an additive thermal loss
channel, and in [39] that the additive thermal loss channel on a GKP state is correctable. Therefore, we
can transmit half of an entangled Bell pair in this way, assuming a sufficiently low effective noise rate as
specified in the aforementioned works.
4.3.1.2 Superdense Coding
There are other common tasks which make use of entanglement for purposes of communication, such
as superdense coding. It should be noted that continuous variable superdense coding via sending TMSV
states through the monitored channel is not a task which can be performed steganographically, even in
principle (at least with a perfect fidelity). This is because superdense coding requires Alice to send two
correlated instances of information to Bob, and these correlations break the assumption of independence
of different uses of the channel which underlies the secrecy guarantees we have previously made. As such
53
(a) (b)
(c)
Figure 4.4: Average result of teleportation of the odd α = −1.5i cat state (top row) compared to the
original cat state (bottom row), where the TMSV states are being wiretapped (a) by an eavesdropper with
transmissivity η = .9. Average fidelity in this case is about .58 and negativity can clearly be observed in
the state. The same follows for (b) η = .75, with a fidelity of .47, and at (c) η = .5, with a fidelity of .34,
we can no longer observe negativity.
54
|+GKP i •
i ⌦ j
|0GKP i X
|ri P
|+ri D(p
p2) D(x
p2)
|0Evei | Evei
Alice
Bob
Eve
T=.1
Expectations of Paulis
Pauli Noiseless Rotated Wiretap+Rotated (.1) Wiretap+Rotated (.01)
XX 0.9928 0.6320 0.3238 0.6189
XZ 0.0239 0.6624 0.3396 0.6692
ZX -0.0147 -0.6002 -0.3100 -0.5744
ZZ 0.9893 0.6570 0.3458 0.6557
S 1.991 2.551 1.319 2.518
Figure 4.5: Using the StrawberryFields package, we were able to simulate the results of two-qubit quantum
state tomography on the teleported GKP state using a TMSV state with a high squeezing parameter r = 3.2.
The procedure (with a wiretap of transmissivity .1) is displayed in the above figure; the CNOT in the
diagram is a logical CNOT, the p displacement is in the imaginary (p) direction, and the measurements at the
end are for measuring the Bell inequality violations. The reconstructed matrix was mapped to the nearest
density operator in Frobenius norm by taking its positive-semidefinite part, which had a fidelity of .584
with the original two-qubit Bell state and displayed an entanglement of formation of .838. It was verified
to be entangled by the Peres-Horodecki criterion [30]. It was also possible to measure Bell inequality
violations by applying a 3π/4 Pauli Y rotation on the first qubit before the Pauli measurement, either with
or without the wiretap, as seen in the table above. With a loss of 0.1, we are not able to observe a Bell
inequality violation, but we are able to observe a violation when the loss is instead 0.01. This demonstrates
that under ideal conditions, qubit entanglement can be shared steganographically.
55
it is in principle possible for Eve to determine that the channel is not thermal by doing a joint measurement
on two correlated modes.
However, if in practice Alice and Bob can establish that they share an entangled TMSV state between
them (i.e. Eve is not still holding one of the modes; this likely requires two-way communication, which
has not been necessary until now), then a continuous variable superdense coding protocol such as [13] can
be performed using two sets of TMSV states. Such a protocol has an asymptotic (in terms of the squeezing
parameter) communication rate:
C = ln
1 + ¯n + ¯n
2
→ 4r, (4.16)
which is asymptotically twice the classical communication rate. The latter is given by
S(¯n) = (1 + ¯n) ln(1 + ¯n) − n¯ ln ¯n → 2r. (4.17)
The condition for outperforming the classical communication rate in this context is thus
(1 − p) ln
1 + ¯n + ¯n
2
> (1 + ¯n) ln(1 + ¯n) − n¯ ln ¯n, (4.18)
which is satisfiable from about n > ¯ 1.89 =⇒ r > 1.13 onwards, as we can see in Figure 4.6. Below
this level of squeezing, continuous variable superdense coding provides no advantage even if p = 0, and
above this squeezing level the maximum acceptable measurement probability pmax to observe a quantum
advantage is still lower than for cat state teleportation, likely because Wigner negativity still displays
prominently when averaged over, whereas the performance of the channel over each channel use contributes directly and equally to the average rate for superdense coding. Nevertheless, it is a useful measure
of quantum communication advantage in this context.
Note that covert superdense coding is only possible because under the Werner eavesdropper model,
Eve retains no correlations with the state after she releases it back into the channel, and therefore cannot
detect the correlation between the two TMSV modes used for the superdense coding protocol under the
above assumptions. Covert superdense coding will not be possible for the wiretap model, as we will show.
4.3.2 Wiretap Model of the Eavesdropper
The wiretap model of the eavesdropper is one where the input mode is coupled by a beamsplitter of transmissivity η to a mode in the vacuum state. This is equivalent to a pure loss channel of parameter η; you
could say that the model assumes all losses go to Eve. Unlike in the previous model, in this case we can
actually correct errors that occur due to the eavesdropper’s interference as not all information is destroyed.
In fact, GKP and cat codes are both known to be able to correct (at least approximately) errors resulting
from the pure loss channel. In this case it is the TMSV state that is experiencing loss, not the encoded
state itself; nevertheless, the effective channel acting on the GKP state is still Gaussian and therefore correctable. However, Alice and Bob must be careful what channel operations they perform on the states,
as in principle Eve could be storing the tapped portions of the states to use in a joint measurement later.
Without knowing the true loss in the channel, Alice and Bob are unsure whether Eve is tapping the channel and how much, which is similar to the underlying uncertainty of the true channel state that makes
steganography possible (only in this case Eve is the one who is hidden).
4.3.2.1 State Teleportation
If we reexamine the cat state teleportation protocol, we see in Figure 4.4 that at η = .5 there is no longer
negativity to be observed. This is intuitive: you can imagine that Bob no longer has a communication
advantage against Eve, and therefore there cannot be a quantum advantage either.
2 4 6 8 10
n
-0.1
0.1
0.2
0.3
pmax
Figure 4.6: The maximum measurement probability (pmax) at which a quantum advantage for superdense
coding is still possible, as a function of n¯ = sinh2
(r) of the mimicked thermal state under the Werner
channel. The value of pmax cannot actually be negative, but that region of the plot indicates that no quantum
communication advantage is possible below r = 1.89.
57
To formalize this argument, we can examine the notion of degradable and anti-degradable channels
[18, 17]. A degradable channel between Alice, Bob, and Eve NAB is one where there exists a completely
positive trace-preserving (CPTP) map Φ that when applied to the channel NAB gives the complementary
channel NAE = Φ(NAB). In this case, the complementary channel NAE is called anti-degradable. The
wiretap channel with η > .5, the results of which we see in Figure 4.4, is a degradable channel [58]. This
can be easily seen by passing the result of the degradable channel with η > .5 through another beamsplitter of transmissivity η
′
so that the (η)(η
′
) = 1−η. If the wiretap channel with NAB(η) is degradable,
the wiretap channel with NAB(η
′
) is anti-degradable for η
′ < .5. Therefore, its quantum capacity is 0
(otherwise we could violate the no-cloning theorem by having both the channel and the complementary
channel teleport a given quantum state). Since this is the case, it is impossible to observe any signature of
quantum advantage in the teleported state, including negativity.
By referencing the Pirandola-Laurenza-Ottaviani-Banchi(PLOB) bound [43], we can expect that with a
transmissivity of .9 and therefore an achievable rate of − log2
(.1) = 3.32 it should be possible to transmit
qubit entanglement via teleportation. This can be done using GKP states, for example. In Fig. 4.5 we
describe the results of simulating the teleportation of GKP states using a TMSV state as the resource. By
reconstructing the density matrix as described there, we are able to verify whether the state is entangled
by using the Peres-Horodecki criterion. We further verify the presence of entanglement by measuring
Bell inequality violations on a rotated version of the teleported GKP bell state; the rotation is a Pauli Y
rotation by 3π/4, which maximizes the violation of the Bell inequality with the standard expectations
of XX, XZ, ZX, and ZZ operators. Indeed, we are able to observe a violation with S = 2.55, which
is roughly in line with the concurrence of the reconstructed state which was calculated to be .89. If the
wiretap is in place, the state decoheres significantly and a Bell inequality violation is not observable. It
may be possible to transmit qubit entanglement through the wiretap with η = .1 using a distillation or
concentration procedure, but the above demonstration of qubit entanglement sharing demonstrates that
for a sufficiently low level of wiretapping, steganographic qubit entanglement sharing is possible.
4.3.2.2 Superdense Coding
Figure 4.7 shows that steganographic superdense coding is impossible under this eavesdropper model,
since you must always send correlated information through the channel which Eve can store and detect
using a joint measurement. This is in contrast to the Werner channel; while in theory Eve could hold a
state in that channel as well, Alice and Bob would be able to detect that the state they have is uncorrelated, whereas holding sufficient information to detect the sending of correlated information in the wiretap
scheme does not produce the same signature under wiretap assumptions.
It is possible for Alice and Bob to circumvent this issue, however, if they can communicate classically
between them (both ways). A sketch of the procedure for doing so would be as follows: first, Alice sends
one mode of the TMSV state through the channel. Eve siphons off part of this state using her beam splitter,
while Bob receives the remainder. Then, Alice does not send the other mode of the TMSV state through the
channel, but instead repeats this procedure with another TMSV state, however many times will be required
for eventual distillation. Eve now has several uncorrelated fragments of TMSV states. Alice and Bob then
communicate covertly, perhaps using classical steganography, so that they can distill the states into a pure
TMSV state, using a procedure such as what is described in [46]. In so doing, they eliminate the correlations
between the original mode that Eve siphoned, and the remaining modes Alice has available to send. Alice
and Bob can now use the other mode of each TMSV state for superdense coding normally. In this series of
events, the degree of wiretapping dictates the success probability for the distillation procedure.
58
Alice
Bob
Eve
|௧⟩
T=.1
(−) ()
|்ெௌ⟩
Alice
Bob
Eve
T=.1
()
|்ெௌ⟩
T=.1
Figure 4.7: The circuits for continuous variable teleportation (top) and superdense coding (bottom) under
the wiretap model. In the former case, Eve can only interfere with Alice and Bob’s operation of the circuit,
but in the latter case, since two correlated bits of information pass through the channel, Eve can in principle
detect quantum correlations via a Bell-type or other joint measurement.
59
4.4 Fuchs-Van de Graaf Lower Bound for a Mixture of Two States
Consider a density operator ρ0, and a second density operator ρ1 = pρth + (1 − p)ρc for two valid density
operators ρth and ρc. A direct application of the Fuchs-Van de Graaf Bound [23] gives
1 −
p
F(ρ1, ρ0) ≤
1
2
||ρ1 − ρ0||
F(ρ1, ρ0) ≥
1 −
1
2
||ρ1 − ρ0||2 (4.19)
to which we can apply the triangle inequality as follows:
F(ρ1, ρ0) ≥
1 −
1
2
||p(ρth − ρ0) + (1 − p)(ρc − ρ0)||2
F(ρ1, ρ0) ≥
1 −
p
2
||ρth − ρ0|| − 1 − p
2
||ρc − ρ0||2
F(ρ1, ρ0) ≥
p
1 −
1
2
||ρth − ρ0||
+ (1 − p)
1 −
1
2
||ρc − ρ0|| !2
,
(4.20)
where the above norm is the trace norm. Therefore the lower bounds on the individual states of the mixture
can be used to define a lower bound on the mixture, which greatly increases computational efficiency. Note
that a similar derivation is not possible for the upper bound, but that the upper bound does hold whenever
ρ1 is pure (for example, if ρc is a pure state it holds for p = 0), and therefore since the tightness of the
upper bound decreases as the purity of the states decrease (by contrast with the lower bound), it may still
hold in practice or be useful for illustrative purposes.
4.5 Conclusion
In this chapter, we have shown that steganographic entanglement sharing using standard TMSV states is
possible under two eavesdropper models. We have also verified that even without entanglement concentration, this capability is sufficient for tasks such as teleportation and qubit teleportation at a level that
still demonstrates a quantum advantage despite the presence of an eavesdropper. There is a limitation
to these protocols that would be interesting for future study: TMSV state generation is possible using a
periodically poled crystal or single mode squeezing, but this limits the wavelength of the states to the
relevant wavelengths for which these processes are possible. Put another way: it is only possible to mimic
thermal states with certain convenient values of n¯. This is unlike the coherent state steganography studied
previously in this thesis and in [9], where in principle it was possible to emulate a thermal state of any n¯
using modulation as was shown in [56]. Thus, to enhance the secrecy it may be interesting to consider
methods of up- and down- conversion, to more readily match thermal states emitted across a variety of
possible wavelengths [38]. The discussion of the effects of such schemes on secrecy or communication
capacity are left for a future work.
60
Chapter 5
Conclusions
Noise is everywhere. It is very rare to find an experimental component which fully utilizes, without waste,
its entire capability, be the artifact an operating EDFA, an outside frequency in a transmission line, or
background noise in communication. Any of these can be a subject for steganography, and their ubiquity provides an avenue for the application of this work’s methods. If these sources of noise are not
policed, for example for economic reasons, it may be possible to use them to acquire free bandwidth for
communication, and since much of the world’s communication infrastructure is fiber-optic-based, optical
steganography is uniquely positioned to do this.
In this thesis we have examined a variety of methods for covert transmission of information by impersonating a thermal state. When examining the transmission of classical information, it sufficed to consider
the Wigner function of the thermal state, divide it in half along some degree of freedom (be it radial or azimuthal), and use this division to define a bit of classical information. In this way, the transmission of one
temporal and spatial mode of thermal state information can be substituted for a bit of information. When
transmitting quantum information, by contrast, the thermal state needed to be fully utilized to transmit
the corresponding amount of quantum information, equivalent to S =
(¯n+1) log(¯n+1)−n¯ log ¯n
log 2 ebits. This is
not to say that in the quantum case it is impossible to transmit a lower amount of entanglement, but that
it is less natural, at least when one is not operating in the Fock basis classically. We have also examined
some experimental issues that affect the practical demonstration of the classical steganography protocols,
and have results showing it is still possible. There may be a greater variety of noise channels for which
such coherent steganography schemes are possible, but this remains to be demonstrated experimentally
in a future work.
There is another fundamental difference between the classical and quantum cases. In the classical case,
we communicate secretly through the channel, and in this way one can say that we are accessing a hidden
channel. In the quantum case, however, we use this hidden channel to construct an entirely new channel,
an ebit channel, which can be accessed at any time after this transmission so long as the entanglement
does not degrade. One can do something similar by transmitting part of a larger message in the classical
case, but in the quantum case this more powerful interpretation is again more natural and provides, all
else being equal, a higher communication rate. Furthermore, as we discussed in the quantum case, there is
a powerful connection between the ability to precisely prepare the entangled resource state and the ability
to mimic the channel the eavesdropper expects.
Part of this is due to the required operations. When we use homodyne detection to discriminate between two coherent states, we are using an inherently suboptimal measurement because it is what we are
able to do practically. When we use homodyne detection for teleportation, on the other hand, we are projecting onto a joint maximally entangled basis with respect to the TMSV state, and the operation we are
performing is able to extract more of the information contained within the quantum states. It is striking
that this setup, which was chosen in part for its ease of assembly and practicality, may be more efficient at
working with notoriously finicky quantum states than classical ones. If we were working in the Fock basis
61
and using photon counting measurements, designing a more optimal scheme is relatively straightforward,
but it should be noted that the states in question are still undoubtedly “quantum” states, even though we
have so far considered only classical steganography using Fock states. The same kind of setup could be
used to consider a qubit steganography scheme using qubits encoded in the number basis, for example.
A future demonstration of quantum steganography, however, will have a greater difficulty demonstrating its usefulness. Classical steganography can be used to send messages or even an encoded image. While
it is possible to do superdense coding in the quantum case, such a demonstration as we have considered
requires the consistent preparation of GKP qubits, which is still a nascent technology, and does not maintain secrecy under wiretapping. One can use other types of optical qubits, as cat states or even Fock states
can provide the basis for qubits, but with perhaps a lower accuracy, and these types of protocols have not
been considered in this thesis.
The better candidate is quantum teleportation, as this can already be done with readily-producible
TMSV states, but a demonstration of utility in this context may not be as meaningful to those not already
invested in quantum computation. It is oftentimes more meaningful to communicate a bit of arbitrary classical information than a cat state, even if the accuracy of the latter operation requires a theoretically larger
amount of information to be used. The latter does, however, provide a use-case for covert quantum optical
networks: if one wishes to covertly move qubits from place to place, steganography using CV entangled
states, which can mimic any single-mode state subject only to entropy restrictions, can be used to build
up the entanglement required to teleport the qubits. This may require an entanglement concentration or
entanglement purification protocol to achieve the required level of entanglement, however, depending on
the state which is to be mimicked, and the problem of managing resources for such a protocol under entanglement constraints due to entropy is an interesting question for a future work. This communication may
also require the tailoring of the two-mode entangled state to a single-mode cover state in a way that is not
always natural to do experimentally. Nevertheless, quantum steganography remains a promising candidate for covert transmission of qubits, and may find practical application in the future. Even if the future of
consumer communication networks is classical, it does not follow that the future of covert communication
also should be.
62
Bibliography
[1] July 2024. url: https://www.britannica.com/topic/Vigenere-cipher.
[2] url: https://www.tutorialspoint.com/cryptography/origin_of_cryptography.htm.
[3] url: https://mathworld.wolfram.com/ChristmasStockingTheorem.html.
[4] url: https://www.nongnu.org/lzip/manual/lzip_manual.html#File-format.
[5] Emmanuel Abbe and Colin Sandon. “A proof that Reed-Muller codes achieve Shannon capacity on
symmetric channels”. In: (2023), pp. 177–193. doi: 10.1109/FOCS57990.2023.00020.
[6] Sazeen T. Abdulrazzaq, Mohammed M. Siddeq, and Marcos A. Rodrigues. “A Novel Steganography
Approach for Audio Files”. In: SN Computer Science 1.2 (Mar. 2020), p. 97. issn: 2661-8907. doi:
10.1007/s42979-020-0080-2.
[7] Ali Arsal. “A STUDY ON WIRELESS CHANNEL MODELS: SIMULATION OF FADING,
SHADOWING AND FURTHER APPLICATIONS”. PhD thesis. Aug. 2008. doi:
10.13140/RG.2.2.13520.66562.
[8] Air Power Australia. url: https://www.ausairpower.net/OSR-0597.html.
[9] Bruno Avritzer and Todd A. Brun. “Quantum steganography via coherent- and Fock-state
encoding in an optical medium”. In: Phys. Rev. A 109 (3 Mar. 2024), p. 032401. doi:
10.1103/PhysRevA.109.032401.
[10] Boulat A. Bash, Dennis Goeckel, and Don Towsley. Covert Communication Gains from Adversary’s
Ignorance of Transmission Time. 2016. arXiv: 1403.1013 [cs.IT]. url:
https://arxiv.org/abs/1403.1013.
[11] Boulat A. Bash, Dennis Goeckel, and Don Towsley. “Square root law for communication with low
probability of detection on AWGN channels”. English (US). In: 2012 IEEE International Symposium
on Information Theory Proceedings, ISIT 2012. IEEE International Symposium on Information
Theory - Proceedings. 2012 IEEE International Symposium on Information Theory, ISIT 2012 ;
Conference date: 01-07-2012 Through 06-07-2012. 2012, pp. 448–452. isbn: 9781467325790. doi:
10.1109/ISIT.2012.6284228.
63
[12] Martin Boesgaard, Mette Vesterager, Thomas Pedersen, Jesper Christiansen, and Ove Scavenius.
“Rabbit: A New High-Performance Stream Cipher”. In: Fast Software Encryption. Ed. by
Thomas Johansson. Berlin, Heidelberg: Springer Berlin Heidelberg, 2003, pp. 307–329. isbn:
978-3-540-39887-5.
[13] Samuel L. Braunstein and H. J. Kimble. “Dense coding for continuous variables”. In: Phys. Rev. A 61
(4 Mar. 2000), p. 042302. doi: 10.1103/PhysRevA.61.042302.
[14] Samuel L. Braunstein and H. J. Kimble. “Teleportation of Continuous Quantum Variables”. In: Phys.
Rev. Lett. 80 (4 Jan. 1998), pp. 869–872. doi: 10.1103/PhysRevLett.80.869.
[15] Thomas R Bromley, Juan Miguel Arrazola, Soran Jahangiri, Josh Izaac, Nicolás Quesada,
Alain Delgado Gran, Maria Schuld, Jeremy Swinarton, Zeid Zabaneh, and Nathan Killoran.
“Applications of near-term photonic quantum computers: software and algorithms”. In: Quantum
Science and Technology 5.3 (May 2020), p. 034010. doi: 10.1088/2058-9565/ab8504.
[16] Aiden A. Bruen and Mario A. Forcinito. Cryptography, information theory, and error-correction a
handbook for the 21st century. John Wiley & Sons, 2011.
[17] Toby S Cubitt, Mary Beth Ruskai, and Graeme Smith. “The structure of degradable quantum
channels”. In: J. Math. Phys. 49.10 (Oct. 2008), p. 102104.
[18] I Devetak and P W Shor. “The capacity of a quantum channel for simultaneous transmission of
classical and quantum information”. In: Commun. Math. Phys. 256.2 (June 2005), pp. 287–303.
[19] Miloslav Dušek, Norbert Lütkenhaus, and Martin Hendrych. “Quantum cryptography”. In: Progress
in Optics. Elsevier, 2006, pp. 381–454. isbn: 9780444527325. doi: 10.1016/s0079-6638(06)49005-3.
[20] Avik Dutt, Kevin Luke, Sasikanth Manipatruni, Alexander L. Gaeta, Paulo Nussenzveig, and
Michal Lipson. “On-Chip Optical Squeezing”. In: Phys. Rev. Applied 3 (2015), p. 044005.
[21] A. Einstein. “Über einen die Erzeugung und Verwandlung des Lichtes betreffenden heuristischen
Gesichtspunkt”. In: Annalen der Physik 322.6 (1905), pp. 132–148. doi:
https://doi.org/10.1002/andp.19053220607. eprint:
https://onlinelibrary.wiley.com/doi/pdf/10.1002/andp.19053220607.
[22] Chip Elliott, David Pearson, and Gregory Troxel. Quantum Cryptography in Practice. 2003. arXiv:
quant-ph/0307049 [quant-ph]. url: https://arxiv.org/abs/quant-ph/0307049.
[23] Christopher A. Fuchs and Jeroen van de Graaf. “Cryptographic Distinguishability Measures for
Quantum Mechanical States”. In: (1997). eprint: arXiv:quant-ph/9712042.
[24] Julio Gea-Banacloche. “Hiding messages in quantum data”. In: Journal of Mathematical Physics 43.9
(Sept. 2002), pp. 4531–4536. issn: 0022-2488. doi: 10.1063/1.1495073. eprint:
https://pubs.aip.org/aip/jmp/article-pdf/43/9/4531/19182999/4531\_1\_online.pdf.
[25] Leonid Gurvits. Classical deterministic complexity of Edmonds’ problem and Quantum Entanglement.
2003. arXiv: quant-ph/0303055 [quant-ph]. url: https://arxiv.org/abs/quant-ph/0303055.
64
[26] Jacob Hastrup and Ulrik L. Andersen. “Protocol for Generating Optical Gottesman-Kitaev-Preskill
States with Cavity QED”. In: Phys. Rev. Lett. 128 (17 Apr. 2022), p. 170503. doi:
10.1103/PhysRevLett.128.170503.
[27] Jacob Hastrup and Ulrik Lund Andersen. “All-optical cat-code quantum error correction”. In: Phys.
Rev. Res. 4 (4 Oct. 2022), p. 043065. doi: 10.1103/PhysRevResearch.4.043065.
[28] Carl W. Helstrom. “Quantum detection and estimation theory”. In: Journal of Statistical Physics 1.2
(June 1969), pp. 231–252. issn: 1572-9613. doi: 10.1007/BF01007479.
[29] Sam A. Hill and William K. Wootters. “Entanglement of a Pair of Quantum Bits”. In: Phys. Rev. Lett.
78 (26 June 1997), pp. 5022–5025. doi: 10.1103/PhysRevLett.78.5022.
[30] Michał Horodecki, Paweł Horodecki, and Ryszard Horodecki. “Separability of mixed states:
necessary and sufficient conditions”. In: Physics Letters A 223.1 (1996), pp. 1–8. issn: 0375-9601.
doi: https://doi.org/10.1016/S0375-9601(96)00706-2.
[31] Mark Howard, Joel Wallman, Victor Veitch, and Joseph Emerson. “Contextuality supplies the
‘magic’ for quantum computation”. In: Nature 510.7505 (June 2014), pp. 351–355. issn: 1476-4687.
doi: 10.1038/nature13460.
[32] R.L. Hudson. “When is the wigner quasi-probability density non-negative?” In: Reports on
Mathematical Physics 6.2 (1974), pp. 249–252. issn: 0034-4877. doi:
https://doi.org/10.1016/0034-4877(74)90007-X.
[33] Ladislav Mista Jr., Radim Filip, and Jaromir Fiurasek. “Continuous-variable Werner state:
separability, nonlocality, squeezing and teleportation”. In: (2001). doi: 10.1103/PhysRevA.65.062315.
eprint: arXiv:quant-ph/0112062.
[34] Nathan Killoran, Josh Izaac, Nicolás Quesada, Ville Bergholm, Matthew Amy, and
Christian Weedbrook. “Strawberry Fields: A Software Platform for Photonic Quantum
Computing”. In: Quantum 3 (Mar. 2019), p. 129. issn: 2521-327X. doi: 10.22331/q-2019-03-11-129.
[35] A I Lvovsky. “Iterative maximum-likelihood reconstruction in quantum homodyne tomography”.
In: Journal of Optics B: Quantum and Semiclassical Optics 6.6 (May 2004), S556. doi:
10.1088/1464-4266/6/6/014.
[36] D. J. Santos M. Curty. paper presented at the 2nd Bielefeld Workshop on Quantum Information and
Complexity, Bielefeld, Germany.
[37] D. L. Maunz P.and Moehring, S. Olmschenk, K. C. Younge, D. N. Matsukevich, and C. Monroe.
“Quantum interference of photon pairs from two remote trapped atomic ions”. In: Nature Physics
3.8 (Aug. 2007), pp. 538–541.
[38] C. J. McKinstrie, J. D. Harvey, S. Radic, and M. G. Raymer. “Translation of quantum states by
four-wave mixing in fibers”. In: Opt. Express 13.22 (Oct. 2005), pp. 9131–9142. doi:
10.1364/OPEX.13.009131.
65
[39] Kyungjoo Noh, S. M. Girvin, and Liang Jiang. “Encoding an Oscillator into Many Oscillators”. In:
Phys. Rev. Lett. 125 (8 Aug. 2020), p. 080503. doi: 10.1103/PhysRevLett.125.080503.
[40] R. Paschotta. Erbium-doped Fiber Amplifiers. RP Photonics Encyclopedia. doi:
10.61835/jlr"title="Thislinkwillreloadthecurrentpage.. (Visited on 07/30/2024).
[41] D.N. Payne. “Low-noise erbium-doped fibre amplifier operating at 1.54m”. English. In: Electronics
Letters 23 (19 Sept. 1987), 1026–1028(2). issn: 0013-5194. url:
https://digital-library.theiet.org/content/journals/10.1049/el_19870719.
[42] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring,
C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. Shamsul Shaari, M. Tomamichel, V. C. Usenko,
G. Vallone, P. Villoresi, and P. Wallden. “Advances in quantum cryptography”. In: Adv. Opt. Photon.
12.4 (Dec. 2020), pp. 1012–1236. doi: 10.1364/AOP.361502.
[43] Stefano Pirandola, Riccardo Laurenza, Carlo Ottaviani, and Leonardo Banchi. “Fundamental limits
of repeaterless quantum communications”. In: Nat. Commun. 8.1 (Apr. 2017), p. 15043.
[44] Anjam Riaz and Maaruf Ali. “Chaotic Communications, their applications and advantages over
traditional methods of communication”. In: 2008 6th International Symposium on Communication
Systems, Networks and Digital Signal Processing. 2008, pp. 21–24. doi: 10.1109/CSNDSP.2008.4610808.
[45] H. P. Robertson. “The Uncertainty Principle”. In: Phys. Rev. 34 (1 July 1929), pp. 163–164. doi:
10.1103/PhysRev.34.163.
[46] Kaushik P. Seshadreesan, Hari Krovi, and Saikat Guha. “Continuous-variable entanglement
distillation over a pure loss channel with multiple quantum scissors”. In: Physical Review A 100.2
(Aug. 2019). issn: 2469-9934. doi: 10.1103/physreva.100.022315.
[47] Jeffrey H. Shapiro. In: MIT Course 6.453 Quantum Optical Communication. MIT OpenCourseWare.
Cambridge MA, 2016.
[48] Bilal A. Shaw and Todd A. Brun. Hiding Quantum Information in the Perfect Code. 2011. arXiv:
1007.0793 [quant-ph]. url: https://arxiv.org/abs/1007.0793.
[49] Bilal A. Shaw and Todd A. Brun. “Quantum steganography with noisy quantum channels”. In:
Phys. Rev. A 83 (2 Feb. 2011), p. 022310. doi: 10.1103/PhysRevA.83.022310.
[50] Haowei Shi, Zheshen Zhang, and Quntao Zhuang. “Practical Route to Entanglement-Assisted
Communication Over Noisy Bosonic Channels”. In: Phys. Rev. Appl. 13 (3 Mar. 2020), p. 034029.
doi: 10.1103/PhysRevApplied.13.034029.
[51] Chris Sutherland and Todd A. Brun. “Quantum steganography over noiseless channels:
Achievability and bounds”. In: Phys. Rev. A 101 (5 May 2020), p. 052319. doi:
10.1103/PhysRevA.101.052319.
[52] Chris Sutherland and Todd A. Brun. “Quantum steganography over noisy channels: Achievability
and bounds”. In: Phys. Rev. A 100 (5 Nov. 2019), p. 052312. doi: 10.1103/PhysRevA.100.052312.
66
[53] Mehrdad Tahmasbi and Matthieu R. Bloch. “Steganography protocols for quantum channels”. In:
Journal of Mathematical Physics 61.8 (Aug. 2020), p. 082201. issn: 0022-2488. doi:
10.1063/5.0004731. eprint: https://pubs.aip.org/aip/jmp/articlepdf/doi/10.1063/5.0004731/16098028/082201\_1\_online.pdf.
[54] Kan Takase, Akito Kawasaki, Byung Kyu Jeong, Mamoru Endo, Takahiro Kashiwazaki,
Takushi Kazama, Koji Enbutsu, Kei Watanabe, Takeshi Umeki, Shigehito Miki, Hirotaka Terai,
Masahiro Yabuno, Fumihiro China, Warit Asavanant, Jun-ichi Yoshikawa, and Akira Furusawa.
“Generation of Schrödinger cat states with Wigner negativity using a continuous-wave low-loss
waveguide optical parametric amplifier”. In: Opt. Express 30.9 (Apr. 2022), pp. 14161–14171. doi:
10.1364/OE.454123.
[55] A. Vourdas. “Optical signals with thermal noise”. In: Phys. Rev. A 39 (1 Jan. 1989), pp. 206–213. doi:
10.1103/PhysRevA.39.206.
[56] Haley Weinstein, Bruno Avritzer, Todd A. Brun, and Jonathan L. Habif. High Fidelity Artificial
Quantum Thermal State Generation using Encoded Coherent States. 2024. arXiv: 2405.03881
[quant-ph].
[57] Reinhard F. Werner. “Quantum states with Einstein-Podolsky-Rosen correlations admitting a
hidden-variable model”. In: Phys. Rev. A 40 (8 Oct. 1989), pp. 4277–4281. doi:
10.1103/PhysRevA.40.4277.
[58] Mark M. Wilde. Quantum Information Theory. Cambridge University Press, 2013.
[59] Reinhard Wobst and Angelika Shafir. Cryptology unlocked. John Wiley & Sons, 2007.
[60] Ben Wu, Zhenxing Wang, Yue Tian, Mable P. Fok, Bhavin J. Shastri, Daniel R. Kanoff, and
Paul R. Prucnal. “Optical steganography based on amplified spontaneous emission noise”. In: Opt.
Express 21.2 (Jan. 2013), pp. 2065–2071. doi: 10.1364/OE.21.002065.
[61] Bo-Han Wu, Zheshen Zhang, and Quntao Zhuang. “Continuous-variable quantum repeaters based
on bosonic error-correction and teleportation: architecture and applications”. In: Quantum Science
and Technology 7.2 (Mar. 2022), p. 025018. doi: 10.1088/2058-9565/ac4f6b.
67
Abstract (if available)
Abstract
Quantum Steganography is an alternative to quantum cryptography in which the channel is hidden instead of the message. As such, it is viable in contexts where it is desirable to avoid the appearance that information is being transmitted in a channel at all. In this thesis, we will develop the machinery to understand quantum steganography in optical systems, propose methods for classical and quantum steganographic communication in optical systems, and discuss experimental implementations of these protocols, along with practical considerations for their implementation. We will discuss how to transmit classical messages and continuous variable entanglement, and even discrete variable entanglement in the form of GKP qubits, while making the transmission appear identical to thermal noise. We will discuss the experimental implementation of this steganography protocol by mimicking noise produced by an Erbium-Doped Fiber Amplifier, a common optical component. In collaboration with Dr. Jonathan Habif and Haley Weinstein of the University of Southern California, we have demonstrated the covert transmission of a binary encoded image file in this fashion, and in this thesis we will discuss the theoretical aspects of that demonstration.
Linked assets
University of Southern California Dissertations and Theses
Conceptually similar
PDF
Characterization and suppression of noise in superconducting quantum systems
PDF
Trainability, dynamics, and applications of quantum neural networks
PDF
Demonstration of error suppression and algorithmic quantum speedup on noisy-intermediate scale quantum computers
PDF
Quantum coding with entanglement
PDF
Lower overhead fault-tolerant building blocks for noisy quantum computers
PDF
Destructive decomposition of quantum measurements and continuous error detection and suppression using two-body local interactions
PDF
Quantum information and the orbital angular momentum of light in a turbulent atmosphere
PDF
Quantum information flow in steganography and the post Markovian master equation
PDF
Topics in quantum information and the theory of open quantum systems
PDF
Quantum steganography and quantum error-correction
PDF
Quantum error correction and fault-tolerant quantum computation
PDF
Theory and simulation of Hamiltonian open quantum systems
PDF
Open-system modeling of quantum annealing: theory and applications
PDF
Error correction and quantumness testing of quantum annealing devices
PDF
Entanglement in strongly fluctuating quantum many-body states
PDF
Entanglement in quantum critical and topological phases
PDF
Topics in quantum cryptography, quantum error correction, and channel simulation
PDF
Spatial modes for optical communications and spatiotemporal beams
PDF
Towards efficient fault-tolerant quantum computation
PDF
Quantum information techniques in condensed matter: quantum equilibration, entanglement typicality, detection of topological order
Asset Metadata
Creator
Avritzer, Bruno
(author)
Core Title
Quantum and classical steganography in optical systems
School
College of Letters, Arts and Sciences
Degree
Doctor of Philosophy
Degree Program
Physics
Degree Conferral Date
2024-08
Publication Date
10/01/2024
Defense Date
09/09/2024
Publisher
Los Angeles, California
(original),
University of Southern California
(original),
University of Southern California. Libraries
(digital)
Tag
continuous variable quantum information,covert communications,entanglement,gkp qubits,OAI-PMH Harvest,quantum communications,quantum information,quantum optics,quantum steganography,steganography
Format
theses
(aat)
Language
English
Contributor
Electronically uploaded by the author
(provenance)
Advisor
Brun, Todd Andrew (
committee chair
), Haas, Stephan (
committee member
), Levenson-Falk, Eli (
committee member
), Lidar, Daniel Amihud (
committee member
), Reichardt, Benjamin (
committee member
)
Creator Email
avritzer@usc.edu,bavritzer@yahoo.com
Permanent Link (DOI)
https://doi.org/10.25549/usctheses-oUC11399BEDG
Unique identifier
UC11399BEDG
Identifier
etd-AvritzerBr-13565.pdf (filename)
Legacy Identifier
etd-AvritzerBr-13565
Document Type
Dissertation
Format
theses (aat)
Rights
Avritzer, Bruno
Internet Media Type
application/pdf
Type
texts
Source
20241002-usctheses-batch-1216
(batch),
University of Southern California
(contributing entity),
University of Southern California Dissertations and Theses
(collection)
Access Conditions
The author retains rights to his/her dissertation, thesis or other graduate work according to U.S. copyright law. Electronic access is being provided by the USC Libraries in agreement with the author, as the original true and official version of the work, but does not grant the reader permission to use the work if the desired use is covered by copyright. It is the author, as rights holder, who must provide use permission if such use is covered by copyright.
Repository Name
University of Southern California Digital Library
Repository Location
USC Digital Library, University of Southern California, University Park Campus MC 2810, 3434 South Grand Avenue, 2nd Floor, Los Angeles, California 90089-2810, USA
Repository Email
cisadmin@lib.usc.edu
Tags
continuous variable quantum information
covert communications
entanglement
gkp qubits
quantum communications
quantum information
quantum optics
quantum steganography
steganography