Experimental Guesswork with Quantum Side Information Using Twisted Light

Abstract

Guesswork is an information–theoretic quantity which can be seen as an alternate security criterion to entropy. Recent work has established the theoretical framework for guesswork in the presence of quantum side information, which we extend both theoretically and experimentally. We consider guesswork when the side information consists of the BB84 states and their higher-dimensional generalizations. With this side information, we compute the guesswork for two different scenarios for each dimension. We then performed a proof-of-principle experiment using Laguerre–Gauss modes to experimentally compute the guesswork for higher-dimensional generalizations of the BB84 states. We find that our experimental results agree closely with our theoretical predictions. This work shows that guesswork can be a viable security criterion in cryptographic tasks and is experimentally accessible in a number of optical setups.

1. Introduction

Guesswork is an information–theoretic measure of security and uncertainty of an information source [1,2], similar to entropy. In its simplest form, it can be understood as a game between two agents, Alice and Bob. Alice picks an element x from an alphabet $\mathcal{X}$ with prior probability $p_X\left(x\right)$. Bob’s task then is to guess Alice’s choice x while being allowed to ask questions in the form of “Is $X=x$?”. The guesswork, $G\left(X\right)$, is the average number of guesses Bob needs until Alice answers with “yes”. This is in contrast to entropy, where the same game is played, except that Bob is allowed to ask questions in the form of “Is $X\in \tilde{X}?$”, where $\tilde{X}$ is a subset of the alphabet $\mathcal{X}$ [3].

Guesswork also has real-world applicability. Consider that one’s account on an online portal is subjected to a brute-force hacking attack. A malicious agent is only allowed a certain number of guesses of the password before being locked out. The average number of guesses, i.e., the guesswork, would be the operational criterion of security in such a situation. Furthermore, guesswork takes on richer behavior when Bob possesses some quantum correlations with Alice, also known as side information. The theoretical framework for this problem has been laid out and studied recently [4,5,6,7,8,9]. For a general quantum ensemble, guesswork was shown to be computable by a semidefinite program [4,5]. Closed-form expressions for certain special cases of the guesswork exist, in particular, ensembles of qubit states [6,7,8], and the extension of guesswork to the study of classical-quantum channels has been recently initiated in Ref. [9]. However, experimental verification of the guesswork with quantum side information is yet an unexplored avenue.

Recently, spatially structured beams of light have been used extensively for multiple applications, such as 3D surface imaging, quantum cryptography, remote sensing, and correlated imaging [10,11,12,13,14,15,16,17,18,19,20,21]. Among them, the Laguerre–Gauss (LG) modes are particularly important, as they possess orbital angular momentum (OAM) [22,23] and allow the construction of OAM modes of light. OAM modes enable the construction of orthonormal bases of light in any arbitrary finite dimension. OAM also enables the construction of a mutually unbiased basis of azimuthal angle (ANG) [24,25,26]. These two properties allow for the generation of the qubit BB84 states [27], as well as their higher-dimensional generalizations, which are especially important in quantum cryptography.

In this work, we perform a proof-of-principle experiment in which we use spatial modes of light to experimentally calculate and verify the value of guesswork for several physically and cryptographically relevant examples involving the BB84 states. We extend the work of Refs. [5,6], both theoretically and experimentally, to higher-dimensional generalizations. Generalizing to higher dimensions allows for an enlarged alphabet and, thus, a more versatile and secure protocol, which is especially attractive considering that the same beams of light are used. We find excellent agreement between our experimental results and theoretical predictions. In each of the cases considered, we find that there is a “quantum” gap in the guesswork between the standard basis measurement and the optimal projective measurement. Our work shows that guesswork can be a viable security criterion in cryptographic tasks, and is experimentally accessible from optical setups.

2. Theory

First, we introduce the theoretical framework of guesswork with quantum side information. Guesswork with quantum side information can be viewed as a multi-round two-party game, as shown in Figure 1. The guesser, Bob, has a classical system or, more generally, a quantum system B, which is correlated with Alice’s random variable X. In this work, we consider the latter (and more general) case where Bob possesses quantum side information. This scenario is fully characterized by a classical quantum state ${\rho }_{XB}$ shared by Alice and Bob, where Alice’s symbols and their associated probabilities are captured in the classical register X, and Bob’s quantum side information is present in the quantum system B. In the guessing game picture of guesswork, Alice picks an element $x\in \mathcal{X}$ and sends Bob the corresponding quantum state ${\rho }_B^x$. Bob then performs quantum measurements on his side information state ${\rho }_B^x$, the results of which inform his guessing strategy. In general, Bob performs a quantum instrument before each guess. A quantum instrument yields both a classical measurement outcome and a post-measurement quantum state. This ensures that after each round, Bob has classical information used to make a guess, and also a quantum state for future rounds of the guessing game.

However, it was shown in Ref. [5] that Bob can do just as well if he performs a single quantum measurement to decide his guessing order; that is, the typical sequential guessing strategy can be reduced to a single-round guessing strategy. This divides the guessing game into two parts: an initial step involving a quantum measurement, followed by a purely classical guessing game between Alice and Bob. Such an equivalence makes a trade-off between time and space, in the sense that Bob needs more spatial resources and fewer temporal resources than the sequential guessing game.

A simple and yet instructive example of guesswork with quantum side information is that involving the four BB84 states [27]. In this case, Alice first picks one of four classical letters $x_1$ through $x_4$ with equal probability, and then sends the corresponding BB84 states $\{|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}$ to Bob. Therefore, Bob’s side information is hidden in his quantum state. Bob’s task is to use his received quantum state to guess which classical letter Alice chose. Suppose that the projective measurement is characterized by the two orthogonal states $\{|\psi \left(\theta \right)\rangle ,|\psi (\pi /2-\theta )\rangle \}$ where $|\psi \left(\theta \right)\rangle :=cos\theta |0\rangle +sin\theta |1\rangle$. Alice’s states constitute mutually unbiased bases, and Bob’s naive strategy would to be to measure in one of them. This would correspond to measuring in the $\{|0\rangle ,|1\rangle \}$ basis, or the standard basis as it is known. Measuring in this basis offers the scenario most similar to a classical or digital measurement and yields the average number of guesses as $1.75$ (See Appendix A). However, there exists an optimized projective measurement which leads to a smaller guesswork. This optimal measurement is characterized by $\theta =1/2arctan(1/3)$. This measurement can be shown to achieve a guesswork of $1.709$ [5,6].

It was shown in Ref. [6] that for this case, and in general for any qubit ensemble with uniform probability distribution, a projective measurement suffices to attain the guesswork. Corollary 2 of Ref. [6] provides a closed-form expression for the guesswork applicable in this case, which evaluates the guesswork to be $\frac{5}{2}-\sqrt{\frac{5}{8}}=1.709$, which, for the above-discussed BB84 example, is indeed the value obtained by the optimized projective measurement characterized above by $\theta =1/2arctan(1/3)$. Projective measurements achieve the minimum guesswork only in the $d=2$ case, and are not sufficient in higher dimensions [6].

From the above simple example, we see a clear separation of guesswork when using the optimal projective measurement compared to a “standard” basis measurement. Such a separation can be interpreted as a quantum gap, or quantum advantage, as an optimized quantum measurement results in lesser number of guesses as compared to a standard basis measurement (resembling a classical/digital measurement). Such a “quantum” separation of the guesswork can also be obtained in higher-dimensional generalizations of the BB84 example; that is, we consider the side information system in the d-dimension BB84 generalization. Alice will pick one of the $2d$ classical symbols with equal probability, each of which is correlated with one of the $2d$ side information states. These $2d$ states are divided into two mutually unbiased bases of d states each. The states are as follows:

$$\{|0\rangle ,|1\rangle ,\dots ,|d-1\rangle ,|\tilde{0}\rangle ,|\tilde{1}\rangle ,\dots ,|\widetilde{d-1}\rangle \}$$

(1)

where $|\tilde{j}\rangle =\frac{1}{\sqrt{d}}{\sum }_{k=0}^{d-1}{e}^{i2\pi kj/d}|k\rangle$ and ${\left|\langle i|\tilde{j}\rangle \right|}^2=1/d\forall i,j\in \{0,1,\dots ,d-1\}$. In this case, a standard basis measurement by Bob means that he projects his state onto the basis $\{|0\rangle ,|1\rangle ,\dots ,|d-1\rangle \}$. When outcome $|k\rangle$ is obtained, Bob can eliminate the $d-1$ standard basis states that are orthogonal to $|k\rangle$. His best strategy, in this case, is then to guess outcome k first, then $\tilde{0}$ through $\widetilde{d-1}$, and finally the remaining labels in any order. The guesswork in this case is $(d+5)/4$. We provide more details of this calculation in Appendix A.

However, like in the two-dimensional case, Bob can do better by carefully selecting his quantum measurement. We briefly explain the strategy he can use and how it can be optimized. Consider that Bob chooses to project onto an arbitrarily chosen orthonormal basis $\{|{\psi }_0\rangle ,\dots ,|{\psi }_{d-1}\rangle \}$. If he obtains the outcome corresponding to $|{\psi }_k\rangle$, then he guesses in decreasing order of the overlap between $|{\psi }_k\rangle$ and the $2d$ input states. We note again here that the post-measurement guessing strategy is purely classical, and we obtain it by invoking Massey’s observation [1] to minimize the guesswork by guessing in decreasing order of the posterior probability of classical symbols.

Since the rules of the game are decided beforehand, Bob finds and decides on his optimal projective measurement via a numerical technique. We perform this optimization for dimensions $d=3$ and 4 using MATLAB. This optimization also yields the guessing order to use with each of these measurements. Using this technique, we find that there is a significant gap between the guesswork attained by standard basis measurements and that attained by the optimized projective measurement. We summarize this gap in

Table 1. The guesswork for each of the scenarios considered.

Dimension	Theoretical Value	Experimental Value
Standard basis measurement
d = 2	1.75	$1.7505\pm 0.0017$
d = 3	2	$1.9996\pm 0.0087$
d = 4	2.25	$2.2547\pm 0.0029$
Optimized projective measurement
d = 2	1.709	$1.7062\pm 0.0089$
d = 3	1.9425	$1.9439\pm 0.0084$
d = 4	2.1429	$2.1411\pm 0.0025$

and provide more details in Appendix B. We note again that the optimized projective measurement does not yield the minimum guesswork, as we are not optimizing over all POVMs, yet does provide a lower guesswork than the standard basis measurement. Simulating these projective measurements with twisted light can be done by using holograms generated by a spatial light modulator (SLM), which is what we use in our experiment, described below.

3. Experiment

We now proceed to describe the experimental apparatus and techniques used to perform our experiment. The generalized BB84 states consist of two mutually unbiased bases. The bases we use in our experiment are the OAM basis and the ANG basis, which are mutually unbiased. Each mode of light in the OAM basis is characterized by an angular momentum quantum number ℓ. In principle, ℓ can be any integer and, therefore, the OAM basis consists of an infinite number of orthogonal modes; thus, it is simple to generate an orthonormal basis in arbitrary dimensions by selecting the appropriate values of ℓ.

For example, if Alice generates the OAM basis consisting of qunatum numbers $\ell \in \{-L,-L+1,\dots ,L-1,L\}$, then we have a $d=2L+1$-dimensional OAM basis, consisting of the states ${\left\{{\Psi }_{\mathrm{OAM}}^{\ell }=e^{i\ell \phi }\right\}}_{\ell =-L}^{\ell =L}$.

The ANG basis corresponding to the OAM basis defined above also consists of $2L+1$ orthogonal states. Each ANG state is a superposition of each of the OAM states. The basis is constituted by the following states:

$${\left\{{\Psi }_{\mathrm{ANG}}^n=\frac{1}{\sqrt{d}}\sum _{\ell =-L}^{\ell =L}{e}^{\frac{2i\pi n\ell }{d}}{\Psi }_{\mathrm{OAM}}^{\ell }\right\}}_{n=-L}^{n=L}.$$

(2)

Simple verification shows that the two bases are indeed mutually unbiased, i.e.,

$$|\langle {\Psi }_{\mathrm{OAM}}^l|{\Psi }_{\mathrm{ANG}}^n\rangle {|}^2=1/d.$$

(3)

3.1. Experimental Setup

The schematic diagram of our experimental setup is depicted in Figure 2. Here, Alice prepares quantum states of light which corresponds to her choice of symbol, and then sends to Bob for further processing. In our experiment, Alice uses a spatial light modulator (SLM) and computer-generated holograms to generate the LG modes required in our experiment [28]. This technique enables us to generate spatial modes in the first-order diffraction order of the SLM. This is sufficient to generate the OAM and ANG modes that correspond to generalized BB84 states in higher dimensions. It is also a characteristic of using such spatial modes of light that the same results will hold when the input beams of light consist of single photons, similar to the results of Ref. [29]. The generated modes are filtered and sent to Bob using a 4f optical system. Bob then projects the spatial mode onto a second SLM to perform a projective measurement. The specific holograms imprinted on the SLM dictate the basis onto which the initial mode is projected. The beam reflected by the second SLM corresponds to a post-measurement state, which is propagated to a charge-coupled device (CCD). The spatial profile of the final beam is captured and analyzed. This process is repeated for each of the measurement states to be projected on, and the captured images are then used to compute the guesswork.

3.2. Experimental Determination of Guesswork

Our goal is to compute the guesswork for the generalized BB84 states for dimensions $d=2,3$, and 4. For each dimension, the guesswork is computed for the standard basis measurement, as well as the optimized projective measurement, which makes for a total of six different scenarios. We remark here again that measuring in the standard basis, in this case, one of the mutually unbiased bases comprising the input states, is most akin to a classical measurement and the optimized projective measurement would represent a quantum advantage.

In each iteration of the guessing game, Bob begins with a predecided guessing order for each possible measurement outcome. For each state Alice sends, he projects onto each of the basis states that characterize his measurement. This enables him to determine the relative rate of the measurement outcomes and, hence, decide on the measurement outcome. This holds for both the standard and optimized basis measurement. Once the guessing order is decided, Bob simply sends Alice his guesses—this interaction yields the average number of guesses for each input state. Averaging over input states yields the overall guesswork. The post-processing of CCD images to compute the guesswork is performed using MATLAB.

We perform a total of six experiments corresponding to six scenarios: this comprises two sets of measurements for each of the three dimensions considered. The two measurements are the standard basis measurement and the numerically determined optimal projective measurement. In each case, we repeated the measurement ten times for each input state. Overall, this is equivalent to playing the guesswork game ten times for each of the six scenarios under consideration.

In Table 1, we present our experimental results. The results are divided into two parts: the guesswork when performing a standard basis measurement, and when performing the optimized projective measurement. The errors reported correspond to the standard deviation of our data across experimental iterations. We see that for all scenarios we consider, the guesswork is within $1\%$ of the theoretical prediction for both the standard basis and optimal measurement.

We note here that for such a protocol to be deployed in a real-world setting, there are other considerations that are to be taken into account. These include, but are not limited to, the vulnerability of the protocol to side-channel attacks, such as fault attacks, power analysis attacks, and even combined differential fault analysis and differential power analysis. Specific countermeasures, such as fault detection architectures [30], error detection schemes [31], or fault diagnosis schemes [32], will need to be built in to a security protocol to guard against these attacks. Such a protocol could be implemented either on a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or on an ARM processor, to name a few. The side channel attack evaluation for each of these will be slightly different, e.g., the difference between the results of Refs. [30,33]. The advent of post-quantum cryptography schemes will also need to be considered, with implementations such as those in Refs. [33,34].

Finally, we remark on the choice of specific OAM modes used for each dimension d. OAM modes are, in principle, orthogonal to each other; thus, any combination of them can be used to construct the desired orthonormal basis. However, due to the finite size of the SLM pixels, they are not perfectly orthogonal in practice. We quantify the overlap between the OAM modes under consideration using a cross-correlation matrix, shown in Figure 3. To minimize overlap errors in our experiment, we choose ℓ values that are spaced further apart from one another to generate our input states, instead of using consecutive ℓ values. For $d=2$, we use the ℓ values $\{-3,3\}$. Similarly, for $d=3$ and $d=4$, we use ℓ values $\{-3,0,3\}$ and $\{-3,-1,1,3\}$, respectively. We note that this modification does not alter any of the calculations for the guesswork itself, and is done only to reduce errors that arise from non-zero overlap between nearby OAM modes. An illustrative demonstration of the input modes used for $d=3$, as well as some of the post-measurement states, are provided in Appendix C.

4. Conclusions

In summary, we showed how to use accessible spatial modes of light to experimentally compute the guesswork in the presence of side information. We considered the side information to be higher-dimensional generalizations of the qubit BB84 states, and showed that the experimentally calculated guesswork matches the theoretical predictions to within an error of $1\%$.

This proof-of-principle work lays the ground for further experimental applications of guesswork with quantum side information. Ref. [9] identifies a number of use-cases for using the guesswork as an operational quantifier of information, such as in information–disturbance relations and majorization theory. Experimental verification will be necessary for theoretical results that address these problems. The avenues of research for future experimental work also include identifying and performing the optimal measurement for each scenario outside of projective measurements, performing vulnerability analysis for various side channel attacks, and devising countermeasures to such attacks. We hope that our work will serve as a starting point for more experimental uses of the guesswork as a security criterion.