Does ignorance of the whole imply ignorance of the parts? Large violations of non-contextuality in quantum theory

12 Pages·0.452 MB·English

by  Vidick T., Wehner S.

Does ignorance of the whole imply ignorance of the parts?
— Large violations of non-contextuality in quantum theory
Thomas Vidick1 and Stephanie Wehner2
1Computer Science division, UC Berkeley, USA∗
2Center for Quantum Technologies, National University of Singapore, 2 Science Drive 3, 117543 Singapore†
(Dated: May 5, 2011)
Acentralquestioninourunderstandingofthephysicalworldishowourknowledgeofthewhole
relates to our knowledge of the individual parts. One aspect of this question is the following: to
what extent does ignorance about a whole preclude knowledge of at least one of its parts? Relying
purely on classical intuition, one would certainly be inclined to conjecture that a strong ignorance
of the whole cannot come without significant ignorance of at least one of its parts. Indeed, we
show that this reasoning holds in any non-contextual hidden variable model (NC-HV). Curiously,
1 however,suchaconjectureisfalse inquantumtheory: weprovideanexplicitexamplewherealarge
1 ignorance about the whole can coexist with an almost perfect knowledge of each of its parts. More
0 specifically,weprovideasimpleinformation-theoreticinequalitysatisfiedinanyNC-HV,butwhich
2 can be arbitrarily violated by quantum mechanics. Our inequality has interesting implications for
quantum cryptography.
y
a
M
In this note we examine the following seemingly inno- and the maximization is taken over all d2-outcome mea-
centquestion: doesone’signoranceaboutthewholenec- surements allowed in the theory. In the case of quan-
4
essarily imply ignorance about at least one of its parts? tum theory, for example, the maximization is taken over

] Givenjustamomentsthought,theinitialreactionisgen- POVMs M = {M } and p(y|M,P ) = tr(M ρ ). The
y y y y y
h
erally to give a positive answer. Surely, if one cannot guessingprobabilityisdirectlyrelatedtotheconditional
p
know the whole, then one should be able to point to an min-entropy H (Y|E) through the equation [2]
- ∞
t unknown part. Classically, and more generally for any
n
deterministic non-contextual hidden variable model, our
a H (Y|E):=−logP (Y|E) . (2)
∞ guess
u intuition turns out to be correct: ignorance about the
q whole does indeed imply the existence of a specific part
[ which is unknown, so that one can point to the source of This measure plays an important role in quantum cryp-
tography and is the relevant measure of information in
one’s ignorance. However, we will show that in a quan-
2
thesingleshotsettingcorrespondingtooureverydayex-
v tum world this intuition is flawed.
perience, as opposed to the asymptotic setting captured
8
bythevonNeumannentropy. Acloselyrelatedvariantis
4
4 THE PROBLEM thesmoothmin-entropyHε∞(Y|E)whichcanbethought
6 of as being like H∞(Y|E) except with some small error
. probabilityε. Themainquestionweareinterestedincan
1 Let us first explain our problem more formally. Con-
1 sidertwoditsy andy ∈{0,...,d−1},wherethestring then be loosely phrased as:
0 1
0
y = y y plays the role of the whole, and y , y are the
1 0 1 0 1
: individualparts. Letρy denoteanencodingofthestring HowdoesH∞(Y =Y0Y1|E)(ignoranceabout
v y into a classical or quantum state. In quantum theory, the whole) relate to H (Y |EC), for C ∈
Xi ρy is simply a density operator, and in a NC-HV model {0,1} (ignorance about∞theCparts)?
itisapreparationP describedbyaprobabilitydistribu-
r y
a tionoverhiddenvariablesλ∈Λ. LetPY beaprobability
distribution over {0,...,d−1}2, and imagine that with Here the introduction of the additional random vari-
probability P (y) we are given the state ρ . The op- ableC iscrucial,anditcanbeunderstoodasapointerto
Y y
timum probability of guessing y given its encoding ρ , thepartofY aboutwhichthereislargeignorance(given
y
which lies in a register E, can be written as a large ignorance of the whole string Y); see Figure 1
(cid:88) for an illustration of this role. It is important to note
P (Y|E)=max P (y)p(y|M,P ) , (1)
guess Y y that the choice of C should be consistent with the en-
{M}
y∈{0,...,d−1}2 coding prior to its definition. That is, whereas C may of
coursedependonY ,Y andtheencodingE,thereduced
where p(y|M,P ) is the probability of obtaining out- 0 1
y
state on registers holding Y ,Y and E after tracing out
come y when measuring the preparation P with M, 0 1
y
C should remain the same. In particular, this condi-
tionstatesthatC cannotbetheresultofameasurement
causing disturbance to the encoding register; if we were
∗Electronicaddress: [email protected] allowed to destroy information in the encoding we would
†Electronicaddress: [email protected] effectively alter the original situation.
2
RESULTS by quantum theory. More specifically, we provide an ex-
plicit construction that demonstrates this violation: Let
An inequality valid in any NC-HV model. Y = Y0Y1 be uniformly distributed over {0,...,d−1}2.
Given y = y y ∈ {0,...,d − 1}2, define its encoding
We first show that classically, or more generally in 0 1
ρE =|Ψ (cid:105)(cid:104)Ψ | as
anynon-contextualhiddenvariablemodel[22],ignorance y0y1 y y
aboutthewholereallydoes implyignoranceaboutapart.
More specifically, we show that for any random variable
|Ψ (cid:105):=Xy0Zy1|Ψ(cid:105) , (5)
Y =Y0Y1 and side information E, there exists a random y d d
variable C ∈{0,1} such that
where X and Z are the generalized Pauli matrices and
d d
H (Y Y |E)
H (Y |EC)(cid:38) ∞ 0 1 . (3) 1
∞ C 2 |Ψ(cid:105):= (cid:114) (|0(cid:105)+F|0(cid:105)) , (6)
(cid:16) (cid:17)
2 1+ √1
This inequality can be understood as an information- d
theoretic analogue of Bell inequalities to the question of
non-contextuality. Classically, this inequality is known with F being the matrix of the Fourier transform over
as the min-entropy splitting inequality, and plays an im- Zd. Since we are only interested in showing a quantum
portant role in the proof of security of some (classical) violation, we will for simplicity always assume that d is
cryptographic primitives [3, 4]. The proof of (3) is a prime[23]. ThesystemYE isthendescribedbytheccq-
straightforward extension to the case of standard NC- state
HV models [7, 8] of a classical technique known as min-
1 (cid:88)
entropysplittingfirstintroducedbyWullschleger[3],and ρ = |y (cid:105)(cid:104)y |⊗|y (cid:105)(cid:104)y |⊗ρE . (7)
Y0Y1E d2 0 0 1 1 y0y1
we defer details to the appendix. y0,y1
The fact that C is a random variable, rather than be-
ing deterministically chosen, is important, and an ex- We first prove that H∞(Y|E) = logd for our choice of
ample will help clarify its role. Consider Y uniformly encoding. We then show the striking fact that, even
distributed over {0,...,d−1}2 and E = Y with prob- though the encoding we defined gives very little infor-
0
ability 1/2, and Y with probability 1/2. In this case it mation about the whole string Y, for any adversarially
1
is easy to see that both Y and Y can be guessed from chosen random variable C (possibly correlated with our
0 1
E with average success probability 1/2+1/(2d), so that encoding) one can guess YC from its encoding ρE with
H (Y |E) = H (Y |E) ≈ 1, which is much less than essentially constant probability. More precisely, for any
∞ 0 ∞ 1
H∞(Y|E)≈logd. However, define C as 0 if E =Y1 and ccqc-state ρY0Y1EC, with C ∈ {0,1}, that satisfies the
1ifE =Y0. ThenitisclearthatH∞(YC|EC)=logd,as consistency relation trC(ρY0Y1EC)=ρY0Y1E, we have
we are always asked to predict the variable about which
H (Y |EC)≈1 (8)
we have no side information at all! In this case the ran- ∞ C
dom variable C “points to the unknown” by being cor-
for any sufficiently large d. This shows that the inequal-
related with the side information E, but is entirely con-
ity(3)canbeviolatedarbitrarily(withd),givingastrik-
sistent with our knowledge about the world: by tracing
ing example of the malleability of quantum information.
out C we recover the initial joint distribution on (Y,E).
What’s more, it is not hard to show that this effect still
Thisalsohighlightstheimportantdifferencebetweenthe
holds even for Hε , for constant error ε, and a “helpful”
task we are considering and the well-studied random ac- ∞
physical model leaking m ≈ clogd bits of information
cess codes [5, 6], in which the requirement is to be able
with c < 1/2. Hence, the violation of the inequality (3)
to predict one of Y ,Y (adversarially chosen) from their
0 1 has the appealing feature of being very robust. Indeed,
encoding; for this task it has been demonstrated that
for any number of bits m a NC-HV might leak in addi-
there is virtually no asymptotic difference between clas-
tion, we could find a d to ensure a violation.
sicalandquantumencodings(seebelowforadiscussion).
It is interesting to note that (3) still holds if we con-
sider a somewhat “helpful” physical model in which in
additiontotheencodingonemightlearnasmallnumber
of “leaked” bits of information about Y. More specifi-
PROOF OF THE QUANTUM VIOLATION
cally, if the NC-HV discloses m extra bits of information
then it follows from the chain rule for the min-entropy
We now provide an outline of the proof that the en-
(see appendix) that
coding specified in (5) leads to a quantum violation of
H (Y Y |E) the splitting inequality (3); for completeness, we provide
H∞(YC|EC)(cid:38) ∞ 20 1 −m . (4) a more detailed derivation in the appendix. Our proof
proceeds in three steps: first, by computing H (Y|E)
∞
Violation in quantum theory. Our main result we show that the encoding does indeed not reveal much
shows that (3) is violated in the strongest possible sense information about the whole. Second, we compute the
3
v = tr(Qˆ) = 1/d. Similarly, consider the measure-
dual
ment M = |Ψ (cid:105)(cid:104)Ψ |/d. Using Schur’s lemma,
one cany0dyi1rectly vy0eyr1ify tyh0ayt1 (cid:80) M = I, giving
y0,y1 y0y1
v =1/d. The claimed value of the conditional min-
primal
entropy follows.
Step 2: Asimilarargument,exploitingthesymmetries
in the encoding, can be used to show that
1 1
P (Y |E)=P (Y |E)= + √ . (9)
guess 0 guess 1 2 2 d
FIG. 1: Intuitively,onecanalsounderstandourresultintermsofa The measurements that attain these values are given by
the eigenbases of Z and X respectively.
gamebetweenBobandamaliciouschallenger,theOwl. ImagineBob d d
is taking a philosophy class teaching him knowledge about Y, clearly As a remark to quantum information theorists, note
chosenuniformlyatrandom. Unfortunately,heneveractuallyattended that this means that our encoding doubles as a random
andhadinsufficienttimetoprepareforhisexam. Luckily,however,he accessencodingofthestringyintoad-dimensionalquan-
hasbeengivensomeencodingE ofthepossibleanswersY0Y1,hastily tumstateρy withprobability(9)torecovery0 ory1. For
prepared by his old friend Alice. When entering the room, he had to d = 2, such encodings have previously been considered
submit E for inspection to the challenger who knows Y0, Y1 as well in the realm of contextuality as a reinterpretation of the
astheencodingAlicemightuse. Afterinspection,thechallengermay
CHSH inequality [9, 10]. However, we note that this is
secretly keep a system C, possibly correlated with E, but such that
not what is surprising here, as there exists an obvious
the reduced system on Y0, Y1 and E looks untampered with. It is classical random access encoding for 2 dits into a single
immediatelyobvioustothechallengerthatBobmustbeignorantabout
dit(seediscussiononC above),withrecoveryprobability
the whole of Y0Y1. But can it always measure and point to a C = c
1/2+1/(2d).
suchthatBobisignorantaboutYC? Thatis,canitalwaysdetectBob’s
ignorancebychallenginghimtooutputasingleYC? Classically,thisis Simplycomputing (9)ishenceinsufficientforourpur-
indeedpossible: ignoranceaboutthewholeofY0Y1 impliessignificant poses. Let us write {|y0(cid:105), y0 ∈ {0,...,d−1}} for the
ignoranceaboutoneoftheparts,YC. However,aquantumBobcould eigenbasis of Zd, and note that its Fourier transform
beattheOwl. {F|y (cid:105), y ∈{0,...,d−1}} is then the eigenbasis of X .
1 1 d
Exploiting the symmetries in our problem, it is straight-
forward to verify that for all y ,y ∈{0,...,d−1}
optimal measurements for extracting Y and Y on aver- 0 1
0 1
age, and show that these measurements perform equally 1 1
well for any other prior distribution on Y. Finally, we |(cid:104)y0|Ψy0y1(cid:105)|2 =|(cid:104)y1|F†|Ψy0y1(cid:105)|2 = 2 + 2√d . (10)
show that even introducing an additional system C does
notchangeone’sabilitytoextractYC fromtheencoding. An important consequence of this is that for any other
Step 1: Very intuitively, ignorance about the whole priordistributionPy0y1, measurementintheZd eigenba-
stringalreadyfollowsfromHolevo’stheoremandthefact sis distinguishes the states
that we are trying to encode 2 dits into a d-dimensional
(cid:88)
quantum system. To see this more explicitly, recall σy0 = Py0y1(y0,y1)|Ψy0y1(cid:105)(cid:104)Ψy0y1| , (11)
that H∞(Y|E) = logd is equivalent to showing that y1
P (Y|E) = 1/d. From (1) we have that this guess- √
guess
with probability at least 1/2+1/(2 d), even when the
ing probability is given by the solution to the following
distribution is unknown. A similar argument can be
semidefinite program (SDP)
made for the marginal states σ and measurement in
y1
maximize d12 (cid:80)y0,y1tr(My0y1|Ψy0y1(cid:105)(cid:104)Ψy0y1|) the Xd eigenbasis.
subject to M ≥0 for all y ,y , Step 3: It now remains to show that, for any possi-
(cid:80)y0y1 M =I .0 1 ble choice of an additional classical system C [24], one
y0,y1 y0,y1 can still guess Y from the encoding with a good suc-
C
The dual SDP is easily found to be cess probability: one cannot construct a C which would
“point to the unknown”. Note that we may express the
minimize Tr(Q) joint state with any other system C as
subject to Q≥ 1 |Ψ (cid:105)(cid:104)Ψ | for all y ,y .
d2 y0y1 y0y1 0 1 1 (cid:88)
ρ = |y (cid:105)(cid:104)y |⊗|y (cid:105)(cid:104)y |⊗ρEC , (12)
Let v and v be the optimal values of the pri- Y0Y1EC d2 0 0 1 1 y0y1c
mal apnridmadlual resdpueacltively. By the property of weak y0y1
douuralriteys,ulvtd,uwale≥onvlyprinmeaeldaltwoafiynsdhoaldpsr.imHaelnacned, tdouaplrosvoe- froerduscoemdestsattaeteosnρYEy0Cy,Y1c aonndreEgisshteorusldEbeantdheCsa.mSeinfoceratnhye
0 1
lutions for which vprimal = vdual = 1/d. It is easy C we have by the fact that Y0 and Y1 are classical that
to check that Qˆ = I/d2 is a dual solution with value tr (ρEC ) = |Ψ (cid:105)(cid:104)Ψ |. Since |Ψ (cid:105)(cid:104)Ψ | is a
C y0y1c y0y1 y0y1 y0y1 y0y1
4
pure state, this implies that ρEC = |Ψ (cid:105)(cid:104)Ψ |⊗ Our results show that contextuality is responsible for
y0y1c y0y1 y0y1
σC . Now imagine that we were to perform some arbi- much more significant effects than have previously been
trya0ryy1 measurement on C, whose outcome would suppos- noted. In particular, it leads to arbitrarily large quan-
edlypointtoanunknownsubstring. Butthismerelycre- tumviolationsof (3),whichcanbeunderstoodasaBell-
ates a different distribution P over encoded strings, type inequality for non-contextuality. This is still true
y0y1
and we already know from the above that we can still even for a somewhat “helpful” physical model, leaking
succeed in retri√eving either y0 or y1 with probability at additional bits of information. To our knowledge, this is
least1/2+1/(2 d)bymakingameasurementintheX the first information-theoretic inequality distinguishing
d
or Z basis respectively. Hence for large d we have a NC-HV models from quantum theory. Our question and
d
recovery probability of roughly 1/2, implying perspective are completely novel, and we hope that our
observations will lead to an increased understanding of
H (Y |EC =0)≈H (Y |EC =1)≈1 , (13) theroleofcontextuality. Inthiswork,wehaveconsidered
∞ 0 ∞ 1
standard NC-HVs in which all HVs can be decomposed
which is our main claim. as convex combinations of extremal HVs which give de-
Note that the consistency condition, which states that terministic outcomes for effects (see appendix). It is an
our choice of C should be compatible with the original interestingopenquestionwhetherourresultscanbegen-
situation and should not affect the reduced state, is im- eralized to very general models that distinguish between
portant, and makes our task non-trivial. As an example, measurement and preparation contextuality [1].
consider our construction for d = 2. In that case the Attheheartofourresultliesthefactthatcontextual-
encoding states lie in the XZ-plane of the Bloch sphere. ity allows for strong forms of complementarity in quan-
Imagine now that we measured the encoding register E tum mechanics (often conflated with uncertainty [16]),
in the eigenbasis of σ , and let the outcome be C. But which intuitively is responsible for allowing the violation
y
for any measurement in the eigenbasis of σ we observe of (3). Typically, complementarity is discussed by con-
y
entirely random outcomes, and the post-measurement sidering examples of properties of a physical system that
statestriviallynolongercarryanyinformationaboutthe one may be able to determine individually, but which
encoded string. Indeed, any choice of C would do if we cannot all be learned at once. In spirit, this is simi-
are allowed to destroy information in such a manner. lar to the notion of a random access encoding where we
could determine either property Y or Y quite well, but
0 1
not all of Y. However, as discussed above this can also
IMPLICATIONS FOR CRYPTOGRAPHY be true classically, in a probabilistic sense. We would
thus like to emphasize the novelty of our perspective, as
Our result answers an interesting open question we approach the problem from the other end, and first
in quantum cryptography [11], namely whether min- demonstrate the general result that in an NC-HV igno-
entropysplittingcanstillbeperformedwhenconditioned rance about the whole always implies ignorance about a
on quantum instead of classical knowledge. This tech- part. We then show that in a quantum world, this prin-
nique was used to deal with classical side information cipleisviolatedinthestrongestpossiblesense,evenwith
E in [4, 12]. Our example shows that quantum min- respect to an additional system C. One could think of
entropy splitting is impossible, even when we would be thisasamuchmorerobustwayofcapturingtheintuitive
willing to accept subtracting a large error term on the notion of complementarity [17].
r.h.s. of (3). This tells us that classical protocols that Finally, it is an interesting open question whether our
relyonsuchstatementsmaybecomeinsecureinthepres- inequality can be experimentally verified. Note that this
enceofquantumsideinformation,andhighlightstheim- made difficult by the fact that our aim would be to test
portanceofso-calledmin-entropysamplingresultsof[13] ignorance rather than knowledge. However, it is con-
used in quantum cryptography [14] instead. It also in- ceivable that such an experiment can be performed by
dicates that contextuality may play a more important building a larger cryptographic protocol whose security
role in our understanding of the possibilities and limits reliesonbeingignorantaboutoneofthepartsofastring
of quantum cryptography than previously thought. Y created during that protocol [26]. A quantum viola-
tion could then be observed by breaking the security of
theprotocol,andexhibitingknowledge (ratherthanigno-
rance) about some information that could not have been
DISCUSSION
obtained if the protocol was secure.
Thefirstindicationthatsomethingmaybeamisswhen
looking at knowledge from a quantum perspective was
given by Schr¨odinger [15], who pointed out that one can Acknowledgments
have knowledge (not ignorance) about the whole, while
stillbeingignorantabouttheparts[25]. Here,wetackled We thank Jonathan Oppenheim, Christian Schaffner,
thisproblemfromaverydifferentdirection,startingwith Tony Short, Robert Spekkens and CQT’s ”non-local
the premise that one has ignorance about the whole. club” for useful comments. We are particularly grate-
5
ful to Tony Short for pointing out that our problem the Ministry of Education, Singapore. TV is grateful
could more easily be explained by means of the game to CQT, Singapore, for hosting him while part of this
depicted in Figure 1. TV was supported by ARO Grant workwasdone. SWisgratefulforaninvitationfromthe
W911NF-09-1-0440 and NSF Grant CCF-0905626. SW Mittag-LefflerInstitute,Sweden,wherepartofthiswork
wassupportedbytheNationalResearchFoundation,and was performed.
[1] R. Spekkens, Physical Review A 71, 052108 (2005). [25] The whole here being a maximally entangled state, and
[2] R.Ko¨nig,R.Renner,andC.Schaffner,IEEETrans.Info. thepartsbeingtheindividual(locallycompletelymixed)
55 (2009). subsystems. See also [21] for an example.
[3] J. Wullschleger, in Advances in Cryptology — EURO- [26] For example, one could consider weak forms of oblivious
CRYPT ’07 (Springer-Verlag, 2007), Lecture Notes in transferwhereoneonlydemandssecurityagainstthere-
Computer Science. ceiver.
[4] I. B. Damg˚ard, S. Fehr, R. Renner, L. Salvail, and [27] Asimpleexampleintheclassicalsetting—storingeach
C. Schaffner, in Advances in Cryptology—CRYPTO ’07 ofthehalveswithprobabilityhalf—shouldconvincethe
(Springer-Verlag, 2007), vol. 4622 of Lecture Notes in reader that this is necessary.
Computer Science, pp. 360–378. [28] We will write a max instead of a sup everywhere, and
[5] A.Nayak,inProceedingsof40thIEEEFOCS (1999),pp. assume that the dimension of the system E is finite.
369–376. [29] Someofthesevariablesmaybehidden,inthesensethat
[6] A. Ambainis, A. Nayak, A. Ta-Shma, and U. Vazirani, the operational description of a particular preparation
in Proceedings of 31st ACM STOC (1999), pp. 376–383. does not necessarily fully determine the distribution on
[7] A. A. Klyachko, M. A. Can, S. Biniciog˘lu, and A. S. variables that describe it, but we will not need to make
Shumsovsky, Physical Review Letters 101, 020403 that distinction.
(2008).
[8] A. Cabello, S. Severini, and A. Winter (2010),
In this appendix, we provide a detailed derivation of our
arXiv:1010.2163.
results. To this end, we first provide some more detailed
[9] J. Clauser, M. Horne, A. Shimony, and R. Holt, Phys.
background on the entropic quantities we use in Sec-
Rev. Lett. 23, 880 (1969).
tion A. In Section B we show that the splitting inequal-
[10] R. Spekkens, D. Buzacott, A. Keehn, B. Toner, and
ity (B8) is satisfied in any deterministic non-contextual
G. Pryde, Physical Review Letters 102, 010401 (2009).
[11] C. Schaffner (2007), Personal communication. hidden variable model (NC-HV model for short). This
[12] I. B. Damg˚ard, S. Fehr, L. Salvail, and C. Schaffner, in is a minor twist on the existing classical proof [4] due
Proceedings of 46th IEEE FOCS (2005), pp. 449–458. to Wullschleger [3]. Finally, in Section C, we proceed to
[13] R. Ko¨nig and R. Renner (2007), arXiv:0712.4291. proveourmainresult,thatthereexistsaquantumencod-
[14] R. Ko¨nig, S. Wehner, and J. Wullschleger (2009), ing which strongly violates the splitting inequality (B8).
arXiv:0906.1030.
[15] E. Schro¨dinger, Naturwissenschaften 23, 807,823,840
(1935).
Appendix A: Entropy measures
[16] J.OppenheimandS.Wehner,Science330,1072(2010).
[17] J. Oppenheim and S. Wehner (2010), in preparation.
[18] A. J. Short and S. Wehner, New Journal of Physics 12, Throughout, we will measure information in terms of
033023 (2010). themin-entropy,whichisdirectlyrelatedtotheguessing
[19] R. Renner, Ph.D. thesis, ETH Zurich (2005), quant- probability P (Y|E) [2], where Y is a classical string
guess
ph/0512258. ranging in the set Y and E an auxiliary system. It is
[20] A.Bowie,IntroductiontoGermanphilosophy: fromKant
defined as the maximum probability with which one can
to Habermas (2003).
predict the whole string Y, given the system E. The
[21] R. Q. Odendaal and A. R. Plastino, Eur. J. of Physics
maximization is over all possible observations, or mea-
31, 193 (2010).
surements, on E; these vary depending on the physical
[22] Intuitively, a non-contextual model is one in which the
observable statistics of a particular measurement do not model (e.g. classical or quantum) under consideration.
depend on the context in which the measurement isper-
Definition A.1. Let Y be a classical random vari-
formed,andinparticularonwhichothercompatiblemea-
surements are possibly performed simultaneously. Here, able with distribution PY taking values in a set Y, and
and as is usual, we consider non-contextual models in {Py}y∈Y any set of preparations on E. Then the maxi-
which the measurements are composed of deterministic mum guessing probability of Y given E is defined as
effects. We refer to the appendix for formal definitions.
[23] Recall that there are infinitely many primes. P (Y|E)= max (cid:88)P (y)p(y|P ,M ) , (A1)
guess Y y y
[24] In principle, C could be arbitrary, but since we are only {My}y∈Y
interested in the result of a 2-outcome measurement on
C, we assume that C is indeed already classical and use
wherethemaximumistakenoverallmeasurementsM=
the subscript C to denote that classical value.
{M } allowed in the model.
y
6
For instance, in the case of quantum mechanics we A final property that will be important to us is that,
simply have as a direct consequence of (A4) we may also write the
min-entropy as
P (Y|E):= max (cid:88)P (y)tr(cid:0)M ρE(cid:1) , (A2)
guess Y y y
{∀MyMy}yy≥∈0Y y H∞(Y|E)=minH∞(Y|M(E)) , (A8)
(cid:80)yMy=I M
wherethemaximizationistakenoverallPOVMs[28]and where the minimization is taken over all measurements
ρEy denotes the reduced state of the system on E, when M,andH∞(Y|M(E))isthemin-entropyconditionedon
Y = y. For classical side-information E this expression the classical information obtained by measuring E with
simplifies to M.
(cid:20) (cid:21)
P (Y|E):=E maxP (y) . (A3)
guess e←E Y|E=e
y
Inotherwords,forclassicalsideinformation,theoptimal Appendix B: A splitting inequality valid in any
NC-HV model
guessing measurement is to simply output the y which is
most likely given the classical value e.
For the case of classical and quantum theories it is Beforeturningtotheproofofthegeneralizedsplitting
known that the guessing probability directly relates to inequality, let us briefly review what is meant by a non-
theconditionalmin-entropy[2]. Here,wefollowtheoper- contextualmodel. Inanyphysicaltheory,wecanimagine
ational approach of [18], and define the conditional min- that a system is prepared according to some preparation
entropy for an arbitrary theory with classical Y as P, onwhichwelatermakemeasurements M. Eachsuch
measurement can be viewed as a collection of elemen-
H (Y|E):=−logP (Y|E) . (A4)
∞ guess tary effects f. The exact form of the effects depends on
the model one considers. For example, in quantum the-
For the case of quantum systems, the conditional min-
ory the effects are simply given by POVM elements. A
entropy was first introduced by Renner [19] as a way
particularlyusefuleffectisgivenbytheso-calledunit ef-
to measure randomness conditioned on an adversary’s
fect I, corresponding to the identity in the quantum or
knowledge. The min-entropy can also be defined when
classical setting. Hence to any effect one can associate a
Y is quantum itself [19], but we will not need it here. In
two-outcome measurement M ={f,I−f}.
thequantumsetting,wewillalsouseasmoothedversion f
of the quantum conditional min-entropy, defined for any When discussing non-contextuality, this measurement
ε>0 as: is typically interpreted as a question one might pose to
the underlying physical system and has two answers,
Hε∞(Y|E)=ρ˜YE∈mBaεx(ρYE)H∞(Y|E)ρ˜YE , (A5) “fyaess”afoqrufesatinodn.“nOo”f fcoorurIs−e,fo.neWmeihgehntcecoanlssioderrefemretao-
wherethemaximizationistakenoverall(subnormalized) surements that ask many questions simultaneously, that
states ρ˜ within ε trace distance of ρ . A similar is, they consist of many individual effects. Two effects
YE YE
definition could be made for arbitrary theories using the are called compatible if the corresponding questions can
distance defined in [18], but we will not require it here. beansweredsimultaneouslywithoutcausingdisturbance
The conditional min-entropy has a number of appeal- to the underlying physical system, in the sense that we
ing properties, which for any NC-HV model essentially would obtain the same answers again were we to ask the
follow from its operational interpretation, and also hold same questions repeatedly.
inthequantumsetting[19]. Firstofallconsiderthemin- A set of mutually compatible effects/questions is
entropy of classical YZ conditioned on side information therebycalledacontext. Forexample, iff iscompatible
1
E. Clearly, since guessing Y and Z can only be more withf thesetC ={f ,f }iscalledacontext. Similarly,
2 1 1 2
difficult then guessing Y alone, we have Pguess(YZ|E)≤ if f1 is compatible with f3, then the set C2 = {f1,f3} is
Pguess(Y|E). Translated, this gives monotonicity of the also a context. Note, however, that in such a scenario it
min-entropy can still be that f and f are not compatible. That is,
2 3
any effect can be part of multiple distinct contexts.
H (YZ|E)≥H (Y|E) . (A6)
∞ ∞
For each effect in a particular context, one can pose
Similarly, to guess Y and Z from E one strategy would the question f by making the measurement M defined
f
be to guess Z (in the worst case, choosing Z = z with above. Informally,amodeliscallednon-contextual ifthe
z ∈Z taken from the uniform distribution) and then try answer to question f will always be the same in both
1
to guess Y knowing Z. In terms of guessing probabili- contexts,whetherM or M areperformedsimultane-
f2 f3
ties, this means that P (YZ|E)≥P (Y|EZ)/|Z|. ously (which is possible by definition of being compati-
guess guess
Translated, we obtain the chain rule ble). In our example this means that if were we to make
measurementM incontextC ,orcontextC ,wewould
H (Y|EZ)≥H (YZ|E)−log|Z| . (A7) f1 1 2
∞ ∞ always obtain the same distribution on outcomes.
7
1. Classical theory 3. For every (cid:96)-outcome measurement M, and hidden
variableλ∈Λ,aprobabilitydistributionp(k|λ,M)
Recall that the phenomenon of min-entropy splitting over k ∈[(cid:96)]:={1,...,(cid:96)}.
guarantees that, if a string Y Y has high min-entropy
0 1 The model is indeed a model for the physical theory if
then there is a way to split it by introducing a binary
it accurately predicts the outcome distribution of any
randomvariableC suchthatthestringY hasabouthalf
C measurement on any preparation, i.e. performing mea-
as much min-entropy as Y Y . Classically, min-entropy
0 1 surement M on preparation P produces outcome k with
splitting follows from the following statement.
probability
Lemma B.1 ([4],Lemma4.2). Let ε>0 and Y ,Y two
0 1 (cid:88)
random variables such that Hε (Y Y |E) ≥ α, where E p(k|P,M)= p(k|λ,M)p(λ|P) , (B2)
∞ 0 1
is classical. Then, there exists a binary random variable λ
C such that Hε (Y C|E)≥α/2.
∞ C
where for notational simplicity we assume that Λ is dis-
Usingthechainrule(A7)andthemonotonicity(A6)of crete.
the min-entropy one immediately obtains the statement Effects. We adopt the common notion that measure-
of min-entropy splitting ments are a collection of elementary effects. Here, an
effect is a linear functional f : Λ → [0,1], mapping
k
Hε∞P(YC|EC)≥α/2−1−log1/ε(cid:48) (B1) hidden variables to outcomes. As is common in the
studyofnon-contextuality[8],wewillconsideronlymea-
surements which are a collection of deterministic effects
2. Non-contextual hidden variable models f : Λ → {0,1}. That is, we effectively work with a
k
deterministic model. Much more general scenarios are
Typically,inanon-contextualhiddenvariablemodelit certainly possible [1] but we will not consider them here.
is assumed that a preparation P is simply a distribution Notethatadeterministicmodeldoesnotmeanthatthere
over hidden variables Λ, and a measurement then cor- is no more randomness: preparations are given as prob-
responds to “reading out” such hidden variables. Each ability distributions over hidden variables and hence we
outcome event k ∈ K is associated with a correspond- generally do observe non-deterministic outcomes when
ing effect f , where intuitively f “reads out” the hidden measuring a preparation. Of particular importance is
k k
variables by mapping a certain subset of possible hidden the unit effect I (i.e, the identity), which obeys I(λ)=1
variablestotheoutcomek ∈K. Incontrast,someworks for all λ ∈ Λ. A measurement is thus a collection
consider more generalized scenarios known as ontological M := {fk | (cid:80)kfk = I}, where we usually index the
models [1]. The main difference here is that these hid- effects by the outcome that they give in M. We write
den variable models can locally model even contextual the probability of obtaining the outcome k using mea-
theories, but specify explicit conditions to make these surement M containing the effect fk as
generalized theories non-contextual again.
In this section we show that the splitting inequality p(k|λ,fk):=p(k|λ,M)=fk(λ) . (B3)
holdsinanystandarddeterministic NC-HV,whichisthe
definition taken in most previous work, as in e.g. [7, 8]. Notethatwitheveryeffect,wecanagainassociateatwo-
We will, however, phrase our result in the general lan- outcome measurement Mf = {f,I−f} where without
guage of non-contextual models as introduced in [1], re- loss of generality we label f using the outcome ’1’ and
stricting our attention to those models which are deter- I−f usingtheoutcome’0’. Whenconcernedwithsucha
ministic. measurementMf wethusalsousep(1|λ,f)andp(0|λ,I−
f) to denote the probabilities of obtaining outcomes ’1’
and ’0’ respectively.
a. Background
Extensions. Often we wish to relate one physical sys-
tem to another. For example, we may wish to perform
Veryintuitively,anon-contextualontologicalmodel for an additional independent experiment such as flipping a
an operational theory associates intrinsic attributes to coin. Given a system with a set of hidden variables Λ,
every physical system, which are supposed to exist inde- we allow its extension to a second system in the follow-
pendently of the particular context in which the system ing way: if Λ(cid:48) is another set of hidden variables used to
might be observed. These attributes are described by a describeanotherphysicalsystem,thenthecombinedsys-
set of hidden variables [29] λ∈Λ. Hence for us a hidden tem will have hidden variables Λ×Λ(cid:48). For every prepa-
variable model consists of the following: ration P on the original system, we say that P(cid:48) is an
extensionofP inthecombinedsystemifforeveryλ∈Λ
1. A set of hidden variables Λ.
(cid:88)
2. For every preparation P in the physical theory, a p(λ|P)= p(cid:48)((λ,λ(cid:48))|P(cid:48)) . (B4)
probability distribution p(λ|P) over λ∈Λ. λ(cid:48)∈Λ(cid:48)
8
AmeasurementM(cid:48) issimilarlysaidtoextendMaslong Fix a measurement M = {f } , where we indexed the
k k
as effects by their outcome in the measurement. By defi-
nition, the probability of observing the outcome k when
(cid:88)
p(j|λ,M)= p(cid:48)(j|(λ,λ(cid:48)),M(cid:48)) . (B5) M is performed on the preparation P is
y0y1
λ(cid:48)
(cid:88)
p(k|P ,M)= p(λ|P )p(k|λ,f ) , (B11)
Preparations. To study our problem, we will assume y0y1 y0y1 k
λ
that there is an implicit prior distribution on prepara-
tionsP describingpriorknowledgeaboutthestateofthe Theoverallprobabilityofobservingtheoutcomek when
systemunderconsideration. Morespecifically,wewillbe M is performed on the preparation P corresponding to
concerned with encodings of a string y into preparations the mixture of the preparations Py0y1 with associated
Py, where the probability PY(y) of choosing the string y probabilities p(Py0y1) is then
translates into a prior probability on the preparation as
(cid:88)
p(k):=p(k|P)= p(P )p(k|P ) . (B12)
y0y1 y0y1
p(Py):=PY(y) . (B6) y0y1
Notethatbydefinitionthehiddenvariablesλgivedeter-
ministic outcomes under the measurement of any effect,
b. Splitting inequality
andhencep(k|λ,f )=λ , whereλ is1ifthemeasure-
ment {f ,I−f } dketermifnkistically pfkroduces the outcome
k k
We are now ready to generalize Lemma B.1 to any ’f ’ when performed on a system in state λ, and 0 other-
k
deterministic NC-HV model. The analogue of (B1) is wise. Using Bayes’ rule twice we obtain
then an easy corollary. Note that in this statement,
the conditional min-entropy is understood as being de- p(k)p(P |k)=p(P )p(k|P )
y0y1 y0y1 y0y1
fined through the guessing probability (A1) as in equa- (cid:88)
=p(P ) p(λ|P )p(k|λ,f )
toinonth(eA4st)r.inTghsisyayssu,mthersoguigvhenwahfiicxhedadpirsitorribduitsitornibPuYti0oYn1 y0y1 λ y0y1 k
0 1 (cid:88)
onthepreparationsP followsasexplainedattheend = p(λ)p(k|λ,f )p(P |λ) . (B13)
y0y1 k y0y1
of Section B2. λ
Theorem B.2. Let a NC-HV model M be given, with Using(A3)and(A8)weobtainthatforanymeasurement
corresponding set of hidden variables Λ. Let Y = Y0Y1 M={fk},theguessingprobabilityofY0Y1isdetermined
be two classical random variables each taking values in a bythemaximumposteriorprobabilityofanystringy0y1,
finite set Y, and {P } a corresponding fixed conditionedonobtainingtheoutcomek whenmeasuring
set of preparations oyn0ya1 r(eyg0i,syt1e)∈rYE2 such that P with M, so that (B9) implies
(cid:88)
H∞(Y0Y1|E)≥α . (B7) 2−α ≥ p(k)my0ayx1 p(Py0y1|k)
k
Then there exists an extended model M(cid:48) over the set of (cid:34) (cid:35)
(cid:88) (cid:88)
thiiodndsenPv(cid:48)aria,bfloesrΛc(cid:48)∈={0Λ,×1}{,0eCx,te1nCd}i,nagntdheaPset ofapnrdepsaurcah- = λ p(λ)my0ayx1 k p(k|λ,fk)p(Py0y1|λ) . (B14)
y0y1c y0y1
that
where in order to invert the summations over k and λ
α with the maximization we used the fact that for any k,
H (Y C|E)≥ . (B8)
∞ C 2 there exists exactly one λ such that λfk = 1 and vice-
versa,sothatthesummationoverλ(resp. overk)which
Proof. Recall that we assume a prior distribution on the isafterthemaxintheexpressionsabovecontainsexactly
preparations given by p(Py0y1):=PY0Y1(y0y1). This lets one term. This is a consequence of the fact that the fk
us define the guessing probability, which by assumption form a measurement, so that (cid:80) f = 1, together with
k k
is such that thevariablesλbeingdeterministic,sothatp(k|λ,f )can
k
only be either 0 or 1.
2−α ≥Pguess(Y|E) . (B9) We now need to define the additional single-bit ran-
dom variable C, which is intuitively supposed to des-
To rewrite the r.h.s. in terms of hidden variables, first ignate which of the two halves, y or y , the prepa-
0 1
ofallnotethatgiventhepriordistributionoverprepara- ration P contains the least amount of information
tions we can write the probability of a particular hidden about, syo0yt1hat we can indeed lower-bound the min-
variable λ∈Λ as entropy H (Y C|P). For this we allow C to be cor-
∞ C
related with the preparation P .
p(λ)= (cid:88)p(Py0y1)p(λ|Py0y1) . (B10) In order to accommodate Cy0,y1we extend the set of
y0y1 hidden variables Λ(cid:48) as Λ(cid:48) × {0C,1C}. Define q1 =
9
(cid:80)
p(λ|P ),wherethesumrangesoverallλsuchthat Rather,letM={f } beany2d-outcomemeasurement;
(cid:80)λ p(P y0y|1λ) ≥ 2−α/2, and q = 1−q . Note that q as in (B14) we needktko bound
y0 y0y1 0 1 0
canbecomputedbythesamesummation,butnowrang- (cid:34) (cid:35)
ing over all λ such that (cid:80) p(P |λ) < 2−α/2. Define (cid:88) (cid:88) (cid:88)
two preparations as followsy:0 y0y1 λ p(λ)mya0x k p(k|(λ,1C),fk) y1 p(Py0y11|(λ,1C))
• Py0y11 is defined through the distribution Note that by definition, (cid:80)y0p(Py0y11|(λ,1C)) is either 0
or at least 2−α/2, so that for all y , y and λ, we have
p((λ,1 )|P )= (B15) 0 1
C y0y11 the trivial bound
(cid:26)p(λ|P )/q if (cid:80) p(P |λ)≥2−α/2
y0y1 1 y0 y0y1 p(P |(λ,1 ))
0 otherwise y0y11 C
(cid:88)
≤maxp(P |(λ,1 ))2α/2 p(P |(λ,1 ))
and p((λ,0C)|Py0y11)=0 for every λ. y0y1 y0y11 C(cid:88) y0 y0y11 C
=maxp(P |λ)2α/2 p(P |(λ,1 )) (B20)
• Py0y10 is defined analogously by y0y1 y0y1 y0 y0y11 C
p((λ,0C)|Py0y10)= (B16) whereforthelastequalityweused(B18). Summingthis
(cid:26)p(λ|P )/q if (cid:80) p(P |λ)<2−α/2 equation over all y1 and combining it with (B14) lets
y0y1 0 y0 y0y1 us bound (B20) by 2−α2α/2 · 1 = 2−α/2. This bound
0 otherwise together with (B19) proves the theorem.
and p((λ,1 )|P )=0 for every λ. The fact that min-entropy splitting holds in any NC-
C y0y10
HV model now follows as a corollary from Theorem B.2
Finally, we define the preparation Py0y1C as the mix- and the fact that the chain rule (A7) and monotonic-
ture of Py0y11 with probability q1, and of Py0y10 with ity(A6)ofthemin-entropyalsoholdforNC-HVmodels.
probability q . Note that the preparation P is
0 y0y1C Corollary B.3. Let a NC-HV model M be given, with
indeed an extension of P in the new theory, as
y0y1 corresponding set of hidden variables Λ. Let Y = Y Y
p((λ,0 )|P )+p((λ,1 )|P ) = p(λ|P ). Fi- 0 1
C y0y1C C y0y1C y0y1 be two classical random variables each taking values in a
nally, we update the prior on preparations by setting
finite set Y, and {P } a corresponding fixed
p(Py0y11) = q1p(Py0y1) and p(Py0y10) = q0p(Py0y1), so set of preparations oy0ny1a(yre0g,yi1s)t∈eYr2E. Then there exists
that
an extended model M(cid:48) over the set of hidden variables
Λ(cid:48) =Λ×{0 ,1 }, and a set of preparations P , for
p(Py0y1)=p(Py0y10)+p(Py0y11) . (B17) c∈{0,1}, exCtenCding the P such that y0y1c
y0y1
One can check that with these definitions, whenever
H (Y Y |E)
(cid:80) p(P |λ)≥2−α/2 wehave,usingBayes’ruletwice, H (Y |EC)≥ ∞ 0 1 −1 . (B21)
y0 y0y1 ∞ C 2
p(cid:0)P |(λ,1 )(cid:1) To see that this equality is robust is now again an im-
y0y11 C mediate consequence of the chain rule (A7) and mono-
p((λ,1 )|P )p(P )
= C y0y11 y0y11 tonicityproperty(A6),whichtellusthatwhenweobtain
p((λ,1 ))
C some additional classical information A = a with a ∈ A
= (p(λ|Py0y1)/q1)·(q1p(Py0y1)) we have
p(λ)
H (Y |EAC)≥H (Y A|EC)−log|A| (B22)
∞ C ∞ C
=p(P |λ) (B18)
y0y1 ≥H (Y |EC)−log|A| (B23)
∞ C
and 0 otherwise, where for the second equality we ≥H∞(Y0Y1|E)/2−log|A|−1 . (B24)
used p(λ) = p((λ,1 )) for all those λ such that
C That is, a secretly helpful NC-HV leaking a small num-
p((λ,1 )|P ) is not zero.
C y0y11 ber m = log|A| bits of additional information does not
From this point on, our proof follows very closely the decrease the min-entropy by more than log|A| bits.
classical proof of Lemma B.1. By definition, for every y
1
and every λ, we have that
Appendix C: Splitting is violated by quantum
(cid:88)p(P |(λ,0 ))<2−α/2 (B19) mechanics
y0y10 C
y0
We are now ready to show that the splitting inequal-
It does not seem possible to similarly bound ity (B8) is violated by quantum mechanics in a very
(cid:80)
p(P |(λ,1 )), but it is not necessary ei- strong sense. To this end, we first construct a partic-
y1 y0y11 C
ther, as we do not have access to this quantity directly. ular quantum encoding of two dits into one qudit.
10
1. The encoding Let v and v be the optimal values of the primal
primal dual
anddualrespectively. Notethatbyweakdualitywehave
ConsidertheencodingE :{0,...,d−1}×2 →Cd given vdual ≥vprimal. Since |Ψy0y1(cid:105)(cid:104)Ψy0y1| is a pure state, Qˆ =
by I/d2 is a feasible dual solution with value tr(Qˆ)=1/d.
WenowshowthatQˆ isinfactoptimal,byconstructing
E(y0,y1)=|Ψy0y1(cid:105):=Xdy0Zdy1|Ψ(cid:105) , (C1) asolutiontotheprimalthatachievesthesamevalue. Let
M = |Ψ (cid:105)(cid:104)Ψ |/d. Clearly, M ≥ 0 for all y
where Xd and Zd are the generalized Pauli matrices anyd0yy11, andyb0yy1Schyu0ry’1s lemma we havey0y1 0
givenbytheiractionsonanorthonormalbasis{|y (cid:105),y ∈
0 0
{0,...,d−1}} (cid:88) M = 1 (cid:88) Xy0Zy1|Ψ(cid:105)(cid:104)Ψ|(Xy0Zy1)† (C7)
y0y1 d d d d d
X |y (cid:105)=|y +1 mod d(cid:105) , (C2) y0,y1 y0,y1
d 0 0
=I . (C8)
Z |y (cid:105)=ωy0|y (cid:105) , (C3)
d 0 0
Hence,ourchoiceofoperatorsisafeasibleprimalsolution
with ω =exp(2πi/d), and
with primal value 1/d which concludes our claim.
1
|Ψ(cid:105):= (|0(cid:105)+F|0(cid:105)) , (C4) We now show that the probability of retrieving any
(cid:114)
(cid:16) (cid:17) of the individual entries Y and Y is nevertheless quite
2 1+ √1 0 1
d large. To this end, let us first establish the following
simple lemma.
with F denoting the Quantum Fourier transform opera-
tor over Z . Note that X = FZ F†. We also refer to Lemma C.2. For the encoding defined in (C1) we have
d d d
the eigenbasis of Zd as the computational basis and the for all y0,y1 ∈{0,...,d−1}
eigenbasis of X as the Fourier basis. Below, it will be
d 1 1
tcoornvinentihenetetigoennobtaesitshoaftXZd,aacntds avsictehevecryscal.icTshhrioftugohpoeruat-, |(cid:104)y0|Ψy0y1(cid:105)|2 = 2 + 2√d , (C9)
d
we will assume that d is prime. 1 1
|(cid:104)y |F†|Ψ (cid:105)|2 = + √ . (C10)
Imagineasourcethatchoosesy0,y1 ∈Y :={0,...,d− 1 y0y1 2 2 d
1}uniformlyatrandomandemits|Ψ (cid:105),corresponding
to the ccq-state y0y1 Proof. First of all, note that for all y0 and y1
ρY0Y11E (cid:88) (cid:104)y0|Ψy0y1(cid:105)==(cid:104)(cid:104)00||(ZXdy1dy|0Ψ)†(cid:105)|Ψ=y(cid:104)00y1|Ψ(cid:105)(cid:105) , ((CC1112))
:= |y (cid:105)(cid:104)y |⊗|y (cid:105)(cid:104)y |⊗|Ψ (cid:105)(cid:104)Ψ | . (C5)
d2 0 0 1 1 y0y1 y0y1
y0,y1(cid:124) (cid:123)Y(cid:122)0 (cid:125) (cid:124) (cid:123)Y(cid:122)1 (cid:125) (cid:124) (cid:123)E(cid:122) (cid:125) wwehehraevwee have used the fact that Zd|0(cid:105)=|0(cid:105). Similarly,
Throughout, we will consider the probability that we
guess Y0Y1 or the individual entries Y0 and Y1 given the (cid:104)y1|F†|Ψy0y1(cid:105)=ω−y1a(cid:104)y1|F†Zdy1|Ψ(cid:105) (C13)
register E. We begin by showing that for our specific =ω−y1a(cid:104)0|F†(Zy1)†Zy1|Ψ(cid:105) (C14)
d d
encodingtheprobabilityofguessingboth entriesY ,Y is
0 1 =ω−y1a(cid:104)0|F†|Ψ(cid:105) (C15)
small.
=ω−y1a(cid:104)0|Ψ(cid:105) , (C16)
Lemma C.1. For the ccq-state ρ given by (C5)
Y0Y1E
with ω = exp(2πi/d), where the first equality follows
1
from the fact that F|y (cid:105) is an eigenvector of X , and the
P (Y Y |E)= . (C6) 1 d
guess 0 1 d last equality by noting that F|Ψ(cid:105)=|Ψ(cid:105). It thus remains
to compute
Proof. Computing the probability of guessing both bits
is equivalent to solving the semidefinite program (SDP) 1
(cid:104)0|Ψ(cid:105)= ((cid:104)0|0(cid:105)+(cid:104)0|F|0(cid:105)) (C17)
(cid:114)
(cid:16) (cid:17)
2 1+ √1
maximize 1 (cid:80) tr(M |Ψ (cid:105)(cid:104)Ψ |) d
d2 y0,y1 y0y1 y0y1 y0y1 (cid:115)
subject to (cid:80)My0y1 ≥M0 for=allIy.0,y1 , = √1 1+ √1 , (C18)
y0,y1 y0,y1 2 d
The dual SDP is easily found to be
from which our claim follows.
minimize Tr(Q) It is now straightforward to compute the maximum
subject to Q≥ 1 |Ψ (cid:105)(cid:104)Ψ | for all y ,y . probabilities that we retrieve Y and Y correctly.
d2 y0y1 y0y1 0 1 0 1