Choice of Mutually Unbiased Bases and Outcome Labelling Affects

Choice of mutually unbiased bases and outcome labelling aﬀects measurement outcome secrecy

Mirdit Doda,1, 2 Matej Pivoluska,1, 3 and Martin Plesch1, 3 1Institute of Physics, Slovak Academy of Sciences, 845 11 Bratislava, Slovakia 2Institute for Quantum Optics and Quantum Information - IQOQI Vienna, Austrian Academy of Sciences, Boltzmanngasse 3, 1090 Vienna, Austria 3Institute of Computer Science, Masaryk University, 602 00 Brno, Czech Republic (Dated: March 11, 2021) Mutually unbiased bases (MUBs) are a crucial ingredient for many protocols in quantum information processing. Measurements performed in these bases are unbiased to the maximally possible extent, which is used to prove randomness or secrecy of measurement results. In this work we show that certain properties of sets of MUBs crucially depend on their speciﬁc choice, including, somewhat surprisingly, measurement outcome labelling. If measurements are chosen in a coherent way, the secrecy of the result can be completely lost for speciﬁc sets of MUB measurements, while partially retained for others. This can potentially impact a broad spectrum of applications, where MUBs are utilized.

I. INTRODUCTION The natural question of the number of unbiased bases in a given dimension d turned out to be unexpectedly One of the defining features of quantum mechanics is complicated. While the answer is rather simple for qubits the impossibility to simultaneously measure a certain set – there are three pairwise mutually unbiased bases, de- of physical quantities. This fact led to the definition of fined as eigenvectors of Pauli σx, σy, σz operators up the famous Heisenberg uncertainty principle [1] or under- to unitary equivalencies, in general, the construction of standing of the quantum model of hydrogen atom [2]. If a MUBs is a very difficult task. It is known that the num- simultaneous measurement of two quantities is not possi- ber of MUBs has to be smaller than d + 1 for any di- ble, or, in other words, if a measurement of one quantity mension and the constructions of d + 1 MUBs are known r influences the expectation of the other measurement, we for d = p , where p is a prime. However, for non-prime- call these two measurements incompatible. In this con- power d only the trivial tensor product construction is text a very natural question arises – how much incom- known. patible a pair of measurements can be? The answer to Fortunately, in many applications one needs to use only this question is simple – for any quantum system, one k ≤ d+1 MUB measurements. Clearly, there are different can find a pair of measurements where irrespective of the ways to pick the subset of k out of all MUBs. In fact, it starting state of the system, after performing one of the is known that different sets of MUBs are not necessarily measurements the result of the other one is completely equivalent under different mathematical operations, such random. as global unitary operations, changing individual vector A straightforward generalization is at hand – can one phases, relabelling of outcomes, relabelling of moments or form a larger set of measurements that are pairwise fully introducing complex conjugation [27]. This mathemati- incompatible? Here again one can answer affirmatively – cal inequivalence is however irrelevant in many practical for each system one can find at least three such measure- applications where just satisfying the defining property ments and the size of this set depends on the dimension (1) is required for the task. of the system. More interestingly, it was recently shown that differ- In order to tackle with these questions more formally, ent subsets of MUBs of can be inequivalent operationally the notion of mutually unbiased bases (MUBs) [3–6] was as well. For example, MUBs turn out to be an optimal arXiv:2006.08226v2 [quant-ph] 10 Mar 2021 introduced. Two d-dimensional bases {|ψii}i=0,...,d−1 strategy in a communication task called quantum ran- and {|ϕji}j=0,...,d−1 corresponding to two full projective dom access coding (QRAC) [28]. measurements are mutually unbiased, when In [29] it was shown that in a certain variant of QRAC, different subsets of k out of d + 1 MUBs lead to differ- 1 ∀i, j : |hψi|ϕji| = √ . (1) ent strategies with different average success rates. More d recently, it was shown that different subsets of k out of Due to their properties, mutually unbiased bases have d + 1 MUBs behave differently under a measure called become an important cornerstone of contemporary quan- incompatibility robustness [30]. Last but not least, very tum information processing [7]. They are being used specific MUBs are required to obtain Bell inequalities for quantum tomography [4,6], uncertainty relations [22], which are maximally violated by maximally entan- [5,8,9], quantum key distribution [10–13], quantum er- gled states and MUBs. ror correction [14], as well as for witnessing entanglement The full definition of a measurement consist of specify- [15–21], design of Bell inequalities [22, 23] and more gen- ing the basis as a set of states and labelling these states. eral forms of quantum correlations [24–26]. Two measurements consisting of the same set of states 2 are in principle different, even if they measure the same † property and their results can be classically transformed ρB a at any later stage. From the experimental and opera- Ui tional point of view it makes sense to distinguish between different measurements that only differ in labelling (we call this a classical difference) and two measurements that differ in the states per se (quantum difference). One can then naturally ask, to what extent the properties of ρC Mb b MUBs do change if one only makes a classical change in them. In other words, do the properties of the subsets change by simple re-labelling of their vectors? In FIG. 1. Guessing game description. Alice measures the probe this work, we affirmatively answer this question by intro- state ρB with one out of d possible measurements. Alice’s ducing a quantum information task called guessing game. measurements choice is implemented coherently, via a controlled unitary Pd−1 U † ⊗ |iihi|, where U † maps the basis There a subset of d out of d+1 MUBs is used to hide and i=0 i i guess information between two parties. We show that vectors of the i-th basis onto the computational basis. Alice then measures in the computational basis and her outcome is this simple choice of removing a single MUB from the denoted a. Bob’s goal is to guess Alice’s outcome by prepar- full set critically affects achievable results in the game. ing a probe state ρB and an optimal measurement described Even more interestingly, for a suitable chosen subset of d−1 by POVM elements {Mb}b=0 , through which he obtains his d out of d + 1 MUBs, we observe the full spectrum of guess b. Bob wins when b = a. In the classical coin case, results – perfect guessing and maximal hiding – just by the control state ρC is fully mixed , and in the quantum coin relabelling the measurement outcomes. case, ρC is a superposition of computational basis vectors.

II. RESULTS shown that for qubits (d = 2), in the quantum coin scenario Bob can guess Alice’s outcome with certainty. In The incompatibility of measurements can be demon- contrast, this was not the case for higher dimensions. strated and examined with the help of a very simple They have concluded that in case of two measurements quantum game, studied in [31, 32]. Here Alice realizes the control state is always a two dimensional state and it one of m possible measurements on a d-dimensional sys- is impossible to use it to determine a higher dimensional tem and records the result a of this measurement. The outcome. task of Bob is to guess this result using the following In [32] we have further analyzed the guessing game strategy: first, he prepares the state for Alice to be mea- with the quantum coin and we have shown that for sured and second, he receives information about which qubits, with any number of measurements (independent measurement was performed (see the next section for the on their level of compatibility) it is always possible for full definition of the guessing game). Bob to obtain the result of Alice with probability 1. In If the game is described by classical physics, a pure contrast, for higher dimensions this is not the case, so state has a determined outcome for all possible mea- even if Bob receives a large enough control state, he will surements. Therefore, trivially, Bob can prepare a state not be able to guess the result perfectly for a specific set which leads to a deterministic outcome irrespective on of MUBs chosen by Alice. measurement performed by Alice. Here we analyze the problem further. We fix the num- One can make the scenario partially quantum, by mak- ber of measurements to m = d, which will make the size ing Bob’s probe state as well as the measurements quan- of the measurement outcomes alphabet equal to the di- tum, but keep the information about the measurement mension of the control state available to Bob. First we chosen by Alice classical – we call this a classical coin study quantum coin scenario with this choice for different scenario. This is the traditional way to demonstrate in- sets of d MUBs and for each prime d we construct a set of compatibility of quantum measurements – for compati- d MUBs, which allow Bob to guess Alice’s measurement ble measurements Bob still can guess with certainly, but outcomes with certainty. Further, with a combination of with increasing incompatibility of the measurements the exhaustive search for d = 3 and d = 5 and numerical uncertainty of his guess increases. methods for higher dimensions we study Bob’s guessing In a fully quantum scenario – called quantum coin sce- probability with different sets of d MUB measurements. nario – depicted in Figure (1), both the probe state and We consider MUBs obtained by choosing d out of d + 1 the information about the measurement chosen are quan- MUBs from standard Wootters-Fields (WF) construction tum. Here Alice realizes the chosen measurement by first (see [6] and equation (3)) followed by relabelling of their applying a coherently controlled unitary, followed by a vectors in order to obtain different measurements. measurement in a standard basis. Bob receives the con- Strikingly, both the lowest and the highest guessing trol state and can use it to determine Alice’s outcome. probabilities we observe are achieved by excluding the The authors of [31] have analyzed the guessing game computational basis from d + 1 WF bases and imposing for two specific MUB measurements (m = 2). They have different labelling of measurement outcomes to the rest of 3 bases – original WF labelling leads to the lowest guessing prepares a coherent superposition of two basis states of probabilities while our construction, which is yet another the two possible measurements of Alice) and yields the outcome relabelling of this set of MUBs, leads to perfect guessing probability of 1 1 + √1 , for the higher dimen- guessing probability. More broadly, our study goes far 2 2 sional variant of the game the situation is much more beyond the study of the guessing game itself, as it shows complicated. In AppendixC we derive an upper bound that different sets of d out of d + 1 MUBs, which only in the form 1 1 + d√−1 valid for any set of MUBs (this differ in a classical sense (i.e. by relabelling), exhibit very d d different operational properties. includes relabelling, since it does not influence the Bob’s guessing probability in the classical coin scenario), which converges to 0 for high d. Furthermore, for the set of III. GUESSING GAME MUBs defined in (3) up to d = 7 we also obtain exact values. For higher d we provide numerical estimates that Here we give a formal definition of the guessing game show that the bound obtained is not tight. These results and define a set of d out of d + 1 MUB measurements show that without coherent information, with increas- which allows Bob to construct a perfect guessing strategy. ing d, Bob can only obtain negligible information about In the guessing game, Alice receives an initial state ρB of the result obtained by Alice irrespective on which set of dimension d prepared by Bob. She performs a coherently MUBs she uses. controlled unitary transformation CU defined by the set † d−1 of {Ua }a=0 controlled by the “coin” state ρC . In the quantum coin scenario the pure state ρC = |+ih+| is B. Quantum coin scenario d−1 used, where |+i = √1 P |ii, while in the classical d i=0 1 The situation is dramatically different for the quan- coin scenario a fully mixed state ρC = d is used. After the transformation, Alice measures the state ρ in the tum coin scenario, in which ρC = |+ih+|. First we show B that for a specific selection of MUBs it is possible for computational basis and sends the control state ρC to Bob, who also performs a general measurement defined Bob to obtain Alice’s result with certainty. To achieve d−1 this, Alice needs to select both the proper d WF MUBs, by POVM elements {Mb}b=0 to obtain his guess b. Bob wins if the results coincide. (quantum setting) and label the individual measurement The average guessing probability of Bob is defined as: basis vectors in a suitable way as well (classical setting). Specifically, if Alice chooses d WF bases without rela- d−1 belling, Bob can never achieve perfect guessing, as we X † Pg:= Tr (ρB ⊗ρC )CU (|aiha| ⊗ Ma) CU , (2) have shown in [32]. a=0 MUBs which result in Bob’s perfect guessing probability are defined as Although there are multiple constructions of MUBs for prime dimensions, to demonstrate our result we will use d−1 DPP 1 X ai2+ij−a2i a construction of Wootters and Fields (WF) [6]: Ua = √ ω |iihj|, (4) d i,j=0 d−1 1 2 WF X ai +ij which can be seen as relabelling of the vectors of the bases Ua = √ ω |iihj|. (3) d DPP WF 2 i,j=0 of the WF construction: Ua |ji = Ua j − a . Let us define Bob’s (pure) probe state |ψBi and mea- In prime dimension d, this construction defines d different d−1 surements {Ma}a=0 as: bases and can be supplemented by the computational basis to for the full set of d + 1 MUBs. There are d + 1 d−1 1 X 3d−2k3 different ways to select the set of d bases. Additionally, |ψBi = √ ω |ki , d for each set of d bases we will consider relabelling of the k=0 vectors which allows us to construct additional sets of d |φaihφa| Ma = , (5) measurements used in the guessing game. hφa|φai d−1 1 X |φ i := √ hj| U † |ψ i |ai , A. Classical coin scenario a a B d a=0

In the case of a classical coin state, we have that where |φji are unnormalized pure states. In the Ap- 1 d−1 ρC = d . Clearly, this is equivalent to Alice choosing the pendixB we show that {Ma}a=0 form a projective mea- measurement uniformly at random and Bob then receiv- surement. Subsequently we show that such measurement ing the information about which measurement was cho- allows Bob to guess perfectly Alice’s measurement out- sen. Based on this information he has to guess the result comes if used in conjunction with the probe state |ψBi. obtained by Alice. While for qubits the optimal strategy Interestingly, if one of the WF bases is exchanged for for Bob is straightforward and easy to understand (he the computational basis (which corresponds to a quan- 4 tum diﬀerence), there is no way for Bob to achieve per- Pg fect guessing for any labelling of the individual measure- 1.0 ◆▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ments. In other words, if the computational basis is in- ●■ ◆ cluded in the set of MUBs used, we have strong numerical 0.8 ◆ evidence that Alice can retain some secrecy towards Bob ●■ ◆ irrespective of the labelling used; for dimensions 3 and 5 ◆ ◆ 0.6 ◆ ◆ ■ ◆ this can be shown by exhaustive search over all the pos- ● sible relabellings, for higher dimensions we performed a ●■ 0.4 ● CLB randomized search (see AppendixD for details). ■ ● ■ ■ CUB ● ■ ■ ● ■ ● 0.2 ◆ QLB ● ▲ IV. OPTIMAL HIDING IN THE QUANTUM QUB COIN CASE d 2 3 5 7 11 13 17 19 23

We have shown that if Bob can influence the choice of FIG. 2. Here we depict the bounds of the guessing probabil- MUBs used by Alice, he can perfectly guess her outcome. ity for the classical and quantum coin for different dimensions. It is thus very natural to ask the complementary question The quantum coin upper bound (QUB) is analytical and equal – if Alice can retain full control about her measurements, to 1. For d up to 5 the quantum coin lower bounds (QLB) what is the maximum Bob can learn about her outcome? are over all relabelling (permutations), for higher dimensions And how does this maximum depend on the quantum over all cyclic permutation topped up by a random search. setting of her measurements and actual labelling? For d up to 7 the classical coin lower bounds (CLB) are tight and obtained by an exhaustive search. The classical upper To answer this question fully, one would have to search bounds (CUB) are obtained via matrix inequalities. through all possible MUBs including their labelling and find optimal values. To keep the task tractable, first we have focused on the standard WF set of MUBs plus the computation basis (leading to d+1 possibilities) plus pos- of the quantum coin, the maximal and minimal guess- sible relabellings expressed via permutation matrices Pπ, which relabel the computational basis states and leave ing probability discovered with our numerical methods the MUB property intact: change with the choice of both measurement bases and their labelling, making it critically important for Alice to

† 1 † carefully choose the MUBs used in the guessing game. hi| Ua Ub |ji = √ = hi| PπUa UbPπ0 |ji . d An analysis of the actual MUBs that lead to the obtained minimum guessing probability sheds some light on Due to the intractably large number of combinations, for the problem. Surprisingly, it turned out that the mini- dimensions higher than 5 we first restricted ourselves to mal guessing probabilities we found are obtained for the cyclic permutation matrices. On top of it, we have also standard WF construction of MUBs {U WF}d−1. So in tested randomly a large set of non-cyclic permutation a a=0 the case when Alice can make her choice of the measure- matrices. ments, including the labelling, it is best for her to select For a fixed set of MUBs, we cast the problem as a see- the standard construction to minimize the knowledge of saw SDP [33](see AppendixA for details), which allows Bob. At the same time we could see that the perfect us to obtain a lower-bound on Pg. We have randomized guessing by Bob was achieved for the DPP construction the initial point and repeated the optimization to obtain (4), which only differs from the WF construction by rela- the lower bounds as depicted in Figure (2). As a last step, belling – i.e. boundary values we found are achieved for to look a bit behind the strict limit of WF construction MUBs that differ only by labelling. and its relabelling, we applied the see-saw algorithm to unitaries close to the MUBs in the space of unitary matri- On the contrary, if the computational basis is included ces. In all cases we obtained values higher than the WF into the system by exchanging it with any of the WF construction; this shows that the found values constitute bases, we have strong numerical evidence that neither (at least) a local minimum in the space of unitary matri- Bob can perfectly guess the outcome, nor Alice can hide ces, while the search over permutation matrices suggests it as well as in the WF case. This suggests that the set of that they constitute a global minimum over the space of d WF constructed bases including its relabelling is struc- MUB unitary matrices as well. turally different than any set where the computational While the obtained minima decrease with the dimen- basis is used with d − 1 WF bases. It is worth mention- sion, they stay far above the upper bounds of the classi- ing that this fact is not connected to the computation cal coin scenario. Thus it is clear that irrespective of the basis itself. One can find sets of MUBs containing com- selection of measurements by Alice, obtaining coherent putation basis that exhibit the same properties as the information about her measurement allows Bob to take WF or DPP set respectively, but the remaining bases are a more accurate guess. At the same time, in the case not given by the WF construction. 5

V. DISCUSSION be the result of the following optimization:

d−1 In our work we have shown, using a simple quan- max X † Pg = max TrAB (ρB ⊗ρC )CU(|aiha|⊗Ma)CU tum mechanical game, that different choices of mutually d−1 ρB ,{Ma}a=0 unbiased bases have dramatic effects on experimentally a=0 achievable results. Interestingly, for any prime dimension s.t. ρB ≥ 0 d one can choose a set of d MUBs that provide the pos- TrρB = 1 sibility of perfect guessing by Bob of the result obtained Ma ≥ 0 ∀a ∈ {0, . . . , d − 1} by Alice in the quantum coin scenario. At the same time, d−1 X we obtained a strong numerical evidence that with a set M = 1, of MUBs that differs only by relabelling of the individ- a a=0 ual vectors, Alice can obtain the maximum hiding of her (A1) result the game allows. This result is very striking on its own, as it shows a very where the optimization variables are Bob’s probe state interesting and deep structure of the seemingly simple ρB and Bob’s POVM elements Ma corresponding to the construction of MUBs. Even though all of the bases look outcome a. Also recall that ρC is the control state rep- very similar in its mathematical form, the subtle phase resenting the choice of measurements, and CU is a con- interdependences allow for some of the subsets to deliver trolled unitary used to implement Alice’s measurement truly different results than others. settings coherently. The target function of this optimiza- More than that, the result is interesting from a prac- tion problem is non-linear, therefore it cannot be solved tical viewpoint as well. While it might be considered as directly by Semi-Definite Programming (SDP). We therefore cast it as two SDPs, which we run alternatively. In very artificial to introduce a quantum control of the mea- d−1 surement chosen by Alice, this is in fact the way how such the first SDP we optimize over {Ma}a=0 with ρB constant and in the second one we optimise over ρB while a control works for instance on the IBM quantum com- d−1 puter, where no classical control is available [34]. In the {Ma}a=0 are constant: future design of quantum security elements it is possible that due to technological reasons, quantum controls will be a standard procedure. In such a case, it will be very SDP 1: given ρB important to carefully consider the design of the quan- d−1 tum part so that the selected MUBs are not only secure 1 X {M }d−1 = arg max hi| M |ji ha| U †ρ U |ai as designed, but are (reasonably) secure even in the case a a=0 a j B i {M }d−1 d of coherent control and possible relabelling. a a=0 i,j,a=0 s.t. Ma ≥ 0 ∀a ∈ {0, . . . , d − 1} d−1 X Ma = 1 a=0

ACKNOWLEDGMENTS

SDP 2: given {M }d−1 Acknowledgements. We would like to thank Flavien a a=0 d−1 Hirsch and Marco TúlioQuintino for innitial discus- 1 X † sions and MátéFarkas and Jed Kaniewski for discus- ρB = arg max hi| Ma |ji ha| Uj ρBUi |ai ρB d sions about MUBs. We acknowledge funding from VEGA i,j,a=0 project 2/0136/19. MPi and MPl additionally acknowl- s.t. ρB ≥ 0 edge GAMU project MUNI/G/1596/2019. TrρB = 1,

where we simpliﬁed the notation with

d−1 X † Appendix A: Optimization Algorithm TrAB (ρB ⊗ρC )CU (|aiha| ⊗ Ma) CU = a=0 d−1 Given a MUB construction encoded by the unitaries 1 X † d−1 hi| Ma |ji ha| Uj ρBUi |ai , {Ua} , we want to estimate the associated optimal d a=0 i,j,a=0 strategy that Bob can use to guess Alice’s outcomes in the quantum coin scenario. The optimal strategy would 6

d−1 for Here we show that {Ma}a=0 is indeed a valid POVM, Pd−1 d−1 i.e. Ma ≥ 0 ∀a and a=0 Ma = 1. Positivity is guar- X † anteed by definition. To prove summation to identity we CU = Ui ⊗ |iihi|, i=0 notice that Ma are projectors and span the Hilbert space d−1 n |φj i o ρC = |+ih+|, of Bob if k|φ ik form an orthonormal basis. Nor- j j=0 d−1 1 X malization is guaranteed by definition, so it remains to |+i = √ |ii . prove orthogonality: d i=0 d−1 1 X The two SDPs are each guaranteed to converge, the hφ |φ i = hj| U † |ψ i hψ | U |ii = i j d a B B a see-saw, however must stop at a ‘convergence parameter’ a=0 −6 ε that we set to be 10 ; explicitly, the see-saw algorithm d−1 1 X 2 2 d−2 3 d−2 3 2 2 is the following: = ω−(ak +jk−a k)ω3 k ω−3 l ωal +il−a l d3 a,k,l=0 Algorithm 1 See-saw d−1 1 X 2 2 d−2 3 d−2 3 2 2 1: Initialization: Generate a random density matrix ρ0, = ω−ak −jk+a k+3 k −3 l +al +il−a l. distributed according to the Hilbert-Schmidt measure. d3 a,k,l=0 Set PW = 0. 2: POVM optimization: Given ρ0, solve the SDP with d−1 ∗ d−1 {Ma}a=0 as variable, and find the solution {Ma }a=0. ∗ d−1 1. Dimensions larger than 3 3: State optimization: Given {Ma }a=0 from step 2, solve ∗ the SDP with ρB as variable, and find the solution ρB ∗ and PW . In what follows, we will show that for d > 3 (d = 3 4: Convergence check: and d = 2 are treated separately) the above expression ∗ ∗ ∗ can be simplified using quadratic Gauss sums. In order • If PW − PW > ε, then set ρ0 = ρB and PW = PW . Repeat from step 2. to do so, we will manipulate the exponents of ω. The d ∗ key idea is to realize that since ω = 1 , we can work • If PW − PW < ε, stop the algorithm. The complete ∗ ∗ ∗ d−1 with its exponent modulo d. Additionally, we introduce solution is given by P , ρ , {Ma } . W B a=0 a substitution:

The algorithm is then applied to a large number of m = l + k and n = l − k, initial random points ρ0. We observed that for ε small ∗ and two constants enough it yields always the same result PW , suggesting that the see-saw algorithm lower bounds tightly the so- α = 3d−2 ≡ 3−1 (mod d) lution of (A1). β = 2d−2 ≡ 2−1 (mod d).

Appendix B: Optimal strategy From these deﬁnitions it follows that l ≡ β(m + n) (mod d), In the DDP construction we considered Al- 3α ≡ 1 (mod d), ice’s MUB measurements deﬁned as Ua = d−1 2 2 √1 P ωai +ij−a i|iihj|. Bob’s optimal strategy k ≡ β(m − n) (mod d), d i,j=0 in this case is: 2β ≡ 1 (mod d), 2 2 d−1 l − k ≡ mn (mod d), 1 X 3d−2k3 |ψBi = √ ω |ki , il − jk ≡ βm(i − j) + βn(i + j) (mod d), d k=0 l3 − k3 ≡ β2n(3m2 + n2) (mod d). |φaihφa| Ma = , hφa|φai We will also use the quadratic Gauss sum: d−1 √ 1 X † d−1 ( m |φai = √ hj| U |ψBi |ai , X 2 εd d if m 6≡ 0 (mod d) d a ωa m = d , a=0 d if m ≡ 0 (mod d) a=0

where m is the Legendre symbol: d−1 d where |ψBi is Bob’s (pure) probe state and {Ma}a=0 are ( POVM elements of the measurement he uses on the probe m 1 if ∃n : m ≡ n2 (mod d) state ρC = |+ih+| to guess Alice’s outcome. Note that = , d −1 if @n : m ≡ n2 (mod d) states |φai are not normalized. 7 and bility Pg = 1:

2. Dimension 3 where the second equality follows from the fact that (a − βm)2 iterates over the same values (mod d) as a2. Above we have shown that Bob can guess with prob- Substituting this expression in the previous one, we ob- ability one for d > 3. For the case d = 2 the optimal tain: strategy can be found in [31]. For d = 3, the proof needs to be adapted due to the fact that a multiplicative inverse 2πi (mod 3) of 3 does not exist; we then use ω = e 3 for Al- d−1 d−1 2 2 1 X βm(i−j) √1 P ai +ij−a i ice’s MUB construction Ua = i,j=0 ω |iihj| hφi|φji = 3 ω d d 2πi m=0 and with ω9 = e 9 we deﬁne Bob’s strategy as: "d−1 √ # X −n −αβ2n3+βn(i+j) × εd d ω +d = d |φaihφa| n=1 Ma = , " d−1 # hφa|φai δij εd X n (d−2) 3 √ 12 n −nj 2 = ω + 1 , 1 X † d d d |φai = √ hj| U |ψBi |ai , n=1 d a (B1) a=0 2 1 X k3 |ψBi = √ ω |ki , d 9 which shows that they are orthogonal as requested. We k=0 then show that this construction gives a guessing proba- 8

The proof follows exactly the same steps of B1, with all With these deﬁnitions we can state the problem as fol- the substitutions remaining valid, with the exception of lows:

c Pg := k3−l3 −β2n(3m2+n2) d−1 ω9 = ω9 X 1 = max Tr ρ ⊗ CU(|kihk|⊗M ) CU † 2 2 2 3 AB B k −β m n −β n ρ ,{M }d−1 d = ω ω9 B k k=0 k=0 −β2m2n −7n3 d−1  = ω ω9 , 1 X † = max max Tr  ρBUj|njihnj|Uj  ρB n0,n1,...,nd d j=0 where we made use of the fact that β = 5 is the mul- d−1  1 X † tiplicative inverse of 2 (mod 3) and (mod 9). We then = max Tr  ρBUj|n˜(j)ihn˜(j)|Uj  d ρB get j=0

d−1  1 X = λ U |n˜(j)ihn˜(j)|U † . " 2 # d max  j j  δij ε3 X n 3 hφ |φ i = √ ω7n −3nj + 1 , j=0 i j 3 d 9 3 n=1

where λmax[T ] is the largest eigenvalue of a matrix T . concluding the proof. For small dimensions, the maximum probability can be found by evaluating all possible mappingsn ˜(j) (there are dd of them). This however quickly becomes infeasible, therefore we look for an upper boound:

 d−1  c 1 X † Pg = 1 + λmax  Uj|n˜(j)ihn˜(j)|U − 1 ; Appendix C: Classical coin d j j=0

to simplify the notation we deﬁne In the classical case, the control state is a computational basis vector |ii, chosen uniformly at random, which 1 T := U |n˜(j)ihn˜(j)|U † − , selects the measurement used by Alice via controlled uni- j j j d tary CU. Therefore, it contains full information about d−1 X the basis Alice measures in, which can be obtained by T := Tj, Bob performing a measurement in computational basis. j=0 Any other measurement by Bob only introduces extra entropy to this information via uncertainty principle and which satisfy the following properties: thus decreases Bob’s guessing probability. Bob’s optimal guessing strategy is therefore a simple projection onto the Tr(Tj) = 0 ∀j ∈ {0, . . . , d − 1}, † computational basis, which reveals Alice’s measurement Tr(Ti Tj) = 0 ∀i 6= j ∈ {0, . . . , d − 1}, basis i, followed by a mapn ˜(i) that associates to each d − 1 basis i the most probable outcome of Alice for that ba- Tr(T 2) = ∀j ∈ {0, . . . , d − 1}, j d sis. Note that this also means that the maximum guess-  d−1  ing probability in the classical scenario does not depend 2 X † on the labelling of the outcomes, since the labelling does Tr(T ) = Tr  Ti Tj not change the probability of the most probable outcome. i,j=0 Formally: d−1 d−1 X † X † = Tr Ti Ti + Tr Ti Tj i=0 i,j=0 i6=j n˜(i) := arg max PA(j|Ui), j∈{0,...,d−1} = d − 1. † PA(j|Ui) = Tr ρBUi|jihj|Ui , d−1 The guessing probability with a classical coin can be then X Mi = |iihi|. expressed as i=0:˜n(i)=j 1 P c : = (1 + λ [T ]) . g d max 9

Since T is trace-less and Hermitian, its largest eigenvalue d = 2, 3, 5, 7, obtaining exact bounds for these dimen- is positive. We then use the following inequality: sions. In other dimensions lower bounds were obtained by applying the see-saw algorithm (A) with ρC = 1/d 2 2 2 T and randomized initial points. This algorithm tends to Tr(T ) = λmax [T ] Tr 2 λmax [T ] get stuck in local maxima; however in the dimensions in which we could perform the extensive search we observed 2 2 ≥ λmax [T ] 1 + min Tr(S ) that the see-saw algorithm returned the maximum value S∈M :TrS=−1 d−1 more often then by a random sampling ofn ˜ in the space 1 = λ2 [T ] 1 + of maps Zd → Zd. max d − 1 d = λ2 [T ] ; max d − 1 where we denoted the space of Hermitian matrices of or- 2 der d − 1 by Md−1. Substituting the trace of T we get 2. Quantum coin the desired upper bound: d − 1 For the quantum coin, for the convergence parameter λmax [T ] ≤ √ , −6 d ε small enough (10 ) we didn’t observe convergences to local maxima diﬀerent from the global maximum. c 1 d − 1 Pg ≤ 1 + √ . Diﬀerently from the classical case, the choice of unitaries d d changes the value of the maximum. We then search for the smallest such value among all possible unitary constructions. The space over which we search is given by Appendix D: Numeric search choosing d + 1 unitaries out of the d + 1 available from the WF construction, and by relabeling, i.e. applying 1. Classical coin a permutation matrix to each unitary. For d = 3, 5 we searched over all possible permutations, for d = 7 we only When considering a classical coin, the optimal strategy considered cyclic permutations, while for higher dimen- is given by searching over all possible mapsn ˜ : Zd → Zd sion we randomly sampled over the space of permutation and taking the largest eigenvalue of the matrix T = matrices. Each search is performed for all d + 1 choices Pd−1 † d j=0 Uj|n˜(j)ihn˜(j)|Uj − 1. There are d such map- of unitaries. We observed that the WF unitaries give the pings, and we could perform this extensive search for lowest value when the excluded unitary is the identity.

[1] W. Heisenberg, Zeitschrift fur Physik 43, 172 (1927). [12] H. Bechmann-Pasquinucci and N. Gisin, Phys. Rev. A [2] N. B. D. phil., The London, Edinburgh, and Dublin 59, 4238 (1999). Philosophical Magazine and Journal of Science 26, 1 [13] L. Sheridan and V. Scarani, Phys. Rev. A 82, 030301 (1913), https://doi.org/10.1080/14786441308634955. (2010). [3] J. Schwinger, Proceedings of the Na- [14] A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. tional Academy of Sciences 46, 570 (1960), Sloane, Phys. Rev. Lett. 78, 405 (1997). https://www.pnas.org/content/46/4/570.full.pdf. [15] Y. Huang, Phys. Rev. A 82, 012335 (2010). [4] I. D. Ivonovic, Journal of Physics A: Mathematical and [16] C. Spengler, M. Huber, S. Brierley, T. Adaktylos, and General 14, 3241 (1981). B. C. Hiesmayr, Phys. Rev. A 86, 022311 (2012). [5] K. Kraus, Phys. Rev. D 35, 3070 (1987). [17] L. Maccone, D. Bruß, and C. Macchiavello, Phys. Rev. [6] W. K. Wootters and B. D. Fields, Annals of Physics 191, Lett. 114, 130401 (2015). 363 (1989). [18] E. C. Paul, D. S. Tasca, L. Rudnicki, and S. P. Walborn, [7] T. DURT, B.-G. ENGLERT, I. BENGTSSON, Phys. Rev. A 94, 012303 (2016). and K. ZYCZKOWSKI,˙ International Jour- [19]J. Reháˇcek,Z.ˇ Hradil, A. B. Klimov, G. Leuchs, and nal of Quantum Information 08, 535 (2010), L. L. Sánchez-Soto, Phys. Rev. A 88, 052110 (2013). https://doi.org/10.1142/S0219749910006502. [20] P. Erker, M. Krenn, and M. Huber, Quantum 1, 22 [8] H. Maassen and J. B. M. Uffink, Phys. Rev. Lett. 60, (2017). 1103 (1988). [21] J. Bavaresco, N. Herrera Valencia, C. Klöckl, M. Pivo- [9] M. A. Ballester and S. Wehner, Phys. Rev. A 75, 022319 luska, P. Erker, N. Friis, M. Malik, and M. Huber, Nature (2007). Physics 14, 1032 (2018). [10] N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, [22] J. Kaniewski, I. Supić,J.ˇ Tura, F. Baccari, A. Salavrakos, Phys. Rev. Lett. 88, 127902 (2002). and R. Augusiak, Quantum 3, 198 (2019). [11] H. Bechmann-Pasquinucci and N. Gisin, Phys. Rev. A [23] A. Tavakoli, M. Farkas, D. Rosset, J.-D. Bancal, and 67, 062310 (2003). J. Kaniewski, arXiv e-prints , arXiv:1912.03225 (2019), 10

arXiv:1912.03225 [quant-ph]. [31] F. Rozpedek, J. Kaniewski, P. J. Coles, and S. Wehner, [24] P. Skrzypczyk and D. Cavalcanti, Phys. Rev. A 92, New Journal of Physics 19, 023038 (2017). 022354 (2015). [32] M. Plesch and M. Pivoluska, New Journal of Physics 20, [25] D. Sauerwein, C. Macchiavello, L. Maccone, and 023018 (2018). B. Kraus, Phys. Rev. A 95, 042315 (2017). [33] M. Laurent and F. Rendl, in Discrete Optimization, [26] A. C. S. Costa, R. Uola, and O. G¨uhne, Phys. Rev. A Handbooks in Operations Research and Management Sci- 98, 050104 (2018). ence, Vol. 12, edited by K. Aardal, G. Nemhauser, and [27] S. Brierley, S. Weigert, and I. Bengtsson, Quantum In- R. Weismantel (Elsevier, 2005) pp. 393 – 514. formation & Computation 10, 803 (2010). [34] An example of using coherent control instead [28] M. Farkas and J. m. k. Kaniewski, Phys. Rev. A 99, of classical is given on qiskit tutorial on quan- 032316 (2019). tum teleportation. URL: https://qiskit.org/ [29] E. A. Aguilar, J. J. Borkala, P. Mironowicz, and textbook/ch-algorithms/teleportation.html#4. M. Paw lowski, Phys. Rev. Lett. 121, 050501 (2018). 1-IBM-hardware-and-Deferred-Measurement-. [30] S. Designolle, P. Skrzypczyk, F. Fr¨owis,and N. Brunner, Phys. Rev. Lett. 122, 050402 (2019).