11institutetext:  University of Leeds 22institutetext: Mysten Labs
33institutetext: University College London (UCL)

# Performance of EdDSA and BLS Signatures in Committee-Based Consensus

Zhuolun Li 11 Alberto Sonnino 2233 Philipp Jovanovic 33

###### Abstract

We present the first performance comparison of EdDSA and BLS signatures in
committee-based consensus protocols through large-scale geo-distributed
benchmarks. Contrary to popular beliefs, we find that _small_ deployments
(less than 40 validators) can benefit from the small storage footprint of BLS
multi-signatures while larger deployments should favor EdDSA to improve
performance. As an independent contribution, we present a novel way for
committee-based consensus protocols to verify BLS multi-signed certificates by
manipulating the aggregated public key using pre-computed values.

###### Keywords:

Digital signature Consensus Blockchain

##  1 Introduction

Consensus protocols run at the core of blockchains to order clients’
transactions into a sequence agreed by all honest validators. The popularity
of blockchains raised the interest in developing high-performance consensus
systems, with early studies proposing committee-based protocols to improve
over Bitcoin’s [24] low throughput of 7 transactions per second. These
protocols have since been shown to increase blockchain throughput and reduce
latency [19, 1], and they are rapidly becoming the standard in recent proof-
of-stake architectures [10, 21, 22]. The blockchain literature provides a
large variety of efficient committee-based consensus protocols. They improve
on the state-of-the-art through various techniques, ranging from efficient
data-sharing layers [9, 27] and robust DAG-based protocols [25, 12] to multi-
mode protocols adapting to faults and network conditions [13, 23, 20, 15].

Unfortunately, these works pay little attention to their choice of signature
scheme. Our inspection of their codebases indicates that most use either EdDSA
[9, 25, 10, 21, 22] or BLS [12, 23, 17, 16] but do not justify their choice.
This is unfortunate as digital signatures require CPU-intensive operations and
are extensively used in committee-based consensus: block proposers
authenticate their block proposals by signing them, validators counter-sign
block proposals to indicate their support, and certificates containing a
quorum of signatures are used to commit and finalize transactions. On the one
hand, EdDSA signatures provide very fast signature generation and
verification; on the other hand, BLS multi-signing enables small certificates
and nearly constant-time certificate verification regardless of the committee
size. It is a popular belief that BLS is preferable to EdDSA for large
deployments where large EdDSA certificates are slow to propagate and verify.
There is however no empirical evidence supporting this belief.

We address this gap by providing the first performance comparison of EdDSA and
BLS signatures in committee-based consensus (to the best of our knowledge). We
demonstrate through large-scale geo-distributed benchmarks that the choice of
the signature scheme is a major factor determining the system’s performance.
We find that contrary to popular beliefs, deployments with a relatively
_small_ committee size (less than 40 validators) can benefit from the small
storage footprint of BLS multi-signatures while larger deployments should
favor EdDSA to improve performance. In a nutshell, the computational overhead
of BLS verification becomes prohibitive when validators verify a large number
of counter-signed block proposals; at the point where it offsets the benefits
of small and efficient certificates. We select HotStuff [28] as an example of
a committee-based consensus protocol for our experiments. As an independent
contribution, we present a novel way for committee-based consensus protocols
to verify BLS multi-signed certificates by pre-computing a fixed number of
group elements to manipulate the aggregated public key. This technique
outperforms a traditional BLS verification process (even in the presence of
Byzantine faults) requiring to re-compute the appropriate aggregated public
key upon each certificate verification.

### Contributions.

In summary, we make the following contributions:

  * •

We perform the first performance comparison of EdDSA and BLS signatures in
committee-based consensus (to the best of our knowledge) through large-scale
geo-distributed benchmarks.

  * •

We analyze the performance implications of each signature scheme and identify
that small deployments are most suited to take advantage of BLS multi-
signatures while larger deployments should favor EdDSA.

  * •

We present a novel and more efficient way for committee-based consensus
protocols to take advantage of BLS multi-signatures to verify certificates.

##  2 Background

We recall BLS multi-signatures and provide an overview of typical committee-
based consensus protocols.

### BLS multi-signatures.

The Boneh-Lynn-Shacham (BLS) signature scheme [3] is an efficient signature
scheme using pairing-friendly elliptic curves. BLS supports multi-signing and
public-key aggregation, making it very popular for various blockchain
projects. We start by recalling the standard BLS signature scheme. Let
$\mathbb{G}_{1}$, $\mathbb{G}_{2}$, and $\mathbb{G}_{T}$ be groups of prime
order $q$ such that there exists an efficiently computable and non-degenerate
bilinear map $e:\mathbb{G}_{1}\times\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}$.
We denote by $g_{1}$, $g_{2}$, and $g_{T}$ the canonical generators of
$\mathbb{G}_{1}$, $\mathbb{G}_{2}$, and $\mathbb{G}_{T}$, respectively, and
let $\mathsf{H}_{1}:\\{0,1\\}^{*}\to\mathbb{G}_{1}$. We denote the security
parameter by $\lambda$ and $\xleftarrow{\$}$ denotes sampling uniformly at
random. The BLS signature scheme consists of the following algorithms:

  * •

BLS.Setup$(1^{\lambda})$: Setup and output a bilinear group
$par=(q,\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},e,g_{1},g_{2})$.

  * •

BLS.KeyGen$(par)$: Given the parameters $par$, output a pair of public/secret
keys $(\mathsf{pk},\mathsf{sk})$ where
$\mathsf{sk}\xleftarrow{\$}\mathbb{Z}_{q}^{*}$ and
$\mathsf{pk}=g_{2}^{\mathsf{sk}}\in\mathbb{G}_{2}$.

  * •

BLS.Sign$(par,\mathsf{sk},m)$: Given a message $m\in\\{0,1\\}^{*}$, output a
signature $\sigma=\mathsf{H}_{1}(m)^{\mathsf{sk}}\in\mathbb{G}_{1}$.

  * •

BLS.Verify$(par,\mathsf{pk},\sigma,m)$: Given a public key
$\mathsf{pk}\in\mathbb{G}_{2}$, a signature $\sigma\in\mathbb{G}_{1}$ and a
message $m\in\\{0,1\\}^{*}$, output $1$ if
$e(\sigma,g_{2})=e(\mathsf{H}_{1}(m),\mathsf{pk})$ and $0$ otherwise.

BLS signatures can support multi-signing with public key aggregation. A multi-
signature scheme (MSP) allows $n$ signers to generate a short signature
$\sigma$, on the _same_ message $m$ (the size of the signature is independent
of the number of signers). To verify the multi-signature one needs all the
signer’s public keys aggregated into a single key $apk$, $m$, and $\sigma$.

  * •

MSP.Setup$(1^{\lambda})$: Output BLS.Setup$(1^{\lambda})$.

  * •

MSP.KeyGen$(par)$: Output BLS.KeyGen$(par)$.

  * •

MSP.Sign$(par,\mathsf{sk},m)$: Output BLS.Sign$(par,\mathsf{sk},m)$.

  * •

MSP.SigAggr$(\\{\sigma_{0},\dots,\sigma_{n}\\})$: Output
$\sigma=\prod_{i=1}^{n}\sigma_{i}$.

  * •

MSP.KeyAggr$(par,\\{\mathsf{pk}_{1},\dots,\mathsf{pk}_{n}\\})$: Output
$apk=\prod_{i=1}^{n}\mathsf{pk}_{i}$.

  * •

MSP.Verify$(par,apk,\sigma,m)$: Output BLS.Verify$(par,apk,\sigma,m)$.

An MSP scheme is usually vulnerable to rogue key attacks if the signers do not
prove their ownership of the corresponding secret keys [2]. This is not a
problem for committee-based blockchains because validator prove knowledge of
their secret key $\mathsf{sk}$ by signing a special transaction before being
eligible to join a future committee.

We note that threshold signatures are a generalization of multi-signatures
requiring only a threshold $t\leq n$ of signatures (rather than $t=n$) to
compute $\sigma$. Threshold signatures require complex distributed key
generation mechanisms to generate the key pair of every signer when there is
no natural trusted third party to run the setups protocol [14, 18].
Furthermore, they do not extend naturally to settings where validators have
different voting powers and are thus unsuitable for consensus protocols. As a
result, we do not consider them in this paper as no committee-based
blockchains use them within their consensus protocol (to the best of our
knowledge).

### Committee-based consensus.

Committee-based blockchains typically divide time into a sequence of epochs
(lasting roughly a day [22, 21, 26]). They elect a committee of $n=3f+1$
validators for each epoch (usually through proof-of-stake [22, 21]), where $f$
is the maximum number of faulty validators that the system can tolerate. The
elected committee then ‘extends’ the blockchain by sequencing clients’
transactions using a Byzantine fault tolerant (BFT) protocol.

Figure 1: High-level overview of one round of a typical committee-based
consensus protocol. The committee is formed of four validators
$(v_{0},v_{1},v_{2},v_{3})$. The leader $v_{0}$ proposes $B_{k}$ for round
$k$; validators reply with a vote $V_{k}$ over $B_{k}$; the leader collects a
quorum of votes into a certificate $C_{k}$ and disseminates it, and validators
verify $C_{k}$.

For the sake of this paper, we only present the aspects of committee-based
consensus protocols where signatures intervene the most (and omit other
aspects such as synchronizers [7], leader-election modules [6], and view-
changes [4, 13]). Typical committee-based consensus protocols operate in a
round-by-round manner, electing a leader in each round among the validators to
balance validator participation. Figure 1 provides a high-level overview of
one round of a typical committee-based consensus protocol running with four
validators, $v_{0}$, $v_{1}$, $v_{2}$, and $v_{3}$. The leader $v_{0}$ of
round $k$ disseminates a block $B_{k}$ extending the longest chain of blocks
it knows111Usually leaders collect batches of transactions to propose,
referred to as blocks, hence the protocol forms a chain of blocks (or a
‘blockchain’). (➊). Validators then vote for at most one leader’s proposal for
each round by counter-signing it unless the proposal is malformed or conflicts
with a longer chain that they know (➋); validators send their votes $V_{k}$
back to the leader. The leader aggregates a quorum of $2f+1$ votes into a
certificate $C_{k}$ and distributes it to the validators; validators accept
$C_{k}$ if it is correctly signed by a quorum (➌).

The protocol then repeats for several rounds (usually two or three) in order
to commit $B_{k}$. For instance, the original HotStuff protocol [28] commits
$B_{k}$ when there exist three consecutive certified blocks in the chain,
$C_{k}$, $C_{k+1}$, $C_{k+2}$. More recent variants of HotStuff, such as
Jolteon [13], only require two consecutive rounds; and state-of-the-art DAG-
based protocols [9, 25, 12] allow multiple validators to disseminate proposals
in parallel. The general protocol flow, however, remains similar. If the
leader fails or is unresponsive for a long periods of time, the validators run
a _view-change_ sub-protocol to elect a new leader [4]; changing leader is
expensive and severely degrades performance.

The key motivation for BLS multi-signatures in committee-based consensus is to
reduce the size of certificates (which grow linearly with the committee size)
and allow their nearly constant-time verification (by verifying a single
multi-signature rather than the $2f+1$ votes individually).

##  3 Cached BLS Multi-Signature Verification

We extend the BLS multi-signature scheme presented in Section 2 with a new
function MSP.KeyDisAggr that subtracts a set of public keys from the aggregate
public key $apk$.

  * •

MSP.KeyDisAggr$(par,apk,\\{-\mathsf{pk}_{1},\dots,-\mathsf{pk}_{n}\\})$: Given
the aggregate public key $apk$, the opposite of all public keys
$PK=\\{-\mathsf{pk}_{1},\dots,-\mathsf{pk}_{n}\\}$, output
$apk^{*}=apk\prod_{i=1}^{j}-\mathsf{pk}_{i}$.

This function requires a single elliptic curve addition per key to remove from
the aggregate. We now show how to incorporate it in the normal flow of
committee-based consensus protocols depicted in Figure 1 of Section 2.

### Protocol description.

Every validator in the committee is initialized with the public parameters
$par$ output by MSP.Setup$(1^{\lambda})$. Each validator locally runs
MSP.KeyGen$(par)$ to generate their public/secret keypair
$(\mathsf{pk},\mathsf{sk})$ and publishes $\mathsf{pk}$ (see Section 2). Each
validator stores the public key $\\{\mathsf{pk}_{1},\dots,\mathsf{pk}_{n}\\}$
of all other valiators. They also compute and store the aggregated public key
$apk=\textbf{{MSP.KeyAggr}}(par,\\{\mathsf{pk}_{1},\dots,\mathsf{pk}_{n}\\})$
as well as the opposite of all validator’s public keys
$\\{-\mathsf{pk}_{1},\dots,-\mathsf{pk}_{n}\\}$.

  * •

Step ➊: Propose. The leader of round $k$ collects a set of clients’
transactions $l$ and creates a block proposal $m=(k,l,\cdot)$, where the dot
‘$\cdot$’ denotes omitted protocol-specific fields. The leader then signs $m$
by calling $\sigma_{B}=\textbf{{MSP.Sign}}(par,\mathsf{sk},m)$ using its
secret key $\mathsf{sk}$ and disseminates $B_{k}(m,\sigma_{B})$ to the other
validators.

  * •

Step ➋: Vote. Validators first parse $B_{k}=(m,\sigma_{B})$ and then verify it
via $\textbf{{MSP.Verify}}(par,\mathsf{pk},\sigma_{B},m)$ where $\mathsf{pk}$
is the leader’s public key. If the check passes and all other protocol-
specific conditions are met, they counter-sign $B_{k}$ and send their vote
$V_{k}=\textbf{{MSP.Sign}}(par,\mathsf{sk},H(B_{k}))$ to the leader (where $H$
is a collision-resistant hash-function).

  * •

Step ➌: Certify. The leader calls
$\textbf{{MSP.Verify}}(par,\mathsf{pk},V_{k},H(B_{k}))$, where $\mathsf{pk}$
is the public key of the voter, to verify each incoming vote. As soon as it
receives $2f+1$ valid votes $\\{V_{k_{1}},\dots,V_{k_{n}}\\}$, it aggregates
them calling
$\sigma_{C}=\textbf{{MSP.SigAggr}}(\\{V_{k_{1}},\dots,V_{k_{n}}\\})$. It then
computes a bitmap $b$ indicating which validators _did not_ contribute to
$\sigma_{C}$. This is achieved by deterministically attributing an index to
each validator that corresponds to its position in the bitmap. This bitmap
allows to reduce the size of the certificate that would otherwise contain the
public key of each signer. The leader then disseminates the certificate
$C_{k}=(\sigma_{C},b)$ to the validators. Upon receiving $C_{k}$, validators
use the bitmap $b$ to identify the validators who did not contribute to
$\sigma_{C}$, retrieve their previously cached set of
$\\{-\mathsf{pk}_{1},\dots,-\mathsf{pk}_{j}\\}$, and compute
$apk^{*}=\textbf{{MSP.KeyDisAggr}}(par,apk,\\{-\mathsf{pk}_{1},\dots,-\mathsf{pk}_{n}\\})$.
They then verify the certificate calling
$\textbf{{MSP.Verify}}(par,apk^{*},\sigma_{C},H(B_{k}))$.

This approach has two main advantages. (i) The bitmap allows to reduce the
certificate size by 32B per signer compared to straightforward implementations
including the public key of each signer in the certificate (as it is the case
in many production systems [10, 21, 22]); certificates are part of the
forever-stored blockchain so any message compression becomes substantial over
time. (ii) Before verifying a certificate validators compute $apk^{*}$ with at
most $f$ elliptic curve additions, while a straightforward BLS multi-signature
verification would require $2f+1$ to recompute the aggregated verification key
every time. Furthermore, practical leaders’ implementations wait around
50-100ms after collecting the first $2f+1$ votes to give extra time to the
remaining validators to vote. As a result, typical certificates contain close
to $n=3f+1$ votes in the common case (happy path), and computing $apk^{*}$
requires only one or two elliptic curve additions.

##  4 Performance Comparison

We select HotStuff [28] as an example of a committee-based consensus protocol
for our experiments. We select this protocol because it is the quorum-based
consensus protocol most used in production blockchains; Celo [5], Cypherium
[8], Flow [11], Diem [10], and Aptos [21] all run a variant of HotStuff.
Furthermore, it shares many design traits with Tendermint [26] (its closest
ancestor). We specifically run our benchmarks on a 2-chain HotStuff variant
called Jolteon [13]; we chose this variant because Diem [10], Aptos [21], and
Flow [11] run it in production.

### Implementation.

We implement BLS multi-signatures on top of the original open-source
implementation of Jolteon222 https://github.com/asonnino/hotstuff . It is
implemented in Rust, uses Tokio333https://tokio.rs for asynchronous
networking, ed25519-dalek444https://github.com/dalek-
cryptography/ed25519-dalek for signatures, and data-structures are persisted
using RocksDB555https://rocksdb.org. It uses TCP to achieve reliable point-to-
point channels, necessary to correctly implement the distributed system
abstractions. Since this implementation uses EdDSA (over the curve Ed25519),
we modify its crypto module to use BLS multi-signatures as described in
Section 3. We use the BLS implementation of Filecoin (over the curve
BLS12-381)666 https://github.com/filecoin-project/bls-signatures . We are
open-sourcing our BLS-enabled implementation777
https://github.com/radiken/hotstuff-digital-signature-benchmarking .

### Evaluation setup.

We evaluate the throughput and latency of HotStuff/Jolteon equipped with BLS
multi-signatures through experiments on Amazon Web Services (AWS). We then
compare its performance with the baseline implementation using EdDSA for
various committee sizes.

We deploy a testbed on AWS, using t3.medium instances across 4 different AWS
regions: N. Virginia (us-east-1), N. California (us-west-1), Sydney (ap-
southeast-2), and Frankfurt (eu-central-1). Validators are distributed across
those regions as equally as possible. Each machine provides up to 5 Gbps of
bandwidth, 2 virtual CPUs (1 physical core) on a 2.5 GHz, Intel Xeon Platinum
8175, 4 GB memory, and runs Linux Ubuntu server 20.04. In the following
sections, each measurement in the graphs is the average of 5 independent runs,
and the error bars represent one standard deviation. Our baseline experiment
parameters are a block size of 500KB, a transaction size of 512B, and one
benchmark client per party submitting transactions at a fixed rate for 5
minutes. The leader timeout value is set to 5 seconds. When referring to
_latency_ , we mean the time elapsed from when the client submits the
transaction to when the transaction is committed by one validator. We measure
it by tracking sample transactions throughout the system.

### Analysis.

Figure 2: EdDSA-based implementation; 4, 20, 40, 60, and 80 validators (WAN).

Figure 3: BLS-based implementation; 4, 20, 40, 60, and 80 validators (WAN).

Figure 3 and Figure 3 show that a 4-validators deployment can process 50,000
tx/s while keeping the latency below 1.5 seconds, regardless of the signature
scheme. Similarly, 20- and 40-validator deployments can process around 80,000
tx/s while keeping the latency around 4 to 5 seconds, regardless of the
signature scheme888It may seem surprising that the system achieves a higher
throughput with 20 and 40 validators than with 4. This is however a known
result [9, 13], the extra capacity provided by the additional validators
allows for better resource utilization..

Increasing the committee size to 60 validators drops the performance of our
EdDSA-based implementation to around 60,000 tx/s and increases the latency to
5 seconds (Figure 3). This performance drop is explained by both the
additional bandwidth required to broadcast messages to many validators and the
CPU overhead required to verify a large number of signatures. Indeed, the
leader needs to verify at least $2f+1=41$ votes every round (step ➋ of Figure
1) and validators need to verify 41 signatures to validate each
certificate999The ‘batch-verify’ feature of EdDSA greatly speeds up
certificate verification. (step ➌ of Figure 1). Our BLS-based implementation
suffers a more significant performance drop: Figure 3 indicates the system can
only process up to 20,000 tx with a latency of about 15 seconds. It appears
that this performance difference is due to the time required by the leader to
verify individual votes (step ➋ of Figure 1). EdDSA allows the leader to
efficiently verify votes while BLS verification is about 100x slower and
monopolizes the leader’s CPU. This causes the leader’s slow down, which
affects both throughput and latency.

Figure 3 indicates that even larger deployments of 80 validators further drop
the performance of the EdDSA-based implementation to about 40,000 tx/s (with a
latency of 6 seconds). Figure 3 shows that our BLS-based implementation barely
manages to process transactions; it can only process a few thousands tx/s with
a latency of over 25 seconds. The time required by the leader to verify votes
exceeds 5 seconds most of the time (the leader-timeout value), at which point
validators believe the leader crashed and initiate a view-change sub-protocol
to elect a new leader; this scenario repeats often andgreatly degrades
performance.

### Key takeaways.

Our experiments demonstrate no apparent performance benefit of BLS signatures.
Contrary to popular belief, large deployments do not benefit from the
aggregation properties of BLS. Despite BLS multi-signatures enabling small
certificates and nearly constant-time certificate verification (regardless of
the committee size), the CPU overhead of individual votes verification greatly
offsets this benefit. As a result, large deployments should favor EdDSA. Small
deployments (up to 40 validators) do not place an excessive CPU burden on the
leader, EdDSA and BLS-based deployments perform similarly and they may thus
take advantage of the aggregation properties of BLS. Small BLS multi-signed
certificates can provide a significant storage benefit: storing an EdDSA
certificate requires 2.5 KB (for a 40 nodes deployment) while a BLS multi-
signed certificate only requires about 100 B. This difference may become
significant over time since certificates are part of the forever-persisted
blockchain.

## Acknowledgements

This work is partially funded by Mysten Labs.

## References

  * [1] Bano, S., Sonnino, A., Al-Bassam, M., Azouvi, S., McCorry, P., Meiklejohn, S., Danezis, G.: Consensus in the age of blockchains. arXiv preprint arXiv:1711.03936 (2017)
  * [2] Boneh, D., Drijvers, M., Neven, G.: Compact multi-signatures for smaller blockchains. In: Advances in Cryptology–ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part II. pp. 435–464. Springer (2018)
  * [3] Boneh, D., Lynn, B., Shacham, H.: Short signatures from the weil pairing. In: International conference on the theory and application of cryptology and information security. pp. 514–532. Springer (2001)
  * [4] Castro, M., Liskov, B., et al.: Practical byzantine fault tolerance. In: OsDI. vol. 99, pp. 173–186 (1999)
  * [5] Celo: Build Together and Prosper. https://celo.org (2023)
  * [6] Cohen, S., Gelashvili, R., Kogias, L.K., Li, Z., Malkhi, D., Sonnino, A., Spiegelman, A.: Be aware of your leaders. In: Financial Cryptography and Data Security: 26th International Conference, FC 2022, Grenada, May 2–6, 2022, Revised Selected Papers. pp. 279–295. Springer (2022)
  * [7] Cohen, S., Goren, G., Kokoris-Kogias, L., Sonnino, A., Spiegelman, A.: Proof of availability & retrieval in a modular blockchain architecture. Cryptology ePrint Archive (2022)
  * [8] Cypherium: Web3-Ready Blockchain. https://www.cypherium.io (2023)
  * [9] Danezis, G., Kokoris-Kogias, L., Sonnino, A., Spiegelman, A.: Narwhal and tusk: a dag-based mempool and efficient bft consensus. In: Proceedings of the Seventeenth European Conference on Computer Systems. pp. 34–50 (2022)
  * [10] Diem: Welcome to the Diem Project. https://www.diem.com (2023)
  * [11] Flow: Build Powerful, Secure, and Scalable Web3 Apps. https://flow.com (2023)
  * [12] Gao, Y., Lu, Y., Lu, Z., Tang, Q., Xu, J., Zhang, Z.: Dumbo-ng: Fast asynchronous bft consensus with throughput-oblivious latency. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. pp. 1187–1201 (2022)
  * [13] Gelashvili, R., Kokoris-Kogias, L., Sonnino, A., Spiegelman, A., Xiang, Z.: Jolteon and ditto: Network-adaptive efficient consensus with asynchronous fallback. arXiv preprint arXiv:2106.10362 (2021)
  * [14] Gennaro, R., Jarecki, S., Krawczyk, H., Rabin, T.: Secure distributed key generation for discrete-log based cryptosystems. In: International Conference on the Theory and Applications of Cryptographic Techniques. pp. 295–310. Springer (1999)
  * [15] Guerraoui, R., Knežević, N., Quéma, V., Vukolić, M.: The next 700 bft protocols. In: Proceedings of the 5th European conference on Computer systems. pp. 363–376 (2010)
  * [16] Guo, B., Lu, Y., Lu, Z., Tang, Q., Xu, J., Zhang, Z.: Speeding dumbo: Pushing asynchronous bft closer to practice. Cryptology ePrint Archive (2022)
  * [17] Guo, B., Lu, Z., Tang, Q., Xu, J., Zhang, Z.: Dumbo: Faster asynchronous bft protocols. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. pp. 803–818 (2020)
  * [18] Kate, A., Huang, Y., Goldberg, I.: Distributed key generation in the wild. Cryptology ePrint Archive (2012)
  * [19] Kokoris-Kogias, E., Jovanovic, P., Gailly, N., Khoffi, I., Gasser, L., Ford, B.: Enhancing bitcoin security and performance with strong consistency via collective signing. CoRR abs/1602.06997 (2016), http://arxiv.org/abs/1602.06997
  * [20] Kotla, R., Alvisi, L., Dahlin, M., Clement, A., Wong, E.: Zyzzyva: speculative byzantine fault tolerance. In: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles. pp. 45–58 (2007)
  * [21] Labs, A.: Committed to developing products and applications on the Aptos blockchain that redefine the web3 user experience. https://aptoslabs.com (2023)
  * [22] Labs, M.: Build without boundaries. https://sui.io (2023)
  * [23] Lu, Y., Lu, Z., Tang, Q.: Bolt-dumbo transformer: Asynchronous consensus as fast as the pipelined bft. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. pp. 2159–2173 (2022)
  * [24] Nakamoto, S.: Bitcoin: A peer-to-peer electronic cash system. Decentralized Business Review p. 21260 (2008)
  * [25] Spiegelman, A., Giridharan, N., Sonnino, A., Kokoris-Kogias, L.: Bullshark: Dag bft protocols made practical. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. pp. 2705–2718 (2022)
  * [26] Tendermint: Building the most powerful tools for distributed networks. https://tendermint.com (2023)
  * [27] Yang, L., Park, S.J., Alizadeh, M., Kannan, S., Tse, D.: Dispersedledger: High-throughput byzantine consensus on variable bandwidth networks. arXiv preprint arXiv:2110.04371 (2021)
  * [28] Yin, M., Malkhi, D., Reiter, M.K., Gueta, G.G., Abraham, I.: Hotstuff: Bft consensus with linearity and responsiveness. In: Proceedings of the 2019 ACM Symposium on Principles of Distributed Computing. pp. 347–356 (2019)


Present address: ] Quandela, 7 Rue Léonard de Vinci, 91300 Massy, France

# Topological properties of Floquet winding bands in a photonic lattice

Albert F. Adiyatullin  [  Univ. Lille, CNRS, UMR 8523 – PhLAM – Physique des
Lasers Atomes et Molécules, F-59000 Lille, France  Lavi K. Upreti  Institut
für Theoretische Physik und Astrophysik, Universität Würzburg, 97074 Würzburg,
Germany  Corentin Lechevalier  Clement Evain  Francois Copie  Pierre Suret
Stephane Randoux  Univ. Lille, CNRS, UMR 8523 – PhLAM – Physique des Lasers
Atomes et Molécules, F-59000 Lille, France  Pierre Delplace  ENS de Lyon,
CNRS, Laboratoire de physique (UMR CNRS 5672), F-69342 Lyon, France  Alberto
Amo<EMAIL_ADDRESS>Univ. Lille, CNRS, UMR 8523 – PhLAM –
Physique des Lasers Atomes et Molécules, F-59000 Lille, France

###### Abstract

The engineering of synthetic materials characterised by more than one class of
topological invariants is one of the current challenges of solid-state based
and synthetic materials. Using a synthetic photonic lattice implemented in a
two-coupled ring system we engineer an anomalous Floquet metal that is gapless
in the bulk and shows simultaneously two different topological properties. On
the one hand, this synthetic lattice presents bands characterised by a winding
number. The winding emerges from the breakup of inversion symmetry and it
directly relates to the appearance of Bloch suboscillations within its bulk.
On the other hand, the Floquet nature of the lattice results in well-known
anomalous insulating phases with topological edge states. The combination of
broken inversion symmetry and periodic time modulation studied here enrich the
variety of topological phases available in lattices subject to Floquet driving
and suggest the possible emergence of novel phases when periodic modulation is
combined with the breakup of spatial symmetries.

One of the most striking properties of topological phases of matter is the
appearance of robust unidirectional interface states between two gapped
materials of different topology. The existence and number of edge channels is
determined by a topological invariant, which is a property of the Hamiltonian
describing the bulk materials [1, 2]. This pivotal idea, known as the bulk-
edge correspondence, has successfully explained the topological edge transport
in the quantum Hall effect and in topological insulators [3], the existence of
topological edge states in anomalous Floquet systems [4] and in non-Hermitian
lattices [2]. Even within the bulk, the non-trivial topology of a lattice
Hamiltonian gives rise to remarkable phenomena such as the anomalous velocity
due to non-zero Berry curvature [5, 6], the quantized transport in a Thouless
pump [7, 8] and the braiding of bands in non-Hermitian systems [9].

Enlarging the palette of topological effects in lattices beyond the bulk-edge
correspondence is an important resource that would allow combining different
topological properties in a single material. An example of band topologies
with properties beyond the bulk-edge correspondance are periodically-driven
(Floquet) Hamiltonians with nontrivial band holonomies. The eigenvalues of
Floquet Hamiltonians can form bands that are periodic both in momentum and
quasienergy. This double periodicity enables the possibility of engineering
bands with non-trivial windings, that is, bands that traverse the Brillouin
zone in any possible direction, even across the top and bottom of the
quasienergy spectrum. Recently, it has been shown that when inversion symmetry
is broken in a Floquet-Bloch lattice the bulk modes can also present
nontrivial holonomies and windings across the Brillouin zone [10, 11, 12].
This situation is illustrated in Fig. 1(d): two bands never touch each other,
but still traverse the whole quasienergy spectrum. Since the system is gapless
in the sense that bulk states exist at all energies, its spectrum can be
identified with that of a metal [13].

Here, we report the experimental implementation of such a Floquet metal with
anomalous edge states. The winding of the bulk bands, induced by a suitable
inversion symmetry breaking, can be directly measured via the number of Bloch
suboscillations in the dynamics of a wavepacket accelerated across the
Brillouin zone. Furthermore, the time-periodic nature of the system can be
used to engineer anomalous Floquet topological edge states. Therefore,
Floquet-Bloch bands with broken inversion symmetry allow engineering two
distinct topological properties in the same synthetic material. Thanks to a
heterodyne measurement technique, we get a direct access to both the spectral
bulk winding bands and to the anomalous edge states that we experimentally
show to exist despite the absence of a complete gap.

To engineer these topological properties, we use a two-dimensional synthetic
photonic lattice implemented in two coupled fiber rings. Recently, photonic
platforms based on fiber rings have permitted the study of unconventional
topological effects hardly accessible in other systems [6, 14, 15, 16, 17,
18]. The propagation of light pulses in two rings (Fig. 1(a)) can be mapped
into a lattice of oriented scatterers (Fig. 1(b)), whose couplings and onsite
energies can be manipulated at will [19, 20, 14, 21]. The dynamics of a light
pulse injected in the system follows a split-step coherent walk described by
the equations [22, 14]:

$\displaystyle\alpha_{n}^{m+1}$ $\displaystyle=$
$\displaystyle\left(\cos\theta_{m}\alpha_{n-1}^{m}+i\sin\theta_{m}\beta_{n-1}^{m}\right)e^{i\varphi_{m}}$
$\displaystyle\beta_{n}^{m+1}$ $\displaystyle=$ $\displaystyle
i\sin\theta_{m}\alpha_{n+1}^{m}+\cos\theta_{m}\beta_{n+1}^{m},$ (1)

where $\alpha_{n}^{m}$ and $\beta_{n}^{m}$ denote the complex amplitudes of a
light pulse in the left and right fiber ring. The temporal position of a pulse
within a ring corresponds to a lattice site $n$ while the round trip number is
the time step $m$. The splitting ratio of the beamsplitters at step $m$ is
parametrized by $\theta_{m}$ so that the reflection and transmission
amplitudes are given by $\cos\theta_{m}$ and $\sin\theta_{m}$, respectively.
Lastly, an electrooptical phase modulator (PM) applies an extra phase
$\varphi_{m}$ to all light pulses in one of the rings at a time step $m$.

Figure 1:  Floquet winding metals. (a) The experimental platform consists of
two 40 m long fiber rings with a 0.55 m difference of length coupled via a
variable beamsplitter (VBS). One ring contains a phase modulator (PM) that
controls the phase of light pulses. (b) The dynamics in the rings can be
mapped onto a lattice: propagation in the left (right) fiber ring is
represented with orange (blue) lines, and lattice sites are shown with
circles. $T_{F}$ represents one Floquet driving period. (c)-(d) Calculated
band structure of a Floquet insulator (c) with $K=0$ ($c_{1}=1,c_{2}=-1$) and
a Floquet winding metal (d) with $K=-1$ ($c_{1}=-2,c_{2}=0$). (e) Selected
band-cuts for different values of $\varphi$ corresponding to the red band in
(d).

We consider a time-periodic version of the model described by Eq. (Topological
properties of Floquet winding bands in a photonic lattice) with two steps per
period $T_{F}$. The coupling between rings alternates between $\theta_{1}$ and
$\theta_{2}$ on odd and even steps. In the experiments and simulations
presented below, we use $\theta_{1}=\pi/4-0.1$ and $\theta_{2}=\pi/4-0.4$.
Similarly, $\varphi_{m}$ takes the values $\varphi_{1}=c_{1}\varphi$ and
$\varphi_{2}=c_{2}\varphi$, where $\varphi\in[-\pi,\pi]$, and $c_{1,2}$ are
integer coefficients (Fig. 1(b)). The periodicity of the system in synthetic
space and time allows applying the Floquet-Bloch ansatz to the eigenstates of
Eq. (Topological properties of Floquet winding bands in a photonic lattice):
$(\alpha^{m}_{n},\beta^{m}_{n})^{\dagger}=(A,B)^{\dagger}e^{-iEm/2}e^{ikn/2}$,
with $E$ being the quasienergy, and $k$ the quasimomentum associated to the
real-space position in the lattice.

For a fixed value of $\varphi=0$, the system has one dimension and it presents
anomalous edge modes for specific values of the splitting ratios $\theta_{1}$
and $\theta_{2}$, as studied in Ref. [22]. Interestingly, the phase $\varphi$
can be seen as an additional parametric dimension, with periodicity between
$[-\pi,\pi]$. In this way the model becomes two-dimensional with two bands
$E_{\pm}(k,\varphi)$ defined in the generalised momenta space defined by $k$
and the parametric dimension $\varphi$ (see Fig. 1(c),(d)) [12, 23]. The use
of parametric dimensions has been very successful in augmenting the available
dimensions in synthetic materials and in exploring topological order in quasi-
crystals [24, 25], Berry curvature in photonic bands [6], the four-dimensional
quantum Hall effect [26, 27] and nonlinear Thouless pumping [28].

The periodicity of the Brillouin zone in $k$, $\varphi$ and $E$ allows for the
engineering of bands with nontrivial windings. An example of such peculiar
band structure is shown in Fig. 1(d). The bands are inclined in quasienergy:
when $\varphi$ is changed, they experience a shift in quasienergy and a
lateral displacement along quasimomentum $k$ (Fig. 1(e)), the combined effect
resulting in their winding.

Insights into the topological character of the winding of the bands can be
gained by looking at the evolution operator after one Floquet period (two
steps in our model):

$U_{F}(k,\varphi)=e^{iK\varphi}T_{2}S_{2}T_{1}S_{1},$ (2)

where the unitary operators $S_{1,2}$ and $T_{1,2}$ represent the action of
beamsplitters and phase shifts along the lattice, and $K\equiv(c_{1}+c_{2})/2$
[23]. From Eq. (2) one can see that $K\neq 0$ imprints an additional net phase
to one of the rings during one Floquet period and breaks the generalized
inversion symmetry $U_{F}(k,\varphi)\leftrightarrow U_{F}(-k,-\varphi)$,
leading to the winding of the bands along the quasienergy direction. This net
phase gained by light travelling in the left ring can be seen as an onsite
potential (see [23] for a Hamiltonian description of the model) and it cannot
be gauged away. The phase added periodically by the modulator is not a trivial
shift of the model and, as we will see in the following, has strong
consequences in the dynamics of wavepackets.

Figure 2:  Tomography of the quasienergy bands. (a) Experimentally observed
split-step coherent walk for $\varphi=0$. (b) Reconstructed band structure of
the system. (c) Measured band tomographies for $K=0$ ($c_{1}=1,c_{2}=-1$),
$K=1$ ($c_{1}=2,c_{2}=0$), and $K=2$ ($c_{1}=3,c_{2}=1$) integrated over the
quasimomentum $k$. (d) Band structure from simulations of Eq. Topological
properties of Floquet winding bands in a photonic lattice for the same
parameters as in (c).  Figure 3:  Topological Bloch suboscillations. (a)-(c)
Measured real-space evolution of a wavepacket injected close to $k=0$ into one
of the bands and evolved under an adiabatic increase of $\varphi$ for (a)
$K=1$ ($c_{1}=2,c_{2}=0$), (b) $K=2$ ($c_{1}=5,c_{2}=-1$), and (c) $K=3$
($c_{1}=8,c_{2}=-2$). Note that in (a) and (b), the initial wavepacket has a
momentum slightly smaller and larger, respectively, than $k=0$ due to the
experimental injection technique. Dashed orange lines show analytical curves.
The increase rate $d\varphi/dt$ is $2\pi\cdot 0.008$ rad/turn for (a) and (b),
and $2\pi\cdot 0.012$ rad/turn for (c). (d) Dots: Measured evolution of the
center-of-mass of the wavepacket in (c); solid line: analytic solution. Error
bars represent $1\sigma$ confidence intervals and generally are smaller than
the dot size. Gray areas emphasize the difference between the maximal and the
minimal achievable amplitudes of suboscillations in the analytic curve. (e)
Illustration of the experimental procedure.

The quasienergy winding is a topologically protected property of the bulk of
the system. The corresponding invariant can be defined using a homotopic
property of $U_{F}$ [29]:

$\nu=\sum_{j=\pm}\frac{1}{2\pi}\int_{0}^{2\pi}d\varphi\frac{\partial
E_{j}}{\partial\varphi}=\frac{1}{2\pi
i}\int_{0}^{2\pi}d\varphi\operatorname{Tr}\left[U_{F}^{-1}\frac{\partial
U_{F}}{\partial\varphi}\right],$ (3)

which gives $\nu=2K$ [23]. Since our model features two bands, the number $K$
has a simple meaning: it shows how many times each band winds along the
quasienergy axis for one full turn of $\varphi$ from $-\pi$ to $\pi$. Note
that Eq. (3) does not depend of $k$: the winding is a property of the
$\varphi$ synthetic dimension and it takes the same value for any value of
$k$.

We experimentally demonstrate the Floquet winding metals by injecting a single
$\approx 1$ ns long laser pulse at a position $\alpha_{n=0}^{m=1}$ and
following the dynamics of the system at each time step (Fig. 2(a)). Such
localised excitation populates all the bands of the model. We get access to
both the amplitude and the phase of light $\alpha_{n}^{m},\beta_{n}^{m}$ in
each ring at each lattice site $n$ and time step $m$ by using an optical
heterodyning technique [21]. For this, we let the light pulse at each position
and time step interfere with a local oscillator shifted by 3 GHz from the
frequency of the laser used to inject the initial pulse. By Fourier
transforming the beating of the signal and the local oscillator we can
directly reconstruct the bands as shown in Fig. 2(b). See Ref. [23] for
further details.

For $\varphi=0$ (Fig. 2(b)) the system features two symmetric bands with
respect to $E=0$. We repeat such measurement for values of $\varphi$ from
$-\pi$ to $\pi$, thus performing a full tomography of the band structure
$E(k,\varphi)$. The measured tomographies integrated along the quasimomentum
direction, for $c_{1}$ and $c_{2}$ corresponding to $K=0$, $1$, and $2$ are
presented in Fig.2(c). All subplots feature two distinct bands, each of which
wraps $K$ times along the quasienergy axis. These results are in perfect
agreement with numerical simulations in Fig.2(d).

The topological feature we have just described does not present any particular
effect on the real-space edges of the lattice. However, it has direct
consequences on the wavepacket dynamics of the system: it manifest itself in a
new kind of Bloch suboscillations[12]. If we adiabatically propagate a
wavepacket with quasimomentum $k$ along the $\varphi$ dimension as sketched in
Fig. 3(e), the group velocity $v_{g}=\partial E(k,\varphi)/\partial k$
periodically changes its sign, resulting in suboscillations of the wavepacket.
Analytical inspection of the expression for $v_{g}$ shows that within one
Bloch period the group velocity changes its sign $2K$ times, thus leading to
observation of $K$ suboscillations. The number of suboscillations is thus
determined by the winding number. It is independent of the coupling parameters
$\theta_{1}$, $\theta_{2}$, and it is preserved in the presence of a weak
spatial disorder in the couplings (see Refs. [12, 23] for further details).
This feature is present as long as the wavepacket dynamics is adiabatic and
out of the particular case when the bands are flat (i.e., $\theta_{1}$,
$\theta_{2}=\pi/2$), for which there are no Bloch oscillations at all.

To observe the topological suboscillations, we prepare a wavepacket at
$k\approx 0$ in one of the quasienergy bands [23] and follow its evolution
while $\varphi$, imprinted by the phase modulator, is adiabatically increased
at a constant rate $\partial\varphi/\partial t$. The observed dynamics for
winding metals with $K=1$, $2$, and $3$ is shown in Fig. 3(a)-(c)
respectively. The wavepacket shows an oscillatory behavior towards positive
values of the lattice sites. The weak signal in the other direction arises
from residual initial excitation of the other band. While the full period of
oscillations is always equal to $\Delta\varphi=2\pi$, there are exactly $K$
suboscillations over one full period. An analytical calculation of the
wavepacket trajectory, shown in Fig. 3(a)-(c) with dashed lines, reproduces
the observed behavior.

When $K=1$, the system shows a single oscillation over a full period
$\Delta\varphi=2\pi$. This matches the expected behaviour for the usual Bloch
oscillations of a wave packet accelerated by an electric field over the
Brillouin zone. Indeed, in this case, there is a gauge transformation that
links the dynamics under an adiabatic increase of $\varphi$ to the dynamics of
a wave packet in a lattice subject to a static potential gradient (i.e., a
constant electric field), as discussed in Refs. [30, 12]. For higher values of
$K$, suboscillations appear within a period of acceleration
($\varphi\rightarrow\varphi+2\pi$). Interestingly, in general, the
suboscillations do not have a constant amplitude. Figure 3(d) shows evidence
of the variations of amplitude within a Bloch period (compare green and red
arrows) for a wavepacket adiabatically accelerated in a lattice with $K=3$
over two periods of $\Delta\varphi$. These amplitude variations allow
identifying in an unambigous manner the overall period of the Bloch
oscillations, and show that the appearance of suboscillations cannot be
explained by a redefinition of the periodicity of the dynamics. The observed
behavior matches well the analytical calculations (solid line in Fig. 3(d)).

Figure 4:  Topological edge states. (a) Phase diagram of anomalous Floquet
phases as a function of the coupling amplitudes in the first $\theta_{1}$ and
second step $\theta_{2}$. (b) Measured dynamics when exciting the lattice at a
single site located at the interface between two lattices belonging to two
different phases (triangles in (a)), showing a localized interface state. Both
lattices are prepared with $K=-1$ ($c_{1}=1,c_{2}=-3$) and $\varphi=\pi/2$ but
different values of $\theta_{1}$ and $\theta_{2}$. (c) Measured dispersion
showing a flat band in one gap (shown with the arrow), corresponding to the
interface state. (d) Experimental and (e) theoretical band tomography of the
winding metal for all values of $\varphi$ confirming the presence of edge
state bands in each of the gaps.

Finally, we demonstrate that Floquet winding metals can support a second
topological property: the emergence of anomalous chiral edge states. They
arise neither from the winding number $\nu$ nor from the Chern number that
vanishes due to the phase rotation symmetry [31]. They rather emerge from the
generalised Floquet topological invariant related to the micromotion of the
system during one driving period [4]. Such anomalous Floquet phases have been
reported in 1D photonic lattices [32, 33, 34, 22] and in 2D systems [35, 36,
37, 38]. Here we show spectral evidence of the anomalous topological edge
states and that they can also exist in a Floquet winding metal.

The phase diagram for the anomalous Floquet phases in the topological system
is determined by the values of $\theta_{1}$ and $\theta_{2}$ for which the gap
between the two bands closes (Fig. 4(a)), and it does not depend on the
winding $K$. Following Ref. [31], a bulk topological invariant can be
constructed to account for the number of edge states in the anomalous regime
for $K=0$ (orange areas in the figure). These anomalous phases are preserved
for any value of $K$ as confirmed by simulations via the presence of edge
states at the edge of a single semi-infinite lattice [23].

In our experiment we take profit of the full control over the couplings
between the lattice sites to engineer interfaces between different anomalous
topological phases. To demonstrate this, we consider a winding metal with
$K=-1$ and prepare two topologically different phases with an interface at
position $n=0$. For lattice sites $n<0$ we set $\theta_{1}=\pi/4$,
$\theta_{2}=\pi/4-0.4$, forming an anomalous phase. For $n>0$ we create a
trivial phase with $\theta_{1}=\pi/4-0.4$, $\theta_{2}=\pi/4$ (triangles in
Fig. 4(a)). When exciting the interface with a single pulse, the system shows
a localized edge state at $n=0$ (see Fig. 4(b) for $\varphi=\pi/2$).
Simultaneously, the band structure reveals a flat band in one of the gaps
(Fig. 4(c)), which can be associated to the localised interface state. To
probe the full dispersion of the edge states in $k$ and $\varphi$ we perform
the full band tomography (Fig. 4(d)). The characteristic spectral flow of edge
states between two bands is evident in both gaps, in good agreement with
simulations (Fig. 4(e)). Remarkably, edge states are present even in the
absence of a complete gap. While the topological origin of the edge states is
confirmed by the fact that it requires the presence of an interface between
two different phases, the access to the topological invariant associated to
this two-dimensional split-step Floquet operator and the robustness against
scattering to bulk modes in the gapless phases is an interesting question to
be addressed in subsequent works.

We have shown the experimental realisation of an anomalous Floquet metal,
which simultaneously hosts two different topological properties. Whereas the
first one appears as a consequence of the breakup of inversion symmetry and
manifests in Bloch suboscillations, the second one leads to the formation of
edge states. Both of these topological properties arise from the Floquet
nature of the system and therefore do not have static counterparts. The
flexibility of our platform paves the road to studies of Floquet winding bands
with unconventional dispersion in higher dimensions, and open unprecedented
perspectives in the search for novel Floquet topological phases when combined
with selected spatial symmetries or when including, for instance, non-
Hermitian hoppings [9, 15, 14].

Acknowledgments. We thank S. Ravets and J. Bloch for fruitful discussions.
This work was supported by European Research Council grant EmergenTopo
(865151), the H2020-FETFLAG project PhoQus (820392), the QUANTERA project
Interpol (ANR-QUAN-0003-05), the French government through the Programme
Investissement d’Avenir (I-SITE ULNE / ANR-16-IDEX-0004 ULNE) managed by the
Agence Nationale de la Recherche, the Labex CEMPI (ANR-11-LABX-0007) and the
CPER Photonics for Society P4S. LKU acknowledges support from the Deutsche
Forschungsgemeinschaft (DFG, German Research Foundation) through Project-ID
258499086 - SFB 1170 and through the Würzburg-Dresden Cluster of Excellence on
Complexity and Topology in Quantum Matter – ct.qmat Project-ID 39085490 - EXC
2147.

## References

  * Schnyder  _et al._ [2008] A. Schnyder, S. Ryu, A. Furusaki, and A. Ludwig, Classification of topological insulators and superconductors in three spatial dimensions, Phys. Rev. B 78, 195125 (2008).
  * Gong  _et al._ [2018] Z. Gong, Y. Ashida, K. Kawabata, K. Takasan, S. Higashikawa, and M. Ueda, Topological Phases of Non-Hermitian Systems, Phys. Rev. X 8, 31079 (2018).
  * Hasan and Kane [2010] M. Z. Hasan and C. L. Kane, Colloquium: Topological insulators, Rev. Mod. Phys. 82, 3045 (2010).
  * Rudner  _et al._ [2013] M. S. Rudner, N. H. Lindner, E. Berg, and M. Levin, Anomalous Edge States and the Bulk-Edge Correspondence for Periodically Driven Two-Dimensional Systems, Phys. Rev. X 3, 031005 (2013).
  * Aidelsburger  _et al._ [2015] M. Aidelsburger, M. Lohse, C. Schweizer, M. Atala, J. T. Barreiro, S. Nascimbène, N. R. Cooper, I. Bloch, and N. Goldman, Measuring the Chern number of Hofstadter bands with ultracold bosonic atoms, Nat. Phys. 11, 162 (2015).
  * Wimmer  _et al._ [2017] M. Wimmer, H. M. Price, I. Carusotto, and U. Peschel, Experimental measurement of the Berry curvature from anomalous transport, Nat. Phys. 13, 545 (2017).
  * Nakajima  _et al._ [2016] S. Nakajima, T. Tomita, S. Taie, T. Ichinose, H. Ozawa, L. Wang, M. Troyer, and Y. Takahashi, Topological Thouless pumping of ultracold fermions, Nat. Phys. 12, 296 (2016).
  * Lohse  _et al._ [2016] M. Lohse, C. Schweizer, O. Zilberberg, M. Aidelsburger, and I. Bloch, A Thouless quantum pump with ultracold bosonic atoms in an optical superlattice, Nat. Phys. 12, 350 (2016).
  * Wang  _et al._ [2021a] K. Wang, A. Dutt, C. C. Wojcik, and S. Fan, Topological complex-energy braiding of non-Hermitian bands, Nature 598, 59 (2021a).
  * Zhou  _et al._ [2016] L. Zhou, C. Chen, and J. Gong, Floquet semimetal with Floquet-band holonomy, Phys. Rev. B 94, 75443 (2016).
  * Cedzich  _et al._ [2018] C. Cedzich, T. Geib, C. Stahl, L. Velázquez, A. H. Werner, and R. F. Werner, Complete homotopy invariants for translation invariant symmetric quantum walks on a chain, Quantum 2, 95 (2018).
  * Upreti  _et al._ [2020] L. K. Upreti, C. Evain, S. Randoux, P. Suret, A. Amo, and P. Delplace, Topological Swing of Bloch Oscillations in Quantum Walks, Phys. Rev. Lett. 125, 186804 (2020).
  * Ying and Kamenev [2018] X. Ying and A. Kamenev, Symmetry-Protected Topological Metals, Phys. Rev. Lett. 121, 086810 (2018).
  * Weidemann  _et al._ [2020] S. Weidemann, M. Kremer, T. Helbig, T. Hofmann, A. Stegmaier, M. Greiter, R. Thomale, and A. Szameit, Topological funneling of light, Science 368, 311 (2020).
  * Wang  _et al._ [2021b] K. Wang, A. Dutt, K. Y. Yang, C. C. Wojcik, J. Vučković, and S. Fan, Generating arbitrary topological windings of a non-Hermitian band, Science 371, 1240 (2021b).
  * Nitsche  _et al._ [2019] T. Nitsche, T. Geib, C. Stahl, L. Lorz, C. Cedzich, S. Barkhofen, R. F. Werner, and C. Silberhorn, Eigenvalue measurement of topologically protected edge states in split-step quantum walks, New J. Phys. 21, 043031 (2019).
  * Chalabi  _et al._ [2019] H. Chalabi, S. Barik, S. Mittal, T. E. Murphy, M. Hafezi, and E. Waks, Synthetic Gauge Field for Two-Dimensional Time-Multiplexed Quantum Random Walks, Phys. Rev. Lett. 123, 150503 (2019).
  * Leefmans  _et al._ [2022] C. Leefmans, A. Dutt, J. Williams, L. Yuan, M. Parto, F. Nori, S. Fan, and A. Marandi, Topological dissipation in a time-multiplexed photonic resonator network, Nat. Phys. 18, 442 (2022).
  * Regensburger  _et al._ [2012] A. Regensburger, C. Bersch, M.-A. Miri, G. Onishchukov, D. N. Christodoulides, and U. Peschel, Parity–time synthetic photonic lattices, Nature 488, 167 (2012).
  * Wimmer  _et al._ [2013] M. Wimmer, A. Regensburger, C. Bersch, M.-A. Miri, S. Batz, G. Onishchukov, D. N. Christodoulides, and U. Peschel, Optical diametric drive acceleration through action–reaction symmetry breaking, Nat. Phys. 9, 780 (2013).
  * Lechevalier  _et al._ [2021] C. Lechevalier, C. Evain, P. Suret, F. Copie, A. Amo, and S. Randoux, Single-shot measurement of the photonic band structure in a fiber-based Floquet-Bloch lattice, Commun. Phys. 4, 243 (2021).
  * Bisianov  _et al._ [2019] A. Bisianov, M. Wimmer, U. Peschel, and O. A. Egorov, Stability of topologically protected edge states in nonlinear fiber loops, Phys. Rev. A 100, 063830 (2019).
  * [23] See Supplementary Material for theoretical details of the model and the topological invariant, and experimental information on the setup and the reconstruction of the band structure.
  * Kraus  _et al._ [2012] Y. E. Kraus, Y. Lahini, Z. Ringel, M. Verbin, and O. Zilberberg, Topological states and adiabatic pumping in quasicrystals, Phys. Rev. Lett. 109, 106402 (2012).
  * Baboux  _et al._ [2017] F. Baboux, E. Levy, A. Lemaître, C. Gómez, E. Galopin, L. Le Gratiet, I. Sagnes, A. Amo, J. Bloch, and E. Akkermans, Measuring topological invariants from generalized edge states in polaritonic quasicrystals, Phys. Rev. B 95, 161114 (2017).
  * Lohse  _et al._ [2018] M. Lohse, C. Schweizer, H. M. Price, O. Zilberberg, and I. Bloch, Exploring 4D quantum Hall physics with a 2D topological charge pump, Nature 553, 55 (2018).
  * Zilberberg  _et al._ [2018] O. Zilberberg, S. Huang, J. Guglielmon, M. Wang, K. P. Chen, Y. E. Kraus, and M. C. Rechtsman, Photonic topological boundary pumping as a probe of 4D quantum Hall physics, Nature 553, 59 (2018).
  * Jürgensen  _et al._ [2021] M. Jürgensen, S. Mukherjee, and M. C. Rechtsman, Quantized nonlinear Thouless pumping, Nature 596, 63 (2021).
  * Kitagawa  _et al._ [2010] T. Kitagawa, E. Berg, M. Rudner, and E. Demler, Topological characterization of periodically driven quantum systems, Phys. Rev. B 82, 235114 (2010).
  * Wimmer  _et al._ [2015] M. Wimmer, M.-A. Miri, D. Christodoulides, and U. Peschel, Observation of Bloch oscillations in complex PT-symmetric photonic lattices, Sci. Rep. 5, 17760 (2015).
  * Delplace  _et al._ [2017] P. Delplace, M. Fruchart, and C. Tauber, Phase rotation symmetry and the topology of oriented scattering networks, Phys. Rev. B 95, 205413 (2017).
  * Kitagawa  _et al._ [2012] T. Kitagawa, M. A. Broome, A. Fedrizzi, M. S. Rudner, E. Berg, I. Kassal, A. Aspuru-Guzik, E. Demler, and A. G. White, Observation of topologically protected bound states in photonic quantum walks, Nat. Commun. 3, 882 (2012).
  * Cardano  _et al._ [2017] F. Cardano, A. D’Errico, A. Dauphin, M. Maffei, B. Piccirillo, C. de Lisio, G. De Filippis, V. Cataudella, E. Santamato, L. Marrucci, M. Lewenstein, and P. Massignan, Detection of Zak phases and topological invariants in a chiral quantum walk of twisted photons, Nat. Commun. 8, 15516 (2017).
  * Bellec  _et al._ [2017] M. Bellec, C. Michel, H. Zhang, S. Tzortzakis, and P. Delplace, Non-diffracting states in one-dimensional Floquet photonic topological insulators, EPL 119, 14003 (2017).
  * Maczewsky  _et al._ [2017] L. J. Maczewsky, J. M. Zeuner, S. Nolte, and A. Szameit, Observation of photonic anomalous Floquet topological insulators, Nat. Commun. 8, 13756 (2017).
  * Mukherjee  _et al._ [2017] S. Mukherjee, A. Spracklen, M. Valiente, E. Andersson, P. Öhberg, N. Goldman, and R. R. Thomson, Experimental observation of anomalous topological edge modes in a slowly driven photonic lattice, Nat. Commun. 8, 13918 (2017).
  * Wintersperger  _et al._ [2020] K. Wintersperger, C. Braun, F. N. Ünal, A. Eckardt, M. D. Liberto, N. Goldman, I. Bloch, and M. Aidelsburger, Realization of an anomalous Floquet topological system with ultracold atoms, Nat. Phys. 16, 1058 (2020).
  * Zhang  _et al._ [2021] Z. Zhang, P. Delplace, and R. Fleury, Superior robustness of anomalous non-reciprocal topological edge states, Nature 598, 293 (2021).

Supplemental Materials for: Multi-topological Floquet metals in a photonic
lattice

##  I Calculation of the band structure

By applying the Floquet-Bloch ansatz to Eq. (1) in the main text and solving
the determinant problem we obtain the solution for the energies of the bands
$E_{\pm}$:

$\displaystyle
E_{\pm}(k,\varphi)=\pm\arccos[\cos\theta_{1}\cos\theta_{2}\cos\left(k+K\varphi\right)$
$\displaystyle-\sin\theta_{1}\sin\theta_{2}\cos\left(\Delta\varphi\right)]+K\varphi,$

where $\varphi_{1,2}=c_{1,2}\varphi$, $K\equiv(c_{1}+c_{2})/2$,
$\Delta\equiv(c_{1}-c_{2})/2$. In this work we consider the case of integer
$K$ and $\Delta$, which makes the period along the $\varphi$ direction equal
to $2\pi$. The last term $K\varphi$ emphasizes the fact that each band winds
$K$ times along the quasienergy axis when $\varphi$ is changed by $2\pi$.

##  II Derivation of the Floquet evolution operator

For the Floquet period of 2 steps the evolution of the system in real space
can be written as

$\Psi(m+2)=U\Psi(m),$ (S1)

where

$\Psi(m)=\begin{pmatrix}\cdots\\\ \alpha_{n}^{m}\\\ \beta_{n}^{m}\\\
\alpha_{n+2}^{m}\\\ \beta_{n+2}^{m}\\\ \cdots\end{pmatrix}$ (S2)

is a vector representing the state of the system in real space at time step
$m$, and

$U=\sum_{x_{i},y_{j}}U_{x_{i}\rightarrow
y_{j}}\left|y_{j}\right>\left<x_{i}\right|$ (S3)

is the real-space Floquet evolution operator. Here $\left|x_{i}\right>$ and
$\left|y_{j}\right>$, where $x,y\in\\{\alpha,\beta\\}$ and $i,j$ are the site
number, represent a vector $\Psi$ with $x_{i}=1$ (or $y_{j}=1$) and all the
other components equal to zero. Non-zero matrix elements of $U$ can be found
from the evolution equation (Eq. (1) of the main text):

$\displaystyle U_{\alpha_{n}\rightarrow\beta_{n}}$
$\displaystyle=is_{1}Re^{i\Delta\varphi}$ $\displaystyle
U_{\beta_{n}\rightarrow\alpha_{n}}$ $\displaystyle=is_{1}Re^{-i\Delta\varphi}$
$\displaystyle U_{\beta_{n}\rightarrow\alpha_{n+2}}$
$\displaystyle=is_{2}Re^{iK\varphi}$ $\displaystyle
U_{\alpha_{n}\rightarrow\beta_{n-2}}$ $\displaystyle=is_{2}Re^{-iK\varphi}$
$\displaystyle U_{\alpha_{n}\rightarrow\alpha_{n+2}}$
$\displaystyle=s_{3}Re^{iK\varphi}$ $\displaystyle
U_{\beta_{n}\rightarrow\beta_{n-2}}$ $\displaystyle=s_{3}Re^{-iK\varphi}$
$\displaystyle U_{\beta_{n}\rightarrow\beta_{n}}$
$\displaystyle=-s_{4}Re^{i\Delta\varphi}$ $\displaystyle
U_{\alpha_{n}\rightarrow\alpha_{n}}$
$\displaystyle=-s_{4}Re^{-i\Delta\varphi}$

where $s_{1}=\cos\theta_{1}\sin\theta_{2}$,
$s_{2}=\sin\theta_{1}\cos\theta_{2}$, $s_{3}=\cos\theta_{1}\cos\theta_{2}$,
$s_{4}=\sin\theta_{1}\sin\theta_{2}$, and $R=e^{iK\varphi}$.

To obtain the Floquet evolution operator in reciprocal space, we can use the
Floquet-Bloch ansatz and substitute it into the evolution equation. This gives

$U_{F}(k,\varphi)=\begin{pmatrix}e^{i(\varphi_{1}+\varphi_{2})}e^{-ik}\cos\theta_{1}\cos\theta_{2}&-&e^{i\varphi_{2}}\sin\theta_{1}\sin\theta_{2}&ie^{i(\varphi_{1}+\varphi_{2})}e^{-ik}\sin\theta_{1}\cos\theta_{2}&+&ie^{i\varphi_{2}}\cos\theta_{1}\sin\theta_{2}\\\
ie^{ik}\sin\theta_{1}\cos\theta_{2}&+&ie^{i\varphi_{1}}\cos\theta_{1}\sin\theta_{2}&e^{ik}\cos\theta_{1}\cos\theta_{2}&-&e^{i\varphi_{1}}\sin\theta_{1}\sin\theta_{2}\end{pmatrix}.$
(S4)

It can be seen that the Floquet evolution operator can be factorized in a
sequential manner

$U_{F}(k,\varphi)=D_{2}B_{2}(k)S_{2}D_{1}B_{1}(k)S_{1}$ (S5)

where $S_{1,2}=S(\theta_{1,2})$ are scattering matrices representing the
action of the beamsplitter,

$S(\theta)=\begin{pmatrix}\cos\theta&i\sin\theta\\\
i\sin\theta&\cos\theta\end{pmatrix},$ (S6)

$B_{1,2}(k)$ are translation operators

$B_{1}(k)=\begin{pmatrix}1&0\\\
0&e^{ik}\end{pmatrix},B_{2}(k)=\begin{pmatrix}e^{-ik}&0\\\ 0&1\end{pmatrix},$
(S7)

and $D_{1,2}$ correspond to the phase shift on odd and even steps:

$D_{1,2}=\begin{pmatrix}e^{i\varphi_{1,2}}&0\\\ 0&1\end{pmatrix}.$ (S8)

To study the symmetry properties of the unitary evolution operator we
symmetrize the matrices $B_{1,2}(k)$ and $D_{1,2}$:

$B(k)\equiv\begin{pmatrix}e^{-ik/2}&0\\\
0&e^{ik/2}\end{pmatrix},D(\varphi)\equiv\begin{pmatrix}e^{i\varphi/2}&0\\\
0&e^{-i\varphi/2}\end{pmatrix}$ (S9)

and write

$\displaystyle U_{F}(k,\varphi)$ $\displaystyle=$ $\displaystyle
e^{i(\varphi_{1}+\varphi_{2})/2}D(\varphi_{2})B(k)S_{2}D(\varphi_{1})B(k)S_{1}$
(S10) $\displaystyle=$ $\displaystyle
e^{i(\varphi_{1}+\varphi_{2})/2}T_{2}S_{2}T_{1}S_{1},$

where $T_{1,2}=D(\varphi_{1,2})B(k)$. We notice that both $B(k)$ and
$D(\varphi)$ possess inversion symmetry: $\sigma_{x}B(k)\sigma_{x}=B(-k)$,
$\sigma_{x}D(\varphi)\sigma_{x}=D(-\varphi)$, where $\sigma_{x}$ is the Pauli
matrix. Consequently, for $\varphi_{1}+\varphi_{2}=0$ the Floquet evolution
operator also has the inversion symmetry
$\sigma_{x}U_{F}(k,\varphi)\sigma_{x}=U_{F}(-k,-\varphi)$. However,
introducing a net phase $\varphi_{1}+\varphi_{2}\neq 0$ over one Floquet
period breaks this symmetry and leads to winding of the bands.

##  III Calculation of the topological invariant

Given the factorized version of the Floquet evolution operator (S5), we can
calculate the topological invariant

$\displaystyle\nu$ $\displaystyle=$ $\displaystyle\frac{1}{2\pi
i}\int_{0}^{2\pi}d\varphi\operatorname{Tr}\left[U_{F}^{-1}\frac{\partial
U_{F}}{\partial\varphi}\right]$ (S11) $\displaystyle=$
$\displaystyle\frac{1}{2\pi
i}\int_{0}^{2\pi}d\varphi\operatorname{Tr}\left[S_{1}^{\dagger}B_{1}^{\dagger}D_{1}^{\dagger}S_{2}^{\dagger}B_{2}^{\dagger}D_{2}^{\dagger}\frac{\partial}{\partial\varphi}\left[D_{2}B_{2}S_{2}D_{1}B_{1}S_{1}\right]\right]$
$\displaystyle=$ $\displaystyle\frac{1}{2\pi
i}\int_{0}^{2\pi}d\varphi\operatorname{Tr}\left[D_{1}^{\dagger}\frac{\partial
D_{1}}{\partial\varphi}+D_{2}^{\dagger}\frac{\partial
D_{2}}{\partial\varphi}\right].$

By substituting (S8) we get

$\nu=\frac{1}{2\pi i}\int_{0}^{2\pi}d\varphi\left[ic_{1}+ic_{2}\right]=2K.$
(S12)

##  IV Hamiltonian formalism

The coherent split step model discussed above in terms of evolution operators
can also be described using a time dependent Hamiltonian, as originally
discussed in Ref. [12]. To describe the two step process, we divide each
period of the Hamiltonian evolution into four steps:

$\displaystyle
H(t,k_{x})=\left\\{\begin{array}[]{ll}H_{1}(k_{x})=\begin{pmatrix}0&0\\\
0&-V_{1}\end{pmatrix},&0<t\leq t_{1}\\\
H_{2}(k_{x})=\begin{pmatrix}0&-J_{1}\text{e}^{-ik_{x}/2}\\\
-J_{1}\text{e}^{ik_{x}/2}&0\end{pmatrix}&t_{1}<t\leq t_{2}\\\
H_{3}(k_{x})=\begin{pmatrix}0&0\\\ 0&-V_{2}\end{pmatrix}&t_{2}<t\leq t_{3}\\\
H_{4}(k_{x})=\begin{pmatrix}0&-J_{2}\text{e}^{ik_{x}/2}\\\
-J_{2}\text{e}^{-ik_{x}/2}&0\end{pmatrix}&t_{3}<t\leq T\end{array}\right.$
(S17)

The parameters $V_{1},V_{2},J_{1}$ and $J_{2}$ are related to the phases
gained in the left ring and the coupler strengths via:

$\displaystyle\phi_{1}\equiv V_{1}\tau_{1}/\hbar\quad\quad\theta_{1}\equiv
J_{1}\tau_{2}/\hbar\quad\phi_{2}\equiv
V_{2}\tau_{3}/\hbar\quad\theta_{2}\equiv J_{2}\tau_{4}/\hbar.$ (S18)

The action of the phase modulator in the first and third steps directly maps
into a modification of the onsite energy, while the couplers act as hopping
amplitudes. In this way it can be readily seen that the presence of the phase
modulation breaks inversion symmetry.

Note that the each time step can be associated to an evolution operator
$U_{j}$ during the duration $\tau_{j}=t_{j}-t_{j-1}$:

$\displaystyle U_{j}(k_{x})\equiv\text{e}^{-iH_{j}(k_{x})\tau_{j}/\hbar},$
(S19)

so that the evolution (Floquet) operator after one full period is defined as
$U_{F}(k_{x})=U_{4}U_{3}U_{2}U_{1}$, with stepwise evolution operators:

$\displaystyle U_{1}=\begin{pmatrix}1&0\\\
0&\text{e}^{i\phi_{1}}\end{pmatrix}\qquad
U_{2}=\begin{pmatrix}\cos\theta_{1}&i{\rm e}^{-ik_{x}/2}\sin\theta_{1}\\\
i{\rm e}^{ik_{x}/2}\sin\theta_{1}&\cos\theta_{1}\end{pmatrix}$ (S20)
$\displaystyle U_{3}=\begin{pmatrix}1&0\\\
0&\text{e}^{i\phi_{2}}\end{pmatrix}\qquad
U_{4}=\begin{pmatrix}\cos\theta_{2}&i{\rm e}^{-ik_{x}/2}\sin\theta_{2}\\\
i{\rm e}^{ik_{x}/2}\sin\theta_{2}&\cos\theta_{2},\end{pmatrix}$ (S21)

leading to the expression of the Floquet operator described in Sec. II.

##  V Topologically protected Bloch sub-oscillations

The group velocity in the real space dimension can be found as

$v_{g}^{\pm}(k,\varphi)=\dfrac{\partial E_{\pm}(k,\varphi)}{\partial k}\\\
=\frac{\pm\cos\theta_{1}\cos\theta_{2}\sin\left(k+K\varphi\right)}{\sqrt{1-\left[\cos\theta_{1}\cos\theta_{2}\cos\left(k+K\varphi\right)-\sin\theta_{1}\sin\theta_{2}\cos\left(\Delta\varphi\right)\right]^{2}}}$
(S22)

Due to the term $\sin\left(k+K\varphi\right)$ in the numerator, the sign of
$v_{g}$ changes $2K$ times when $\varphi$ is changed by $2\pi$, forcing a
wavepacket to experience $K$ sub-oscillations during one driving period. Since
$\sin\left(k+K\varphi\right)$ becomes zero with periodicity of $\pi/K$ in
$\varphi$, we can claim that the winding number topologically protects the
frequency of Bloch sub-oscillations. At the same time if $K\neq\Delta$, then
the term $\cos\left(k+K\varphi\right)$ in the denominator precesses at a
different rate than $\cos\left(\Delta\varphi\right)$. Consequently, the
translational symmetry $v_{g}(k,\varphi)=v_{g}(k,\varphi+2\pi/K)$ gets broken,
leading to sub-oscillations of different amplitudes.

Finally, the center-of-mass motion of the wavepacket can be found by
integrating the group velocity:

$X(k,t)=\int_{0}^{t}v_{g}(k,\varphi(\tau))\,d\tau$ (S23)

##  VI Experimental platform

The photonic network is made of two fiber rings coupled by an electronically-
controlled high-bandwidth variable beamsplitter (EOSpace AX-2x2-0MSS-20). Each
of the rings contains an erbium-doped fiber amplifier (Keopsys CEFA-C-HG)
followed by a narrow-band optical filter (EXFO XTM-50), an isolator, a
polarizer, a variable attenuator, and an optical switch (Photonwares NSSW).
One of the rings contains a phase electro-optic modulator (EOM, iXblue MPZ-
LN-10), which imposes the phases $\varphi_{1,2}$. All the fiber components use
polarization-maintaining fibers. Each ring has a length of 40 m, and the
length difference between the rings is 0.55 m. The mean length of the two
rings sets the round trip period, of 205 ns, between the different time steps
$m$. The length difference sets the temporal size of the lattice sites $n$ in
the synthetic spatial dimension, of 2.7 ns.

For the injection of light, emission of a narrow single-frequency laser (IPG
Photonics ELR-5-LP) at a wavelength of 1550 nm is chopped into 1.4 ns-long
pulses by an amplitude EOM (iXblue MXER-LN-10). Before entering the fiber
rings the light passes through an optical switch, which is closed after the
injection. This ensures that no spurious signal from the laser enters the
fibers during the experiment. The prepared injection signal is coupled into
one of the rings through a 70/30 beamsplitter.

##  VII Measurement procedure

The light field in the system is probed via an 80/20 beamsplitter in each of
the rings. To get access to both the amplitude and the phase of each light
pulse we use optical heterodyning. For this, a fraction of the laser light is
modulated by a phase EOM at a frequency of $\Omega=3$ GHz, thus creating
sidebands shifted by $\pm\Omega$ from the laser frequency. Next, the $+\Omega$
sideband is filtered out by a home-built fiber ring cavity actively locked to
this sideband. The filtered out light field is used as a local oscillator, and
its beating with the signal from each ring is measured by a fast photodiode
(Thorlabs DET08CFC, 5 GHz). Recording the response of the photodiode with a
fast oscilloscope (Tektronix MSO64, bandwidth 4 GHz) allows to see the
beating, the amplitude and the phase of which directly correspond to the
amplitude and the phase of the light field under study. By reshaping the
measured signal in a two-dimensional matrix, we can observe the coherent walk
in the real space (Fig. 2(a) of the main text). Performing a two-dimensional
Fourier transform of the coherent walk gives access to the band structure
centered at the frequency $\Omega$ of the local oscillator (Fig. 2(b) of the
main text).

##  VIII Reconstruction of the band structure

Due to the periodicity of the system in both synthetic dimension and time, its
band structure can be obtained simply by calculating the two-dimensional
Fourier transform (2DFT) of a split-step coherent walk. An important
prerequisite for this is that each site of the walk ($\alpha_{n}^{m}$ and
$\beta_{n}^{m}$) is a complex number, which accounts for both the amplitude
and the phase of the light field. In our experiment the measured quantity is
the beating of the signal with the local oscillator at a constant frequency
$\Omega$. This allows us to reconstruct the band structure by performing the
2DFT of the measured signal and offsetting it by the frequency $\Omega$.

Figure S1:  Calibration of the band structure.

The length of an optical fiber is sensitive to the environmental temperature
and pressure and can fluctuate over time. For our experiment, this can be
thought of as an extra optical phase that the light acquires during its
propagation in each fiber ring, which results in a shift of the band structure
in both horizontal ($\delta k$) and vertical ($\delta E$) directions. Over a
long time, the length of a fiber ring can change by a few wavelengths. This
implies that both $\delta k$ and $\delta E$ (which are defined modulo $2\pi$)
can change in any possible value, and the observed band structure is shifted
by an random amount from the expected position.

However, on a short timescale (tens of milliseconds) the length of each ring
changes by less than a few percent of a wavelength. This allows us to
calibrate the band structure by performing two consecutive experimental shots
within a short time (100 $\mu$s), during which $\delta k$ and $\delta E$ stay
the same. The first shot implements a simple model without extra phase
modulation (i.e. $\varphi=0$), which has a well-known band structure for given
$\theta_{1}$ and $\theta_{2}$:

$E_{\pm}^{\mathrm{ref}}(k)=\pm\arccos\left(\cos\theta_{1}\cos\theta_{2}\cos
k\right)$ (S24)

The second shot realizes the experimental system of interest (Fig. S1). By
comparing the band structure of the first shot with its theoretical model we
can measure the shifts $\delta k$ and $\delta E$ and therefore calibrate the
axes, which will stay the same during the subsequent shot.

##  IX Excitation of a single band

We start with a theoretical description for the case of
$\theta_{1}=\theta_{2}=\pi/4$, which has simple and intuitive analytical
expressions for the eigenstates. At time step $m=0$ we inject a train of
pulses with Gaussian envelope into one ring, i.e.

$\alpha^{0}_{n}=e^{-\frac{n^{2}}{\sigma^{2}}},\ \beta^{0}_{n}=0.$ (S25)

Such excitation populates the eigenstates with narrow quasimomentum spread
around $k\approx 0$ in both bands. This can be understood knowing that the
eigenvectors of the model corresponding to the eigenvalues $E_{\pm}$ are [20]:

$\Psi_{\pm}=\begin{pmatrix}A\\\ B\end{pmatrix}_{\pm}=\frac{1}{\sqrt{1+e^{\pm
2\sin k/2}}}\begin{pmatrix}1\\\ \mp e^{\pm\sin k/2}e^{-ik/2}\end{pmatrix}$
(S26)

For $k=0$

$\Psi_{\pm}(k=0)=\frac{1}{\sqrt{2}}\begin{pmatrix}1\\\ \mp 1\end{pmatrix},$
(S27)

and for broad Gaussian wavepackets with $\sigma\gg 1$ the excitation (S25)
excites equal fraction of both bands at $k=0$:

$\begin{pmatrix}\alpha^{0}_{n}\\\
\beta^{0}_{n}\end{pmatrix}\approx\begin{pmatrix}1\\\
0\end{pmatrix}=\frac{1}{\sqrt{2}}\left(\Psi_{+}+\Psi_{-}\right)$ (S28)

To excite a single band, we program the PM during the turn $m=1$ to apply a
phase $\varphi_{1}=\pi/2$. After the first step, the state of the systems
becomes

$\begin{pmatrix}\alpha^{1}_{n+1}\\\
\beta^{1}_{n+1}\end{pmatrix}=\frac{1}{\sqrt{2}}\begin{pmatrix}\alpha^{0}_{n}e^{i\varphi_{1}}\\\
i\alpha^{0}_{n+2}\end{pmatrix}\approx\frac{i}{\sqrt{2}}\begin{pmatrix}1\\\
1\end{pmatrix}=i\Psi_{-},$ (S29)

and, up to the global phase factor, occupies only one single band $\Psi_{-}$.
Note that choosing $\varphi_{1}=-\pi/2$ would occupy the $\Psi_{+}$ band.

For the arbitrary choice of $\theta_{1}$ and $\theta_{2}$ one would need to
adjust both the phase and the amplitude of signals in two rings in order
excite one single band. However, if chosen values of $\theta_{1}$ and
$\theta_{2}$ do not alter significantly the shape of the bands (which is the
case of our work), one can still transfer the most part of the signal into one
band. In our experiment, we can reproducibly inject more than a 80% of the
emission into one of the bands (Fig. S2).

Figure S2:  Excitation of one band.

##  X Identification of trivial and anomalous Floquet phases

To identify the trivial and anomalous Floquet phases we compute the
quasienergy spectra $E(k,\varphi)$ for a finite size system containing 50 unit
cells along the synthetic dimension with fully reflective boundary conditions.
The calculated spectra in the trivial and anomalous case are shown in Fig. S3
A and B respectively. The anomalous phase clearly shows spectral features
traversing the gaps, which correspond to the states localized at the edges of
the lattice as in Fig. S3C.

Figure S3:  Calculated bands for the (a) trivial winding metal with $K=-1$,
$\theta_{1}=\pi/4-0.6$, and $\theta_{2}=\pi/4$, (b) anomalous winding metal
with $K=-1$, $\theta_{1}=\pi/4$, and $\theta_{2}=\pi/4-0.6$. Lines traversing
the gap correspond to states localized at the edges. Both models are comprised
of 50 sites along the synthetic dimension. (c) Probability amplitude of the
red edge state marked by a black arrow in (b) at $\varphi=1.24\pi$.