justified theoremdefinition theorem lemmadefinition lemma corollarydefinition
corollary remarkdefinition remark

# Optimizing quantum codes with an application to the loss channel with
partial erasure information

Benjamin Desef  Martin B. Plenio  Institute for Theoretical Physics & IQST,
University of Ulm

(2022-02-25)

###### Abstract

Quantum error correcting codes (QECCs) are the means of choice whenever
quantum systems suffer errors, e.g., due to imperfect de- vices, environments,
or faulty channels. By now, a plethora of families of codes is known, but
there is no universal approach to finding new or optimal codes for a certain
task and subject to specific experimental constraints. In particular, once
found, a QECC is typically used in very diverse contexts, while its resilience
against er- rors is captured in a single figure of merit, the distance of the
code. This does not necessarily give rise to the most efficient protection
possi- ble given a certain known error or a particular application for which
the code is employed.

In this paper, we investigate the loss chan- nel, which plays a key role in
quantum com- munication, and in particular in quantum key distribution over
long distances. We develop a numerical set of tools that allows to optimize an
encoding specifically for recovering lost parti- cles both deterministically
and probabilistically, where some knowledge about  _what_ was lost is
available, and demonstrate its capabilities. This allows us to arrive at new
codes ideal for the distribution of entangled states in this particu- lar
setting, and also to investigate if encoding in qudits or allowing for non-
deterministic correc- tion proves advantageous compared to known QECCs. While
we here focus on the case of losses, our methodology is applicable whenever
the errors in a system can be characterized by a known linear map.

##  1 Introduction

Quantum key distribution (QKD) uses intrinsic properties of quantum mechanics
to allow for information-theoretically secure transmission of information [1,
*bib:Bennett1984r, 3, 4]. Necessarily, this requires to transmit quantum
systems—mostly, photons—between two parties with a sufficiently low error rate
[5]. Due to the fragility of such systems, a major task in the development of
a QKD landscape is to reduce the effects of natural, i.e., not eavesdropper-
induced, errors.

Probably the main issue at the present time is to deal with channel
attenuation, which leads to a probabilistic loss of particles [6, 5]. The
exponential nature of channel attenuation makes it practically impossible to
develop QKD systems over longer distances with direct transmission [7, 8]. Two
proposals exist to deal with this issue: quantum repeaters [9, 10, 11, 12, 13]
and trusted nodes [14, 15, 16]. Only the former is able to provide
satisfactory security, as the repeater nodes do not have to be trusted.

In section 2, we will describe the problem of channel attenuation more in
detail, with a particular emphasis on QKD. We will explain why approaches to
and realizations of quantum repeaters currently found in the literature may be
valid working examples, but do not address issues that are central to
embedding them seamlessly into the current telecom infrastructure. This will
serve as a motivation in section 3 to introduce a new methodology that has the
potential to showcase particular implementations that push the bounds of
realistic QKD systems toward their fundamental limits, while conversely, it
can also reveal to which extent the infrastructure must be adapted. We will
apply those methods to various configurations and give results in section 4.
In section 5, we will discuss the implications of our results and issues that
remain to be addressed. We summarize our ideas in section 6 and provide an
outlook on future potential applications.

##  2 Channel attenuation

###  2.1 Definition and parameter values

The secret key rate (per channel use) in QKD is based mainly on two factors:
the success probability of transferring the signal, $p_{\mathrm{trans}}$, as
well as the quality of the arrived bits, measured in terms of the bit error
rates in the chosen basis. We employ a simple key rate analysis in the
asymptotic framework [3, 17], based on the bit error rates $e_{X}$ and $e_{Z}$
in the Pauli $X$ and $Z$ bases, respectively, although with a more complicated
analysis, improved bounds can be found [18, 19, 4, 20]. We will also disregard
any finite size or side channel effects. The efficient QKD protocol [17]
asymptotically removes the sifting prefactor and gives a secret key rate of

$\bigl{[}1-2H(\max\\{e_{X},e_{Z}\\})\bigr{]}p_{\mathrm{trans}}\text{,}$ (1)

where $H$ is the binary entropy function.

This shows that indeed attenuation—(heralded) loss of signals—does not
_fundamentally_ limit transmission, but it still does so _effectively_. The
probability $p_{\mathrm{trans}}$ of successful transmission through a channel
of length $L$ with attenuation coefficient $\alpha$ is given by

$p_{\mathrm{trans}}={\mathrm{e}}^{-\alpha L}\text{,}$ (2)

which severely limits the achievable bit rate to drop at least exponentially
with distance, and therefore also constrains the distance between repeater
stations.

The ultimate goal of rolling out QKD systems for private and commercial use is
to embed them most seamlessly in the _existing_ telecom infrastructure. While
this will require significant investments into new devices such as quantum
repeaters and routers, ideally, existing fiber networks should be able to
provide the backbone of the QKD network. This is not a hard requirement on the
way to build a quantum internet, but large-scale infrastructural projects will
have a significant impact both on how well the technology will be received in
the general public as well as on whether private telecommunication companies
will feel inclined to carry out said projects at all.

Hence, it is crucial to investigate QKD “at the limit,” namely, letting both
$\alpha$ and $L$ be dictated by the specifications of today’s
telecommunication networks. Common fibers in the $1550\,\mathrm{nm}$ telecom
window have an attenuation coefficient
$\alpha=0.2\,\mathrm{\frac{dB}{km}}=0.046\,\mathrm{\frac{1}{km}}$ [5]. The
inter-repeater distance $L$ is given by the distance between the repeater
stations that amplify the classical signals, where unused slots of dark fibers
may be employed to plug in quantum repeaters. They are located about
$60\,\text{--}\,80\,\mathrm{km}$ apart [6].

Figure 1 illustrates the consequences of these values: The transfer of a
single photon between two adjacent stations placed $80\,\mathrm{km}$ apart
takes $0.4\,\mathrm{ms}$, using the speed of light in fiber, $c=2\cdot
10^{5}\,\mathrm{\frac{km}{s}}$, and has a transmission probability of
$2.5\,\mathrm{\%}$. A scheme in which the successful or failed transmission is
signaled back and only then triggers the next action will take
$32\,\mathrm{ms}$ on average—completely neglecting the time for any local
operations, further meta-communication, and the practical difficulties that
come with quantum memories.

$6.3\,\mathrm{\%}$$2.5\,\mathrm{\%}$$20$$40$$60$$80$$0$$0.2$$0.4$$0.6$Distance
$L$ ($\mathrm{km}$)$p_{\mathrm{trans}}$ Figure 1: Transmission probability for
fiber with attenuation coefficient $\alpha=0.2\,\mathrm{\frac{dB}{km}}$

In classical communication, these values do not restrict the actual bandwidth.
The intensity of a classical signal is high enough that a reduction
by$98\,\mathrm{\%}$ still amounts to a successful transmission. Hence, there
is no need to signal back whether a transmission was actually successful;
instead, the next photon packet can be sent almost immediately after its
predecessor. This is why the distance between two classical communication
parties only has an impact on _latency_ , i.e., initialization of the
communication, but not on the _rate_ of information transfer.

###  2.2 Error correction

The same thought carries over to the quantum regime: if the successful
transmission of a signal needs to be signaled back to the previous station
before it can carry on with the next signal, the rate is severely bound by the
distance between those stations. Hence, a truly scalable QKD system must be
able to avoid two-way communication between repeater stations under all
circumstances; or to make it non-blocking using an enormous number of quantum
memories, which, despite recent achievements [21], is a huge challenge. Note
this argument does not forbid the receiver from sending some required
information back to the sender when the message arrives, as long as there is
only this one round of backwards communication affecting only classical
information. This means that the sender must only store all the classical
information until the confirmation or failure signal from the receiver
arrives. Hence, the availability of large (compared to the quantum case,
quasi-infinite) classical memory allows us to count this waiting time of the
sender as an initial latency with no impact on the rate: there is no need to
wait for the heralding signal from the receiver before sending the next state.
This is based on the assumption that signals can be sent arbitrarily close to
each other, which is an idealization; but still, the possibility to adjust the
waiting time between signals is now a way to combat negative impacts of failed
transmissions on the rate, which is not possible if the successful arrival has
to be heralded between each station.

####  2.2.1 Traditional quantum error correcting codes

Whereas quantum repeaters of the first and second generation rely on backwards
communication, third-generation repeaters employ quantum error correcting
codes (QECCs) [22, 23, 24, 25] to circumvent attenuation without the
requirement of additional feedback communication [26]. An $\mathord{\llbracket
n,k,d\rrbracket}$ QECC is a $2^{k}$-dimensional subspace of a
$2^{n}$-dimensional Hilbert space; or, it stores the content of $k$  _logical_
qubits into $n$  _physical_ qubits. It is able to correct against
$\bigl{\lfloor}\frac{d-1}{2}\bigr{\rfloor}$ arbitrary single-qubit errors,
among which we can also count deletions, i.e., losses whose position is
unknown. Erasures—losses with known position—can be corrected for on up to
$d-1$ qubits [27]. Hence, the idea behind employing an error correcting code
against attenuation effects is that it is sufficient to successfully transfer
a lower number of bits instead of the full number, $n$, while still completing
the action successfully.

In this paper, we will not be concerned with errors due to faulty components
or dark counts—we will only consider the errors introduced by channel
attenuation. Our main focus will be on a “reduced” erasure scenario: While we
will assume that lost qubits are known not to have arrived, once all those
arrived qubits are bundled together, we will not exploit any further knowledge
of which particular combination of qubits the bundle pertained to. We will
explain and justify this model more in detail in section 2.4. We assume that
the loss of every photon is independent from all the others, and they all
occur with the same probability.

Since QECCs are required to deterministically restore the full state, the no-
cloning theorem [28, 29, 30] limits them to tolerate only error rates below
$50\,\mathrm{\%}$, or, in our case, a QECC requires
$p_{\mathrm{trans}}>\frac{1}{2}$. Translated into distance, neighboring
stations must not be more than $15\,\mathrm{km}$ apart.

We note that while we used the $\mathord{\llbracket n,k,d\rrbracket}$ notation
commonly employed for stabilizer-based (additive) quantum codes, there have
been a few reports about better performance of some exemplary nonadditive
codes [31, 32, 33]. However, apart from the fact that so far, only very low
code distances were reported, they are still QECCs that are bound by the no-
cloning theorem.

####  2.2.2 Redundant parity encoding

An $\mathord{\llbracket n,k,d\rrbracket}$ code is designed to be robust
against errors, i.e., to allow for the correction of arbitrary quantum errors.
For the particular issue of losses, other codes have been developed [27]. In
particular, for use with quantum repeaters, a redundant parity encoding [34,
35] has been proposed. The general idea is to encode the state
$\alpha\ket{0}+\beta\ket{1}$ in two layers of encoding, giving (unnormalized)

$\alpha\bigl{[}\ket{0}^{\otimes m}+\ket{1}^{\otimes m}\bigr{]}^{\otimes
n}+\beta\bigl{[}\ket{0}^{\otimes m}-\ket{1}^{\otimes m}\bigr{]}^{\otimes
n}\text{.}$ (3)

At the lower level, we have a block consisting of $m$ qubits prepared in a GHZ
state [36, 37]; at the higher level, there are $n$ of those blocks. Now note
that measuring an arbitrary qubit in the computational basis effectively
disentangles its whole embedding $m$-qubit block from all the other blocks.
Therefore, provided at least one photon from each block survives, all blocks
can be disentangled from each other by measuring one photon from each but one
block in the computational basis. From the block that was left unchanged, we
require to have access to all its $m$ qubits. It is now in the (unnormalized)
state

$\alpha\bigl{[}\ket{0}^{\otimes m}+\ket{1}^{\otimes
m}\bigr{]}\pm\beta\bigl{[}\ket{0}^{\otimes m}-\ket{1}^{\otimes
m}\bigr{]}\text{,}$ (4)

where the sign depends on the sum of all previous measurements and can
therefore be corrected. We end up with the logical state of the qubit, which
may be decoded or processed further.

For some values of $m$ and $n$ this actually describes a QECC—for instance,
the Shor code [22] is given by $m=n=3$—while for others, it does not, the most
simple example being $n=1$, $m=2$.

Unfortunately, the previous analysis in [35] has neglected that the two
requirements are competitive (see appendix C for details): large $m$ and small
$n$ are required to have a successful disentangling operation, while large $n$
and small $m$ are needed to then successfully restore the initial state from
the disentangled one. The total success probability is given by

$p\Bigl{(}\begin{subarray}{c}\geq 1\text{ physical qubits}\\\ \text{in each
block}\end{subarray}\Bigr{)}-p\Bigl{(}{\underbrace{\begin{subarray}{c}1\text{
to }(m-1)\text{ physical qubits}\\\ \text{in each
block}\end{subarray}}_{\begin{subarray}{c}=\text{ never a complete block}\\\
\text{among the left set}\end{subarray}}}\Bigr{)}\text{,}$ (5)

which, defining $\bar{p}_{\mathrm{trans}}\coloneqq 1-p_{\mathrm{trans}}$, is

$\bigl{(}1-\bar{p}_{\mathrm{trans}}^{m}\bigr{)}^{n}-\bigl{(}1-\bar{p}_{\mathrm{trans}}^{m}-p_{\mathrm{trans}}^{m}\bigr{)}^{n}\text{.}$
(6)

We numerically scanned $(m,n)\in[1,1000]^{2}\mathbin{\cap}\mathbb Z^{2}$ and
found that redundant quantum parity codes can only deliver higher transmission
probabilities than direct transmission for $p_{\mathrm{trans}}\geq
54\,\mathrm{\%}$.

####  2.2.3 Cluster states

The use of cluster states was suggested to tolerate high error rates [38, 39].
However, as these were mostly based on QECCs, the limit of $50\,\mathrm{\%}$
failure also applies here.

Recently, it has been pointed out that there are cluster states for which no
foliation to a traditional stabilizer code exists [40]. The existence of a
cluster state with a $55\,\mathrm{\%}$ erasure threshold was reported and it
was pointed out that there is no fundamental limit. Although we do not use
cluster state methods in this paper, our approach later will be motivated by
this fact.

###  2.3 Beyond traditional error correction

The previous approaches share two common traits: within their scope of
applicability, they correct deterministically; and they are based on qubits.

Addressing the former, we note that the secret key rate in eq. 1 scales
linearly with a probabilistic factor and has an entropic dependency on a
quality factor. QECCs are _deterministic_ codes: their probabilistic element
is purely based on the question—which is typically considered external to the
code—of whether few enough errors happened, and in this case they are always
able to deliver perfect quality. If too many errors occur, the code-specific
behavior is usually uncharacterized. We will ask the question of how much loss
can be tolerated in a state if we allow the correction operation to only
probabilistically succeed. Here, by “success” we do not require a perfect
recovery, as eq. 1 has a non-zero rate even if the states are slightly
erroneous. Instead, we will investigate how to achieve an optimal combination
of success probability and recovery quality with regard to the secret key
rate. This is justified by the fact that we may signal back the success of the
total operation to the sender without negatively impacting the rate. We note
that a very recent study of probabilistic transformations from the point of
view of resource theories also investigates the potential benefits of
nondeterministic operations [41].

More out of tradition and its close relationship with classical error
correction, QECCs are defined in terms of qubits. In [35], it was noted that a
photon has multiple degrees of freedom that can be exploited for the encoding.
While using more degrees of freedom per photon implies that the photons that
arrive will be able to carry more information, at the same time, the photons
that do _not_ arrive will also _lose_ more information. For this reason, it is
not immediately obvious if and in what manner going to higher dimensions will
prove beneficial. We will investigate this possibility in section 3.7 by
moving from qubits to qudits; and indeed, for some configurations, we can
report a significant improvement in the transmitted fidelity.

###  2.4 The “reduced” erasure model

We previously introduced the “reduced” erasure model, which is the subject of
study in this paper. It arises from the conventional, “full” erasure by
dropping the information about which particular loss configuration occurred,
while still removing all lost slots from the input to the correction circuit.
We will illustrate this with an example.

Imagine that we send three photons $1$, $2$, and $3$; the full erasure
information now consists in knowing which one of

$\bigl{\\{}\emptyset,\\{1\\},\\{2\\},\\{3\\},\\{1,2\\},\\{1,3\\},\\{2,3\\},\\{1,2,3\\}\bigr{\\}}$

arrived. In principle, the receiver may implement eight (or seven,
disregarding the case of complete failure) different maps corresponding to all
the different configurations. We will mostly only study the case with a given
number of received photons (e.g., corresponding to the most likely event; but
see section 3.8), but even if the receiver knows that, say, two photons
arrived, it can still lead to three different maps. The process becomes
simpler, both experimentally and for our numerical study, if the receiver only
has to implement a _single_ correction map that takes two input states: this
corresponds to the “reduced” erasure information. Still, the receiver must
route the two successful arrivals into the proper input slots for the map, but
after this photonic switch, only one circuit needs to be run.

While the theoretical model of quantum erasures is a very common one [42, 27,
25], recent experimental progress actually makes it feasible for the use in
quantum communication. For example, non-destructive photon detectors [43, 44]
can be used to directly obtain all the erasure information; in principle,
boosted teleportation schemes [45] should provide means to detect photons
nondestructively with arbitrarily high success probabilities using linear
optics and resource state generators alone. Alternatively, the necessary data
may be obtained by storing the arriving photons in quantum memories in a
heralding way [46, 47, 48, 49], which may have benefits if the quantum
information is to be manipulated in this form anyway.

We note that in all these situations, a suitable protocol will use classical
communication and synchronized clocks to first establish what the receiver
_should_ expect. Then, the erasure information is obtained by comparing the
output of the aforementioned detectors or heralding signals with the
expectations. Since this actually reveals the _full_ erasure information, we
also see potential for extending our method to cover this case. However, since
this will render the symmetry reduction in section 3.3 impossible, additional
insight is required in order to scale the full erasure case to larger systems.
We plan to address this in a forthcoming publication.

##  3 Optimizing transmission

The TGW [7] and the PLOB [8] bounds require us to use quantum repeaters for a
scalable QKD network. However, current research is dominated either by
repeater distances of $1\,\text{--}\,2\,\mathrm{km}$ [50, 51, 52], which are
far beyond what the current infrastructure has to offer, or they require
inter-repeater two-way communication over long distances together with a large
number of quantum memories [53, 54, 55].

The most effective way to securely transmit information would be to find an
optimal QKD protocol (preparation, transfer, and key processing) for a given
repeater sequence. In a highly connected quantum network, then the best
possible sequence is selected as the chosen pathway. This approach is highly
impractical, and we discard it in favor of a “plug-and-play” solution
that—while not necessarily being globally optimal—does not require a different
protocol whenever the routing between the parties differs: We are interested
only in finding the optimal protocol that allows to establish a Bell state
$\ket{\Phi^{+}}\propto\ket{00}+\ket{11}$ between two adjacent neighbors. This
segment is then suitable for use in any specific communication chain and thus
provides a lower bound on what is achievable, while still being much more easy
to implement than a global protocol.

_Outline_ —In the following subsections, we will develop our method to
numerically find such optimal protocols. In section 3.1, we will first
establish the context in which our approach will fit. The most general
formulation applicable to the “reduced” erasure scenario, previously
introduced in sections 2.2.1 and 2.4, will be given in section 3.2.
Subsequently, in section 3.3, we analyze the setting in more detail: We will
exploit a permutation symmetry in order to reduce the effective dimensionality
of our systems and will end up with a scaling that is linear in the number of
sent and received particles.

While this greatly simplifies the optimization task, it is still a nonconvex
problem. We will discuss two approaches that are suitable to solve this
problem: nested optimization with convex subproblems (section 3.4) and a
method that is called _convex iteration_ (section 3.5). In section 3.6, we
bring those approaches together: we describe advantages and disadvantages and
detail an optimization pipeline that uses both methods, and which we found to
give satisfying results with acceptable resource consumption.

We will then discuss some choices that we made in our model and how to
generalize them, from the assumption of sending qubits (section 3.7), the
fixed value $r$ of arriving particles (section 3.8), to our decision to only
consider the “reduced” erasure setting instead of the full erasure knowledge
(section 3.9).

A brief discussion in section 3.10 of how the resulting numerical data—which
will typically lead to extremely complicated states and maps—may be simplified
concludes the discussion of our methods.

###  3.1 Multiplexing and entanglement distillation

A direct transmission success probability of $2.5\,\mathrm{\%}$ is too low to
allow for successful large-scale QKD. However, it is not too low for
multiplexing techniques to provide substantial advantage.

Multiplexing was already suggested multiple times in the literature [56, 57]
and to some extent also demonstrated experimentally [58]. Although it is
mostly found for all-photonic implementations [11], this is no necessity. The
basic idea is simple: If we require the successful transmission of one photon,
but we send $s$ copies instead, the probability that the transmission
failed—which now only means that _no_ photon arrived—is given by
$1-\bar{p}_{\mathrm{trans}}^{s}$. By tuning $s$, the success probability can
be brought arbitrarily close to $1$ at the expense of sending more and more
copies. In particular, using the transmission probability for
$80\,\mathrm{km}$, we already need to multiplex with $28$ photons in order to
have at least $50\,\mathrm{\%}$ success probability.

The difference to the codes presented before is that now each photon is
independent of all others—but, as a consequence, the associated half of each
copy has to be stored in its individual quantum memory. Additionally, the
successful arrival of a copy has to be signaled back so that then,
entanglement swapping can be performed on the correct pair. Since this is in
strong conflict with the previously stated goal to avoid backwards
communication between repeaters at all costs, we instead want to perform
multiplexing with $s$ qubits while the sender only stores a _single_ qubit,
which need not be processed further based on some outcome at the receiver’s
site111In fact, a single unitary operation conditioned on a measurement
outcome at the receiver’s site is still permissible—since this correction can
be accounted for only at the very end, as is the case for a chain of multiple
entanglement swappings. However, we find that allowing for such an operation
does not appear to lead to any improvement. .

Alicesend $s$$\mathrm{A}$memory$1$$2$$3$$4$transmissionAlicelossreceive
$r$$\mathrm{A}$$1$$2$$3$$4$$M_{1}$$\vdots$$M_{\binom{s}{r}}$$\mathrm{A}$$3$$4$$1$$2$distillationAliceBob$\mathrm{A}$iii$E$$\mathrm{B}$$p_{\mathrm{dist}}$
Figure 2: Visualization of the setting. After preparation at Alice’s site, $s$
qubits are sent though the channel, but only $r$ arrive. All possible
configurations, corresponding to the loss maps $\\{M_{i}\\}_{i}$, are
independent and equally likely. A local distillation map $E$ then aims at
producing a high-quality Bell pair between Alice and Bob with probability
$p_{\mathrm{dist}}$; this map does not know which particles were lost. We
visualize the important initial and final correlations by wavy lines, but
suppress them at the intermediate stages. While we name the individual parties
“Alice” and “Bob,” they may also be repeaters.

Put into the larger context, every repeater (and the sender) creates an
$(s+1)$-qubit state $\rho$, stores a single qubit and sends the remaining $s$
qubits to its neighboring node. This node, due to losses, will receive $r\leq
s$ of them (typically, $s\gg 1$ while $r\sim 1$) and execute a local
postprocessing map $E$ to convert them to a single qubit that, together with
the stored one at the previous site, has the highest possible overlap with a
pure Bell state. These steps are visualized in fig. 2. Finally, the repeater
performs entanglement swapping with _its_ stored single qubit and the one
resulting from the postprocessing. Every operation has to produce states with
sufficiently high fidelity and success probability (but, contrary to QECCs,
not unit probability), so that errors are kept small and success needs not be
signaled back to the previous station. Since the receiver is still allowed to
signal back the successful arrival to the sender, even probabilities
considerably different from one are permissible, at the expense of more
classical memory.

Phrased in this way, the repeaters have to carry out an entanglement
distillation procedure. When we later discuss the possibility of sending
higher-dimensional states, it will become clear that even the case $r=1$—which
has local filtering operations [59] as the optimal procedure for the case of
qubits—should not _a priori_ be dismissed.

There exist numerous entanglement distillation protocols, e.g., [60, 61,
*bib:Deutsch1998, 63, 64, 65, *bib:Okrasa2008, *bib:Feng2008, 68, 69, 70, 71],
approaches to a theory of entanglement distillation [72, 73, 74]; and upper
bounds [75] as well as numerical tools to incorporate experimental constraints
[76, 77] have been reported recently. However, finding the optimal protocol
with respect to _both_ the prepared state and the distillation map, but now
with a given channel model and certain protocol restrictions (success
probability, available erasure information, …) is an unsolved task; and
indeed, for the particular issue we face here, it is not advantageous to use
known protocols. They assume an input state which is mostly unknown, apart
from a single parameter such as the fidelity or some entanglement measure.
Here, we are free to prepare an arbitrary state at the sender’s site; and
given the particular case of channel loss, we then also know precisely which
state the receiver will get. We will compare our results with known
distillation protocols in section 4.3.

###  3.2 Optimizing the “reduced” erasure setting

We will formulate our problem in a way that captures most of what is possible
in the “reduced” erasure setting previously described; but we will also
explore some possible extensions later on.

Let $\\{M_{i}\\}_{i}$ be a set of completely positive (CP) and trace
preserving maps, where each $M_{i}$ corresponds to a different combination of
losing $s-r$ out of $s$ subsystems; mathematically, they are given by the
partial trace maps on the lost subsystems. Let $p_{\mathrm{dist}}\in(0,1]$ be
an external parameter that denotes the desired distillation success
probability, and let $\ket{\Phi^{+}}\propto\ket{00}+\ket{11}$ be a Bell state.
Finally, let $C(E)$ denote the Choi state of the CP trace-nonincreasing
distillation map $E$. The task is then to solve

$\left\\{\begin{aligned} &\hskip
3.8889pt\mathclap{\max_{E,\rho}F_{\mathrm{min}}}\\\ &\hskip
3.8889pt\mathclap{\text{subject to}}\\\
F_{\mathrm{min}}&\leq\frac{1}{p_{\mathrm{dist}}}\braket{\Phi^{+}}{(\mathbbm{1}_{\mathrm{A}}\otimes
E)\mathbin{\circ}M_{i}[\rho]}{\Phi^{+}}\ \forall i\\\
p_{\mathrm{dist}}&=\operatorname{tr}\bigl{(}(\mathbbm{1}_{\mathrm{A}}\otimes
E)\mathbin{\circ}M_{i}[\rho]\bigr{)}\ \forall i\\\ \rho&\succeq
0,\quad\operatorname{tr}\rho=1\\\ C(E)&\succeq
0,\quad\operatorname{tr}_{\mathrm{B}}\mathbin{\circ}E\preceq\mathbbm{1}_{\mathrm{R}}\text{.}\end{aligned}\right.$
(7)

Here, $\mathbbm{1}_{S}$ is the identity map acting on a system $S$,
$\mathbin{\circ}$ denotes composition, and the partial order with respect to
the positive semidefinite cone is indicated by $\succeq$ and $\preceq$. We
will traditionally label the two parties Alice and Bob, although in most
cases, they will be repeater nodes. Following this convention, the state
$\rho$ is defined on the systems $\mathrm{A}$ and $\mathrm{S}$; each $M_{i}$
maps $\mathrm{S}$ to $\mathrm{R}$222In fact, depending on which combination of
subsystems arrived, we get different $\mathrm{R}_{i}$; but in the “reduced”
erasure scenario described in sections 2.2.1 and 2.4, we identify all those
different $\mathrm{R}_{i}$ with each other.; and finally, the map $E$ turns
$\mathrm{R}$ into $\mathrm{B}$.

Equation 7 is a generalized bilinear and semidefinite program—which can also
be written as an indefinite quadratically constrained and semidefinite
program—obtaining a global solution is NP-hard.

Note that eq. 7 is different from the standard formulation of entanglement
distillation, in that it allows one party to perform global operations
_before_ sending the state, which is encoded in the state preparation
procedure. Traditional distillation protocols instead assume that the two
parties are given parts of a rather arbitrary state and have to make the best
out of it; however, if the distribution state is actually under control, not
exploiting this power relinquishes a potential advantage.

In the following subsections, we will detail how to reduce the dimensionality
of eq. 7 and show how to approach the problem numerically in an efficient way.
We then proceed to give details on the actual implementation and results.

_Alternatives._ We note that while the formulation of eq. 7 is natural and the
favorable reduction in dimensionality appears to be a direct consequence, it
is not the _only_ natural formulation. We might demand not the _minimum_ , but
the _average_ fidelity to be maximized. Instead of fixing each _individual_
success probability, we might choose to fix only the _overall_ success
probability. While these changes to the problem formulation are certainly
well-justified, they do not enable a reduction in dimensionality, so that we
will not consider them. Finally, we also did not allow for the conditional
execution of a single unitary Alice’s site, depending on a measurement outcome
at Bob’s, as we did not find any improvement using this freedom.

###  3.3 Reducing dimensionality

Even if eq. 7 were convex, note that $\rho\in\mathcal{B}(\mathbb C^{2^{s+1}})$
and $C(E)\in\mathcal{B}(\mathbb C^{2^{r+1}})$, which means that the program
size scales exponentially in the number of sent or received particles. Solving
the problem for more than a handful of photons would be impossible.

However, note that we optimize the minimum of the fidelity over all possible
losses, and every loss channel has to give rise to the same probability.
Consequently, the optimal $\rho$ and $C(E)$ will be graded in terms of the
worst loss configuration. We can thus make the following _ansatz_ :

$\displaystyle\rho=\sum_{a_{1},a_{2}=0}^{1}\sum_{i,j=0}^{s}\rho_{a_{1},a_{2}}(i,j)\ket{a_{1}D^{s}_{i}}\\!\bra{a_{2}D^{s}_{j}}\text{,}$
(8) where
$\displaystyle\ket{D^{s}_{i}}\coloneqq\frac{1}{\sqrt{\binom{s}{i}}}\sum_{\begin{subarray}{c}x_{1},\dotsc,x_{s}\in\\{0,1\\}\\\
\sum_{k}x_{k}=i\end{subarray}}\ket{x_{1},\dotsc,x_{s}}$ (9)

is a Dicke state [78]—i.e., we assume that the coefficients in the
$2^{s+1}\times 2^{s+1}$ matrix $\rho$ only depend on the stored qubit at Alice
and the _number_ of set bits that arrive at Bob, but not on their particular
order. The structure is now similar to a permutation invariant quantum code
[79, 80], without imposing the Knill-Laflamme conditions [24]. In this way, we
exploit that favoring one particular loss configuration at the expense of
another will actually _reduce_ the final (minimum) fidelity—so the best way to
start is to make them all equal. While this reasoning is intuitive and also
supported by numerical studies for small $s$ and $r$, a formal proof of
optimality faces various problems; e.g., even if all reduced states are equal,
they do not necessarily imply an original Dicke state; and there is no direct
relation between the fidelities arising from an arbitrary state and its
closest symmetrized version.

The Dicke states are all orthonormal; we can thus reduce our attention to the
$2(s+1)\times 2(s+1)$-dimensional subspace that hosts our matrix $\rho$.

In order to be able to work with these much smaller states, we must consider
the action of any partial trace of $s-r$ qubits, excluding the one stored at
Alice’s site, on the full state. It is given by (in appendix A, we explicitly
derive a more general version)

$\operatorname{tr}_{\mathrm{loss}}\rho=\sum_{a_{1},a_{2}=0}^{1}\sum_{k,\ell=0}^{r}\sum_{i=0}^{s-r}\binom{s-r}{i}\sqrt{\frac{\binom{r}{k}\binom{r}{\ell}}{\binom{s}{k+i}\binom{s}{\ell+i}}}\cdot{}\\\
\rho_{a_{1},a_{2}}(k+i,\ell+i)\ket{a_{1}D^{r}_{k}}\\!\bra{a_{2}D^{r}_{\ell}}\text{.}$
(10)

This structure already shows that the exact same symmetry argument will be
valid for the Choi state $C(E)$ of the distillation map, which will take the
form

$C(E)=\sum_{b_{1},b_{2}=0}^{1}\sum_{i,j=0}^{r}c_{b_{1},b_{2}}(i,j)\ket{b_{1}D^{r}_{i}}\\!\bra{b_{2}D^{r}_{j}}\text{.}$
(11)

We define the tensor

$D_{k,\ell;k^{\prime},\ell^{\prime}}\coloneqq\delta_{k^{\prime}-k,\ell^{\prime}-\ell}\binom{s-r}{k^{\prime}-k}\sqrt{\frac{\binom{r}{k}\binom{r}{\ell}}{\binom{s}{k^{\prime}}\binom{s}{\ell^{\prime}}}}$
(12)

and find

$E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}=\sum_{a_{1},a_{2}=0}^{1}\sum_{b_{1},b_{2}=0}^{1}\ket{a_{1}b_{1}}\\!\bra{a_{2}b_{2}}\cdot{}\\\
\sum_{k,\ell=0}^{r}\sum_{k^{\prime},\ell^{\prime}=0}^{s}c_{b_{1},b_{2}}(k,\ell)D_{k,\ell;k^{\prime},\ell^{\prime}}\rho_{a_{1},a_{2}}(k^{\prime},\ell^{\prime})\text{.}$
(13)

The symmetry considerations have allowed us to reduce the number of (non-
slack) degrees of freedom in the optimization from $2^{2(s+1)}+2^{2(r+1)}$ to
$4(s+1)^{2}+4(r+1)^{2}$. An immediate side-effect is that we no longer have to
consider $\binom{s}{r}$ constraints on both fidelity and probability arising
from all possible loss channels, as they automatically all give rise to the
same final state.

The problem now reads

$\left\\{\begin{aligned}
\mathrlap{\max_{E,\rho}\frac{1}{p_{\mathrm{dist}}}\braket{\Phi^{+}}{E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho]}{\Phi^{+}}}\hphantom{\operatorname{tr}_{\mathrm{out}}E}&\\\
&\hskip 3.8889pt\mathclap{\text{subject to}}\\\
p_{\mathrm{dist}}&=\operatorname{tr}\mathbin{\circ}E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}\\\
\rho&\succeq 0\\\ \operatorname{tr}\rho&=1\\\ C(E)&\succeq 0\\\
\operatorname{tr}_{\mathrm{B}}\mathbin{\circ}E&\preceq\mathbbm{1}_{\mathrm{R}}\text{.}\end{aligned}\right.\qquad$
(14)

The program itself does not explicitly introduce complex numbers; but of
course, $\rho$ and $C(E)$ are hermitian, not necessarily real. Based on the
fact that at least for every stabilizer code, there is an equivalent real-
valued version [81] and preliminary numerical studies with small parameters
$s$ and $r$ that always lead to real-values solutions, we will assume that
both $\rho$ and $E$ are real-valued, reducing the number of degrees of freedom
to $(s+1)(2s+3)+(r+1)(2r+3)$. While dropping this requirement may open up
possibilities for improvement on the results presented here, it considerably
helps to keep the numerics tractable. Almost all numerical solvers work with
real inputs only; hence hermitian matrices must be represented in a double-
sized real matrix with block-symmetry constraints. Convex solvers typically
require a time that is at least cubic in the size of the semidefinite matrices
involved, which is a huge drawback; and for nonconvex solvers, the more
variables are involved, the less confidence can be obtained about global
optimality when some termination criteria are met.

###  3.4 Reformulation: convex subproblems

We investigated various approaches to obtain good solutions for eq. 14.
Obviously, eq. 14 turns into a convex problem once either $E$ or $\rho$ are
fixed. This leads to two possible reformulations:

  1. 1.

given $E$, find $\rho$:

$\left\\{\begin{aligned}
\mathrlap{\max_{\rho}\frac{1}{p_{\mathrm{dist}}}\braket{\Phi^{+}}{E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho]}{\Phi^{+}}}\hphantom{\operatorname{tr}_{\mathrm{out}}E}&\\\
&\hskip 3.8889pt\mathclap{\text{subject to}}\\\
p_{\mathrm{dist}}&=\operatorname{tr}\mathbin{\circ}E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}\\\
\rho&\succeq 0\\\ \operatorname{tr}\rho&=1\end{aligned}\right.\qquad$ (15a)

  2. 2.

given $\rho$, find $E$:

$\left\\{\begin{aligned}
\mathrlap{\max_{E}\frac{1}{p_{\mathrm{dist}}}\braket{\Phi^{+}}{E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho]}{\Phi^{+}}}\hphantom{\operatorname{tr}_{\mathrm{out}}E}&\\\
&\hskip 3.8889pt\mathclap{\text{subject to}}\\\
p_{\mathrm{dist}}&=\operatorname{tr}\mathbin{\circ}E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}\\\
C(E)&\succeq 0\\\
\operatorname{tr}_{\mathrm{B}}\mathbin{\circ}E&\preceq\mathbbm{1}_{\mathrm{R}}\end{aligned}\right.\qquad$
(15b)

Both reformulations can be solved in total by nonconvex, and in general local,
optimization methods that, in each iteration, in turn call a convex solver for
the convex subproblem. Note that for the nonconvex eq. 15b, we can make use of
another insight: for sure, the best initial state will be pure; mixed states
can be interpreted as a loss of information of which pure state was prepared,
which can never increase the final fidelity. This argument does not hold for
$C(E)$, which in fact will turn out to be mixed at the optimum as soon as
$r>2$—the optimal measurement is not projective. Hence, while we have to
optimize over about $(r+1)(2r+3)$ nonconvex degrees of freedom in eq. 15a, we
only need to consider about $2(s+1)$ nonconvex degrees of freedom in eq. 15b.
Of course, this is counteracted by the expected orders of magnitude $r\sim 1$,
$s\gg 1$ of the parameters. Still, all nonconvex optimization algorithms we
tried turned out to cope tremendously better with a state vector than with a
general matrix optimization.

###  3.5 Reformulation: convex iteration

The nonconvexity in eq. 7 stems from the fact that
$E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}$ contains products of
$\rho$ and $E$. Note

$x=yz\Leftarrow\operatorname{rk}\begin{pmatrix}a&x&y\\\ x&b&z\\\
y&z&1\end{pmatrix}=1\text{,}$ (16)

i.e., we can rewrite any product as a rank-one constraint, which is still non-
convex.

Relaxing the rank-one by a positive semidefinite constraint removes any
correlation between $x$ and $yz$: for all $x$, $y$, $z$, there exist $a$, $b$
such that the matrix is positive semidefinite. Therefore, the optimum of the
relaxed problem will have nothing to do with the original problem.

However, note that a feasibility problem that is, apart from rank(-one)
constraints, convex, can be re-cast in the form of a sequence of convex
problems which are non-increasing in the sum of all but the largest singular
value [82, 83]. This sequence will, in general, not converge to zero, but we
will later describe heuristics that allow to steer out of local rank minima.

We will briefly outline the general procedure, closely following [82, chapter
4.5]. First, eq. 7 has to be cast into a feasibility problem, which we found
to be superior to its alternative, multi-objective optimization. Therefore,
instead of maximizing the output fidelity, we fix a certain value for the
fidelity and use the feasibility problem to check whether this is valid. The
line $F\in[0,1]$ can then be scanned to re-obtain the maximization. Here, a
binary search is not necessarily the most efficient way. In fact, a linear
search can greatly outperform the binary search, as the convex iteration will
profit from a good initial vector from the last round. Proceeding in small
steps of, say, $\Delta F=0.01$ will allow to quickly progress for a large
range of fidelities with less than five iterations per check, whereas large
steps could easily take hundreds of iterations. On top of this, detection of
infeasibility is not a definite conclusion: the iteration might just be stuck
in a local minimum.

Now, our problem is to

$\left\\{\begin{aligned} &\hskip
3.8889pt\mathclap{\operatorname*{find}_{E,\rho}\,\\{G_{i}\\}_{i}}\\\ &\hskip
3.8889pt\mathclap{\text{subject to}}\\\
F&=\frac{1}{p_{\mathrm{dist}}}\sum_{i}\mathcal{F}_{i}G_{i}^{1,2}\leavevmode\hbox
to0pt{\vbox to0pt{\pgfpicture\makeatletter\hbox{\hskip 0.0pt\lower 0.0pt\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{
}\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{
}\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{
}\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{} \pgfsys@invoke{\lxSVG@closescope
}\pgfsys@endscope\hbox
to0.0pt{}{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope
}\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}\\\
p_{\mathrm{dist}}&=\sum_{i}\mathcal{P}_{i}G_{i}^{1,2}\\\ \rho&\succeq
0,\quad\operatorname{tr}\rho=1\\\ C(E)&\succeq
0,\quad\operatorname{tr}_{\mathrm{B}}\mathbin{\circ}E\preceq\mathbbm{1}_{\mathrm{R}}\leavevmode\hbox
to0pt{\vbox to0pt{\pgfpicture\makeatletter\hbox{\hskip 0.0pt\lower 0.0pt\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{
}\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{
}\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{
}\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{} \pgfsys@invoke{\lxSVG@closescope
}\pgfsys@endscope\hbox
to0.0pt{}{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope
}\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}\\\
\operatorname{rk}G_{i}&=\operatorname{rk}\begin{pmatrix}G_{i}^{1,1}&G_{i}^{1,2}&C(E)_{\mathfrak
c(i)}\\\ G_{i}^{1,2}&G_{i}^{2,2}&\rho_{\mathfrak r(i)}\\\ C(E)_{\mathfrak
c(i)}&\rho_{\mathfrak r(i)}&1\end{pmatrix}=1\ \forall
i\text{.}\end{aligned}\right.\leavevmode\hbox to24.91pt{\vbox
to15.67pt{\pgfpicture\makeatletter\hbox{\hskip-14.02638pt\lower-2.85378pt\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{
}\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{
}\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{
}\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox
to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{}{}{}{}{}{{}}{}
{}{}{}{}{{{}{}}}{{}} {}{{}{}}{}{}{}{{}}{{}}{{}{}}{{}{}}{{{{}{}{{}} }}{{}} {}
{}{}{} { {{}} {} {}{}{} {}{}{} } { {{}} {} {}{}{} } }{{}{}}{{}{}}{{{{}{}{{}}
}}{{}}}
{}\pgfsys@moveto{14.22638pt}{11.3811pt}\pgfsys@moveto{14.22638pt}{11.3811pt}\pgfsys@curveto{14.97638pt}{11.00612pt}{15.47638pt}{10.1311pt}{15.47638pt}{8.8811pt}\pgfsys@lineto{15.47638pt}{7.47923pt}\pgfsys@curveto{15.47638pt}{6.22923pt}{15.97636pt}{5.35422pt}{16.72638pt}{4.97923pt}\pgfsys@curveto{15.97636pt}{4.60425pt}{15.47638pt}{3.72923pt}{15.47638pt}{2.47923pt}\pgfsys@lineto{15.47638pt}{1.07736pt}\pgfsys@curveto{15.47638pt}{-0.17264pt}{14.97638pt}{-1.04765pt}{14.22638pt}{-1.42264pt}\pgfsys@stroke\pgfsys@invoke{
}\hbox{\hbox{{\pgfsys@beginscope\pgfsys@invoke{ }{{}{}{{ {}{}}}{ {}{}}
{{}{{}}}{{}{}}{}{{}{}} { }{{{{}}\pgfsys@beginscope\pgfsys@invoke{
}\pgfsys@transformcm{1.0}{0.0}{0.0}{1.0}{20.60466pt}{0.47923pt}\pgfsys@invoke{
}\hbox{{\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{
}\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{
}\hbox{{\vbox{\halign{#\hfil\cr\cr\vskip-1.42264pt\cr\hbox{{${}\eqqcolon\boxast$}}\cr}}}}
}}\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope}}}
\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope}}}
\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope\hbox
to0.0pt{}{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope
}\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}$ (17)

Here, we construct $3\times 3$-matrices $G_{i}$ for every product of a $C(E)$
with a $\rho$ entry that appears as a term in the fidelity or probability. The
vectors $\mathcal{F}$ and $\mathcal{P}$ contain the corresponding
coefficients, and the functions $\mathfrak c$ and $\mathfrak r$ map the index
$i$ to the index in the matrices $C(E)$ and $\rho$, respectively.

A step in the convex iteration is made up of the semidefinite program

$\left\\{\begin{aligned}
&\min_{E,\rho,\\{G_{i}\\}_{i}}\sum_{i}\braket{G_{i},W_{i}}\\\ &\text{subject
to}\\\ \mathrlap{\boxast\text{, see
\lx@cref{creftype~refnum}{eqn:rankcon}}}\hphantom{G_{i}}&\\\ G_{i}&\succeq 0\
\forall i\text{.}\end{aligned}\right.$ (18)

Here, $\braket{A,B}\coloneqq\operatorname{tr}(A^{\top}B)$ is the Hilbert-
Schmidt scalar product. Initially, we choose $W_{i}$ filled with $1$ in every
entry (but other choices, such as the identity, are also possible333We found
that the identity will converge faster; however, it is also more likely to end
up with a non-fixable stall than when starting with the matrix of
$1$-entries.). Having found the optimal $\\{G_{i}\\}_{i}$ for eq. 18, we
decompose
$G_{i}=U_{i}\operatorname{diag}(\lambda_{i}^{1},\lambda_{i}^{2},\lambda_{i}^{3})U_{i}^{\top}$,
where the columns of $U_{i}$ are made up of the eigenvectors of $G_{i}$, and
$0\leq\lambda_{i}^{1}\leq\lambda_{i}^{2}\leq\lambda_{i}^{3}$ are the
corresponding eigenvalues. We obtain the direction vector for the next
iteration by $W_{i}\mapsto U_{i}^{\star}U_{i}^{\star\top}$, where
$U_{i}^{\star}$ has the last column dropped (i.e., the one corresponding to
the largest eigenvalue). In this way, the quantifier of rank violation,
$\sum_{i}\sum_{j=1}^{2}\lambda_{i}^{j}$, will never increase from iteration to
iteration [82]. However, it might not converge to zero.

If the iteration stalls, i.e., the quantifier of rank violation does not
decrease notably, we empirically find that the following perturbation allows
to steer out of the local minimum; it slightly differs from the one proposed
in [82]. Let $\bm{r}_{i}\in[0,0.01]^{2}$ be a random vector and
$\bm{u}_{i}^{3}$ the eigenvector of $U_{i}$ corresponding to the largest
eigenvalue $\lambda_{i}^{3}$. Then, the next $W_{i}$ is given by
$W_{i}=U^{\star}\bigl{(}\bm{r}_{i}^{\vphantom{3}}\bm{u}_{i}^{3\top}+U^{\star\top}\bigr{)}$.
Note that the range of the random values is carefully chosen: larger ranges
will completely deteriorate the iteration without any hope of recovery, while
smaller ranges will not produce the desired liberation from the current
valley.

Also note that while the iteration was formulated in primal form, the
corresponding dual form is actually more economic.

Equation 17 is not the most efficient formulation of the problem in terms of
rank constraints. Given that these constraints are nonconvex, we want to keep
their number as small as possible. Observe that both $C(E)$ and $\rho$ are
symmetric matrices, i.e., $c_{b_{1},b_{2}}(k,\ell)=c_{b_{2},b_{1}}(\ell,k)$
and likewise for $\rho$. To incorporate this symmetry, we will extend $D$ and,
writing output indices before input indices, define

$D_{A_{1},B_{1},A_{2},B_{2};b_{1},k;b_{2},\ell;a_{1},k^{\prime};a_{2},\ell^{\prime}}\coloneqq\delta_{A_{1},a_{1}}\delta_{B_{1},b_{1}}\delta_{A_{2},a_{2}}\delta_{B_{2},b_{2}}D_{k,\ell;k^{\prime},\ell^{\prime}}$
(19)

in terms of the four-index $D$-tensor introduced in eq. 12.

We now have

$\displaystyle\braket{A_{1}B_{1}}{E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}}{A_{2}B_{2}}$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{b_{1},b_{2}=0}^{1}\sum_{k,\ell=0}^{r}\sum_{k^{\prime},\ell^{\prime}=0}^{s}c_{b_{1},b_{2}}(k,\ell)D_{A_{1},B_{1},A_{2},B_{2};b_{1},k;b_{2},\ell;a_{1},k^{\prime};a_{2},\ell^{\prime}}\rho_{a_{1},a_{2}}(k^{\prime},\ell^{\prime})\text{.}$
(20) Due to the symmetry of $C(E)$ and $\rho$, we can replace, leaving
$E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}$ invariant,
$\displaystyle
D_{A_{1},B_{1},A_{2},B_{2};b_{1},k;b_{2},\ell;a_{1},k^{\prime};a_{2},\ell^{\prime}}$
$\displaystyle\mapsto\frac{1}{4}\biggl{(}\begin{subarray}{c}\displaystyle
D_{A_{1},B_{1},A_{2},B_{2};b_{1},k;b_{2},\ell;a_{1},k^{\prime};a_{2},\ell^{\prime}}+D_{A_{1},B_{1},A_{2},B_{2};b_{1},k;b_{2},\ell;a_{2},\ell^{\prime};a_{1},k^{\prime}}\hfill\\\
\displaystyle{}+D_{A_{1},B_{1},A_{2},B_{2};b_{2},\ell;b_{1},k;a_{1},k^{\prime};a_{2},\ell^{\prime}}+D_{A_{1},B_{1},A_{2},B_{2};b_{2},\ell;b_{1},k;a_{2},\ell^{\prime};a_{1},k^{\prime}}\end{subarray}\biggr{)}\text{.}$
(21)

Next, we can drop all entries from $D$ that refer to, say, strict lower
triangles of the input and output matrices, and adjust the remaining terms
appropriately. For example, we drop all entries from $D$ where
$(a_{1},k^{\prime})\equiv
a_{1}(2s+1)+k^{\prime}>a_{2}(2s+1)+\ell^{\prime}\equiv(a_{2},\ell^{\prime})$,
and multiply by $2$ those with $(a_{1},k^{\prime})<(a_{2},\ell^{\prime})$. We
then end up with a rank-three tensor that maps the vectorized upper triangles
of $C(E)$ and $\rho$ to the vectorized upper triangle of
$E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}$. In fact, we can
further reduce this by, in the output index, already summing over the elements
required for the trace or overlap, respectively. The dimensions of the tensor
are now $2$, $(r+1)(2r+3)$, and $(s+1)(2s+3)$. We perform singular value
decompositions of the two matrices in the second and third indices; it turns
out that it is possible to find joint left- and right-singular bases to both
of them. We get

$\displaystyle\operatorname{tr}E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}$
$\displaystyle=\sum_{i}d_{i}^{\mathrm{tr}}\braket{c}{d_{i}^{c}}\braket{d_{i}^{\rho}}{\rho}$
(22a)
$\displaystyle\braket{\Phi^{+}}{E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}}{\Phi^{+}}$
$\displaystyle=\sum_{i}d_{i}^{\Phi}\braket{c}{d_{i}^{c}}\braket{d_{i}^{\rho}}{\rho}$
(22b)

All $(r+1)(2r+3)$ singular values $d_{i}^{\Phi}$ for the overlap are non-zero;
for the trace, we find $(r+1)(r+2)/2$ nonzero elements $d_{i}^{\mathrm{tr}}$.

In this way, we only need to calculate the product of $(r+1)(2r+3)$ overlaps,
which therefore also defines the number of rank constraints. In particular, it
is independent of $s$.

Finally, note that we can reduce the number of iteration variables further.
For this, we remark that

$yz=\frac{(y+z)^{2}-(y-z)^{2}}{4}\text{;}$ (23)

so any multiplicative constraint can instead be rewritten by two quadratic and
some linear constraints. The quadratic constraints are of course also non-
convex; but the hypograph $t\geq x^{2}$ is a convex set. We therefore write

$\displaystyle\braket{c}{d_{i}^{c}}\braket{d_{i}^{\rho}}{\rho}$
$\displaystyle=\frac{\bigl{(}\braket{c}{d_{i}^{c}}+\braket{d_{i}^{\rho}}{\rho}\bigr{)}^{2}-\bigl{(}\braket{c}{d_{i}^{c}}-\braket{d_{i}^{\rho}}{\rho}\bigr{)}^{2}}{4}$
$\displaystyle\geq\frac{\bigl{(}\braket{c}{d_{i}^{c}}+\braket{d_{i}^{\rho}}{\rho}\bigr{)}^{2}-t_{i}}{4}\text{,}$
(24) where $\displaystyle t_{i}$
$\displaystyle\geq\bigl{(}\braket{c}{d_{i}^{c}}-\braket{d_{i}^{\rho}}{\rho}\bigr{)}^{2}\text{,}$
(25)

While this is of no use for the trace, where we need an exact equality—as the
overlap with the Bell state is only a valid indicator for the fidelity if the
trace is fixed—it is helpful for the overlap. Since we want to maximize the
fidelity, we can alternatively use this lower bound for all singular values
$d_{i}^{\Phi}$ where $d_{i}^{\mathrm{tr}}=0$; and this requires only $2\times
2$ rank matrices, reducing the number of iteration variables from six to three
per matrix.

###  3.6 Practical optimization

All reformulations have their individual advantages and disadvantages. Finding
a suitable initial point for the nonconvex optimization is problematic, though
it is of considerable help to express both $\rho$ and $C(E)$ in their singular
bases found in eq. 22. In order to reduce the likeliness of getting stuck in a
local optimum, we would need to combine a local nonconvex optimization (such
as Nelder-Mead [84]) with global methods (such as basin-hopping [85, 86]),
which has dramatic impacts on the solving time of the nonconvex problems. The
convex iteration, in turn, allows to quickly approach relatively good values,
but in order to cross some “fidelity barriers,” hundreds or thousands of
iterations are necessary until an appropriate random perturbation vector is
found that allows to steer out of the local rank basin—even for relatively
small system sizes.

Here, we propose a combined approach: We first perform convex iteration until
no significant rank improvements were possible for at least $50$ iterations.
For large values of $s$, we then use the output Choi state as an initial point
for the nonconvex eq. 15a, which does not work as well as eq. 15b, but allows
to steer into the right direction. To get a high-quality solution, we finally
always employ eq. 15b, starting with the dominant eigenvector of $\rho$ that
resulted from the previous optimization.

To improve reliability, the optimization proceeds independently on all
probability sample points; after it has finished for probability
$p_{\mathrm{dist}}$, the output state will be used as initial point for eq.
15b with the neighboring probabilities $p_{\mathrm{dist}}\pm\Delta
p_{\mathrm{dist}}$. If this improves the previously-found solution by a
certain threshold, we use the new result for the next probability in the same
direction, until improvement is no longer achieved.

As nonlinear optimization algorithm, we investigated all suitable methods
implemented in the SciPy optimization library [87], and also CMA [88]. For eq.
15a, only constrained methods (restricting all variables to $[-1,1]$) were
able to provide any useful result at all; and SLSQP [89] proved to be the
superior one both in terms of speed and quality of the results by far. The
most reliable algorithm for eq. 15b turned out to be BFGS [90, 91, 92, 93,
94]. To perform the convex optimizations, we employ the MOSEK Optimization
Suite 9.2.29 [95]. We strongly recommend using an interior-point solver for
the convex iterations, as we experienced that iterations took longer and
longer with a first-order solver—in our case, SCS [96, 97]—while naturally
being much less accurate.

All our implementations are available in a GitHub repository [98]. While the
individual classes starting with Optimizer correspond to the algorithms
described in all parts of section 3 and can be used purely as an API, we
provide two command line applications that may be used to generate all the
numerical data backing our LABEL:fig:fidsr and 5. We give a visual depiction
of this optimization pipeline fig. 3.

python Main.py <$d$> <$s$> <$r$> optional argument default • \--outermap
(apply eq. 15a?) _unset_ • \--erasure (use ideas from section 3.9, not
described in this figure) _unset_ • \--pmin=<value> (minimum probability to
scan) 0.01 • \--pmax=<value> (maximum probability to scan) 1.00 •
\--workers=<value> (number of threads) machine-dependent for
$p\in\\{\text{pmin},\text{pmin}+0.01,\dotsc,\text{pmax}\\}$:
OptimizerDickeConvexIteration.py • check: $F\in\\{0.50,0.51,\dotsc,1\\}$
possible? • at most 50 iterations per $F$ • algorithm: section 3.5
convex solver: MOSEK • output: bestState[p], bestMap[p] if outermap:
OptimizerDickeOuterMap.py • input: bestMap[p] • algorithm: sections 3.4 and
15a
outer solver: SciPy SLSQP; convex solver: MOSEK • output: bestState[p],
bestMap[p], bestF[p] stateOptimize(p, bestState[p]) queue stateOptimize(p -
0.01, bestState[p]) queue stateOptimize(p + 0.01, bestState[p])
stateOptimize(p, bestState) if p $\notin[\text{pmin},\text{pmax}]$: return
OptimizerDickeOuterState.py • input: bestState[p] • algorithm: sections 3.4
and 15b
outer solver: SciPy BFGS; convex solver: MOSEK • output: newBestState,
newBestMap, newF if newF $>$ bestF[p]: bestState[p] $\coloneqq$ newBestState
bestMap[p] $\coloneqq$ newBestMap bestF[p] $\coloneqq$ newF queue
stateOptimize(p-0.01, newBestState) queue stateOptimize(p+0.01, newBestState)
Figure 3: Algorithmic description of the optimization pipeline implemented in
our GitHub repository [98]. This depicts the main optimization program
described in section 3.6, and based on the algorithms discussed in sections
3.4 and 3.5; additionally, the parameter $d$ allows to control the dimension
of the sent systems, as described in section 3.7. We also implemented a second
optimization program MainAllR.py, which takes into account multiple values of
$r$ (see section 3.8); consult the command line help for its arguments. Note
that both the main program with the erasure switch activated and the
optimization over all values of $r$ do not scale very well and should
therefore only be considered for the case of qubits and small values of $s$
and $r$.

###  3.7 Moving to qudits

In section 2.3, we already mentioned the possibility to exploit more photonic
degrees of freedom by transmitting higher-dimensional systems. The
consequences are not immediately obvious: While now the arrival of a single
photon can in principle transmit more information, also the loss of a single
photon will lead to losing more information. Let $F_{2}(s,r,p)$ denote the
fidelities obtained for qubits; then, assuming that a photon allows to
implement $m\in\mathbb N$ qubits, the minimum achievable fidelity
$F_{2^{m}}(s,r,p)$ is

$F_{2^{m}}(s,r,p)\geq\max\bigl{\\{}F_{2}(s,r,p),F_{2}(ms,mr,p)\bigr{\\}}\text{,}$
(26)

while the arrival probability is independent of $m$. Since this lower bound is
obtained by either ignoring the new degrees of freedom or by considering them
all independently, $F_{2^{m}}$ might actually be larger if we exploit the fact
that the degrees of freedom pertaining to a single photon are always
guaranteed to arrive together.

The formalism introduced before only needs to be adapted slightly in order to
be able to deal with qudits. Closely following section 3.3, the dimensionality

reduction is now based on the _ansatz_

$\rho=\sum_{a_{1},a_{2}=0}^{1}\;\sum_{\bm{i},\bm{j}\in[s]_{d}}\rho_{a_{1},a_{2}}(\bm{i},\bm{j})\ket{a_{1}D^{s}_{\bm{i}}}\\!\bra{a_{2}D^{s}_{\bm{j}}}\text{,}$
(27)

where

$[s]_{d}\coloneqq\Biggl{\\{}\bm{i}\in\mathbb
N_{0}^{d}:\sum_{m=0}^{d-1}i_{m}=s\Biggr{\\}}$ (28)

and

$\ket{D^{s}_{\bm{i}}}\coloneqq\frac{1}{\sqrt{\binom{s}{\bm{i}}}}\sum_{\begin{subarray}{c}x_{1},\dotsc,x_{s}\in\\{0,\dotsc,d-1\\}\\\
\lvert\\{j:x_{j}=m\\}\rvert=i_{m}\ \forall
m\end{subarray}}\ket{x_{1},\dotsc,x_{s}}$ (29)

is the Dicke qudit state for $s=\mathinner{\lvert\bm{i}\rvert}$ particles in
which the level $m$ occurs $i_{m}$ times ($m\in\\{0,\dotsc,d-1\\}$). Here, we
used the multinomial coefficient,

$\binom{s}{\bm{i}}\equiv\binom{s}{i_{0},\dotsc,i_{d-1}}\coloneqq\begin{dcases}\frac{s!}{i_{0}!\dotsm
i_{d-1}!}&\begin{subarray}{c}\displaystyle\text{if }\sum_{m=0}^{d-1}i_{m}=s\\\
\displaystyle\hfill{}\land\bm{i}\succeq 0\end{subarray}\\\ \
0&\text{else,}\end{dcases}$ (30)

where $\bm{i}\succeq 0$ is a component-wise inequality.

In appendix A, we derive the action of the partial trace of $s-r$ qubits (any
apart from the first one) on the full state eq. 27. It is given by

$\operatorname{tr}_{\mathrm{loss}}\rho=\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{i}\in[s-r]_{d}}\sum_{a_{1},a_{2}=0}^{1}\binom{s-r}{\bm{i}}\sqrt{\frac{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}{\binom{s}{\bm{k}+\bm{i}}\binom{s}{\bm{\ell}+\bm{i}}}}\rho_{a_{1},a_{2}}(\bm{k}+\bm{i},\bm{\ell}+\bm{i})\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}\text{.}$
(31)

With the help of the tensor

$\displaystyle D_{\bm{k},\bm{\ell};\bm{k}^{\prime},\bm{\ell}^{\prime}}$
$\displaystyle\coloneqq\delta_{\bm{k}^{\prime}-\bm{k},\bm{\ell}^{\prime}-\bm{\ell}}\binom{s-r}{\bm{k}^{\prime}-\bm{k}}\sqrt{\frac{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}{\binom{s}{\bm{k}^{\prime}}\binom{s}{\bm{\ell}^{\prime}}}}\text{,}$
(32)

we can now also express $E$—here, $C(E)$—in terms of Dicke states with
coefficients $c_{b_{1},b_{2}}(\bm{k},\bm{\ell})$ and finally find

$E\bigl{[}\operatorname{tr}_{\mathrm{loss}}\rho\bigr{]}=\sum_{a_{1},a_{2}=0}^{1}\sum_{b_{1},b_{2}=0}^{1}\ket{a_{1}b_{1}}\\!\bra{a_{2}b_{2}}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{k}^{\prime},\bm{\ell}^{\prime}\in[s]_{d}}c_{b_{1},b_{2}}(\bm{k},\bm{\ell})D_{\bm{k},\bm{\ell};\bm{k}^{\prime},\bm{\ell}^{\prime}}\rho_{a_{1},a_{2}}(\bm{k}^{\prime},\bm{\ell}^{\prime})\text{.}$
(33)

While also here, the dimensionality reduction was able to greatly reduce the
number of degrees of freedom, the situation is much more problematic than
before. Since

$\mathopen{\bBigg@{1.2}\lvert}\big{[s]_{d}}\mathclose{\bBigg@{1.2}\rvert}=\binom{s+d-1}{d-1}\simeq\frac{s^{d-1}}{(d-1)!}$
(34)

for large $s$, the complexity is now at least quadratic in $s$ and becomes
intractable extremely quickly. Therefore, we can only optimize low numbers of
$s$, $r$, and $d$ with the hope of finding optimal solutions.

###  3.8 Using more sophisticated processing

All previous schemes assumed that the number of received variables is some
constant $r$. However, due to the probabilistic nature of the transmission,
the whole range $r\in\\{0,\dotsc,s\\}$ is in principle a valid choice444Dark
counts may in principle even allow for $r>s$, which we will not consider here.
Note that every quantum signal may be accompanied by a classical heralding
signal that allows to greatly diminish the effect of dark counts.. We might
therefore decide to generalize our optimization problem to

$\left\\{\begin{aligned}
\mathrlap{\max_{E_{1},\dotsc,E_{s},\rho}\frac{1}{p_{\mathrm{tot}}}\braket{\Phi^{+}}{\rho_{\mathrm{f}}}{\Phi^{+}}}\hphantom{\operatorname{tr}_{\mathrm{out}}E}&\\\
&\hskip 3.8889pt\mathclap{\text{subject to}}\\\
\operatorname{tr}\rho_{\mathrm{f}}&=p_{\mathrm{tot}}\\\ \rho&\succeq 0\\\
\operatorname{tr}\rho&=1\\\ C(E_{j})&\succeq 0\ \forall j\\\
\operatorname{tr}_{\mathrm{B}}\mathbin{\circ}E_{j}&\preceq\mathbbm{1}_{\mathrm{R}}\
\forall j\\\
\rho_{\mathrm{f}}&=\sum_{j=1}^{s}\binom{s}{j}p_{\mathrm{trans}}^{j}\bar{p}_{\mathrm{trans}}^{s-j}E_{j}\bigl{[}\operatorname{tr}_{\mathrm{keep}\,j}\rho\bigr{]}\text{.}\end{aligned}\right.$
(35)

Here, we replaced the probability of successful distillation
$p_{\mathrm{dist}}$ by the total success probability $p_{\mathrm{tot}}$ that
also incorporates the channel transmission.

While we wrote “for all $j$” in eq. 35, for all practical purposes, we can fix
a certain relative probability threshold; for arrival configurations with a
lower probability than this threshold, we can disregard the additional maps.

This approach is only moderately more time- and resource consuming when using
eq. 15b, but eqs. 15a and 18 will suffer greatly under the increase of
variables. On top of this comes the difficulty in experimentally implementing
this scheme, where, depending on the number of arrived photons, a different
map has to be applied. Finally, the procedure now explicitly contains the
transmission probability—and since in real life, distances between repeater
stations will vary, this may in fact imply different optimal maps and states
depending on which repeater is the next in the chain. For these reasons, we
will mostly refrain from using eq. 35. When we briefly report some results
from this optimization, we use the output states of the convex optimization
routine for $r=2$ and feed them as inputs to eq. 35, using an outer nonconvex
optimization over the initial state.

###  3.9 Exploiting full erasure knowledge

Our _ansatz_ crucially relied on the fact that we considered a “reduced”
erasure scenario, i.e., we did not assume the information of which particular
photon combination arrived to be available. This was reflected in the fact
that in eq. 7, the distillation map $E$ did not depend on the slot
configuration index $i$. We may choose to insert such a dependency,
introducing a whole family of distillation maps $E_{i}$ instead (or, combined
with eq. 35, even a two-parameter family $E_{j,i}$). In order to exploit this
new information, the use of Dicke states now becomes prohibitive: due to their
full symmetry with respect to a permutation of particles, we cannot improve
our results in the setting of reduced dimensionality. Solving this problem for
large values of $s$ and $r$ is not viable, but we are able to explore the
landscape for small values mainly through eq. 15b.

###  3.10 Processing the result data

The initial states $\rho$ arising from the numerical optimizations will
necessarily be pure. However, these $\rho=\ket{\psi}\\!\bra{\psi}$ still
appear like arbitrarily complicated states. Note that the same final fidelity
can be achieved if an arbitrary single-qubit rotation with angle $\alpha$ is
carried out on the qubit stored at the sender’s site and $s$ identical
(transversal) single-qubit rotations with an angle $\beta$ (or their higher-
dimensional counterparts) are performed on the sent qubits. By minimizing the
number of nonzero components in $\ket{\psi}$ and the Choi state, this freedom
in $\alpha$ and $\beta$ allows the complicated numerical output to still
correspond to relatively tractable states. After applying this cardinality
reduction to the full data, we re-perform the optimization, removing the
close-to-zero components from the beginning. This will speed up the
optimization and lead to better results; however, in eq. 22, the singular
bases will no longer coincide for trace and overlap, so that we use the nested
optimization approach.

We note that the most promising way for improving both resource consumption
and quality of the simulations would be to identify the relevant non-zero
coefficients beforehand.

##  4 Results

###  4.1 Qubit scenario

We applied the optimization algorithms described in the previous sections to
$1\leq r\leq 10$. LABEL:fig:fidsr shows the fidelities for various parameters
$s$, $r$, and $p_{\mathrm{dist}}$ that can be achieved by explicit protocols
using qubit transmission. The probabilities were sampled in
$1\,\mathrm{\%}$-steps in the interval $[0.01,1]$.

The number of variables is small enough for these simulations that we can gain
confidence in the actual optimality of the numerical lower bounds. The case
$p_{\mathrm{dist}}=1$ that is usually considered for QECC is now only the
extreme point of lowest distillation fidelity; by lowering the distillation
success probability, we get access to higher fidelities. As
$p_{\mathrm{dist}}$ goes to zero, we may pass one or multiple points at which
the fidelity curve is nonsmooth—the optimal initial state then takes a
qualitatively different form that would have been suboptimal before.

From [27], we know that there is a deterministic quantum erasure correcting
code that is able to fully recover from a single erasure for $s=4$, $r=3$
(actually, this code falls into the same “reduced” class as we are studying),
and that $s<4$ does not allow for this. Our numerical data indeed confirms
this.

Note that for $s=5$, $r=3$, the best possible deterministic recovery gives a
fidelity of $80\,\mathrm{\%}$. Knowing that the perfect five qubit code [99]
has distance $3$, it is actually possible to perfectly correct for two
erasures deterministically; this gives an example of how we could improve if
we assumed access to the full knowledge of which particular erasure occurred.
While our numerical scheme hinted at in section 3.9 is indeed able to provide
such a code that gives a fidelity of $99.87\,\mathrm{\%}$, this already
stretches the capabilities of the algorithm; for $s=6$, $r=3$, there are so
many variables that this advanced scheme delivers worse results than the
reduced one.

Using the technique described in section 3.10, in some cases—mainly for
$p_{\mathrm{dist}}=1$—we are able to derive analytical forms for the optimal
states and maps based on the numerical data. We detail those results in
appendix B.

###  4.2 Qudit scenario

When looking at the results for higher-dimensional carriers such as qutrits,
we cannot claim the same level of confidence in the optimality of the results
because of the much higher number of degrees of freedom. Nevertheless, we
compare some of the results in fig. 5.

We observe a very diverse behavior. Sometimes, moving to higher-dimensional
systems can pay off: Let us fix $s$, then there is a minimal $r^{\prime}\leq
s$ that still allows to distill perfect pairs with unit probability for qubits
(in the worst case, $r^{\prime}=s$). The $(s,r^{\prime}-1)$ combination will
then typically profit greatly from moving to higher-dimensional information
carriers. Often, an advantage is visible only for distillation probabilities
smaller than $1$, but some combinations such as $s=4$, $r=2$ do not seem to
have any potential for improvement (which has nothing to do with the
$50\,\mathrm{\%}$ loss mark—we find improvements for codes with less than,
exactly, and more than $50\,\mathrm{\%}$ loss). If qutrits are able to
increase the fidelity, then ququarts can sometimes do even better; but
sometimes, there is nothing to be gained. The question whether these issues
pertain to the insufficient numerical means or whether we actually hit a
barrier that cannot be overcome even by moving to still higher-dimensional
carriers remains open.

Note that the full knowledge of which particular erasure happened, as
mentioned in section 3.9, could in principle be encoded in some way in higher-
dimensional states. The new basis states might be used to flag the different
components occurring in the Dicke state, which—depending on how well these
flags can still be identified after the loss—could then be used to implement
the different distillation maps $E_{i}$ as a single quantum map. However, this
is _not_ what happens in the cases reported here: It would require the
preparation to be made in the full basis, not the Dicke basis, i.e., there is
no way to use the enlarged dimension in order to flag the different
configurations in our scheme.

###  4.3 Comparison to known entanglement distillation schemes

$0.2$$0.4$$0.6$$0.8$$1$$0.7$$0.8$$0.9$$1$$p_{\mathrm{dist}}$$F$$(s,r)$$(2,1)$$(3,2)$$(5,2)$

$0.4$$0.5$$0.6$$0.7$$0.8$$0.9$$1$$0.8$$0.85$$0.9$$0.95$$1$$p_{\mathrm{dist}}$$F$$(s,r)$$(5,3)$$(6,4)$$(7,4)$

Figure 5: Comparison between lower bounds on the fidelities for qubit channels
(_solid lines_ , as in LABEL:fig:fidsr), qutrit channels (_dashed lines_),
ququart channels (_dashed–dotted lines_), and ququint channels (_dotted
lines_). Various combinations of $s$ and $r$ are color-coded. We only show a
channel of higher dimensionality in those cases in which we have been able to
find an improved lower bound numerically. Increasing the tested dimension may
tighten the bound further.

Our procedure allows us to simultaneously obtain optimal states and maps in
order to circumvent channel attenuation. It is interesting to see how our
results compare to known entanglement distillation schemes. Since these
schemes typically favor a different approach, namely starting from a
completely unknown state, the most fair way of conducting such a comparison is
to take a known entanglement distillation protocol from the literature and
apply eq. 15a on it—i.e., we allow to make the most out of this protocol by
choosing the optimal input state. We go a step further than what we did with
our own schemes and allow arbitrary—in particular, also complex-valued—initial
states for the known protocols. This can now easily be done, as the
optimizations are semidefinite programs.

Still, it has to be taken into account that the protocols we are referring to
actually are recurrence protocols, so they are meant to be applied multiple
times in a row—typically with dramatic consequences for the success
probability and state consumption. While by a sequential subselection instead
of a parallel one or incorporating further feedback [100], their input state
consumption may be greatly reduced, this is impossible without backwards
communication or even multiple rounds of two-way communication. Here, we only
take into account a single application of the distillation procedure.

####  4.3.1 BBPSSW/DEJMPS

The first known entanglement distillation protocol was the one by Bennett _et
al._ [101, *bib:Bennett1996b2], known as BBPSSW after its authors. It is the
predecessor of the Quantum Privacy Amplification protocol DEJMPS, by Deutsch
_et al._ [61, *bib:Deutsch1998, 63]; however, if the distillation operation is
applied only once, both are equivalent. We depict the procedure in circuit
form in LABEL:fig:bbpssw1; for a description of the protocol, see the figure
caption. LABEL:fig:bbpssw2 shows how we adapt the protocol to our scenario for
comparison. We compare the optimal fidelities in LABEL:fig:bbpssw3 with our
own schemes and can indeed observe quite significant improvements. Note that
the DEJMPS protocol was found to be the optimal two-particle distillation
protocol if the shared states are Bell-diagonal (as is a common assumption in
entanglement distillation) and of rank at most three [75], or if the possible
distillation operations consist of local permutations of the Bell basis [72].

####  4.3.2 CNot double selection

As an example of an entanglement distillation protocol among three particles,
we choose the double selection circuit in [103], which is depicted in
LABEL:fig:cnotcnot1. Since the postselection now is on coincidences of two
pairs of measurements, it is no longer possible to prepare an initial state in
such a way that a successful outcome is always obtained, but instead
$p_{\mathrm{dist}}\leq\frac{2}{3}$. As is evidenced in LABEL:fig:cnotcnot3,
also the double selection circuit is by far inferior to our results; in fact,
we are even able to numerically arrive at a code that deterministically
protects against the loss.

####  4.3.3 Further schemes

We did similar comparisons with the CCNot distillation scheme [68] ($r=3$),
the exemplary scheme for $r=4$ by Dehaene _et al._ [72], as well as the triple
selection scheme ($r=4$) given in [76]. Since all of those procedures are
based on coincidence measurements of $r-1$ particles, the maximum success
probability has an upper bound that decreases with $r$. The fidelity
achievable by our codes naturally was always an upper bound to those schemes;
and unless they are able to deliver unit fidelity results, there actually is a
large gap.

$1\,\mathrm{km}$$11\,\mathrm{km}$$21\,\mathrm{km}$$31\,\mathrm{km}$$41\,\mathrm{km}$$51\,\mathrm{km}$$61\,\mathrm{km}$$71\,\mathrm{km}$$81\,\mathrm{km}$$91\,\mathrm{km}$$0$$0.2$$0.4$$0.6$$0.8$$1$$0.5$$0.6$$0.7$$0.8$$0.9$$1$$p_{\mathrm{tot}}$$L$($F$

$5\,\mathrm{\%}$$15\,\mathrm{\%}$$25\,\mathrm{\%}$$35\,\mathrm{\%}$$45\,\mathrm{\%}$$55\,\mathrm{\%}$$65\,\mathrm{\%}$$75\,\mathrm{\%}$$85\,\mathrm{\%}$$95\,\mathrm{\%}$$20$$40$$60$$80$$100$$0.5$$0.6$$0.7$$0.8$$0.9$$1$$L$
($\mathrm{km}$)$p$$F$

Figure 7: Lower bounds on the maximally achievable fidelities for a pure loss
channel. $p_{\mathrm{tot}}$ represents the product of the transmission with
the distillation success probability. The transmission probabilities are based
on eq. 2 and the typical attenuation coefficient
$\alpha=0.2\,\mathrm{\frac{dB}{km}}$, for various distances $L$ (_left_) and
total success probabilities (_right_), as indicated by the line labels. The
data was obtained by taking the best possible distillation protocol according
to eq. 14 for a certain probability (floored to integer percent values) out of
all simulations. The lines are cut off at the left at the point at which
direct transmission without any multiplexing (giving $F=1$) would outperform
all encodings that we studied. The lines are cut off at the right due to the
fact that we only scanned a finite set of configurations, so that we did not
consider every possible success probability—though of course, every desired
probability can be achieved.

##  5 Discussion

###  5.1 Taking attenuation into account

All results on entanglement distillation protocols—except from eq. 35—cannot
be immediately related to the task of counteracting channel losses. The
abscissa in LABEL:fig:fidsr refers to the success probability of the
distillation scheme _alone_. We still have to take into consideration the
probability of successfully transmitting the required multiplexed state,
$P_{\mathrm{trans}}=\sum_{i=r}^{s}\binom{s}{i}p_{\mathrm{trans}}^{i}\bar{p}_{\mathrm{trans}}^{s-i}$.
In order to check this, we assembled the numerical data from all simulations
that we carried out and replaced the success probability of distillation by
the total success probability. We then took the best fidelity possible for any
given probability and plotted this data in fig. 7.

We can indeed observe how our optimization schemes are able to deliver
entangled states in the regimes at which direct transmission fails. The
fidelity of these states of course depends strongly on the desired total
success probability and is thus tunable.

We note that there is potential for improvement by using eq. 35, i.e.,
employing different maps depending on the different possible values of $r$. We
considered this eq. for a subset of the previous configurations. Figure 6
shows that this can indeed lead to a large payoff, in particular when high
success probabilities are desired: despite our pool of protocols being much
smaller, the fidelities obtained in this way in some instances are almost as
good as the previous ones for $10\,\mathrm{km}$ less distance (almost
$60\,\mathrm{\%}$ higher success probability).

$11\,\mathrm{km}$$21\,\mathrm{km}$$31\,\mathrm{km}$$41\,\mathrm{km}$$51\,\mathrm{km}$$61\,\mathrm{km}$$71\,\mathrm{km}$$81\,\mathrm{km}$$91\,\mathrm{km}$$0$$0.2$$0.4$$0.6$$0.8$$1$$0.5$$0.6$$0.7$$0.8$$0.9$$1$$p_{\mathrm{tot}}$$F$
Figure 6: Lower bounds on the maximally achievable fidelities for a pure loss
channel, using maps that depend on the number of arrived states. The
transmission probabilities are based on eq. 2 and the typical attenuation
coefficient $\alpha=0.2\,\mathrm{\frac{dB}{km}}$ for various distances $L$.
The _dashed lines_ are the same as in fig. 7, where we only considered a fixed
map; the _solid lines_ allow for different maps depending on the actual number
of received states. The data was obtained by taking the best possible
distillation protocol according to eq. 35 for a certain probability (floored
to integer percent values) out of all simulations. The lines are cut off at
the left at the point at which direct transmission without any multiplexing
(giving $F=1$) would outperform all encodings that we studied. The lines are
cut off at the right due to the fact that we only scanned a finite set of
configurations, so that we did not consider every possible success
probability—though of course, every desired probability can be achieved. Note
that there were much fewer samples from which we took the optimum for the
solid lines compared to the dashed ones.

###  5.2 Implications for conventional entanglement distillation

We will use this section to slightly deviate from our original goal to find
suitable procedures that work in a quantum repeater scenario and consider the
task of “pure” entanglement distillation instead. Recurrence schemes have the
advantage of working in the low-fidelity regime, but they have exponentially
low yields and require two-way communication. Therefore, usually, a recurrence
distillation is carried out only until the fidelity is high enough to allow
the hashing protocol [60] to continue, which can asymptotically distill
perfect states using one-way communication only.

Though not designed with this particular purpose in mind, our protocols are of
course valid “pre-hashing” schemes. To investigate this, we calculate the von
Neumann entropy $S$ [104] of the final two-party state $\rho_{\mathrm{f}}$
after a complete dephasing in the Bell basis. After this single step of
distillation, we can, using only one-way communication, asymptotically distill
perfect Bell pairs with a rate $1-S$ [60]. In fact, for this particular use,
it would have been a meaningful alternative not to maximize $F$, but instead
minimize $S$ in all previous programs. However, while the entropy of a state
after a dephasing in a particular basis can be accessed in a convex program by
means of the exponential cone [105], being concave, it cannot be minimized
efficiently. We therefore use our fidelity approach as an approximation to the
entropy optimization, where we calculate the latter _a posteriori_.

There are two main ways in which we might connect our results with a hashing
protocol. The one-way communication approach requires us to mix the final
state $\rho_{\mathrm{f}}$ with a maximally mixed state, with weights
corresponding to the total success and failure probability, respectively.
While this procedure always gives a state, the fidelities that can be achieved
are naturally rather modest; this is only viable for relatively short
distances and low-loss scenarios. Naturally, the optimal distillation protocol
will always be the deterministic one, as the maximally mixed state that
compensates for the reduced success probability is worse than the benefit that
we can possibly obtain from an increased fidelity. When we compare the entropy
of directly transmitted states with the entropy after the best of our
distillation schemes in fig. 7, we are still able to find significant
improvements. The distillation can increase the critical distance with one-way
communication from $6\,\mathrm{km}$ to about $9\,\mathrm{km}$. Compared to
QECCs, which can offer up to $15\,\mathrm{km}$—and indeed, the perfect
$\mathord{\llbracket 5,1,3\rrbracket}$ code [99] accomplishes this—this seems
to suggest far from optimal results. However, in fig. 7, we depict the
performance of the $\mathord{\llbracket 5,1,3\rrbracket}$ code555To make the
comparison most meaningful, we take the logical states of the code to form the
encoded state
$\ket{0}\otimes\ket{0}_{\mathrm{L}}+\ket{1}\otimes\ket{1}_{\mathrm{L}}$. For
_every_ loss configuration—which is much more than what we allow for in our
codes—we optimize to find the ideal map that gives a unit-trace final state
with maximal fidelity., and we also investigate how well this code can perform
if applied to our chosen setting, where we do not fully exploit the
information on which particular loss configuration arrived. In the latter
case, we clearly observe how our codes surpass the QECC—despite that fact that
for our codes, we even fix $r$, while we still allow $r$-dependent correction
maps for the QECC. We conjecture that indeed, the possibility to discriminate
the basis states with the same number of set bits is crucial to get the best
possible performance.

$(3,6,4,1)$$(4,5,3,1)$$(2,48,1,1)$$(2,72,1,1)$$0$$20$$40$$60$$80$$0$$0.5$$1$$1.5$$2$$1$$L$
($\mathrm{km}$)$S$direct transmissionoptimized
distillation$\mathord{\llbracket 5,1,3\rrbracket}$ code
(full)$\mathord{\llbracket 5,1,3\rrbracket}$ code (red.) Figure 7: Entropies
$S$ of the Bell-diagonalized normalized final states $\hat{\rho}_{\mathrm{f}}$
after transmission through a pure loss channel. The transmission probabilities
are based on eq. 2 and the typical attenuation coefficient
$\alpha=0.2\,\mathrm{\frac{dB}{km}}$, for various distances $L$. More
precisely, as we rely on one-way communication only, we look at the von
Neumann entropies of
$p_{\mathrm{tot}}\hat{\rho}_{\mathrm{f}}+(1-p_{\mathrm{tot}})\mathbbm{1}/4$.
The data was obtained by taking the best possible distillation protocol
according to eq. 14 out of all simulations at each sample point (integer
kilometers); the multiplexed curve is therefore an upper bound. For selected
points, we give the combinations $(d,s,r,p_{\mathrm{dist}})$ that gave rise to
the optimal value. The largest sampled multiplexing value was $s=75$. We also
compare this with the entropies obtained by using the perfect
$\mathord{\llbracket 5,1,3\rrbracket}$ code [99], where we take optimal
correction maps that can either depend on the full information of which
particular configuration arrived, or only take into account the reduced
information of how many qubits survived.

For our codes, we observe that only a few combinations
$(d,s,r,p_{\mathrm{dist}})$ turn out to be optimal protocols; with less than
$50\,\mathrm{\%}$ losses, these are particularly promising qudit protocols;
for high losses, we naturally have $r=1$. It is interesting to see that the
best protocol for a long time is with $s=48$, before it switches to $s=73$,
where $s=75$ was the maximum simulated. Only looking at the fidelity—which is
monotonically decreasing with $s$—there is no particular reason to single out
these two combinations; however, this is where the difference between fidelity
and entropy optimization shows. A multitude of different entropies can give
the same fidelity; and due to the randomness of our starting points in the
optimizations, the $s\in\\{48,73\\}$ configurations turned out to give the
best entropy. This already shows the limitations of applying our single-shot
scenario in the asymptotic regime; it is highly likely that the upper bound in
fig. 7 can in fact be lowered by more suitable optimization strategies or
exploiting even higher-dimensional carriers. Still, this scenario is not
suitable for surpassing the $15\,\mathrm{km}$ barrier; it aims at distilling
perfect states and relies on deterministic protocols, so that it is bound by
the no-cloning theorem.

The second way to combine our results with hashing is to consider a
distillation task that allows for two-way communication. In this way, both the
unsuccessful transmission as well as an unsuccessful distillation can be
signaled back and therefore do not have an impact on the state, at the expense
of being more resource-intensive. The interesting quantity in this regard is
the (inverse) yield: How many packets of $s$ particles are required, on
average, to obtain a single perfect Bell pair, when we choose our best
distillation protocol and feed its output into the hashing protocol? In fig.
8, we plot the inverse yields, both when we count the application of our
protocol as a single send step and when we count it in terms of the number of
sent particles $s$. We can observe that for short distances,
$p_{\mathrm{dist}}=1$ is still optimal; but for longer distances,
$p_{\mathrm{dist}}=\frac{1}{2}$ in fact becomes the best protocol. In all
cases, the best protocols are the ones that already give unit fidelity, i.e.,
those that completely avoid the hashing protocol. Figure 8 shows that, when
measured in terms of packets, we get a clear advantage in the
$p_{\mathrm{trans}}>\frac{1}{2}$ range, but direct transmission—where we send
Bell state halves—always has the advantage in the high-loss regime.

$(3,3,2,1)$$(3,2,1,\frac{1}{2})$$(2,7,5,1)$$(3,3,2,1)$$L$
($\mathrm{km}$)inverse yield$0$$20$$40$$60$$80$$10^{0}$$10^{1}$$10^{2}$direct
transmissiondist. per sent packetdist. per sent photon Figure 8: Inverse
yields for the distillation of perfect Bell pairs across a loss channel of
given length. The data was obtained by taking the best possible distillation
protocol according to eq. 14 out of all simulations at each sample point
(integer kilometers); the multiplexed curve is therefore an upper bound. For
selected points, we give the combinations $(d,s,r,p_{\mathrm{dist}})$ that
gave rise to the optimal value. _Direct transmission_ corresponds to the
inverse of the success probability of transmission. The curve _dist. per sent
packet_ assumes that each instance of our protocol counts as one channel use;
the curve _dist. per sent photon_ counts every protocol use by its number of
sent photons $s$. Note that since this weighting affects which protocol is
optimal, both curves do in general not give the same protocol for the same $L$
(although they do over a large range).

We remark that in the two-way communication scenario, it is meaningful to ask
about multiple successive applications of our protocols. Without the
possibility to signal back, this would be no better—but potentially worse—than
one of our protocols with twice the number of received particles, while
feedback can in principle allow to increase the yield. This comes at the
expense of delaying the distillation operation at the sender’s site until the
feedback has arrived.

###  5.3 Implications for quantum key distribution

Our procedure was motivated by the problem of quantum key distribution, where
the final secret key rate is linearly dependent on $p_{\mathrm{trans}}$, but
can drop to zero if other errors are too high. Note that here, we allow for
two-way communication, as long as it has to occur only between the
communication partners at the end of the line and not between repeaters;
hence, it only adds an initial latency, but does not affect scalability.

For a repeaterless operation mode, we plot the secret key rate, eq. 1, in fig.
9 and again see significant rate improvements for short lengths (where the
optimal protocols are deterministic), while direct transmission is at the
advantage in the high-loss regime (where the optimal protocols are
probabilistic—using eq. 35, they even give the same rates as the direct
transmission, but cannot surpass them).

$20$$40$$60$$80$$10^{-2}$$10^{-1}$$10^{0}$$L$ ($\mathrm{km}$)secret bit rate
per transmissiondirect transmissionoptimized distillation Figure 9: Secret bit
rates per sent packet after transmission through a pure loss channel,
achievable via two-way communication between the two stations. The
transmission probabilities are based on eq. 2 and the typical attenuation
coefficient $\alpha=0.2\,\mathrm{\frac{dB}{km}}$, for various distances $L$.
The data was obtained by taking the best possible distillation protocol
according to eq. 14 out of all simulations at each sample point (integer
kilometers); the multiplexed curve is therefore a lower bound.

We will now apply our protocol in the scenario it was developed for, namely,
for the use of a quantum repeater. We take the simplest case and assume that
we use a single quantum repeater. For all of our protocols, we carry out the
following procedure. Alice and the first repeater individually prepare a copy
of the multi-qubit state as dictated by the protocol; the repeater sends the
appropriate parts to Bob, Alice sends them to the repeater. Both the first
repeater and Bob carry out their distillation procedure as required by the
protocol; the global state now is
$\rho_{\mathrm{f}}^{\mathrm{AR}}\otimes\rho_{\mathrm{f}}^{\mathrm{RB}}$, where
we denoted the systems in superscripts, and $\rho_{\mathrm{f}}$ is precisely
the best normalized approximation of $\ket{\Phi^{+}}\\!\bra{\Phi^{+}}$ that
the protocol was able to deliver. The repeater now carries out an optimal
entanglement swapping protocol for this particular state. This protocol is
defined by the following convex optimization problem (in fact, the objective
is not convex, but is easily obtained from two convex optimizations):

$\mathclap{\left\\{\begin{aligned}
&\min_{\\{\Lambda_{k},\rho_{k}\\}_{k=1}^{4},e_{X},e_{Z}}\\{e_{X},e_{Z}\\}\\\
&\hskip 3.8889pt\mathclap{\text{subject to}}\\\ C(\Lambda_{k})&\succeq 0\
\forall k\\\ \smash[b]{\sum_{k}}\vphantom{\sum}\Lambda_{k}&=\mathbbm{1}\\\
\rho_{k}&=(\mathbbm{1}^{\mathrm{A}}\otimes\Lambda_{k}\otimes\mathbbm{1}^{\mathrm{B}})\bigl{[}\rho_{\mathrm{f}}^{\mathrm{AR}}\otimes\rho_{\mathrm{f}}^{\mathrm{RB}}\bigr{]}\\\
e_{X}&\begin{multlined}=\braket{\mathord{+}\mathord{-}}{\rho_{1}+\rho_{2}}{\mathord{+}\mathord{-}}+\braket{\mathord{-}\mathord{+}}{\rho_{1}+\rho_{2}}{\mathord{-}\mathord{+}}\\\
+\braket{\mathord{+}\mathord{+}}{\rho_{3}+\rho_{4}}{\mathord{+}\mathord{+}}+\braket{\mathord{-}\mathord{-}}{\rho_{3}+\rho_{4}}{\mathord{-}\mathord{-}}\end{multlined}=\braket{\mathord{+}\mathord{-}}{\rho_{1}+\rho_{2}}{\mathord{+}\mathord{-}}+\braket{\mathord{-}\mathord{+}}{\rho_{1}+\rho_{2}}{\mathord{-}\mathord{+}}\\\
+\braket{\mathord{+}\mathord{+}}{\rho_{3}+\rho_{4}}{\mathord{+}\mathord{+}}+\braket{\mathord{-}\mathord{-}}{\rho_{3}+\rho_{4}}{\mathord{-}\mathord{-}}\\\
e_{Z}&\begin{multlined}=\braket{01}{\rho_{1}+\rho_{3}}{01}+\braket{10}{\rho_{1}+\rho_{3}}{10}\\\
+\braket{00}{\rho_{2}+\rho_{4}}{00}+\braket{11}{\rho_{2}+\rho_{4}}{11}\text{.}\end{multlined}=\braket{01}{\rho_{1}+\rho_{3}}{01}+\braket{10}{\rho_{1}+\rho_{3}}{10}\\\
+\braket{00}{\rho_{2}+\rho_{4}}{00}+\braket{11}{\rho_{2}+\rho_{4}}{11}\text{.}\end{aligned}\right.}$
(36)

Here, the four possible instruments of the protocol (in standard entanglement
swapping, those would be the projections onto the four Bell basis elements)
are given by the maps $\Lambda_{k}$, which in total are trace-preserving666In
fact, instead of trace preservation, we can again ask for probabilistic
swapping maps. Computationally, the probability must be fixed beforehand, so
this requires a line scan. We also investigated this case and found no
improvements by a nondeterministic swap.. Their application leads to four
(subnormalized) possible outcomes $\rho_{k}$, defined at Alice’s and Bob’s
site. In standard entanglement swapping, we would now require local correction
operations; this amounts to the fact that the bit error rates in the two
bases, $e_{X}$ and $e_{Z}$, are calculated based on anticorrelations for half
of the outcomes, but on correlations for the other half.

Running eq. 36 for all protocols, we obtain the bit error rates with one
repeater. We combine them with the success probabilities to get the true
asymptotic secret bit rates and then compare them with the rates for direct
transmission over the _double_ length in fig. 10.

$20$$40$$60$$80$$10^{-2}$$10^{-1}$$10^{0}$$L$ ($\mathrm{km}$)secret bit rate
per transmissiondirect transmissionoptimized distillation Figure 10: Secret
bit rates per sent packet after transmission through a pure loss channel,
achievable via two-way communication between the two final stations, with one
quantum repeater at $L/2$. The transmission probabilities are based on eq. 2
and the typical attenuation coefficient $\alpha=0.2\,\mathrm{\frac{dB}{km}}$,
for various distances $L$. The data was obtained by taking the best possible
distillation protocol according to eq. 14 out of all simulations, combined
with optimal entanglement swapping at each sample point (integer kilometers);
the multiplexed curve is therefore a lower bound.

While here, we still observe the same behavior that as soon as the individual
stations are more than $15\,\mathrm{km}$ apart, direct transmission is
advantageous, the repeater advantage clearly shows over the full length.
Interestingly, we find that the optimal protocol for most of the relevant
range is again the deterministic $d=3$, $s=3$, $r=2$, $p_{\mathrm{dist}}=1$,
which allows for perfect distillation. Since in this case, traditional
entanglement swapping is optimal, the results can be generalized in a
straightforward way to an arbitrary number of repeaters using this particular
protocol.

###  5.4 Experimental remarks

Our scheme delivers numerically optimized states and maps. While analytical
optimality proofs are not available, extensive numerical testing suggests that
these result are close to the optimum. We always assumed that the channel
itself is a pure loss channel that exhibits no further errors and that both
state preparation and execution of the map are flawless. Due to these
simplifications, our results are theoretical bounds. Real-life noise will put
additional constraints on the actual performance; however, having the bounds
in mind allows to assess whether improvements in the quality of, say, state
preparation are worthwhile.

Both the preparation and the distillation map are very well under control and
we can expect that the continuous development of quantum technology will allow
to approach the idealized states and maps to a better and better degree.
However, additional sources of error in the channel (or necessary pre- and
post-channels such as frequency conversion) must be thoroughly investigated.
While our simulation methods are also able to incorporate further errors, we
might instead try to nest the loss-tolerant codes with other well-established
QECCs. It is not immediately obvious that this approach can work: If we first
encode our data with the loss-tolerant code and then each physical qubit with
a traditional code, due to high losses, the traditional code will not even be
able to restore the inner code. Hence, we must first encode our data with a
traditional QECC and then with a loss-tolerant code. Upon recovery, we must
compensate for losses; but is this still possible if other errors deteriorated
the state?

We finally remark that our codes rely heavily on the use of Dicke states. In
the last years, the preparation of qubit Dicke states has received some
attention and by now, there are various theoretical proposals as well as
working implementations, e.g., in ions [106, 107], atoms [108, 109, 110],
quantum dots [111], photonic systems [112, 113], or as a quantum circuit
[114]. Some already address how to create arbitrary superpositions of Dicke
states [107, 115, 116]. Most, but not all [117] are limited to relatively few
qubits. Qudit Dicke states are much less explored; we are aware only of one
very recent proposal that allows to efficiently verify qudit Dicke states
[118], which may also be a starting point when it comes to implementing the
maps.

##  6 Conclusion

The contributions in this paper are twofold.

First, we describe a general numerical methodology that allows to optimize
quantum problems in which both a state as well as a map acting on a linearly
transformed version of this state are unknowns. These methods are quite
general in their applicability and we expect them to be able to offer helpful
insight into a lot of problems that require simultaneous optimization over
states and maps. In fact, such problem formulations are very common especially
in the definition of resource theoretic measures such as entanglement [119] or
channel capacities [120]. While the limit of infinite copies that is often
required in these measures is of course out of reach of a numerical algorithm,
optimizing for the first couple of copies certainly help in building an
intuition; and if the measure features some kind of additivity property, this
allows to derive bounds.

We then use our methodology to carry out a detailed study on how a pure loss
channel can be compensated for by using new codes and procedures for
entanglement distillation. All codes are parametrized, so that in an
application, we can choose between higher fidelities or higher total success
probabilities. While we indeed found that in some parameter ranges, non-
deterministic distillation procedures gave better secret bit rates, this only
occurred in the high-loss regime in which direct transmission would deliver
results of at least the same quality. This does not rule out the possibility
of increasing the rate by probabilistic distillation, but the restricted set
of state we looked at might not be able to validate this.

While most of our studies were carried out on qubits, we also investigated
higher-dimensional carriers. For the particular case of $p_{\mathrm{dist}}=1$,
this corresponds to qudit erasure correcting codes and can also be extended to
qudit quantum error correcting codes, a subject with only few contributions so
far [121, 122, 123]. For the case of the reduced erasure situation, we found
that sometimes, using higher-dimensional information carriers instead of
qubits can significantly boost the fidelity, keeping the same distillation
success probability.

We showed that further advantage can be gained if the receiver is able to
choose the postprocessing map dependent on the number of arrived states. Our
procedure was limited to the reduced erasure case, in which we exploited the
erasure information only by removing failed slots from the input to the
distillation map, but not by choosing different maps for different
configurations. This approach facilitated a mapping to low-dimensional vector
spaces, which allowed us to carry out trustworthy simulations for a large
number of qubits. However, we also found that the knowledge of the precise
erasure configuration is actually able to significantly boost the distillation
fidelity. Hence, the results that are optimal in our scenario can in fact be
improved much further. While the full Hilbert spaces are hardly tractable for
larger number of photons, it may be possible to use our results as a starting
point and single out various smaller-scaled subproblems that arise from
expanding the Dicke basis, which may then in fact render the full-dimensional
optimization feasible.

Our approach opens a new way to the task-driven derivation of (probabilistic)
error correcting or distillation codes and is able to significantly enhance
the quality of signal transmission through lossy channels even under the
reduced erasure regime, which does not exploit all available information. We
expect that our methodology can be applied to design other codes—either of few
qubits or exploiting symmetries—for example to protect small registers for
certain operations in a quantum computer against noise and errors. The
advantage of the optimization procedure is that a better characterization of
the noise can directly manifest in better protocols—provided effective states
and maps can be devised from the intended ones linearly777For the convex
iteration and the outer optimization, more complicated dependencies can be
thought of..

We investigated entanglement generation as an elementary building block of
QKD. A set of protocols for different parameters generated by numerical
studies as outlined in this paper can then be used in other optimization
algorithms that are concerned with scaling up single-link connections to whole
networks [124, 125].

We already pointed at direct possible sequels to this work; in particular,
trying to use the full information available about the erasures should deliver
much more optimized schemes. A second step is to take into account other
typical sources of quantum errors in channels, preparation and processing, and
whether a concatenation of loss-tolerant with standard QECCs is able to
provide sufficient protection. In this way, we can find optimal realizations
under realistic constraints, as opposed to the theoretical limits that we
considered in this paper.

## Code and data availability

The full code to carry out the simulations is available on GitHub [98]; see
fig. 3 and the Readme of the repository for a brief overview. Numerical data
is available from the authors upon request.

We appreciate helpful discussions with Thomas Theurer. This project is funded
by the Federal Ministry of Education and Research (BMBF) grants number
16KIS0875 and 16KISQ006. The authors acknowledge support by the state of
Baden-Württemberg through bwHPC and the German Research Foundation (DFG)
through grant no INST 40/575-1 FUGG (JUSTUS 2 cluster).

## References

  * Bennett and Brassard [1984] C. H. Bennett and G. Brassard, in  _International Conference on Computers, Systems & Signal Processing_, Vol. 1, edited by K. Soundararajan (1984) pp. 175–179.
  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Theoretical Computer Science 560, 7 (2014), reprint of 1984.
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 (2000).
  * Renner [2005] R. Renner,  _Security of Quantum Key Distribution_ , Ph.D. thesis, Swiss Federal Institute of Technology, Zürich (2005), arXiv:quant-ph/0512258v2 .
  * Scarani  _et al._ [2009] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, _et al._ , Rev. Mod. Phys. 81, 1301 (2009).
  * Agrawal [2010] G. P. Agrawal,  _Fiber-Optic Communication Systems_ , 4th ed. (John Wiley & Sons, 2010).
  * Takeoka  _et al._ [2014] M. Takeoka, S. Guha, and M. M. Wilde, Nature Communications 5, 5235 (2014).
  * Pirandola  _et al._ [2017] S. Pirandola, R. Laurenza, C. Ottaviani, _et al._ , Nature Communications 8, 15043 (2017).
  * Briegel  _et al._ [1998] H.-J. Briegel, W. Dür, J. I. Cirac, _et al._ , Phys. Rev. Lett. 81, 5932 (1998).
  * Sangouard  _et al._ [2011] N. Sangouard, C. Simon, H. de Riedmatten, _et al._ , Rev. Mod. Phys. 83, 33 (2011).
  * Azuma  _et al._ [2015] K. Azuma, K. Tamaki, and H.-K. Lo, Nature Communications 6, 6787 (2015).
  * Azuma  _et al._ [2016] K. Azuma, A. Mizutani, and H.-K. Lo, Nature Communications 7, 13523 (2016).
  * Pirandola [2019] S. Pirandola, Communications Physics 2, 51 (2019).
  * Peev  _et al._ [2009] M. Peev, C. Pacher, R. Alléaume, _et al._ , New Journal of Physics 11, 075001 (2009).
  * Sasaki  _et al._ [2011] M. Sasaki, M. Fujiwara, H. Ishizuka, _et al._ , Opt. Express 19, 10387 (2011).
  * Stucki  _et al._ [2011] D. Stucki, M. Legré, F. Buntschu, _et al._ , New Journal of Physics 13, 123001 (2011).
  * Lo  _et al._ [2005] H.-K. Lo, H. F. Chau, and M. Ardehali, Journal of Cryptology 18, 133 (2005).
  * Kraus  _et al._ [2005] B. Kraus, N. Gisin, and R. Renner, Phys. Rev. Lett. 95, 080501 (2005).
  * Renner  _et al._ [2005] R. Renner, N. Gisin, and B. Kraus, Phys. Rev. A 72, 012332 (2005).
  * Smith  _et al._ [2008] G. Smith, J. M. Renes, and J. A. Smolin, Phys. Rev. Lett. 100, 170502 (2008).
  * Bradley  _et al._ [2019] C. E. Bradley, J. Randall, M. H. Abobeih, _et al._ , Phys. Rev. X 9, 031045 (2019).
  * Shor [1995] P. W. Shor, Phys. Rev. A 52, R2493 (1995).
  * Steane [1996] A. M. Steane, Phys. Rev. Lett. 77, 793 (1996).
  * Knill and Laflamme [1997] E. Knill and R. Laflamme, Phys. Rev. A 55, 900 (1997).
  * Gottesman [1997] D. Gottesman,  _Stabilizer Codes and Quantum Error Correction_ , Ph.D. thesis, California Institute of Technology, Pasadena (1997), arXiv:quant-ph/9705052v1 .
  * Muralidharan  _et al._ [2016] S. Muralidharan, L. Li, J. Kim, _et al._ , Scientific Reports 6, 20463 (2016).
  * Grassl  _et al._ [1997] M. Grassl, T. Beth, and T. Pellizzari, Phys. Rev. A 56, 33 (1997).
  * Park [1970] J. L. Park, Foundations of Physics 1, 23 (1970).
  * Wootters and Zurek [1982] W. K. Wootters and W. H. Zurek, Nature 299, 802 (1982).
  * Dieks [1982] D. Dieks, Physics Letters A 92, 271 (1982).
  * Rains  _et al._ [1997] E. M. Rains, R. H. Hardin, P. W. Shor, _et al._ , Phys. Rev. Lett. 79, 953 (1997).
  * Smolin  _et al._ [2007] J. A. Smolin, G. Smith, and S. Wehner, Phys. Rev. Lett. 99, 130505 (2007).
  * Yu  _et al._ [2008] S. Yu, Q. Chen, C. H. Lai, _et al._ , Phys. Rev. Lett. 101, 090501 (2008).
  * Ralph  _et al._ [2005] T. C. Ralph, A. J. F. Hayes, and A. Gilchrist, Phys. Rev. Lett. 95, 100501 (2005).
  * Munro  _et al._ [2012] W. J. Munro, A. M. Stephens, S. J. Devitt, _et al._ , Nature Photonics 6, 777 (2012).
  * Greenberger  _et al._ [1989] D. M. Greenberger, M. A. Horne, and A. Zeilinger, Going beyond Bell’s theorem, in  _Bell’s Theorem, Quantum Theorey and Conceptions of the Universe_ , Fundamental Theories of Physics, Vol. 37, edited by M. Kafatos (Springer Netherlands, 1989) pp. 69–72, arXiv:0712.0921 [quant-ph] .
  * Bouwmeester  _et al._ [1999] D. Bouwmeester, J.-W. Pan, M. Daniell, _et al._ , Phys. Rev. Lett. 82, 1345 (1999).
  * Varnava  _et al._ [2006] M. Varnava, D. E. Browne, and T. Rudolph, Phys. Rev. Lett. 97, 120501 (2006).
  * Varnava  _et al._ [2007] M. Varnava, D. E. Browne, and T. Rudolph, New Journal of Physics 9, 203 (2007).
  * Nickerson and Bombín [2018] N. Nickerson and H. Bombín, arXiv:1810.09621 [quant-ph] (2018).
  * Kondra  _et al._ [2021] T. V. Kondra, C. Datta, and A. Streltsov, arXiv:2111.12646 [quant-ph] (2021).
  * Bennett  _et al._ [1997a] C. H. Bennett, D. P. DiVincenzo, and J. A. Smolin, Phys. Rev. Lett. 78, 3217 (1997a).
  * Niemietz  _et al._ [2021] D. Niemietz, P. Farrera, S. Langenfeld, _et al._ , Nature 591, 570 (2021).
  * Distante  _et al._ [2021] E. Distante, S. Daiss, S. Langenfeld, _et al._ , Phys. Rev. Lett. 126, 253603 (2021).
  * Ewert and van Loock [2014] F. Ewert and P. van Loock, Phys. Rev. Lett. 113, 140403 (2014).
  * Brekenfeld  _et al._ [2020] M. Brekenfeld, D. Niemietz, J. D. Christesen, _et al._ , Nature Physics 16, 647 (2020).
  * Bhaskar  _et al._ [2020] M. K. Bhaskar, R. Riedinger, B. Machielse, _et al._ , Nature 580, 60 (2020).
  * Kalb  _et al._ [2015] N. Kalb, A. Reiserer, S. Ritter, _et al._ , Phys. Rev. Lett. 114, 220501 (2015).
  * Michelberger  _et al._ [2014] P. S. Michelberger, J. Nunn, T. F. M. Champion, _et al._ , in  _2014 Conference on Lasers and Electro-Optics (CLEO) – Laser Science to Photonic Applications_ (IEEE, 2014) pp. 1–2.
  * Muralidharan  _et al._ [2014] S. Muralidharan, J. Kim, N. Lütkenhaus, _et al._ , Phys. Rev. Lett. 112, 250501 (2014).
  * Lee  _et al._ [2019] S.-W. Lee, T. C. Ralph, and H. Jeong, Phys. Rev. A 100, 052303 (2019).
  * Alsina and Razavi [2021] D. Alsina and M. Razavi, Phys. Rev. A 103, 022402 (2021).
  * Simon  _et al._ [2007] C. Simon, H. de Riedmatten, M. Afzelius, _et al._ , Phys. Rev. Lett. 98, 190503 (2007).
  * Vinay and Kok [2017] S. E. Vinay and P. Kok, Phys. Rev. A 95, 052336 (2017).
  * Nickerson  _et al._ [2014] N. H. Nickerson, J. F. Fitzsimons, and S. C. Benjamin, Phys. Rev. X 4, 041041 (2014).
  * Collins  _et al._ [2007] O. A. Collins, S. D. Jenkins, A. Kuzmich, _et al._ , Phys. Rev. Lett. 98, 060502 (2007).
  * Munro  _et al._ [2010] W. J. Munro, K. A. Harrison, A. M. Stephens, _et al._ , Nature Photonics 4, 792 (2010).
  * Li  _et al._ [2020] C. Li, N. Jiang, Y.-K. Wu, _et al._ , Phys. Rev. Lett. 124, 240504 (2020), and references therein.
  * Verstraete  _et al._ [2001] F. Verstraete, J. Dehaene, and B. DeMoor, Phys. Rev. A 64, 010101 (2001).
  * Bennett  _et al._ [1996a] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, _et al._ , Phys. Rev. A 54, 3824 (1996a).
  * Deutsch  _et al._ [1996] D. Deutsch, A. Ekert, R. Jozsa, _et al._ , Phys. Rev. Lett. 77, 2818 (1996).
  * Deutsch  _et al._ [1998] D. Deutsch, A. Ekert, R. Jozsa, _et al._ , Phys. Rev. Lett. 80, 2022 (1998).
  * Macchiavello [1998] C. Macchiavello, Physics Letters A 246, 385 (1998).
  * Metwally [2002] N. Metwally, Phys. Rev. A 66, 054302 (2002).
  * Feng  _et al._ [2000] X.-L. Feng, S.-Q. Gong, and Z.-Z. Xu, Physics Letters A 271, 44 (2000).
  * Okrasa and Walczak [2008] M. Okrasa and Z. Walczak, Physics Letters A 372, 3136 (2008).
  * Feng  _et al._ [2008] X.-L. Feng, S.-Q. Gong, and Z.-Z. Xu, Physics Letters A 372, 3337 (2008).
  * Metwally and Obada [2006] N. Metwally and A.-S. Obada, Physics Letters A 352, 45 (2006).
  * Feng  _et al._ [2012] X. Feng, Y. Xu, and Z. Zhang, Chinese Optics Letters 10, 042701 (2012).
  * Zhou  _et al._ [2020] L. Zhou, W. Zhong, and Y.-B. Sheng, Opt. Express 28, 2291 (2020).
  * Hu  _et al._ [2021] X.-M. Hu, C.-X. Huang, Y.-B. Sheng, _et al._ , Phys. Rev. Lett. 126, 010503 (2021).
  * Dehaene  _et al._ [2003] J. Dehaene, M. Van den Nest, B. De Moor, _et al._ , Phys. Rev. A 67, 022310 (2003).
  * Bombin and Martin-Delgado [2005] H. Bombin and M. A. Martin-Delgado, Phys. Rev. A 72, 032313 (2005).
  * Hostens  _et al._ [2006] E. Hostens, J. Dehaene, and B. De Moor, Phys. Rev. A 73, 062337 (2006).
  * Rozpędek  _et al._ [2018] F. Rozpędek, T. Schiet, L. P. Thinh, _et al._ , Phys. Rev. A 97, 062333 (2018).
  * Krastanov  _et al._ [2019] S. Krastanov, V. V. Albert, and L. Jiang, Quantum 3, 123 (2019).
  * Jansen  _et al._ [2021] S. Jansen, K. Goodenough, S. de Bone, _et al._ , arXiv:2103.03669 [quant-ph] (2021).
  * Bergmann and Gühne [2013] M. Bergmann and O. Gühne, Journal of Physics A: Mathematical and Theoretical 46, 385304 (2013).
  * Ouyang [2014] Y. Ouyang, Phys. Rev. A 90, 062317 (2014).
  * Ouyang [2017] Y. Ouyang, Linear Algebra and its Applications 532, 43 (2017).
  * Rains [1999] E. M. Rains, IEEE Transactions on Information Theory 45, 2361 (1999).
  * Dattorro [2019] J. Dattorro,  _Convex Optimization $\dagger$ Euclidean Distance Geometry_ ($\mathcal{M}\epsilon\beta oo$ Publishing USA, 2019).
  * Dedeoǧlu  _et al._ [2016] M. Dedeoǧlu, Y. K. Alp, and O. Arıkan, IEEE Transactions on Signal Processing 64, 2209 (2016).
  * Nelder and Mead [1965] J. A. Nelder and R. Mead, The Computer Journal 7, 308 (1965).
  * Wales and Doye [1997] D. J. Wales and J. P. K. Doye, The Journal of Physical Chemistry A 101, 5111 (1997).
  * The SciPy community [2020a] The SciPy community, scipy.optimize.basinhopping, https://docs.scipy.org/doc/scipy/reference/generated/scipy.optimize.basinhopping.html (2020a), accessed: 2020-06-25.
  * The SciPy community [2020b] The SciPy community, scipy.optimize.minimize, https://docs.scipy.org/doc/scipy/reference/generated/scipy.optimize.minimize.html (2020b), accessed: 2020-10-15.
  * Hansen  _et al._ [2019] N. Hansen, Y. Akimoto, and P. Baudis, CMA-ES/pycma on Github, doi:10.5281/zenodo.2559634 (2019).
  * Kraft [1998] D. Kraft,  _A Software Package for Sequential Quadratic Programming_ , Forschungsbericht (Deutsche Forschungs- und Versuchsanstalt für Luft- und Raumfahrt, 1998).
  * Broyden [1970] C. G. Broyden, IMA Journal of Applied Mathematics 6, 76 (1970).
  * Fletcher [1970] R. Fletcher, The Computer Journal 13, 317 (1970).
  * Goldfarb [1970] D. Goldfarb, Math. Comp. 24, 23 (1970).
  * Shanno [1970] D. F. Shanno, Math. Comp. 24, 647 (1970).
  * Nocedal and Wright [2006] J. Nocedal and S. J. Wright, Quasi-Newton methods, in  _Numerical Optimization_ (Springer, 2006) pp. 135–163.
  * MOSEK ApS [2020] MOSEK ApS,  _MOSEK Optimizer API for Python_ (2020).
  * O’Donoghue  _et al._ [2016] B. O’Donoghue, E. Chu, N. Parikh, _et al._ , Journal of Optimization Theory and Applications 169, 1042 (2016).
  * O’Donoghue  _et al._ [2019] B. O’Donoghue, E. Chu, N. Parikh, _et al._ , SCS: Splitting conic solver, version 2.1.2, https://github.com/cvxgrp/scs (2019).
  * Desef and Plenio [2021] B. Desef and M. B. Plenio, Protecting quantum states against loss, https://github.com/projekter/ChannelLoss (2021).
  * Laflamme  _et al._ [1996] R. Laflamme, C. Miquel, J. P. Paz, _et al._ , Phys. Rev. Lett. 77, 198 (1996).
  * Xu  _et al._ [2012] Y. Xu, X. Feng, and Z. Zhang, Chin. Opt. Lett. 10, 042701 (2012).
  * Bennett  _et al._ [1996b] C. H. Bennett, G. Brassard, S. Popescu, _et al._ , Phys. Rev. Lett. 76, 722 (1996b).
  * Bennett  _et al._ [1997b] C. H. Bennett, G. Brassard, S. Popescu, _et al._ , Phys. Rev. Lett. 78, 2031 (1997b).
  * Fujii and Yamamoto [2009] K. Fujii and K. Yamamoto, Phys. Rev. A 80, 042308 (2009).
  * von Neumann [2018] J. von Neumann,  _Mathematical Foundations of Quantum Mechanics_ , edited by N. A. Wheeler (Princeton University Press, 2018).
  * MOSEK Aps [2021] MOSEK Aps,  _MOSEK Modeling Cookbook_ (2021).
  * Hume  _et al._ [2009] D. B. Hume, C. W. Chou, T. Rosenband, _et al._ , Phys. Rev. A 80, 052302 (2009).
  * Ivanov  _et al._ [2013] S. S. Ivanov, N. V. Vitanov, and N. V. Korolkova, New Journal of Physics 15, 023039 (2013).
  * Stockton  _et al._ [2004] J. K. Stockton, R. van Handel, and H. Mabuchi, Phys. Rev. A 70, 022106 (2004).
  * Xiao  _et al._ [2007] Y.-F. Xiao, X.-B. Zou, and G.-C. Guo, Phys. Rev. A 75, 012310 (2007).
  * Shao  _et al._ [2010] X.-Q. Shao, L. Chen, S. Zhang, _et al._ , EPL (Europhysics Letters) 90, 50003 (2010).
  * Zou  _et al._ [2003] X. Zou, K. Pahlke, and W. Mathis, Phys. Rev. A 68, 034306 (2003).
  * Prevedel  _et al._ [2009] R. Prevedel, G. Cronenberg, M. S. Tame, _et al._ , Phys. Rev. Lett. 103, 020503 (2009).
  * Wieczorek  _et al._ [2009] W. Wieczorek, R. Krischek, N. Kiesel, _et al._ , Phys. Rev. Lett. 103, 020504 (2009).
  * Bärtschi and Eidenbenz [2019] A. Bärtschi and S. Eidenbenz, in  _Fundamentals of Computation Theory_ , edited by L. A. Gąsieniec, J. Jansson, and C. Levcopoulos (Springer International Publishing, Cham, 2019) pp. 126–139.
  * Keating  _et al._ [2016] T. Keating, C. H. Baldwin, Y.-Y. Jau, _et al._ , Phys. Rev. Lett. 117, 213601 (2016).
  * Mu  _et al._ [2020] F. Mu, Y. Gao, H. Yin, _et al._ , Opt. Express 28, 39574 (2020).
  * Kasture [2018] S. Kasture, Phys. Rev. A 97, 043862 (2018).
  * Li  _et al._ [2021] Z. Li, Y.-G. Han, H.-F. Sun, _et al._ , Phys. Rev. A 103, 022601 (2021).
  * Plenio and Virmani [2007] M. B. Plenio and S. Virmani, Quantum Inf. Comput. 7, 1 (2007).
  * Gyongyosi  _et al._ [2018] L. Gyongyosi, S. Imre, and H. V. Nguyen, IEEE Communications Surveys Tutorials 20, 1149 (2018).
  * Hostens  _et al._ [2005] E. Hostens, J. Dehaene, and B. De Moor, Phys. Rev. A 71, 042315 (2005).
  * Bullock and Brennen [2007] S. S. Bullock and G. K. Brennen, Journal of Physics A: Mathematical and Theoretical 40, 3481 (2007).
  * Gheorghiu [2014] V. Gheorghiu, Physics Letters A 378, 505 (2014).
  * Jiang  _et al._ [2007] L. Jiang, J. M. Taylor, N. Khaneja, _et al._ , Proceedings of the National Academy of Sciences 104, 17291 (2007).
  * Goodenough  _et al._ [2021] K. Goodenough, D. Elkouss, and S. Wehner, Phys. Rev. A 103, 032610 (2021).

##  Appendix A State after partial tracing

In this appendix, we will determine the state of the system that arises from
eq. 27 after tracing out $r-s$ subsystems at the receiver’s site. To begin
with, the full state is given by

$\rho=\sum_{a_{1},a_{2}=0}^{1}\;\sum_{\bm{i},\bm{j}\in[s]_{d}}\rho_{a_{1},a_{2}}(\bm{i},\bm{j})\ket{a_{1}D^{s}_{\bm{i}}}\\!\bra{a_{2}D^{s}_{\bm{j}}}\text{,}$
(27)

where $[s]_{d}$ is defined in eq. 28 and $\ket{D^{s}_{\bm{i}}}$ in eq. 29. The
symmetry of the Dicke states makes it clear that it does not matter which ones
of the qudits are traced out; so let us without loss of generality assume that
we keep, at the receiver’s site, the first $r$ qudits and trace out the
remaining $s-r$ qudits.

Let now $\bm{i}\in[s]_{d}$ be fixed. To simplify the notation, we define

$B(s,\bm{i})\coloneqq\Bigl{\\{}(x_{1},\dotsc,x_{s})\in\\{0,\dotsc,d-1\\}^{s}:\bigl{\lvert}\\{j:x_{j}=m\\}\bigr{\rvert}=i_{m}\
\forall m\in\\{0,\dotsc,d-1\\}\Bigr{\\}}$

as the set over all $d$-ary strings of length $s$ in which the digit $m$
occurs $i_{m}$ times. We can then write the definition of the Dicke state as

$\ket{D^{s}_{\bm{i}}}=\frac{1}{\sqrt{\binom{s}{\bm{i}}}}\sum_{\sigma\in
B(s,\bm{i})}\ket{\underbrace{\hbox
to56.9055pt{\hfill$\sigma_{1}$\hfill}}_{\text{length }r}\underbrace{\hbox
to56.9055pt{\hfill$\sigma_{2}$\hfill}}_{\text{length }s-r}}\text{,}$

splitting the digit string $\sigma$ into two parts.

We now consider how to properly split the sum in these two parts. We will use
the vector $\bm{k}\in[r]_{d}$ to describe how often the individual digits
occur in the first $r$ digits, and $\bm{k}^{\prime}\in[s-r]_{d}$ for the same
in the rest. We have $\bm{k}+\bm{k}^{\prime}=\bm{i}$. With this, we get

$\displaystyle\sum_{\begin{subarray}{c}\sigma\in B(s,\bm{i})\\\ \tau\in
B(s,\bm{j})\end{subarray}}\ket{\sigma}\\!\bra{\tau}$
$\displaystyle=\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{k}^{\prime},\bm{\ell}^{\prime}\in[s-r]_{d}}\delta_{\bm{k}+\bm{k}^{\prime},\bm{i}}\delta_{\bm{\ell}+\bm{\ell}^{\prime},\bm{j}}\sum_{\begin{subarray}{c}\sigma_{1}\in
B(r,\bm{k})\\\ \tau_{1}\in
B(r,\bm{\ell})\end{subarray}}\sum_{\begin{subarray}{c}\sigma_{2}\in
B(s-r,\bm{k}^{\prime})\\\ \tau_{2}\in
B(s-r,\bm{\ell}^{\prime})\end{subarray}}\ket{\sigma_{1}\sigma_{2}}\\!\bra{\tau_{1}\tau_{2}}\text{,}$
where $\delta$ is Kronecker’s delta. The partial trace can now easily be
written down:
$\displaystyle\operatorname{tr}_{2}\sum_{\begin{subarray}{c}\sigma\in
B(s,\bm{i})\\\ \tau\in B(s,\bm{j})\end{subarray}}\ket{\sigma}\\!\bra{\tau}$
$\displaystyle=\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{k}^{\prime},\bm{\ell}^{\prime}\in[s-r]_{d}}\delta_{\bm{k}+\bm{k}^{\prime},\bm{i}}\delta_{\bm{\ell}+\bm{\ell}^{\prime},\bm{j}}\sum_{\begin{subarray}{c}\sigma_{1}\in
B(r,\bm{k})\\\ \tau_{1}\in
B(r,\bm{\ell})\end{subarray}}\ket{\sigma_{1}}\\!\bra{\tau_{1}}{\underbrace{\sum_{\begin{subarray}{c}\sigma_{2}\in
B(s-r,\bm{k}^{\prime})\\\ \tau_{2}\in
B(s-r,\bm{\ell}^{\prime})\end{subarray}}\braket{\sigma_{2}}{\tau_{2}}}_{=\,\binom{s-r}{\bm{k}^{\prime}}\delta_{\bm{k}^{\prime},\bm{\ell}^{\prime}}}}\text{,}$

where the multinomial coefficient was defined in eq. 30. We now insert the
partial trace into $\rho$. Also note that $\bm{k}^{\prime}\in[s-r]_{d}$ is a
redundant condition that is already enforced by the multinomial coefficient.

$\displaystyle\operatorname{tr}_{2}\rho$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{i},\bm{j}\in[s]_{d}}\frac{\rho_{a_{1},a_{2}}(\bm{i},\bm{j})}{\sqrt{\binom{s}{\bm{i}}\binom{s}{\bm{j}}}}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{k}^{\prime}\in\mathbb
Z^{d}}\delta_{\bm{k}+\bm{k}^{\prime},\bm{i}}\delta_{\bm{\ell}+\bm{k}^{\prime},\bm{j}}\binom{s-r}{\bm{k}^{\prime}}\sum_{\begin{subarray}{c}\sigma_{1}\in
B(r,\bm{k})\\\ \tau_{1}\in
B(r,\bm{\ell})\end{subarray}}\ket{a_{1}\sigma_{1}}\\!\bra{a_{2}\tau_{1}}$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{i},\bm{j}\in[s]_{d}}\frac{\rho_{a_{1},a_{2}}(\bm{i},\bm{j})}{\sqrt{\binom{s}{\bm{i}}\binom{s}{\bm{j}}}}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sum_{\bm{k}^{\prime}\in\mathbb
Z^{d}}\delta_{\bm{k}+\bm{k}^{\prime},\bm{i}}\delta_{\bm{\ell}+\bm{k}^{\prime},\bm{j}}\binom{s-r}{\bm{k}^{\prime}}\sqrt{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}$
Rearranging sums and removing $\delta$s gives
$\displaystyle\operatorname{tr}_{2}\rho$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sqrt{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}\sum_{\bm{i},\bm{j}\in[s]_{d}}\delta_{\bm{\ell}+\bm{i}-\bm{k},\bm{j}}\frac{\rho_{a_{1},a_{2}}(\bm{i},\bm{j})}{\sqrt{\binom{s}{\bm{i}}\binom{s}{\bm{j}}}}\binom{s-r}{\bm{i}-\bm{k}}$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sqrt{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}\sum_{\bm{i}\in[s]_{d}}\mathbf{1}_{[s]_{d}}(\bm{\ell}+\bm{i}-\bm{k})\frac{\rho_{a_{1},a_{2}}(\bm{i},\bm{\ell}+\bm{i}-\bm{k})}{\sqrt{\binom{s}{\bm{i}}\binom{s}{\bm{\ell}+\bm{i}-\bm{k}}}}\binom{s-r}{\bm{i}-\bm{k}}$
$\displaystyle=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sqrt{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}\sum_{\bm{i}\in[s]_{d}-\bm{k}}\mathbf{1}_{[s]_{d}}(\bm{\ell}+\bm{i})\frac{\rho_{a_{1},a_{2}}(\bm{i},\bm{i}+\bm{\ell})}{\sqrt{\binom{s}{\bm{i}}\binom{s}{\bm{i}+\bm{\ell}}}}\binom{s-r}{\bm{i}}\text{.}$

Here,

$\mathbf{1}_{M}(x)\coloneqq\begin{dcases}1&\text{if }x\in M\\\
0&\text{else}\end{dcases}$

is the indicator function. All reformulations are valid under the convention
$\frac{0}{0}=0$. Note that addends with negative components in $\bm{i}$ are
ruled out by the multinomial coefficient; and since $\bm{k}\in[r]_{d}$,
subtracting $\bm{k}$ from a vector in $[s]_{d}$ will give—apart from those
with negative contributions—a vector in $[s-r]_{d}$. In turn,
$\bm{\ell}+\bm{i}$ will then automatically be an element of $[s]_{d}$, which
finally gives

$\operatorname{tr}_{2}\rho=\sum_{a_{1},a_{2}=0}^{1}\sum_{\bm{k},\bm{\ell}\in[r]_{d}}\sqrt{\binom{r}{\bm{k}}\binom{r}{\bm{\ell}}}\ket{a_{1}D^{r}_{\bm{k}}}\\!\bra{a_{2}D^{r}_{\bm{\ell}}}\sum_{\bm{i}\in[s-r]_{d}}\frac{\rho_{a_{1},a_{2}}(\bm{i}+\bm{k},\bm{i}+\bm{\ell})}{\sqrt{\binom{s}{\bm{i}+\bm{k}}\binom{s}{\bm{i}+\bm{\ell}}}}\binom{s-r}{\bm{i}}\text{.}$
$\square$

##  Appendix B Analytic forms for states and measurements

In this appendix, we will give some analytic forms that were derived from the
numerical data of the optimal states and measurements, as well as a few
interesting purely numerical results. All results are only exemplary; an
immediate way to generate a variation is to flip the qubits at Alice’s or
Bob’s site, or to replace all states $\ket{D^{x}_{y}}$ by $\ket{D^{x}_{x-y}}$.

Unless indicated differently, all results correspond to the case of unit
probability, $p_{\mathrm{dist}}=1$. In general, the optimal states with lower
success probability will continuously arise from them, but they will have many
more nonzero coefficients for which we cannot give an analytic form. As can be
seen by the discontinuous slopes in LABEL:fig:fidsr, there are bifurcation
points at which another structural branch of the state may happen to give the
optimal fidelity.

Finally, note that strictly speaking, unless $F=1$, all results only give
lower bounds for the maximization.

We will write $\mathbb P(\ket{x})\equiv\ket{x}\\!\bra{x}$.

###  B.1 Qubits

  * •

If $s\geq 2r-1$ (high-loss regime), we have $C(E)=2\mathbb
P\biggl{(}\frac{\ket{0D^{r}_{1}}+\ket{1D^{r}_{0}}}{\sqrt{2}}\biggr{)}\text{.}$
(37) The sent state is
$\ket{\psi}=\sqrt{\frac{r}{r+s}}\ket{0D^{s}_{1}}+\sqrt{\frac{s}{r+s}}\ket{1D^{s}_{0}}$
and the resulting fidelity is $\frac{1}{2}+\frac{r}{2s}$.

For $p\neq 1$, we find $C(E)=2\mathbb
P\Bigl{(}\frac{\ket{0D^{r}_{1}}+\alpha\ket{1D^{r}_{0}}-\sqrt{1-\alpha^{2}}\ket{1D^{r}_{2}}}{\sqrt{2}}\Bigr{)}$
with a single free parameter $\alpha$.

  * •

For $s-1=r>2$, we have $C(E)=2\mathbb
P\biggl{(}\frac{\ket{0D^{r}_{2}}+\ket{1D^{r}_{0}}}{\sqrt{2}}\biggr{)}+2\mathbb
P\biggl{(}\frac{\ket{0D^{r}_{1}}+\ket{1D^{r}_{r}}}{\sqrt{2}}\biggr{)}\text{.}$
(38) The sent state is
$\ket{\psi}=\frac{\ket{0D^{s}_{2}}}{\sqrt{2}}+\sqrt{\frac{r-1}{2(r+1)}}\ket{1D^{s}_{0}}+\frac{1}{\sqrt{r+1}}\ket{1D^{s}_{s}}$
and the resulting fidelity is $1$.

  * •

For $s-2=r>4$, we have $C(E)=2\mathbb
P\biggl{(}\frac{\ket{0D^{r}_{1}}+\ket{1D^{r}_{r-1}}}{\sqrt{2}}\biggr{)}+2\mathbb
P\biggl{(}\frac{\ket{0D^{r}_{2}}}{\sqrt{2}}+y\ket{1D^{r}_{0}}+x\ket{1D^{r}_{r}}\biggr{)}+2\mathbb
P\biggl{(}x\ket{0D^{r}_{0}}-y\ket{0D^{r}_{r}}+\frac{\ket{1D^{r}_{r-2}}}{\sqrt{2}}\biggr{)}\text{,}$
(39) where $x=\sqrt{\frac{1}{r(r-1)}}$ and $y=\sqrt{\frac{1}{2}-x^{2}}$. The
sent state is