# Recurrent Neural Network based Electricity Load Forecasting of G-20 Members

Jaymin Suhagiya
Department of Information and Communication Technology
Adani Institute of Infrastructure Engineering
Ahmedabad, Gujarat, India - 382421
<EMAIL_ADDRESS>
&Deep Raval
Department of Information and Communication Technology
Adani Institute of Infrastructure Engineering
Ahmedabad, Gujarat, India - 382421
<EMAIL_ADDRESS>
&Siddhi Vinayak Pandey
Department of Electrical Engineering
Adani Institute of Infrastructure Engineering
Ahmedabad, Gujarat, India - 382421
<EMAIL_ADDRESS>
&Jeet Patel
Department of Electrical Engineering
Adani Institute of Infrastructure Engineering
Ahmedabad, Gujarat, India - 382421
<EMAIL_ADDRESS>
&Ayushi Gupta
Department of Electronics and Communication Engineering
Pranveer Singh Institute of Technology
Kanpur, Uttar Pradesh, India - 209305
<EMAIL_ADDRESS>
&Akshay Srivastava
Department of Electronics and Communication Engineering
Pranveer Singh Institute of Technology
Kanpur, Uttar Pradesh, India - 209305
<EMAIL_ADDRESS>

###### Abstract

Forecasting the actual amount of electricity with respect to the need/demand
of the load is always been a challenging task for each power plants based
generating stations. Due to uncertain demand of electricity at receiving end
of station causes several challenges such as: reduction in performance
parameters of generating and receiving end stations, minimization in revenue,
increases the jeopardize for the utility to predict the future energy need for
a company etc. With this issues, the precise forecasting of load at the
receiving end station is very consequential parameter to establish the
impeccable balance between supply and demand chain. In this paper, the load
forecasting of G-20 members have been performed utilizing the Recurrent Neural
Network coupled with sliding window approach for data generation. During the
experimentation we have achieved Mean Absolute Test Error of 16.2193 TWh using
LSTM.

##  1 Introduction

An electrical load is a component of a circuit that consumes power, in other
words the current drawn from the source by the components connected in
parallel is called as an electrical load. The standard economic growth,
population variance, geographical variations etc. of a country is additionally
defined by the load consumption parameters. All the factors can be surmised
and analyzed by load distribution and variation in a particular area. Demand
forecast are habituated to determine the capacity of generation, transmission
and distribution system. Generally, load connected in a circuit is not
constant. If a person turns on a light bulb in a house there will be a slight
increase in the input power of a generator in a power plant. Due to this there
is always an uncertainty in the load. Consequentially, load forecasting is a
very important part of a power system analysis.

###  1.1 Why load forecasting is required

As the use of electricity is increasing day by day; the load forecasting
becomes important due to many reasons. One of the major reasons is that -
nonrenewable sources of energy; which is decreasing drastically. While, the
efficiency of renewable energy source; which is not a quite reliable in
nature. Load forecasting also helps during the power system expansion which
starts from the future load anticipations. If future increase of the load is
needed, then cost and capacity of new power plant can be estimated. Load
forecasting can also be used for safety purpose. In Industrial sector the load
consumed is peak load most of the time, but there is always a limit for a
particular industry above which they cannot draw the power from the grid or
else they are charged very heavy for the carelessness .Load forecasting helps
notify that the limit is going to be breached sometime soon.

###  1.2 History & Advancement in load forecasting:

In 1800, electricity was discovered by an Italian Physicist, Alessandro Volta.
This discovery boosted up the economy of world at the crowning point. Later
on, researchers worked on electricity power-based gadgets. Subsequently,
industries became dependent on electricity as it is the primary product of the
power industry. People started discovering new methods for generation of
electricity. But for estimation of electricity required by power industries
any country, people claimed a method so that they can predict that how much
electricity is required by power industries. These industries move the
electrons through the grid to end users. There are two features that make the
electric supply chain very different from other supply chains. Firstly, the
electrons travel really fast at the speed of light and secondly, there is not
yet a practical solution for bulk storage of electricity. Therefore, the
production and consumption have to be balanced in real time. To operate and
plan the system, people have to understand when, where and how much
electricity is spread throughout the system. That is why load forecasting is
crucial to the power industry [1]. In 1880’s, the power companies simply used
Layman method for predicting the use of electricity in future. They predicted
the future consumption by simply developing an engineering approach to
manually forecast the future load using charts and tables. Some of those
elements, such as heating/cooling degree days, temperature-humidity index, and
wind-chill factor, are inherited by today’s load forecasting models. The
similar day method, which derives a future load profile using the historical
days with similar temperature profiles and day type (e.g., day of the week and
holiday), is still used by many utilities [2, 3].

In $1940s$, when air conditioners invented, the demand of electricity got
tremendously affected by whether change and climate change. In winters,
electricity usage got down but in summers it raised. After the discovery of
air conditioners there came electric heaters for winters. So, prediction and
estimation of electricity usage became very hectic by using the traditional
method. The below mentioned graph shows how weather is affecting the
electricity consumed by the load and this graph is plotted using advanced
methods of load forecasting[4].

Figure 1: The increasing impact on weather on electricity supply and demand
[4]

Presently, in this period of booming increment in innovation, demand of power
has come to at apex [5, 6], so industrialists require a few progressed
strategies for load forecasting. And there are created strategies like short
term load forecasting [7] and medium-and long-term forecasting [8]. The long-
term load forecasting covers horizons of one to ten years [9] and in some
cases for various decades [10]. It confers month to month figure for top and
valley in loads for different dissemination frameworks [11], on other hand,
the short-term load forecasting covers time interims of another half hours to
a week or some of the time few weeks [15]. It fulfils brief, termed targets
like aggregated household demands, it is more accurate and smooth strategy
utilized for load forecasting [12].

###  1.3 Recurrent Neural Networks

RNN (Recurrent neural networks) is a machine learning approach that can
remember the sequences of inputs, pattern recognition is the specialty of this
technique, the processing time of RNN is much longer in comparison with ANN.
Fig. X shows the working of a basic RNN cell.

Figure 2: Basic RNN

Here, $W_{xh}$ is the weight for connection of the input layer to the hidden
layer, $W$ is the weight for the connection of the hidden layer to the hidden
layer, Why is the weight for the connection of the hidden layer & $a$ is the
activation layer.

####  1.3.1 LSTM (Long Short Term Memory) Networks:

LSTM is a recurrent neural network that consists of memory blocks in the
recurrent hidden layer, this network contains multiplicative units called
gates to control the flow of information in network. These have three gates
comprising of input gates that controls the flow of input activations into the
memory cell whereas output gates control the output flow of cell activations
into the rest of the network on the other hand there is one gate known as
forget gate that scales the internal state of the cell.

LSTM uses no activation function within its recurrent components and it is
capable of remembering values for either long or short time periods. Stack
LSTM model is the one of the models in which layers are stacked, the stacking
of three LSTM forms a deep RNN. Figure 6 shows the internal structure of the
LSTM cell.

$f_{t}=\sigma(W_{f}\cdot[h_{t-1},x_{t}]+b_{t})$ (1)
$i_{t}=\sigma(W_{i}\cdot[h_{t-1},x_{t}]+b_{i}])$ (2)
$\tilde{C_{t}}=tanh(W_{c}\cdot[h_{t-1},x_{t}]+b_{t})$ (3) $C_{t}=f_{t}\cdot
C_{t-1}+i_{t}\cdot\tilde{C_{t}}$ (4)
$o_{t}=\sigma(W_{o}\cdot[h_{t-1},x_{t}]+b_{o})$ (5) $h_{t}=o_{t}\cdot
tanh(C_{t})$ (6)

Where, $W$ is the weight matrices, $C_{t}$ is the cell state and $b$ is the
input bias vector whereas $i$, $f$, $o$ is the input, forget and the output
gate layer respectively. Cell out activation function in this paper is $tanh$.

Figure 3: LSTM cell

Figure 4: GRU cell

####  1.3.2 GRU (Gated Recurrent Unit) Networks:

Unlike other variants of LSTM, GRU is relatively easier to train and it is
little faster than the traditional LSTM. GRU combines the gating functions of
input gate j and forget gate f into a single update gate basically the cell
state positions are marked by entry points for new data. GRU is used for the
exotic concepts like neural GPUs[2].

$h_{t}=(1-z_{t})\cdot h_{t-1}+z_{t}\cdot\tilde{h_{t}}$ (7)
$\tilde{h_{t}}=g(w_{h}x_{t}+U_{h}(r_{t}\cdot h_{t-1}))+b_{h}$ (8)

####  1.3.3 Convolution LSTM

An approach of a ConvLSTM could be a Convolution-LSTM model, in which the
picture passes through the convolutions layers and its result is a set
smoothed to a 1D cluster with the gotten features. It is the matrix
multiplication calculation of the input with the LSTM cell supplanted by the
convolution operation. The output of the convolutional layer as the input to
this layer. The LSTM model contains multiple LSTM cells, where each LSTM cell
consists of an input gate ($i_{t}$), forget gate ($f_{t}$) and output gate
($o_{t}$). The calculation is as follows:

$f_{t}=\sigma(W_{f}\cdot[h_{t-1},y_{t}]+b_{f})$ (9)
$i_{t}=\sigma(W_{i}\cdot[h_{t-1},y_{t}]+b_{i}])$ (10)
$o_{t}=\sigma(W_{o}\cdot[h_{t-1},y_{t}]+b_{o})$ (11)
$g_{t}=\sigma(W_{g}\cdot[h_{t-1},y_{t}]+b_{g})$ (12) $C_{t}=f_{t}\odot
C_{t-1}+i_{t}\odot g_{t}$ (13) $h_{t}=o_{t}\odot tanh(C_{t})$ (14)

where, $\odot$ represents element-wise multiplication, $\sigma$ denotes the
sigmoid function containing the gating values in $[0,1]$. $y_{t}$ $\in$
$R_{q}$ is the current input from the lower layer at time step t (where $q$ is
the dimensionality of word vector $y_{t}$). $H_{t-1}$ is the output vector of
the previous step, and $W_{i}$ , $b_{i}$ , $W_{f}$ , $b_{f}$ , $W_{o}$,
$b_{o}$, $W_{g}$ and $b_{g}$ are the parameters that must be trained[10].

Figure 5: Convolution LSTM cell[13]

####  1.3.4 Bidirectional LSTM Networks:

Bidirectional LSTMs are an expansion of conventional LSTMs that can progress
model execution on arrangement classification problems. In problems where all
timesteps of the input arrangement are accessible. Bidirectional LSTMs train
two rather than one LSTMs on the input arrangement. The primary on the input
sequence as-is and the second on a turned around duplicate of the input
sequence. This could give extra setting to the organize and result in speedier
and indeed more full learning on the issue [9].

Figure 6: Bidirectional LSTM cell

###  1.4 Dataset used

The data used in this paper was collected and prepared by Enerdata
organization [14]. The data originally contains yearly electricity domestic
consumption (in $TWh$) for $61$ entities (including countries, continents and
unions) from the year $1990$ to $2019$. This paper focuses mainly on G-20
members, which includes : Argentina, Australia, Brazil, Canada, China, France,
Germany, India, Indonesia, Italy, Japan, South Korea, Mexico, Russia, Saudi
Arabia, South Africa, Turkey, United Kingdom, United States, European Union.
Among all G-20 members, $19$ are the countries and one is the European Union.

##  2 Results and Discussions

Recurrent neural networks can process the data sequence of any arbitrary size.
In light of the fact that we have less data, sliding window approach can be
used to train the recurrent model. Sliding window approach provides $N$
timesteps and expect the model to predict $(N+1)^{th}$ timestep. This approach
can give us large amount of training data compared to raw training data at the
cost of data repetition. This way model can learn trend from previous values
in the chosen window size, for instance window size 4 will give previous 4
years data and will expect the model to predict value of the $5^{th}$ year.
Fig. 7 shows the demonstration of sliding window on the time-series data. As
seen in the figure, $N$ values are given as an input to the model while,
$(N+1)^{th}$ value is the target value. Window is shifted one by one after
creating each training instance. We created the new datasets with various
window sizes in the range $3-7$ while, keeping the data of the years
$2016-2019$ reserved for the testing purpose.

Figure 7: Demonstration of Sliding Window approach

In addition to different windows sizes, we also experimented with LSTM, GRU,
Bidirectional-LSTM and Conv-LSTM. Models based on LSTM, GRU and Bidirectional-
LSTM has two recurrent layers stacked each with $36$ units followed by a dense
layer. First two layers have $ReLU$ as an activation function while, last has
linear activation function which simply gives the activation values without
applying any additional computation. Conv-LSTM based model has similar
architecture except it has $64$ filters in first two layers followed by the
flatten layer which simply flattens the previous layer’s output so, it can be
fed to the last dense layer. All of the models were trained for the maximum of
$200$ epochs with $Adam$[15] as an optimizer (having the slow learning rate of
$0.001$) and $huber$ as the loss function. Fig. 8 shows the MAE (Mean Absolute
Error) achieved by each of the models for the different window sizes for the
test data.

Window | Mean Absolute error(MAE) in TWh
---|---
Size |  LSTM |  Bidirectional LSTM |  GRU |  ConvLSTM
3 |  $21.646873$ |  $20.861853$ |  $19.607866$ |  $19.545732$
4 |  $19.642729$ |  $20.14976$ |  $19.1428$ |  $19.634954$
5 |  $20.922813$ |  $19.376783$ |  $19.574736$ |  $20.03209$
6 |  16.2193 |  $17.725124$ |  $18.281723$ |  $17.696333$
7 |  $19.55587$ |  $20.1838$ |  $19.3956$ |  $17.649738$
Figure 8: MAE on test data of each trained model

Figure 9: Predictions done by models trained with window size = 6

Seeing the test error rates, it can be concluded that we get the best
performance for $window$ $size$ $=6$ while using the LSTM based model.
Ignoring the best model, all other models are not far away in terms of error
rate. Overall, we can say that using $6$ as window gives us the optimum
results compared to other window sizes. Fig. 9 shows the actual predictions of
the different models (trained with $window$ $size$ $=6$) for all the G-20
members. Before the vertical line all model’s performance can be compared to
the ground truth at particular timestep (i.e. year). After the vertical line,
up to the year $2025$ all models try to predict next values independently of
each other. Years where previous true values are not available, model is self-
fed it’s own predicted values. Although this carries the error forward, we can
get a rough estimate of next values models would actually predict if they were
given true values.

##  3 Conclusion

In this paper we have estimated the 5 year electricity demand of G-20 Members
utilizing the various RNN sets; such as- GRU, LSTM, Bidirectional LSTM and
ConvLSTM. The best performance has been achieved using the LSTM based model by
keeping the window size of 6. The result depicts, during the interval of (2019
– 2025); the energy demand of G – 20 Members can increase between the 118.69
to 155.8151 TWh. This result is rigorously based on the Terawatt hour of
prediction utilising the Recurrent Neural Network Approach. During
observations, the average energy growth from 2019 to 2025 of GRU, LSTM,
Bidirectional LSTM, and Convolutional LSTM is achieved such as: 141.91,
140.36, 155.81 and 118.69 TWh respectively. In future, these energy demand can
be superseded using the various kind of Renewable Generating Sources such as –
Solar Energy, Wind Energy, Hydro Energy and Tidal Energy for better fulfilment
of supply – demand chain.

## Acknowledgement

We would like to thank Enerdata organization for allowing us to use the Energy
Consumption Data prepared by them.

## References

  * [1] Tao Hong and Mohammad Shahidehpour.  Load forecasting case study.  EISPC, US Department of Energy, 2015.
  * [2] Understanding how electricity load works |energysage.  https://news.energysage.com/understanding-electricity-load/, 2020\.  [Online; accessed 01-October-2020].
  * [3] Load forecasting case study.  https://pubs.naruc.org/pub.cfm?id=536E10A7-2354-D714-5191-A8AAFE45D626, 2020\.  [Online; accessed 01-October-2020].
  * [4] Iain Staffell and Stefan Pfenninger.  The increasing impact of weather on electricity supply and demand.  Energy, 145:65–78, 2018.
  * [5] Zhenyu Wang, Jun Li, Shilin Zhu, Jun Zhao, Shuai Deng, Zhong Shengyuan, Hongmei Yin, Hao Li, Yan Qi, and Zhiyong Gan.  A review of load forecasting of the distributed energy system.  IOP Conference Series: Earth and Environmental Science, 237:042019, 03 2019.
  * [6] Victor Alagbe, Segun I Popoola, Aderemi A Atayero, Bamidele Adebisi, Robert O Abolade, and Sanjay Misra.  Artificial intelligence techniques for electrical load forecasting in smart and connected communities.  In International Conference on Computational Science and Its Applications, pages 219–230. Springer, 2019.
  * [7] David Scott, Tom Simpson, Nikolaos Dervilis, Timothy Rogers, and Keith Worden.  Machine learning for energy load forecasting.  Journal of Physics: Conference Series, 1106:012005, 10 2018.
  * [8] Liye Xiao, Wei Shao, Tulu Liang, and Chen Wang.  A combined model based on multiple seasonal patterns and modified firefly algorithm for electrical load forecasting.  Applied energy, 167:135–153, 2016.
  * [9] Arjun Baliyan, Kumar Gaurav, and Sudhansu Kumar Mishra.  A review of short term load forecasting using artificial neural network models.  Procedia Computer Science, 48:121–125, 2015.
  * [10] Gheisa RT Esteves, Bruno Q Bastos, Fernando L Cyrino, Rodrigo F Calili, and Reinaldo C Souza.  Long term electricity forecast: a systematic review.  Procedia Computer Science, 55:549–558, 2015.
  * [11] Hossein Daneshi, Mohammad Shahidehpour, and Azim Lotfjou Choobbari.  Long-term load forecasting in electricity market.  In 2008 IEEE International Conference on Electro/Information Technology, pages 395–400. IEEE, 2008.
  * [12] Maria Jacob, Cláudia Neves, and Danica Vukadinović Greetham.  Short Term Load Forecasting, pages 15–37.  Springer International Publishing, Cham, 2020.
  * [13] JCS Kadupitiya Kadupitige, Geoffrey Fox, Vikram Jadhao, and Minje Kim.  Survey on deep learning models for time series data.
  * [14] World Power consumption |Electricity consumption |Enerdata.  https://yearbook.enerdata.net/electricity/electricity-domestic-consumption-data.html, 2020\.  [Online; accessed 01-October-2020].
  * [15] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  arXiv preprint arXiv:1412.6980, 2014.


# Anonymous and secret communication in quantum networks

Christopher Thalacker1,2, Frederik Hahn3, Jarn de Jong4, Anna Pappa4, Stefanie
Barz1,2 1Institute for Functional Matter and Quantum Technologies, Universität
Stuttgart, 70569 Stuttgart, Germany
2Center for Integrated Quantum Science and Technology (IQST), Universität
Stuttgart, 70569 Stuttgart, Germany
3Dahlem Center for Complex Quantum Systems, Freie Universität Berlin, 14195
Berlin, Germany
4Electrical Engineering and Computer Science Department, Technische
Universität Berlin, 10587 Berlin, Germany

###### Abstract

Secure communication is one of the key applications of quantum networks. In
recent years, following the demands for identity protection in classical
communication protocols, the need for anonymity has also emerged for quantum
networks. Here, we demonstrate that quantum physics allows parties—besides
communicating securely over a network— to also keep their identities secret.
We implement such an anonymous quantum conference key agreement by sharing
multipartite entangled states in a quantum network. We demonstrate the
protocol with four parties and establish keys in subsets of the
network—different combinations of two and three parties—whilst keeping the
participating parties anonymous. We additionally show that the protocol is
verifiable and run multiple key generation and verification routines. Our work
thus addresses one of the key challenges of networked communication: keeping
the identities of the communicating parties private.

Quantum communication has developed from first proof-of-principle
demonstrations to real-world applications. Since the first proposals of using
quantum physics to establish secret keys between two parties more than three
decades ago [1, 2, 3], numerous demonstrations of quantum key distribution
have been performed. Starting from proof-of-concept experiments, intermediate
and large-scale quantum networks spanning thousands of kilometres have
recently been developed [4, 5, 6, 7, 8, 9, 10]. These experiments use single
photons or entangled photon pairs to exchange a secret key between two parties
and are known as quantum key distribution (QKD) protocols [11, 12].

With growing complexity of quantum networks, new possibilities arise for
multiparty protocols that go beyond bipartite secure communication. One
example is conference key agreement (CKA), a cryptographic primitive that
allows parties in a large-scale network to jointly establish a shared secret
key [13]. Several approaches have been proposed with different requirements
for quantum resources, ranging from bipartite to multipartite quantum states
shared over the network. Interestingly, sharing multipartite states was shown
to be more efficient in specific cases, e.g. for networks that have
bottlenecks [14]. Recently, experimental implementations of CKA protocols have
been performed [15].

Figure 1: Anonymous Conference Key Agreement. A sender (blue) aims to
establish a secret key with $m$ participants (orange) while their identities
remain secret, both from each other and from the remaining non-participants
(black).

Beyond the security of key generation, quantum networks open up a wide range
of possibilities regarding other aspects of secure communication. One such
aspect is _anonymity_ [16, 17, 13, 15, 18]. In a broad range of cases,
internet users put much effort into keeping their activities and identities
secret. As classical networks are replaced by their quantum counterparts,
anonymity will likewise be a vital requirement for networked quantum
communication.

Various levels of anonymity can be envisioned, and there exist multiple real-
life scenarios where the identities of one or more of the communicating
parties need to be kept secret. One example is whistle blowing, where it is
imperative that the identity of the sender is kept secret. Combining anonymity
with the requirement for private communication between multiple parties leads
to anonymous conference key agreement (ACKA) [16]. Here, the goal is to
establish a secret key between several parties across a larger network in such
a way that their identities are hidden from everyone else in the network,
including each other, and are only known to the initiating party (see Fig. 1).

In this work, we demonstrate how to anonymously establish a secret key in a
quantum network of four parties using multipartite entanglement. We focus on a
protocol first proposed in [16], extending the work of [17, 19] on bipartite
key generation.

Our protocol works as follows: first, each party is notified whether they are
meant to participate in the key exchange or not [20]. Then, Greenberger-Horne-
Zeilinger ($\mathrm{GHZ}$) states are repeatedly shared with all parties in
the network, such that each party receives one qubit from every shared state
[21, 22, 23, 24, 25]. A few of these shared states are used to generate a
secret key; the majority is used to detect an eavesdropper or any deviation of
the parties from the protocol, making the protocol also verifiable. In our
implementation, we demonstrate six different configurations for anonymously
establishing a secret key between a sender and one or two participants in a
four-partite network.

Figure 2: Sketch of the anonymous conference key agreement protocol. A sender
(blue) notifies $m$ participants (orange) and establishes a secret key while
their identities remain secret, both from each other and from the remaining
non-participants (black). See main text for detailed explanation of the
protocol.

##  I The protocol for anonymous conference key agreement

The goal of the protocol is for a sender to anonymously establish a key with
$m$ participants of their choice while they form part of a larger network of
$n$ parties. The network is able to distribute a state

$\displaystyle\ket{\mbox{GHZ}_{n}}\mathrel{\mathop{:}}=\tfrac{1}{\sqrt{2}}\left(\ket{0}^{\otimes
n}+\ket{1}^{\otimes n}\right)$ (1)

between all $n$ parties (cf. Fig. 2).

The protocol starts with the $n$ parties running a classical notification
protocol that allows the sender to anonymously notify $m$ participants—and
thereby implicitly the non-participants [20]. This requires private classical
communication between all pairs of parties. Once the participants are
notified, the remainder of the protocol is repeated $L$ times. In each round,
a $\mathrm{GHZ}_{n}$ state is distributed to the $n$ parties and the non-
participants measure their qubits in the $X$-basis. This results in a
$\mathrm{GHZ}_{m+1}$ state between only the sender and the participants, with
an additional phase of $\pm 1$ depending on the parity $\Delta$ of the
measurement outcomes of the non-participants, i.e.

$\displaystyle\ket{\mbox{GHZ}_{m+1,\Delta}}=\tfrac{1}{\sqrt{2}}\left(\ket{0}^{\otimes{(m+1)}}+(-1)^{\Delta}\ket{1}^{\otimes{(m+1)}}\right).$
(2)

In order for this phase to be compensated, the non-participants publicly
announce their measurement outcomes—while the participants hide their identity
by announcing random bits. The sender can tell everyone apart and can now
apply a local correction to her qubit, thereby canceling this phase. This
allows the sender and the participants to anonymously ‘extract’ a smaller
$\mathrm{GHZ}_{m+1}$ state shared only between themselves. This state can
consequently be used to anonymously generate a shared secret key due to its
inherent correlations when measured in the computational basis.

Note that, however, the non-participants could have diverged from their
expected behaviour—for instance by not measuring their qubits and announcing
instead a random bit. This would allow them to be part of the key-generating
network, without being noticed. To prevent this, the participants use a large
percentage of the shared $\mathrm{GHZ}_{m+1}$ states for anonymous
verification. In these Verification rounds, the participants perform
measurements of random stabilisers on the $\mathrm{GHZ}_{m+1}$ state, whose
outcome parity is known to be one. All participants announce their measurement
bases and outcomes, while the non-participants announce two random bits
concealing their roles. Only the sender is able to distinguish between these
announcements and can thus validate the results. By performing $D-1$ randomly
chosen Verification rounds out of every $D$ rounds in total, the sender can
thus estimate the closeness of the distilled state to the ideal
$\mathrm{GHZ}_{m+1}$ state [26]. This guarantees that the resulting key is
provably secure and secret, while also preserving anonymity as no
communication takes place during the KeyGen rounds. We obtain a key of length
$L/D$ which is provably secure and the participants remain anonymous. Which of
the rounds will be Verification rounds and which KeyGen rounds is decided by a
$1/D$-biased public source of randomness.

##  II Experimental Implementation

We demonstrate anonymous verifiable conference key agreement in a network with
four parties. We generate four-photon $\mathrm{GHZ}_{4}$ states encoded in
polarisation (H = 0, V = 1) using an all-optical setup as shown in Fig. 3 (a)
and in more detail in Fig. 5 in the Appendix. The generated states have a
fidelity of $F=0.85(\pm 0.02)$, estimated via quantum state tomography [27].

The four-photon state allows us to demonstrate various configurations of the
anonymous conference key agreement: a sender and two receivers, and a
bipartite protocol with a sender and one receiver. In all configurations, as
shown in Fig. 3 (b), all participating parties remain anonymous. As a
consequence, the non-participants do not know which and how many parties are
in the end sharing a secret key, since they cannot distinguish between the
different configurations.

We assume that the classical Notification protocol has already been performed
and we start by distributing the $\mathrm{GHZ}_{4}$ states to all parties.
First, the non-participants perform a measurement in the $X$-basis, resulting
in a smaller $\mathrm{GHZ}_{3}$ or $\mathrm{GHZ}_{2}$ state.

Figure 3: The setting of our implementation. (a) Sketch of the experimental
setup with four receivers. Two polarisation-encoded EPR photon pairs are
generated and two photons—one of each pair—are superimposed on a PBS to
generate a four-photon $\mathrm{GHZ}_{4}$ state. This state is then
distributed to the four parties. (b) Different network configurations
implemented in our demonstration. The sender and the participants are
highlighted in colour, while the non-participants are displayed in black. (c)
Resulting measurement settings for each configuration and type of round,
KeyGen or Verification.

We then randomly choose between KeyGen rounds and Verification rounds. In a
KeyGen round, all participants measure in the $Z$-basis and exploit the
correlations of the $\mathrm{GHZ}$ state for establishing a shared key. In the
Verification rounds, each participant randomly measures in the $X$\- and
$Y$-basis and announces their basis together with their measurement outcome,
while the sender announces random bits. Then, the sender performs either an
$X$\- or $Y$-measurement so that the total number of $Y$-measurements is even.

Figure 3 (c) shows the different measurement configurations of each setting
according to the protocol. In our implementation, all four measurements are
implemented at the same time using motorised half-wave and quarter-wave
plates, together with a polarising beam splitter.

Figure 4: Experimental results. (a) Total number of KeyGen and Verification
rounds with corresponding security parameter $D$. (b) Success probability for
key generation verification rounds for the different configurations. We
calculate the probabilities per run; the error bars show the standard
deviation over the number of runs.

For each configuration we run the protocol between 150 and 300 times, each run
corresponding to a specific measurement setting. For each run, we integrate
over $10\,$min of measurement time; each four-photon event is considered a
round; this leads to the total number of KeyGen and Verification rounds given
in Fig. 4 (a).

We estimate the probability of a correct KeyGen round and a passed
Verification for each run. We then calculate the averaged probabilities over
all runs (see Fig. 4 (b)) for all measurement operators and all implemented
three-partite (A, B, C and D) and bipartite (E and F) network configurations.
The success probability averaged over all the KeyGen runs is $95.3$ with a
standard deviation of $\pm 1.3\%$, whereas for the Verification rounds the
average success rate is $89.3(\pm 2.1)\%$.

The main source of noise in our implementation originates from higher-order
emissions from the parametric down-conversion sources, which is about $3\%$ of
all four-fold coincidences at a pump power of 180 mW for each source.
Furthermore, the generated Bell states show visibilities of about $\simeq
0.97$ when both qubits are measured in either the $X$\- or the $Z$-basis. At
the polarising beam splitter, we achieve two-photon interference visibility of
$0.823\pm 0.02$, mainly limited through higher-order emissions, residual
distinguishability of the photons, and, in particular, imperfect mode overlap.

As displayed in Figure 4(a), the effective security parameter $D$ ranges from
about $20$ to $32$. If we just consider the number of Verification rounds vs.
the number of KeyGen rounds, the probability $1/D$ of an adversary correctly
guessing a round to be a KeyGen round is on average about $4\%$ (see
Appendix). In that case they can perform a $Z$ measurement instead of an $X$
measurement. Thus, they would effectively take part in the KeyGen round and
could compromise the security of the key. Note that this is the probability
per individual key bit, and all key bits are uncorrelated in this regard.

In our implementation, the probability of a successful Verification round is
smaller than one. The worst-case scenario would be that all failed
Verification rounds are accepted, but are in fact caused by a malicious
adversary actively cheating. Then, the adversary can cheat during all these
failed Verification rounds without being caught, thereby getting more ‘tries’
to cheat during the KeyGen rounds. In that case, the adversary has $\eta(D-1)$
of these extra attempts, where $\eta$ the failure rate of the Verification
rounds. The average probability of the adversary correctly guessing the KeyGen
round becomes then $\tfrac{1+\eta(D-1)}{D}$. In our experiment, the adversary
has a probability of $\sim 14$% of correctly guessing each KeyGen round
averaged over all different configurations (see Appendix for individual
values).

However, in reality, the fidelity of the $\mathrm{GHZ}_{4}$ state is non-
perfect, leading also to failed Verification rounds. We can estimate the
expected failure rate due to noise based on the (non-unit) fidelity of the
distributed $\mathrm{GHZ}_{4}$ state. We look for a lower bound on the
expected failure rate so that the adversary has the maximum number of cheating
attempts based on our fidelity. Using the trace distance and relating it to
the fidelity, the lower bound on the expected failure rate can be estimated to
be $r_{f}\geq 1-\sqrt{F}$. We then replace $\eta$ by $\eta^{\prime}=\eta-
r_{f}$, or $0$ if this is negative. With this correction the probability of
the adversary guessing the KeyGen round without being caught reduces to $\sim
7\%$ in our experiment (see Appendix for more information).

In summary, our analysis shows that our KeyGen error rates are on average
$<5\%$ and are thus correctable using standard approaches. The probability of
being correlated with the adversary can be bounded from above by $\lesssim
7\%$; additional correlations could be gained through error correction. Both
contributions together are still expected to be within the limit that they can
be reduced using privacy amplification [28]. Note that our arguments are meant
to give an estimate of the viability of the experimental implementation and
the subsequent post-processing steps. Performing these tasks in an anonymous
fashion is a nontrivial task and further theoretical work is necessary to
facilitate this.

Finally, we gather between 100 and 200 counts each run of 10 minutes
integration time, which corresponds to $0.16$ \- $0.33$ bps. Taking into
account that $1/30$ to $1/20$ are KeyGen rounds and the rest is Verification
rounds, we get an effective keyrate between $0.006$ and $0.017$. The classical
post-processing necessary to obtain a perfectly secure key is, as mentioned
before, out of the scope of this article, but it will affect the effective key
rate.

##  III Discussion

We have demonstrated how to anonymously and verifiably establish a shared key
between several parties using multipartite quantum resources and exploiting
the correlations of $\mathrm{GHZ}$ states. This is a significant step towards
achieving secure and anonymous quantum communication, adding to the recent
theoretical and experimental achievements in the field [16, 17, 13, 15, 18].

For full-scale and real-life implementations of anonymous conference key
agreement protocols, methods for error correction and privacy amplification
need to be developed [29] and, also, finite key effects to be considered [15].
Even though we make a first attempt to quantify the effect of experimental
imperfections on the security of the protocol, further research is still
needed.

In this context, the effect of losses on general conference key agreement has
been studied recently [30]; it would be interesting to investigate whether a
similar approach can be deployed while preserving anonymity. Future steps will
be the implementation of our protocol in larger-scale networks and active
switching for closing loopholes [31]. Finally, it will be interesting to see
whether anonymity can be maintained with multipartite entangled resources
other than $\mathrm{GHZ}$ states.

##  IV Acknowledgements

We thank Jelena Mackeprang and Lukas Rückle for comments, and Bülent Demirel
for setting up the early stages of the experiment. A.P. and J.d.J. acknowledge
support from the German Research Foundation (DFG, Emmy Noether grant No.
418294583) and F.H. from the Studienstiftung des deutschen Volkes. C.T. and
S.B acknowledge support from the Carl Zeiss Foundation, the Centre for
Integrated Quantum Science and Technology (IQ${}^{\text{ST}}$), the German
Research Foundation (DFG), the Federal Ministry of Education and Research
(BMBF, project SiSiQ), and the Federal Ministry for Economic Affairs and
Energy (BMWi, project PlanQK).

## References

  * Bennett and Brassard [1984] C. H. Bennett and G. Brassard, in  _IEEE International Conference on Computers, Systems, and Signal Processing_ (New York, 1984) p. 175–179.
  * Ekert [1991] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).
  * Bennett  _et al._ [1992] C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin, Journal of Cryptology 5, 3 (1992).
  * Ursin  _et al._ [2007] R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek, _et al._ , Nature physics 3, 481 (2007).
  * Peng  _et al._ [2007] C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng, T. Yang, X.-B. Wang, and J.-W. Pan, Phys. Rev. Lett. 98, 010505 (2007).
  * Peev  _et al._ [2009] M. Peev, C. Pacher, R. Alléaume, C. Barreiro, J. Bouda, W. Boxleitner, T. Debuisschert, E. Diamanti, M. Dianati, J. F. Dynes, S. Fasel, S. Fossier, M. Fürst, J.-D. Gautier, O. Gay, N. Gisin, P. Grangier, A. Happe, Y. Hasani, M. Hentschel, H. Hübel, G. Humer, T. Länger, M. Legré, R. Lieger, J. Lodewyck, T. Lorünser, N. Lütkenhaus, A. Marhold, T. Matyus, O. Maurhart, L. Monat, S. Nauerth, J.-B. Page, A. Poppe, E. Querasser, G. Ribordy, S. Robyr, L. Salvail, A. W. Sharpe, A. J. Shields, D. Stucki, M. Suda, C. Tamas, T. Themel, R. T. Thew, Y. Thoma, A. Treiber, P. Trinkler, R. Tualle-Brouri, F. Vannel, N. Walenta, H. Weier, H. Weinfurter, I. Wimberger, Z. L. Yuan, H. Zbinden, and A. Zeilinger, New Journal of Physics 11, 075001 (2009).
  * Sasaki  _et al._ [2011] M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, Opt. Express 19, 10387 (2011).
  * Liao  _et al._ [2017] S.-K. Liao, W.-Q. Cai, W.-Y. Liu, L. Zhang, Y. Li, J.-G. Ren, J. Yin, Q. Shen, Y. Cao, Z.-P. Li, _et al._ , Nature 549, 43 (2017).
  * Pugh  _et al._ [2017] C. J. Pugh, S. Kaiser, J.-P. Bourgoin, J. Jin, N. Sultana, S. Agne, E. Anisimova, V. Makarov, E. Choi, B. L. Higgins, _et al._ , Quantum Science and Technology 2, 024009 (2017).
  * Chen  _et al._ [2021] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren, Z. Chen, S.-L. Han, Q. Yu, K. Liang, F. Zhou, X. Yuan, M.-S. Zhao, T.-Y. Wang, X. Jiang, L. Zhang, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, C.-Y. Lu, R. Shu, J.-Y. Wang, L. Li, N.-L. Liu, F. Xu, X.-B. Wang, C.-Z. Peng, and J.-W. Pan, Nature 589, 214 (2021).
  * Krenn  _et al._ [2016] M. Krenn, M. Malik, T. Scheidl, R. Ursin, and A. Zeilinger, Optics in Our Time 18, 455 (2016).
  * Flamini  _et al._ [2018] F. Flamini, N. Spagnolo, and F. Sciarrino, Reports on Progress in Physics 82, 016001 (2018).
  * Murta  _et al._ [2020] G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, Advanced Quantum Technologies 3, 2000025 (2020).
  * Epping  _et al._ [2017] M. Epping, H. Kampermann, D. Bruß, _et al._ , New Journal of Physics 19, 093012 (2017).
  * Proietti  _et al._ [2020] M. Proietti, J. Ho, F. Grasselli, P. Barrow, M. Malik, and A. Fedrizzi, arXiv:2002.01491 (2020).
  * Hahn  _et al._ [2020] F. Hahn, J. de Jong, and A. Pappa, PRX Quantum 1, 020325 (2020).
  * Unnikrishnan  _et al._ [2019] A. Unnikrishnan, I. J. MacFarlane, R. Yi, E. Diamanti, D. Markham, and I. Kerenidis, Physical Review Letters 122, 240501 (2019).
  * Huang  _et al._ [2020] Z. Huang, S. K. Joshi, D. Aktas, C. Lupo, A. O. Quintavalle, N. Venkatachalam, S. Wengerowsky, M. Lončarić, S. P. Neumann, B. Liu, Željko Samec, L. Kling, M. Stipčević, R. Ursin, and J. G. Rarity, arXiv: 2011.09480 (2020).
  * Yang  _et al._ [2020] Y.-G. Yang, Y.-L. Yang, X.-L. Lv, Y.-H. Zhou, and W.-M. Shi, Physical Review A 101, 062311 (2020).
  * Broadbent and Tapp [2007] A. Broadbent and A. Tapp, in  _Advances in Cryptology – ASIACRYPT 2007. Lecture Notes in Computer Science_ , Vol. 4833, edited by K. Kurosawa (Springer, Berlin, Heidelberg, 2007) pp. 410–426.
  * Greenberger  _et al._ [1989] D. M. Greenberger, M. A. Horne, and A. Zeilinger, in  _Bell’s theorem, quantum theory and conceptions of the universe_ (Springer, 1989) pp. 69–72.
  * McCutcheon  _et al._ [2016] W. McCutcheon, A. Pappa, B. A. Bell, A. McMillan, A. Chailloux, T. Lawson, M. Mafu, D. Markham, E. Diamanti, I. Kerenidis, J. G. Rarity, and M. S. Tame, Nature Communications 7, 13251 (2016).
  * Wang  _et al._ [2016] X.-L. Wang, L.-K. Chen, W. Li, H.-L. Huang, C. Liu, C. Chen, Y.-H. Luo, Z.-E. Su, D. Wu, Z.-D. Li, H. Lu, Y. Hu, X. Jiang, C.-Z. Peng, L. Li, N.-L. Liu, Y.-A. Chen, C.-Y. Lu, and J.-W. Pan, Phys. Rev. Lett. 117, 210502 (2016).
  * Wang  _et al._ [2018] X.-L. Wang, Y.-H. Luo, H.-L. Huang, M.-C. Chen, Z.-E. Su, C. Liu, C. Chen, W. Li, Y.-Q. Fang, X. Jiang, J. Zhang, L. Li, N.-L. Liu, C.-Y. Lu, and J.-W. Pan, Phys. Rev. Lett. 120, 260502 (2018).
  * Zhong  _et al._ [2018] H.-S. Zhong, Y. Li, W. Li, L.-C. Peng, Z.-E. Su, Y. Hu, Y.-M. He, X. Ding, W. Zhang, H. Li, L. Zhang, Z. Wang, L. You, X.-L. Wang, X. Jiang, L. Li, Y.-A. Chen, N.-L. Liu, C.-Y. Lu, and J.-W. Pan, Phys. Rev. Lett. 121, 250505 (2018).
  * Pappa  _et al._ [2012] A. Pappa, A. Chailloux, S. Wehner, E. Diamanti, and I. Kerenidis, Physical Review Letters 108, 260502 (2012).
  * James  _et al._ [2001] D. F. V. James, P. G. Kwiat, W. J. Munro, and A. G. White, Phys. Rev. A 64, 052312 (2001).
  * Grasselli [2021] F. Grasselli, in  _Quantum Cryptography_ (Springer, 2021) pp. 55–70.
  * Grasselli  _et al._ [2019] F. Grasselli, H. Kampermann, and D. Bruß, New Journal of Physics 21, 123002 (2019).
  * Singkanipa and Kok [2021] P. Singkanipa and P. Kok, arXiv:2101.01483 [quant-ph] (2021), arXiv: 2101.01483.
  * Huang  _et al._ [2018] A. Huang, S. Barz, E. Andersson, and V. Makarov, New Journal of Physics 20, 103016 (2018).

## Appendix

Here, we give more information on the experimental setup for the
implementation of the anonymous conference key agreement protocol. The
experimental setup for the generation of the four-photon GHZ state is depicted
and described in Fig. 5. Fig. 6 depicts the reconstructed density matrix of
the $\mathrm{GHZ}_{4}$ state generated in the experiment. We also add more
detailed information re the security parameters of our implementation. Fig. 7
shows the number of runs and rounds we perform in our experiment. In Fig. 8 we
list the values that an adversary correctly guesses a KeyGen round for each
configuration, assuming an ideal state or a non-ideal state.

Figure 5: Experimental setup. Two $\beta$-barium borate (BBO) crystals are
pumped with a fs-pulsed laser ($390\,$nm) to generate polarisation-entangled
photon pairs via type-II spontaneous parametric down-conversion. After passing
a half-wave plate and an additional BBO, the photons are prepared in state
$\ket{\psi^{-}}=(\ket{H,V}-\ket{V,H})/\sqrt{2}$. Two photons, one from each
source, are superimposed on a polarising beam splitter (PBS) to generate the
four-photon state $\ket{\mathrm{GHZ}}=(\ket{H,H,H,H}+\ket{V,V,V,V})/\sqrt{2}$
after postselecting four-photon events. The measurements as described in the
main protocol are realised using quarter-wave (HWP) and half-wave plates
(HWP), together with PBSs and avalanche photo detectors (APDs). FPC indicates
fibre paddles for controlling the polarisation. Figure 6: Reconstructed
density matrix $\rho$ of the $\mathrm{GHZ}_{4}$ state used to implement the
anonymous conference key agreement. Figure 7:  List of all KeyGen and
Verification runs for each configuration. Each configuration has a certain set
of measurement bases for KeyGen and Verification. For each run, we integrate
over 10 min of measurement time. The number of rounds refers to the total
number of four-photon clicks in each basis, integrated over all runs. The
number of successful rounds refers to the total number of four-photon clicks
that correspond to a measurement result expected from the theory. Figure 8:
Probabilities for a potential adversary to correctly guess which round is the
KeyGen round for each configuration and multiple scenarios. In the first
scenario, corresponding to the second column (”No failed Verification”), we
assume the guessing probability is $\frac{1}{D}$. This means we consider the
number of Verification rounds vs. KeyGen rounds, meaning that effectively no
failed Verification is allowed. The second scenario, corresponding to the
fourth column (”Worst case”), is a worst-case analysis, where all allowed
Verification failures (from our experimental results) are assumed to come from
a malicious, cheating, adversary - such that the guessing probability becomes
$\frac{1+\eta(D-1)}{D}$, where $\eta$ is the failure rate of the Verification
rounds. The third and final scenario takes a more realistic approach (”Non-
unit fidelity”), where the non-unit fidelity of the shared $\mathrm{GHZ}_{4}$
state is taken into account. Here, $\eta$ is updated to $\eta^{\prime}$ to
correct for the fact that some of the Verification rounds will fail purely
because of noise in the system—the updated guessing probability can be found
in the sixth column. These are heuristic analyses, but the guessing
probability $p$ can be seen as (influencing) the information that the
adversary possesses about the final raw key. These correlations with the
adversary have to be deleted in post-processing, giving up a fraction $\sim
h(p)$ of the raw key, where $h(p)$ is the binary entropy of $p$.