# Discovering Encrypted Bot and Ransomware Payloads Through Memory Inspection
Without A Priori Knowledge

Peter McLaren, William J Buchanan, Gordon Russell, Zhiyuan Tan  School of
Computing, Edinburgh Napier University, Edinburgh, UK.

###### Abstract

Malware writers frequently try to hide the activities of their agents within
tunnelled traffic. Within the Kill Chain model the infection time is often
measured in seconds, and if the infection is not detected and blocked, the
malware agent, such as a bot, will often then set up a secret channel to
communicate with its controller. In the case of ransomware the communicated
payload may include the encryption key used for the infected host to register
its infection. As a malware infection can spread across a network in seconds,
it is often important to detect its activities _on the air_ , _in memory_ and
_at-rest_. Malware increasingly uses encrypted channels for communicating with
their controllers. This paper presents a new approach to discovering the
cryptographic artefacts of real malware clients that use cryptographic
libraries of the Microsoft Windows operating system. This enables malware
secret communications to be discovered without any prior malware knowledge.

###### Index Terms:

network traffic; decryption; memory analysis; Transport Layer Security; bot;
ransomware

##  I Introduction

Malicious actors employ secure channels to hide communications from detection
agents. These channels enable activities such as the installation of exploit
kits, distribution of malware and adware, and communicating useful information
to controllers. So, knowledge of channel contents is unknown while malicious
use of secure channel surges - a cloud vendor blocked 1.7 billion threats
using TLS in he second half of 2018 [1]. Malware classes that frequently uses
TLS secure channel for communications are bots and ransomware.

The ransomware element of an attack can be defined as the weaponisation part,
where a ransomware element can be packaged with a defined distribution and
infection methods, and then targeted as required. The first phase of
ransomware, such as WannaCry, was often fairly scattergun in its targets, but
the usage of ransomware in targeted attacks increases. In 2019, Symantec found
that enterprise-targeting ransomware showed a yearly increase of 12% and
attacks on mobile devices rose by 33% [2]. With WannaCry we saw the
weaponisation of ransomware, which used the Eternal Blue vulnerability for its
infection. The NHS in the UK was but one organization of many who suffered
major outages from the ransomware infection [3].

Modern bot malware is generally multi-purpose. Once installed on a client, an
external controller determines bot activities through issued commands.
Encrypted controller-to-bot channels prevent defenders from discovering
commands. Ransomware clients are generally single purpose in that users pay to
recover document or device access. Crypto-ransomware, where documents on an
infected client are encrypted and a payment is required, typically in
Bitcoins, for the decryption key, is a common variant [4]. Communications
between crypto-ransomware clients and controllers may include useful
information such as encryption keys.

Current methods of dealing with malicious use of secure channels have
limitations. Whereas in unencrypted channels, payload inspection provides
knowledge of malware activity, with encrypted channels, detection methods rely
on discovering anomalies between benign and malicious activity. These methods
assist in the detection and possible prevention of possible malicious activity
but cannot provide detailed knowledge of the malicious activity.

This paper investigates decrypting TLS communications of real-world malware. A
framework uses a standard approach for decrypting TLS traffic to analyse and
decrypt the secure communications. For malware, performance challenges can
result from malware use of different cryptographic libraries. So, the
framework is extended to accommodate the Windows cryptographic library.
Experiments evaluate decrypting real bot and ransomware command and control
communications using the extension. The contribution is a novel method to
discovering cryptographic artefacts used by real malware. As these are
discovered in single memory extracts and decrypted in less than a second, the
communicated activities of unknown malware can be discovered.

The rest of the paper is structured as follows. Related research on malware
command and control channels is presented in Section II. Section III discusses
sourcing of real-world malware samples while Section IV evaluates and
discusses the limitations of decrypting using a standard TLS decryption
methodology. An new approach for decrypting traffic using Windows
cryptographic libraries is presented in Section V. The results are presented
and discussed in Section VI and conclusions drawn in Section VII.

##  II Related Work

A number of papers focus on memory inspection to discover the malware threat
using calls to APIs. Gupta et al [5] analysed API calls within Windows and
mapped a total of 534 important API calls with 26 categories (A-Z). These were
then used to identify five types of malware (Worm, Trojan-Downloader, Trojan-
Spy, Trojan-Dropper and Backdoor). Hampton et al [6] furthered this work by
analysing 14 strains of ransomware on Windows platforms and created mappings
of the API call frequencies.

Other studies detect the presence of malware command and control channels.
Signature-based detection systems that check for known byte sequences in
packet headers or payloads may be less successful with new malware variants or
encrypted traffic. So, anomaly detection methods using data mining methods [7]
can distinguish benign from malware traffic. For example, features such as
correlations between malware channel request and response times [8], short
packet sizes [9], TLS header information [10], or a combination of features
[11] are possible differentiators. The features facilitate malware detection
and prevention but the encrypted contents are hidden.

Controller emulation can discover malware client plaintext. Logging client
requests may provide useful insights although cited challenges may be
environment security, scalability for large botnets, and transparency, where
malware detects the presence of a test environment and terminates [12].
Although a controlled environment is advantageous [13] and can be used to
detect adversaral activities [14] emulator drawbacks for decrypting real-world
malware communications may be not knowing valid controller responses but,
perhaps more importantly, the malware must be known a priori to execute in the
environment.

Patil et al [15] define an investigation framework for analysing captured
memory for the detection of malware using information from processes, running
threads, opened registry keys, and user authentication details. Google, too,
focus on memory inspection for the detection of malware [16] and use a number
of virtual machines to detect anomalous behaviour.

Feichtner et al [17] defines a method of detecting cryptographic misuse in
Apple iOS applications. Their work uses a decompilation method to analyse the
code calls to the core cryptographic libraries. In their analysis they found
that 82% of the applications sampled had a cryptographic flaw. For this they
defined six main rules to identify a cryptographic flaw. These included: the
usage of the ECB mode for encryption; the usage of a non-random IV for CBC
encryption; and the usage of constant encryption keys. Most of flaws found
related to the usage of a non-random Initialization Vector (IV) and the usage
of constant encryption keys. They also found that 27% of the sampled apps used
ECB (Electronic Code Book) for the symmetric key encryption.

A priori malware knowledge may also enable plaintext discovery. While virtual
machine environments, such as DRAKVUF [18], support malware dynamic analysis,
such solutions succeed only where actual, or suspected, malware is obtained.
Our approach requires no prior knowledge so discovering the plaintext in the
encrypted communications of unknown malware is possible.

Discovery of malware cryptographic artefacts may enable their communications
to be decrypted. For example, researchers have discovered TLS encryption keys
in memory [19]. Initialization vectors were not discovered, which for
commonly-used AES-GCM encryption is necessary, so plaintext was not derived.
Furthermore, whereas keys were discovered in Linux memory, malware is still
predominantly Windows-focused [10].

##  III Sourcing Malware Samples

Malware communications analysis ideally executes real malware samples. Samples
of recent provenance are preferable as these may reflect the approaches of
modern malware authors, Maintained online databases provide guides to current
usage. For SSL traffic, the SSL Blacklist website [20] lists bot and
ransomware clients in reverse chronological order of awareness. From the list,
35 potential malware entities were identified. For each, multiple client
executable samples were downloaded in compressed, password protected from the
VirusShare website [21]. The compressed files are securely copied to the
client. on which Windows Defender is disabled, the compressed files
uncompressed and executed. As the responder acting as a malware controller was
not configured to respond appropriately, only three executables successfully
established a TLS connection including a data exchange with a server running
the OpenSSL server application [22]. The three malware executables are listed
in Table I followed by pertinent background.

TABLE I: Malware Samples Type | Class | MD5
---|---|---
Bot | Zbot | eeef1e062c8011cabb23b3c833ff766a
Ransomware | Torrentlocker | aeb5bb78ab442bc94bb94d968754e523
Bot | Gozi | 67a775879d3664456cb6a5026c518ca0

Zbot, also known as ZeuS or Zeus, is a well-known bot malware instance.
Detected in 2006 [23], Zbot is primarily known for stealing banking passwords
by injecting code into a user browser as illustrated in Figure 1. Other Zbot
functionality includes extracting information such as browser history and
cookies, certificates, and mail account information as well as perform actions
such as manipulate local files, install ransomware, log keystrokes, take
screenshots, and manage a botnet of other infected computers [24] [25].
Although Zbot previously used the HTTP protocol for communications,
information and commands are now generally concealed with TLS.

Figure 1: Zbot Fake [26]

Gozi, also known as Ursnif inter alia, is also an information-stealing bot.
Detected in 2007 [27], Gozi is commonly used by malicious actors for stealing
and other confidential banking information [28] [29] [30] as shown in 2.
Although functions include theft of cookies and email credential, and logging
of keystrokes and browsing activity [31], a key feature is intercepting
network traffic to hijack financial transactions. For example, when a money
transfer is detected, Gozi issues an encrypted message through its command and
control server to prevent the correct transfer and redirect the funds to a
controlled account [32].

Figure 2: Gozi Data Theft [27]

TorrentLocker is an instance of crypto-ransomware. Known since 2014,
sufficiently similar to CryptoLocker to also be known as Crypt0L0cker, it
encrypts user documents including pictures, advises the user of its action,
and demands payment using Bitcoins [33] as indicated in Figure 3. Although
client-controller communications were previously encrypted using XOR, TLS is
now a common communications mechanism [34]. Information transmitted to the
controller includes the ransom page, the encryption key which is RSA-encrypted
with a TorrentLocker public key, counts of encrypted files, address book
contacts, email credentials, and logs [33].

Figure 3: TorrentLocker/Crypt0L0cker Warning

##  IV Approach

The analysis framework executes in a virtualized environment, A hypervisor
supports a virtual machine monitor executing on a privileged virtual machine,
a suspect client virtual machine executing malware samples, and virtual
machines providing server functionality for client communications. The
framework extracts read/write client virtual machine memory, analyses memory
extracts to discover small sets of candidate cryptographic artefacts, and
decrypts encrypted network traffic until a decrypt is validated. The framework
accommodates SSH and TLS protocols and encryption algorithms such as AES and
ChaCha20.

A standard TLS extension searches memory extracts for key blocks that a
pseudo-random number generator (PRNG) create after the handshake. For AES-GCM,
the agreed encryption algorithm for each malware sample, key blocks contain
client and server encryption keys, and client and server implicit
initialization vector (IV) segments. MemDecrypt memory analysis searches for
key blocks following the process illustrated in 4 where the explicit IV
segment in an Application Data network packet enables searches for candidate
implicit IVs, which enable candidate key block discovery. Candidate implicit
IVs are memory extract segments co-located with explicit IV segment values.
Candidate key blocks are memory extract segments co-located with candidate
implicit IV segments and where the key block client key and server key exceed
a threshold.

Figure 4: GCM Memory Analysis Approach

###  IV-A Test Environment

The Xen Project 4.4.1 hypervisor runs on a Core 2 Duo Dell personal computer
with 40 GB of disk storage and 3 GB of RAM, It supports a privileged
hypervisor console running Debian release 3.16.0-4-amd64 version and the
MemDecrypt framework. and three unprivileged virtual machines. Experiments
execute on a Windows client and a Linux server virtual machine. The client
runs the Windows 10 (10.0.16299) operating system with 2 GB of memory and 40
GB of disk, and the server runs an Ubuntu 14.04 build (“Trusty”) with 512 MB
of allocated memory and 4 GB of disk storage.

The environment is configured for malware containment. The malware client is
prevented from communicating with external servers to prevent possible
corruption of other environments. So, an additional Linux machine running
Ubuntu 14.04 build (“Trusty”) with 512 MB of allocated memory and 4 GB of disk
storage is established as a DNS server using the ‘dnsmasq’ package. Responses
to benign DNS requests, such as *.microsoft.com, return the DNS server IP
address and to other requests the IP address of the target TLS server. For the
first experiment, debug mode was enabled to log keys, IVs and plaintext. The
OpenSSL server command used was:

openssl s_server -accept 443 -debug -cert crt.pem -key key.pem -WWW

###  IV-B Results

With Zbot, the application of the standard TLS extension to memory extraction
and analysis, the decrypt analysis component was projected to require
approximately 34 hours to identify correct artefacts. By excluding artefacts
less than 1000 bytes apart in memory extracts, this reduced to 15 minutes so
the combined analysis duration was 38 minutes. Although quicker than brute-
force, cryptanalytic, and side-channel approaches, the duration may be
insufficient for practical application in live scenarios. Furthermore, the
duration is substantially longer than earlier experiments with, for example,
the OpenSSL library, warranting further analysis.

Two factors cause this increase. One is the 8-byte explicit IV segment
obtained from an Application Data Message. For Zbot, the first explicit IV
segment is _’0x0000000000000001’_ as illustrated in the highlighted section of
the Wireshark packet capture in Figure 5. This byte sequence occurs more
frequently than randomly generated explicit IVs in memory extracts. So, when
the explicit IV is used to discover possible four-byte implicit IV segments,
578,629 possible instances were found. Entropy measure thresholds reduced the
candidate key block size to 23,361. By contrast, an experiment with an OpenSSL
client application yielded three candidate implicit IVs and 79 candidate keys.

Figure 5: Gozi Handshake & Application Data message

The other factor is masquerading. To evade detection, malware applications may
camouflage their activities and one such mechanism is masquerading as a benign
application so the malware may also be known as a ‘trojan’. In the Windows
environment, examples of benign applications used for masquerading includes
the Edge browser and Windows Explorer. However, when Zbot masquerades as the
Windows Explorer, for example, the data collection component extracts 265
read/write memory files totalling 73.2 MB for each separate extraction. The
combination of these two factors leads to large sets of candidate keys and
IVs.

##  V Windows Library Extension

Memory extract features suggest a more efficient alternative. Using the
session key and IV from OpenSSL server logs, a search of malware client
application memory yielded interesting facts: the key occurs frequently in
different extract files, memory extract files sizes containing the key are
within specific ranges, and two unusual ASCII strings are present near
encryption key locations in the memory extract files.

The repeated occurrence of the key in memory extracts may result from data
protection or an absence of data cleansing. After a TLS handshake when client
and server keys have been generated by a pseudo-random generator, the keys may
be copied to record data structures for simplified access by the encryption
process. The malware may copy the keys repeatedly to ensure access.
Alternatively, the malware writer may copy keys on different occasions but
fail to cleanse the source or copy. In any case, this feature is not used in
the extension.

Sizes of memory extract files containing encryption keys ranged between 2 MB
and 4 MB. Consistent with prior SSH and TLS investigations, the size probably
originates from an application memory allocation request (‘malloc’) for a data
structure to hold the encryption, or decryption fields such as keys,
encrypt/decrypt flags, key length, mode, etc. As illustrated in Figure 6 which
maps the number of segments above a 4.5 threshold (Y-axis) against the
extracted size (X-axis), the distribution of high-entropy counts in malware
application memory suggests that prioritizing regions for analysis may speed
up the IV and key discovery process.

Figure 6: Windows Explorer High-entropy Regions

The presence of specific ASCII strings in memory extracts containing keys is
more significant. The strings are _‘3LLS’_ and _‘KSSM’_ , or in big-endian
format" _’SSL3’_ and _‘MSSK’_. Researchers identified ‘MSSK’ in the Windows
security policy application, Local Security Authority Subsystem Service
(LSASS) as a possible acronym for ‘Microsoft Symmetric Key’ or ‘Microsoft
Symmetric Key’ [35]. ‘SSL3’ may refer to the deprecated forerunner of TLS,
SSLv3. Kambic identified probable fields in the undocumented LSASS data
structure including: encryption data structure sizes; TLS version; and the
encryption key. The field identified by Kambic as the probable IV field is
inconsistent with MemDecrypt memory extracts. The implicit IV is located
approximately 20 bytes after the ‘3LLS’ string, and the key approximately 30
bytes after the ‘KSSM’ string. Although random occurrences are possible, the
strings provide good indicators for identifying candidate memory extracts
containing cryptographic artefacts when Microsoft security libraries are used.

A MemDecrypt extension to decrypt TLS communications from executables that use
Microsoft security libraries accommodates these features. Microsoft encryption
libraries are assumed When TLS Application Data messages contain explicit IV
values of ‘x0000000000000001’, Additional techniques such as the
identification of executable linked libraries might validate this assumption.
Extract file sizes are banded to prioritise medium-sized files. The extract
files are searched for the ASCII strings and fields in near locations in the
same extracts and of sufficient entropy to be candidate keys and IVs are
identified. The Microsoft memory analysis algorithm is shown in Algorithm 1.
The banding is wider, and the maximum allowable distances in memory between
’3LLS’ and a candidate IV, and ’KSSM’ and a candidate key exceed the
empirically observed values to allow for potential data structure changes, as
may result from operating system upgrades. The entropy thresholds for ’IVsize’
and ’keysize’ are set to 1.5 and 4.5 respectively based on previous
experiments with PRNG functions. If the Microsoft library extension fails to
find cryptographic artefacts, the TLS extension provides a fall-back.

Data: Extracts folder, entropy thresholds, keysize

Result: Z = candidate keys, Y = candidate IVs

for  _file in folder_ do

if  _1 MB < size(file) < 8MB _ then

Band1 += file;

end if

if  _0 MB < size(file) < 1MB _ then

Band2 += file;

end if

if  _8 MB < size(file) _ then

Band3 += file;

end if

end for

IVsize = 4;

for  _each file in Bands 1-3_ do

if  _‘KSSM’ in extract_ then

start = location (‘3LLS’);

for  _i = start to MaxIVdistance inc by 4_ do

s = extract[i:i+4];

if  _entropy(s) > threshold(IVsize)_ then

Y += s

end if

end for

Start = location ‘KSSM’;

for  _i = start to MaxKeydistance increment by 4_ do

s = extract[i:i+keysize];

if  _entropy (s) > threshold(keysize)_ then

Z += s;

end if

end for

end if

end for

Algorithm 1 Windows Library Memory Analysis

##  VI Windows Library Extension Evaluation

Experiments were executed to evaluate the Windows library extension. Each
malware sample was executed on a Windows 10 client, memory extracted and
Ubuntu OpenSSL server logs collected. Analysis decrypts were validated by
evaluating compliance with HTTP 1.1 and comparison with server logs. An
example of Zbot decrypted analysis output is illustrated in Figure 7 and
verification provided by the OpenSSL server log shown in Figure 8. Each Zbot,
Gozi, and TorrentLocker samples decrypted with 100% success. Decrypt output
examples for all malware samples are shown in Table II. Host names and GET
image names vary for different test runs, and furthermore, Gozi decrypts
produce POST as well as GET requests.

Figure 7: Zbot Decrypt Log Figure 8: Zbot Server Log TABLE II: Malware Decrypt Analysis Output Examples Malware |  Decrypt
---|---
Zbot |  GET /images/iWjLmuDOy7/XYiI3c6Yc19CBsArB
/rO6Z4SdMsmUI/_2FtdYcDlyk/LoNJcQlukRof2E/
|  wEtt4hPTStlxvgVkkzKsg/60jtn5ijtM8aubv/YKQoZ
|  fCXiA4x01o/rjcmP9NhrPGMZrGeb/mWLp7cs9z/83p8s
|  ChdoB_2FBMuejFT/IP3nyBFsFoV/U.jpeg HTTP/1.1
|  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0;
|  Windows NT 10.0; Win64; x64)
|  Host: aineiounfafjnafjwnaefoiajwnf.net
|  Connection: Keep-Alive
|  Cache-Control: no-cache
TorrentLocker |  POST /topic.php HTTP/1.1
Accept: */*
|  Host: orbfoz.drinkmilks.org
|  Content-Length: 176
|  Cache-Control: no-cache
Gozi |  GET/images/SZK2b21jT4lHGlPQ/dzUZdQ7R6GQ9vDq/
_2Bubb8ji761TySLT2/0hh3OGhrh/Gp933q_2
|  BuLnl3Zz6zem/PlUvBGkYtrVJ8DUn8vN/LcmmaA101Yc
|  rEmAU5RwlEy/zK8Z9xa06n3R/g0EFUOhv/8sDfI2Goa38
|  03Voj6biFmRG/JDejp7Gffn/y7.jpeg HTTP/1.1
|  User-Agent: Mozilla/4.0 (compatible; MSIE 8.0;
|  Windows NT 10.0; Win64; x64)
|  Host: wjenqwdqwdwdqwd.com
|  Connection: Keep-Alive
|  Cache-Control: no-cache

Analysis component durations for each malware sample confirm the extension’s
performance. As illustrated in Table III the maximum combined duration for
memory analysis and decrypt analysis is below 1 second, a direct consequence
of reduced candidate cryptographic artefact set sizes. With the Microsoft
library extension, the set sizes range between three and six, and IV set sizes
between 79 and 483.

TABLE III: Malware Extension Analysis Times (secs) | Memory Analysis | Decrypt Analysis
---|---|---
Maximum | 0.21 | 0.41
Minimum | 0.18 | 0.03
Mean | 0.17 | 0.16
Standard Deviation | 0.03 | 0.18

###  VI-A Analysis

The small experimental set size might inhibit complete confidence in the
extension’s capacity to decrypt encrypted malware command and control traffic.
When malware writers have developed custom security routines, analysts have
broken them easily broken so known cryptographic libraries are more commonly
used. Microsoft library presents a good opportunity for malware writers being
pre-loaded with a Windows operating system. Use of libraries such as OpenSSL
would require additional download increasing the risk of detection. It is
concluded that payloads of secure TLS communications between malware clients
executing on Windows clients and their controllers can be rapidly discovered.

Decrypting a single request is not conclusive. This outcome is determined by
testbed configuration as the server responds with OK to any TLS requests, In
the absence of a reasonable response, the client may terminate or cease
further communications with the controller. Also, decryption may not
necessarily provide useable information, particularly where the plaintext
includes a secondary encryption layer as with TorrentLocker. However, having
discovered the key and IV, a complete session is decryptable.

##  VII Conclusions

Rapid decryption of live TLS malware traffic offers exciting prospects. For
instance, by permitting the client to communicate with its controller in a
managed environment, knowledge such as client-controller interaction details
may contribute to enhanced malware defences. Furthermore, decrypting unmanaged
communications between malware and controller may provide ransomware keys or
stolen banking details. Future work will explore these opportunities as well
as expanding the range of tested malware clients.

## References

  * [1] D. Desai, “What’s hiding in encrypted traffic? Millions of advanced threats,” 2019. [Online]. Available: https://www.zscaler.com/blogs/research/whats-hiding-encrypted-traffic-millions-advanced-threats
  * [2] Symantec, “Internet Security Threat Report (ISTR) 2019,” https://solutionsreview.com/endpoint-security/by-the-numbers-endpoint-security-vulnerabilities/, 2019, [Online; accessed 20-Mar-2019].
  * [3] J. Hoeksma, “NHS cyberattack may prove to be a valuable wake up call,” _BMJ: British Medical Journal (Online)_ , vol. 357, 2017.
  * [4] A. Kharraz, W. Robertson, D. Balzarotti, L. Bilge, and E. Kirda, “Cutting the gordian knot: A look under the hood of ransomware attacks,” in _International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment_. Springer, 2015, pp. 3–24.
  * [5] S. Gupta, H. Sharma, and S. Kaur, “Malware characterization using windows API call sequences,” in _International Conference on Security, Privacy, and Applied Cryptography Engineering_. Springer, 2016, pp. 271–280.
  * [6] N. Hampton, Z. Baig, and S. Zeadally, “Ransomware behavioural analysis on Windows platforms,” _Journal of information security and applications_ , vol. 40, pp. 44–51, 2018.
  * [7] A. S. Shekhawat, F. Di Troia, and M. Stamp, “Feature analysis of encrypted malicious traffic,” _Expert Systems with Applications_ , 2019.
  * [8] G. Gu, J. Zhang, and W. Lee, “BotSniffer: Detecting botnet command and control channels in network traffic,” in _NDSS ’08 Proceedings of the 15th Annual Network and Distributed System Security Symposium_ , 2008.
  * [9] X. Ma, X. Guan, J. Tao, Q. Zheng, Y. Guo, L. Liu, and S. Zhao, “A novel IRC botnet detection method based on packet size sequence,” in _2010 IEEE International Conference on Communications_. IEEE, 2010, pp. 1–5.
  * [10] B. Anderson, S. Paul, and D. McGrew, “Deciphering malware’s use of tls (without decryption),” _Journal of Computer Virology and Hacking Techniques_ , pp. 1–17, 2016.
  * [11] P. McLaren, G. Russell, and B. Buchanan, “Mining malware command and control traces,” in _2017 Computing Conference_. IEEE, 2017, pp. 788–794.
  * [12] B. Lin, Q. Hao, L. Xiao, L. Ruan, Z. Zhang, and X. Cheng, “Botnet emulation: challenges and techniques,” in _Emerging Technologies for Information Systems, Computing, and Management_. Springer, 2013, pp. 897–908.
  * [13] C. P. Lee, “Framework for botnet emulation and analysis,” Ph.D. dissertation, Georgia Institute of Technology, 2009.
  * [14] S. Sentanoe, B. Taubmann, and H. P. Reiser, “Virtual machine introspection based ssh honeypot,” in _Proceedings of the 4th Workshop on Security in Highly Connected IT Systems_. ACM, 2017, pp. 13–18.
  * [15] D. N. Patil and B. B. Meshram, “Windows Physical Memory Analysis to Detect the Presence of Malicious Code,” in _Recent Findings in Intelligent Computing Techniques_. Springer, 2019, pp. 3–13.
  * [16] E. Thioux, M. Amin, and O. A. Ismael, “System and method for analysis of a memory dump associated with a potentially malicious content suspect,” Feb. 5 2019, uS Patent App. 10/198,574.
  * [17] J. Feichtner, D. Missmann, and R. Spreitzer, “Automated Binary Analysis on iOS: A Case Study on Cryptographic Misuse in iOS Applications,” in _Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks_. ACM, 2018, pp. 236–247.
  * [18] T. K. Lengyel, S. Maresca, B. D. Payne, G. D. Webster, S. Vogl, and A. Kiayias, “Scalability, Fidelity and Stealth in the DRAKVUF Dynamic Malware Analysis System,” in _Proceedings of the 30th Annual Computer Security Applications Conference_ , ser. ACSAC ’14. ACM, 2014, pp. 386–395.
  * [19] B. Taubmann, C. Frädrich, D. Dusold, and H. P. Reiser, “TLSkex: Harnessing virtual machine introspection for decrypting TLS communication,” _Digital Investigation_ , vol. 16, pp. S114–S123, 2016.
  * [20] “SSL Blacklist,” 2018. [Online]. Available: https://sslbl.abuse.ch
  * [21] “VirusShare.” [Online]. Available: https://virusshare.com/
  * [22] OpenSSL Software Foundation, “OpenSSL: Cryptography and SSL/TLS toolkit,” https://www.openssl.com/, 2018, [Online; accessed 29-Jan-2019].
  * [23] Trend Micro, “Trend Micro,” https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/online-banking-trojan-brief-history-of-notable-online-banking-trojans, 2015, [Online; accessed 20-Mar-2019].
  * [24] “Trojan.Zbot,” 2016. [Online]. Available: https://www.symantec.com/security-center/writeup/2010-011016-3514-99
  * [25] Panda, “Zeus is Still the Base of Many Current Trojans,” 2017. [Online]. Available: https://www.pandasecurity.com/mediacenter/panda-security/zeus-trojan/
  * [26] R. PP, “Zeus/Zbot Trojan Attacks Credit Cards of Banks,” 2016. [Online]. Available: https://techpp.com/2010/07/15/zeuszbot-trojan-attacks-credit-cards-of-banks/
  * [27] D. Jackson, “Gozi Trojan,” 2007.
  * [28] M. Alvarez, T. Agayev, and T. Darsan, “Q1 2018 Results: Gozi (Ursnif) Takes Larger Piece of the Pie and Distributes IcedID,” 2018. [Online]. Available: https://securityintelligence.com/q1-2018-results-gozi-ursnif-takes-larger-piece-of-the-pie-and-distributes-icedid/
  * [29] E. Brumaghin, H. Unterbrink, and A. Weller, “Gozi ISFB Remains Active in 2018, Leverages "Dark Cloud" Botnet For Distribution,” 2018. [Online]. Available: https://blogs.cisco.com/security/talos/gozi-isfb-remains-active-in-2018
  * [30] M. Garnaeva, F. Sinitsyn, Y. Namestnikov, D. Makrushin, and A. Liskin, “Kaspersky Security Bulletin: Overall Statistics for 2016,” p. 31, 2016. [Online]. Available: https://kasperskycontenthub.com/securelist/files/2016/12/Kaspersky_Security_Bulletin_2016_Statistics_ENG.pdf
  * [31] A. Mohanta, A. Saldanha, and P. Kimayong, “The Gozi Sleeper Cell,” 2018.
  * [32] C. Weller, “CyberSecurity in 120 Secs_ The Comeback of Gozi Malware,” 2016\. [Online]. Available: https://blog.ensilo.com/cyber-security-in-120-secs-the-comeback-of-gozi-malware
  * [33] M.-E. M. Léveillé, “TorrentLocker,” ESET, Tech. Rep., 2014. [Online]. Available: http://www.welivesecurity.com/wp-content/uploads/2014/12/torrent_locker.pdf
  * [34] M.-E. M.Léveillé, “TorrentLocker: Crypto-ransomware still active, using same tactics,” 2016. [Online]. Available: https://www.welivesecurity.com/2016/09/01/torrentlocker-crypto-ransomware-still-active-using-tactics/
  * [35] J. M. Kambic, “Extracting CNG TLS/SSL Artifacts from LSASS Memory,” 2016.


# Entanglement trimming in stabilizer formalism

Changchun Zhong  Pritzker School of Molecular Engineering, University of
Chicago, Chicago, IL 60637, USA  Yat Wong  Pritzker School of Molecular
Engineering, University of Chicago, Chicago, IL 60637, USA  Liang Jiang
Pritzker School of Molecular Engineering, University of Chicago, Chicago, IL
60637, USA

###### Abstract

Suppose in a quantum network, there are $n$ qubits hold by Alice, Bob and
Charlie, denoted by systems $A$, $B$ and $C$, respectively. We require the
qubits to be described by a stabilizer state and assume the system $A$ is
entangled with the combined system $BC$. An interesting question to ask is
when it is possible to transfer all the entanglement to system $A$ and $B$ by
local operation on $C$ and classical communication to $AB$, namely
entanglement trimming. We find a necessary and sufficient condition and prove
constructively for this entanglement trimming, which we name it as “the bigger
man principle”. This principle is then extended to qudit with square-free
dimension and continuous variable stabilizer states.

Introduction.—Distributed quantum architecture has been recently proposed for
various quantum enhanced applications, e.g., quantum metrology, quantum
communication and quantum computation Wehner  _et al._ (2018); Sansavini and
Parigi (2020); Zhang and Zhuang (2020); Nielsen and Chuang (2002). These
quantum enhancements usually require efficiently generating and distributing
entanglement between different quantum nodes in a network through connected
quantum channels Kimble (2008). In practice, the quantum entanglement in the
network will suffer from environment noise, leading to a rapid resource decay
in time. Thus an efficient algorithm to manipulate the entanglement is
critical. To get a higher two-node entanglement, one can always resort
directly to the connected quantum channels. However, in practice the quantum
channel could be very expensive. A possible more economical resolution is to
make full use of the preexisting entanglement in the network and perform some
local operations on other nodes such that the entanglement could concentrate
to the chosen two nodes van Loock and Braunstein (2000); Zhang and Braunstein
(2006). Similar question has been raised up in Ref. Dahlberg  _et al._ (2020);
Pant  _et al._ (2019a, b), where Bell state between chosen nodes is targeted
through local operations. In this paper, we study a tripartite network by
asking the question: when and how two parties can preserve all the
entanglement if the third party is removed. This problem can be captured by a
simple model: as illustrated in Fig. 1, for a tripartite quantum system
described by a density operator $\rho^{ABC}$, whether it is possible to
locally disentangle the system $C$ while transfer the entanglement between $A$
and $BC$ to system $A$ and $B$, namely the entanglement trimming:
$\rho^{ABC}\rightarrow\tilde{\rho}^{AB}\otimes\tilde{\rho}^{C}$ with
$E(\rho^{A|BC})=E(\tilde{\rho}^{A|B})$ ($E$ is any entanglement measure).

In particular, we study the entanglement trimming of a given stabilizer state
with tri-partition using only single party Clifford operations and classical
communication. We answer the question in the positive by showing the
possibility of precisely transferring the tripartite entanglement to the
chosen two parties through local operations on the third. Unlike general
entangled states, which need exponential large number of parameters to
describe, the stabilizer states can be efficiently specified by its stabilizer
generators, e.g., only $2n^{2}$ bits are needed to describe a $n$-qubit
stabilizer state, and the state property is fully determined by its generators
Gottesman (1997, 1998a). Through exploring the stabilizer generator
structures, e.g., the canonical decomposition Fattal  _et al._ (2004), we
identity a necessary and sufficient condition for the entanglement trimming,
and we call it “the bigger man principle”—to be respectful to information
theorists and their preference of using metaphor to reveal entanglement rules,
e.g., entanglement monogamy Coffman  _et al._ (2000); Terhal (2004), and here
we refer the bigger man to Charlie (system $C$), who sacrifices himself in
ending a triangular relation and remarkably not hurting others. Although the
stabilizer states, together with Clifford operations are not enough to
demonstrate quantum advantage Gottesman (1996), they contain rather rich
quantum structures and play an essential role in the measurement based quantum
computation Raussendorf and Briegel (2001); Hein  _et al._ (2004). Thus
revealing their entanglement properties would be helpful in designing new
quantum algorithms. In this paper, we first discuss “the bigger man principle”
of entanglement trimming for qubit stabilizer states, then extend it to the
stabilizer state of general discrete and continuous variables.

Figure 1: Alice is initially entangled with the combined system hold by Bob
and Charlie. Local measurement on Charlie’s system gets him disentangled,
while all entanglement is transferred to between Alice and Bob.

Entanglement trimming for qubit stabilizer state.—The stabilizer formalism is
well known as a powerful tool in discussing a wide class of quantum error
correcting codes Gottesman (1996, 1998b) as well as analyzing the complexity
of classical simulation of quantum computations Gottesman (1997). The
stabilizer for a quantum error correcting code is an Abelian subgroup of the
Pauli group for $n$ qubits. Any state in the code is a simultaneously eigen-
state of the Abelian subgroup elements. If the subgroup has $k$ generators, it
defines an error correcting code with dimension $2^{n-k}$. When $k=n$, the
stabilizer uniquely determines a stabilizer state. Stabilizer states can be
efficiently described by their group generators, which scales only
polynomially with the number of qubits. By exploring the structure of the
group generators, many fruitful results have been achieved, such as
quantifying stabilizer state entanglement Fattal  _et al._ (2004); Audenaert
and Plenio (2005), developing the Gottesman-Knill theorem Gottesman (1998c);
Bartlett  _et al._ (2002), etc. Suppose we have a stabilizer
$S=\braket{g_{1},g_{2},...g_{n}}$ with $n$ generators, which stabilizes an
$n$-qubit state

$\rho=\frac{1}{2^{n}}\sum_{g\in S}g.$ (1)

With a partition into system $A$ and $B$ ($n_{A}+n_{B}=n$), the stabilizers in
$S$ can be divided into several subgroups $S_{AB}=\braket{g_{i}^{A}\otimes
g_{i}^{B}}_{i=1,...,\mathinner{\\!\left\lvert S_{AB}\right\rvert}}$,
$S_{A}=\braket{g_{j}^{A}\otimes I^{B}}_{j=1,...,\mathinner{\\!\left\lvert
S_{A}\right\rvert}}$ and $S_{B}=\braket{I^{A}\otimes
g_{k}^{B}}_{k=1,...,\mathinner{\\!\left\lvert S_{B}\right\rvert}}$, where
$\mathinner{\\!\left\lvert\cdot\right\rvert}$ denotes the group rank. $S_{AB}$
is responsible for the state correlation while $S_{A}$ and $S_{A}$ give the
local information. The bipartite entanglement can be obtained by calculating
the von Neumann entropy of the reduced density operator. Since Pauli operators
are trace free, we have

$\rho_{B}=\frac{1}{2^{n_{B}}}\sum_{g\in
S_{B}}g=\frac{1}{2^{n_{B}-\mathinner{\\!\left\lvert
S_{B}\right\rvert}}}\prod_{k=1}^{\mathinner{\\!\left\lvert
S_{B}\right\rvert}}\frac{I+g^{B}_{k}}{2}.$ (2)

where $\prod_{k=1}^{\mathinner{\\!\left\lvert
S_{B}\right\rvert}}\frac{I+g^{B}_{k}}{2}$ is the projection onto a subspace
with dimension $2^{n_{B}-\mathinner{\\!\left\lvert S_{B}\right\rvert}}$. The
von Neumann entropy is thus evaluated to be
$E=-\text{tr}(\rho_{B}\log_{2}\rho_{B})=n_{B}-\mathinner{\\!\left\lvert
S_{B}\right\rvert}$. Similarly, by taking partial trace over system $B$, we
can get another expression of the entanglement as
$E=n_{A}-\mathinner{\\!\left\lvert S_{A}\right\rvert}$. Since $\rho$ is a pure
state, we have $n_{A}-\mathinner{\\!\left\lvert
S_{A}\right\rvert}=n_{B}-\mathinner{\\!\left\lvert S_{B}\right\rvert}$.
Combining the fact that $\mathinner{\\!\left\lvert
S_{A}\right\rvert}+\mathinner{\\!\left\lvert
S_{B}\right\rvert}+\mathinner{\\!\left\lvert S_{AB}\right\rvert}=n$, it is
easy to get that the entanglement $E={\mathinner{\\!\left\lvert
S_{AB}\right\rvert}}/{2}$, where we see that the number of generators for the
subgroup $S_{AB}$ determines the entanglement. It is in this sense that the
generators for $S_{AB}$ are called correlated, while the generators for
$S_{A}$ and $S_{B}$ are named local.

######  Lemma 1.

—Canonical decomposition of generators for qubit: the generator
$S=\braket{g_{1},g_{2},...,g_{n}}$ for $n$-qubit stabilizer state of any bi-
partition $A|B$ can always be brought into the canonical form:
$S=\braket{a_{i}\otimes I_{B},I_{A}\otimes b_{j},g_{k}^{A}\otimes
g_{k}^{B},\bar{g}_{k}^{A}\otimes\bar{g}_{k}^{B}}$, where the first two subsets
generate $S_{A}$ and $S_{B}$, and the last two sets generate $S_{AB}$,
responsible for correlation. The generators of $S_{AB}$ collect into
$E=\mathinner{\\!\left\lvert S_{AB}\right\rvert}/2$ pairs $\\{g_{k}\equiv
g_{k}^{A}\otimes
g_{k}^{B},\bar{g}_{k}\equiv\bar{g}_{k}^{A}\otimes\bar{g}_{k}^{B}\\}$, where
the opeartor $g_{k}^{A}$ $(g_{k}^{B})$ commutes with all canonical generators
of $S$ except $\bar{g}_{k}$, while the operator $\bar{g}_{k}^{A}$
$(\bar{g}_{k}^{B})$ commutes with all generators in $S$ except $g_{k}$—we
define this property as exclusive commutation relation.

The proof of this lemma is first given in Ref. Fattal  _et al._ (2004), later
we will generalize the result to qudit with prime dimension and continuous
variable stabilizer state. It is worth mentioning that identifying the
canonical form of a given stabilizer can be done efficiently, which scales
polynomially in the number of qubits Fattal  _et al._ (2004); Audenaert and
Plenio (2005). This lemma gives us an easy way of getting the bi-partite
entanglement by counting the $E$ correlated pairs. More importantly it allows
us to identify the set of stabilizer states that are possible for entanglement
trimming and also gives us a constructive way to realize it.

Suppose the $n$-qubit stabilizer state, stabilized by
$S=\braket{g_{1},g_{2},...g_{n}}$, is hold by three parties $A$, $B$ and $C$.
If taking the partition $AB|C$ (group $AB$ together), then according to lemma
1, we can bring the stabilizer generators into the canonical form,

$S=\braket{a_{i}^{AB}\otimes I^{C},I^{AB}\otimes b_{j}^{C},g_{k}^{AB}\otimes
g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}},$ (3)

where the last two sets of generators determine the $AB|C$ entanglement.

######  Theorem 1.

—the bigger man principle for qubit stabilizer state: given a general
$n$-qubit stabilizer state $\rho^{ABC}$ stabilized by Eq. (3), the $A|BC$
entanglement can be transferred to $A|B$ by local operations on $C$ if and
only if, (1) for any given $k$, one of its paired generators
$\\{g_{k}^{AB}\otimes g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}\\}$ can
be expressed as local operator in terms of $A|BC$, e.g.,
$g_{k}^{AB}g_{k}^{C}=I^{A}g_{k}^{B}g_{k}^{C}$, or (2) even number of pairs of
correlated generators can be expressed in the form, e.g.,
$\\{I^{A}g_{k^{\prime}}^{B}\otimes
g_{k^{\prime}}^{C},I^{A}\bar{g}_{k^{\prime}}^{B}\otimes\bar{g}_{k^{\prime}}^{C}\\}$
and $\\{{g}_{k}^{A}I^{B}\otimes
g_{k}^{C},\bar{g}_{k}^{A}I^{B}\otimes\bar{g}_{k}^{C}\\}$.

###### Proof.

If part: Suppose we have $\bar{g}^{AB}_{k}=I^{A}\otimes\bar{g}^{B}_{k}$ for
any $k$ satisfying condition (1), the initial stabilizer is

$S_{i}=\braket{a_{i}^{AB}\otimes I^{C},I^{AB}\otimes
b_{j}^{C},g_{k}^{AB}\otimes
g_{k}^{C},I^{A}\bar{g}_{k}^{B}\otimes\bar{g}_{k}^{C}}.$ (4)

To do entanglement trimming, we need to disentangle $C$ from the whole system.
It can be realized by local measurement on $C$. Noticing the operator
$g^{C}_{k}$ commutes all generator in $S_{i}$ except
$I^{A}\bar{g}^{B}_{k}\otimes\bar{g}^{C}_{k}$, we thus can measure $g^{C}_{k}$,
and a renewed stabilizer can be obtained (assuming measurement result $+1$ in
all later discussions)

$S_{f}=\braket{a_{i}^{AB}\otimes I^{C},I^{AB}\otimes
b_{j}^{C},g_{k}^{AB}\otimes I^{C},I^{AB}\otimes g_{k}^{C}},$ (5)

where we see system $C$ becomes separable with $AB$ and the $A|B$ entanglement
$E_{f}(A|B)$ is totally determined by those generators
$\\{a_{i}^{AB},g_{k}^{AB}\\}$. Also, we know the $A|BC$ entanglement
$E_{i}(A|BC)$ in $S_{i}$ is captured by the generators $\\{a_{i}^{AB}\otimes
I^{C},g_{k}^{AB}\otimes g_{k}^{C}\\}$ sno . Obviously, we have
$E_{i}(A|BC)=E_{f}(A|B)$.

If $S_{i}$ has some generators in the form of condition (2), the generator
pairs can be rewritten as
$\\{I^{A}g_{k^{\prime}}^{B}\otimes{g}_{k^{\prime}}^{C},\bar{g}_{k}^{A}\bar{g}_{k^{\prime}}^{B}\otimes\bar{g}_{k}^{C}\bar{g}_{k^{\prime}}^{C}\\}$
and
$\\{I^{A}\bar{g}_{k^{\prime}}^{B}\otimes\bar{g}_{k^{\prime}}^{C},g_{k}^{A}g_{k^{\prime}}^{B}\otimes
g_{k}^{C}g_{k^{\prime}}^{C}\\}$, where we see, in each new paired generators,
one is in the $A|BC$ local form. Condition (2) is thus reduced to the form of
condition (1) with the only difference that the first generators in each new
pair do not satisfy the exclusive commutation relation, specifically,
$[I^{A}g^{B}_{k^{\prime}},I^{A}\bar{g}^{B}_{k^{\prime}}]\neq 0$. Luckily,
commutation of the two operators is not required since we can perform similar
measurements on $C$, e.g., the operators
$\bar{g}_{k}^{C}\bar{g}_{k^{\prime}}^{C}$, ${g}_{k}^{C}{g}_{k^{\prime}}^{C}$,
to disentangle $C$, realizing the required entanglement trimming. This fact
also applies in the following “only if” proof.

Only if part: We first transform the stabilizer state into a product of un-
entangled qubit states in system $C$ and a state with the remaining qubits
maximally entangled with $AB$. As shown in the supplement sup , this
transformation can be accomplished by local Clifford gates on $C$ only, which
obviously don’t change entanglement. Thus we write down the stabilizer in a
simpler canonical form (neglecting those unentangled qubits, $C$ is maximally
entangled with $AB$)

$S_{i}=\braket{a_{i}^{AB}\otimes I^{C},g_{k}^{AB}\otimes
g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}}.$ (6)

We then need to perform measurement on system $C$. If not commuting all
generators in $S_{i}$, a Pauli measurement operator can always be made anti-
commuting with only one generator in $S_{i}$ Nielsen and Chuang (2002). Let’s
first assume the operator $g^{C}_{k=1}$ is measured on $C$, which only anti-
commutes the generator $\bar{g}^{AB}_{1}\otimes\bar{g}^{C}_{1}$. The
measurement leads to a generator replacement
$\bar{g}^{AB}_{1}\otimes\bar{g}^{C}_{1}\rightarrow I^{AB}\otimes g^{C}_{1}$,
where the new generator is local in terms of $AB|C$ (making $C$ not maximally
entangled again) and can be similarly removed by local Clifford operations on
$C$. Then Up to a generator multiplication, a new stabilizer can be obtained
$\braket{a_{i}^{AB}\otimes I^{C},g_{1}^{AB}\otimes I^{C},g_{k}^{AB}\otimes
g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}}_{k\neq 1}$ nob . This
process can be repeated for all $k$ until we totally separate the system $C$

$S_{f}=\braket{a_{i}^{AB}\otimes I^{C},g_{k}^{AB}\otimes I^{C}}.$ (7)

Comparing $S_{i}$ and $S_{f}$, it is obvious
$\bar{g}^{AB}_{k}=I^{A}\bar{g}^{B}_{k}$ is needed for the equivalence
$E_{i}(A|BC)=E_{f}(A|B)$.

Now a question to ask is whether a better Pauli measurement than $g^{C}_{k}$
exists. We now show the answer is negative. Let’s assume a Pauli operator
$p^{C}_{1}\neq g^{C}_{k=1}$ which only anti-commutes
$\bar{g}^{AB}_{1}\otimes\bar{g}^{C}_{1}$ in $S_{i}$. The $p^{C}_{1}$
measurement and similar procedure yield a stabilizer
$\braket{a_{i}^{AB}\otimes I^{C},g_{1}^{AB}\otimes
g_{1}^{C}p_{1}^{C},g_{k}^{AB}\otimes
g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}}_{k\neq 1}$, where
$g^{C}_{1}p^{C}_{1}$ is not identity. Nevertheless, up to a correlated
generator multiplication, the transform $g_{1}^{AB}\otimes
g^{C}_{1}p^{C}_{1}\rightarrow\tilde{g}_{1}^{AB}\otimes I^{C}$ must exists
since the correlated generators must be paired in the canonical form sup .
However, $\tilde{g}_{1}^{AB}$ is not guaranteed to be in a correlated form in
terms of $A|B$, e.g., we might have
$\tilde{g}_{1}^{AB}=I^{A}\tilde{g}^{B}_{1}$, reducing the entanglement that
can be trimmed to $A|B$. ∎

To better convey the idea, we now show some examples. First, for a GHZ state,
stabilized by the generators
$S=\braket{Z_{A}Z_{B}I_{C},I_{A}Z_{B}Z_{C},X_{A}X_{B}X_{C}}$, each party holds
one of the three qubits. The entanglement is $1$ ebit between $A$ and $BC$.
After a measurement of operator $I_{A}I_{B}X_{C}$, which anti-commutes
$I_{A}Z_{B}Z_{C}$ and commutes with other generators in $S$, (also assuming
$+1$ eigenvalue is obtained), we get a renewed stabilizer
$S^{\prime}=\braket{Z_{A}Z_{B}I_{C},I_{A}I_{B}X_{C},{X_{A}X_{B}I_{C}}}$, where
we see that $C$ is disentangled, and $A|B$ inherits the $1$ ebit entanglement
from $A$ and $BC$. This is possible since we initially have a generator
$I_{A}Z_{B}Z_{C}$, satisfying the trimming condition. Notice the GHZ state has
a symmetric structure, which means we can perform measurement on any one of
the three parties and preserve the entanglement in the remaining two. As a
second example, for a tripartite four-qubit state with stabilizer
$S=\braket{X_{A}I_{B}X_{C}I_{C},Z_{A}I_{B}Z_{C}I_{C},I_{A}Z_{B}I_{C}Z_{C},I_{A}X_{B}I_{C}X_{C}}$,
where $A|BC$ is entangled with $1$ ebit, and the two pairs
$\\{X_{A}I_{B},Z_{A}I_{B}\\}$ and $\\{I_{A}X_{B},I_{A}Z_{B}\\}$ satisfy
entanglement trimming condition (2). Thus we can rewrite the stabilizer
$S=\braket{X_{A}Z_{B}X_{C}Z_{C},I_{A}X_{B}I_{C}X_{C},Z_{A}X_{B}Z_{C}X_{C},I_{A}Z_{B}I_{C}Z_{C}}$.
After the Pauli measurements, we disentangle the system $C$ and get a
stabilizer state for $A|B$, stabilized by $\braket{X_{A}Z_{B},Z_{A}X_{B}}$
preserving the $1$ ebit entanglement.

Qudit entanglement trimming.—The bigger man principle can be extended to qudit
stabilizer states. Analogously, one can define an $n$-qudit stabilizer state
as

$\rho=\frac{1}{D^{n}}\sum_{g\in S}g,$ (8)

where $D$ is the qudit dimension, the stabilizer $S=\braket{g_{1},g_{2},...}$
and $g_{i}$ is a generalized Pauli generators for $n$ qudits Hostens  _et al._
(2005); Hayashi (2017a, b). For any generalized Pauli group defined on $n$
qudits, the group elements satisfy the relation
$g_{i}g_{j}=g_{j}g_{i}\omega^{\lambda_{ij}}$, where $\omega=e^{i2\pi/D}$ and
$\lambda_{ij}$ is an integer in a ring $Z_{D}$. Equation (8) represents a
stabilizer state since we have $S\rho=\rho$, and obviously it respects the
condition tr$\rho=1$. In qubit case, whenever the number of stabilizer
generator equals the number of qubits, its stabilizer state will be a pure
state. However, for qudits, it is different since in general we have
$tr\rho^{2}=\frac{\|S\|}{D^{n}}$, where the symbol $\|\cdot\|$ denotes the
group size (note we use $\mathinner{\\!\left\lvert\cdot\right\rvert}$ for
group rank). We see that $tr\rho^{2}=1$ if and only if $\|S\|=D^{n}$. In
general for qudit, the size of a group with $n$ generators is not equal to
$D^{n}$. Actually we have $\|S\|=\prod_{i}^{n}O_{i}\leq D^{n}$, where $O_{i}$
is the order of the group generator $g_{i}$ and it takes the value of either
$D$ or the division of $D$. Obviously, a sufficient condition for $\rho$ to be
pure is $D$ being a prime number, while for general $D$, $\rho$ defined by Eq.
(8) with only $n$ generators is a mixed state qud ; Hayashi (2017b); Gheorghiu
(2014); Hostens  _et al._ (2005). To have a pure state, we confine the
discussion to prime dimension (later, we will extend the discussion to
composite square free dimension eno ). Similar to the qubit case, to evaluate
the entanglement, we take the partition $A|B$ with $n_{A}+n_{B}=n$. The
stabilizer is decomposed into the local subgroups
$S_{A}=\braket{g_{i}^{A}\otimes I^{B}}_{i=1,...,\mathinner{\\!\left\lvert
S_{A}\right\rvert}}$, $S_{B}=\braket{I^{A}\otimes
g_{j}^{B}}_{j=1,...,\mathinner{\\!\left\lvert S_{B}\right\rvert}}$ and the
correlated subgroup $S_{AB}=\braket{g_{k}^{A}\otimes
g_{k}^{B}}_{k=1,...,\mathinner{\\!\left\lvert S_{AB}\right\rvert}}$ with
$\mathinner{\\!\left\lvert S_{A}\right\rvert}+\mathinner{\\!\left\lvert
S_{B}\right\rvert}+\mathinner{\\!\left\lvert S_{AB}\right\rvert}=n$. By
tracing out the sytem $A$, we have a reduced density matrix

$\rho_{B}=\frac{1}{D^{n_{B}}}\sum_{g\in S_{B}}g.$ (9)

Noticing $\frac{1}{\|{S_{B}}\|}\sum_{g\in S_{B}}g$ is a projector onto the
subspace with dimension $D^{n_{B}}/||S_{B}||$, the von Neumann entropy is thus
evaluated to be $E=n_{B}\log_{2}D-\log_{2}\|{S_{B}}\|$. Since $\rho$ is pure,
we also have $E=n_{A}\log_{2}D-\log_{2}\|{S_{A}}\|$ by tracing over system
$B$. Combining the two expressions, we find $E=\frac{1}{2}\log_{2}\|S_{AB}\|$.
Notice $D$ is prime, the entanglement further takes the form
$E=\frac{1}{2}\mathinner{\\!\left\lvert S_{AB}\right\rvert}\log_{2}D$,
obviously reducing to the qubit case when $D=2$. The result indicates the
bipartite entanglement of a qudit stabilizer state is also determined by the
number of correlated generators in the stabilizer group.

######  Lemma 2.

—Canonical decomposition for qudit: Denote a stabilizer
$S=\braket{g_{1},g_{2},...,g_{n}}$ with $n$ generators for a pure $n$-qudit
stabilizer state, then for any bi-partition $A|B$, its generators can always
be brought into the canonical form:

$S=\braket{a_{i}\otimes I_{B},I_{A}\otimes b_{j},g_{k}^{A}\otimes
g_{k}^{B},\bar{g}_{k}^{A}\otimes\bar{g}_{k}^{B}}$ (10)

where the first two subsets generate $S_{A}$ and $S_{B}$, responsible for
local information, and the last two generate $S_{AB}$, responsible for
correlation. The generators of $S_{AB}$ collect into
$E=\mathinner{\\!\left\lvert S_{AB}\right\rvert}/2$ pairs
$\\{g_{k}=g_{k}^{A}\otimes
g_{k}^{B},\bar{g}_{k}=\bar{g}_{k}^{A}\otimes\bar{g}_{k}^{B}\\}$, where
$g_{k}^{A}$ $(g_{k}^{B})$ commutes with all canonical generators of $S$ except
$\bar{g}_{k}$, and $\bar{g}_{k}^{A}$ $(\bar{g}_{k}^{B})$ commutes with all
canonical generators of $S$ except $g_{k}$.

As in the qubit case Fattal  _et al._ (2004), the proof of this lemma explores
the transformation of group generators, and the detail is given in the
supplementary material sup . By analyzing the correlated generators in the
decomposition, it turns out that a similar entanglement trimming theorem as in
qubit case can be constructed in a similar way. The differences are: when we
perform a generalized Pauli measurement, the result could be
$\omega^{\lambda}$ with $\lambda=0,1,...,D-1$, and we should replace the
stabilizer elements accordingly Gottesman (1998a); the generalized Pauli
generators satisfy $g^{D}=I$, which requires us to take the multiplication
several times to get identity operator when we renew the generators. We
summarize the theorem in the following:

######  Theorem 2.

—the bigger man principle for qudit stabilizer state: given an $n$-qudit
stabilizer state with tri-partition $\rho^{ABC}$, and its stabilizer
generators are in the canonical form $S=\braket{a_{i}^{AB}\otimes
I^{C},I^{AB}\otimes b_{j}^{C},g_{k}^{AB}\otimes
g_{k}^{C},\bar{g}_{k}^{AB}\otimes\bar{g}_{k}^{C}}$. The $A|BC$ entanglement
can be reduced to $A|B$ by local $C$ measurement if and only if, (1) for given
$k$, one of the paired operators is local, e.g., $g_{k}^{AB}=I^{A}g_{k}^{B}$,
or (2) there are pairs of operators in the form, e.g.,
$\\{I^{A}g_{k}^{B}\otimes
g_{k}^{C},I^{A}\bar{g}_{k}^{B}\otimes\bar{g}_{k}^{C},g^{A}_{k^{\prime}}I^{B}\otimes
g_{k^{\prime}}^{C},\bar{g}^{A}_{k^{\prime}}I^{B}\otimes\bar{g}_{k^{\prime}}^{C}\\}$.

Besides qudit with prime dimension, the bigger man principle can be applied to
qudit stabilizer states with composite square-free dimension, which is a
direct result of the Chinese remainder isomorphism. As first discussed in Ref.
Looi and Griffiths (2011), any qudit stabilizer state of composite dimension
can be decomposed into tensor product of several stabilizer states with prime
power dimension. Thus for a square-free dimensional stabilizer state, the
entanglement trimming can still be done within the above formalism if each
component in the tensor product satisfies the trimming condition. Interesting,
when the condition is not satisfied, the entanglement trimming is still
possible but can no longer be described by stabilizer formalism (see Ref. sup
for more details). Furthermore, the principle is also true for continuous
variable stabilizer state. As an extension of discrete variable Pauli group,
the generalized Pauli group for continuous variables is called Heisenberg-Weyl
(HW) group, composed of all phase space displacements Barnes (2004); Kok and
Lovett (2010). Interestingly, one can build up a correspondence between the HW
group and a symplectic vector space, and each group element is represented by
a symplectic vector. Moreover, an Abelian subgroup corresponds to a vector
subspace with all elements being symplectic orthogonal, which defines a
Lagrangian plane De Gosson (2006). This vector subspace, rather than the
commuting displacement operators, enables us to concisely formulate the
canonical decomposition of continuous variable stabilizer generators. Detailed
in the supplement sup , we show that the vector subspace also wears a
canonical form, with which continuous variable bigger man principle can be
established.

Outlook.—There are several interesting questions to be answered in the future.
First, we studied the tripartite entanglement trimming in this paper, it would
be worthwhile to explore the trimming condition for more parties, which is
more practical in real quantum networks. Also, The principle we discussed is
based on pure stabilizer states. While interesting as it is, we might often
encounter mixed entangled state. In fact, we can define a mixed stabilizer
state similarly Audenaert and Plenio (2005). As we mentioned before, the
stabilizer state defined in Eq. (1), or Eq. (8) will be mixed when the number
of generator is not chosen properly compared to the number of qubits (qudits).
In these cases, the same canonical decomposition of the stabilizer generators
can be obtained, and we can claim a same “bigger man principle” if we only
require von Neumann entropy to be equal before and after the local opeartion
on system $C$. However, since the von Neumann entropy for the reduced density
operator of a mixed state can’t faithfully measure the entanglement, it could
be more involving to get a similar “bigger man principle”, e.g., possibly
introducing other mixed state entanglement measure Bennett  _et al._ (1996),
which is an interesting and important research topic. Furthermore, the
stabilizer state, although significant in the quantum application, forms only
a subset of all quantum states. The search for the bigger man principle of
general entangled state should be an exciting work to do in the future.

###### Acknowledgements.

C.Z. thanks Filip Rozpedek and Wenlong Ma for helpful discussions. We
acknowledge support from the ARO (W911NF-18-1-0020, W911NF-18-1-0212), ARO
MURI (W911NF-16-1-0349), AFOSR MURI (FA9550-19-1-0399), NSF (EFMA-1640959,
OMA-1936118, EEC-1941583), NTT Research, and the Packard Foundation
(2013-39273).

## References

  * Wehner  _et al._ (2018) S. Wehner, D. Elkouss, and R. Hanson, Science 362 (2018).
  * Sansavini and Parigi (2020) F. Sansavini and V. Parigi, Entropy 22, 26 (2020).
  * Zhang and Zhuang (2020) Z. Zhang and Q. Zhuang, arXiv preprint arXiv:2010.14744 (2020).
  * Nielsen and Chuang (2002) M. A. Nielsen and I. Chuang, “Quantum computation and quantum information,” (2002).
  * Kimble (2008) H. J. Kimble, Nature 453, 1023 (2008).
  * van Loock and Braunstein (2000) P. van Loock and S. L. Braunstein, Phys. Rev. Lett. 84, 3482 (2000).
  * Zhang and Braunstein (2006) J. Zhang and S. L. Braunstein, Phys. Rev. A 73, 032318 (2006).
  * Dahlberg  _et al._ (2020) A. Dahlberg, J. Helsen, and S. Wehner, Quantum 4, 348 (2020).
  * Pant  _et al._ (2019a) M. Pant, H. Krovi, D. Towsley, L. Tassiulas, L. Jiang, P. Basu, D. Englund, and S. Guha, npj Quantum Information 5, 1 (2019a).
  * Pant  _et al._ (2019b) M. Pant, D. Towsley, D. Englund, and S. Guha, Nature communications 10, 1 (2019b).
  * Gottesman (1997) D. Gottesman, arXiv preprint quant-ph/9705052 (1997).
  * Gottesman (1998a) D. Gottesman, in  _NASA International Conference on Quantum Computing and Quantum Communications_ (Springer, 1998) pp. 302–313.
  * Fattal  _et al._ (2004) D. Fattal, T. S. Cubitt, Y. Yamamoto, S. Bravyi, and I. L. Chuang, arXiv preprint quant-ph/0406168 (2004).
  * Coffman  _et al._ (2000) V. Coffman, J. Kundu, and W. K. Wootters, Phys. Rev. A 61, 052306 (2000).
  * Terhal (2004) B. M. Terhal, IBM Journal of Research and Development 48, 71 (2004).
  * Gottesman (1996) D. Gottesman, Phys. Rev. A 54, 1862 (1996).
  * Raussendorf and Briegel (2001) R. Raussendorf and H. J. Briegel, Phys. Rev. Lett. 86, 5188 (2001).
  * Hein  _et al._ (2004) M. Hein, J. Eisert, and H. J. Briegel, Phys. Rev. A 69, 062311 (2004).
  * Gottesman (1998b) D. Gottesman, Phys. Rev. A 57, 127 (1998b).
  * Audenaert and Plenio (2005) K. M. Audenaert and M. B. Plenio, New Journal of Physics 7, 170 (2005).
  * Gottesman (1998c) D. Gottesman, arXiv preprint quant-ph/9807006 (1998c).
  * Bartlett  _et al._ (2002) S. D. Bartlett, B. C. Sanders, S. L. Braunstein, and K. Nemoto, Phys. Rev. Lett. 88, 097904 (2002).
  * (23) The operator $g^{AB}_{k}$ can’t take the form $g^{A}_{k}\otimes I^{B}$ since it should anti-commute with $\bar{g}^{AB}_{k}=I^{A}\otimes\bar{g}^{B}_{k}$ due to the exclusive commutation relation.
  * (24) See the supplementary material for the discussion of isolating unentangled qudits in a bipartition, the proof of lemma 2 and the discussions of entanglement trimming for square-free dimensional stabilizer state, and continuous variable stabilizer states.
  * (25) Rigorously speaking, all generators must be renewed by the local Clifford gates on $C$. Since they don’t change the stabilizer structures, we just use the same symbols for simplicity.
  * Hostens  _et al._ (2005) E. Hostens, J. Dehaene, and B. De Moor, Phys. Rev. A 71, 042315 (2005).
  * Hayashi (2017a) M. Hayashi,  _A Group Theoretic Approach to Quantum Information_ (Springer, 2017).
  * Hayashi (2017b) M. Hayashi,  _Group representation for quantum theory_ (Springer, 2017).
  * (29) Depending on the number of generators and the qudit dimension, the stabilizer state could be mixed or pure. In this letter, we focus on pure stabilizer state.
  * Gheorghiu (2014) V. Gheorghiu, Physics Letters A 378, 505 (2014).
  * (31) For qudit with composite dimension, one need to introduce more than $n$ generators to defined an $n$-qudit pure stabilizer state.
  * Looi and Griffiths (2011) S. Y. Looi and R. B. Griffiths, Phys. Rev. A 84, 052306 (2011).
  * Barnes (2004) R. L. Barnes, arXiv preprint quant-ph/0405064 (2004).
  * Kok and Lovett (2010) P. Kok and B. W. Lovett,  _Introduction to optical quantum information processing_ (Cambridge university press, 2010).
  * De Gosson (2006) M. A. De Gosson,  _Symplectic geometry and quantum mechanics_ , Vol. 166 (Springer Science & Business Media, 2006).
  * Bennett  _et al._ (1996) C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters, Phys. Rev. A 54, 3824 (1996).
  * Gottesman  _et al._ (2001) D. Gottesman, A. Kitaev, and J. Preskill, Phys. Rev. A 64, 012310 (2001).
  * Harrington and Preskill (2001) J. Harrington and J. Preskill, Phys. Rev. A 64, 062301 (2001).
  * Zhang  _et al._ (2009) J. Zhang, G. He, and G. Zeng, Phys. Rev. A 80, 052333 (2009).

## Supplementary material for “Entanglement trimming in stabilizer formalism”

##  Appendix A The qudit stabilizer formalism

###  A.1 Generalized Pauli group for qudit

The Pauli group defined on qubits plays a vital role in quantum error
correction. Here we briefly review the generalization to qudits with dimension
$D$. The qubit case is thus just a special case when $D=2$. The Pauli $X$ and
$Z$ operator defined on a qudit with $D$ dimension is given by

$X=\sum_{j=0}^{D-1}\ket{j}\bra{j+1},Z=\sum_{j}\omega^{j}\ket{j}\bra{j}$ (11)

with $\omega=\exp(i2\pi/D)$ and the arithmetic is defined on a modular $D$
ring. Obviously we have $X^{D}=Z^{D}=I$ and $XZ=\omega ZX$. For $n$ qudits, we
can define a Pauli product

$p(\bm{v})=\omega^{\lambda/2}X_{1}^{x_{1}}Z_{1}^{z_{1}}...X_{n}^{x_{n}}Z_{n}^{z_{n}},$
(12)

where $\bm{v}=\\{x_{1},x_{2},...;z_{1},z_{2}...\\}$ is a $2n$ dimensional
vector and $\lambda\in Z_{2D}$. The collection of all possible Pauli products
forms a generalized Pauli group $P_{n}$. For each $p\in P_{n}$, we have
$p^{D}=I,-I$. It is well known that $-I$ is excluded in any stabilizer code,
so only the Pauli product with $P^{D}=I$ will be included in later
discussions. As a remark, when $D$ is prime, the vector representation of the
Pauli product corresponds to a symplectic vector space on the field $Z_{D}$,
which provides us a powerful tool to study the generalized Pauli group. In the
later section, we give more discussions on Heisenberg-Weyl group in the
symplectic space formalism.

###  A.2 Qudit Clifford gates

The qudit Fourier gate is a generalization of the Hadamard gate, given by

$F=\frac{1}{\sqrt{D}}\sum_{j=0}^{D-1}\omega^{jk}\ket{j}\bra{k},$ (13)

which satisfies

$FZF^{\dagger}=X,FXF^{\dagger}=Z^{-1}.$ (14)

A multiplicative gate $Q^{\alpha}$ can be defined for an invertible integer
$\alpha\in Z_{D}$

$Q^{\alpha}=\sum_{j=0}^{D-1}\ket{j}\bra{\alpha j},$ (15)

with the relation

$Q^{\alpha}Z{Q^{\alpha}}^{\dagger}=Z^{\alpha},Q^{\alpha}X{Q^{\alpha}}^{\dagger}=X^{\bar{\alpha}},$
(16)

where $\bar{\alpha}$ is the inverse of $\alpha$ in $Z_{D}$. For qubit case
with $D=2$, $\alpha=1$ is the only invertible integer and $Q^{\alpha=1}$ is
just an identity operator.

A phase gate for qudit is defined according to the dimension $D$ being even or
odd

$\begin{split}W_{\text{even}}&=\sum_{j=1}^{D-1}\omega^{-j(j+2)/2}\ket{j}\bra{j},\\\
W_{\text{odd}}&=\sum_{j=1}^{D-1}\omega^{-j(j+1)/2}\ket{j}\bra{j},\end{split}$
(17)

which satisfy

$WZW^{\dagger}=Z,WXW^{\dagger}=XZ$ (18)

for $D$ being odd, and

$WZW^{\dagger}=Z,WXW^{\dagger}=\omega^{1/2}XZ$ (19)

for $D$ being even.

The two-qudit gates include the control-Z (C-Phase) and control-X (CNOT)

$\begin{split}CZ&=\sum_{j=0}^{D-1}\ket{j}\bra{j}_{1}\otimes Z_{2}^{j},\\\
CX&=\sum_{j=0}^{D-1}\ket{j}\bra{j}_{1}\otimes X_{2}^{j}.\end{split}$ (20)

The two gates are related by a Fourier gate on the second qudit
$CX=(I_{1}\otimes F_{2})CZ(I_{1}\otimes F_{2})^{\dagger}$. The CNOT gate
satisfies

$\begin{split}CX(I_{1}\otimes Z_{2})CX^{\dagger}&=Z_{1}Z_{2},\\\
CX(Z_{1}\otimes I_{2})CX^{\dagger}&=Z_{1}I_{2},\\\ CX(I_{1}\otimes
X_{2})CX^{\dagger}&=I_{1}X_{2},\\\ CX(X_{1}\otimes
I_{2})CX^{\dagger}&=X_{1}X^{-1}_{2}\end{split}$ (21)

###  A.3 Tripartite stabilizer state

As described in the main text, a $n$-qudit stabilizer state is defined as

$\rho=\frac{1}{D^{n}}\sum_{g\in S}g,$ (22)

where $S$ is the set of stabilizers. For a prime $D$, we could have exactly
$n$ generators, and they can be written in the form

$\begin{split}S&=\braket{g_{1},g_{2},...,g_{n}}\\\ &=\braket{a_{i}^{AB}\otimes
I^{C},I^{AB}\otimes b_{j}^{C},c^{AB}_{k}\otimes c^{C}_{k}},\end{split}$ (23)

with the partition $AB|C$. The first two sets generate the local group
$S_{AB},S_{C}$, while the last sets determines the correlated group
$S_{AB|C}$. The generators can be further simplified without changing the
entanglement. To show that, the following theorem is needed.

######  Theorem 3.

Given any stabilizer generator $p(\bm{v})$ (except the one with identity on
the first qudit) on $n$ qudits with prime dimension, it is possible to have a
Clifford unitary transformation $U$, such that

$Up(\bm{v})U^{\dagger}=X_{1}I_{2}I_{3}...I_{n}$ (24)

This theorem is discussed in Ref. Nielsen and Chuang (2002); Looi and
Griffiths (2011). We give the proof of this theorem here for the purpose of
completeness.

###### Proof.

Given a stabilizer generator in the form
$p(\bm{v})=e^{i\phi}X_{1}^{x_{1}}Z_{1}^{z_{1}}...X_{n}^{x_{n}}Z_{n}^{z_{n}}$,
satisfying $p^{D}=I$. Knowing the first qudit is not identity, the following
transformation for the first qudit can be made:
$X_{1}^{x_{1}}Z_{1}^{z_{1}}\xrightarrow{\text{W
gates}}X_{1}^{x_{1}}\xrightarrow{Q^{\alpha}\text{gates}}X_{1}.$ Note if
initially $x_{1}=0$, we can apply Fourier gate to the first qudit such that
$x_{1}$ becomes nonzero. The above procedure can be repeated for all other
qudits if they are not identity already. Then we will get a result
$X_{1}X_{2}...X_{n}$. The last step is to apply CNOT gate with first qudit as
control until we get $X_{1}I_{1}...I_{n}$. Note there might be a phase factor
which can always compensated by applying $Z$ gates. Collecting all gates used
gives us the Clifford unitary $U$ for the transformation. ∎

This theorem can be directly used to locally transform the stabilizer state in
Eq. (23). For example, given the local generator $I^{AB}\otimes b^{C}_{j}$
with any $j$, local Cliffords on $C$ can transform it to
$I^{AB}\otimes(I...IX)^{C}$. Notice these local Clifford gates will also
change other generators, but no matter how they change, the operator
corresponding to the last qudit will either be $I$ or $X$, since all
generators must commute. By generator multiplication, the last qudit can be
shown as separated $S=\braket{a_{i}^{AB}\otimes
I^{C},I^{AB}\otimes\tilde{b}_{j}^{C},c^{AB}_{k}\otimes\tilde{c}^{C}_{k}}\otimes\braket{X}$,
where we use $\tilde{b},\tilde{c}$ to denote the difference upon the
transformation. Notice the number of local generators in
$I^{AB}\otimes\tilde{b}^{C}_{j}$ is now reduced by one. This process can be
done repeatedly until the local generators are all separated

$S=\braket{a_{i}^{AB}\otimes
I^{C},c^{AB}_{k}\otimes\tilde{c}^{C}_{k}}\otimes\braket{X_{1}X_{2}...},$ (25)

where the generators in the first braket actually defines a new stabilizer
state with the system $C$ maximally entangled with $AB$. Since separable
qudits doesn’t affect the entanglement, the new stabilizer state can be used
to study the entanglement structure, as we did in the main text.

##  Appendix B Entanglement trimming for square-free dimensional qudits
stabilizer state

As indicated in Ref. Looi and Griffiths (2011), any stabilizer states defined
on square-free dimensional qudits can be further decomposed to tensor product
of stabilizer states with prime dimension. Specifically, for a stabilizer
state $\ket{\Psi}$ with the qudit dimension $D=d_{1}d_{2}...d_{i}...$, we have

$\ket{\Psi}=\ket{\psi_{1}}\otimes\ket{\psi_{2}}\otimes...\ket{\psi_{i}}...,$
(26)

where $\ket{\psi_{i}}$ are decomposed stabilizer states with prime dimension
$d_{i}$. Thus for each state $\ket{\psi_{i}}$, the corresponding stabilizer
generators could have a canonical form in terms of any bipartition. This means
for any tripartition of the state $\ket{\Psi}^{ABC}$, we can first do
entanglement trimming within each decomposed stabilizer state
$\ket{\psi_{i}}^{ABC}$. If the entanglement trimming principle is satisfied
for each state, then all $A|BC$ entanglement can be preserved in the system
$AB$ while separating the system $C$.

The situation is more subtle when the condition is violated for some
stabilizer states in the tensor product. It might be still possible to realize
the entanglement trimming, but non-Clifford operations would be needed, which
is out of the range of stabilizer formalism. Although it is not the focus of
current paper, we still illustrate it by a simple example: given a three-qudit
($D=6$) stabilizer state, the stabilizer generator is given by

$S=\braket{X_{A}I_{B}Z_{C}^{3},I_{A}X_{B}Z_{C}^{2},Z_{A}^{3}Z_{B}^{2}X_{C}}_{\text{qudit}}.$
(27)

Since $D=2\times 3$, the above state can be decomposed into a three-qubit and
a three-qutrit stabilizer states. Using the mapping:

$\begin{split}&X_{D=6}\rightarrow X_{d_{1}=2}\otimes X_{d_{2}=3},\\\
&Z_{D=6}\rightarrow Z^{r_{1}}_{d_{1}=2}\otimes
Z^{r_{2}}_{d_{2}=3},r_{i}=\frac{D}{d_{i}}\text{ mod }d_{i},\end{split}$ (28)

we can write down their stabilizer generators as

$\begin{split}S=&\braket{X_{A}I_{B}Z_{C},I_{A}X_{B}I_{C},Z_{A}I_{B}X_{C}}_{\text{qubit}}\\\
&\otimes\braket{X_{A}I_{B}I_{C},I_{A}X_{B}Z_{C},I_{A}Z_{B}X_{C}}_{\text{qutrit}}.\end{split}$
(29)

We see each stabilizer state has the generators in the canonical form. The
first one contains a Bell state with one ebit $A|C$ entanglement, while the
second one contains a EPR state with one etrit $B|C$ entanglement. Thus, the
entanglement trimming still can be realized by teleportating the qubit in $C$
to $B$ with the entangled qutrits as a resource. The final state will have one
ebit entanglement between the qubit in $A$ and the qutrit in $B$, which is
obviously not a stabilizer state any more.

##  Appendix C Proof of canonical decomposition of generators for qudit
stabilizer state

We now present the proof of the lemma 2 in the main text by proving the
following three lemmas.

######  Lemma 3.

Given a generalized Pauli group $G$ defined on qudits, and denote $C$ as its
maximal Abelian subgroup generated by $c(G)$ generators $g_{j}$, we have

$c(G)=\mathinner{\\!\left\lvert
C\right\rvert}\geq\frac{\mathinner{\\!\left\lvert G\right\rvert}}{2},$ (30)

where $c(G)$ is called group compatibility index.

###### Proof.

Denote $\bar{C}$ the subgroup generated by $p=\mathinner{\\!\left\lvert
G\right\rvert}-c(G)$ generators $\bar{g}_{j}$, s.t.
$G=\braket{g_{i},\bar{g}_{j}}$ ($p$ is called incompatibility index). Then we
claim that up to multiplication of elements in generator $C$, each
$\bar{g}_{j}$ can be made to commute with all but one $g_{j}$ in $C$, which
can be seen in two steps: first, it is obvious $\bar{g}_{j}$ can’t commute
with all $g_{j}$ since $C$ itself is maximal Abelian subgroup; second, suppose
$\bar{g}_{j}$ is not commuting with two generator elements $g_{1},g_{2}$ in
$C$, e.g.,
$\bar{g}_{j}g_{1}=g_{1}\bar{g}_{j}\omega^{\lambda_{1}},\bar{g}_{j}g_{2}=g_{2}\bar{g}_{j}\omega^{\lambda_{2}}.$
By the multiplication of $g_{1},g_{2}$, we can replace $g_{2}$ by
$g_{1}^{m}g_{2}$ with some integer $m$ Gottesman (1998a), s.t.
$[\bar{g}_{j},g_{1}^{m}g_{2}]=0$ 111The existence of integers $m$ is
guaranteed when the qudit dimension is prime., and $\bar{g}_{j}$ still not
commuting with $g_{1}$.

If $c(G)<\mathinner{\\!\left\lvert G\right\rvert}/2$, by the pigeon hole
principle, we could get two generators in $\bar{C}$ which are not commuting
with a same element in $C$. With the same method, we could get one of them to
be commuting with all elements in $C$. This should be avoided since $C$ being
Abelian subgroup is already maximal. ∎

######  Lemma 4.

In the mean time respecting lemma $1$, we can make the generators of $\bar{C}$
commute with each other.

###### Proof.

Respecting lemma 3, the group $G$ can be written as
$G=\braket{g_{1},...,g_{i},...;\bar{g}_{1},...,\bar{g}_{j},...}$, where
$g_{i}$ commutes with any generator in $G$ except $\bar{g}_{i}$ (notice there
might be some $g_{i}$ commuting all generators, which generates the center of
the group $G$). We want the same is true for any $\bar{g}_{i}$. This can be
accomplished recursively: suppose we have $[\bar{g}_{1},\bar{g}_{2}]\neq 0$,
and we know $[g_{2},\bar{g}_{2}]\neq 0$, then we can replace $\bar{g}_{1}$ by
$\bar{g}^{\prime}_{1}=g_{2}^{m}\bar{g}_{1}$ with some integer $m$ such that
$[\bar{g}^{\prime}_{1},\bar{g}_{2}]=0$. ∎

Now let’s return to the qudit stabilizer and focus on the correlated generator
$S_{AB}$. Define projection maps: $P_{A}\mathrel{\mathop{\mathchar
58\relax}}g^{A}\otimes g^{B}\rightarrow g^{A}\otimes I^{B}$ (or
$P_{B}\mathrel{\mathop{\mathchar 58\relax}}g^{A}\otimes g^{B}\rightarrow
I^{A}\otimes g^{B}$), where the image of the map forms a subgroup of the
generalized Pauli group.

######  Lemma 5.

The centers of the group $P_{A}(S_{AB})$ and $P_{B}(S_{AB})$ are trivial.

###### Proof.

Denote $z$ as the rank of the center of the group $P_{A}(S_{AB})$ and $p$ as
its incompatibility index. Now if we look at the stabilizer $S$, we could have
$\mathinner{\\!\left\lvert S_{A}\right\rvert}+z+p$ independent commuting
generators for system $A$. Similarly for system $B$, we have
$\mathinner{\\!\left\lvert S_{B}\right\rvert}+z+p$ independent commuting
generators. The summation of these two sets of generator can not be lager than
$n$ (the rank of the stabilizer $S$)

$\mathinner{\\!\left\lvert S_{A}\right\rvert}+\mathinner{\\!\left\lvert
S_{B}\right\rvert}+2z+2p\leq n.$ (31)

However, if we count the number of generators in $S$, we get
$\mathinner{\\!\left\lvert S_{A}\right\rvert}+\mathinner{\\!\left\lvert
S_{B}\right\rvert}+z+2p=n$, which suggests $z=0$. This lemma finally brings
the generators of $S$ into its canonical form given in the theorem. ∎

##  Appendix D Entanglement trimming for continuous variable stabilizer state

The Pauli group for $n$ qubits plays a major role in stabilizer error
correction since it forms a basis for qubit operators. For continuous
variables, such as $n$ bosonic modes, the Pauli group is called Heisenberg-
Weyl (HW) group, composed of all phase space displacements Barnes (2004); Kok
and Lovett (2010). Denote $q_{i}$ and $p_{i}$ as the $i_{\text{th}}$ mode
position and momentum quadratures, which satisfy the canonical commutation
relation $[\hat{q}_{i},\hat{p}_{i}]=i$. The HW group $\mathcal{H}_{n}$ is a
Lie group and those quadratures are the infinitesimal generators, which forms
the Lie algebra. In fact, tracking the evolution of the Lie algebra elements
could lead us to a nice proof of continuous version of Gottesman-Knill theorem
Bartlett  _et al._ (2002). The HW group element can be written as

$g(\bm{v})=\exp\left({i\sqrt{2\pi}\sum_{i}^{n}s_{i}\hat{p}_{i}+t_{i}\hat{q}_{i}}\right),$
(32)

where we immediately see the one-to-one correspondence between the element
$g(\bm{v})$ and a vector
$\bm{v}=(s_{1},t_{1},s_{2},t_{2},...,s_{n},t_{n})\in\mathcal{R}^{2n}$. The
group elements satisfy

$g(\bm{v})g(\bm{v}^{\prime})=g(\bm{v}^{\prime})g(\bm{v})e^{i2\pi\sigma(\bm{v},\bm{v}^{\prime})},$
(33)

where
$\sigma(\bm{v},\bm{v}^{\prime})=\sum_{i}^{n}(s_{i}t_{i}^{\prime}-s_{i}^{\prime}t_{i})$
is the standard symplectic form on the symplectic vector space
$(\mathcal{R}^{2n},\sigma)$. This correspondence enables us to define Abelian
subgroups in terms of the symplectic vectors

$\mathcal{S}=\\{g(\textbf{u})\in\mathcal{H}_{n}|\textbf{u}=\sum_{i=1}^{K}\alpha_{i}\bm{v}_{i},\alpha_{i}\in\mathcal{R}\\},$
(34)

where $\sigma(\bm{v}_{i},\bm{v}_{j})=0$ for all $1\leq i,j\leq K\leq n$
222Note this constraint is much stronger than the general requirement of an
Abelian subgroup, where the skew-product only needs to be an interger
Gottesman  _et al._ (2001); Harrington and Preskill (2001).. Thus we also have
a corresponding vector space for the Abelian subgroup $\mathcal{S}$, which is
$\mathcal{V_{S}}=span\\{\bm{v}_{1},\bm{v}_{2},...,\bm{v}_{K}\\}$ (Note
$\mathcal{V_{S}}$ is in general not a symplectic vector space). The Abelian
subgroup could form a set of stabilizers and when $K=n$, the stabilizers
determine a stabilizer state Zhang  _et al._ (2009). Similar to qubit (qudit)
case with bipartition $A|B$, the stabilizer generator contains local
($\mathcal{S}_{A},\mathcal{S}_{B}$) and correlated ($\mathcal{S}_{AB}$)
subsets. The canonical form of the generators can be expressed in terms of the
corresponding vectors.

###  D.1 Canonical decomposition of generators for continuous variable
stabilizer state

######  Theorem 4.

—Canonical form of stabilizer generators for continuous variables: Given an
$n$-mode stabilizer state with bi-partition $A$ and $B$, the vector
correspondence $\mathcal{V_{S}}$ to its stabilizer group $\mathcal{S}$ can
always be brought into the following canonical form

$\mathcal{V_{S}}=span\left\\{\bm{v}_{i}^{A}\cup\textbf{0}^{B},\textbf{0}^{A}\cup\bm{v}_{j}^{B},\textbf{u}_{k}^{A}\cup\textbf{u}_{k}^{B},\bar{\textbf{u}}_{k}^{A}\cup\bar{\textbf{u}}_{k}^{B}\right\\},$
(35)

where the first two subsets correspond to the local generators for
$\mathcal{S}_{A}$ and $\mathcal{S}_{B}$, while the last two paired subsets
correspond to correlated generators for $\mathcal{S}_{AB}$. Those paired
vectors satisfy
$\sigma(\textbf{u}_{k_{i}}^{A},\bar{\textbf{u}}_{k_{j}}^{A})=-\sigma(\textbf{u}_{k_{i}}^{B},\bar{\textbf{u}}_{k_{j}}^{B})\neq
0$ when $k_{i}=k_{j}$, and satisfy
$\sigma(\textbf{u}_{k_{i}}^{A},\bar{\textbf{u}}_{k_{j}}^{A})=\sigma(\textbf{u}_{k_{i}}^{B},\bar{\textbf{u}}_{k_{j}}^{B})=0$
when $k_{i}\neq k_{j}$.

The above theorem can be proved by exploring the structure of the symplectic
vector space, and we present it in terms of the following lemmas.

######  Lemma 6.

Denote $V_{n}$ as a vector space (not necessarily a symplectic space) and
$V_{S}=span\\{\bm{v}_{i}\\}$ its maximal subspace which satisfies
${V_{S}}={V_{S}}^{\sigma}$, and take
${\bar{V}_{S}}=span\\{\bar{\bm{v}}_{j}\\}$ as another subspace of $V_{n}$ that
satisfies ${V}_{n}=span\\{{V_{S}};{\bar{V}_{S}}\\}$, where $\sigma$ is the
standard symplectic form defined on any enlarged symplectic vector space,
$\\{\bm{v}_{i}\\}$ and $\\{\bar{\bm{v}}_{j}\\}$ are the linear independent
sets correspondingly. Then we will have $dim({V_{S}})\geq dim({\bar{V}_{S}})$;
the vectors satisfy
$\sigma(\bm{v}_{i},\bar{\bm{v}}_{j})=\alpha\delta_{ij}\forall i,j$,
$\alpha\in\mathcal{R}$ and
$\sigma(\bar{\bm{v}}_{i},\bar{\bm{v}}_{j})=0,\forall i,j$.

###### Proof.

We first prove that each vector $\bar{\bm{v}}_{j}$ in the set
$\\{\bar{\bm{v}}_{j}\\}$ can be made to symplectic orthogonal to all but one
of $\bm{v}_{i}$ in ${V_{S}}$. The reason is: first, $\forall\bar{\bm{v}}_{j}$
can’t be symplectic orthogonal to all elements in ${V_{S}}$ since it is
already maximal, meaning no more linear independent vectors can be added;
second, if $\bar{\bm{v}}_{j}$ is not symplectic orthogonal to two elements
$\bm{v}_{i},\bm{v}_{k}\in{V_{S}}$, e.g.,
$\sigma(\bm{v}_{i},\bar{\bm{v}}_{j})=\alpha,\sigma(\bm{v}_{k},\bar{\bm{v}}_{j})=b$,
then we can define a new vector
$\bm{v}_{k}^{\prime}=\frac{\alpha}{b}\bm{v}_{k}-\bm{v}_{i}$ to replace
$\bm{v}_{k}$ in the set, such that
$\sigma(\bm{v}_{k}^{\prime},\bar{\bm{v}}_{j})=0$. Repeat this operation until
we have $\sigma(\bm{v}_{i},\bar{\bm{v}}_{j})=\alpha\delta_{ij},\forall i,j$.

We prove $dim(V_{S})\geq dim(\bar{V}_{S})$ by contradiction. If we have
$dim({V_{S}})<dim({\bar{V}_{S}})$, then by the pigeon hole principle we can
find $i_{1}\neq i_{2}$ such that $\bar{\bm{v}}_{i_{1}}$ and
$\bar{\bm{v}}_{i_{2}}$ are not symplectic orthogonal to a same $\bm{v}_{j}$.
Similarly we can replace $\bar{\bm{v}}_{i_{1}}$ or $\bar{\bm{v}}_{i_{2}}$ by a
new vector that is symplectic orthogonal to $\bm{v}_{j}$, making ${V_{S}}$ not
the maximal mutually symplectic orthogonal subspace.

Thus, the vector space $V_{n}$ can be expressed as (up to relabel)
${V}_{n}=span\\{\bm{v}_{1},...,\bm{v}_{dim({V_{S}})};\bar{\bm{v}}_{1},...,\bar{\bm{v}}_{dim({\bar{V}_{S}})}\\}$,
where ($\bm{v}_{j}$,$\bar{\bm{v}}_{j}$) form a pair with $\bm{v}_{j}$ being
symplectic orthogonal to all vectors but $\bar{\bm{v}}_{j}$. Now we prove the
same is true for $\bar{\bm{v}}_{j}$, where we need to show
$\sigma(\bar{\bm{v}}_{i},\bar{\bm{v}}_{j})=0,\forall i,j$. This can be done
recursively: suppose there are two vectors $\bar{\bm{v}}_{j_{1}}$ and
$\bar{\bm{v}}_{j_{2}}$ which are not symplectic orthogonal, and we also know
$\bar{\bm{v}}_{j_{1}}$ is not symplectic orthogonal to $\bm{v}_{j_{1}}$, thus
we can replace $\bar{\bm{v}}_{j_{2}}$ by a similar new vector that is
symplectic orthogonal to $\bar{\bm{v}}_{j_{1}}$. ∎

######  Lemma 7.

Given a symplectic vector space $(\mathcal{R}^{2n},\sigma)$ corresponding to a
HW group $\mathcal{H}_{n}$. A pair of transverse Lagrangian planes
$(L,\bar{L})$, e.g., $L=\text{span}\\{\textbf{u}_{i}|1\leq i\leq n\\}$ and
$\bar{L}$=span$\\{\bar{\textbf{u}}_{j}|1\leq j\leq n\\}$ define two maximal
Abelian subgroups: $\mathcal{H}_{L}$ with generators $g(\textbf{u}_{i})$ and
$\mathcal{H}_{\bar{L}}$ with generators $g(\bar{\textbf{u}}_{j})$. The
corresponding vectors satisfy
$\sigma(\textbf{u}_{i},\bar{\textbf{u}}_{j})=\alpha\delta_{ij},\alpha\in\mathcal{R},\forall
i,j$.

###### Proof.

Inspecting the previous lemma, if we require $V_{n}=(\mathcal{R}^{2n},\sigma)$
as a symplectic vector space, we could get $dim(V_{S})=dim(\bar{V}_{S})=n/2$.
Since $V_{S}\cap\bar{V}_{S}=\emptyset$, they define a pair of transverse
Lagrangian plane, denoted as $L=span\\{\bm{u}_{i}|1\leq i\leq n\\}$ and
$\bar{L}=span\\{\bar{\bm{u}}_{j}|1\leq j\leq n\\}$. The commutation relation
of those vectors just follow. ∎

Notice the set $\\{\bm{u}_{i};\bar{\bm{u}}_{j}\\}$ doesn’t form a symplectic
basis for $(\mathcal{R}^{2n},\sigma)$ since we just have
$\sigma(\bm{u}_{i},\bar{\bm{u}}_{j})=\alpha\delta_{ij}\neq\delta_{ij}$.
However, we can easily promote it to be a symplectic basis by normalizing
those vectors to get $\alpha=1$, which completes the operation indicated in
the renowned symplectic Gram-Schimdt theorem De Gosson (2006). As an
interesting observation, the Lagrangian plane of a standard symplectic vector
space actually defines a continuous variable stabilizer state, suggesting more
interesting structure of stabilizer state can be revealed in the framework of
symplectic geometry.

To present the next lemma that finally proves the theorem, let’s first denote
$\mathcal{V}_{A}=span\\{\bm{v}^{A}_{i}\cup\bm{0}^{B}\\}$,
$\mathcal{V}_{B}=span\\{\bm{0}^{A}\cup\bm{v}_{j}^{B}\\}$ and
$\mathcal{V}_{AB}=span\\{(\bm{v}^{A}\cup\bm{v}^{B})_{k}\\}$ as the vector
space corresponding to the generator sets $\mathcal{S}_{A}$, $\mathcal{S}_{B}$
and $\mathcal{S}_{AB}$, respectively, and define a projection map
$f_{A}(\mathcal{V}_{AB})\mathrel{\mathop{\mathchar
58\relax}}(\bm{v}^{A}\cup\bm{v}^{B})_{k}\rightarrow\bm{v}_{k}^{A}\cup\bm{0}^{B}$
(similarly we have another map
$f_{B}(\mathcal{V}_{AB})\mathrel{\mathop{\mathchar
58\relax}}(\bm{v}^{A}\cup\bm{v}^{B})_{k}\rightarrow\bm{0}^{A}\cup\bm{v}_{k}^{B}$).
Notice the image of the map $f_{A}(\mathcal{V}_{AB})$ is linearly independent
with the vectors defined in $\mathcal{V}_{A}$.

######  Lemma 8.

The image of the map $f_{A}(\mathcal{V}_{AB})$ $(\text{or
}f_{B}(\mathcal{V}_{AB}))$ is a symplectic vector space.

###### Proof.

Obviously, $f_{A}(\mathcal{V}_{AB})=span\\{\bm{v}^{A}_{k}\\}$ is a vector
space and it is bilinear and alternating in terms of the standard symplectic
form $\sigma$. We only have to show the vector space $f_{A}(\mathcal{V}_{AB})$
is nondegenerate. Suppose
$f_{A}(\mathcal{V}_{AB})=span\left\\{\\{\bm{v}_{i}\\}_{i=1,...,p};\\{\bar{\bm{v}}_{j}\\}_{j=1,...,\bar{p}}\right\\}$
with $p-\bar{p}=t\geq 0$, meaning there are $t$ non-zero vectors that are
symplectic orthogonal to all vectors in the image. Now if we look at the
vector space $\mathcal{V_{S}}$, we can find
$dim(\mathcal{V}_{A})+p=dim(\mathcal{V}_{A})+t+\bar{p}$ independent vectors on
system $A$. Similarly considering $f_{B}(\mathcal{V}_{AB})$, we could have
$dim(\mathcal{V}_{B})+t+\bar{p}$ independent vectors on system $B$. The
summation of these independent vectors can not be larger than $n$, which is
the dimension of $\mathcal{V_{S}}$

$dim(\mathcal{V}_{A})+dim(\mathcal{V}_{B})+2t+2\bar{p}\leq n.$ (36)

However, we know the independent vectors on $\mathcal{V_{S}}$ is simply
counted as $dim(\mathcal{V}_{A})+dim(\mathcal{V}_{B})+t+2\bar{p}=n$. The only
possibility is $t=0$, which means all vectors in $f_{A}(\mathcal{V}_{AB})$ are
paired, thus only zero vectors can be symplectic orthogonal to all vectors in
it, leading to nondegeneracy. The canonical form given in the theorem just
follows. ∎

As a remark, all symplectic analysis for continuous variable stabilizer state
apply naturally to qudit with prime dimension $D$, where the symplectic vector
space is defined in the field $Z_{D}$. With the canonical decomposition of
stabilizer generators, we can analogously construct “the bigger man principle”
for continuous variable stabilizer state.

######  Theorem 5.

—the bigger man principle for continuous variable: for a continuous variable
stabilizer state with tri-partition $AB|C$, according to the canonical
decomposition theorem, the vector space corresponding to its stabilizer can be
written in the canonical form,

$\mathcal{V_{S}}=span\left\\{\bm{v}_{i}^{AB}\cup\textbf{0}^{C},\textbf{0}^{AB}\cup\bm{v}_{j}^{C},\textbf{u}_{k}^{AB}\cup\textbf{u}_{k}^{C},\bar{\textbf{u}}_{k}^{AB}\cup\bar{\textbf{u}}_{k}^{C}\right\\}.$
(37)

The $A|BC$ entanglement can be transformed to $A|B$ with local operation on
$C$, if and only if, (1) $\forall$ $k$, either
$\textbf{u}_{k}^{AB}=\textbf{0}^{A}\cup\textbf{u}^{B}_{k}$ or
$\bar{\textbf{u}}_{k}^{AB}=\textbf{0}^{A}\cup\bar{\textbf{u}}^{B}_{k}$, or (2)
even pairs of correlated vectors come in the form
$\\{\textbf{0}^{A}\textbf{u}_{k}^{B}\cup\textbf{u}_{k}^{C},\textbf{0}^{A}\bar{\textbf{u}}_{k}^{B}\cup\bar{\textbf{u}}_{k}^{C},\textbf{u}_{k^{\prime}}^{A}\textbf{0}^{B}\cup\textbf{u}_{k^{\prime}}^{C},\bar{\textbf{u}}_{k^{\prime}}^{A}\textbf{0}^{B}\cup\bar{\textbf{u}}_{k^{\prime}}^{C}\\}$.