Past exam of the mathematics course of the University of Cambridge / 2004 / iii / Paper 54 (Quantum Information Science)

By the Schmidt decomposition theorem, suitable local unitary operations put the normalized pure state into the formIt is entangled precisely when both Schmidt coefficients are nonzero. Put $s=2{\lambda }_0{\lambda }_1$, so $0<s\le 1$ for the case of interest. The Pauli operatorssatisfy $⟨Z\otimes Z⟩=1$ and $⟨X\otimes X⟩=s$ in this pure state: $Z\otimes Z$ fixes both basis terms, and $X\otimes X$ exchanges them.

Choose Alice's two observables as $A_0=Z$, $A_1=X$, and Bob's asThese are valid dichotomic projective measurements. Indeed, $XZ+ZX=0$ and $X^2=Z^2=I$, so $B_0^2=B_1^2=I$; each observable has outcomes $\pm 1$. For the CHSH inequality convention $|⟨A_0\otimes (B_0+B_1)+A_1\otimes (B_0-B_1)⟩|\le 2$, the quantum value isFor the original pure state, conjugate these four observables by the corresponding local unitary operators. Their outcomes and Pauli correlators are unchanged, and each party still measures only their own qubit. Thus every entangled pure two-qubit state violates CHSH for suitable local measurements, proving Gisin's theorem directly. The CHSH axes for an entangled pure two-qubit state approach a nonviolating configuration continuously as one Schmidt coefficient tends to zero; the strict violation therefore need not be large for weak entanglement.

There is a necessary distinction between a failure bound averaged over the unknown state, a worst-case bound, and a separate bound for each candidate state. The last interpretation is false: a forger can discard the inputs and always prepare $|{\psi }_0{⟩}^{\otimes N}$. If the actual state is $|{\psi }_0⟩$, every authenticity test passes with probability one. The meaningful uniform statement concerns worst-case failure, or average failure under any fixed prior giving both states positive probability. The PDF does not specify that prior; the argument below gives an explicit bound for either interpretation.

Put $c=|⟨{\psi }_0|{\psi }_1⟩|\in (0,1)$. Any unconditional strategy producing $N$ output qubits, including ancillas, adaptive measurement in quantum measurements and correlated outputs, is a quantum channel $\mathcal{E}$. Its inputs and ideal outputs are the density operatorsThe projective measurements on the different banknotes commute, and their all-pass effect is exactly $P_i$. Therefore the probability of at least one rejection, conditional on input $i$, isThis remains true for entangled outputs; no independence of their individual test outcomes is assumed.

Use trace distance $D(\rho ,\sigma )=\frac{1}{2}\Vert \rho -\sigma {\Vert }_1$. The pure-state trace distance and fidelity identity givesFor completeness, two pure-state projectors differ by a matrix with nonzero eigenvalues $\pm \sqrt{1-|⟨u|v⟩{|}^2}$, which proves this identity. Also the pure-target upper bound on trace distance gives $D({\rho }_i,P_i)\le \sqrt{e_i}$. To see the mixed-state step, write ${\rho }_i={\sum }_j{q}_j|u_j⟩⟨u_j|$ and use convexity of the trace norm followed by the Cauchy-Schwarz inequality:Finally, trace-distance contraction under quantum channels gives $D({\rho }_0,{\rho }_1)\le D({\sigma }_0,{\sigma }_1)$. This follows from $D(\rho ,\sigma )={\max }_{0\le E\le I}\mathrm{Tr}[E(\rho -\sigma )]$: the adjoint channel is positive and unital, so its image of any effect $E$ is still an effect.

The triangle inequality now yieldsThus the cloning failure bound from trace-distance contraction isand in particular $\max (e_0,e_1)\ge {\Delta }^2/4$. For positive priors ${\pi }_0+{\pi }_1=1$, another Cauchy-Schwarz inequality givesso the average rejection probability satisfiesFor equal priors, one may take $p_0={\Delta }^2/8$; the same choice is a strict lower bound on worst-case rejection. This proves a quantitative version of the no-cloning theorem for the bank's all-pass test. It concerns an unconditional attempt: heralded success cannot be postselected while omitting failed attempts from the accounting.

Let $q=|B|$ and choose $h$ uniformly from the finite family $H$. All bounds below must hold for every pair of distinct inputs $x,y\in A$.

A universal hash family, also called universal2, satisfies $P[h(x)=h(y)]\le 1/q$. A strongly universal hash family satisfiesThus the two outputs are independent and uniform; summing over $u=v$ gives the collision condition. An almost strongly universal hash family permits a larger conditional guessing bound. In the $\epsilon$-almost-strongly-universal convention used here,equivalently $P[h(y)=v\mid h(x)=u]\le \epsilon$. Necessarily $\epsilon \ge 1/q$, with $\epsilon =1/q$ giving strong universality. Stating this normalization matters because the name alone does not specify the allowed forgery probability.

Here is an explicit polynomial almost strongly universal hashing construction and a one-use message authentication protocol. Use a publicly specified finite field ${\mathbb{F}}_q$, where $q=2^t$. Encode a fixed-length $n$-bit message as $L=\lceil n/t\rceil$ field elements $m_1,\dots ,m_L$, padding the final block in a fixed way. Both parties know the length, so this encoding is injective. They share independent uniform secret field elements $a,b$, requiring $2t$ shared secret bits. DefineFor every message, the output is uniform because of $b$. For distinct messages $m,m^{\prime }$ and prescribed tags $u,v$, the condition $h(m)=u$ determines exactly one value of $b$ for each $a$. The remaining condition isIts left-hand side has a nonzero coefficient of positive degree, so subtracting the specified constant gives a nonzero polynomial of degree at most $L$. By the root bound for a polynomial, there are at most $L$ possible field elements $a$. Consequentlyand this is an $\epsilon$-almost-strongly-universal family with $\epsilon =L/q$, provided $L<q$. The powers start at one deliberately: a message coefficient at power zero could give a known constant tag shift, allowing a deterministic substitution.

Alice sends the message and its tag $u=h_{a,b}(m)$ over the public channel. Bob accepts only if his independently computed tag agrees. An attacker who has seen no tag guesses one with probability $1/q$. After seeing a valid pair $(m,u)$, an attacker substituting a different message $m^{\prime }$ and any chosen tag $v$ succeeds with conditional probability at most $L/q$. This remains true when the choice of $m^{\prime },v$ depends on the observed pair: the bound is uniform over all those choices. More explicitly, the observed tag leaves $a$ uniform because each possible $a$ has exactly one compatible secret mask $b$.

For a desired forgery bound $\eta$, choose $t=\lceil {\log }_2(n/\eta )\rceil$. Since $L\le n$ and $q\ge n/\eta$, the substitution bound is at most $\eta$. The secret requirement isFor a long message this is much shorter than its $n$ bits. This is Wegman–Carter authentication: a keyed hash plus a fresh secret one-time pad on the tag. It authenticates the message rather than concealing its contents. Use the key once for the guarantee just established; multiple authenticated messages require fresh masks and a reuse security analysis. Authenticate lengths and sequence identifiers too if variable lengths or replay protection are required.

Compute the honest one-qubit density operators in the computational basis. Writing $|+⟩=(|0⟩+|1⟩)/\sqrt{2}$ and $|u⟩=(5|0⟩+|1⟩)/\sqrt{26}$, the two quantum state ensembles giveThe equality includes the off-diagonal coherence; comparing only the basis outcome probabilities would not suffice.

The protocol is perfectly hiding against Bob when Alice is honest. Independence of the honest preparations makes his full received density operator ${\rho }_0^{\otimes N}={\rho }_1^{\otimes N}$. For any POVM $\{E_z\}$, including collective measurements and measurements using ancillas, the Born rule gives the same outcome probabilities $\mathrm{Tr}(E_z{\rho }_0^{\otimes N})=\mathrm{Tr}(E_z{\rho }_1^{\otimes N})$. Thus no measurement supplies information about the committed bit.

It is not binding against Alice. Here is an explicit ensemble-steering attack on quantum bit commitment. For each position, Alice prepares the normalized two-qubit pure stateretains $A$ and sends $B$. Its partial trace on $A$ is the honest common density operator. She sends the $B$ halves of $N$ independent copies while retaining all the $A$ halves, and chooses her bit only at unveiling.

To open one, she makes a projective measurement of each retained qubit in the computational basis. Outcome zero has probability $13/20$ and prepares Bob's state $|u⟩$; outcome one has probability $7/20$ and prepares $|1⟩$. She announces that list. It has exactly the honest bit-one distribution, and every declared-state test passes.

To open zero, she instead measures each retained qubit using a three-outcome POVM with effects $E_j=|v_j⟩⟨v_j|$, whereAll effects are positive. Their diagonal sums are $4/5+1/5=1$ and $4/70+16/70+5/7=1$, and the off-diagonal sum is zero, so $E_0+E_{+}+E_1=I$. This establishes that the proposed POVM is physically valid.

To verify the conditional states directly, the coefficient matrix of $|\Omega ⟩$, with Bob's index as the row and Alice's as the column, isA real rank-one effect $|v_j⟩⟨v_j|$ on Alice's half gives the unnormalized Bob state vector $C{v}_j$. For the three effects above,Their squared norms are therefore $1/2,1/4,1/4$, exactly the honest bit-zero probabilities, and Bob's conditional pure states are the corresponding declared states. Independent measurements on the retained halves produce the honest distribution of the entire list, so even checks on the declared frequencies do not defeat the attack. Every declared-state projector test again succeeds.

Alice can consequently unveil either bit with acceptance probability one, without having chosen it when sending the qubits. This is the Hughston–Jozsa–Wootters theorem mechanism implemented by an explicit measurement, rather than merely an appeal to the general impossibility of perfectly hiding and binding quantum bit commitment.