Two-way covert quantum communication in the microwave regime

R. Di Candia,1, ∗ H. Yi˘gitler,1 G. S. Paraoanu,2 and R. J¨antti1 1Department of Communications and Networking, Aalto University, Espoo, 02150 Finland 2QTF Centre of Excellence, Department of Applied Physics, Aalto University School of Science, FI-00076 AALTO, Finland Quantum communication addresses the problem of exchanging information across macroscopic distances by employing encryption techniques based on quantum mechanical laws. Here, we ad- vance a new paradigm for secure quantum communication by combining backscattering concepts with covert communication in the microwave regime. Our protocol allows communication between Alice, who uses only discrete phase modulations, and Bob, who has access to cryogenic microwave technology. Using notions of quantum channel discrimination and quantum metrology, we find the ultimate bounds for the receiver performance, proving that quantum correlations can enhance the signal-to-noise ratio by up to 6 dB. These bounds rule out any quantum illumination advantage when the source is strongly amplified, and shows that a relevant gain is possible only in the low photon-number regime. We show how the protocol can be used for covert communication, where the carrier signal is indistinguishable from the thermal noise in the environment. We complement our information-theoretic results with a feasible experimental proposal in a circuit QED platform. This work makes a decisive step toward implementing secure quantum communication concepts in the previously uncharted 1 − 10 GHz frequency range, in the scenario when the disposable power of one party is severely constrained.

I. INTRODUCTION range. For instance, QKD security proofs require level of noises which at room temperature are reachable only by frequencies at least in the Terahertz band [8]. In It is well understood that the application of quan- addition, entanglement can be distributed with mini- tum mechanics to traditional technology-related prob- mal losses, allowing for the implementation of a se- lems may give a new twist to a number of fields. Quan- ries of key long-distance quantum communication ex- tum communication is a potential candidate for over- periments, such as quantum teleportation [9], device- passing its classical counterpart in relevant aspects of independent QKD [10], deterministic QKD [11], super- information-theoretic security. By appropriately encod- dense coding [12], and continuous-variable quantum in- ing the information in the degrees of freedom of quantum formation correction schemes [13–15], among others. The systems, a possible eavesdropping attack can be detected realization of these experiments have been mainly possi- due to the sensitivity of the system to the measurement ble because of large efforts in improving photon-detection process. This simple reasoning has been at the basis of fidelities, single-photon generation, high-rate entangle- defining a number of quantum key distribution (QKD) ment generation, and on-chip fabrication methods [16]. protocols during the first quantum information era, such Despite these advances in optical technology for quantum as BB84 [1], E91 [2] and B92 [3]. The defined protocols communication, low-frequency systems, such as those have been proven to be unconditionally secure provided operating in the microwave or radio wavelengths, have that the transmitting channel has a low noise [4,5]. The still advantages related to easier electronic design. In same level of security would be impossible to reach even addition, microwave signals in the range 100 MHz – in the most sophisticated known classical architectures, 10 GHz belong to the low-opacity window, therefore are which rely on the current impossibility of solving effi- particularly suitable for open-air communication appli- ciently specific problems, such as prime number factor- cations. In fact, one may think as optical fibers as a arXiv:2004.07192v2 [quant-ph] 14 May 2021 ization or finding the solution of systems of multivariate better choice for long-distance communication, due to equations [6]. This means that classical encryption tech- their resilience to environmental dissipation, and mi- niques are not fundamentally secure: information con- crowave systems for short- and medium- distance appli- sidered to be safely stored today is not guaranteed to be cations for the low-cost of their electronics [17]. It is so tomorrow [7]. Quantum communication aims to solve therefore compelling to investigate at the fundamental this long-term security problem at some infrastructure level whether secure open-air communication protocols costs yet to be quantified. are possible at larger wavelengths, with a long-term idea From a theoretical point of view, there is a challenge of reaching a network design integrating quantum and in defining quantum communication protocols which are classical links, with minimal possible changes in the al- secure, efficient and practical at the same time. In ready existing infrastructure. With the advent of cir- this respect, optical systems have been considered for cuit QED (cQED) as a promising platform for quantum decades the main candidates for quantum communica- computation [18], experimental and theoretical research tion, as thermal effects are negligible in this frequency has been focused on understanding the properties of mi- 2

a pre-agreed alphabet. The signal is then transmitted

Eve kTB back to Bob and measured in order to discriminate be- tween the different modulations (see Fig.1). As Alice is Bob performing uniquely passive operations at room temper- Alice ature, she needs only classically available components. If seen from the energy-expenditure perspective, one can think of one- and two-way protocols as having funda- mentally different features in quantum communication. In one-way protocols, Alice (the message transmitter) generates quantum states of some sort, while Bob (the Eve message receiver) has access to some operations typi- cally easy to implement, and a measurement device. Tak- FIG. 1. Sketch of the two-way quantum communica- ing into account that even the simplest of the detection tion protocol. Bob sends a signal to Alice, who embeds the schemes, such as homodyne or heterodyne, requires am- message by phase modulation. The signal is then sent back plifiers and signal generators, a non-negligible energy dis- to Bob, who retrieve the information via a suitable measure- posal for both Alice and Bob is required in order to im- ment. Bob may use quantum correlations in order to increase plement any one-way protocol. Our two-way protocol, in- the signal-to-noise ratio. A passive Eve is able to collect the stead, puts all the challenging technological requirements photons lost in both paths, but she does not have access to at Bob’s side. This feature has recently gained a lot of Bob and Alice labs. interest in the communication engineer community, espe- cially for implementing backscatter communication [44– crowave signals at the quantum level. If cooled down 46]. In fact our protocol is significantly different with re- at 20 mK, thermal effects are suppressed and microwave spect to previous proposals [43, 47–50], since it does not electromagnetic fields with frequency above a few GHz require active control at Alice side. Since Alice’s energy show exemplary quantum effects, such as superposition, requirements are minimized, we envision real-life appli- entanglement and squeezing below vacuum [19]. Lately, cations in ultra-low power RF communications, Internet- we have witnessed several experimental advances, which of-Things, and Near Field Communication (NFC) based can be regarded as milestones for developing microwave technology, among others. While the possibility of using quantum communication, such as improved Josephson this technology has been speculated in the literature, no parametric amplifiers (JPAs) [20, 21], microwave pho- rigorous approach has ever been pursued. One of the goal todetectors [22] and bolometers [23], generation of path- of this paper is indeed to provide a solid theoretical ba- entanglement [19, 24, 25], generation of multi-mode en- sis to the quantum backscatter communication field, to- tangled states [26–28], remote state preparation [29] and gether with a feasible implementation proposal. We dis- quantum teleportation [30–32]. The ability of generat- cuss both the cases when the signal is in a coherent state ing and manipulating microwave radiation in a way that and when it is correlated with an idler. The latter shows reproduces quantum optics experiments allows to extend a gain of up to 6 dB in the signal-to-noise ratio (SNR) the concept of photon as a single-quanta excitation of the with respect to the former one, at some experimental electromagnetic field. The short-term promise in the field cost in the preparation and the detection stages by Bob. is to demonstrate quantum communication and quantum The setup resembles the Gaussian quantum illumination sensing protocols protocols in the microwave regime [33– protocol [39–41], where a weak two-mode squeezed vac- 37], which would then enable real-life applications [38]. uum (TMSV) state is transmitted in a bright environ- Recent theoretical results in noisy quantum sensing and ment in order to detect the presence or absence of a low- metrology show that preserving entanglement in an ex- reflectivity object in a region of space. Unlike radar ap- periment is not a fundamental feature for reaching a plications, for which the quantum illumination paradigm quantum advantage [39, 42], paving the way for the im- is usually employed [33, 37], and where location, velocity plementation of open-air quantum microwave protocols. and cross-section are unknown, our communicating setup This article exploits recent results in quantum commu- can be thought to be applied with static antennas where nication, quantum sensing and cQED in order to intro- all these properties are known and can be engineered. In duce a feasible secure two-way quantum communication the first part of the paper, we derive a general expression protocol in the microwave regime. The protocol com- for the error probability, putting an emphasis on Gaus- bines microwave quantum radar technology with covert sian states and Schr¨odinger’scat (SC) states [51]. We communication. It consists in the secure exchange of in- prove that 6 dB is indeed the maximal gain in the error formation between a classical party (Alice) and a quan- probability exponent reachable by a quantum-correlated tum party (Bob), who pre-share a secret. Bob sends a state over a coherent state receiver. This also settles continuous-variable microwave signal to Alice, which en- the ultimate limits of quantum illumination [52]. We codes her message in the phase modulation according to show that our communication protocol is covert [53–56]. 3

In a covert quantum communication protocol the signal is hidden in the thermal noise unavoidably present in a room-temperature environment, so that Eve’s detection probability collapses. The basic idea is therefore to pro- tect the message content by hiding its existence. This concept has a natural application in low-frequency spec- trum communication. Covertness is achievable only if the generated signal is weak enough, so that cryogenic detec- tion technology is needed at Bob’s side. This concept can be applied in situations when one does not want to ex- pose the metadata about the propagation channel access time and duration. In addition, since covertness works FIG. 2. Setup for the two-way covert quantum com- in the regime where the power of all involved signals is munication through a bright bosonic channel. A signal (k) low, one is allowed to use already licensed frequencies microwave modea ˆS , possibly entangled with an idler mode (k) without compromising the performance of the licensed aˆI , is generated by Bob. The idler mode is stored in the lab, users [44]. In our protocol, we use a one-time-pad cipher while the signal is sent through a noisy channel to Alice, who 0(k) to allow for the covert channel to be measured only by receive the noisy modesa ˆS . Alice modulates the phase of the intended recipients (detectability), and to make the the signal byϕ ˜k = φ + ϕk, where φ and ϕk belong to a pre- agreed discrete alphabet A. Here, φ embeds the information transmitted and reflected signals uncorrelated between to be sent, while e−iϕk is an encoding operator. The value each other and indistinguishable from thermal noise (in- of ϕk is taken uniformly at random in A, and it is known distinguishability). In this way the protocol is also un- only to Alice and Bob. The signal is then scattered back to conditionally secure. We show explicit strategies for how Bob, who decodes it by applying a phase modulation eiϕk . to use entanglement to increase the effective bandwidth, This process is repeated M times (k = 1,...,M), for each i.e. the number of data hiding bits per channel use. In- symbol transmission. Bob performs a measurement on the iϕk (k) (k) deed, we show the square-root-law for our two-way com- modes {e aˆR , aˆI } in order to discriminate between the munication protocol, which states that the number of bits possible values φ. Eve performs a collective measurement on √ the modes {wˆ(k), wˆ(k)} in order to understand whether Alice that can be sent over n channel usages scales as O( n), ← → and Bob are communicating.√ If the average power of the sig- finding explicitly all the multiplicative constants for vari- 2 nal modes is O(η NB / n), then Alice and Bob are able√ to ous transmitters and receivers. In addition, we design an use covertly n channel modes. This allows to transmit O( n) entanglement-assisted protocol based on SC states in a number of bits in a secure way. In the 1−10 GHz band, Bob’s circuit QED (cQED) setup, which relies solely on Jaynes- signals are generated at 20 mK in order to suppress the ther- Cumming interactions and qubit measurements. This is mal contribution and comply with the covertness conditions. an important requirement for a circuit QED implemen- tation, since a receiver based on photon-detection is cur- rently too demanding to be realistic. This shows the path II. THE SETUP for future experimental investigation of our concept. The two-way communication protocol is depicted in Fig.2. Alice and Bob use n = mM modes of the bosonic channel simultaneously in order to communicate m symbols. They use M modes to transmit a symbol φ taken from a discrete alphabet A. We refer to each The article is organized in the following way. In Sec- these M channel usages as a slot. In each slot, Bob gen- tionII, we describe our communicating setup. In Sec- erates M independent and identically distributed (i.i.d) (k) tionIII, we provide the ultimate bounds on the receiver signal modes {aˆS } (k = 1,...,M) with NS > 0 aver- performance for both local and collective strategies. In age number of photons, and he sends the modes to Alice. SectionIV, we focus on the cases of Gaussian and SC The signal modes are possibly entangled with M idler (k) states, providing an explicit expression for the Chernoff modes {aˆI }, which are retained in the lab by Bob for bound in the corresponding channel discrimination prob- the measurement stage. The signals are generated at a lem. In SectionV, we discuss the conditions on the av- low enough temperature to consider the signal-idler (SI) erage transmitting power in order to have a covert sys- state as pure. Although the results of this article are tem, together with a proof of the square-root law for general, we emphasize the application in the microwave our two-way setup for the discussed transmitters and re- spectrum, specifically in the range of operating frequen- ceivers. We also discuss the key-expansion and synchro- cies of a cQED setup, i.e. 1-10 GHz. In this range of nization protocols. In SectionVI, we discuss a cQED pro- frequencies, T ' 20 mK is required to avoid thermal tocol based on SC states, with a receiver design based on fluctuations. We refer to the idler-free case when the Jaynes-Cumming interactions and qubit measurements. idler is absent, or, equivalently, when the signal and the 4 idler are uncorrelated. The signal modes are sent to Al- The setup can be mapped to quantum illumina- ice through a room-temperature channel (TB = 300 K), tion [39], also referred to On-Off-Keying (OOK), where which is modeled as a beamsplitter. Alice receives the Alice modulates the amplitude of the signal. In fact, 0(k) BPSK and OOK share the same optimal strategies in modes {aˆS }, with the η  1 limit (see Lemma A1 of the Appendix). In 0(k) √ (k) p ˆ(k) aˆS = η aˆS + 1 − η h← . (1) addition, BPSK performs better than OOK for given transmitting power, as the distance of the symbols in Here, η is the power transmitting rate of the channel the phase-space is larger. A similar setup has been stud- and {hˆ(k)} are independent thermal modes with N ← B ied in the optical domain [50]. Here, a phase-insensitive average number of photons. The numerical value of amplification by Alice is required in order to add thermal N depends on the signal operating frequency ω as B k noise and ensure security with respect to a passive Eve. N = (eβ~ωk − 1)−1 with β = (k T )−1, k being the B B B B In the low-frequency spectrum, the thermal noise is nat- Boltzmann constant. In the 1 − 10 GHz spectrum this urally present in the environment, so that no amplifica- results to values of the order N ∼ 103, therefore we B tion is needed and covertness can be ensured. Instead, in will emphasize the NB  1 case. Alice modulates the 0(k) Ref. [57], the authors discuss the advantage of using pre- phase ofa ˆS byϕ ˜k = φ + ϕk, with φ, ϕk ∈ A, generat- shared entanglement between Alice and Bob for commu- −iϕ˜k 0(k) ing the mode e aˆS . She then sends the signal back nication in noisy environment, finding that the number to Bob through the same channel. Here, φ embeds the of covert bits that can be sent increases by a logarithmic symbol to be transmitted, while the phase-shift e−iϕk is factor with respect to the unentangled case. Although an encoding operation that Alice and Bob have secretly their setup falls in the one-way scenario, these results pre-shared. In other words, Alice and Bob uses a one- suggest that using quantum correlations may come with time-pad protocol to encode the symbol φ. Bob receives a logarithmic overhead in the capacity also in our case. (k) the modes {aˆR }, with √ (k) −iϕ˜k 0(k) p ˆ(k) aˆR = η e aˆS + 1 − η h→ , (2) ˆ(k) Here, {h→ } are M independent thermal modes identical III. OPTIMAL RECEIVER PERFORMANCE ˆ(k) ˆ(k) to {h← }. We also assume that the modes {h← } and ˆ(k) {h→ } are independent. Bob applies the decoding trans- (k) In this section, we find the ultimate bounds on the formation eiϕk to the received modea ˆ . He then applies R receiver performance for the protocol described in Fig.2. iϕk (k) (k) a discrimination strategy to the modes {e aˆR , aˆI } for These results hold for SI systems in any quantum state. distinguishing between the different symbols in A. We set the encoding operation to the identity, i.e. we fix For a given symbol transmission φ, we denote with ρ η,φ ϕk = 0. This is possible because both Alice and Bob have the density matrix of Bob’s state at the receiver, i.e. the a pre-shared knowledge of ϕ , therefore this operation (k) (k) k state of the system defined by the modesa ˆR anda ˆI . can be reversed by Bob. In the BPSK case, where the φ ∈ As we are working in the i.i.d. assumption, ρη,φ does not {0, π}, our aim is to minimize the total error probability depend on k. In the following, we work under the η  1 assumption, corresponding to a very lossy thermal prop- 1 agation channel. This is the case of non-directional an- perr = [Pr (φ = π|φ = 0) + Pr (φ = 0|φ = π)] , (3) tenna and/or unfavorable weather conditions. However, 2 the theory can be extended to finite values of η as well. The number M has to be chosen to be large enough in where Pr (φ = a|φ = b) is the probability of detecting a order to give Bob the chance of discriminating between phase φ = a given that Alice has transmitted the symbol the possible phases in A with high confidence. The mea- φ = b. The main strategies to achieve this can be classi- surement discriminating between the symbols depends on fied in (i) collective, where the M modes are allowed to the adopted SI system. We consider mainly the Binary- be measured together, and (ii) local, where the copies are Phase-Shift-Keying (BPSK) alphabet, when A = {0, π}. measured separately, allowing classical communication However, we will discuss how the results in this article between the measurements on the different copies. We can be extended to more complex alphabets. Different consider the performance of a coherent state transmitter figures of merit can be used to quantify the performance as reference for the correlated cases. In other contexts, of the optimal strategies to discriminate between the dis- such as in quantum illumination, coherent states trans- tinct modulations, depending on their a priori probabili- mitters are usually used as a classical reference. This ties. Here, we discuss the case where all the modulations choice is done mainly for two reasons: 1) they achieve in the key have the same a priori probability of being the optimal error probability in the idler-free case and realized, which is the most natural scenario for quantum 2) they describe faithfully coherent signals that can be communication. generated with classical technology. 5

(a) (b) βcol, where the protocol based on quantum correlations will present the maximal advantage with respect to an uncorrelated input state with the same power. In addi- tion, we will see that unconditional security by means of covertness can be ensured in this regime. In the follow- ing, for simplicity, we will refer to βcol as the quantum Chernoff bound (QCB). However, we stress that in the literature the QCB is generally referred as βη. Let us col col denote as βfree the value of β if the input is idler-free, i.e. when the signal and the idler are uncorrelated. The following result define the optimal receiver performances. Theorem 1. [Ultimate receiver-EP bound] FIG. 3. Performance of the quantum correlated pro- The following bounds holds for the receiver performance tocol with respect to the idler-free case. (a) Maximal achievable gain of the Chernoff bound of the quantum cor- with collective strategies: col related case (denoted as βmax) with respect to the idler-free  1  col col 4NS 1 NS + 2 case (βcl ), depending on the average number of thermal pho- β ≤ min , √ , (5) tons in the environment NB . For instance, for NB = 1, the 1 + NB cB 1 + NB maximal gain is about 4.6 dB and it is reached in the NS  1 4 N βcol ≤ S ≡ βcol, (6) limit. (b) Comparison of the optimal receiver performance free √
2 1 + N cl for Gaussian states and Schr¨odinger’s cat states with respect 1 + cB B to the idler-free case, in the NB  1 limit. The performance NB where cB = . The idler-free case bound is saturated is quantified in terms of the error probability decaying expo- 1+NB col col col nent. Indeed, the quantities gTMSV,SC = βTMSV,SC/βcl and by coherent state signals. loc loc loc gTMSV,SC = βTMSV,SC/βcl are plotted for NB  1. The This is in agreement with the result of the stan- graphics shows how the advantage in using quantum correla- tions decays with the transmitting power N . Gaussian states dard quantum illumination protocol. We notice that S col perform better than Schr¨odinger’scat states for finite NS . βcl ' NS/NB in the NB  1 limit. The general bound in Theorem1 is tight for NS  1 and for NS,NB  1. By a direct comparison, we see that the optimal achiev- A. Collective strategies able gain with respect to the idler-free case is 6 dB, and the maximal advantage can be achieved when NB  1 The quantum Chernoff bound [58–60] provides an up- and NS  1. This result can be understood by noticing per bound on the achievable error probability (EP) in the that in the low signal-photon regime the protocol can be binary detection problem. Indeed, we have that perr ≤ approximated by Gaussian quantum illumination, where 1 −βη M s 1−s 2 e , where βη = − mins∈(0,1) log Tr (ρη,0ρη,π ). This the detection problem can be mapped to discriminating bound is tight for M  1, and its exponent βη can be between two coherent states with amplitude proportional used as figure of merit for quantifying the performance to the two-mode correlations at the receiver level [63]. of the optimal discrimination protocol. Generally, one Here, the Kennedy receiver is optimal, and it shows a needs a collective measurement over all the M modes in 6 dB advantage with respect to the idler-free case. No order to saturate this bound. There are few exceptions advantage can be detected in a vacuum environment to this statement, for instance, when either one of ρη,0 or (NB  1), which is the case of the optical systems. ρη,π is close enough to a pure state [58], or for coherent Interestingly, our bounds show that even in the NB  1 state illumination in a bright environment. In the fol- limit the gain decreases with increasing number of lowing, we focus on computing analytically βη up to the signal photons NS, achieving the same performance of first relevant order in η, using a metric-based approach. a coherent state transmitter in the NS  1 limit. This Since the expansion of βη to the first order of η is zero also means that amplifying the source is not a possible (Lemma A2 of the Appendix), we can define the figure to implement a quantum illumination protocol, ruling of merit for collective strategies as out any gain claimed in a recent experiment [36]. The setup in Fig.2 is particularly relevant for studying β βcol ≡ lim η . (4) entanglement-assisted low-frequency communication in η→0 η2 very noisy environment. However, one must note that This metric provides us a framework for conducting com- the advantage of using quantum correlations is kept parative analysis between different transmitters. In ad- when the environment is not bright, see Fig. 3a. For dition, the found relations can be analytically computed, instance, a 4.6 dB maximal advantage can be achieved providing an insight on the scaling of the performance for NB ' 1, implying that the advantage in using with respect to the system parameters. We are partic- quantum correlations is not limited to the NB  1 case. ularly interested in the NS  1 and NB  1 limits of 6

B. Quantum estimation strategies Similarly to the case of collective strategies, we will adopt the exponent of the EP to the first relevant order An approach based on the quantum estimation of the in η as figure of merit, i.e. βloc ≡ F/2. Let us denote loc loc amplitude modulation has been developed in Ref. [61] in with βfree the value of β in the idler-free case. We have the quantum illumination context. This is less exper- the following bounds on the achievable EP decaying rate imentally demanding than the collective strategy, as it using quantum estimation methods. does not require the interaction between the M copies of Theorem 2. [Ultimate QFI bound] the received signal. However, it comes at some loss in the The following bounds holds for the receiver performance error exponent of the EP, quantified as at least 3 dB with with local strategies: respect to the optimal collective strategy. Here, we use the same concept in order to deal with the BPSK case.  1  2N 1 NS + We address this approach as local strategy, as opposite of βloc ≤ min S , √ 2 , (9) the collective strategies previously discussed. First, we 1 + NB cB 1 + NB (k) notice that the received modes {aˆ } can be expressed loc 2 NS loc R βfree ≤ ≡ βcl , (10) as 1 + cB 1 + NB

(k) −iφ (k) p (k) NB aˆ = η e aˆ + 1 − η2 hˆ , (7) where cB = . The idler-free case is saturated by R S 1+NB coherent state signals, in which case the optimal detector q ˆ(k) q η −iφˆ(k) 1 ˆ(k) is homodyne. where h ≡ 1+η e h← + 1+η h→ are thermal modes with NB average number of photons. We can Similarly to Theorem1, the bound in Theorem2 is thus optimally estimate the parameter κ ≡ η e−iφ ∈ , R tight for NS  1 and for NS,NB  1. It follows that obtaining a value κest, and deciding towards the hypoth- the maximal advantage with respect to the classical case esis [φ = 0] if κest > 0 or the hypothesis [φ = π] if is 3 dB in the EP exponent if we adopt a threshold dis- κest < 0. We refer to this strategy as “threshold discrim- crimination strategy. Theorem2 also implies that the ination strategy”. The main figure of merit quantify- optimal detector in the classical case can be implemented ing the quantum estimation performance is the quantum with local measurements in the NB & 2 regime, as in this Fisher information (QFI), defined as [62] loc col case βcl ' βcl . However, this is not anymore valid in 2 the NB 1 regime, where collective measurements start X |hφm|dρ|φni| . F = , (8) to perform better, achieving βcol ' 2βloc in the N  1 λ + λ cl cl B mn m n limit. where dρ = (∂κρκ)|κ=0, with ρκ ≡ ρη.φ, and λm is the eigenvalue of ρ0 corresponding to the eigenstate |φmi. This is due to the Cramer-Rao bound, which asserts the IV. TRANSMITTER EXAMPLES limit of the achievable precision of an unbiased estimator κˆ: ∆ˆκ2 ≥ 1/MF . An estimator saturating the Cramer- The aim of this section is to discuss two topical trans- Rao bound is given by the mean over the M single- mitter examples whose optimal receiver saturates the ul- copy measurements of the observable Oˆ = L/Fˆ , where timate bounds in the correlated case. For these states, we col loc P hφm|dρ|φni have derived explicit formulas of β and β , showing Oˆ = |φmihφn| is the symmetric logarith- mn λm+λn mic derivative computed at κ = 0. Due to the central how they scale with respect to the system parameters. limit theorem, the EP for the threshold discrimination We also show a time-bandwidth estimation for a typical p 1 −η2FM/2 communication scenario. strategy is perr ' 1 − erf (η FM/2) ≤ 2 e for M  1. The previous discussion holds whenever one has an a priori knowledge of the neighborhood where κ be- longs to (in our case κ  1). If no assumptions of this A. Two-mode squeezed vacuum state transmitter sort can be made, generally the optimal strategy con- sists of a two-stage adaptive protocol: use M 1/δ (with TMSV states are defined as

δ > 1) copies to estimate the neighborhood and then use ∞ s X N n the rest of the copies to optimal estimate the parame- |ψi = S |ni |ni , (11) TMSV (1 + N )1+n I S ter. This provides the same asymptotic performance as n=0 S when the information on the neighborhood is provided. ∞ The same adaptive protocol can be used to generalize the where {|ni}n=0 is the Fock basis. They have been thor- ideas of this article to more complex alphabets, by first oughly studied in the context of QI because they are a having a rough estimation of the phase φ, and then ro- good benchmark to show a quantum advantage and be- tate the system in order to maximize the classical Fisher cause they are experimentally easy to generate, regard- information [57]. less of the frequency regime. The performance for the 7 optimal receiver of a TMSV state transmitter are given by 1 |ψiSC = √ [|+iI |αiS + |−iI | − αiS] , (14) 2 col 4 NS βTMSV = √ 2 (12) 1
1 + NB where |±i = √ (|gi ± |ei) are eigenstates of the Pauli 1 + cScB 2 operatorσ ˆ , |αi is a coherent state with amplitude α > loc 2 NS x β = , (13) 2 TMSV 0 (NS = |α| ), assumed to be real for simplicity. Of 1 + cScB 1 + NB particular interest will be the case of |α|  1, that shows

NS NB the maximal advantage with respect to the classical case. where cS = and cB = (see AppendixA). The 1+NS 1+NB This state can be written in the Schmidt decomposition optimal receiver for a threshold discrimination strategy † † as consists in measuring in the eigenbasis ofa ˆI aˆR +a ˆI aˆR. It is clear that TMSV states saturate the bound of Theo- p p |ψiSC = λ+|gi|α+i + λ−|ei|α−i, (15) rem1 in the NS  1 limit. In addition, the advantage of 1 −2NS √1 using the optimal detector for TMSV states decays slowly where λ± = 2 (1±e ) and |α±i = [|αi±|−αi]. 2 λ± with increasing NS, making the protocol useful also for The performance of the optimal receiver for a SC-state finite number of signal photons. The detectors achiev- transmitter are given by ing the maximal gain are known for both the collective (only for NS  1 [63]) and the local (for any NS [64]) col col NS βSC = fSC (NS,NB) , (16) cases. Generally, they involve efficient photon-counting 1 + NB devices, which are yet to be developed in the microwave loc loc NS regime. A possible solution is the use optomechanical βSC = fSC (NS,NB) , (17) 1 + NB transducers into optical frequencies, where sensitive de- tectors are available [33]. However, current optomechan- where ical transducers are still in infancy, as they suffer from col NB 1 p low efficiencies and high thermal added noise. A differ- fSC = 4 − 8 NS + O(NS) (18) ent solution is to use a qubit as single-photon detector. loc NB 1 2 fSC = 2 − 4NS + O(NS). (19) This approach has the advantage of seamless integration with cQED platforms, as dispersive qubit measurements The optimal threshold discrimination strategy in the can be implemented already in the lab [65, 66]. However, NB  1 regime consists in measuring in the eigenbasis of ˆ − † single-photon detection devices so far have achieved only the observable Oopt =σ ˆ [λ+aˆR + λ−aˆR] + c.c.. The ex- col loc a 70 % fidelity [67], making this approach currently un- act expressions of fSC and fSC are given in AppendixA. suitable for practical applications. On a different note, A comparison with the TMSV state case is shown in the idler storage must be carefully considered in order to Fig. 3b. As expected, the maximal gain can be achieved understand how quantum correlations can be useful in for NS  1. In addition, the gain decays exponentially † practice. In cQED, memory elements based on a coaxial with increasing NS. In fact, the observableσ ˆx(ˆaR +a ˆR) λ/4 resonator with coherence time of nearly 1 ms have is optimal for NS & 1, therefore the classical mixed state 1 been demonstrated [68]. This corresponds to 300 Km of 2 [|+iI h+| ⊗ |αiShα| + |−iI h−| ⊗ | − αiSh−α|] performs free-space propagation of light. Another promising alter- the same as |ψiSC in this regime. This loss of gain for native consists in transferring the idler bosonic degrees finite NS can be mitigated by considering states with 1 Pd−1 of freedom to the delay line based on surface acoustic larger Schmidt rank, i.e. √ |wkiI |αkiS, where √ d k=0 waves [69, 70]. i 2πk αk = NSe d and the idler is a d-level system with hwk|wk0 i = δk,k0 [61]. This state can be implemented by letting several transmon qubits interacting with the same resonator. However, in this case the optimal de- B. Schr¨odinger’scat state transmitter tector is complicated and we will not consider it in the implementation discussion. We now discuss the performance of the protocol based on SC states, created by the interaction of a qubit with a continuous-variable signal. It comes as no surprise that C. Time-bandwidth estimation SC states show the same advantage of Gaussian states for NS  1, because in this limit the two states approximate If we consider a microwave implementation, where 3 each other. However, the underlying physics is different. NB ' 10 for T = 300 K at 5 GHz, we need a time- βcl NB In fact, the SC scheme relies on qubit measurements, and bandwidth product M ' 2 log(1/perr) to reach βTMSV η NS provides us naturally with a digital way to store the idler an error probability of perr. If we assume propagation in in a cQED setup. free space at ambient condition, where power losses are 8 around l ' 0.01 dB/Km for the considered spectrum, nication between Alice and Bob is happening. and an antenna area of 0.1 m2 for R ' 1 m space prop- −Rl/10 AR −2 Definition 1. [Covertness criteria] A communicat- agation, this gives us η = 10 2 ' 10 [17, 71]. 4πR ing system is δ-covert over n channel usages if Eve’s EP If we choose NS ' 0.01 average number of photons per mode, where TMSV states show a close to optimal gain in discerning between the equally likely hypothesis of com- (Eve) 1 with respect to the classical protocol, then we require a munication happening or not-happening is P ≥ 2 −δ 9 βcl for n large enough. time-bandwidth product of M ' 10 log(1/perr). βTMSV The error probability is chosen depending on the cir- Ideally, we would like to have δ as smaller as possible cumstance. In a communication scenario, one needs to by still being able to communicate a finite number of bits. perform error correction where in practice error proba- Generally, covert communication is possible because Eve bilities of the order of 10−2 are needed. This gives us a does not have control at least to a part of the environ- time bandwidth product of the order of M ∼ 109. This mental channel [53]. This assumption is not radical, as number can be considerably lowered by using directional in the low-frequency regime at room temperature there is antennas. These are made typically as phased arrays, an unavoidable noise dictated by the laws of physics. We comprising tens or hundreds of small elements with a assume that Bob’s and Alice’s places, where the state ma- phase difference between them. This phase difference is nipulation and the measurements are implemented, are chosen such that the radiated field is maximum, due to sealed, and that the signals are sent directly to a room constructive interference, along the desired direction. [72] temperature environment where Eve may be placed. We Assuming that an effective way of measuring the power also assume, for simplicity, that the part of the channel of large bandwidth signals with few-photons sensitivity that Eve cannot control does not change while commu- is available, then a Gaussian state protocol is arguably nication is in progress. The latter assumption can be re- the best option for implementing the ideas presented this laxed by analyzing more general fading communication article. In fact, the ability of generating large bandwidth channel models, where the amplitude losses and/or the Gaussian signals would reduce the time complexity of signal phases are random variables [73]. In addition, we the protocol. Even though at the present stage Gaussian provide Alice with the capability of implementing truly states remains the main solution for sensing and metrol- random phase modulations on her signal on the alpha- ogy in noisy regime, SC states provides a way to avoid bet A. This is an important requirement for ensuring photon-detection. covertness in the two-way setup. Alice and Bob use n = mM modes of the bosonic V. COVERT QUANTUM COMMUNICATION channel simultaneously. They use M modes to transmit a symbol taken from a discrete alphabet A. In addition, they use a publicly available codebook C that mapsm ¯ - We now discuss the possibility of performing secure bit input blocks to m-symbol codewords from Am, with quantum communication using the setup depicted in m¯ < m, by generating 2m¯ codeword sequences, i.e. C = Fig.2, by exploiting recent results about covert quan- m¯ {a ∈ Am}2 . The codebook is built in the way that tum communication [53, 54, 56]. The basic idea is to k k=1 the codewords, when the transmission is corrupted by the protect the content of the message to be transmitted by channel, are distinguishable from each other with high covering the existence of the carrier in a given bandwidth probability. This induces a natural way of defining when and temporal frame. In this context, Eve’s main task be- communication is reliable. comes to understand whether a message is being trans- mitted or not through the channel. Here, we provide Definition 2. [Reliability criteria] A communicat- bounds for Eve’s detection probability depending on the ing protocol is -reliable if the decoding error probability receiver performance. The results of this section holds averaged over the codebook is bounded by , i.e. when for states which well approximates Gaussian states in 1 P P P (a |a ) ≤  for n large enough. √ |C| ak∈C aj ∈C\{ak} j k the NS  1 limit. We prove thatm ¯ = O( n) num- ber of bits securely transmittable over n channel usages We focus primarily to the BPSK case, corresponding with an arbitrary small EP. We also show how quantum to A = {0, π}, keeping in mind that the concept can be correlations can increase the bit transmission rate by a generalised to more complex constellations. Each symbol constant factor, which depends on the adopted strategy transmission is done by performing the two-way protocol (i.e. collective or local). described in Fig.2. We define the on-setting, correspond- ing to the case when the communication is happening, and the off -setting, when no information is exchanged A. Square-root law between Alice and Bob. In other words, we consider the on-setting when Alice and Bob applies the protocol with A natural way of defining covertness consists in bound- NS > 0, while the off -setting is when NS = 0. We con- ing from below the probability of detecting that commu- sider a passive eavesdropper, able to catch all the modes 9 that are lost in the Bob-Alice path, denoted with the Bob Alice ← subscript, and Alice-Bob path, denoted with the → subscript. In the following we will consider the worst- on setting case scenario, where Eve gets all the lost photons in the e i e i environment, since the case of Eve with limited capabili- ties can be similarly derived. Using directional antennas off setting would decrease the photons received by Eve in the worst- case scenario, improving the covert bit transmission rate. For a given slot, Eve gets the modes t (k) p (k) √ ˆ(k) wˆ← = − 1 − η aˆS + η h← (20) FIG. 4. Probabilistic version of the two-way covert p 0(k) √ wˆ(k) = − 1 − η e−iϕ˜k aˆ + η hˆ(k), (21) quantum communication protocol. Alice and Bob se- → S → cretly choose to communicate only in the fraction of the tem- for k = 1,...,M. Here, {N > 0, ϕ˜ = ϕ + φ} defines poral and frequency modes at their disposal. In the on-setting S k k (green dots), Alice performs a phase modulation e−i(φ+ϕ), the on-setting, while {NS = 0, ϕ˜k = ϕk} is the off - where φ ∈ A is the symbol that Alice wants to transmit and setting. The goal is to let the on and the off settings the ϕ is taken uniformly at random in A. The phase ϕ is secretly least distinguishable possible. This is possible only in the known to both Alice and Bob. In the off -setting (red dots), −iϕ NS  1 limit, as in this case Eve’s mode in both settings Alice performs a phase modulation e , where ϕ is taken approximate each other. This is due to the fact that uniformly at random in A Here, φ is generated in situ and it is not shared by Alice. both ϕk + φ and ϕk are distributed uniformly at random in the alphabet A. The inclusion of the random sequence of phase-shifts by Alice is a crucial requirement for the 1 P7 covertness proof, as otherwise Eve would have enough coherent state, then ρS = 8 k=0 |αkihαk| respects the resources to uncover the communication by detecting the conditions of Lemma1 with c = 1/2. Bob’s phase modu- (k) lation at the transmission can be reversed at the receiver phase φ in a given slot, by let interfere the modesw ˆ← (k) level due to the linearity of the communicating channel. andw ˆ→ . However, she can still detect if communication is happening by detecting the changes in power of each We also notice that a Gaussian thermal state at Bob’s (k) side is not needed in order to ensure covertness, meaning path, and their correlations. As all thea ˆS are i.i.d., Eve’s quantum state does not depend on k and on which that complex Gaussian modulations of Bob’s signal are symbol is being transmitted. not needed. We can rely instead on discrete phase mod- ulations, which are experimentally easier to generate and Lemma 1. [Covertness: achievability and con- they require less memory complexity. verse bounds] Let NS > 0 be the average number of We have provided an upper bound on the average √ −1 signal photons in the on-setting. Let the signal density transmitting power NS, which needs to scale as O( n) P∞ j matrix be ρS = j=0 NSσj, where in order to keep the communication covert over n channel usages. Typical transmitter operates at constant pho- σ = |0ih0| (22) 0 ton number per mode, and√ the requirement of NS de- σ1 = |1ih1| − |0ih0| (23) caying with the inverse of n can be quite restrictive. This constraint can be relaxed by defining a probabilis- σ2 = c(|2ih2| − 2|1ih1| + |0ih0|), (24) tic version of the protocol, which makes use only of a δ with 0 ≤ c ≤ 1. Then, the communication between Al- fraction τ ≤ Aη,N √ of the n available modes in the B NS n ice and Bob is δ-covert over n channel√ usages, provided on-setting [56], see Fig.4. In each of these modes, the 4 η2N (1+η2N ) √δ B B transmitting power NS is kept constant and small. that NS ≤ Aη,NB , with Aη,NB = (1−η2) . In n Lemma1, together with a random-coding argument, addition, no constant better than Aη,N can be found. B implies that the square-root-law is achievable by our two- Here, we learn that the correlations between the two way setup. paths are not useful for Eve to detect the presence of the transmitted signal, provided that random modulations Theorem 3. [Square-root law: two-way setup] Let of the signal are applied at Alice. Notice that the con- Alice and Bob share a publicly available codebook√ and stant Aη,NB is the same as in the one-way covert protocol a secret random sequence of length n [O( n log n) in 2 with the change η → η [53], which is due to the double the probabilistic√ version]. Then, they can communicate path transmission. Lemma1 can be directly applied to m¯ = βdetβcovδ n + log2  bits over n channel usages by a TMSV state transmitter, which corresponds to c = 1. keeping the system δ-covert and the communication - 8 4 It can be also applied to coherent state and SC state reliable. Here, βcov = π log 2 cBη provided that the trans- transmitters, if we allow Bob to perform random phase mitted signal satisfies the assumptions of Lemma 1, and −ikπ/4 modulations. In fact, let |αki with α = |α|e be a βdet is a constant that depends on the detector: βdet ≤ 4 10

(βdet ≤ 2) for the TMSV state and SC state transmit- gorithm have outputs that are exponentially larger than ters with a collective (local) receiver, and βdet = 1 for their seeds while still retaining computational indistin- the coherent state transmitter with a homodyne receiver. guishability from true randomness [76]. The security of the protocol defined by a key expansion step based on This result comes from a compromise between the pseudo-random functions followed by a one-time-pad en- transmission rate needed to keep the communication coding is not unconditionally secure. Its security relies on √ −1 covert, quantified as NS = O( n) in Lemma1, and the computational assumption that hacking the pseudo- the ability of performing error correction on a random random function is hard in a way. However, covertness code, whose error probability decreases exponentially√ adds a new layer of security, since the transmission is with the total transmitted power nNS = O( n). In this also protected from the limited Eve’s detection capabil- way, the error probability√ P in transmittingm ¯ bits is ity and the bandwidth spreading. Indeed, let us consider log P ∼ m¯ − O( n), which implies the square-root scal- the probabilistic version of the protocol, where only a ing. In Theorem3, all the constants have been explicitly small fraction τ of the modes is used to communicate. derived for different transmitters and receivers for the Since Alice applies to the remaining modes truly random two-way protocol. phase modulations generated in situ, the randomness of the transmitted string can be controlled with τ. One may think a similar protocol in the one-way case, by gener- B. Key expansion and synchronization ating meaningless signals in the off-setting. However, generally the covertness criteria is whether a signal is be- Summarizing, Alice and Bob need to agree secretly on ing transmitted or not rather than if Alice and Bob are the following information prior the communication for transmitting anything meaningful or not. This is because each n channels in the on-setting: (i) A secret random there are relevant scenario when the transmitter must in- sequence corresponding to the random phase-shifts by deed be switched off [77]. Our two-way protocol, instead, uses passive operations to embed the information, which Alice. This information√ requires O(n) bits of pre-shared knowledge, or O( n) in the probabilistic version. (ii) In allows to generate meaningless messages when the trans- the probabilistic version, the information needed to spec- mitter is switched off. To establish covert communication, Alice and Bob re- ify the modes√ which are used in the on-setting. This re- quires O( n log n) bits of shared secret. Moreover, Alice quire a pre-established secret, in this case the knowledge and Bob need to agree on which temporal frame to turn of the phases ϕk in the on-setting and the instances when the communication on, which requires additional O(N), communication is happening. This in turn requires them ∆T ∆Ω to have very accurate synchronization so that time tags where N = n is the number of temporal frames in a time interval ∆T assuming an operational bandwidth of signals are properly assigned. The simplest solution ∆Ω. Assuming N = C(n), with C(n) > n, eventually for synchronization is that Alice and Bob are both syn-  C(n)  we will need a key of at least ω √ bits of pre-shared chronized to the same clock. Sub nano-second level clock n accuracy is possible using IEEE 1588 high accuracy de-  C(n)  √ secret to transmit O n covert bits. It is then clear fault profile [78], but that requires physical cabling be- that there is an overhead of number of pre-shared bits tween the master clock and the communicating party. with respect to the transmitted ones, if we want to en- High accuracy wireless synchronization is possible using sure covertness. Therefore, Alice and Bob need to meet General Global Navigate Satellite System (GNSS) [79]. regularly in order to agree on a key. These meetings can Since our scheme requires continuous synchronization be- be implemented via public communication through an tween Alice and Bob in both the cases of communication authenticated channel. In this case, the key generation switched on and off, this step does not need to be imple- and expansion steps can be done covertly and secretly mented covertly. with a protocol based on likelihood encoder techniques, assuming that the public channel is classical [74, 75]. Once Alice and Bob share the key, we have shown that VI. CIRCUIT QED IMPLEMENTATION using the Vernam cypher allows for covert and uncon- ditionally secure communication. If instead the parties The ideas introduced in this paper can be easily im- are not allowed to publicly communicate at any point, plemented using coherent states properly modulated, as but they still do pre-share a secret key, one can expand described in the previous section, and heterodyne mea- the key using a pseudo-random generating function. In- surement. While this scheme does not achieve any of the deed, if Alice and Bob pre-share a pseudo-random gen- ultimate bounds for the receiver, it is the most practical erating function f : {0, 1}l → {0, 1}p(l), where l ∈ N and way of realizing the protocol. If one is allowed to imple- l = o(p(l)) for l  1, then it is possible to communicate ment certain entangling operations at the transmitting more bits than the pre-shared ones. Widely used Ad- and receiver level, then larger key rates are achievable. vanced Encryption Standard and the Secure Hashing Al- In this context, optimal schemes for the Gaussian state 11 receiver have been thoroughly studied in the literature. Instead, a receiver for the SC state transmitter is still missing. In this section, we fill this gap by introducing an implementation in a circuit QED setup of a transmitter and a receiver based on SC states. We show that Jaynes- Cumming (JC) operations and qubit measurements are enough to fully implement the protocol. This comes with a great advantage with respect to the Gaussian state re- ceiver, which requires photo-detectors. We also provide an analysis of how the decoherence affects the protocol FIG. 5. Scheme for the preparation of the Schr¨odinger’scat based on quantum correlations. The discussion will be state. A resonator with central frequency ωr is driven with a mostly at the model level. However, it is noteworthy to coherent signal, displacing the state of the cavity to | − iαi. observe that all the operations described in the follow- A transmon qubit with frequency ωq is initialized in a state |ei+|gi |+i = √ . A conditional phase shift is then applied. This ing have been proved in cQED since fifteen years, with 2 increasing enhancements of fidelity for the gate imple- is implemented by letting the resonator and qubit interact mentation and state storage. in the strong dispersive regime for a time tχ = π/2χ, where χ = g2/∆ is the effective coupling. Here, g is the coupling strength of the qubit-resonator system, ∆ = ωr − ωq and A. State preparation g/∆  1. Finally, a π/2σ ˆy-pulse is applied to the qubit. Feasible parameters are ωr = 5 GHz, ωq = ωr + ∆ with ∆ = 20 Mhz, and g = 100 Khz. The SC state defined in Eq. (14) can be prepared in a circuit QED setup as described in the following. Consider the JC Hamiltonian Step 2: Let the qubit and the resonator interact for π (ω ,ω ) a time t = . This results in a conditional Hˆ = Hˆ r q + Hˆ g , (25) χ 2χ 0 JC phase shift on the cavity state by the operator † † ˆ (ωr ,ωq ) † ~ωq |gihg| ⊗ exp(iπaˆ a/ˆ 2) + |eihe| ⊗ exp(−iπaˆ a/ˆ 2), Its where H0 = ~ωraˆ aˆ + 2 σˆz, withσ ˆz = |eihe| − ˆ g + − † action on the state prepared in Step 1 can be un- |gihg|, and HJC = ~g(ˆσ aˆ +σ ˆ aˆ ). Here, ωr and ωq are the frequency of the resonator and the qubit re- derstood as a uniform counterclockwise rotation spectively, and g is the coupling between these two sys- by an angle π/2 of the coherent state, followed tems. We also define the detuning ∆ = ω − ω and by the application of the photon parity operator r q exp(−iπaˆ†aˆ) if the qubit is excited. The state after Γ = max{κ, 1/T1, 1/T2}, where κ is the cavity decay this step is √1 [|gi|αi + |ei| − αi]. rate, and T1 and T2 are the qubit decaying and dephas- 2 ing times respectively (see AppendixD). In the dispersive Step 3: Apply a π/2σ ˆ -pulse to the qubit. The state regime, where ∆  g, one can apply perturbation the- y after this step is √1 [|+i|αi + |−i| − αi]. ory to the first order of the parameter g/∆, finding the 2 effective Hamiltonian In order to implement Step 1 and Step 3 we would ˆ ˆ (ωr ,ωq +χ) † need to decouple the qubit and the resonator: this can HSDR = H0 + ~χσˆzaˆ a,ˆ (26) be achieved either by a tunable coupler or by further 2 where χ = g /∆ [80]. We assume that χ  Γ, which is detuning the qubit. Also we have considered here the known as the strong-dispersive regime (SDR). In this way, ideal situation when all the operations can be realized any losses of the bosonic mode and the qubit are negli- with high fidelity, which is a good approximation in the gible during the implementation of the gate, as long as strong regime [82]. The main remaining source of errors the operating time will be sufficiently short. The prepa- is due to the spurious thermal contribution present in ration protocol is based on the fact that the Hamiltonian the cryogenic environment prior to the preparation stage. ˆ HSDR is a conditional phase-shift on the resonator, with This will be the object of a later on discussion. the qubit acting as the control. To put this easier in evidence, we will work in a rotating frame defined by ˆ (ωr ,ωq +χ) the free Hamiltonian H0 . The Hamiltonian in B. Receiver for the entanglement-assisted protocol † the rotating frame is χσzaˆ aˆ. The preparation protocol consists in the following steps [81], assuming an initial For the implementation of the optimal observable Oˆopt qubit-resonator state |gi|0i (see Fig.5). we will make use of the JC Hamiltonian defined in

Step 1: Apply a π/2σ ˆy-pulse to the qubit in the ground Eq. (25) in the strong-resonant regime, i.e. when ωq = ωr state, and drive the resonator at frequency ω with and g  Γ. The qubit-resonator system evolution under r ˆ a signal calibrated such that the coherent state | − a time tg = τ/g corresponds to applying the gate Uτ = −τ[ˆa† σˆ−−aˆ σˆ+] −iHˆ t / iαi is prepared. e R R up to a known phase shift e 0 g ~, as 12

ˆ (ωq ,ωq ) ˆ g ˆ [H0 , HJC ] = 0. The observable Oopt can be im- plemented in an approximately in the following way, see Fig.6.

Step 1: Perform a squeezing operation Sˆ(r) on the re- flected modea ˆR, with squeezing parameter r = 0 − arcsinh λ− [91]. This generates the modea ˆR = † λ+aˆR + λ−aˆR.

Step 2: Apply a π/2σ ˆx-pulse to the qubit state. This switchesσ ˆ− withσ ˆ+. FIG. 6. Scheme for the implementation of the observable op- timizing the quantum Fisher information. During the signal Step 3: Let the qubit-signal system interact with the transmission, which happens at frequency ωr, the qubit state JC Hamiltonian in the strong-resonant regime for is transferred to a quantum memory. The qubit frequency is then tuned to ω = ω . Here the quantum memory is a res- a time tg = τ/g, with a small enough τ. This q r generates the transformation onator at frequency ωQM , interacting dispersively with the qubit. This allows the implementation of the cat code. The † state is transferred back to the qubit for the measurement Vˆ |eihe|Vˆ = |gihg| + τOˆopt + o(τ), (27) stage. The received signala ˆR is attenuated. A squeezing op- where Vˆ = Uˆ Sˆ(r)ˆσ . eration is then applied using a Josephson parametric amplifier τ x in the degenerate mode. The output interacts with the qubit in the resonant regime. Finally, the qubit is measured in the Step 4: Measure the qubit in the basis {|gihg|, |eihe|}. {|gihg|, |eihe|} basis.

If τ is low enough, this protocol approximates the ˆ 3 measurement in the low-energy eigenspace of Oopt = Interfacing a signal with NB ∼ 10 number of pho- − † tons with a low-temperature environment is challenging. σˆ [λ+aˆR + λ−aˆR] + c.c., which, in NS  1 regime, is the relevant part of the Hilbert space. Let us define An initial attenuation is needed, making the protocol † Oˆτ = Vˆ |eihe|Vˆ . The threshold discrimination proto- less efficient in terms of the SNR. An attenuation can col consists in repeating the steps 1-4 M times, collect- be modeled with the beamsplitter√ input-output relations M √ ing the results {oi}i=1. Here, oi = 1 (or 0) is the mea- aˆR,att = ηatt aˆR + 1 − ηatt vˆ, where ηatt is a power surement outcome corresponding to the projection on the attenuator and v is a bosonic mode assumed to be in a state |gi (or |ei). We then calculate the relative frequency vacuum state. This can be achieved with cryogenic mi- 1 PM crowave attenuators. The measurement protocol is ap- M i=1 oi, which corresponds to the expected value of plied to the modea ˆR,att, resulting in a rescaled SNR: the observable Oˆτ on the [qubit]-[reflected signal] system att ηattNB Q /QO ∗ ' in the NS  1 limit, This means state. We use the result to discriminate√ between the two Oτ∗ τ 1+ηattNB hypothesis: hOˆ i = λ + τη N (1 + e−4NS ) + o(τ) that the performance is not affected as long as ηattNB is τ φ=0 +√ S −4NS kept large enough. and hOˆτ iφ=π = λ+ − τη NS(1 + e ) + o(τ). We choose the τ value in order to maximize the SNR Q Oˆτ for the observable Oˆτ , defined as C. Effects of decoherence on the performance ˆ ˆ 2 (hOτ iρη,π − hOτ iρη,0 ) Q ˆ ≡ , (28) Oτ ˆ2 ∆Oτ In the state preparation scheme, the main source of hq q i2 inefficiency is given by the spurious thermal contribution ˆ2 1 ˆ2 ˆ2 where ∆Oτ = 4 ∆Oτ,φ=π + ∆Oτ,φ=0 is the vari- present in the cryogenic environment prior to the prepa- ration stage. In addition, while any sort of signal dissi- ance of the observable Oˆτ averaged over the states ρη,φ=π pation after the state preparation is already included in and ρη,φ=0. The SNR is related to the EP of a thresh- h Q M i the quantum illumination setup in an effective way, the old discrimination strategy with p ∼ exp − Oˆτ err 8 idler decoherence must be characterized and bounded in for M  1. In AppendixC, we show that any value order to understand the actual performance of the pro- 2 NS/NB  τ  1/NB is good for approximating the tocol in practical scenarios. Let us first discuss how the optimal SNR in the NB  1, NS  1 regime. For, in- protocol is affected by the initial thermal noise. We as- 2 NS ∗ 2 1 stance, if we choose τ = √ ≡ τ , with NS  √ , NB NB sume a Markovian environment at temperature T , whose q r we obtain Lindblad master equation is ∂tρ = [LD + LD]ρ. Here, Q ˆ Oτ∗ 1 ' 1 − √ . (29) q γ + − Q ˆ NB LD/~ = D[ˆσz] + Γ↑D[ˆσ ] + Γ↓D[ˆσ ], (30) Oopt 2 13 models the qubit decoherence, and at 5 GHz frequencies it corresponds to a decay time of 2/5 ms. Other options include highly coherent two- Lr / = κ(1 + N )D[ˆa] + κN D[ˆa†], (31) D ~ T T level systems formed in the junctions of qubits and high-

β ωr −1 −1 with NT = (e ~ − 1) and β = (kBT ) , is the res- frequency piezo-mechanical modes. onator dissipation in an environment at temperature T . Digital methods based on error correction have been Here, the Lindblad operators act on a general qubit- widely studied in the context of quantum computing. ˆ ˆ ˆ† 1 ˆ† ˆ There are principally two approaches to tackle the de- resonator state ρ as D[L]ρ = LρL − 2 {L L, ρ}. In Γ↓ −β ωq −1 coherence problem with a digital approach. We may en- addition, the relations ag ≡ = (1 + e ~ ) Γ↓+Γ↑ code the idler into a logical qubit since the beginning, Γ↑ −β ωq and ae ≡ = e ~ hold for a qubit in an envi- Γ↓+Γ↑ and perform the protocol in the logical Hilbert space. ronment at temperature T . In a T ' 20 mK environ- This is always doable in principle, and one may make a ment we have that β~ωr,q  1 for ωr,q ∼ 1 − 10 GHz, statement that an efficient cQED error-correction code therefore decoherence and dissipations in principle should implementation will be soon reached in the context of not play a role in the performance evaluation. How- quantum computing [86]. However, this approach is gen- ever, small thermal contributions can be relevant in the erally costy, as it requires the simultaneous control of low-photons regime, and their effects on the SNR need several qubits. An alternative consists in exploiting the to be quantified. We assume the initial qubit-resonator possibility of transfer the qubit information to the infi- state to be the steady state of the Lindblad master nite degrees of freedom of a bosonic resonator field via equation, i.e. ρq ⊗ ρr with ρq = ag|gihg| + ae|eihe| a Jaynes-Cumming interaction [87]. This approach re- n ∞   1 P NT quires only one resonator to store the idler, making the and ρr = 1+N n=0 1+N |nihn|. By applying the T T syndrome detection and error correction tasks easier to state preparation protocol, we obtain the state ρnoisy = 1 P 0 0 0 realize, because dissipation would be the main source of 0 [ag +kk ae]|kihk |⊗D(kα)ρrD(k α), where 2 k,k ∈{+,−} noise at T ' 20 mK. These so-called cat codes are at D(β) is a displacement operator. This implies a rescaling the basis of one of the most promising quantum com- of the optimal SNR for fixed transmitting power, given by 2 puting architectures, and they have been experimentally noisy (ag −ae) 2 Q /Q ˆ = −1 , where we have set |α| = cNT . Oˆopt Oopt 1+c demonstrated. Theoretically, one may reach substantial 2 −1 We notice that for c ≤ [2(ag −ae) −1] we cannot have fidelity improvements over the uncorrected protocol for any quantum advantage. This sets an upper limit to the given time, with millisecond lifetime instead of hundred amount of thermal noise tolerable before losing all the of microseconds of a bare transmon qubit [87]. In princi- advantage with respect to a coherent-state transmitter. ple, this approach should be better than using the Fock The initial thermal contribution can be experimentally states of a resonator as a qubit. However, further exper- characterized in several ways. For instance, recently a imental research is needed in this context, as the lifetime primary thermometry for propagating√ microwaves with of the cat-qubit implemented in a recent experiment has sensitivity of 4 × 10−4 photons/ Hz and a bandwidth been only 1.1 larger than an uncorrected qubit encoded of 40 MHz has been developed [83]. A similar analysis in the Fock basis of a resonator [88]. can be performed for the TMSV state case, obtaining comparable results. The main source of losses appears in the traveling VII. CONCLUSION phase of the protocol. Here, the idler must be preserved coherently in order to profit from the initial quantum We have developed the theory for performing a two- correlations. In fact, it is easy to see that under the lossy way covert quantum communication protocol in the low- dynamics described in Eq. (30), we have that frequency regime, in the case where one party has a severe dec energy constraint. While the results of this article are Q ˆ t Oopt −2 = e T2 , (32) quite general, we have focused mainly on the 1 − 10 GHz Q Oˆopt spectrum, where cQED platforms have been highly de- dec veloped in the late decades. We have proved the ultimate where Q ˆ is the SNR for the protocol applied to the Oopt bounds for the optimal receivers, finding that a quantum q −1 Γ↑+Γ↓ dec tLD /~ state ρ = e [|ψiSChψ|], T2 = γ + 2 , t is the correlated detector can be at most a factor of four bet- traveling time, and we have discarded any initial ther- ter in terms of SNR. Our bounds can be directly applied mal contributions (see AppendixD). This means that to the performance of a quantum illumination protocol. the protocol must be performed in a time well below They imply that if the source is strongly amplified, then the dephasing time of the qubit. Nowadays, qubits with a protocol based on coherent state is optimal, ruling out 100 µs lifetime can be realized [84], corresponding to 30 any quantum advantage in a recent experiment [36]. We km freespace propagation of light. An alternative would have used the quantum illumination paradigm as a tool be the storage in high-Q Nb resonators. Presently, inter- to perform two-way communication in the scenario where nal quality factors can reach above 1 milion [85], which the sender is constrained to passive operations. Indeed, 14 we have proved the square-root law for covert√ commu- nication in our two-way setup, showing that O( n) bits can be covertly transmitted by using the channel n times. ∗ [email protected] On the practical side, covertness is still limited by the [1] C. H. Bennett and G. Brassard, “Quantum cryptogra- low transmission rates. However, there are many ma- phy: Public key distribution and coin tossing”, Theoreti- chine type communications applications such as meter- cal Computer Science, Vol. 560 (Part 1), pp. 7-11 (2014). ing of electric power, gas and water that generate very [2] A. K. Ekert, “Quantum cryptography based on Bell’s the- little traffic per day and can tolerate large delays [89]. orem”, Phys. Rev. Lett. 67 (6): 661?663 (1991). That is, their required data rates can be as low as mil- [3] C. H. Bennett, “Quantum cryptography using any two libits per second. These systems often transmit privacy nonorthogonal states”, Phys. Rev. Lett. 68, 3121 (1992). [4] P. W. Shor and J. Preskill, “Simple Proof of Security of the sensitive data. Even if post-quantum encryption is uti- BB84 Quantum Key Distribution Protocol” Phys. Rev. lized, the adversary could still learn privacy jeopardizing Lett. 85, 441 (2000). information simply by observing the traffic pattern [90]. [5] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Finally, we have provided the ingredients for perform- Bunandar, R. Colbeck et al., “Advances in Quantum Crip- ing a cQED based experiment, using Schr¨odinger’scat tography”, Adv. Opt. Photon. 12, 1012-1236 (2020). states as resource. Our implementation concept relies [6] D. J. Bernstein and T. Lange, “Post-quantum cryptogra- on qubit measurements instead of photodetection, no- phy”, Nature vol. 549, pp. 188?194 (2017). [7] M. Mosca, “Cybersecurity in an Era with Quantum Com- tably improving the experimental requirements for the puters: Will We Be Ready?”, IEEE Security & Privacy, entanglement-assisted protocol. Developing a microwave vol. 16, no. 5, pp. 38-41, September/October (2018). quantum communication theory is a challenging task, due [8] C. Weedbrook, S. Pirandola, and T. C. Ralph, to the amount of noise that the related systems exhibit “Continuous-variable quantum key distribution using at room temperature. Indeed, our results contribute to- thermal states”, Phys. Rev. A 86, 022318 (2012). wards an implementation of open-air microwave quantum [9] X.-S. Ma, T. Herbst, T. Scheidl, D. Wang, S. Kropatschek, communication. In particular, we have settled, for the W. Naylor et al., “Quantum teleportation over 143 kilome- tres using active feed-forward”, Nature 489 7415, 269?273 first time, a rigorous ground for developing a quantum- (2012). enhanced version of backscatter communication. This [10] H. Liu, W. Wang, K. Wei, X.-T. Fang, Li Li, N.-L. paradigm is now gaining plenty of interest in the com- Liu et al., “Experimental Demonstration of High-Rate munication engineering community due its ability of com- Measurement-Device-Independent Quantum Key Distri- municating with low-energy devices, with applications in bution over Asymmetric Channels”, Phys. Rev. Lett. 111, RF communications, Internet-of-Things and NFC based 130502 (2013). technology [44]. Indeed, our theoretical treatment gives [11] W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, and G.-C. Guo, “Quantum Secure Direct Communication a new twist to the field of backscatter communication, with Quantum Memory”, Phys. Rev. Lett. 118, 220501 and we believe it will inspired further research on this (2017). line. [12] B. P. Williams, R. J. Sadlier, and T. S. Humble, “Su- perdense Coding over Optical Fiber Links with Complete Bell-State Measurements”, Phys. Rev. Lett. 118, 050501 (2017). [13] M. Sabuncu, R. Filip, G. Leuchs, and U. L. Ander- ACKNOWLEDGEMENTS sen, “Environment-assisted quantum-information correc- tion for continuous variables”, Phys. Rev. A 81, 012325 (2010). The authors acknowledge support from Academy of [14] M. Sabuncu, L. Miˇsta,Jr., Jarom´ırFiur´aˇsek,R. Filip, Finland under project no. 319578, under the RAD- G. Leuchs, and U. L. Andersen, “Nonunity gain minimal- DESS programme project no. 328193, and under the disturbance measurement”, Phys. Rev. A 76, 032309 “Finnish Center of Excellence in Quantum Technology (2007). QTF” Project Nos. 312296, 336810. RD acknowl- [15] M. Lassen, M. Sabuncu, A. Huck, J. Niset, G. Leuchs, edges support from the Marie Sklodowska Curie fellow- N. J. Cerf, U. L. Andersen, “Quantum optical coherence can survive photon losses: a continuous-variable quantum ship number 891517 (MSC-IF Green-MIQUEC). GSP ac- erasure correcting code”, Nature Photonics 4, 700 - 705 knowledges funding received from the European Union’s (2010). Horizon 2020 research and innovation programme under [16] J. Wang, F. Sciarrino, A. Laing, and M. J. Thompson, grant agreement no. 862644 (FET-Open project QUAR- “Integrated photonic quantum technologies”, Nat. Pho- TET). We are also grateful for the support of the Scien- tonics 14, 273-284 (2020). tific Advisory Board for Defence (Finland) and Saab. [17] A. Karsa, G. Spedalieri, Q. Zhuang, and S. Pirandola, “Quantum illumination with a generic Gaussian source”, The authors thank Sergey N. Filippov, Giuseppe Phys. Rev. Research 2, 023414 (2020). Vitagliano, G¨oran Johansson, Stefano Pirandola, and [18] A. Blais, A. L. Grimsmo, S. M. Girvin, and A. Wallraff, Kirill G. Fedorov for their useful comments to the “Circuit Quantum Electrodynamics”, arXiv:2005.12667 manuscript in its various stages. [19] E. P. Menzel, R. Di Candia, F. Deppe, P. Eder, L. Zhong, 15

M. Ihmig et al., “Path-entanglement of Continuous- [34] U. Las Heras, R. Di Candia, K. G. Fedorov, F. Deppe, Variable Quantum Microwaves”, Phys. Rev. Lett. 109, M. Sanz, and E. Solano, “Quantum Illumination Unveils 250502 (2012). Cloaking”, Sci. Rep. 7, 9333 (2017). [20] L. Zhong, E. P. Menzel, R. Di Candia, P. Eder, M. Ihmig, [35] R. Jonsson, R. Di Candia, M. Ankel, A. Str¨om,and G. A. Baust et al., “Squeezing with a flux-driven Josephson Johansson, 2020 IEEE Radar Conference (RadarConf20) parametric amplifier”, New J. of Phys. 15, 125013 (2013). 1-6 (2020). [21] S. Pogorzalek, K. G. Fedorov, L. Zhong, J. Goetz, F. [36] S. Barzanjeh, S. Pirandola, D. Vitali, and J. M. Fink, Wulschner, M. Fischer et al., “Hysteretic flux response and “Microwave quantum illumination using a digital re- nondegenerate gain of flux-driven Josephson parametric ceiver”, Science Advances Vol. 6, no. 19, eabb0451 (2020). amplifiers”, Phys. Rev. App. 8, 024012 (2017). [37] C. W. Sandbo Chang, A. M. Vadiraj, J. Bourassa, B. Bal- [22] J.-C. Besse, S. Gasparinetti, M. C. Collodo, T. Wal- aji, and C. M. Wilson, “Quantum-enhanced noise radar”, ter, P. Kurpiers, M. Pechal, C. Eichler, and A. Wallraff, Appl. Phys. Lett. 114, 112601 (2019). “Single-Shot Quantum Nondemolition Detection of Indi- [38] M. Sanz, K. G. Fedorov, F. Deppe, and E. Solano, “Chal- vidual Itinerant Microwave Photons”, Phys. Rev. X 8, lenges in Open-air Microwave Quantum Communication 021003 (2018). and Sensing”, 2018 IEEE Conference on Antenna Mea- [23] R. Kokkoniemi, J.-P. Girard, D. Hazra, A. Laitinen, J. surements & Applications (CAMA), V¨asteras, Sweden, Govenius, R. E. Lake, I. Sallinen, V. Vesterinen, M. Par- pp. 1-4 (2018). tanen, J. Y. Tan, K. W. Chan, K. Y. Tan, P. Hakonen [39] S.-H. Tan, B. I. Erkmen, V. Giovannetti, S. Guha, S. and M. M¨ott¨onen, “Bolometer operating at the threshold Lloyd, L. Maccone, S. Pirandola, and J. H. Shapiro, for circuit quantum electrodynamics ”, Nature 586, 47–51 “Quantum Illumination with Gaussian States”, Phys. (2020).. Rev. Lett. 101, 253601 (2008). [24] K. G. Fedorov, S. Pogorzalek, U. Las Heras, M. Sanz, P. [40] Z. Zhang, M. Tengner, T. Zhong, F. N. C. Wong, Yard, P. Eder et al.,“Finite-time quantum entanglement and J. H. Shapiro, “Entanglement’s Benefit Survives an in propagating squeezed microwaves”, Sci. Rep. 8, 6416 Entanglement-Breaking Channel”, Phys. Rev. Lett. 111, (2018). 010501 (2013). [25] R. Di Candia, E. P. Menzel, L. Zhong, F. Deppe, A. [41] Z. Zhang, S. Mouradian, F. N. C. Wong, and J. H. Marx, R. Gross, and E. Solano, “Dual-path methods Shapiro, “Entanglement-Enhanced Sensing in a Lossy and for propagating quantum microwaves”, New J. Phys. 16, Noisy Environment”, Phys. Rev. Lett. 114, 110506 (2015). (2014). [42] D. Braun, G. Adesso, F. Benatti, R. Floreanini, U. Mar- [26] P. L¨ahteenm¨aki,G. S. Paraoanu, J. Hassel, and P. J. zolino, M. W. Mitchell, and S. Pirandola, “Quantum- Hakonen, “Coherence and multimode correlations from enhanced measurements without entanglement”, Rev. vacuum fluctuations in a microwave superconducting cav- Mod. Phys. 90, 35006 (2018). ity”, Nat. Comm. 7, 12548 (2016). [43] S. Pirandola, S. Mancini, S. Lloyd, and S. L. Braun- [27] C. W. Sandbo Chang, M. Simoen, J. Aumentado, C. stein, “Continuous-variable quantum cryptography using Sabin, P. Forn-Diaz, A. M. Vadiraj, F. Quijandria, G. two-way quantum communication”, Nat. Phys. 4, 726?730 Johansson, I. Fuentes, and C. M. Wilson, “Generating (2008). Multimode Entangled Microwaves with a Superconduct- [44] J. D. Griffin and G. D. Durgin, “Complete Link Budgets ing Parametric Cavity”, Phys. Rev. Applied 10, 044019 for Backscatter-Radio and RFID Systems”, IEEE Anten- (2018). nas and Propagation Magazine, vol. 51, no. 2, pp. 11-25 [28] D.E. Bruschi, C. Sabin, and G. S. Paraoanu, “Entangle- (2009). ment, coherence, and redistribution of quantum resources [45] S. J. Navaz, S. K. Sharma, B. Mansoor, M. N. Pat- in double spontaneous down-conversion processes”, Phys. wary and N. M. Khan, “Non-Coherent and Backscatter Rev. A 95 , 062324 (2017). Communications: Enabling Ultra-Massive Connectivity [29] S. Pogorzalek, K. G. Fedorov, M. Xu, A. Parra- in 6G Wireless Networks”, IEEE Access, vol. 9, pp. Rodriguez, M. Sanz, M. Fischer, E. Xie, K. Inomata, Y. 38144-38186, 2021. Nakamura, E. Solano, A. Marx, F. Deppe, and R. Gross, “Secure quantum remote state preparation of squeezed mi- [46] J. Niu and G. Y. Liu, “An Overview on Backscatter crowave states”, Nature Comm. 10, 2604 (2019). Communications”, Journal of Communications and [30] K. G. Fedorov, M. Renger, S. Pogorzalek, R. Di Can- Information Networks, vol. 4, no. 2, pp. 1-14, June 2019. dia, Q. Chen, Y. Nojiri, K. Inomata, Y. Nakamura, M. Partanen, A. Marx, R. Gross, F. Deppe, “Experimen- [47] C. Weedbrook, C. Ottaviani, and S. Pirandola, “Two- tal quantum teleportation of propagating microwaves”, way quantum cryptography at different wavelengths”, arXiv:2103.04155 [quant-ph]. Phys. Rev. A 89 (1), 012309 (2014). [31] R. Di Candia, K. G. Fedorov, L. Zhong, S. Felicetti, E. [48] S. Ghorai, E. Diamanti, and A. Leverrier, “Composable P. Menzel, M. Sanz, F. Deppe, A .Marx, R. Gross, and E. security of two-way continuous-variable quantum key dis- Solano , “Quantum teleportation of propagating quantum tribution without active symmetrization”, Phys. Rev. A microwaves”, EPJ Quantum Technology 2, 25 (2015). 99, 012311 (2019). [32] K. G. Fedorov, L. Zhong, S. Pogorzalek, P. Eder, M. [49] C. Weedbrook, S. Pirandola, S. Lloyd, and T. C. Fischer, J. Goetz et al., “Displacement of Propagat- Ralph, “Quantum Cryptography Approaching the Clas- ing Squeezed Microwave States”, Phys. Rev. Lett. 117, sical Limit”, Phys. Rev. Lett. 105, 110501 (2010). 020502 (2016). [50] J. H. Shapiro, “Defeating passive eavesdropping with [33] S. Barzanjeh, S. Guha, C. Weedbrook, D. Vitali, J. H. quantum illumination”, Phys. Rev. A 80, 022320 (2009). Shapiro, and S. Pirandola, “Microwave Quantum Illumi- [51] B. Vlastakis, G. Kirchmair, Z. Leghtas, S. E. Nigg, L. nation”, Phys. Rev. Lett. 114, 080503 (2015). Frunzio, S. M. Girvin, M. Mirrahimi, M. H. Devoret, R. 16

J. Schoelkopf, “Deterministically Encoding Quantum In- herence in circuit QED”, Phys. Rev. B 94, 014506 (2016). formation Using 100-Photon Schr¨odingerCat States”, Sci- [69] P. Delsing, A, N Cleland, M. J A Schuetz, J. Kn¨orzer,G. ence 342, 6158 (2013). Giedke, J. I. Cirac et al., “The 2019 surface acoustic waves [52] J. H. Shapiro, “The Quantum Illumination Story”, roadmap”, J. Phys. D: Appl. Phys. 52, 353001 (2019). (2019), IEEE Aerospace and Electronics Systems Maga- [70] M. K. Ekstr¨om, T. Aref, A. Ask, G. Andersson, B. zine, vol. 35, no. 4, pp. 8-20 (2020). Suri, H. Sanada, G. Johansson, and P. Delsing, “Towards [53] B. A. Bash, A. H. Gheorghe, M. Patel, J. L. Habif, phonon routing: Controlling propagating acoustic waves D. Goeckel, D. Towsley, and S. Guha, “Quantum-secure in the quantum regime”, New J. Phys. 21, 123013 (2019). covert communication on bosonic channels”, Nat. Comm. [71] R. Di Candia, R. J¨antti, R. Duan, J. Lietzen, H. Khalifa, 6, 8626 (2015). and K. Ruttik, “Quantum Backscatter Communication: A [54] J. M. Arrazola and V. Scarani, “Covert Quantum Com- New Paradigm”, 2018 15th International Symposium on munication”, Phys. Rev. Lett. 117, 250503 (2016). Wireless Communication Systems (ISWCS). IEEE, 2018. [55] Y. Liu, J. M. Arrazola, W.-Z. Liu, W. Zhang, I. W. S. 1-6. Primaatmaja, H. Li, L. You, Z. Wang, V. Scarani, Q. [72] R. J¨antti, R. Di Candia, R. Duan, and K. Ruttik, “Mul- Zhang, and J.-W. Pan, “Experimental unconditionally se- tiantenna quantum backscatter communications”, 2017 cure covert communication in dense wavelength-division IEEE Globecom Workshops (GC Wkshps). IEEE, 2017. multiplexing networks”, arXiv:1709.06755 [quant-ph]. S. 1-6. [56] M. S. Bullock, C. N. Gagatsos, S. Guha, and Boulat [73] Q. Zhuang, Z. Zhang, and J. H. Shapiro, “Quantum il- A. Bash, “Fundamental limits of quantum-secure covert lumination for enhanced detection of Rayleigh-fading tar- communication over bosonic channels”, IEEE Journal on gets”, Phys. Rev. A 96, 020302(R)(2017). Selected Areas in Communications, vol. 38, no. 3, pp. 471- [74] M. Tahmasbi and M. R. Bloch, “Framework for covert 482 (2020). and secret key expansion over classical-quantum chan- [57] H. Shi, Z. Zhang, and Q. Zhuang, “Practical Route nels”, Phys. Rev. A 99, 052329 (2019). to Entanglement-Assisted Communication Over Noisy [75] E. C. Song, P. Cuff, and H. V. Poor, “The Likelihood En- Bosonic Channels”, Phys. Rev. Appl. 13, 034029 (2020). coder for Lossy Compression ”, IEEE Trans. Info. Theory [58] J. Calsamiglia, R. Mu˜noz-Tapia, Ll. Masanes, A. Acin, 62, 1836 (2016). and E. Bagan, “Quantum Chernoff bound as a measure of [76] J. M. Arrazola and R. Amiri, “Secret-key expansion from distinguishability between density matrices: Application covert communication”, Phys. Rev. A 97, 022325 (2018). to qubit and Gaussian states”, Phys. Rev. A 77, 032311 [77] L. Wang, G. W. Wornell, and L. Zheng, “Fundamental (2008). Limits of Communication With Low Probability of Detec- [59] K. M. R. Audenaert, J. Calsamiglia, R. Mu˜noz-Tapia, E. tion”, IEEE Transactions on Information Theory, vol. 62, Bagan, Ll. Masanes, A. Acin, and F. Verstraete, “Discrim- no. 6, pp. 3493-3503 (2016). inating States: The Quantum Chernoff Bound”, Phys. [78] F. Girela-L´opez, J. L´opez-Jim´enez,M. Jim´enez-L´opez, Rev. Lett. 98, 160501 (2007). R. Rodr´ıguez,E. Ros, and J. D´ıaz,“IEEE 1588 high ac- [60] S. Pirandola and S. Lloyd, “Computable bounds for curacy default profile: Applications and challenges”, IEEE the discrimination of Gaussian states”, Phys. Rev. A 78, Access 8, pp.45211-45220 (2020). 012331 (2008). [79] U. Weinbach and S. Sch¨on,“GNSS receiver clock mod- [61] M. Sanz, U. Las Heras, J. J. Garcia-Ripoll, E. Solano, eling when using high-precision oscillators and its impact and R. Di Candia, “Quantum Estimation Methods for on PPP”, Advances in space research 47(2), pp.229-238 Quantum Illumination”, Phys. Rev. Lett. 118, 070803 (2011). (2017). [80] M. Boissonneault, J. M. Gambetta, and A. Blais, “Dis- [62] M. Paris, “Quantum Estimation for Quantum Technol- persive regime of circuit QED: Photon-dependent qubit ogy”, Int. J. Quant. Inf. 7, 125 (2009). dephasing and relaxation rates”, Phys. Rev. A 79, 013819 [63] Q. Zhuang, Z. Zhang, and J. H. Shapiro, “Optimum (2009). Mixed-State Discrimination for Noisy Entanglement- [81] B. Vlastakis, A. Petrenko, N. Ofek, L. Sun, Z. Leghtas, K. Enhanced Sensing”, Phys. Rev. Lett. 118, 040801 (2017). Sliwa, et al., “Characterizing entanglement of an artificial [64] S. Guha and B. I. Erkmen, “Gaussian-state quantum- atom and a cavity cat state with Bell’s inequality”, Nat. illumination receivers for target detection”, Phys. Rev. A Comm. 6, 8970 (2015). 80, 052310 (2009). [82] C. Wang, Y. Y. Gao1, P. Reinhold, R. W. Heeres, N. [65] T. Walter, P. Kurpiers, S. Gasparinetti, P. Magnard, Ofek, K. Chou et al., “A Schr¨odingercat living in two A. Potocnik, Y. Salathe, M. Pechal, M. Mondal, M. boxes”, Science 352, 1087 (2016). Oppliger, C. Eichler, and A. Wallraff, “Realizing Rapid, [83] M. Scigliuzzo, A. Bengtsson, J.-C. Besse, A. Wallraff, P. High-Fidelity, Single-Shot Dispersive Readout of Super- Delsing, and S. Gasparinetti., “Primary thermometry of conducting Qubits”, Phys. Rev. Applied 7, 054020 (2017). propagating microwaves in the quantum regime”, Phys. [66] R. Dassonneville, T. Ramos, V. Milchakov, L. Planat, Rev. X 10, 041054. E. Dumur, F. Foroughi et al., “Fast High-Fidelity Quan- [84] A. P. M. Place, L. V. H. Rodgers, P. Mundada, B. M. tum Nondemolition Qubit Readout via a Nonperturbative Smitham, M. Fitzpatrick, Z. Leng, A. Premkumar, J. Cross-Kerr Coupling”, Phys. Rev. X 10, 011045 (2020). Bryon, S. Sussman, G. Cheng, T. Madhavan, H. K. Babla, [67] R. Dassonneville, R. Assouly, T. Peronnin, P. Rou- B. Jaeck, A. Gyenis, N. Yao, R. J. Cava, N. P. de Leon, chon, and B. Huard, “Number-Resolved Photocounter for and A. A. Houck, “New material platform for supercon- Propagating Microwave Mode”, , Phys. Rev. Applied 14, ducting transmon qubits with coherence times exceeding 044022 (2020). 0.3 milliseconds”, Nature Communications vol. 12, 1779 [68] M. Reagor, W. Pfaff, C. Axline, R. W. Heeres, N. Ofek, (2021). K. Sliwa et al., “Quantum memory with millisecond co- [85] A. Megrant, C. Neill, R. Barends, B. Chiaro, Y. Chen, 17

L. Feigl, J. Kelly, E. Lucero, M. Mariantoni, P. J. J. O’Malley, D. Sank, A. Vainsencher, J. Wenner, T. C. White, Y. Yin, J. Zhao, C. J. Palmstrøm, J. M. Martinis, and A. N. Cleland, “Planar Superconducting Resonators with Internal Quality Factors above One Million”, Appl. Phys. Lett. 100, 113510 (2012). [86] F. Arute, K. Arya, R. Babbush, D. Bacon, J. C. Bardin, R. Barends et al., “Quantum supremacy using a pro- grammable superconducting processor”, Nature vol. 574, pp. 505?510 (2019). [87] Z. Leghtas, G. Kirchmair, B. Vlastakis, R. J. Schoelkopf, M. H. Devoret, and M. Mirrahimi, “Hardware-Efficient Autonomous Quantum Memory Protection” , Phys. Rev. Lett. 111, 120501 (2013). [88] N. Ofek, A. Petrenko, R. Heeres, P. Reinhold, Z. Leghtas, B. Vlastakis et al., “Extending the lifetime of a quantum bit with error correction in superconducting circuits”, Na- ture 536, 441 (2016). [89] U. Raza, P. Kulkarni, and M. Sooriyabandara, “Low power wide area networks: An overview”, IEEE Commu- nications Surveys & Tutorials 19(2), pp.855-873 (2017).. [90] I. Hafeez, M. Antikainen and S. Tarkoma, “Protecting IoT-environments against Traffic Analysis Attacks with Traffic Morphing”, IEEE International Conference on Per- vasive Computing and Communications Workshops (Per- Com Workshops), Kyoto, Japan, 2019, pp. 196-201. [91] The squeezing operation on the modea ˆR is defined as ˆ  ξ2 †2 ξ∗2 2  −iφ S(ξ) = exp − 2 aˆR + 2 aˆR , where ξ = re is the squeezing parameter. A1

Appendix: Two-way covert microwave quantum communication In this Appendix, we provide the proofs of the results stated in the main text. We make frequent use of the following objects: ∞ • Fock basis, indicated with latin alphabet kets (or bra): {|ki}k=0;

2 − |α| ∞ αk Coherent states with amplitude α ∈ , indicated with greek alphabet kets (or bra): |αi = e 2 P √ |ki; • C k=0 k!  k P 1 NB Thermal States with NB average photon numbers: ρB = τk|kihk|, where τk = ; • k 1+NB 1+NB Pr √ • General signal-idler state of r Schmidt-rank: |ψiSI = k=0 pk|vkiI |wkiS. The signal mode is indicated by aˆS and we use indistinctively the notation |vi|wi and |v, wi. The Schmidt rank r differentiates between the entangled (r > 1) and the idler-free (r = 1) cases;

NB NS Constants: cB = and cS = . • 1+NB 1+NS

APPENDIX A: RECEIVER ERROR PROBABILITY

In this section, we discuss the results based on the calculation of the Chernoff bounds and the quantum Fisher information (QFI) relative to Bob’s receiver. In the following, as Bob and Alice are sharing ϕk values, we can set it to zero.

1. Equivalence between OOK and BPSK

In the η  1 limit, we can map the problem of discriminating between different φ to the quantum illumination (QI) setup, where Alice decides to modulate the amplitude between η = 0 and η =η ¯, leaving the phase unchanged (φ = 0). (k) This is usually referred as On-Off-Keying (OOK). We first notice that the received modes {aˆR } can be expressed as (k) −iφ (k) p 2 ˆ(k) aˆR = η (e aˆS ) + 1 − η h , (A1) ˆ(k) q η −iφˆ(k) q 1 ˆ(k) where h ≡ 1+η e h← + 1+η h→ are thermal modes with NB average number of photons. This means that h i ˆ ˆ ˆ † ˆ† if |ψiSI hψ| is the state of the SI system, then the final Bob’s state is ρη,φ = TrE BηUφ|ψiSI hψ| ⊗ ρBUφBη , where h i ˆ † ˆ ˆ† ˆ −iφnˆS Bη = exp arccos η(ˆaSh − aˆSh ) is a beamsplitter operation and Uφ = e is a phase-shift operation. We can now prove the equivalence between OOK and BPSK. Lemma A1. [Equivalence of OOK and BPSK] In the η  1 limit, the BPSK and OOK optimal strategies are the same for both the local and the collective cases. The BPSK performs as an OOK with η¯ = 2η. † ˆ ˆ† Proof. We have that ρη,0 = ρB−ηdρ+o(η), ρη,π = ρB+ηdρ+o(η) for η  1, where dρ = TrS [ˆaSh−aˆSh , |ψiSI hψ|⊗ρB]. ⊗n ⊗n ⊗n ⊗n Pn ⊗j−1 ⊗n−j Therefore, ρη,0 = ρB − ηdσ + o(η) and ρη,π = ρB + ηdσ + o(η), with dσ = i=1 ρB ⊗ dρ ⊗ ρB . This means ⊗n ⊗n ⊗n ⊗n that (ρη,π − ρη,0 ) = (ρ0,0 − ρ2η,0) + o(η). Therefore, BPSK performs as an OOK withη ¯ = 2η in the η  1 limit, and their measurement setups - being local or collective - are the same.

2. Chernoff bound and quantum Fisher information: general formulas

We can now analyze the OOK case to state the general formulas for the quantum Chernoff bound and quantum Fisher information for the BPSK case. In the following, we denote ρη ≡ ρη,0. ˆ ˆ† ˆ Lemma A2. [Chernoff bound for QI (OOK)] Given ρη = TrE (Bη|ψiSI hψ| ⊗ ρBBη), with Bη = h i √ † ˆ ˆ† exp arccos η(ˆaSh − aˆSh ) . Then, the optimal error probability in the task of distinguishing between ρ0 and ρη¯

1 −MC(ρ0,ρη¯) is perr ≤ 2 e for M  1, where 2 2 η¯ X pkpk0 |hwk0 |aˆS|wki| 2 C(ρ0, ρη¯) = √ √ √ 2 + o(¯η ). (A2) 1 + NB   k,k0 pk0 + pk cB A2

Proof. This is a simple application of one of the results in Calsamiglia et al. [A1]. We have that C(ρ0, ρη¯) = s 1−s − mins∈[0,1] log Tr(ρ0ρη¯ ). Considering the Taylor expansion aroundη ¯ = 0, ρη¯ = ρ0 +ηdρ ¯ + o(¯η), then

2 0 2 η¯ X |hvk, n|dρ|vk0 n i| 2 C(ρ0, ρη¯) = √ √ 2 + o(¯η ) (A3) 2 [ pkτn + pk0 τn0 ] kk0nn0 =η ¯2βcol + o(¯η2), (A4)

† ˆ ˆ† see Equation (47) of Ref. [A1]. The task reduces in computing Eq. (A4) with dρ = TrS[ˆaSh − aˆSh , |ψiSI hψ| ⊗ ρB]. First, we notice that √ √ 0 † 0 hvk, n|dρ|vk0 n i = (τn0 − τn)[hwk0 |aˆS|wki n + 1δn0,n+1 − hwk0 |aˆS|wki n + 1δn,n0+1]. (A5) We have that

P √ † † 0 2 |hv , n| p p 0 |v ihv 0 | ⊗ [hw 0 |aˆ |w ihˆ − hw 0 |aˆ |w ihˆ , ρ ]|v 0 , n i| col 1 X k jj0 j j j j j S j j S j B k β = √ √ 2 (A6) 2 [ pkτn + pk0 τn0 ] kk0nn0 √ √ † 0 2 1 X pkpk0 |hwk0 |aˆS|wki(τn0 − τn) n + 1δn0,n+1 − hwk0 |aˆS|wki(τn0 − τn) n + 1δn,n0+1| = √ √ 2 (A7) 2 [ pkτn + pk0 τn0 ] kk0nn0 2 1 X pkpk0 (τn0 − τn) h † 2 2 0 i 0 0 0 0 = √ √ 2 |hwk |aˆS|wki| (n + 1)δn ,n+1 + |hwk |aˆS|wki| (n + 1)δn,n +1 (A8) 2 [ pkτn + pk0 τn0 ] kk0nn0 " † 2 2 # 1 X 2 |hwk0 |aˆS|wki| |hwk0 |aˆS|wki| 0 = (n + 1)pkpk [τn+1 − τn] √ √ 2 + √ √ 2 , (A9) 2 [ pkτn + pk0 τn+1] [ pkτn+1 + pk0 τn] kk0n where in the last line we have summed on the n0 index. We now use that the last sum is symmetric under the exchange 0 NB of k and k and that τn/τn−1 = : 1+NB

2 col X 2 |hwk0 |aˆS|wki| 0 β = (n + 1)pkpk [τn+1 − τn] √ √ 2 ) (A10) [ pkτn+1 + pk0 τn] kk0n  2 2 X τn+1 |hwk0 |aˆS|wki| = (n + 1)τnpkpk0 1 − 2 (A11) τn h√ √ q τn+1 i kk0n pk0 + pk τn 2 1 X pkpk0 |hwk0 |aˆS|wki| = . (A12) h q i2 1 + NB 0 √ √ NB kk pk0 + pk 1+NB

Lemma A3. [Quantum Fisher information for QI (OOK) [A2]] Given ρη as in Lemma A2. Then, the quantum Fisher information for estimating the parameter η in the η  1 neighborhood is

4 X pkpk0 2 F = |hwk0 |aˆS|wki| . (A13) 1 + NB pk0 + pkcB k,k0

Proof. The QFI is given by [A3]

0 2 X |hvk, n|dρ|vk0 n i| F = 2 , (A14) pkτn + pk0 τn0 kk0nn0

† ˆ ˆ† where dρ = TrS[ˆaSh − aˆSh , |ψiSI hψ| ⊗ ρB]. The calculation is similar as in Lemma A2.

3. Ultimate error probability bounds for the receiver

We can now prove some of the Theorems of sectionIII the main text. A3

Proof of Theorem1. For the idler-free case, we apply Lemma A2 withη ¯ = 2η (see Lemma A1) to the simple case of 2 loc 4|hw|aˆS |wi| 1 Schmidt-rank one, finding that β = √ 2 . Then, by applying the H¨older’sinequality, we find that cl 1+NB (1+ cB ) 2 2 |hw|aS|wi| ≤ kaS|wik2 = NS, which is saturated by |wi = |αi. For the general case, by applying the inequality pk0 col 4 P † √ √ √ 2 ≤ 1 to Eq. (A2) withη ¯ = 2η (see Lemma A1), we obtain β ≤ 1+N k,k0 pkhwk|aˆS|wk0 ihwk0 |aˆS|wki. [ p 0 + pk cB ] B k P By using the completeness relation k0 |wk0 ihwk0 | = I - which can be assumed by adding zero probability terms to P † col 4NS the sum - and by noticing that NS = pkhwk|aˆ aˆS|wki, we conclude that β ≤ . By applying the inequality k S √ 1+NS pkpk0 pkpk0 pk+pk0 of arithmetic and geometric means √ √ 2 ≤ √ ≤ √ , and by using the completeness relation, we find [ pk0 + pkcB ] 4 cB 8 cB the second inequality βcol ≤ 2NS +1 √1 . Moreover, no mixed state can do better, as in this case the bound can be 1+NB 4 cB applied to its purification. Proof of Theorem2. For the idler-free case, by applying Lemma A3 withη ¯ = 2η (seel Lemma A1) to the Schmidt- 2 rank one case, we find that βloc = 2|hw|aˆS |wi| 1 , which is maximal for |wi = |αi (see the proof of Theorem1). cl 1+NB 1+cB Homodyne is optimal as one can directly see by checking that the signal-to-noise ratio hxˆi2 /hxˆ2i saturates the QFI, ρη¯ ρ0 and by using Lemma A1. The general bound is found similarly as in the proof of Theorem1, with the inequalities p 0 p p 0 p +p 0 k ≤ 1 and k k ≤ k√ k applied to Eq. (A13). Also in this case no mixed state can do better, by applying pk0 +pαcB pk0 +pkcB 4 cB the bound to the purified state.

4. Examples

1 k QCB and QFI of TMSV states: This is done by setting pk = c and |wki = |ki (Fock state with k photons) 1+NS S into the Eq. (A2), where we setη ¯ = 2η, and Eq. (A13). It results in a sum of a geometric series and its first derivative, that can be cast as written in the main text. Similarly, the optimal observable for the threshold discrimination 0 0 P hk ,n |dρ|k,ni 0 0 strategy is found by computing 0 0 |k , n ihk, n| (32). kk nn pk0 τn0 +pkτn QCB and QFI of SC states: This is done by applying Lemma A2 and A3 to the Schmidt decomposition of the SC p p state given in Eq. (15) of the main text, i.e. |ψiSC = λ+|gi|α+i + λ−|ei|α−i. We then use Lemma A1 to bring the result to the BPSK case. The result is

col NS col βSC = fSC (NS,NB) (A15) 1 + NB loc NS loc βSC = fSC (NS,NB) (A16) 1 + NB with 4λ2 4λ2 f col(N ,N ) = + + − , (A17) SC S B p p √
2 p p √
2 λ+ + λ− cB λ− + λ+ cB 2 2 col 2λ+ 2λ− fSC (NS,NB) = + . (A18) λ+ + λ−cB λ− + λ+cB

In the NB  1 limit, these quantities approximate to

−4NS col NB 1 2 + 2e p fSC = √ = 4 − 8 NS + O(NS), (A19) 1 + 1 − e−4NS

loc NB 1 −4NS 2 fSC = 1 + e = 2 − 4NS + O(NS), (A20)

1 −2NS where we have used that λ± = 2 [1 ± e ]. The optimal local observable can be found by computing

0 0 X hk , n |dρ|k, ni 0 0 Oˆopt = |k , n ihk, n|, (A21) pk0 τn0 + pkτn kk0∈{g,e}; nn0∈[0,∞] where pe = λ− and pg = λ+. Alternatively, one can directly compute the SNR of Oˆopt and see that it saturates the QFI in the NB  1 limit. A4

APPENDIX B: COVERT QUANTUM COMMUNICATION

Here, we provide the technical details to prove the main results on covert quantum communication. We denote (NS ) Eve’s quantum state when Alice applies a phase modulationϕ ˜ as ρϕ˜ . NS > 0 corresponds to the on-setting, while NS = 0 is the off -setting. We drop any k superscript and subscript, as we are in the i.i.d assumptions. In addition, ˆ h † † i √ we introduce the beamsplitter unitary operator B12 = exp θ(ˆa1aˆ2 − aˆ1aˆ2) , where θ = arccos η. Let us introduce h i ˆ −iϕ˜nˆS ˆ ˆ† iϕ˜nˆS ˆ† Eϕ˜[σ] = TrS B→,Se B←,S(ρB ⊗ ρB ⊗ σ)B←,Se B→,S (A22) h i −iϕ˜nˆ→ ˆ ˆ ˆ† ˆ† iϕ˜nˆ→ = e TrS B→,SB←,S(ρB ⊗ ρB ⊗ σ)B←,SB→,S e , (A23)

P 0 where σ = k,k0 ckk0 |kiShk |, TrS denotes the partial trace on the signal mode, and the equality is due to the phase- invariance of the thermal state. The latter is evident at seeing the input-output relations in Eqs. (20)-(21) of the

(NS ) 1 P (NS ) (NS ) main text. Let us denote by ρ = |A| ϕ˜∈A ρϕ˜ , where ρϕ˜ = Eϕ˜[ρS]. Here, we denote the phase shift at Alice asϕ ˜, which is ϕ + φ or ϕ depending if we are in the on or off setting respectively. In both cases,ϕ ˜ is distributed uniformly at random in A. Proof of Lemma1. h ⊗n ⊗n i (Eve) 1 1 (NS ) (0) [Achievability] We have that P = 2 1 − 2 kρ − ρ k1 [A1]. As done in Ref. [A4], we can simplify p the calculation by using the Pinsker’s inequality, i.e. kρa − ρbk1 ≤ 2D(ρa, ρb) for any states ρa and ρb, where D(ρa, ρb) = −Tr ρa ln ρb + Tr ρa ln ρa is the quantum relative entropy between ρa and ρb. This provides the bound r (Eve) 1 1 ⊗n ⊗n P ≥ − D(ρ(0) , ρ(NS ) ), (A24) 2 8 meaning that

⊗n ⊗n D(ρ(0) , ρ(NS ) ) ≤ 8δ2 (A25)

(Eve) 1 ensures that P ≥ 2 − δ over n modes. We use that the quantum relative entropy is additive for tensor product, ⊗n ⊗n i.e. D(ρ(0) , ρ(NS ) ) = nD(ρ(0), ρ(NS )) to reduce the calculation to the single channel-usage case.

aˆ +ˆa† aˆ −aˆ† TMSV case: Let us define the vector ~r = (ˆx , pˆ , xˆ , pˆ )T , wherex ˆ = l√ l andp ˆ = √l l (l ∈ {←, →}). • ← ← → → l 2 l 2i For a zero-mean Gaussian state ρ, the covariance matrix is defined as Σij = Tr ({rˆj, rˆk}ρ). The covariance (NS ) matrix of the Gaussian state ρϕ˜ is

 A 0 −B cosϕ ˜ B sinϕ ˜ 

(NS )  0 A −B sinϕ ˜ −B cosϕ ˜ Σ = 2 ×   (A26) ϕ˜ −B cosϕ ˜ −B sinϕ ˜ C 0  B sinϕ ˜ −B cosϕ ˜ 0 C

1 √ 1 2 where A = 2 + ηNB + (1 − η)NS, B = (1 − η) η(NB − NS), and C = 2 + [(1 − η) + η]NB + (1 − η)ηNS. We have that

(0) (NS ) DGauss = D(ρ , ρ ) (A27) 1 X (0) (N ) ≤ D(ρ , ρ S ) (A28) |A| ϕ˜ ϕ˜ ϕ˜∈A

(0) (NS ) = D(ρϕ˜=0, ρϕ˜=0 ), (A29)

where we have used the joint convexity property of the relative entropy, and that the D(Uρˆ Uˆ †, Uσˆ Uˆ †) = D(ρ, σ) for any unitary Uˆ and states ρ and σ, together with Eq. (A23). For zero-mean Gaussian states, we have that

" (NS ) # 1 det[Σ + iΩ] 1 D(ρ(0), ρ(NS )) = log ϕ˜ + Tr [Σ(0)(H(NS ) − H(0))] , (A30) ϕ˜ ϕ˜ 2 (0) 2 ϕ˜ ϕ˜ ϕ˜ det[Σϕ˜ + iΩ] A5

(NS ) (NS ) where Ω = −iI2 ⊗ σy is the symplectic form and Hϕ˜ = 2 arccoth(iΩΣϕ˜ )iΩ is the Hamiltonian matrix, (NS ) given that ρϕ˜ is a faithful Gaussian state [A5, A6]. Eq. (A30) has been computed using Mathematica, finding

(0) (NS ) 2 2  2 2  D(ρϕ˜ , ρϕ˜ ) = − (1 + 2NBη + 2NS(1 − η )) arccoth(1 + 2NBη ) − arccoth(1 + 2NS + 2(NB − NS)η ) 2 2 1 NBη (1 + NBη ) + log 2 2 4 , (A31) 2 NS(1 + NS) + (NB − NS)(1 + 2NS)η + (NB − NS) η

which, as already mentioned, does not depend onϕ ˜. The expansion to the third order in NS gives

2 2 (NS ) (0) (1 − η ) 2 3 3 D(ρϕ˜=0 , ρϕ˜=0) = 2 2 NS + aNS + o(NS) (A32) 2NBη (1 + NBη ) 2 2 (1 − η ) 2 ≤ 2 2 NS (A33) 2NBη (1 + NBη )

where a < 0 allows us to use the Taylor’s remainder theorem.

P∞ j • General case: We extend the result to signal states of the form ρS = j=0 NSσj, where

σ0 = |0ih0| (A34)

σ1 = |1ih1| − |0ih0| (A35)

σ2 = c(|2ih2| − 2|1ih1| + |0ih0|), (A36)

with 0 ≤ c ≤ 1. This set of states include the Gaussian state case (c = 1). In addition, for NS  1 these states well approximate Gaussian states. Let us consider the Taylor expansion for the logarithm of a matrix

Z ∞ 1 1 Z ∞ 1 1 1 log(A + tB) = log(A) + t B dz − t2 B B dz 0 A + z A + z 0 A + z A + z A + z Z ∞ 1 1 1 1 + t3 B B B dz + +o(t3). (A37) 0 A + z A + z A + z A + z

(0) ρ(NS )−ρ(0) If we set A = ρ , B = and t = NS, we obtain NS

(0) (NS ) (0) (NS ) (0) (0) Dc(ρ , ρ ) = −Tr ρ ln ρ + Tr ρ log ρ (A38) Z ∞ 1 1 = −Tr (ρ(NS ) − ρ(0)) ρ(0) dz (0) (0) 0 ρ + z ρ + z Z ∞ 1 1 1 + Tr ρ(0) (ρ(NS ) − ρ(0)) (ρ(NS ) − ρ(0)) dz (0) (0) (0) 0 ρ + z ρ + z ρ + z Z ∞ 1 1 1 1 − Tr ρ(0) (ρ(NS ) − ρ(0)) (ρ(NS ) − ρ(0)) (ρ(NS ) − ρ(0)) dz (0) (0) (0) (0) 0 ρ + z ρ + z ρ + z ρ + z 3 + o(NS) (A39) Z ∞ 1 1 1 = N 2Tr ρ(0) ρ ρ dz (= b N 2) S (0) 1 (0) 1 (0) 1 S 0 ρ + z ρ + z ρ + z Z ∞ 1 1 1 1 − N 3Tr ρ(0) ρ ρ ρ dz (= b N 3) S (0) 1 (0) 1 (0) 1 (0) 2 S 0 ρ + z ρ + z ρ + z ρ + z Z ∞  1 1 1 1 1 1  + cN 3Tr ρ(0) ρ ρ + ρ ρ dz (= cb N 3) S (0) 1 (0) 2 (0) (0) 2 (0) 1 (0) 3 S 0 ρ + z ρ + z ρ + z ρ + z ρ + z ρ + z 3 + o(NS), (A40)

∞ 1 P R s (NS ) (0) where ρk = |A| ϕ˜∈A Eϕ˜[σk]. Here, we have used that 0 (s+z)2 dz = 1 and that ρ − ρ is traceless in order to conclude that the first line of√ Eq. (A39√) is zero. Next, we prove that b2 ≤ 0. We have that R ∞ ρ(0) ρ(0) ρ(0)+z (0) b2 = −Tr 0 AzBzAzBzAzdz, with Az = ρ(0)+z ρ1 ρ(0)+z and Bz = ρ(0) , as ρ is full-rank. Therefore, we A6

have the bound Z ∞ 2 b2 = −Tr (AzBz) Azdz (A41) 0 Z ∞ ≤ −Tr Azdz = 0, (A42) 0 2 where we have used that (AzBz) ≥ 0 and that ρ1 is traceless.

We can now bound Dc regardless of the sign of b3, by using Eq. (A33), as c = 1 includes the Gaussian case. In fact, 3 3 assume that b3 ≥ 0, then Dc = DGauss + (c − 1)b3NS + o(NS). We can use Eq. (A33) and the Taylor’s remainder 2 2 2 (1−η ) NS 2 theorem to conclude that D0≤c≤1 ≤ 2 2 . Assume that b3 < 0, then we have that Dc ≤ b1N by the 2NB η (1+NB η ) S 2 2 2 2 3 (1−η ) NS Taylor’s remainder theorem. In addition, we have that the bound DGauss = b1N + O(N ) ≤ 2 2 S S 2NB η (1+NB η ) (1−η2)2 holds for any NS > 0, which implies that b1 ≤ 2 2 . 2NB η (1+NB η ) √ 4 N η2(1+N η2)δ Therefore, if we choose N ≤ B √B , then we have that P (Eve) ≥ 1 − δ over n channel usages. S (1−η2)2 n 2 √ ⊗n ⊗n 4 η2N (1+η2N ) (NS ) (0) 2 B B √δ [Converse] We now prove that D(ρ , ρ ) ≤ 8δ implies that NS ≤ (1−η2)2 n . Let us consider (k) (k) Eve’s modesw ˆ← andw ˆ→ , k = 1, . . . , n. Let us these modes be the output of a black-box which has the knowledge of the individual realizations ofϕ ˜k. The black-box acts as a beamsplitter, generating the modes r r (k) η 1 wˆ = wˆ(k) + e−iϕ˜k wˆ(k) (A43) 1 1 + η → 1 + η ← r r (k) 1 η wˆ = − wˆ(k) + e−iϕ˜k wˆ(k). (A44) 2 1 + η → 1 + η ←

(k) We then trace-out the modesw ˆ2 . Notice that

(k) p 2 (k) −iϕ˜k ˆ(k) wˆ1 = − 1 − η aˆS e + η h , (A45) q q ˆ(k) η ˆ(k) 1 −iϕ˜k ˆ(k) where h = 1+η h→ + 1+η e h← is in a thermal state with NB average number of photons, regardless of (k) the value ofϕ ˜k. Since Eve does not have the knowledge of the phaseϕ ˜k anda ˆS are i.i.d., the state of the modes (k) (NS ) wˆ1 does not depend on k. Let us denote its density matrix as σ . Here, NS = 0 in the off -setting and NS > 0 in the on-setting. We have that ⊗n ⊗n ⊗n ⊗n D(ρ(0) , ρ(NS ) ) ≥ D(σ(0) , σ(NS ) ), (A46) which comes from the monotonicity of the quantum relative entropy under CPTP maps. This reduces the calculation to the one-way case. Following the proof of Theorem 1 in Ref. [A8], we find that

⊗n ⊗n n(1 − η2)2N 2 (0) (NS ) S 2 D(σ , σ ) ≥ 2 2 + o(NS). (A47) 2η NB(1 + η NB)

Solving for NS ends the proof. Lemma1 implies the square-root law, provided that Alice and Bob share a codebook. Notice that the error probability of reading one wrong bit is

m Perr = 1 − (1 − perr) ≤ mperr (A48) √ where perr is the single-bit receiver error probability. This automatically means that a number m = O( n/ log n) bits 1 2 NS are reliably transmissible. In fact, we have that perr ≤ exp (−Mβη ) for M large enough. Here, β = 4 for the 2 1+NB TMSV state and SC state transmitters with the optimal collective receiver, β = 2 for the TMSV state and SC state transmitter with the optimal√ local receiver, and β = 1 for the coherent state transmitter with a homodyne detector 4 N η2(1+N η2)δ B √B receiver. By setting NS = (1−η2)2 n , with n = mM, we get √ m  n P ≤ exp −4c βδη4 , (A49) err 2 B m A7

√ A n NB √ 4  √ where cB = 1+N . By setting m = A with A = 4δη cBβ, we have that Perr ≤ A ≤ , for small B log  log n log  log n enough . We can use the results in Refs. [A4, A7] for AWGN channels in order to get a better scaling for the decoding error probability. This is Theorem3 of the main text.

2 1+NB Proof of Theorem3. Let us define σβ = 2βη2M . In the optimal local protocol case, the induced AWGN channel for 2 2 M  1 has a variance σβ=2. For the coherent state case, the induced AWGN channel for any M has a variance σβ=1. In the optimal collective protocol case, we can induce a AWGN channel by dividing M into K  1 slots of M/K samples each, and apply the optimal collective protocol on each of the K slots. This provides the same asymptotic 2 performance for the receiver as long as M/K  1. The resulting AWGN channel has σβ=4 variance. In all cases, we can follow the derication of Theorem 1.2 of Ref. [A7] to upper bound the error probability for transmittingm ¯ bits over m modes averaged over a uniformly distributed codebook in a AWGN channel as

m¯ − mNS +O(1) π log(2)σ2 Perr ≤ 2 β ≡ P, (A50) √ 4 N η2(1+N η2)δ NB B √B n where cB = and the bound holds for MNS = o(1). By setting NS = 2 2 and M = , we get 1+NB (1−η ) n m

m NS log2 P ' m¯ − 2 (A51) π log 2 σβ m 8pN η2(1 + N η2)δ βη2n/m B √ B =m ¯ − 2 2 (A52) π log 2 (1 − η ) n 1 + NB 8 √ ≤ m¯ − c βδη4 n. (A53) π log 2 B

8 4√ By settingm ¯ = π log 2 cBβδη n + log2 , we get that P ≤ . As this calculation holds for a random codebook, it 8 4 implies that there exists a specific codebook achieving this performance. Renaming βdet = β and βcov = π log 2 cBβη concludes the proof.

APPENDIX C: SIGNAL-TO-NOISE RATIO OF THE SCHRODINGER’S¨ CAT STATE RECEIVER

Here, we quantify the performance of the circuit QED implementation of Oˆτ in terms of the signal-to-noise ratio.

ˆ ˆ † ˆ Taylor expansion of Oτ : We first expand Uτ |eihe|Uτ with respect to the parameter τ:

h i τ 2 h i Uˆ †|eihe|Uˆ = |eihe| + τ aˆ† σˆ− − aˆ σˆ+, |eihe| + aˆ† σˆ− − aˆ σˆ+, [ˆa† σˆ− − aˆ σˆ+, |eihe|] + o(τ 2). (A54) τ τ R R 2! R R R R We have that

h † − + i † − + ˆ aˆRσ − aˆRσˆ , |eihe| =a ˆRσˆ +a ˆRσˆ ≡ E1 (A55) and

† − + ˆ † − + † [ˆaRσˆ − aˆRσˆ , E1] = 2[ˆaRσˆ , aˆRσˆ ] = −2|eihe| − 2ˆσzaˆRaˆR (A56)

− + where σz = |eihe| − |gihg| and we have used that [ˆσ , σˆ ] = −σˆz. By applying the unitary evolution Sˆ(r)ˆσx to each ± ∓ ˆ † ˆ 0 of the terms, and using the relationsσ ˆxσˆ σˆx =σ ˆ ,σ ˆxσˆzσˆx = −σˆz and S(r) aˆRS(r) =a ˆR, we obtain

2 2 Oˆτ = |gihg| + τOˆopt + τ Aˆ + o(τ ), (A57)

ˆ 0† 0 2 ˆ where A = −|gihg| +σ ˆzaˆRaˆR. This holds for τ hAiρη,φ=0,π  1. In the NS  1, NB  1 regime, this means roughly 2 τ  1/NB. A8

SNR estimation: We compute the SNR up to the second order in τ, obtaining

2 ˆ ˆ 2 τ (hOoptiρη,φ=0 − hOoptiρη,φ=π ) Q ˆ ' (A58) Oτ (λ − λ2 ) + τ 2[∆Oˆ2 − 2h|gihg|( +a ˆ0†aˆ0 )i − 2λ2 hAˆi2 ] + + opt I R R ρη,φ=0 + ρη,φ=0  τ 2  = Q ˆ , (A59) Oopt a + τ 2(1 + b) where ∆Oˆ2 = hOˆ2 i − hOˆ i2 , a = (λ − λ2 )/∆Oˆ2 , and b = −[2λ2 hAˆi2 + 2h|gihg|( + opt opt ρη=0 opt ρη=0 + + opt + ρη,φ=0 I aˆ0†aˆ0 )i ]/∆Oˆ2 . Here, we have used the approximation hOˆ2 i − hOˆ i2 ' hOˆ2 i − hOˆ i2 holding R R ρη,φ=0 opt opt ρη=0 opt ρη=0 opt ρη,φ opt ρη,φ for any value of φ in the η  1 limit. In the NS  1 and NB  1 regime, we have that a ' NS/NB and b ' −4NS. 2 a ˆ If τ  1+b , then the SNR of Oτ is close to the optimal one. In the NB  1 regime, this happens whenever 2 ˆ τ  NS/NB. Therefore,√ any value NS/NB  τ  1/NB approximates Oτ to the optimal observable. For instance, 2 ∗2 by setting τ = NS/ NB = τ , we have that

Q ˆ a Oτ∗ ' 1 − − b (A60) Q τ 2 Oˆopt 1 ' 1 − √ + 4NS. (A61) NB

APPENDIX D: QUBIT DECOHERENCE

In this section, we show how the decoherence affects the qubit measurements. We are assuming a Markovian noise γ + − ˆ ˆ ˆ† 1 ˆ† ˆ described by the Lindblad operator LD/~ = 2 D[ˆσz] + Γ↑D[ˆσ ] + Γ↓D[ˆσ ], where D[L]ρ = (LρL − 2 {L L, ρ}). In ˆ † ˆ ˆ † order to do so, we solve the equation ∂tO = LDO for different O defining a basis in the qubit Hilbert space, with LD being the dual of LD. The linearity of the time-translation operator allows us to find the solution for general qubit observables. Lemma A4. We have that

h Γ↑+Γ↓ i tL† − − γ+ t − e D σˆ = e 2 σˆ (A62)

† h i Γ − Γ tL −(Γ↑+Γ↓)t −(Γ↑+Γ↓)t ↑ ↓ e D σˆz = e σˆz + 1 − e I. (A63) Γ↑ + Γ↓ Proof. The relations can be derived by simply checking the action of the decoherence generators on the operator of † γ † + † − † † ˆ † ˆ 1 † ˆ interest. Notice that LD = 2 D[ˆσz] + Γ↑D[ˆσ ] + Γ↓D[ˆσ ] , where D[L] O = L OL − 2 {L L, O}. We have that

† − − D[ˆσz] σˆ = −2ˆσ (A64) σˆ− D[ˆσ+]†σˆ− = − (A65) 2 σˆ− D[ˆσ−]†σˆ− = − , (A66) 2

† ∞ tkL†k tLD P D from which Eq. (A62) follows trivially using e = k=0 k! . We have that

† D[ˆσz] σˆz = 0 (A67) + † D[ˆσ ] σˆz = 2|gihg| (A68) − † D[ˆσ ] σˆz = −2|eihe|, (A69)

† † †k from which it follows that LDσˆz = −(Γ↑ + Γ↓)ˆσz + (Γ↑ − Γ↓)I. By using that LDI = 0, we infer that LD σˆz = k k k−1 k−1 (−1) (Γ↑ + Γ↓) σˆz + (−1) (Γ↑ + Γ↓) (Γ↑ − Γ↓)I, k = 1, 2,... Eq. (A63) follows trivially.  −1 −1 Γ↑+Γ↓ ˆ − † Therefore, we have that T1 = (Γ↑ + Γ↓) and T2 = γ + 2 . As Oopt = σ (λ+aˆ + λ−aˆ ) + c.c. is linear in − + dec −2t/T σˆ and σ , we have that Q /Q ˆ = e 2 , which is Eq. (32) of the main text. Oˆopt Oopt A9

∗ [email protected] [A1] J. Calsamiglia, R. Mu˜noz-Tapia, Ll. Masanes, A. Acin, and E. Bagan, “Quantum Chernoff bound as a measure of distinguishability between density matrices: Application to qubit and Gaussian states”, Phys. Rev. A 77, 032311 (2008). [A2] M. Sanz, U. Las Heras, J. J. Garcia-Ripoll, E. Solano and R. Di Candia, “Quantum Estimation Methods for Quantum Illumination”, Phys. Rev. Lett. 118, 070803 (2017). [A3] M. Paris, “Quantum Estimation for Quantum Technology”, Int. J. Quant. Inf. 7, 125 (2009). [A4] B. A. Bash, A. H. Gheorghe, M. Patel, J. L. Habif, D. Goeckel, D. Towsley, and S. Guha, “Quantum-secure covert communication on bosonic channels”, Nat. Comm. 6, 8626 (2015). [A5] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications”, Nat. Comm. 8, 15043 (2017). [A6] K. P. Seshadreesan, L. Lami, and M. M. Wilde, “Renyi relative entropies of quantum Gaussian states”, J. of Math. Phys. 59, 072204 (2018). [A7] B. A. Bash, D. Goeckel, and D. Towsley, “Limits of Reliable Communication with Low Probability of Detection on AWGN Channels”, IEEE Journal on Selected Areas in Communications, Vol. 31, no. 9, pp. 1921-1930 (2013). [A8] M. S. Bullock, C. N. Gagatsos, S. Guha, and Boulat A. Bash, “Fundamental limits of quantum-secure covert communication over bosonic channels”, IEEE Journal on Selected Areas in Communications, vol. 38, no. 3, pp. 471-482 (2020).