Arxiv:1511.04857V1 [Quant-Ph] 16 Nov 2015 2

Entropic Uncertainty Relations and their Applications

Patrick J. Coles∗ Institute for Quantum Computing and Department of Physics and Astronomy, University of Waterloo, N2L3G1 Waterloo, Ontario, Canada Mario Berta† Institute for Quantum Information and Matter, California Institute of Technology, Pasadena, CA 91125, USA Marco Tomamichel‡ School of Physics, The University of Sydney, Sydney, NSW 2006, Australia Stephanie Wehner§ QuTech, Delft University of Technology, 2628 CJ Delft, Netherlands

Heisenberg’s uncertainty principle forms a fundamental element of quantum mechanics. Uncertainty relations in terms of entropies were initially proposed to deal with conceptual shortcomings in the original formulation of the uncertainty principle, and hence play an important role in quantum foundations. More recently, entropic uncertainty relations have emerged as the central ingredient in the security analysis of almost all quantum cryptographic protocols, ranging from quantum key distribution to two-party quantum cryptography. This review surveys entropic uncertainty relations that capture Heisenberg’s idea that the results of incompatible measurements are impossible to predict, covering both ﬁnite- and inﬁnite-dimensional measurements. These ideas are then extended to incorporate quantum correlations between the observed object and its environment, allowing for a variety of recent, more general formulations of the uncertainty principle. Finally various applications are discussed, ranging from entanglement witnessing to wave-particle duality to quantum cryptography.

CONTENTS 2. Rényi entropies8 3. Examples and properties9 I. Introduction2 B. Preliminaries 10 A. Scope of this review5 1. Physical setup 10 2. Mutually unbiased bases 10 II. Relation to Standard Deviation Approach5 C. Measuring in two orthonormal bases 10 A. Position and momentum uncertainty relations5 1. Shannon entropy 10 B. Finite spectrum uncertainty relations6 2. Rényi entropies 11 C. Advantages of entropic formulation6 3. Proof of Maassen-Uﬃnk 11 1. Counterintuitive behavior of standard deviation6 4. Tightness and extensions 11 arXiv:1511.04857v1 [quant-ph] 16 Nov 2015 2. Intuitive entropic properties7 5. Tighter bounds for qubits 11 3. Framework for classical and quantum systems7 6. Tighter bounds in arbitrary dimension 12 4. Operational meaning and information 7. Tighter bounds for mixed states 12 applications7 D. Arbitrary measurements 12 E. State-dependent measures of incompatibility 13 III. Uncertainty without a Memory System8 F. Relation to guessing games 14 A. Entropy measures8 G. Multiple measurements 15 1. Surprisal and Shannon entropy8 1. Bounds implied by two measurements 15 2. Mutually unbiased bases 15 3. Measurements in random bases 17 4. BB84 and six state measurements 17 5. General sets of measurements 18 ∗ [email protected] † 6. Anti-commuting measurements 18 [email protected] 7. Mutually unbiased POVMs 19 ‡ [email protected] H. Fine-grained uncertainty relations 19 § [email protected] I. Majorization approach to entropic uncertainty 20 2

1. Majorization approach 20 3. Noisy-storage model 47 2. From majorization to entropy 20 4. Uncertainty in other protocols 47 3. Measurements in random bases 21 D. Entanglement witnessing 48 4. Extensions 21 1. Shannon entropic witness 48 2. Other entropic witnesses 49 IV. Uncertainty given a Memory System 21 E. EPR steering inequalities 49 A. Classical versus quantum memory 21 F. Wave-particle duality 50 B. Background: Conditional entropies 22 G. Quantum metrology 50 1. Classical-quantum states 22 H. Other applications in quantum information theory 51 2. Classical-quantum entropies 22 1. Coherence 51 3. Quantum entropies 23 4. Properties of entropy 24 2. Discord 51 C. Classical memory uncertainty relations 24 3. Locking of classical correlations 52 D. Bipartite quantum memory uncertainty relations 25 4. Quantum Shannon theory 52 1. Guessing game with quantum memory 25 2. Measuring in two orthonormal bases 25 VII. Miscellaneous Topics 53 3. Arbitrary measurements 27 A. Tsallis and other entropy functions 53 4. Multiple measurements 27 B. Certainty relations 53 5. Complex projective two-designs 28 C. Measurement uncertainty 54 6. Measurements in random bases 29 1. State-independent measurement-disturbance 7. BB84 and six state measurements 29 relations 54 8. General sets of measurements 30 2. State-dependent measurement-disturbance E. Tripartite quantum memory uncertainty relations 30 relations 55 1. Uncertainty relation with quantum memory 30 2. Proof of quantum memory uncertainty relations 30 VIII. Perspectives 56 3. Quantum memory tightens the bound 31 4. Tripartite guessing game 32 Acknowledgments 56 5. Extension to Rényi entropies 32 6. Arbitrary measurements 32 A. Mutually unbiased bases 56 F. Mutual information approach 33 1. Connection to Hadamard matrices 57 1. Information exclusion principle 33 2. Existence 57 2. Classical memory 33 3. Simple constructions 57 3. Stronger bounds 33 4. Quantum memory 34 B. Proof of Maassen-Uffink’s Shannon entropy relation 57 5. A conjecture 34 G. Quantum channel formulation 34 C. Rényi entropies for joint quantum systems 58 1. Bipartite formulation 34 1. Definitions 58 2. Static-dynamic isomorphism 35 2. Entropic properties 58 3. Tripartite formulation 35 a. Positivity and monotonicity 59 b. Data-processing inequalities 59 V. Position-Momentum Uncertainty Relations 36 c. Duality and additivity 59 A. Entropy for infinite-dimensional systems 36 3. Axiomatic proof of uncertainty relation with 1. Shannon entropy for discrete distributions 36 quantum memory 59 2. Shannon entropy for continuous distributions 37 B. Differential relations 37 References 60 C. Finite-spacing relations 37 D. Uncertainty given a memory system 38 1. Tripartite quantum memory uncertainty relations 38 2. Bipartite quantum memory uncertainty relations 39 3. Mutual information approach 39 I. INTRODUCTION E. Extension to min- and max-entropy 40 1. Finite-spacing relations 40 Quantum mechanics has revolutionized our under- 2. Differential relations 40 standing of the world around us. Relative to classical F. Other infinite-dimensional measurements 40 mechanics, the most revolutionary change in our under- VI. Applications 41 standing is that the quantum world — our world — is in- A. Quantum randomness 41 herently unpredictable. 1. The operational significance of conditional min-entropy 41 By far the most famous statement of unpredictability 2. Certifying quantum randomness 42 is Heisenberg’s uncertainty principle (Heisenberg, 1927), B. Quantum key distribution 42 which we treat here as a statement about preparation 1. A simple protocol 43 uncertainty. Roughly speaking, it states that it is impos- 2. Security criterion for QKD 43 3. Proof of security via an entropic uncertainty sible to prepare a quantum particle for which both posi- relation 43 tion and momentum are sharply defined. Operationally, 4. Finite size effects and min-entropy 44 consider a source that consistently prepares copies of a 5. Continuous variable QKD 45 quantum particle in the same way, as shown in Fig.1. For C. Two-party cryptography 45 1. Weak string erasure 45 each copy, suppose we randomly measure either its posi- 2. Bounded-storage model 46 tion or its momentum (but we never attempt to measure 3 both quantities for the same particle1). We record the outcomes and sort them into two sequences associated with the two different measurements. The uncertainty principle states that it is impossible to predict both the measure outcome of the position and the momentum measure- source Q ments: at least one of the two sequences of outcomes will be unpredictable. More precisely, the better such a preparation procedure allows one to predict the outcome measure of the position measurement, the more uncertain the out- P come of the momentum measurement will be, and vice FIG. 1 Physical scenario relevant to preparation uncertainty versa. relations. Each incoming particle is randomly measured using A beautiful aspect of quantum mechanics is that it either measurement P or measurement Q. An uncertainty re- allows for simple quantitative statements of this idea, i.e., lation says we cannot predict the outcomes of both P and Q. constraints on the predictability of observable pairs like If we can predict the outcome of P well, then we are necessar- position and momentum. These quantitative statements ily uncertain if measurement Q would have been performed are known as uncertainty relations. It is worth noting and vice versa. that Heisenberg’s original argument, while conceptually enlightening, was heuristic. The first, rigorously-proven uncertainty relation for position Q and momentum P is our studies of uncertainty in quantum mechanics should due to Kennard(1927). It establishes that (see also the be to find simple, conceptually insightful statements like work of Weyl(1928)) this, if they exist. If this problem was only of fundamental importance, ~ it would be a well-motivated one. Yet in recent years σQσP , (1) ≥ 2 there is new motivation to study the uncertainty principle. The rise of quantum information theory has led to where σ and σ denote the standard deviation of the Q P new applications of quantum uncertainty, for example in position and momentum, respectively, and is the re- ~ quantum cryptography. In particular quantum key dis- duced Planck constant. tribution is already commercially marketed and its secu- We now know that Heisenberg’s principle applies much rity crucially relies on Heisenberg’s uncertainty principle. more generally, not only to position and momentum. (We will discuss various applications in Sec.VI.) There Other examples of pairs of observables observing an un- is a clear need for uncertainty relations that are directly certainty relation include the phase and excitation num- applicable to these technologies. ber of a harmonic oscillator, the angle and the orbital In the above uncertainty relations, (1) and (2), uncer- angular momentum of a particle, and orthogonal compo- tainty has been quantified using the standard deviation nents of spin angular momentum. In fact, for arbitrary of the measurement results. This is, however, not the observables2, X and Z, Robertson(1929) showed that only way to express the uncertainty principle. It is in- 1 structive to consider what preparation uncertainty means σX σZ ψ [X,Z] ψ , (2) ≥ 2|h | | i| in the most general setting. Suppose we have prepared a state ρ on which we can perform two (or more) possible where [ , ] denotes the commutator. Note a distinct dif- measurements labeled by . Let us use to label the · · θ x ference between (1) and (2): the right-hand side of the outcomes of such measurement. We can then identify a former is a constant whereas that of the latter can be list of (conditional) probabilities state-dependent, an issue that we will discuss more in Sρ = p(x θ)ρ , (3) Sec.II. | x,θ These relations have a beauty to them and also give where p(x θ) denotes the probability of obtaining mea- conceptual insight. Equation (1) identifies as a fun- ρ ~ surement outcome| x when performing the measurement θ damental limit to our knowledge. More generally (2) on the state ρ. Quantum mechanics predicts restrictions identifies the commutator as the relevant quantity for on the set S of allowed conditional probability distribu- determining how large the knowledge tradeoff is for two ρ tions that are valid for all or a large class of states ρ. observables. One could argue that a reasonable goal in Needless to say, there are many ways to formulate such restrictions on the set of allowed distributions. In particular, information theory offers a very versatile abstract framework that allows us to formalize notions 1 Section I.A briefly notes other uncertainty principles that involve consecutive or joint measurements. like uncertainty and unpredictability. This theory is the 2 More precisely, Robertson’s relation refers to observables with basis of modern communication technologies and cryp- bounded spectrum. tography and has been successfully generalized to include 4 quantum effects. The preferred mathematical quantity to Alice Θ = Θ express uncertainty in information theory is entropy. En- Z Bob K tropies are functionals on random variables and quantum K? states that aim to quantify their inherent uncertainty.

Amongst a myriad of such measures, we mainly restrict X A ρ our attention to the Boltzmann–Gibbs–Shannon entropy A (Boltzmann, 1872; Gibbs, 1876; Shannon, 1948) and its Θ = quantum generalization, the von Neumann entropy (von Neumann, 1932). Due to their importance in quantum FIG. 2 Cartoon showing a guessing game with players Alice cryptography, we will also consider Rényi entropic mea- and Bob. First, Bob prepares A in state ρA and sends it to sures (Rényi, 1961) such as the min-entropy. Entropy is Alice. Second Alice measures either X or Z with equal prob- a natural measure of uncertainty, perhaps even more nat- ability and stores the measurement choice in bit Θ. Third, ural than the standard deviation, as we argue in Sec.II. Alice stores the measurement outcome in bit K and reveals the measurement choice Θ to Bob. Bob wins the game if he Can the uncertainty principle be formulated in terms can guess K (given Θ). Entropic uncertainty relations like of entropy? This question was first brought up by Everett the Maassen-Uffink relation (5) can be understood as funda- (1957) and answered in the affirmative by Hirschman mental constraints on the optimal guessing probability. (1957) who considered the position and momentum observables, formulating the first entropic uncertainty relation. This was later improved by Beckner(1975) and Białynicki-Birula and Mycielski(1975), who obtained the an observer (with access to the environment) below the relation3 usual bounds. To explain this extension, let us introduce a modern h(Q) + h(P ) log(eπ~) , (4) ≥ formulation of the uncertainty principle as a so-called where h is the differential entropy (defined in (7) below). guessing game, which makes such extensions of the un- Białynicki-Birula and Mycielski(1975) also showed that certainty principle extremely natural and highlights their (4) is stronger than, and hence implies, Kennard’s rela- relevance for quantum cryptography. As outlined in tion (1). Fig.2, we imagine that an observer, Bob, can prepare The extension of the entropic uncertainty relation to an arbitrary state ρA which he will send to a referee, Al- observables with finite spectrum4 was given by Deutsch ice. Alice then randomly chooses to perform one of two (1983), and later improved by Maassen and Uffink(1988) (or more) possible measurements, where we will use Θ following a conjecture by Kraus(1987). The result of to denote her choice of measurement. She records the Maassen and Uffink(1988) is arguably the most well- outcome, K. She then tells Bob the choice of her mea- known entropic uncertainty relation. It states that surement, i.e., she sends him Θ. Bob wins the game, if he correctly guesses Alice’s measurement outcome K. 1 H(X) + H(Z) log , (5) The uncertainty principle tells us that if Alice makes ≥ c two incompatible measurements, then Bob cannot guess where H is Shannon’s entropy, and c denotes the maxi- Alice’s outcome for both measurements. This corre- mum overlap between any two eigenvectors of the X and sponds precisely to the notion of preparation uncertainty. Z observables. Just as (2) established the commutator as It is indeed intuitive why such uncertainty relations form an important parameter in determining the uncertainty an important ingredient in proving the security of quan- tradeoff for standard deviation, (5) established the max- tum cryptographic protocols, as we will explore in detail imum overlap c as a central parameter in entropic uncer- in Sec.VI. In the cryptographic setting ρA will be sent tainty. by an adversary trying to break a quantum cryptographic While these articles represent the early history of en- protocol. If Alice’s measurements are incompatible, there tropic uncertainty relations, there has recently been an is no way for the adversary to know the outcomes of both explosion of work on this topic. One of the most impossible measurements with certainty - no matter what portant recent advances concerns a generalization of the state he prepares. uncertainty paradigm that allows the measured system to The formulation of uncertainty relations as guessing be correlated to its environment in a non-classical way. games also makes it clear that there is an important twist Entanglement between the measured system and the en- to such games: What if Bob prepares a bipartite state vironment can be exploited to reduce the uncertainty of ρAB and sends only the A part to Alice? That is, what if Bob’s system is correlated with Alice’s? Or, adopting the modern perspective of information, what if Bob has 3 Throughout this review, all logarithms are base 2. a non-trivial amount of side information about Alice’s 4 More precisely, the relation applies to non-degenerate observables system? Traditional uncertainty relations implicitly as- on a finite-dimensional Hilbert space (see Sec. III.B). sume that Bob has only classical side information. For 5 example, he may remember a classical description of the II. RELATION TO STANDARD DEVIATION APPROACH state ρA or other details about the preparation. However, modern uncertainty relations—for example those derived Traditional formulations of the uncertainty principle, by Berta et al. (2010) improving on work by Christandl for example the ones due to Kennard and Robertson, and Winter(2005) and Renes and Boileau(2009)—allow measure uncertainty in terms of the standard deviation. Bob to have quantum rather than classical information In this section we argue why we think entropic formu- about the state. As was already observed by Einstein lations are preferable. For further discussion we refer et al. (1935), it is possible for Bob to experience no un- to (Uffink, 1990). certainty at all in this case (in the sense that he can correctly guess Alice’s measurement outcome K in the game described above). A. Position and momentum uncertainty relations We will devote Sec.IV to such modern uncertainty For the case of position and momentum observables, relations. It is these relations that will be of central im- the strength of the entropic formulation can be seen from portance in quantum cryptography, where the adversary the fact that the entropic uncertainty relation in (4) is may have gathered quantum and not just classical infor- strictly stronger, and in fact implies, the standard devi- mation during the course of the protocol that may reduce ation relation (1). Following Białynicki-Birula and My- his uncertainty. cielski(1975), we formally show that 1 h(Q) + h(P ) log(eπ) = σQσP (6) ≥ ⇒ ≥ 2 A. Scope of this review for all states, where here and henceforth in this article we work in units such that ~ = 1. To see this, let us consider a random variable Q governed by a probability Two survey articles partially discuss the topic of en- density Γ(q) and the differential entropy tropic uncertainty relations. Bialynicki-Birula and Rud- nicki(2011) take a physics perspective and cover con- Z ∞ h(Q) = Γ(q) log Γ(q)dq . (7) tinuous variable entropic uncertainty relations and some − −∞ discretized measurements. In contrast, Wehner and Win- We assume that this quantity is finite in the following. ter(2010) take an information-theoretic perspective and Gaussian probability distributions, discuss entropic uncertainty relations for discrete vari- 2 ables with an emphasis on relations that involve more 1 (q q) Γ(q) = q exp − −2 , (8) than two measurements. 2 2σQ 2πσQ These reviews predate many recent advances in the field. For example, both reviews do not cover entropic where q denotes the mean, are special in the following uncertainty relations that take into account quantum cor- sense: for a fixed standard deviation σQ, distributions relations with the environment of the measured system. of the form of (8) maximize the entropy in (7). It is a Moreover, applications of entropic uncertainty relations straightforward exercise to show this, e.g., using varia- are only marginally discussed in both of these reviews. tional calculus with Lagrange multipliers. Here we discuss both physical and information-based ap- It is furthermore straightforward to insert (8) into (7) plications. We therefore aim to give a comprehensive to calculate the entropy of a Gaussian distribution q treatment of all of these topics in one reference, with the h(Q) = log 2πeσ2 (Gaussian) . (9) hope of benefiting some of the quickly emerging technolo- Q gies that exploit quantum information. Since Gaussians maximize the entropy, it follows that the There is an additional aspect of the uncertainty prin- following inequality holds in general ciple known as measurement uncertainty, see, e.g., Busch q h(Q) log 2πeσ2 (in general) . (10) et al. (2007, 2014a); Hall(2004); and Ozawa(2003). The ≤ Q latter includes (1) joint measurability, the concept that Now consider an arbitrary quantum state for a par- there exists pairs of observables that cannot be mea- ticle’s translational degree freedom, which gives rise to sured simultaneously and (2) measurement–disturbance, random variables P and Q for the position and momen- the concept that there exist pairs of observables for which tum respectively. Let us insert the resulting relations measuring one causes a disturbance of the other. Mea- into (4) to find surement uncertainty is still a highly debated topic of q q 2 2 current research. We focus our review article on the con- log(2πeσQσP ) = log 2πeσQ + log 2πeσP (11) cept of preparation uncertainty, although we briefly men- h(Q) + h(P ) (12) tion entropic approaches to measurement uncertainty in ≥ log(eπ) . (13) Sec. VII.C. ≥ 6

By comparing the left- and right-hand sides of (11), not- tain a state-independent bound using standard deviation ing that the logarithm is a monotonic function, we see uncertainty measures in the ﬁnite-dimensional case. For that (11) implies (1), and hence so does (4). example, Busch et al. (2014b) considered the qubit case It is worth noting that (10) is a strict inequality if the and obtained a state-independent bound on the sum of distribution is non-Gaussian, and hence (4) is strictly the variances. stronger than (1) if the quantum state is non-Gaussian. While quantum mechanics textbooks often present (1) as the fundamental statement of the uncertainty princi- C. Advantages of entropic formulation ple, it is clear that (4) is stronger and yet not much more complicated. Furthermore, as discussed in Sec.IV the en- From a practical perspective, a crucial advantage of tropic formulation is more robust, allowing the relation to entropic uncertainty relations are their applications all be easily generalized to situations involving correlations throughout quantum cryptography. However, let us now with the environment. mention several other reasons why the entropic formulation of the uncertainty principle is advantageous over the standard deviation formulation. B. Finite spectrum uncertainty relations

As noted above, both the standard deviation and the 1. Counterintuitive behavior of standard deviation entropy have been applied to formulate uncertainty relations for observables with a finite spectrum. However, It has been pointed out by several authors, for exam- it is largely unclear how the most popular formulations, ple by Bialynicki-Birula and Rudnicki(2011), that the Robertson’s (2) and Maassen-Uffink’s (5), are related. It standard deviation behaves somewhat strangely for some remains an interesting open question whether there exists simple examples. a formulation that unifies these two formulations. There is an important difference between (2) and (5) in that Example 2. Consider a spin-1 particle with equal prob- the former has a bound that depends on the state, while ability Pr(sz) = 1/3 to have each of the three possi- the latter only depends on the two observables. ble values of Z-angular momentum, sz 1, 0, 1 . The standard deviation of the Z-angular momentum∈ {− } is p Example 1. Consider (2) for the case of a qubit, where σZ = 2/3. Now suppose we gain information about the X = 0 1 + 1 0 and Z = 0 0 1 1 , corresponding spin such that we now know that it definitely does not | ih | | ih | | ih | − | ih | to the x- and z-axes of the Bloch sphere. Then the com- have the value sz = 0, and the new probability distribu- mutator is proportional to the Y Pauli operator and the tion is Pr(1) = Pr( 1) = 1/2, Pr(0) = 0. We might right-hand side of (2) reduces to (1/2) Y . Hence (2) expect the uncertainty− to decrease, since we have gained h i gives a trivial bound for all states that lie in the xz plane information about the spin, but in fact the standard de- of the Bloch sphere. For the eigenstates of X and Z, viation increases, the new value being σZ = 1. this bound is tight since one of the two uncertainty terms is zero, and hence the trivial bound is a (perhaps un- We remark that the different behavior of standard de- desirable) consequence of the fact that the left-hand side viation and entropy for spin angular momentum was re- involves a product (rather than a sum) of uncertainties. cently highlighted by Dammeier et al. (2015), in the con- However, for any other states in the xz plane, neither text of states that saturate the relevant uncertainty rela- uncertainty is zero. This implies that (2) is not tight for tion. these states. Bialynicki-Birula and Rudnicki(2011) noted an example for a particle’s spatial position that is analogous to This example illustrates a major weakness of Robert- the above example. son’s relation for finite dimensional systems — it gives trivial bounds for certain states, even when the left-hand Example 3. Consider a very long box of length L, cen- side is non-zero. This point was noted, e.g., by Deutsch tered at x = 0, with two very small boxes of length a (1983) and used as motivation for entropic uncertainty re- attached to the two ends of the long box, as depicted in lations, which do not suffer from this weakness. However, Fig.3. Suppose we know that a classical particle is con- we should note that Schrödinger(1930) slightly strength- fined to the two small end boxes, i.e., with equal probabil- ened Robertson’s bound by adding an additional state- ity it is one of the two small boxes. The standard devia- dependent term that helps to get rid of the artificial triv- tion of the position is σx L/2, assuming that L a. ial bound discussed in Ex.1. Likewise, Maccone and Pati Now suppose the barriers that≈ separate the end boxes from (2014) recently proved a state-dependent bound on the the middle box are removed, and the particle is allowed to on the sum (not the product) of the two variances, and move freely between all three boxes. Intuitively one might this bound also removes the trivial behavior of Robert- expect that the uncertainty of the particle’s position is son’s bound. Furthermore, one still may be able to ob- now larger, since we now know nothing about where the 7

a L a of the random relabeling as due to the fact that the observer is denied access to an auxiliary register that stores the information about which relabeling occurred. If the observer had access to the register, then their uncertainty x = 0 would remain the same, but without access their uncertainty could potentially increase, but never decrease! FIG. 3 Illustration for Ex.3, where a particle is initially con- More generally, this idea, that losing access to an aux- fined to the two small boxes at the end and excluded from the iliary system cannot reduce one’s uncertainty, is a de- long middle box, and then the particle is allowed to go free into the middle box. sirable and powerful property of uncertainty measures known as the data-processing inequality. It is arguably a defining property of entropy measures, or more precisely, conditional entropy measures as discussed in Sec. IV.B. particle is inside the three boxes. However the new stan- Furthermore this property is central in proving entropic dard deviation is actually smaller: σx L/√12. ≈ uncertainty relations (Coles et al., 2012). Entropies on the other hand do not have this counterintuitive behavior, due to properties discussed below. Finally, let us note a somewhat obvious issue that, in 3. Framework for classical and quantum systems some cases, a quantitative label (and hence the standard deviation) does not make sense, as illustrated in the fol- Entropy provides a robust mathematical framework lowing example. that can be generalized to deal with correlated quantum systems. For example, the entropy framework al- Example 4. Consider a neutrino’s flavor, which is of- lows us to discuss the uncertainty of an observable from ten modeled as a three-outcome observable with outcomes the perspective of an observer who has access to part of “electron”, “muon”, or “tau”. As this is a non-quantitative the environment of the system, or to quantify quantum observable, the standard deviation does not make sense in correlations like entanglement between two quantum sys- this context. Nevertheless, it is of interest to quantify the tems. This requires measures of conditional uncertainty, uncertainty about the neutrino flavor, i.e., how difficult namely conditional entropies. We highlight the utility it is to guess the flavor, which is naturally captured by of this framework in Sec.IV. A similar framework for the notion of entropy. standard deviation has not been developed.

2. Intuitive entropic properties 4. Operational meaning and information applications Deutsch(1983) emphasized that the standard devia- Perhaps the most compelling reason to consider en- tion can change under a simple relabeling of the out- tropy as the uncertainty measure of choice is that comes. For example, if one was to assign quantitative it has operational significance for various information- labels to the outcomes in Ex.4, and then relabel them, processing tasks. The standard deviation, in contrast, the standard deviation would change. In contrast, the en- does not play a significant role in information theory. tropy is invariant under relabeling of outcomes, because This is because entropy abstracts from the physical rep- it naturally captures the amount of information about a resentation of information, as one can see from the fol- measurement outcome. lowing example. Furthermore, there is a nice monotonic property of entropy in the following sense. Suppose one does a Example 5. Consider the two probability distributions random relabeling of the outcomes. One can think of in Fig.4. They have the same standard deviation but this as a relabeling plus added noise, which naturally very different entropy. The distribution in Fig. 4(a) has tends to spread the probability distribution out over the one bit of entropy since only two events are possible and outcomes. Intuitively, a relabeling with the injection occur with equal probability. If we want to record data of randomness should never decrease the uncertainty. from this random experiment this will require exactly one This property — non-decreasing under random relabel- bit of storage per run. On the other hand, the distribution ing — was highlighted by Friedland et al. (2013) as a in Fig. 4(a) has approximately 3 bits of entropy and the desirable property of an uncertainty measure. Indeed, recorded data cannot be compressed to less than 3 bits entropy satisfies this property. On the other hand, the per run. Clearly, entropy has operational meaning in this physical process in Ex.3 can be modeled mathematically context while standard deviation fails to distinguish these as a random relabeling and hence we see the contrast in random experiments. behavior between entropy and standard deviation. Monotonicity under random relabeling is actually a Entropies have operational meaning for tasks such as special case of an even more powerful property. Think randomness extraction (extracting perfect randomness 8

variable X with the outcome of a particular measurement. This random variable can take values X = x, where x is a specific instance of a measurement outcome that can be obtained with probability PX (X = x). How- ever, entropies only depend on the probability law PX and not on the specific labels of the elements in the set . Thus, we will in the following just assume this set X (a) low entropy distribution (b) high entropy distribution to be of the form [d] := 1, 2, 3, . . . , d , where d = X stands for the cardinality{ of the set .} | | FIG. 4 Two probability distributions with the same standard X deviation but different entropy, as in Ex.5. 1. Surprisal and Shannon entropy from a partially random source) and data compression Following Shannon(1948), we first define the surprisal (sending minimal information to someone to help them of the event X = x distributed according to P as guess the output of a partially random source). It is X log PX (x), often also referred to as information con- precisely these operational meanings that make entropic −tent. As its name suggests, the information content of uncertainty relations useful for proving the security of X = x gets larger when the event X = x is less likely, quantum key distribution and other cryptographic tasks. i.e. when PX (x) is smaller. In particular, determinis- We discuss such applications in Sec.VI. tic events have no information content at all, which is The operational significance of entropy allows one to indeed intuitive since we learn nothing by observing an frame entropic uncertainty relations in terms of guessing event that we are assured will happen with certainty. In games, see Sec. III.F and IV.D.1. These are simple yet in- contrast, the information content of very unlikely events sightful tasks where, e.g., one party is trying to guess the can get arbitrarily large. Based on this intuition, the outcome of another party’s measurements. Such games Shannon entropy is defined as make it clear that the uncertainty principle is not just abstract mathematics; rather it is relevant to physical X 1 tasks that can be performed in a laboratory. H(X) := PX (x) log , (14) x PX (x)

and quantifies the average information content of X. It III. UNCERTAINTY WITHOUT A MEMORY SYSTEM is therefore a measure of the uncertainty of the outcome of the random experiment described by X. The Shannon Historically, entropic uncertainty relations were first entropy is by far the best-known measure of uncertainty studied for position and momentum observables. How- and it is the one most commonly used to express uncer- ever, to keep the discussion mathematically simple we tainty relations. begin here by introducing entropic uncertainty relations for finite-dimensional quantum systems, and we defer the discussion of infinite dimensions to Sec.V. It is worth 2. Rényi entropies noting that many physical systems of interest are finite- dimensional, such as photon polarization, neutrino flavor, However, for some applications it is important to con- and spin angular momentum. sider other measures of uncertainty that give more weight In this section, we consider uncertainty relations where to events with high or low information content, respec- we measure a single preparation ρA. That is, there is tively. For this purpose we employ a generalization of no memory system. We emphasize that all uncertainty the Shannon entropy to a family of entropies introduced relations with a memory system can also be applied to by Rényi(1961). The family includes several important the situation without. We will not list these special cases special cases which we will discuss individually. These here, but refer to SectionIV. entropies have found many applications in cryptography and information theory (see Sec.VI), and have many convenient mathematical properties.5 A. Entropy measures

Let us consider a discrete random variable X distributed according to the probability distribution . PX 5 Another family of entropies that are often encountered are the We assume that X takes values in a ﬁnite set . For X Tsallis entropies (Tsallis, 1988). They have not found opera- example, this set could be binary values 0, 1 or spin tional interpretation in cryptography or information theory, and states , . In general, we will associate{ the} random we thus defer the discussion of Tsallis entropies until Sec. VII.A. {↑ ↓} 9 H (X) 6.0 0 3. Examples and properties

H1/2(X) 5.0 For all the Rényi entropies, Hα(X) = 0 if and only if H(X) 4.0 the distribution is perfectly peaked, i.e., PX (x) = 1 for some particular value x. On the other hand, the distribu- −1 tion PX (x) = X is uniform if and only if the entropy 3.0 | | takes its maximal value Hα(X) = log X . H (X) H (X) entropy, in bits α 2 | | 2.0 The Rényi entropies can take on very different values Hα(U) depending on the parameter as the following example H∞(X) α visualized in Fig.5 shows. 0.5 1.0 1.5 2.0 4.0 ¥ α Example 6. Note that the Rényi entropies for different FIG. 5 Rényi entropies of X in Ex.6 with |X| = 65 compared values of α can be very different. To see this, consider a to a uniform random variable U on 4 bits. distribution of the form ( 1 for The Rényi entropy of order α is defined as 2 x = 1 PX (x) = 1 (19) 2(|X|−1) else 1 X α Hα(X) := log PX (x) 1 α so that we have − x for α (0, 1) (1, ) , (15) H (X) = log 2 , whereas ∈ ∪ ∞ min 1 and as the corresponding limit for α 0, 1, . For H(X) = log 2 + log( X 1) (20) α = 1 the limit yields the Shannon entropy∈ { 6,∞} and the 2 | | − Rényi entropies are thus a proper generalization of the is arbitrarily large as X 2 increases. This is of Shannon entropy. particular relevance in| cryptographic| ≥ applications where The Rényi entropies are monotonically decreasing as a Hmin(X) — and not H(X) — characterizes how difficult function of α. Entropies with α > 1 give more weight to it is to guess a secret X. As we will see later, Hmin(X) events with high surprisal. determines precisely the number of random bits that can The collision entropy, Hcoll := H2, is given by be obtained from X.

H (X) = log p (X) , where Consider two probability distributions, PX and QY , coll − coll X 2 and define d = max X , Y . Now let us reorder the pcoll(X) := PX (x) (16) {| | | |} ↓ ↓ probabilities in PX into a vector P such that P (1) x X X ≥ P ↓ (2) ... P ↓ (d), padding with zeros if necessary. is the collision probability, i.e. the probability that two X ≥ ≥ X Analogously arrange the probabilities in QY into a vector independent instances of X are equal. The min-entropy ↓ QY . We say PX majorizes QY and write PX QY if Hmin := H∞, is of special significance in many applica- y y tions. It characterizes the optimal probability of correctly X X P ↓ (x) Q↓ (x), for all y [d] . (21) guessing the value of X in the following sense X ≥ Y ∈ x=1 x=1 Hmin(X) = log pguess(X) , where − Intuitively, the fact that PX majorizes QY means that PX pguess(X) := max PX (x) . (17) x is less spread out than QY . For example, the distribution 1, 0,..., 0 majorizes every other distribution, while the Clearly, the optimal guessing strategy is to bet on the uniform{ distribution} X −1,..., X −1 is majorized by most likely value of X, and the winning probability is every other distribution.{| | | | } then given by the maximum in (17). The min-entropy One of the most fundamental properties of the Rényi can also be seen as the minimum surprisal of X. entropy is that it is Schur-concave (Marshall et al., 2011), The Rényi entropies with α < 1 give more weight to meaning that it satisfies events with small surprisal. Noteworthy examples are the max-entropy, H := H1 , and Hα(X) Hα(Y ) if PX QY . (22) max /2 ≤ This has an important consequence. Let for H0(X) = log x : PX (x) > 0 , (18) Y = f(X) { } some (deterministic) function f. In other words, Y is where the latter is simply the logarithm of the essential obtained by processing X using the function f. The ran- support of . PX dom variable Y is then governed by the push forward QY of PX , that is X 6 It is a simple exercise to apply L’Hôpital’s rule to (15) in the QY (y) = PX (x) . (23) limit α → 1. x:f(x)=y 10

Clearly PX QY and thus we have Hα(X) Hα(Y ). In addition, a set of n orthonormal bases Xj is said to ≺ ≥ { } This corroborates our intuition that the input of a func- be a set of n MUBs if each basis Xj is mutually unbiased tion is at least as uncertain as its output. If Z is just a to every other basis Xk, with k = j, in the set. reordering of X, or more generally if f is injective, then 6 the two entropies are equal. Example 7. For a qubit the eigenvectors of the Pauli operators, Finally we note that if two random variables X and Y are independent, we have σ := 0 1 + 1 0 (28) X | ih | | ih | H (XY ) = H (X) + H (Y ) . (24) σ := i 0 1 + i 1 0 (29) α α α Y − | ih | | ih | σ := 0 0 1 1 (30) This property is called additivity. Z | ih | − | ih | form a set of 3 MUBs. B. Preliminaries In App.A we discuss constructions for sets of MUBs in higher dimensional spaces. We also point to Durt et al. 1. Physical setup (2010) for a review on this topic. The physical setup used throughout the remainder of this section is as follows. We consider a quantum system, C. Measuring in two orthonormal bases A, that is measured in either one of two (or more) bases. The initial state of the system A is represented by a den- 1. Shannon entropy sity operator, ρA, or more formally a positive semidefinite operator with unit trace acting on a finite-dimensional Based on the pioneering work by Deutsch(1983) and Hilbert space A. The measurements, for now, are given following a conjecture of Kraus(1987), Maassen and by two orthonormal bases of A. An orthonormal basis is Uffink(1988) formulated entropic uncertainty relations a set of unit vectors in A that are mutually orthogonal for measurements of two complementary observables. and span the space A. The two bases are denoted by sets Their best known relation uses the Shannon entropy to of rank-1 projectors, quantify uncertainty. It states that, for any state ρA,

n x x o n z z o 1 X = X X and Z = Z Z . (25) H(X) + H(Z) log =: qMU , (31) | ih | x | ih | z ≥ c We use projectors to keep the notation consistent as we where the measure of incompatibility is a function of the will later consider more general measurements. This in- maximum overlap of the two measurements, namely duces two random variables, X and Z corresponding to x z 2 the measurement outcomes that result from measuring c = max cxz, where cxz = X Z . (32) x,z |h | i| in the bases X and Z, respectively. These are governed by the following probability laws, given by the Born rule. Note that qMU is state-independent, namely independent We have of the initial state ρA. This is in contrast to Robertson’s x x z z bound in (2). PX (x) = X ρA X and PZ (z) = Z ρA Z , (26) h | | i h | | i The bound qMU becomes non-trivial as long as X and respectively. We also note that X = Z = d, which is Z do not have any vectors in common. Hence, in this the dimension of the Hilbert space| |A. | | case (31) shows that for any input density matrix there is some uncertainty in at least one of the two random variables X and Z, quantified by the Shannon entropies 2. Mutually unbiased bases H(X) and H(Z), respectively. In general we have 1 Before delving into uncertainty relations, let us remark c 1 and hence 0 qMU log d . (33) that, in finite dimensions, there exist pairs of observables d ≤ ≤ ≤ ≤ such that perfect knowledge about observable X implies For the extreme case that X and Z are MUBs, as defined complete ignorance about observable Z. We say that such in (27), the overlap matrix [cxz] is flat: cxz = 1/d for all observables are unbiased, or mutually unbiased. For any x and z, and the lower bound on the uncertainty then finite dimensional space there exist pairs of orthonormal becomes maximal bases that satisfy this property. More precisely, two orthonormal bases and are mutually unbiased bases H(X) + H(Z) log d . (34) X Z ≥ (MUBs) if Note that this is a necessary and sufficient condition: x z 2 1 c = 1/d iff the two bases are MUBs, and hence MUBs X Z = , x, z . (27) |h | i| d ∀ uniquely give the strongest uncertainty bound here. 11

For general observables X and Z the overlap matrix also note that (31) can be tightened for mixed states ρA is not necessarily flat and the asymmetry of the matrix with a state-dependent bound. elements cxz is quantified in (32) by taking the maximum Going beyond orthonormal bases, the above relations over all x, z. In order to see why the maximum entry can be extended to more general measurements, as dis- provides some (fairly coarse) measure of the flatness of cussed in Sec. III.D. Finally, another interesting exten- the whole matrix, note that if the maximum entry of the sion considers more than two observables (which in some overlap matrix is 1/d, then all entries in the matrix must cases leads to tighter bounds for two observables), as dis- be 1/d. Alternative measures of incompatibility will be cussed in Sec. III.G. discussed in Sec. III.C.5.

2. Rényi entropies 5. Tighter bounds for qubits

Maassen and Uffink(1988) also showed that the above Various attempts have been made to strengthen the relation (31) holds more generally in terms of Rényi en- Maassen–Uffink bound, particularly in the Shannon- 1 tropies. For any α, β 2 with 1/α + 1/β = 2, we have entropy form (31). Let us begin by first discussing im- ≥ provements upon (31) in the qubit case and then move Hα(X) + Hβ(Z) q . (35) ≥ MU on to arbitrary dimensions. It is easily checked that the relation (31) in terms of the For d = 2 the situation is fairly simple since the overlap Shannon entropy is recovered for α = β = 1. For α matrix [cxz] only depends on a single parameter, which with β 1/2 we get another interesting special→ case ∞ we can take as the maximum overlap c = maxx,z cxz. of (35) in→ terms of the min- and max-entropy Hence the goal is to find the largest function of c that still lower-bounds the entropic sum. Significant progress H (X) + H (Z) q . (36) along these lines was made by Sánches-Ruiz(1998), who min max ≥ MU noted that the Maassen-Uffink bound, qMU, could be re- Since the min-entropy characterizes the probability of placed by a stronger bound correctly guessing the outcome X, it is this type of relation that becomes most useful for applications in quan- 1 + √2c 1 q = hbin − . (37) tum cryptography and quantum information theory (see SR 2 Sec.VI).

Here, hbin(p) := p log p (1 p) log(1 p) denotes the − − − − 3. Proof of Maassen-Uffink binary entropy. Later work by Ghirardi et al. (2003) then attempted The original proof of (35) of Maassen and Uffink makes to find the optimal bound. They simplified the problem use of the Riesz-Thorin interpolation theorem. Recently to a single-parameter optimization as follows an alternative proof was formulated (Coles et al., 2012, 2011) using the monotonicity of the relative entropy un- 1 + cos θ 1 + cos(α θ) qopt = min hbin + hbin − der quantum channels. The latter approach is illustrated θ 2 2 in App.B, where we prove the special case of the Shan- (38) non entropy relation (31). The proof is very simple and straightforward, hence we highly recommend the inter- where α := 2 arccos √c. While it is straightforward to ested reader to see App.B. The Rényi entropy relation perform this optimization, Ghirardi et al. (2003) noted (35) follows from a more general proof given in App. C.3. that an analytical solution could only be found for c & 0.7. They found this analytical form to be

4. Tightness and extensions qG = 2hbin(b), c & 0.7 , (39) Given the very simple and appealing form of the 1 + √c where b := . (40) Maassen-Uﬃnk relations (35) a natural question to ask 2 is how tight these relations are. It is easily seen that if X and Z are MUBs, then they are tight for any of the Fig.6 shows a plot of qopt, qSR, and qMU. In addition, x x z z states ρA = X X or ρA = Z Z . Thus there can- this plot also shows a bound qmaj obtained from a ma- | ih | | ih | not exist a better state-independent bound if X and Z jorization technique discussed in Sec. III.I. For pairs of are MUBs. However, for general orthonormal bases X entropies Hα and Hβ in (35), Abdelkhalek et al. (2015) and Z the relations (35) are not necessarily tight. This recently completely characterized the amount of uncer- issue is addressed in the following subsections, where we tainty in the one qubit case. 12

1.0 Note that q q . However there is no clear relation RPZ ≥ MU ) between qCP and qRPZ. Z ( 0.8 For arbitrary pairs of entropies Hα and Hβ, Ab- H allowed region delkhalek et al. (2015) give conditions on the minimizing ) +

X 0.6 state of (35). In particular, the minimizing state is pure (

H and real. For measurements in the standard and Fourier

= basis, further conditions are obtained. q 0.4

qopt, Eq. (38) qSR, Eq. (37) 0.2 7. Tighter bounds for mixed states qmaj, Eq. (131) q , Eq. (31) uncertainty, MU Notice that (31) can be quite loose for mixed states. 0.0 0.5 0.6 0.7 0.8 0.9 1.0 For example, if ρA = 1/d, then the left-hand side of (31) overlap, c is 2 log d, whereas the right-hand side is at most log d. FIG. 6 Plot of various literature bounds on entropic uncer- This looseness can be addressed by introducing a state- tainty for qubit orthonormal bases, as a function of the max- dependent bound that gets larger as ρA becomes more imum overlap c. The region above q contains pairs (c, q) opt mixed. The mixedness of ρ can be quantified by the that can be achieved by quantum mechanics. A von Neumann entropy H(ρA), which we also denote by H(A)ρ, defined by X 1 6. Tighter bounds in arbitrary dimension H(ρA) = tr ρA log ρA = λj log , (45) − λ j j Extending the qubit result above in (38), de Vicente where an eigenvalue decomposition of the state is given and Sánchez-Ruiz(2008) found an analytical bound in P by ρA = λj φj φj A. Note that 0 H(ρA) log d, the large overlap (i.e., large c) regime j | ih | ≤ ≤ where H(ρA) = 0 for pure states and H(ρA) = log d for maximally mixed states. In the literature, the von Neu- qdVSR = 2hbin(b) for c & 0.7 , (41) mann entropy is sometimes also denoted using S(A) = which is stronger than the MU bound over this range, H(A). However, here we will follow the more common and they also obtained a numerical improvement over convention in quantum information theory. We note that MU for the range 1/2 c . 0.7. the entropy never decreases when applying a measure- ≤ x x However the situation for d > 2 is more complicated ment X = X X to ρA, that is, {| ih |}x than the qubit case. For d > 2 the overlap matrix [cxz] x x H(ρA) H(X)P with PX (x) = X ρA X . (46) depends on more parameters than simply the maximum ≤ h | | i overlap c. Recent work has focused on exploiting these Equation (31) was strengthened for mixed states by Berta other overlaps to improve upon the MU bound. For ex- et al. (2010), with the bound ample, Coles and Piani(2014b) derived a simple improvement on q that captures the role of the second-largest 1 MU H(X) + H(Z) log + H(ρA) . (47) entry of [cxz], denoted c2, with the measure, ≥ c 1 1 c A proof of (47) is given in App.B; see also Frank and qCP = log + (1 √c) log . (42) Lieb(2012) for a direct matrix analysis proof. When X c 2 − c2 and Z are MUBs, this bound is tight for any state ρA Consider the following qutrit example where qCP > qMU. that is diagonal in either the X or Z basis. Example 8. Let d = 3 and consider the two orthonormal bases X and Z related by the unitary transformation, D. Arbitrary measurements   1/√3 1/√3 1/√3 Many interesting measurements are not of the or- U = 1/√2 0 1/√2 . (43) thonormal basis form. For example, coarse-grained (de- p − 1/√6 2/3 1/√6 generate) projective measurements are relevant to prob- − ing macroscopic systems. Also, there are other measure- We have q = log(3/2) 0.58 while q 0.64. MU ≈ CP ≈ ments that are informationally complete in the sense that their statistics allow one to reconstruct the density oper- More recently, a bound similar in spirit to qCP was obtained by Rudnicki et al. (2014), of the form ator. The most general description of measurements in quan- 1 c2 tum mechanics is that of positive operator valued mea- q = log log b2 + (1 b2) . (44) RPZ c − c − sures (POVMs). A POVM on a system A is a set of 13 positive semidefinite operators Xx that decompose the E. State-dependent measures of incompatibility P x 1 { } identity, x X = A. The number of POVM elements in the set can be much larger or much smaller than In most uncertainty relations we have encountered so the Hilbert space dimension of the system. Physically, far, the measure of incompatibility, for example the over- a POVM can be implemented as a joint coarse-grained lap c, is a function of the measurements employed but is measurement on the system of interest with an ancilla independent of the quantum state prior to measurement. system. The sole exception is the strengthened Maassen-Uffink x z For two POVMs X = X x and Z = Z z, the gen- relation in (47) where the lower bound is the sum of an eral Born rule now induces{ the} distributions{ } ordinary, state-independent measure of incompatibility and the entropy of the pre-measurement state. In the P (x) = tr ρ x and P (z) = tr ρ z . (48) X AX Z AZ following, we review some uncertainty relations that use Krishna and Parthasarathy(2002) proposed an incom- measures of incompatibility that are state dependent. patibility measure using the operator norm. Namely they It was shown in (Tomamichel and Hänggi, 2013) that considered the Maassen-Uffink relation (31) also holds when the 2 overlap is replaced by an effective overlap, denoted ∗. x z c c c = max cxz with cxz = √ √ , (49) ∗ x,z X Z Informally, c is given by the average overlap of the two measurements on different subspaces of the Hilbert space, where denotes the operator norm (i.e. the maximal averaged using the probability of finding the state in the singulark ·value). k Using this measure they generalized (31) subspace. We refer the reader to the paper mentioned to the case of POVMs, i.e., we still have above for a formal definition of c∗. Here we discuss a sim- 1 H(X) + H(Z) log , (50) ple example showing that state-dependent uncertainty re- ≥ c lations can be significantly tighter. but now using the generalized version of c in (49). More Example 10. Let us apply one out of two projective mea- recently, Tomamichel(2012) noted that an alternative surements, either in the orthonormal basis generalization to POVMs is obtained by replacing c with n o n o ( ) 0 , 1 , or + , , (55) 0 X z x z X x z x | i | i |⊥i | i |−i |⊥i c := min max Z X Z , max X Z X , x z z x on a state ρ which has the property that ‘ ’ is measured (51) with probability at most ε.7 The Maassen-Uffink⊥ rela- and the author conjectured that c0 always provides a tion (31) gives a trivial bound as the overlap of the two stronger bound than c. bases is c = 1 due to the vector that appears in both bases. Still, our intuitive understanding|⊥i is that the un- Example 9. Consider two POVMs given by certainty about the measurement outcome is high as long 1n o as ε is small. In fact, the effective overlap (Tomamichel X = Z = 0 0 , 1 1 , + + , . (52) 2 | ih | | ih | | ih | |−ih−| and Hänggi, 2013) of this setup is 0 For these POVMs we find c = 1/4, but c = 3/16 is 1 c∗ = (1 ε) + ε , (56) strictly smaller. − 2 Indeed this conjecture was proved by Coles and Piani and captures this intuition. This formula can be inter- (2014b), where it was shown that preted as follows: with probability 1 ε we are in the subspace spanned by 0 and 1 , where− the overlap is 1/2, X z x z Z X Z max cxz , (53) and with probability | iwe measure| i and have full over- ≤ z ε z lap. ⊥ and hence c0 c, implying that log(1/c0) provides a An alternative approach to state-dependent uncer- stronger bound≤ on entropic uncertainty than log(1/c). tainty relations was introduced in (Coles and Piani, Interestingly, a general POVM can have a non-trivial 2014b). They showed that the factor q = log(1/c) uncertainty relation on its own. That is, for some POVM MU in the Maassen-Uffink relation (31) can be replaced by , there may not exist any state ρ that has H(X) = 0. X A the state-dependent factor Krishna and Parthasarathy(2002) noted this and derived the single POVM uncertainty relation q(ρA) := max qX (ρA), qZ (ρA) , where (57) { } x X 1 H(X) log max X . (54) q (ρ ) := P (x) log , (58) ≥ − x X A X x maxz cxz In fact the proof is straightforward: simply apply (50) to the case where Z = 1 is the trivial POVM. The { } relation (54) can be further strengthened by apply this √ 7 approach to c0 in (51), instead of c. The diagonal states are |±i = (|0i ± |1i)/ 2. 14 and qZ (ρA) is defined analogously to qX (ρA), but with x with the conditional probability distribution and z interchanged. Here, PX (x) and cxz are given by † (26) and (32), respectively. Note that this strengthens PK|Θ=θ (k) := k U ρU k for k = 1, . . . , d (63) X h | X X| i the Maassen-Uffink bound, q(ρA) q , since averaging ≥ MU log(1/ maxz cxz) over all x is larger than minimizing it and similarly for θZ. Alternatively we can also write this over all x. In many cases q(ρA) is significantly stronger as than qMU as discussed in (Coles and Piani, 2014b). 1 1 Recently Kaniewski et al. (2014) derived entropic H(K Θ) log with Θ θ , θ , (64) | ≥ 2 c ∈ { X Z} uncertainty relations in terms of the effective anti- commutator of arbitrary binary POVMs X = X0, X1 in terms of the conditional Shannon entropy { } and Z = Z0, Z1 , namely the quantity { } H(K Θ) := H(KΘ) H(Θ) (65) 1 1 | − ∗ 1 ε = tr ρ[OX,OZ]+ = tr ρ(OXOZ + OZOX) , 2 2 = H(K Θ = θX) + H(K Θ = θX) (66) 0 1 0 1 2 | | where OX = X X and OZ = Z Z (59) − − of the bipartite distribution are binary observables corresponding to the POVMs X and , respectively. In (59), we use the notation [ , ]+ to 1 † Z PKΘ(k, θj) := k U ρUj k with k = 1, . . . , d denote the anti-commutator. We note that ε∗ ·[ ·1, 1]. 2h | j | i ∈ − This results, for example, in the following uncertainty j = X, Z . (67) relation for the Shannon entropy: That is, each measurement labeled θj is chosen with equal p ! 1 + ε∗ probability 1/2 and we condition on this choice. Notice H(X) + H(Z) h | | . (60) ≥ bin 2 that the form in (64) is connected to the guessing game in Fig.2. Regardless of the state ρA that Bob prepares, We refer the reader to (Kaniewski et al., 2014) for sim- the uncertainty relation (64) implies that he will not be ilar uncertainty relations in terms of Rényi entropies as able to win the guessing game (i.e., perfectly guess K) if well as extensions to more than two measurements. Fi- c < 1. Bob might be able to partially guess K, but never nally, for measurements acting on qubits, we find that with perfect accuracy. In this sense, the Maassen-Uffink ε∗ = 2c 1, and (60) hence reduces to the Sanchez- relation is a fundamental constraint on one’s ability to |Ruiz| bound− (37). win a guessing game. Actually, in the context of guessing games, the min- entropy is the more operational measure than the Shan- F. Relation to guessing games non entropy. For example, a diligent reading of Deutsch (1983) reveals the relation Let us now explain in detail how some of the relations 2 above can be interpreted in terms of a guessing game. pguess(X) pguess(Z) b , (68) · ≤ We elaborate on the brief discussion of guessing games in Sec.I, and we refer the reader back to Fig.2 for an for orthonormal bases X and Z, where b is defined in (40). illustration of the game. This relation gives an upper bound on the product of The game is as follows. Suppose that Bob prepares the guessing probabilities (or equivalently, a lower bound on the sum of the min-entropies) associated with and system A in state ρA. He then sends A to Alice, who X . However, to make a more explicit connection to the randomly performs either the X or Z measurement. The Z measurement outcome is a bit denoted as K, and Bob’s guessing game described above, one would like to upper task is to guess K, given that he received the basis choice bound the sum (or average) of the guessing probabilities, namely the quantity denoted by Θ θX, θZ from Alice. We can rewrite∈ { the} Maassen-Uffink relation (31) in 1 the following way such that the connection to the above p (K Θ) = p (K Θ = θ ) + p (K Θ = θ ) . guess | 2 guess | X guess | Z guessing game becomes transparent. Denoting the stan- (69) dard basis on A as k d , we write {| i}k=1 k k Indeed, the quantity (69) can easily be upper- X =: U k and Z =: U k . (61) | i X| i | i Z| i bounded Schaffner(2007) as Then, we have p (K Θ) b or equivalently (70) guess | ≤ 1 1 1 1 H(K Θ = θ ) + H(K Θ = θ ) log , (62) H (K Θ) log . (71) 2 | X | Z ≥ 2 c min | ≥ b 15

Example 11. For the Pauli qubit measurements where the conditional probability distribution PK|Θ=θj is σX, σZ the min-entropy uncertainty relation (71) be- defined analogously to (63). {comes } √ 2 2 1. Bounds implied by two measurements Hmin(K Θ) log . (72) | ≥ 1 + √2 It is important to realize that, e.g., the Maassen-Uffink We emphasize that pguess(K Θ) is precisely the probability for winning the game described| in Fig.2. Hence, relation (31) already implies bounds for larger sets of the entropic uncertainty relation (71) gives the funda- measurements. This is easily seen by just taking the mental limit on winning the game. Finally, we remark Maassen-Uffink relation for all possible pairs of measure- that (71) is stronger than Deutsch’s relation (68), due to ments and adding the corresponding lower bounds. the following argument. For the min-entropy, condition- Example 12. For the qubit Pauli measurements we ing on the measurement choice is defined as find by the simple iterative application of the tightened   Maassen-Uffink bound (47) for the measurement pairs 1 X −Hmin(K|Θ=θj ) , , and that Hmin(K Θ) := log  2  (73) σX, σY σX, σZ σY, σZ | − 2 { } { } { } j=1,2 1 1 = H (KΘ) H (Θ) (in general) , H(K Θ) + H(ρA) with Θ σX, σY, σZ . (78) 6 min − min | ≥ 2 2 ∈ { } in contrast to the Shannon entropy in (65). However in The goal of this section is to find uncertainty relations analogy to (66), we have that are stronger than any bounds that can be derived 1 X directly from relations for two measurements. H (K Θ) H (K Θ = θj) . (74) min | ≤ 2 min | j=1,2 due to the concavity of the logarithm. For a general 2. Mutually unbiased bases discussion of conditional entropies we point to Sec. IV.B. At first glance, one might think that measuring in mutually unbiased bases always results in a large amount G. Multiple measurements of uncertainty. Somewhat surprisingly, this is not the case. In fact, Ballester and Wehner(2007) show that So far we have only considered entropic uncertainty for d = p2l with p prime and l N, there exist up to l ∈ relations quantifying the complementarity of two mea- L = p + 1 many MUBs together with a state ρA for surements. However, there is no fundamental reason for which restricting to this setup and in the following we discuss log d entropic uncertainty relations for multiple measurements. H(K Θ) = with Θ θ , . . . , θL . (79) 2 1 We mostly focus on special sets of measurements that | ∈ { } generate strong uncertainty relations. This is of particu- That is, we observe no more uncertainty than if we had lar interest for various applications in quantum cryptog- just considered two incompatible measurements. While raphy (see Sec. VI.C). a certain amount of mutual unbiasedness is therefore a The notation introduced for guessing games in necessary condition for strong uncertainty relations, it is Sec. III.F is particularly useful in the multiple measure- in general not sufficient. ments setting. In this notation, for larger sets of mea- Starting from the two measurements setting, a promis- surements we are interested in finding lower bounds of ing candidate for deriving strong uncertainty relations the form are sets of MUBs (see Sec. III.B.2 for an introduction and Sec.A for details). For a full set of d + 1 MUBs it H(K Θ) f(Θ, ρA) > 0 with Θ θ , . . . , θL , (75) | ≥ ∈ { 1 } was shown that (Ivanovic, 1992; Larsen, 1990; Sánchez, where, similarly to (67), 1993),

1 † H(K Θ) log(d + 1) 1 with Θ θ1, . . . , θd+1 . PKΘ(k, θj) := k Uj ρUj k with k = 1, . . . , d Lh | | i | ≥ − ∈ { }(80) j = 1,...,L. (76) This is a very strong bound since the entropic term on Again the left-hand side of (75) might alternatively be the left-hand side can become at most log d for any num- written as ber and choice of measurements. The relation (80) can L 1 X be derived from an uncertainty equality for the colli- H(K Θ) = H(K Θ = θj) , (77) sion entropy . Namely, we have for any quantum | L | Hcoll j =1 state ρA on a d-dimensional system and a full set of 16 d + 1 MUBs (Ballester and Wehner, 2007; Brukner and Example 14. For the qubit Pauli measurements (86) Zeilinger, 1999; Ivanovic, 1992), yields 2 H (K Θ) = log(d + 1) log 2−Hcoll(ρA) + 1 H(K Θ) with Θ σ , σ , σ , (87) coll | − | ≥ 3 ∈ { X Y Z} with Θ θ , . . . , θd , (81) ∈ { 1 +1} also see (Sánches-Ruiz, 1998) for more on this special case. Moreover, with (Coles et al., 2011) we can add an where for the collision entropy the conditioning on the entropy dependent term on the right-hand side, measurement choice is defined as   2 1 L H(K Θ) + H(ρA) with Θ σX, σY, σZ . (88) 1 X −Hcoll(K|Θ=θj ) | ≥ 3 3 ∈ { } Hcoll(K Θ) := log  2  (82) | − L j=1 Note that is never a worse bound than (78) which just followed from the tightened Maassen-Uffink relation for = H (KΘ) H (Θ) (in general) . 6 coll − coll two measurements (47). Moreover, the relation (87) be- We also refer to Sec. III.A for a general discussion about comes an equality for any eigenstate of the Pauli mea- conditional entropies. Moreover, the quantum collision surements, while (88) becomes an equality for any state ρA that is diagonal in the eigenbasis of one of the Pauli entropy is a measure for how mixed the state ρA is and defined as measurements.

2 For smaller sets of L < d + 1 MUBs we immediately H (ρA) := log tr ρ . (83) coll − A get a weak bound from an iterative application of the Maassen-Uﬃnk relation (31) for MUBs, We emphasize that since (81) is an equality it is tight for every state. By the concavity of the logarithm we also log d H(K Θ) with Θ θ , . . . , θL . (89) have in analogy to the Shannon entropy (77), | ≥ 2 ∈ { 1 }

d+1 However, it surprisingly turns out that the bound (89) 1 X H (K Θ) H (K Θ = θj) . (84) can in general not be improved much. coll | ≤ d + 1 coll | j=1 Example 15. In d = 3 there exists a set of L = 3 MUBs Example 13. For the qubit Pauli measurements (81) together with a state ρA such that (Wehner and Winter, yields 2010),

H(K Θ) = 1 with Θ θ1, θ2, θ3 . (90) H (K Θ) log 3 log 2−Hcoll(ρA) + 1 | ∈ { } coll | ≥ − This only allows a relatively weak uncertainty relation for with Θ σ , σ , σ . (85) ∈ { X Y Z} L = d = 3 and we have from (Wu et al., 2009), The uncertainty relation for the Shannon entropy (80) 8 follows from (81) by at first only considering pure states, H(K Θ) 0.89 with Θ θ1, θ2, θ3 . (91) | ≥ 9 ≈ ∈ { } i.e., states with Hcoll(ρA) = 0, and using that the Rényi entropies are monotonically decreasing as a function of This is slightly stronger than the lower bound from (89), the parameter α (note that the collision entropy corre- log 3 sponds to α = 2 and the Shannon entropy to α = 1). H(K Θ) 0.79 with Θ θ , θ , θ . (92) | ≥ 2 ≈ ∈ { 1 2 3} For mixed states ρA we can extend this in a second step by taking the eigendecomposition and making use of the Again, in general this only allows relatively weak un- concavity of the Shannon entropy. For later purposes we certainty relations for L < d + 1 and we have from (Wu note that it is technically often more accessible to work et al., 2009), with the collision entropy Hcoll (even when ultimately −H ρ interested in uncertainty relations in terms of other en- d 2 coll( A) + L 1 H (K Θ) log · − tropies). coll | ≥ − L d · The uncertainty relation (80) was improved for d even with Θ θ1, . . . , θL . (93) ∈ { } to (Sánchez-Ruiz, 1995), This implies in particular the Shannon entropy rela- 1 d d d d tion (Azarchs, 2004), H(K Θ) log + + 1 log + 1 | ≥ d + 1 2 2 2 2 d + L 1 H(K Θ) log − with Θ θ1, . . . , θL , with Θ θ1, . . . , θd+1 . | ≥ − L d ∈ { } ∈ { (86)} · (94) 17 see also (Wehner and Winter, 2010) for an elementary and the fudge term g(L) = O (log (L/ log(L))). Note that proof. For comparison, with L = d = 3,(94) yields for any set of L measurements we always have 9 1 H(K Θ) log 0.85 with Θ θ , θ , θ , (95) H(K Θ) log d 1 with Θ θ1, . . . , θL . | ≥ 5 ≈ ∈ { 1 2 3} | ≤ · − L ∈ { } (99) which is between (89) and (91). Additional evidence that general sets of less than d + 1 MUBs in dimension Hence, the relation (98) is already reasonably strong. d only generate weak uncertainty relations is presented However, very recently (98) was improved by proving by (Ambainis, 2010; Ballester and Wehner, 2007; DiVin- a conjecture as stated in (Wehner and Winter, 2010). cenzo et al., 2004; Hasegawa et al., 2007). Many of the Namely, Adamczak et al. (2014) show that in dimension findings here also extend to the setting of approximate d and for any number L > 2 measurements chosen at mutually unbiased bases (Hayden et al., 2004). random, there exists a constant D such that, In terms of the min-entropy, Mandayam et al. (2010) 1 H(K Θ) log d 1 D show that for measurements in L possible MUBs the fol- | ≥ · − L − lowing two bounds hold with Θ θ , . . . , θL . (100) ∈ { 1 } L 1 X 1 d 1 We emphasize that this matches the upper bound (99) H (K Θ = θ) log 1 + − , L min | ≥ − d √ up to the constant D. θ=1 L (96) The downside with the relations (98) and (100), however, is that measurements are not explicit. This is an L 1 X 1 L 1 issue for applications. In particular, it is computation- Hmin(K Θ = θ) log 1 + − . L | ≥ − L √d ally inefficient to sample from the Haar measure. Fawzi θ=1 et al. (2011) show that the measurements in their rela- (97) tion (98) can be made explicit and efficient if the number of measurements is small enough. More precisely, for Each of these is better in certain regimes, and the lat- L n qubits (with sufficiently large) and , there exists ter can indeed be tight. They also study uncertainty n ε > 0 a constant and a set of relations for certain classes of MUBs that exhibit special C symmetry properties. Furthermore, uncertainty relations L (n/ε)C log(1/ε) (101) for a full set of L = d + 1 MUBs can also be expressed ≤ in terms of the extrema of Wigner functions (Mandayam measurements generated by unitaries computable by et al., 2010; Wootters and Sussman, 2007). It remains quantum circuits of size O(polylogn) such that, an interesting topic to study uncertainty relations for H(K Θ) n (1 2ε) h(ε) with Θ θ , . . . , θL , MUBs and in Sec. III.G.7 we present some related re- | ≥ · − − ∈ { 1 } sults of Kalev and Gour(2014). (102) where h(ε) denotes the binary entropy. The relation (102) will be the basis for the information locking 3. Measurements in random bases schemes presented in Sec. VI.H.3.

Another candidate for strong uncertainty relations are sets of measurements that are chosen at random. Extend- 4. BB84 and six state measurements ing on the previous results of Hayden et al. (2004), Fawzi et al. (2011) show that in dimension d and for any num- In contrast to what we discussed so far, for applica- ber L > 2 of measurements chosen at random,8 there tions in cryptography we usually need uncertainty rela- exists a constant C such that, tions for measurements that can be implemented locally. For example, for an n-qubit state we are interested in r ! uncertainty relations for the set of 2n different measure- 1 H(K Θ) log d 1 C log(L) g(L) ments given by measuring each qubit independently in | ≥ · − L · − one of the two Pauli bases σX or σZ. Following Ben- with Θ θ1, . . . , θL , (98) nett and Brassard(1984) these measurements are often ∈ { } called BB84 measurements. Using the Maassen-Uffink bound (31) for two measurements iteratively we immediately find,

8 By “at random” we mean according to the Haar measure on the n n 1 n H(K Θ ) n with Θ θ , . . . , θ n . (103) unitary group. | ≥ · 2 ∈ { 1 2 } 18

This relation is already tight since there exist states that For simplicity we only state the case of L = 3 measure- achieve equality. However, for applications the relevant ments (in any dimension d 2), measure is often not the Shannon entropy but the the ≥ min-entropy. The one qubit relation (72) is easily ex- 1 1 2 H(K Θ) log + H(ρA) tended to n qubits as | ≥ 3 m 3 (1) (2) (3) (108) with Θ V ,V ,V , n n 1 1 ∈ { } Hmin(K Θ ) n log + n 0.22 | ≥ − · 2 2√2 ≈ · and the multiple overlap constant n with Θ θ , . . . , θ n . 1 2   ∈ { }(104) X 1 2 2 3 m := max  max c vi , vj c vj , vk  , (109) k i · Again there exist states that achieve equality. More gen- j erally Ng et al. (2012) find for n qubit BB84 measurements and the Rényi entropy of order α (1, 2], and v1 , v2 , v3 are the eigenvectors of V (1), ∈ {| i i} {| j i} {| ki} (2), (3), respectively. α−1 V V n n α log 1 + 2 Hα(K Θ ) n − | ≥ · α 1 Example 16. For d = 2 and the full set of d + 1 = 3 n − with Θ θ , . . . , θ n , (105) MUBs given by the Pauli measurements this gives ∈ { 1 2 } where the conditioning is given as (see App.C), 9 1 2 H(K Θ) + H(A)ρ with Θ σ , σ , σ . | ≥ 3 3 ∈ { X Y Z}  L  (110) 1−α α 1 X Hα(K|Θ=θj ) Hα(K Θ) = log  2 α  . | 1 α L − j=1 This bound is, however, weaker than (78) and (88). (106) On the other hand, of course the whole point of the bound (108) is that in contrast to (78) and (88) it can be Similarly, we find for the set of 3n different measure- applied to any set of L = 3 measurements. ments given by measuring each qubit independently in We refer to (Liu et al., 2015) for a fully worked out one of the three Pauli bases σX, σY, or σZ that example where their bound can become stronger than n n 2 n any bounds implied by two measurement relations. H(K Θ ) n with Θ θ , . . . , θ n , (107) | ≥ · 3 ∈ { 1 3 } Following Bruß(1998) these measurements are often called six state measurements. The uncertainty rela- 6. Anti-commuting measurements tion (107) is the extension of (87) from one to n qubits. More general relations in terms of Rényi entropies were As already noted in Sec. III.D, many interesting mea- again derived by Ng et al. (2012). surements are not of the orthonormal basis form, but are more generally described by POVMs. One class of Approximate extensions of all these relations when the such measurements that generate maximally strong un- measurements are not exactly given by the Pauli mea- certainty relations are sets of anti-commuting POVMs surements σ , σ , σ are discussed in (Kaniewski et al., X Y Z with only two possible measurement outcomes. In more 2014). We{ note that} some extensions of the n qubit re- detail, we consider of binary POVMs lations discussed above will be crucial for applications in X1,..., XL Xj = 0 1 that generate{ binary observables} (Hermitian op- two-party cryptography (Sec. VI.C). Xj , Xj erators){ }

0 1 Oj := Xj Xj with [Oj,Ok]+ = 2δjk , (111) 5. General sets of measurements − where, as in (59), [ , ] denotes the anti-commutator. Liu et al. (2015) give entropic uncertainty relations for · · + general sets of measurements. Their bounds are qualita- An example are the L = 3 qubit Pauli measurements σ , σ , σ . In higher dimensions, the operators in (111) tively diﬀerent than just combining (31) iteratively and { X Y Z} sometimes become strictly stronger in dimension d > 2. are the analogons of the Pauli operators. We are then interested in ﬁnding lower bounds on H(K Θ) where |

1 k PKΘ(k, Xj) := tr Xj ρA with k = 1, 2 9 L We emphasize that unlike in the unconditional case H2(K|Θ) 6= Hcoll(K|Θ) and hence (82) is diﬀerent from (106) for α = 2. j = 1,...,L. (112) 19

z d For simplicity we only discuss the case of n qubit states and Z = Z z=1 on a d-dimensional quantum system for which we have sets of up to 2n + 1 many binary anti- are mutually{ unbiased} measurements (MUMs) if for some commuting POVMs.10 Wehner and Winter(2008) then κ (1/d, 1], show that ∈ x z x z 1 1 tr [X ] = 1, tr [Z ] = 1, tr [X Z ] = x, z (118) H(K Θ) 1 with k = 1, 2 d ∀ | ≥ − L h x x0 i 1 κ 0 tr X X = δxx0 κ + (1 δxx0 ) − x, x for any subset Θ X1,..., X2n+1 of size L. (113) · − d 1 ∀ ⊆ { } − and similarly for z, z0 . (119) These relations are tight and reduce for the L = 3 qubit

Pauli measurements σX, σY, σZ to the bound (87). Sim- In addition, a set of POVMs X1,..., Xn of said form { } { } ilarly Wehner and Winter(2008) also ﬁnd for the collision is called a set of MUMs if each POVM Xj is mutually entropy, unbiased to each other POVM Xk, with k = j, in the set. 6 A straightforward example are again MUBs for which 1 X 1 .11 The crucial observation of Kalev and Gour Hcoll(K Θ = Xj) 1 log 1 + , (114) κ = 1 L | ≥ − L (2014) is that in any dimension a full set of Xj ∈Θ d d + 1 MUMs exists (see their paper for the explicit construc- and the min-entropy, tion). Moreover, every full set of d + 1 MUMs gives rise to a strong uncertainty relation, 1 X 1 Hmin(K Θ = Xj) 1 log 1 + . (115) L | ≥ − √L H(K Θ) log(d + 1) log (1 + κ) Xj ∈Θ | ≥ − with Θ X1,..., Xd+1 , (120) These relations are again tight. Note however that the ∈ { } average over the basis choice is outside of the logarithm, where the notation is as introduced in (112). This is whereas for the collision and the min-entropy the average in full analogy with (80) for a full set of d + 1 MUBs. is more naturally inside of the logarithm as, e.g., in (81) Tighter and state dependent versions of (120) as well as and in (104). extensions to Rényi entropies can be found in (Chen and Fei, 2015; Rastegin, 2015b) Example 17. For the L = 3 qubit case (114) reduces to

1 X H. Fine-grained uncertainty relations H (K Θ = σj) log 3 1 , (116) 3 coll | ≥ − j=X,Y,Z So far we have expressed uncertainty in terms of the which, as seen by (84), is generally weaker than the cor- von Neumann entropy and the Rényi entropy of the prob- responding bound implied by (81), ability distribution induced by the measurement. Recall, however, that any restriction on the set of allowed prob-

Hcoll(K Θ) log 3 1 with Θ σX, σY, σZ . (117) ability distributions over measurement outcomes can be | ≥ − ∈ { } understood as an uncertainty relation, and hence there Finally, we point to (Ver Steeg and Wehner, 2009) for are many ways of formulating such restrictions. Thus, the connection of the uncertainty relations in this section while in finite dimensions the Rényi entropies determine to Bell inequalities. the underlying probability distribution of the measurement outcomes uniquely,12 it is interesting to ask whether we can formulate more refined versions of uncertainty re- 7. Mutually unbiased POVMs lations. Suppose we perform L measurements labeled Θ on In Sec. III.G.2 we presented that full sets of d+1 MUBs a preparation ρ, where each measurement has N out- give rise to strong uncertainty relations, see, e.g., (80). comes. Fine-grained uncertainty relations (Oppenheim However, for general dimension d we do not know if a full set of d + 1 MUB always exists (see App.A for a discussion). Kalev and Gour(2014) offer the following generalization of MUBs to measurements that are not 11 The trivial example for which each POVM element is the maxi- x d mally mixed state 1/d is excluded because this would correspond necessarily given by a basis. Two POVMs X = X x=1 { } to κ = 1/d. 12 To see this, note that the cumulant generating function of the random variable Z = − log PX (X) can be expressed in terms of the Rényi entropy of X, namely gZ (s) = H1+s(X). The 10 This is obtained by the unique Hermitian representation of the cumulants of Z and hence the distributions of Z and X are thus Clifford algebra via the Jordan-Wigner transformation (Dietz, fully determined by the Rényi entropy in a neighborhood around 2006). α = 1. 20 and Wehner, 2010) consist of a set of N L equations which such that the relation13 state that for all states we might measure ↓ ↓ PX PZ ν holds for all ρ ( ) . (124) L × ≺ ∈ S H X PΘ(Θ = θ)PX (X = xθ Θ = θ) ζx ,...,x , (121) Such a relation gives a bound on how spread out the | ≤ 1 L ↓ ↓ θ=1 product distribution PX PZ must be. A simple and instructive example of a× probability distribution ν sat- for all combinations of measurement outcomes x1, . . . , xL isfying the above relation can be constructed as follows. that are possible for the L different measurements, where Consider the largest probability in the product distribu- PΘ(Θ = θ) is the probability of choosing measurement tion in (124), given by labeled Θ = θ, and 0 ζx1,...,xL 1. ≤ ≤ ↓ ↓ Note that whenever ζ < 1, then we observe p1 := P (1) P (1) = pguess(X) pguess(Z) . (125) x1,...,xL X · Z · some amount of uncertainty, since it implies that we cannot simultaneously have PX (X = xθ Θ = θ) = 1 for all θ. We know that p1 is always bounded away from 1 if the We remark that fine-grained uncertainty| relations natu- two measurements are incompatible, since it cannot be rally give a bound on the min-entropy that both measurements have a deterministic outcome. For example, recall that we have (68) from Deutsch L (1983), which gives X Hmin(X Θ) = log PΘ(Θ = θ) max PX (X = xθ Θ = θ) | − xθ | 2 θ=1 p1 = pguess(X) pguess(Z) b =: ν1 , (126) (122) · ≤ (123) where b was defined in (40). As such, it is immediately log max ζx1,...,xL . 1 ≥ − x1,...,xL clear that the vector ν = ν1, 1 ν1, 0,..., 0 satisfies (124) and in fact constitutes{ a simple− but non-trivial} However, we note that fine-grained uncertainty relations uncertainty relation. are strictly more informative, and are closely connected Going beyond this observation, the works of (Fried- to Bell non-locality (Oppenheim and Wehner, 2010). land et al., 2013) and (Puchała et al., 2013) both present While not the topic of this survey, we note that a number an explicit method to construct a sequence of vectors of extensions of these fine-grained uncertainty relations νk |X|−1 of the form are known (Dey et al., 2013; Rastegin, 2015a; Ren and { }k=1 Fan, 2014). k ν = ν , ν ν ,..., 1 νk− , 0,..., 0 , (127) { 1 2 − 1 − 1 } with νk νk−1, that satisfy (124) and lead to tighter ≺ I. Majorization approach to entropic uncertainty and tighter uncertainty relations. The expressions for νk are given in terms of an optimization problem and become gradually more difficult as increases. We refer Another way to capture uncertainty relations that re- k the reader to these papers for details on the construction. lates directly to entropic ones is given by the majorization approach. Instead of sums of probabilities, we here look at products. The idea to derive entropic uncertainty relations via a majorization relation was pioneered 2. From majorization to entropy by Partovi(2011) and later extended and clarified independently in (Friedland et al., 2013) and (Puchała et al., Entropic uncertainty relations for Rényi entropy follow directly from the above relation due to the fact that 2013). Let us recall the distributions P and P result- X Z the Rényi entropy is Schur concave and additive. This ing from the measurements X and Z, respectively, of the ↓ ↓ implies that state ρA as in (48). We denote by PX and PZ the corresponding reordered vectors such that the probabilities ↓ ↓ P P ν = Hα(X) + Hα(Z) Hα(V ) , (128) are ordered form largest to smallest. X × Z ≺ ⇒ ≥ where V is a random variable distributed according to the law ν. These uncertainty relations have a different flavor 1. Majorization approach than the Maassen-Uffink relations in (35) since they provide a bound on the sum of the Rényi entropy of the same The main objective of this section is to find a vector that majorizes the Cartesian product of the two proba- ↓ ↓ bility vectors PX and PZ , namely we are looking for a 13 probability distribution ν = ν(1), ν(2), . . . , ν( X Z ) Recall the definition of majorization in Sec. III.A.3. { | || | } 21 parameter. As a particular special case for α = , we IV. UNCERTAINTY GIVEN A MEMORY SYSTEM get back Deutsch’s uncertainty relation (Deutsch, ∞1983), The uncertainty relations presented thus far are lim- H(X) + H(Z) Hmin(X) + Hmin(Z) (129) ited in the following sense: they do not allow the observer ≥ 2 log b =: qD , (130) to have access to side information. Side information, also ≥ − known as memory, might help the observer to better pre- where the first inequality follows by the monotonicity of dict the outcomes of the X and Z measurements. It is the Rényi entropy in the parameter α. However, an im- therefore a fundamental question to ask: does the uncer- mediate improvement on this relation can be obtained by tainty principle still hold when the observer has access to applying (128) directly for α = 1, which yields a memory system? If so, what form does it take? The uncertainty principle in the presence of memory is 2 H(X) + H(Z) hbin(b ) =: qmaj . (131) important for cryptographic applications and witnessing ≥ entanglement (Sec.VI). For example, in quantum key distribution, an eavesdropper may gather some information, 3. Measurements in random bases store it in her memory, and then later use that memory to try to guess the secret key. It is crucial to understand An interesting special case for which a majorization whether the eavesdropper’s memory allows her to break based approach gives tighter bounds is for measurements a protocol’s security, or whether security is maintained. in two bases X and Z related by a random unitary. Intu- This is where general uncertainty relations that allow for itively, we would expect such bases to be complementary. memory are needed. More precisely, for any measurement in a fixed basis X Furthermore, such uncertainty relations are also im- and Z related by a unitary drawn from the Haar measure portant for basic physics. For example, the quantum- on the unitary group, Adamczak et al. (2014) show that to-classical transition is an area of physics where one for the Masseen-Uffink bound (31) we have with proba- tries to understand why and how quantum interference bility going to one for d , → ∞ effects disappear on the macroscopic scale. This is often attributed to decoherence, where information about H(X) + H(Z) log d log log d . (132) ≥ − the system of interest S flows out to an environment E (Zurek, 2003). In decoherence, it is important to quan- However, they also show that a majorization based ap- tify the tradeoff between the flow of one kind of infor- proach yields the tighter estimate mation, say Z, to the environment versus the preserva- tion of another kind of information, say X, within the H(X) + H(Z) log d C1 , (133) ≥ − system S. Here one associates X with the “phase" information that is responsible for quantum interference. where C1 > 0 is some constant. This is close to optimal since we have that with probability going to one for d Hence, one can see how this ties back into the quantum- (Adamczak et al., 2014), → to-classical transition, since loss of X information would ∞ destroy the quantum interference pattern. In this discussion, system plays the role of the memory, and hence log d C0 H(X) + H(Z) , (134) E − ≥ uncertainty relations that allow for memory are essen- for some constant C0 > 0. It is an open question to de- tially uncertainty relations that allow the system to in- termine the exact asymptotic behavior, i.e., the constant teract with an environment. We will discuss this more in C (C ,C ) that gives a lower and an upper bound. Sec. VI.F, in the context of interferometry experiments. ∈ 0 1

4. Extensions A. Classical versus quantum memory

The majorization approach has also been extended With this motivation in mind, we now consider two to cover general POVMs and more than two measure- different types of memories. First, we discuss the notion ments in (Friedland et al., 2013). Moreover, a recent of a classical memory, i.e., a system B that has no more paper (Rudnicki et al., 2014) discusses a related method, than classical correlations with the system A that is to based on finding a vector that majorizes the ordered dis- be measured. ↓ tribution (PX PZ ) , where PX PZ is simply the con- catenation of the∪ two probability∪ vectors. This yields a Example 18. Consider a spin-1/2 particle A and a further improvement on (131). Finally, an extension to (macroscopic) coin B as depicted in Fig.7(a). Suppose uncertainty measures that are not necessarily Schur con- that we flip the coin to determine whether or not we pre- cave but only monotonic under doubly stochastic matri- pare A in the spin-up state 0 or the spin-down state 1 . | i | i ces was presented in (Narasimhachar et al., 2015). Denoting the basis Z = 0 , 1 we see that B is perfectly {| i | i} 22 correlated to this basis. That is, before the measurement of A the joint state is Z 1 X ρAB = x x A x x B . (135) 2 | ih | ⊗ | ih | x∈{0,1} (a) Cartoon showing an electron spin whose Z component is correlated to a classical coin. Hence, if the observer has access to B then he can perfectly predict the outcome of the Z measurement on A. On the other hand, if we keep B hidden from the observer, X X then he can only guess the outcome of the Z measurement Z Z on A with probability 1/2.

We conclude from Ex. 18 that indeed, having access to (b) Cartoon showing an electron spin whose and B reduces the uncertainty about Z. However, notice that Z X components are respectively correlated to the Z and X a classical memory B provides no help to the observer if components of another electron spin, i.e., a quantum memory. he tries to guess the outcome of a measurement on A FIG. 7 Comparison of classical and quantum memory. that is complementary to Z. Consider now a more general memory, one that can have any kind of correlations with system A allowed by quantum mechanics. This is called a quantum memory or quantum side information B. Background: Conditional entropies (and includes classical memory as a special case). We remark that quantum memories are now becoming an 1. Classical-quantum states experimental reality, e.g., see (Julsgaard et al., 2004). Our main goal here is to describe the entropy of a Example 18 (continued). Consider two spin-1/2 par- measured (and thus classical) random variable from the ticles A and B that are maximally entangled, say in the perspective of an observer that has quantum memory. state For this purpose, consider a classical register correlated with a quantum memory, modeled by a joint classical 1 ψ AB = 00 AB + 11 AB . (136) quantum (cq) state | i √2 | i | i

X x This is depicted in Fig.7(b). Like for the classical mem- ρXB = PX (x) x x X ρ . (138) | ih | ⊗ B ory in Ex. 18, giving the observer access to B allows him x to perfectly predict the outcome of a Z measurement on A Here, ρx is the quantum state of the memory system (by just measuring the Z observable on B). But in con- B trast to the case with classical memory, B can also be used B conditioned on the event X = x. Formally, quantum to predict the outcome of a complementary measurement states or density operators are positive semidefinite operators with unit trace acting on the Hilbert space B. In X = + , , with = ( 0 1 )/√2, on A. This follows{| byi |−i} rewriting the|±i maximally| i ± |entangledi state (136) order to represent the joint system XB in the density op- as erator formalism we also introduced an auxiliary Hilbert space X with fixed orthonormal basis x X x. {| i } 1 ψ AB = ++ AB + AB , (137) | i √2 | i |−−i 2. Classical-quantum entropies which implies that the observer can simply measure the X basis on B to guess X on A. The interpretation of the min-entropy from (17) in terms of the optimal guessing probability gives a natural The ideas described in Ex. 18 can be dated back to the means to generalize the min-entropy to the setting with famous EPR paper (Einstein et al., 1935) and raise the quantum memory. Clearly, an observer with access to question of whether we can still find nontrivial bounds on the quantum memory B can measure out B to improve the uncertainty of complementary measurements when his guess. The optimal guessing probability for such an conditioning on quantum memory. In the rest of Sec.IV observer is then given by the optimization problem we analyze this interplay between uncertainty and quantum correlations quantitatively and present entropic un- X x x certainty relations that allow the observer to have access pguess(X B) := max PX (x) tr XBρB , | XB to (quantum) memory. For that we first introduce mea- x sures of conditional entropy. where XB is a POVM on B. (139) 23

Consequently, the conditional min-entropy is defined 3. Quantum entropies as (König et al., 2009; Renner, 2005), The classical-quantum conditional entropy is merely a H (X B) := log p (X B) . (140) min | − guess | special case of the quantum conditional entropy. It is This is our first measure of conditional entropy. It quan- useful to introduce the latter here, since the quantum tifies the uncertainty of the classical register X from the conditional entropy will play an important role in the perspective of an observer with access to the quantum following. memory (or side information) B. The more difficult it is In the simplest case, the von Neumann conditional en- to guess the value of X, the smaller is the guessing prob- tropy of an arbitrary bipartite state ρAB, whose marginal ability and the higher is the conditional min-entropy. is ρB = trA(ρAB), takes the form The collision entropy from (16) can likewise be interpreted in terms of a guessing probability. Consider a H(A B) := H(ρAB) H(ρB) . (147) | − generalization of the collision entropy to the case where the observer has a quantum memory B, which takes the We remark that, in general, fully quantum conditional 14 form (Buhrman et al., 2008), entropy can be negative. This is a signature of entanglement, and in fact, the quantity H(A B) provides pg − | Hcoll(X B) := log pguess(X B) . (141) a lower bound on the distillable entanglement (Devetak | − | Here, the pretty good guessing probability is given by and Winter, 2005). We will discuss this connection further around (335) below. pg X h x x i p (X B) := PX (x) tr Π ρ , The fully quantum min-entropy also has a connection guess | B B x to entanglement. Namely, it can be written as, x −1/2 x −1/2 where ΠB = PX (x)ρB ρBρB . H (A B) := log dA F (A B) , (148) (142) min | − · | x The ΠB are POVM elements corresponding to the so- where called pretty good measurement. The name is due the fact that this measurement is close to optimal, in the F (A B) := max F ( )(ρAB), φAA0 φAA0 . | E:B→A0 I ⊗ E | ih | sense that (Hausladen and Wootters, 1994), (149) 2 pg pguess(X B) pguess(X B) pguess(X B) . (143) | ≤ | ≤ | Here φAA0 is a maximally entangled state of dimension That is, if the optimal guessing probability is close to one, A , F| denotesi the fidelity, and the maximization is over then so is the pretty good guessing probability. Hence, all| | quantum channels that map B to A0. One can think E Hcoll(X B) quantifies how well Bob can guess X given of F (A B) as the recoverable entanglement fidelity, and that he| performs the pretty good measurement on . In | B in that sense Hmin(A B) quantifies how close the state particular this also implies that is to a maximally− entangled| state. The fully quantum collision entropy can also be related Hmin(X B) Hcoll(X B) 2Hmin(X B) . (144) | ≤ | ≤ | to a recoverable entanglement fidelity, in close analogy Finally, consider the Shannon entropy H(X), whose to the discussion above for the classical-quantum case. quantum counterpart H(ρ) is the von Neumann entropy Namely, we have (Berta et al., 2014a), as defined in (45). The von Neumann entropy of X con- pg ditioned on a quantum memory B, is defined as H (A B) := log dA F (A B) , (150) coll | − · | H(X B) := H(ρXB) H(ρB) . (145) | − where where ρXB is given by (138), and pg pg F (A B) := F ( )(ρAB), φAA0 φAA0 . (151) X x | I ⊗ E | ih | ρB = trX ρXB = PX (x)ρB . (146) x Here pg is the pretty good recovery map, whose action E Although H(X B) does not have a direct interpretation on an operator O is given by | as a guessing probability, it does have an operational T pg h −1/2 −1/2 i meaning in information theory. For example, if Alice (O) = trB (1 ρ Oρ )ρAB , (152) E ⊗ B B samples from the distribution PX and Bob possesses system B, then H(X B) is the minimal information that Alice must send to| Bob in order for Bob to determine the value of X. (More precisely, H(X B) is the minimal | 14 This should not concern us further here; a consistent interpreta- rate in bits per copy that Alice must send to Bob, in the tion of negative entropies is possible in the context of quantum asymptotic limit of many copies of the state ρXB (Deve- information processing (Horodecki et al., 2006) and also in ther- tak and Winter, 2003).) modynamics (del Rio et al., 2011). 24 where T is the transpose. In analogy to (143), the pretty entanglement. In this sense, the relation in (156) cap- good recovery map is close to optimal (Barnum and Knill, tures the intuition of monogamy of entanglement. It im- 2002), plies that if ρAB has a negative conditional entropy, then ρAC must have a positive conditional entropy. So there 2 pg F (A B) F (A B) F (A B) . (153) is a trade-off between the entanglement present in | ≤ | ≤ | ρAB and in ρAC . As in the classical case, the above conditional entropies The relation in (156) is called the duality relation, as emerge as special cases of Rényi entropies (Müller- it relates an entropy to its dual entropy. As we have seen Lennert et al., 2013). We discuss this connection in Ap- the von Neumann entropy is dual to itself but in general pendixC. the duality relation involves two different entropies. For example, the min-entropy is dual to the max-entropy,

4. Properties of entropy H (A B) := H (A C) . (157) max | − min | Section III.A.3 discussed properties of entropies, We take (157) as the deﬁnition of the max-entropy, al- which, as we will see, are special cases of conditional though an explicit expression in terms of the marginal entropies. Here we mostly discuss properties of the con- ρAB can be derived (König et al., 2009). More generally, ditional von Neumann entropy H(A B), and only note the duality relation for the Rényi entropy family is given that similar properties also hold for other| conditional en- in App. C.2. tropies such as Hmin(A B) and Hcoll(A B) (or more general Rényi entropies). | | Firstly, the conditional entropy reduces to the uncon- C. Classical memory uncertainty relations ditional entropy for product states. That is, for bi- We now have all the measures at hand to discuss un- partite states of the form ρAB = ρA ρB, we have certainty relations that allow for a memory system. Nat- H(A B) = H(A). Secondly, note that⊗ the entropy of classical-quantum| is non-negative, urally, we begin with the simplest case of a classical memory. It turns out that uncertainty relations that allow for H(X B) 0 for X a classical register. (154) classical memory are often easy to derive from the un- | ≥ certainty relations without memory, particularly for the In contrast, as noted above, the fully quantum entropy Shannon entropy (Hall, 1995). Consider the conditional H(A B) can be negative. Shannon entropy, which can be written as | A fundamental property is the so-called data- X H(X Y ) = H(XY ) H(Y ) = PY (y)H(X Y = y) . processing inequality. It says that the uncertainty of A | − | conditioned on some system B never goes down if one y processes system B, i.e., acts on B with a quantum chan- (158) nel : B B0. That is (Lieb and Ruskai, 1973; Lind- E → Now consider some generic Shannon entropy uncertainty blad, 1975; Uhlmann, 1977), n relation for measurements X and quantum states ρA: 0 X H(A B) H(A B ) . (155) H(X ) q where P (x) = x ρ x | ≤ | n Xn Xn A Xn n ≥ h | | i This includes the case where system B = B B is bi- 1 2 and q > 0 state-independent . (159) partite and the processing corresponds to discarding a subsystem, say B2. In this case the data-processing in- The goal is to extend this to quantum classical states ρAY equality takes the form H(A B) H(A B1). This in- where the classical memory Y holds some information | ≤ | equality is intuitive in the sense that having access to about the preparation of the quantum marginal more information can never increase the uncertainty. X y Another useful property of conditional entropies is re- ρAY = PY (y) ρ y y Y with distributions A ⊗ | ih | lated to the monogamy of entanglement. This corre- y sponds to the idea that the more is entangled with x y x A PXnY (x, y) = PY (y) Xn ρA Xn . B the less A is entangled with a purifying system C. h | | (160)i Suppose that C is a system that puriﬁes ρAB, i.e., However, assuming that the uncertainty relation (159) ρABC = ψ ψ . Then, we have | ih | holds for all quantum states, it holds in particular for y H(A B) = H(A C) . (156) each conditional state ρA associated with Y = y in the | − | classical memory Y . Averaging over y gives Typically one associates entanglement with a negative X X X conditional entropy, and indeed as discussed above, mi- PY (y) H(Xn Y = y) PY (y)q = q . (161) | ≥ nus the conditional entropy lower bounds the distillable y n y 25

Hence, we ﬁnd by (158) that Alice Θ = Z Θ Bob X X K H(Xn) q = H(Xn Y ) q . (162) K? n ≥ ⇒ n | ≥

That is, any Shannon entropy uncertainty relation of X A B ρAB the form (159) implies a corresponding uncertainty re- Θ = lation in terms of the conditional Shannon entropy of the form (162). Note that the conditional version (162) even provides a stronger bound, since by the data-processing FIG. 8 Cartoon showing the guessing game in the presence inequality (155) conditioning on side information can of a memory system. First, a source prepares AB in state only reduce uncertainty. ρAB , and then sends system A to Alice and system B to Bob. Second, Alice performs either the X or Z measurement on A, Example 19. Consider a bipartite state ρAB, where Al- and then announces the measurement choice Θ to Bob. Bob wins the guessing game if he correctly produces K. The ques- ice will measure system A in one of two bases X or Z and Bob will measure system B in the basis . Then, tion is thus: how uncertain is Bob about Alice’s measurement Y outcome K, given that he has access to B and Θ. the Maassen-Uﬃnk relation (31) already implies 1 H(X Y ) + H(Z Y ) log , (163) | | ≥ c to keep a quantum memory system in order to help him for the distribution guess Alice’s measurement outcome. This is illustrated x y x y in Fig.8: PXY (x, y) = X Y ρAB X Y , (164) h ⊗ | | ⊗ i 1. Bob prepares a bipartite quantum system AB in a and analogously PZY (z, y). state ρAB. He sends system A to Alice while he It is also worth noting that the classical memory Y keeps the system B. can be considered multipartite, say, of the form Y = 2. Alice performs one of two possible measurements, Y Y ...Y (Cerf et al., 2002; Renes and Boileau, 2009). X 1 2 n or , on A, and stores the outcome in the classical Since by the data-processing inequality (155) discarding Z register K. She communicates her choice to Bob. subsystems of Y can never reduce the uncertainty, (162) already implies that 3. Bob’s task is to guess K. X X H(Xn) q = H(Xn Yn) q . (165) Note that in this game, Bob can make an educated guess ≥ ⇒ | ≥ n n based on his quantum memory B.

Example 20. Consider a tripartite state ρABC , where Example 21. Let the A system be one qubit and Alice’s Alice will measure system A in one of two bases or X two measurements given by σX and σZ. Then Bob can win Z, Bob will measure system B in the basis YB, and the the game with probability one by just preparing the maxi- third party Charlie will measure system C in the basis mally entangled state and using the strategy described in YC . Then, the Maassen-Uffink relation (31) implies Ex. IV.A. 1 This example illustrates the power of a quantum mem- H(X YB) + H(Z YC ) log . (166) | | ≥ c ory, and in particular, one that is entangled with the This relation is reminiscent of the scenario in quantum system being measured. At first sight, this might seem key distribution. Namely, if Alice and Bob verify that to violate the usual notion of the uncertainty principle. H(X PB) is close to zero, then (166) implies that Charlie However, of course, it does not. What it illustrates is that | is fairly ignorant about Z. That is, H(Z YC ) is roughly the usual formulations of the uncertainty principle, such log(1/c) or larger. We emphasize, however,| that (166) as the Kennard-Robertson relation (2) or Maassen-Uffink cannot be used to prove security against general quantum relation (31), are not about conditional uncertainty. The memory eavesdropping attacks. relations (2) and (31) are perfectly valid but limited in this sense.

D. Bipartite quantum memory uncertainty relations 2. Measuring in two orthonormal bases 1. Guessing game with quantum memory Let us first discuss how the Maassen-Uffink rela- Let us now make explicit what the guessing game (see tion (31) can be extended to the setup when the observer Section III.F) looks like when we allow quantum mem- has a quantum memory. Note that Ex. 18 and 21 illus- ory. Specifically, the rules of the game now allow Bob trate that the bound in the uncertainty relation must 26 become trivial in the case where Bob’s memory is max- This last example illustrates that (167) has applica- imally entangled to Alice’s system. On the other hand, tions for entanglement witnessing. More precisely, first we know that the bound must be non-trivial when Bob note that by the data-processing inequality (155), (167) has no memory, since this corresponds to the situation also implies covered by the Maassen-Uffink relation (31). Likewise if Bob has a memory that is only classically correlated 1 H(X YB) + H(Z WB) log + H(A B) to Alice’s system, then we already saw in (163) that the | | ≥ c | Maassen-Uffink relation can be extended. Therefore, it with YB and WB measurements on B. (172) becomes clear that we need a state-dependent extension: a bound that becomes weaker as Bob’s memory is more Now violating this log(1/c) lower bound implies that the entangled with Alice’s system. Indeed, Berta et al. (2010) state ρ must be entangled. We discuss this in detail have proven the following uncertainty relation: for any AB in Sec. VI.D. bipartite state ρAB and any orthonormal bases X and Z, Using the following extension of the notation from 1 Sec. III.F to quantum memory, H(X B) + H(Z B) log + H(A B) , (167) | | ≥ c | 1 X X with the overlap c as in (32). Here, the conditional en- ρK B := k k K j j Θ 2 | ih | ⊗ | ih |Θ tropy H(X B) is evaluated on the classical quantum state k j=X,Z | X † x 1 x 1 k Uj 1B ρAB Uj k 1B , (173) ρXB = x x X X B ρAB X B , ⊗ h | ⊗ | i ⊗ x | ih | ⊗ h | ⊗ | i ⊗ (168) we can rewrite (167) as and similarly for H(Z B). The classical quantum con- | 1 1 ditional entropies H(X B) and H(Z B) quantify Bob’s H(K BΘ) log + H(A B) . (174) uncertainty about X and| Z respectively,| given that Bob | ≥ 2 c | has access to the quantum memory B. The quantity H(A B) on the right-hand side of (167) This is the extension of (64) to quantum memory. Writ- | makes the bound state-dependent. We already men- ing the relation in this way also makes a connection to tioned around (147) that H(A B) is a quantifier of the the guessing game discussed in Sec. IV.D.1, see Fig.8. − | entanglement present in ρAB. For maximally entangled We point to Sec. IV.D.7 for a partial extension of (174) states we have H(A B) = log dA, whereas for all sepa- in terms of the more operational min-entropy. rable (i.e., non-entangled)− | states we have H(A B) 0. | ≥ Let us take a step back and look at the history that led Example 22. Let us explore in more detail how the up to the uncertainty relation (167). Arguably the first bound (167) behaves for some illustrative cases: work on uncertainty relations with quantum memory was by Christandl and Winter(2005). Their formulation was 1. For maximally entangled states we get restricted to bases that are related by the Fourier trans- form but their work captures similar intuition as (167). 1 1 log + H(A B) = log log dA 0 , (169) The main difference, however, is that their relations are c | c − ≤ formulated for quantum channels rather than for quan- and hence the bound becomes trivial. This is as tum states. We discuss quantum channel uncertainty re- expected from the guessing game example discussed lations in Sec. IV.G. in Section IV.D.1. Renes and Boileau(2009) gave the first quantum memory uncertainty relation in terms of the quantum state 2. For the case when Bob has no memory (i.e., B is perspective. However, instead of bipartite states ρ , trivial), (167) reduces to (47), AB they considered tripartite states ρABC . We discuss en- 1 tropic uncertainty relations for tripartite states in the H(X) + H(Z) log + H(ρA) . (170) ≥ c next subsection (Sec. IV.E). Moreover, there is a close connection between tripartite and bipartite uncertainty This is essentially the Maassen-Uffink relation but relations. In fact, as we will also discuss in Sec. IV.E, strengthened for mixed states. Renes and Boileau(2009) conjectured a tripartite uncer- 3. If B is not entangled with A (i.e., the state is sep- tainty relation that is equivalent to (167). Sec. IV.E also arable), then H(A B) 0. Hence, we obtain discusses the proof of quantum memory uncertainty rela- | ≥ tions such as (167), and notes that the tripartite formu- 1 lation of (167) naturally generalizes to the Rényi entropy H(X B) + H(Z B) log . (171) | | ≥ c family. 27

3. Arbitrary measurements this information is not taken into account by the overlaps c or c00, nor by the entanglement of the initial state as Here we discuss some generalizations of (167) for ar- measured by H(A B). Example 23 suggests that (167) bitrary measurements. (See also Sec. IV.E.6 for a dis- can be generalized| by considering the difference in entan- cussion of how the tripartite formulation generalizes to glement of the state before and after measurement. In arbitrary measurements.) fact, Tomamichel(2012) shows the bipartite uncertainty Recall from Sec. III.D that the Maassen-Uffink relation relation generalizes to POVMs with the overlap c given by (49). In contrast, (167) does not hold for general POVMs with 1 H(X B) + H(Z B) log 0 + H(A B) c as in (49). This can be remedied in two ways. The | | ≥ c | n o approach by Frank and Lieb(2013a) leads to a relation min H(A0 XB),H(A0 ZB) , (180) of the form (167) using a weaker complementarity factor. − | | We have with c0 given by (51). The entropies H(A0 XB) and 0 | 1 H(A ZB) are evaluated for the post-measurement states H(X B) + H(Z B) log + H(A B) (175) | | | ≥ c00 | 00 x z X x 1 x 1 where c = max tr X Z . (176) ρXA0B = x x X (XA B)ρAB(XA B) (181) x,z x | ih | ⊗ ⊗ ⊗ X 00 00 z 1 z 1 Note that in general and that reduces to for ρZA0B = z z Z (ZA B)ρAB(ZA B) , (182) c c c c | ih | ⊗ ⊗ ⊗ measurements≥ in bases. However, one may argue that z the form (175)–(176) is not natural if we consider gen- respectively. (We use 0 to denote the system af- eral projective measurements or POVMs. This is best A = A A ter measurement to avoid confusion.) Notably, the terms explained by means of an example (Furrer et al., 2014). H(A0 XB) vanish for measurement given by a basis since | Example 23. Consider a quantum system A comprised in this case the state of A0 is pure conditioned on X. of two qubits, A1 and A2, where A1 is maximally en- Example 23 (continued). It is straightforward to tangled with a second qubit, B, and A2 is in a fully see that if A (A ) is measured, the average entangle- mixed state, in product with A1 and B. We employ rank- 1 2 ment left in the post-measurement state measured by the two projective measurements XA1 and ZA1 which measure von Neumann entropy is given by H(A B) (H(A B)). A1 in two mutually unbiased bases and leave A2 intact. 2 1 Hence, (180) turns into | | Analogously, we employ XA2 and ZA2 which measure A2 in two mutually unbiased bases and leave A intact. Eval- 1 1 uating the terms of interest for the measurement pairs H(X B) + H(Y B) log + H(A B) H(A0 B) , , and , yields c = 1 and c00 = 1 in | | ≥ c | − | XA1 ZA1 XA2 ZA2 2 (183) {both cases.} Moreover,{ we find} that 0 H(A B) = H(A B) + H(A ) = 1 + 1 = 0 . (177) where A corresponds to A2 (A1). This inequality is tight | 1| 2 − for both measurements. Hence, the right hand side of the Frank and Lieb relation (175) vanishes for both measurement pairs. Indeed, if the maximally entangled system A1 is measured, we 4. Multiple measurements find that The basic goal here is to lift some of the relations H(X B) + H(Y B) = 0 , (178) in Sec. III.G to quantum memory. A general approach | | for deriving such relations is provided in (Dupuis et al., and the bound in (175) becomes an equality for the mea- 2015). The extensions will be to the bipartite setting as surement pair XA1 , ZA1 . On the other hand, if A2 is { } in (167). As in the unconditional case (cf. Sec. III.G.1), measured instead, we find that relations for two measurements already imply bounds for larger sets of measurements. For example for two qubit H(X B) + H(Y B) = 2 , (179) | | states ρAB and the Pauli measurements performed on and the bound is far from tight for the measurement pair the A-system we find by the simple iterative application of the bound (167) for the measurement pairs σX, σY , XA2 , ZA2 . { } { } σX, σZ , and σY, σZ that Examining this example, it is clear that the expected { } { } 1 1 uncertainty depends strongly on which of the two systems H(K BΘ) + H(A B) with Θ σ , σ , σ . is measured. Or, more generally, on how much entangle- | ≥ 2 2 | ∈ { X Y Z} ment is consumed in the measurement process. However, (184) 28

Here we use the following extension of the notation from Since the collision entropy has an interpretation in Sec. III.G to quantum memory, terms of the pretty good guessing probability (141),

pg 1 X X Hcoll(X B) = log pguess(X B) , (191) ρK B := k k K j j | − | Θ 3 | ih | ⊗ | ih |Θ k=1,2 j=X,Y,Z and the pretty good recovery map (150), † pg k Uj 1B ρAB Uj k 1B . (185) H (A B) = log dA F (A B) , (192) ⊗ h | ⊗ | i ⊗ coll | − · | Note that alternatively the left-hand side of (184) might the uncertainty equality (188) can be understood as an also be written as entanglement-assisted game of guessing complementary measurement outcomes (as described in Sec. IV.D.1). 1 Namely, we can rewrite (188) as, H(K BΘ) = H(K BΘ = σX) + H(K BΘ = σY) | 3 | | pg pg d F (A B) + 1 + H(K BΘ = σ ) . (186) pguess(K BΘ) = · | . (193) | Z | d + 1 where This gives a one-to-one relation between uncertainty (cer- pg tainty) as measured by pguess(K BΘ) and the absence (presence) of entanglement as measured| by F pg(A B). In ρKB|Θ=σ X contrast, quantum memory assisted uncertainty relations| X † := k k K k UX 1B ρAB UX k 1B , for two measurements as, e.g., in (174) only provide us | ih | ⊗ h | ⊗ | i ⊗ k=1,2 with a connection between uncertainty and entanglement (187) in one direction. Namely, that low uncertainty implies the presence of entanglement (cf. Sec. VI.D). and similarly for . We refer to Sec. III.A for an σY, σZ The uncertainty equality (188) is derived by extend- in depth discussion of conditional entropies. The goal ing the proof from (Ballester and Wehner, 2007) that in all of Sec. IV.D.4 will be to ﬁnd uncertainty relations made use of the fact that a full set of mutually unbiased that are stronger than any bounds that can be derived bases generates a complex projective two-design (Klap- directly from relations for two measurements. penecker and Rotteler, 2005). From this, it is also imme- diate that an equality as (188) holds for other complex projective two-designs as well. This includes in partic- 5. Complex projective two-designs ular so-called symmetric informationally complete positive operator valued measures: SIC-POVMs.15 More Berta et al. (2014a) show that the uncertainty equal- precisely, any SIC-POVM ity (81) in terms of the collision entropy for a full set of 2 MUBs also holds with quantum memory. That is, for 1 d any bipartite state ρ with a full set of d + 1 MUBs on ψk ψk (194) AB d| ih | the d dimensional A-system, k=1 gives rise to the uncertainty equality −Hcoll(A|B) Hcoll(K BΘ) = log(d + 1) log 2 + 1 | − H (K BΘ) = log d(d + 1) log 2−Hcoll(A|B) + 1 coll | − with Θ θ1, . . . , θd+1 . ∈ { (188)} with Θ θ1, . . . , θd+1 . ∈ { (195)} Here, as in (173), we use the notation, Other examples that generate complex projective two- 16 d d+1 designs are unitary two-designs. This includes in par- 1 X X ticular the Cliﬀord group for n qubit systems. ρKΘB := k k K j j Θ d + 1 | ih | ⊗ | ih | Berta et al. (2014b) also show that the relation (188) k=1 j=1 for a full set of d + 1 MUBs generates the following rela- † k U 1B ρAB (Uj k 1B) . tion in terms of the von Neumann entropy, ⊗ h | j ⊗ | i ⊗ (189) n o H(K BΘ) log(d + 1) 1 + min 0,H(A B) | ≥ − | Example 24. For the qubit Pauli measurements (188) with Θ θ1, . . . , θd+1 . (196) yields: ∈ { } −Hcoll(A|B) Hcoll(K BΘ) = log 3 log 2 + 1 | − 15 We refer to (Renes et al., 2004) for more on these objects. with Θ σ , σ , σ . (190) 16 We refer to (Dankert et al., 2009) for more on these objects. ∈ { X Y Z} 29

techniques from (Berta et al., 2014a) based on operator 2.0 Chernoﬀ bounds to derive relations of the form (198). The downside is that we only get strong uncertainty re- Θ) 1.5 n = 1 ... 5 ub B | n = 6 ub/lb lations for a large number L of measurements, that is, K ( n = 5 lb 1.0 coll n = 4 lb L O d log(d) . (199)

H n = 3 lb ≥ n = 2 lb 0.5 n = 1 lb We conclude that it is an open problem to show the existence of small(er) sets of L > 2 measurements that generate strong uncertainty relations that hold with quantum -2 -1 0 1 2 Hcoll(A|B) memory. FIG. 9 For d = 5 and a various number of MUBs n ≤ d+1 = 6 we plot the lower bounds (lb) on the entropic uncertainty 7. BB84 and six state measurements Hcoll(K|Θ) from (197) as a function of Hcoll(A|B). More- over, for n < 6 we only have the trivial upper bound (ub) on Hcoll(K|BΘ), whereas for n = 6 the lower and upper coincide Let us now consider uncertainty relations as they are as in (188). of relevance in quantum cryptography. For historical reasons we start with the n qubit six state measurements and only discuss the BB84 measurements later. For the six state measurements, Berta(2013) shows that for any bi- This corresponds to the generalization of (80) to quan- n partite state ρAnB with the A -system given by n qubits, tum memory. Note that the entropy dependent term on n the right-hand side only makes a contribution if the con- n n −Hcoll(A |B) Hcoll(K BΘ ) n log 3 log 2 + 1 ditional entropy H(A B) is negative. This is consistent | ≥ · − | n with (80). with Θ θ1, . . . , θ3n . ∈ { } For smaller sets of L < d+1 MUBs, Berta et al. (2014a) (200) extend (93) to quantum memory, This extends (190) from one to n qubits. The

Hcoll(K BΘ) bound (200) also implies a similar relation in terms of | the von Neumann entropy (Berta et al., 2014b), extend- ( d·2−Hcoll(A|B)+L−1 log L·d for Hcoll(A B) 0 ing (107) to − −H (A|B) | ≥ ≥ d+(L−1)2 coll log L·d for Hcoll(A B) < 0 − | n n n n o H(K BΘ ) n log 3 + min 0,H(A B)ρ with Θ θ , . . . , θL . ∈ { 1 } | ≥ · | (197) n with Θ θ , . . . , θ n . (201) ∈ { 1 3 } Moreover, for all d and L there exist states that achieve More importantly, Dupuis et al. (2015) improved (200) equality. Note that for L = d + 1 the distinction of cases to the conceptually diﬀerent bound in (197) collapses and furthermore also become an upper n bound as shown in (188). In Fig.9 we illustrate this by n n Hcoll(A B) H (K BΘ ) n γ s | 1 , (202) means of an example for d = 5 (with L 6). coll | ≥ · 6 n − ≤ where 6. Measurements in random bases log 3 x if x 2 γ6s(x) := −1 ≥ log 3 In the unconditional case we found that measurements f (x) log 3 if x < 2 in random bases lead to strong uncertainty relations as, with f(x) = h(x) + x log 3 1 , (203) e.g., in (100). Hence, we might expect that we can gen- − eralize this to quantum memory, and h(x) denotes the binary entropy function. Using the equivalence between the collision and the min-entropy ? 1 n o from (144) this readily implies a relation as (202), but H(K BΘ) O log d 1 + min 0,H(A B) | ≥ · − L | with both the collision entropy terms Hcoll replaced with with Θ θ , . . . , θ chosen at random . min-entropy terms Hmin. Importantly, this variant re- 1 L n ∈ { } (198) mains non-trivial for all values of Hmin(A B). What’s more, (Dupuis et al., 2015) establishes a powerful| meta Unfortunately, the previous works (Fawzi et al., 2011) theorem that can be used to derive uncertainty relations and (Adamczak et al., 2014) make use of measure concen- also for other kinds of measurements, which ﬁnd applica- tration and ε-nets arguments that seem to fail for quan- tions in quantum cryptography (Ribeiro and Grosshans, tum memory. It is, however, possible to use some of the 2015). 30

For the n qubit BB84 measurements Dupuis et al. (2009) consider exactly this scenario but restrict to the (2015) find case where the X and Z bases are related by the Fourier matrix F , n n n Hcoll(A B) Hcoll(K BΘ ) n γBB84 | 1 −zz0 | ≥ · n − x x X ω z z0 n X = F Z with F = Z Z n | i | i √ | ih | with Θ θ1, . . . , θ2 . z,z0 d ∈ { }(204) where ω = e2πi/d . (207) where Notice that this makes X and Z mutually unbiased, al- 1 x if x 2 though in general not all pairs of MUBs are related by γBB84(x) := −1 ≥ 1 g (x) if x < 2 the Fourier matrix. They quantified Bob’s and Charlie’s with g(x) = h(x) + x 1 . (205) uncertainty in terms of the conditional entropies H(X B) − and H(Z C) respectively, and proved that any tripartite| | Again using the equivalence between the collision and the state ρABC satisfies the relation min-entropy from (144), we get a relation as (204) but with both the collision entropy terms H replaced with H(X B) + H(Z C) log d . (208) coll | | ≥ min-entropy terms Hmin. We note that this is even new for one qubit (n = 1) and only the two measurements Here d is the dimension of the A system and the classical- quantum states ρXB and ρZC are defined similarly as Θ σX, σZ . The relation (204) and its min-entropy analogue∈ { can} be understood in terms of the bipartite in (168). Renes and Boileau(2009) also conjectured that guessing game with quantum memory as mentioned in this relation generalizes to arbitrary measurements given Sec. IV.D.1. by bases, 1 H(X B) + H(Z C) log , (209) 8. General sets of measurements | | ≥ c with the overlap c as in (32). Intuitively, what (208) says Liu et al. (2015) also give bipartite entropic uncertainty is that the more Bob knows about Z, the less Charlie relations with quantum memory for general sets of mea- knows about X, and vice-versa. This is a signature of the surements. Again for simplicity we only state the case of well-known trade-off monogamy of entanglement, which L = 3 observables (in any dimension d 2). We find as roughly says that the more Bob is entangled with Alice, ≥ the direct extension of (108), the less he is with Charlie.17 The trade-off described by (208) and (209) can be viewed as a more fine-grained 1 1 2 H(K BΘ) log + H(A B) notion of this monogamy, namely the monogamy appears | ≥ 3 m 3 | at the level of measurement pairs (X, Z). with Θ V (1),V (2),V (3) , (206) ∈ { } Also note that (209) implies both the Maassen-Uffink relation (31) and its classical memory extension (166), where the multiple overlap constant m is defined as due to the data-processing inequality (155). That is, in (109). Like in the unconditional case, this has to be compared with the bounds implied by two measure- H(X B) H(X Y ) H(X) , (210) ment relations as in (184). We refer to (Liu et al., 2015) | ≤ | ≤ for a fully worked out example where (206) can become for any measurement Y on B. As we will see stronger than any bounds implied by two measurement in Sec. IV.E.3 the quantum memory extension (209) relations. is strictly stronger than the classical memory extension (166).

E. Tripartite quantum memory uncertainty relations 2. Proof of quantum memory uncertainty relations 1. Uncertainty relation with quantum memory The quantum memory uncertainty relation (209) was The physical scenario corresponding to tripartite un- ﬁrst proved by Berta et al. (2010). Although these au- certainty relations is shown in Fig. 10. Suppose there is a thors stated their relation in the bipartite form (167), the source that outputs ABC in state ρABC . Systems A, B, two relations are equivalent. and C are respectively sent to Alice, Bob, and Charlie. Then Alice performs either the X or Z measurement. If she measures X, then Bob’s goal is to minimize his uncertainty about X. If she measure Z, then Charlie’s goal is 17 We refer to (Horodecki et al., 2009) for an in-depth review about to minimize his uncertainty about Z. Renes and Boileau entanglement. 31

Charlie by Coles et al. (2012). The latter proof distills the main ideas of the previous proofs: the use of duality relations Alice Z? for entropies as in (156) and the data-processing inequal- Z ity as in (155). More generally, the proof technique ap- X plies to a whole family of entropies satisfying a few ax- Bob ioms (including the Rényi entropies). We will present the ρ ABC proof in App. C.3. Finally, we note that a direct matrix X? analysis proof was given by Frank and Lieb(2013a).

FIG. 10 Cartoon showing the tripartite memory scenario. 3. Quantum memory tightens the bound First, a source prepares ABC in state ρABC , then sends A to Alice, B to Bob, and C to Charlie. Then, Alice mea- Here we argue that the tripartite uncertainty rela- sures either X or Z on A and asks: how uncertain is Bob about her X outcome, given B, and how uncertain is Charlie tion in terms of quantum memory (209) is tighter than about her Z outcome, given C? As shown in (209) there is the corresponding relation in terms of classical mem- a trade-off that is quantified by the complementarity of the ory (166). We will show that there exists states ρABC measurements X and Z. We can also interpret this scenario for which (209) is an equality but (166) is loose, even if as a guessing game, also called a monogamy game, that may one optimizes over all choices of measurements on B and look slightly different at first glance: In this game, Bob and C. Charlie play against Alice. They prepare ρABC where they send A to Alice, Bob keeps B and Charlie keeps C. Alice First, let us introduce some notation. Consider a bi- then randomly chooses a measurement obtaining outcome K. partite state ρAB and let XA and YB be measurements Afterwards, she sends her choice of basis to Bob and Charlie. on systems A and B, respectively. Now, how small can They win if and only if Bob outputs K, and at the same time we make the uncertainty XA given that we can optimize Charlie outputs K. An uncertainty relation says that Bob over all choices of YB? That is, consider the quantity and Charlie cannot win perfectly, that is, not both Bob and Charlie can produce K. This game measures the same kind of α(XA, ρAB) := min H(XA YB) . (213) uncertainty, explicitly exploiting the monogamy of entangle- YB | ment: if Bob produces K = X correctly if Alice measured X, then this is a certificate that Charlie cannot produce a good This is to be compared to the classical-quantum condi- guess of K = Z if Alice measured Z. tional entropy

β(XA, ρAB) := H(XA B) . (214) | The equivalence between the bipartite and tripartite Due to the data-processing inequality (155), we have that relations can be seen as follows. To obtain the bipartite α(XA, ρAB) β(XA, ρAB) , (215) relation (167) from the tripartite relation (209), apply the ≥ latter to a purification ψ ABC of ρAB. Now for tripartite | i and naively one might guess that (215) is satisfied with pure states we have, equality in general. However, this is false (DiVincenzo et al., 2004; Hiai and Petz, 1991). In general there is a H(Z C) = H(Z B) H(A B) , (211) | | − | non-zero gap: and inserting this into (209) gives (167). α β > 0 . (216) Conversely we first prove (209) for tripartite pure − states ψ ABC by inserting (211) into (167). Then, note | i There are many examples to illustrate this, in fact one that the proof for mixed states ρABC follows by apply- can argue that most states ρAB exhibit a gap between α ing (209) to a purification ψ ABCD of ρABC , and making | i and β (Dupuis et al., 2013). This phenomenon is called use of the data-processing inequality (155), locking and we discuss it more in Sec. VI.H.3. It is closely related to a measure of quantum correlations known as H(Z CD) H(Z C) . (212) | ≤ | quantum discord (Modi et al., 2012; Ollivier and Zurek, The original proof of (209) was based on so-called 2001): non-zero discord is associated with the potential smooth entropies.18 The proof was subsequently sim- to have a gap between α and β. We discuss discord in plified by Tomamichel and Renner(2011) and Coles more detail in Sec. VI.H.2. For now we note that discord et al. (2011), which culminated in the concise proof given is defined as,

D(A B) := min H(A YB) H(A B) (217) | YB | − |

18 We refer to (Tomamichel, 2016) for an introduction to smooth where the optimization is over all POVMs YB on B. Con- entropies. sider the following example. 32

Example 25. Let XA = 0 0 , 1 1 and consider the 5. Extension to Rényi entropies bipartite quantum state: {| ih | | ih |} The Maassen-Uﬃnk relation for Rényi entropies (35) 1 ρAB = 0 0 0 0 + 1 1 + + . (218) naturally generalizes to a tripartite uncertainty relation 2 | ih | ⊗ | ih | | ih | ⊗ | ih | with quantum memory. It is expressed in terms of the For this state, the gap between α and β is precisely given conditional Rényi entropies, whose deﬁnition and prop- by the discord, erties are discussed in App.C. For these entropies, the following relation holds (Coles et al., 2012):19 D(A B) = α(XA, ρAB) β(XA, ρAB) . (219) | − 1 1 1 Hα(X B) + Hβ(Z C) log for + = 2 . It is known that D(A B) = 0 if and only if system B is c α β | | | ≥ classical, i.e., if ρAB is a quantum-classical state. But (225) the state ρAB in (218) is not quantum-classical. Hence, Notably, the tripartite uncertainty relation (209) is the D(A B) > 0 and we have α > β. | special case where α = β = 1. Another interesting spe- Now we give an example state for which the quantum cial case is α = and β = 1/2, which respectively corre- memory relation (209) is an equality but the measured spond to the min-∞ and max-entropies that we introduced relation (166) is loose. in (140) and (157). The resulting relation,

Example 26. Let dA = dB = dC = 2 and consider 1 Hmin(X B) + Hmax(Z C) log , (226) the tripartite state ψ ABC = ( 000 + 11+ )/√2, with Z | | ≥ c | i | i | i being the standard basis and X being the + , basis. was first proved by Tomamichel and Renner(2011), {| i |−i} We have and is fundamental to quantum key distribution (see Sec. VI.B). H(Z C) = 1 H(ρC ) 0.4 (220) | − ≈ H(X B) = H(ρC ) 0.6 . (221) | ≈ 6. Arbitrary measurements Hence, this state satisfies the quantum memory relation (208) with equality, All of the tripartite uncertainty relations stated above H(X B) + H(Z C) = 1 . (222) can be generalized to arbitrary POVMs X and Z. Coles | | et al. (2011) and Tomamichel and Renner(2011) in- However, the classical memory relation (166) is not sat- dependently noted that (209) holds for POVMs with isfied with equality. This follows from Ex. 25, noting that the overlap c given by (49). This was strengthened 0 ρAC is the same state as in (218). by Tomamichel(2012) to the overlap c given by (51). Further strengthening was given by Coles and Piani (2014b). However, their bound is implicit, involving an 4. Tripartite guessing game optimization over a single real-valued parameter over a bounded interval. Namely, they show a lower bound We note that also tripartite uncertainty relations can be understood in the language of guessing games as qCP2 := max λmin(∆(p)) , (227) 0≤p≤1 outlined in Figure 10, in particular, the concept of a where λ [ ] denotes the minimum eigenvalue and monogamy game. Tomamichel et al. (2013) show that min · there is fundamental trade-off between Bob’s guessing ∆(p) := p δ(X, Z) + (1 p)δ(Z, X) (228) probability and Charlie’s guessing proba- − pguess(K BΘ) X x | δ( , ) := ax( , ) (229) bility pguess(K CΘ), X Z X Z X | x ·

pguess(K BΘ) + pguess(K CΘ) 2b , (223) X z x z ax(X, Z) := log Z X Z . (230) | | ≤ − with the overlap b as in (40). Alternatively, one can z rewrite this in terms of the min-entropy using the con- Using the fact that δ(X, Z) minx ax(X, Z) 1, it is cavity of the logarithm, straightforward to show that q≥ log(1/c0). · CP2 ≥ 1 Hmin(K BΘ) + Hmin(K CΘ) 2 log . (224) | | ≥ b 19 More precisely, the relation follows from the work (Coles et al., Note that this relation (224) is an extension of (71) to the 2012) in conjunction with properties of the conditional Rényi tripartite scenario. These relations again show a trade-off entropy presented in (Müller-Lennert et al., 2013). It is thus first mentioned in the later work (Müller-Lennert et al., 2013). between Bob’s and Charlie’s winning probability, which Notably Coles et al. (2012) proves a tripartite uncertainty re- is closely connected to the idea of monogamy of entan- lation for a different definition of the conditional Rényi en- glement (cf. Sec. IV.E.1). tropy (Tomamichel et al., 2009). 33

F. Mutual information approach We have H(Xn) log d for each n with d the dimension of the quantum system≤ A that is measured. Combining While entropy quantifies the lack of information, it is this with (233) gives both intuitive and useful to also consider measures that N quantify the presence of information or correlation. Con- X I(Xn : Y ) N log d q . (234) sider the mutual information I(X : Y ), which quantities ≤ − the correlation between random variables X and Y , and n=1 is given by For example, if we take the Maassen-Uffink relation (31) as the starting point, we end up with I(X :Y ) := H(X) + H(Y ) H(XY ) (231) − 2 = H(X) H(X Y ) . (232) I(X : Y ) + I(Z : Y ) log(d c) =: rH (235) − | ≤ The information exclusion relation in (235) was presented Mutual information is a central quantity in information in (Hall, 1995). Note that we have , theory (Cover and Thomas, 1991; Shannon, 1948). It log d rH 2 log d with reaching the extreme points respectively≤ ≤ for quantifies the information gained—or equivalently, the rH c = 1/d and c = 1. reduction of ignorance—about X when given access to Equation (235) has an intuitive interpretation: any Y . classical memory cannot be highly correlated to two complementary measurement outcomes of a quantum system. In the fully complementary case, the bound be- 1. Information exclusion principle comes rH = log d, implying that if the classical memory is perfectly correlated to X, I(X : Y ) = log d, then it Hall pioneered an alternative formulation of the uncer- must be completely uncorrelated to Z, I(Z : Y ) = 0. tainty principle based on the mutual information, which he called the information exclusion principle (Hall, 1995, 1997). Information exclusion relations are closely related 3. Stronger bounds to entropic uncertainty relations that allow for memory, hence is it natural to discuss them here. The idea is Notice that (235) uses the same overlap c as appearing that one is interested in the trade-off between a memory the Maassen-Uffink uncertainty relation (31). However, system Y being correlated to X versus being correlated Grudka et al. (2013) realized that this often leads to a to Z (with X and Z being two measurements on some fairly weak bound. Rather the complementarity of the quantum system A). mutual information should depend highly on more ele- It is worth noting that the mutual information is par- ments of the overlap matrix [cxz] as in (32) than simply ticularly well-suited for applications involving the trans- the maximum element c. They conjectured a stronger mission of information over a quantum channel. Here, information exclusion relation, of the form one is interested in the correlations between a receiver   and a sender. Hence, we will also discuss the application X of information exclusion relations to transmission over I(X : Y ) + I(Z : Y ) rG, rG = log d cxz , ≤ 2 · channels. d largest (236)

with the sum over the largest terms of the matrix . 2. Classical memory d [cxz] This conjecture was proved in (Coles and Piani, 2014b), where the bound was further strengthened to Following Hall’s derivation (Hall, 1995), we show now how information exclusion relations follow directly from I(X : Y ) + I(Z : Y ) r , (237) entropic uncertainty relations. Consider a generic un- ≤ CP certainty relation involving Shannon entropy terms, of with PN the form H(Xn)ρ q as in (159). Recall the dis- n=1 ≥ n o cussion in Sec. IV.C which showed that the uncertainty rCP = min r(X, Z), r(Z, X) (238a) PN relation n=1 H(Xn Y ) q as in (162) immediately fol- ! lows, where Y is some| classical≥ memory. Now with the X r( , ) = log d max cxz (238b) X Z z deﬁnition of the mutual information (231) we can rewrite x this as ! X r( , ) = log d max cxz . (238c) N Z X x X z H(Xn) I(Xn : Y ) q . (233) − ≥ n=1 One can easily verify that r r r . CP ≤ G ≤ H 34

Example 27. The unitary in (43) from Ex.8 provides where XA and ZA are the registers associated with mea- a simple example where all three bounds are different, suring two MUBs XA and ZA on system A, and like- namely rH = log 6, rG = log 5, and rCP = log(9/2). wise for XB and ZB on system B. The relation (242) would say that the quantum mutual information is lower Notice that the behavior of the bounds and are rH rCP bounded by the sum of the classical mutual informations qualitatively different in that they become trivial under in two mutually unbiased bases. We note that a stronger different conditions. The former is trivial if at least one conjecture, in which X and Z are replaced by the row or column of [c ] is trivial (i.e., composed of all zeros B B xz quantum memory B, can be violated in general. except for one element being one), whereas the latter is trivial only if all rows and columns [cxz] are trivial. Hence, the latter gives a non-trivial bound for a much larger range of scenarios. G. Quantum channel formulation

1. Bipartite formulation 4. Quantum memory Christandl and Winter(2005) considered the question It is natural to ask whether system Y can be general- of how well information can be transmitted over a quan- ized to a quantum memory B. Coles and Piani(2014b) tum channel. A quantum channel is the general form show that (237) can indeed be generalized to for quantum dynamics (more general than unitary evolution). Mathematically a quantum channel is a com- I(X : B) + I(Z : B) r H(A B) . (239) E ≤ CP − | pletely positive trace preserving map, and can be represented in its Kraus form, Here the quantum mutual information of a bipartite quantum state ρAB is defined as X † X † ( ) = Kj( )K , where K Kj = 1 . (243) E · · j j I(A:B) := H(ρA) + H(ρB) H(ρAB) (240) j j − = H(ρA) H(A B) , (241) − | Christandl and Winter(2005) address the topic of send- and evaluated on the classical-quantum state ρXB as ing classical information over a quantum channel, or more in (168). Notice that if we specialize to the case where specifically, sending two complementary types of classi- B = Y is classical, then H(A Y ) 0 and hence (239) cal information over a quantum channel. They consider also implies (237). | ≥ a scenario where Alice chooses a state, with probability 1/d, from a set of d orthonormal states, which we label as Example 28. Consider the extreme case where ρ is z z AB Z = Z Z . She then sends the state over the chan- maximally entangled. In this case, both I(X : B) and nel {|to Bob,ih |} and Bob tries to distinguish which state she I(Z : B) are maximal, each being equal to log d. Hence, sent.E Likewise Alice and Bob may play the same game any upper bound on them must be trivial and bounding but with the X = Xx Xx states instead, where the X their sum by r would not work. The bound must be {| ih |} CP and Z states are related by the Fourier matrix F , given weakened in such a way that it becomes trivial, and in- by (207). Bob’s distinguishability for the Z states can deed the term H(A B) accomplishes this. Namely, we be quantified by the so-called Holevo quantity (Holevo, have H(A B)− = log|d in the maximally entangled case. − | 1973), In general, a negative value of H(A B) implies that | ! ρAB has distillable entanglement, and this results in a X 1 z z χ( , Z) =H Z Z bound in (239) that is larger than rCP. In the other ex- E z dE | ih | treme, when H(A B) is positive, which intuitively means | X 1 z z that the correlations between Alice and Bob are weak, H Z Z . (244) d (239) strengthens the bound in (237). − z E | ih |

Likewise, χ( , X) is a measure of Bob’s distinguishabil- E 5. A conjecture ity for the X states, and is deﬁned analogously to (244). Christandl and Winter(2005) prove that Following the resolved conjectures by Grudka et al. (2013); Kraus(1987); and Renes and Boileau(2009), we 1 χ( , X) + χ( , Z) log d + Icoh , , (245) point to some recent and open conjecture by Schneeloch E E ≤ d E et al. (2014). They ask if for any bipartite quantum state

ρAB, where the coherent information Icoh(ρ, ) is a measure of the quality of a quantum channel introducedE by Schu- ? E I(XA : XB) + I(ZA : ZB) I(A : B) , (242) macher and Nielsen(1996). For the maximally-mixed ≤ 35

(a) A A input state 1/d it is given by

|Φi 0 ρAB 1 AA 0 I , = H (1/d) H Φ Φ , A B coh d E E − I ⊗ E | ih | E (246) (b) A A P where Φ = j(1/√d) j j is a maximally entangled state. Coles| i et al. (2011|)i| notedi that (245) holds for ar- |ΦiAA0 A0 B |ψi bitrary MUBs, and that it naturally generalizes to ar- ABC bitrary orthonormal bases X and Z with the right-hand V side of (245) replaced by C 1 log d2c + I , . (247) coh d E FIG. 11 How to convert the dynamical evolution of a system into (a) a bipartite mixed state or (b) a tripartite pure state. Later this bound was improved by Coles and Piani (2014b) to

1 This isomorphism can be exploited to derive uncer- r + I , . (248) CP coh d E tainty relations for quantum channels as corollaries from uncertainty relations for states, and vice versa. This While (245) may look similar to some uncertainty point was emphasized, e.g., in (Coles et al., 2011). For relations discussed previously in this section, espe- example, if one has an uncertainty relation for bipartite cially (239), it is important to note the conceptual dif- states ρAB, such as (167), then one can apply this rela- ference. The relations discussed previously were from tion to the state in (249) in order to obtain an uncertainty a static perspective, whereas (244) refers to a dynamic relation for channels. perspective involving a sender and a receiver. Intuitively, Speciﬁcally, notice that if Alice measures observable Z what (245) says is that if Alice can transmit both the z z Z on system A in Fig. 11(a) and obtains outcome Z Z , states and the X states well to Bob, then is a noiseless |z ihz T| E then the state corresponding to the transpose, Z Z , quantum channel, i.e., it is close to a perfect channel, as will be sent through the channel . This implies| thatih the| quantiﬁed by the coherent information. Holevo quantity can be thought ofE as a classical-quantum mutual information as,

2. Static-dynamic isomorphism T χ( , Z ) = I(Z : B)ρ = log d H(Z B)ρ E − | T z z T With that said, there is a close, mathematical rela- where Z = Z Z , (251) | ih | tionship between the static and dynamic perspectives. In fact, there is an isomorphism, known as the Choi- and the right-hand side is evaluated for the state Jamiołkowski isomorphism (Choi, 1975; Jamiołkowski, X h z z i 1972), that relates the two perspectives (e.g., see (Ży- ρZB = z z trA ( Z Z 1B)ρAB (252) | ih | ⊗ | ih | ⊗ czkowski and Bengtsson, 2004)). Every quantum channel z corresponds to a bipartite mixed state defined by, X 1 z z T E = z z Z Z . (253) z d| ih | ⊗ E | ih | ρAB = ( )( Φ Φ ) , (249) I ⊗ E | ih | Using (251), one can verify that the channel uncertainty P where Φ = j(1/√d) j j is maximally entangled relation (245) is a corollary of the bipartite state uncer- | i | i| i (see Fig. 11(a)). Note that ρAB here has the prop- tainty relation, either (167) or (239). erty that ρA = trB(ρAB) = 1/dA is maximally mixed. Likewise, every bipartite mixed state ρAB with marginal ρA = 1/dA corresponds to a quantum channel whose ac- 3. Tripartite formulation tion on some operator O is defined as, One can formulate uncertainty relations for a dynamic h T i (O) = dA trA O 1 ρAB , (250) tripartite scenario where Alice sends the states over E ⊗ Z quantum channel to Bob or the X states over the com- where the transpose denoted by ( )T is taken in the stan- plementary quantumE channel to Charlie. The rela- dard basis. One can easily verify· that the condition that tionship between a channel andF its complementary chan- ρA = 1/dA is connected to the fact that is trace- nel can be seen via the Stinespring dilation (Stinespring, preserving. E 1955), in which one writes the channel in terms of an 36 isometry V that maps A BC , namely to finite-dimensional systems (whereas position and mo- H → H mentum measurements can only be modeled on infinite- † (O) = trC [VOV ], (254) E dimensional spaces). In this section we review entropic † (O) = trB[VOV ] . (255) uncertainty relations with and without a memory system F for position and momentum measurements.20 We discuss Analogous to (249), we consider the tripartite pure state applications to continuous variable quantum cryptogra- defined by phy later in Sec. VI.B.5.

ψ ABC = (1 V ) Φ . (256) | i ⊗ | i A. Entropy for inﬁnite-dimensional systems This mapping is depicted in Fig. 11(b). The tripartite uncertainty relations presented in Section IV.E can then On a technical level, the position operator Q and the be applied to the state ψ ABC in (256) in order to derive momentum operator with the canonical commutation | i P uncertainty relations for complementary quantum chan- relation nels. For example, Coles et al. (2011) read (209) in this sense to obtain [P,Q] = i1 (261)

2 χ( , X) + χ( , Z) log d c , (257) can only be represented as unbounded operators on E F ≤ infinite-dimensional spaces. Hence, we need to extend for two orthonormal bases X and Z. This relation implies our setup from finite dimensional Hilbert spaces to sep- that if Alice can send the Z states well to Charlie over arable Hilbert spaces A with dim(A) = . However, the channel , then Bob cannot distinguish very well the quantum states can still be represented as linear,∞ positive F outputs of the channel associated with Alice sending a semi-definite operators. Hence, we just keep the notation E complementary set of states X. the same as for finite-dimensional spaces without going into any mathematical details. We start with describing how to define entropy for infinite-dimensional systems. V. POSITION-MOMENTUM UNCERTAINTY RELATIONS

As discussed in the introduction (Sec.I), the first 1. Shannon entropy for discrete distributions precise statement of the uncertainty principle was formulated for position and momentum measurements. Imagine a finite resolution detector that measures the Namely, Kennard(1927) has shown that for all states position Q by indicating in which interval (setting ~ = 1), k;δ := kδ, (k + 1)δ (k Z) , (262) 1 I ∈ σ(Q) σ(P ) , (258) 2 of size δ > 0 the value q falls. This defines a discrete prob- · ≥ 21 ability distribution ΓQδ with infinitely many elements. where σ(Q) denotes the standard deviation of the proba- If the initial is described by a pure state wave function bility density ΓQ(q) when measuring the position Q, and ψ(q) Q we get ΓQδ (k) k∈Z with similarly for σ(P ) when measuring the momentum P . | i { } Z (k+1)δ Henceforth, we always set ~ = 1. ΓQδ (k) = ψ(q) ψ(q) Q dq . (263) Example 29. Consider Gaussian wave packets with po- kδ h | i sition probability density (see also Fig. 12) We then just define the Shannon entropy of ΓQδ in the usual way as 1 2 1 ΓQ(q) = exp q , (259) ∞ √2πσ2 · − · 2σ2 X H(Qδ) := ΓQ (k) log ΓQ (k) . (264) − δ δ and corresponding momentum probability density k=−∞

r 2 2σ 2 2 ΓP (p) = exp p 2σ . (260) π · − · 20 Entropic uncertainty relations for completely general quantum It is then straightforward to check that these achieve systems described by von Neumann algebras and measurements equality in (258) and hence minimize the uncertainty in described by measure spaces are also studied in the literature (Frank and Lieb, 2013a; Furrer et al., 2014). However, here terms of the product of the two standard deviations. we focus on the physically relevant position and momentum measurements. In contrast to Kennard’s formulation (258) of the un- 21 In all of Sec.V, we use the letter Γ instead of P for probability certainty principle the relations developed in Sec.III–IV distributions since the momentum operator is already denoted are phrased in terms of entropy measures and only apply by the letter P . 37

B. Diﬀerential relations 2 | ) q ( ψ

| Extending the work of Everett(1957) and Hirschman (1957), Białynicki-Birula and Mycielski(1975) and inde- ) = q ( δ pendently Beckner(1975) show for position and momen- Q - Γ tum measurements Q and P , respectively, that

h(P ) + h(Q) log(eπ) . (269) q ≥ FIG. 12 Gaussian wave packet in position space with ΓQ(q) We emphasize that (269) holds even though each of the as in (259). We also show the finite resolution discretization differential Shannon entropies on the left-hand side can from (263) in intervals of size δ. become negative! As in Kennard’s relation (258) Gaus- sian wave packets again minimize the uncertainty and lead to equality in (269). This shows that the relation is Despite the fact that there are now infinitely many terms tight. As sketched in Sec.II the entropic relation (269) in the sum, H(Qδ) keeps many of the properties of its also implies Kennard’s relation (258) and is therefore finite-dimensional analogue. In particular, H(Qδ) 0 strictly more general. and the Shannon entropy can still be thought of as≥ an Recently an alternative bound was shown by Frank information measure. and Lieb(2012), see also the works of Hall and Wiseman (2012) and Rumin(2012). Extending the work of Beck- ner(1975), Hall(1999), and Rumin(2011), Frank and 2. Shannon entropy for continuous distributions Lieb show that

The differential Shannon entropy is defined in the limit h(Q) + h(P ) log(2π) + H(ρA) , (270) ≥ of infinitely small interval size δ 0, → where (265) h(Q) : = lim H(Qδ) + log δ H(ρA) := tr ρA log ρA (271) δ→0 − ∞ ! X ΓQδ (k) denotes the von Neumann entropy of the infinite- = lim ΓQδ (k) log . (266) δ→0 − δ dimensional input state before any measurement was per- k −∞ = formed. We note that in contrast to the differential

The term H(Qδ) scales with the interval δ 0 and hence Shannon entropies on the left-hand side, the von Neu- the normalization in (265). This makes the→ differential mann entropy is always non-negative (even for infinite- Shannon entropy an entropy density in the limit δ 0. dimensional systems). The state independent bound We also get a closed formula for the differential Shannon→ log(2π) log(eπ) is worse, but interestingly (270) be- ≤ entropy (at least when ΓQ(q) is continuous), comes an equality for a thermal state in the infinite tem- perature limit (Frank and Lieb, 2012; Hall, 1999). Hence, Z the relation (270) is also tight if we insist on having the h(Q) = dq ΓQ(q) log ΓQ(q) , (267) − von Neumann entropy H(A)ρ on the right-hand side. where ΓQ(q) denotes the probability density when measuring the position Q. For the momentum probabil- C. Finite-spacing relations ity density ΓP (p) we define the discrete and differential Shannon entropy in the same way. Since probability den- It has been argued in the literature that ideal posi- sities can be larger than one, not all of the properties of tion and momentum measurements can effectively never discrete Shannon entropy carry over. For example the be performed because every detector has a finite accu- differential Shannon entropy can be negative. racy. We can then ask: in what other than a purely mathematical sense does (269) and (270) express the un- Example 30. For Gaussian wave packets as in (259) certainty principle?22 Certainly a more operational way and (260) we have, to express uncertainty is in terms of the discrete Shannon 1 1 πe entropy as defined in (264). A series of works (Białynicki- h(Q) = log 2πeσ2 and h(P ) = log . (268) 2 2 2σ2 Birula, 1984; Partovi, 1983; Rudnicki, 2011; Rudnicki By inspection we find that h(Q) < 0 for σ sufficiently small and h(P ) < 0 for σ sufficiently large. 22 This criticism also applies to Kennard’s relation (258) and a fi- Nevertheless the uncertainty principle can still be ex- nite spacing version thereof has been derived in (Rudnicki et al., pressed in term of differential Shannon entropies. 2012). 38

ρAB as H(A B) = H(AB) H(B). However, for inﬁnite- 4 dimensional| systems this is− not a sensible notion of condi- )

δ tional entropy. This is because for some states both terms P 3 Eq. (272) ( H(AB) and H(B) can become inﬁnite even though the H Eq. (273) conditional entropy is ﬁnite.

) + 2 δ Q

( Example 31. Consider a bipartite system with A a qubit

H 1 and B infinite-dimensional. Let ρAB be a state that is entangled between A and a two-dimensional subspace of 2 4 6 8 10 B, and with the marginal ρB having eigenvalues (Wehrl, bin area, δqδp 1978), FIG. 13 Comparison of the lower bounds in (272) and (273) 1 on the uncertainty generated by the finite-spacing position (274) λk 2 for k > 2 . and momentum measurements Qδ,Pδ as in (263). Note that ∝ k(log k) the latter bound becomes negative and hence trivial for larger Then, we have as well as spacings δ δ 8.5. H(AB) = H(B) = q p & even though any sensible definition∞ of conditional entropy∞ H(A B) should be upper and lower bounded by plus and minus| one, respectively. et al., 2012) established that for measurements with fi- However, observe that the classical quantum entropy nite spacing δq for the position q and finite spacing δp for of finite-dimensional classical quantum states ρXB as the momentum we have that in (138) can be rewritten in terms of Umegaki’s relative entropy (Umegaki, 1962), H(Qδ) + H(Pδ) 2! D(ρ σ) := tr[ρ(log ρ log σ)] (275) (1) δqδp k − log(2π) log δqδp S0 1, , (272) X x ≥ − · 4 as H(X B) = D(PX (x)ρB ρB) . (276) | − x k where S(1)( , ) denotes the 0th radial prolate spheroidal Furrer et al. (2014) point out that (276) can be lifted to 0 · · wave function of the first kind (Slepian and Pollak, 1961). ∞ This way of expressing the uncertainty principle has the X k;δ H(Qδ B) := D ρ ρB , (277) advantage that the discrete Shannon entropy is always | − B k=−∞ non-negative and has a clear information theoretic interpretation. As we will say later, it is the discrete formu- k;δ where ρB denotes the (sub-normalized) marginal state lation of the uncertainty principle that becomes relevant on B when the position Q is measured in k;δ, i.e., for applications in continuous variable quantum cryptog- I h k;δi raphy (see Sec. V.E and VI.B.5). PQ (k) := tr ρ is the probability to measure in k δ. δ B I ; Interestingly (272) is not tight for general δ > 0 since (278) we also know that (Białynicki-Birula, 1984),

H(Qδq) + H(Pδp) log(eπ) log (δqδp) , (273) 1. Tripartite quantum memory uncertainty relations ≥ − which becomes tighter for δ 0 (see Fig. 13). Rudnicki With (277) as the definition for classical quantum en- → (2015) employs a majorization based approach along the tropy Furrer et al. (2014) find, lines of Sec. III.I to improve on (272) and (273) for large spacing. However, this does not yield a nice closed for- H(Qδq B) + H(Pδp C) | | mula and we refer to Rudnicki(2011, 2015) for a discus- 2! (1) δqδp sion of tightness and a more detailed comparison. We log(2π) log δqδp S 1, . (279) 0 4 will further comment on this issue in the next section ≥ − · (Sec. V.D) after extending (269) and (272) to a quantum This is the extension of (272) to quantum memories and memory system. likewise not tight. By taking the limit δ 0 we find the differential quantum conditional entropy→

D. Uncertainty given a memory system h(Q B) : = lim H(Qδ B) + log δ (280) | δ→0 | Z For finite-dimensional systems we can write the condi- q = dq D(ρ ρB) , (281) tional von Neumman entropy of bipartite quantum states Bk 39 where the second equality holds under some finiteness as- 3.1 ) sumption (Furrer et al., 2014). With (279) we then imme- P 3.0 ( 1 h r = 2 arccosh(ν) diately find the extension of (269) to quantum memories, 2.9 ) + B | 2.8

h(Q B) + h(P C) log(2π) . (282) Q (

| | ≥ h 2.7 Example 32. For the EPR state on AB (or likewise 0.5 1.0 1.5 AC) in the limit of perfect correlations (282) becomes an squeezing strength, r equality. For ﬁnite squeezing strength r = arccosh(ν)/2 FIG. 14 We picture the uncertainty, h(Q|B) + h(P ), of the the EPR state is a Gaussian state with covariance matrix EPR state from Ex. 32 in terms of the squeezing strength r.

2 1 ν12 √ν 1Z2 ΓAB(ν) = − 2 √ν2 1Z ν1 2. Bipartite quantum memory uncertainty relations − 2 2 1 0 1 0 with 1 = and Z = . (283) Similarly as for ﬁnite-dimensional systems (Sec. IV.D) 2 0 1 2 0 1 − it is possible to reformulate uncertainty relations with quantum memory in a bipartite form. For continuous The left-hand side of (282) for the EPR state generated position and momentum measurements Frank and Lieb by Γ (ν) is then calculated to (Furrer et al., 2014), AB (2013a) show that, h(Q B) + h(P ) h(Q B) + h(P B) log(2π) + H(A B)ρ . (286) | | | ≥ | ν + 1 ν + 1 ν 1 ν 1 = log(eπν) log + − log − , This is the extension of (270) to a quantum memory sys- − 2 2 2 2 tem. However, we note that (286) only holds if that all (284) the terms appearing in H(A B) = H(AB) H(B) are ﬁnite (which is in general too| restrictive).23 − which converges to log(2π) for ν . In Fig. 14 we plot (284) in terms of the squeezing→ ∞ strength r = arccosh(ν)/2: 3. Mutual information approach

1. For r = 0 the system B is uncorrelated and we have Finally, a conceptually different approach was taken the lower bound h(Q)+h(P ) log(eπ) as in (269). by Hall(1995) where the uncertainty relative to a mem- ≥ ory system is quantified in terms mutual information in- 2. For r > 0 we have to take the quantum memory stead of conditional entropy (see Sec. IV.F for a gen- B into account and only the lower bound h(Q B) + eral discussion). Similarly as for the conditional entropy h(P ) log(2π) from (282) holds. | in (277), mutual information for classical quantum states ≥ is most generally defined in terms of Umegaki’s relative 3. For r we get maximal correlations and the entropy from (275), → ∞ bound (282) becomes an equality. ∞ X k;δ I(Qδ : B) := D ρ ρB + H(B)ρk;δ . (287) We note that in typical experiments for applications (see B k=−∞ Sec. VI.B.5) a squeezing strength of r 1.5 is achiev- able (Eberle et al., 2013). For this the lower≈ bound (282) In contrast to entropy, however, the mutual information stays finite when taking the limit δ 0, is already very tight. → I(Q : B) := lim I(Qδ : B) . (288) Note that in (282) the state independent bound is δ→0 log(2π) whereas it was log(eπ) for the case without quan- Hence, no regularization in terms of the interval size δ is tum memory in (269). Hence, in contrast to the finite- taken. For classical memories M it was shown that (Hall, dimensional case, a quantum memory reduces the state 1995), independent uncertainty limit. This is because for the approximate EPR state there exists a gap between the I(Q : M) + I(P : M) 1 + log σ (Q) + log σ (P ) . ≤ Γ Γ accessible classical correlation and the classical-quantum (289) correlation. That is, even when minimized over all measurements QB on B,

23 This restriction is connected with the question about a h(Q QB) h(Q B) log(e/2) . (285) | − | ≈ sensible notion of conditional entropy for fully quantum states (Kuznetsova, 2011). 40

It is an open question to ﬁnd a generalization that also (2014) show holds for quantum memories. This would be in anal- H (Qδ B) + H (Pδ C) ogy to what is known for ﬁnite-dimensional systems (see min | max | 2! Sec. IV.F.4). (1) δqδp log(2π) log δqδp S 1, , (294) ≥ − · 0 4

E. Extension to min- and max-entropy as well as the same relation with Qδ and Pδ interchanged. We note that the special case with trivial quantum mem- As for ﬁnite-dimensional systems (see Sec. III.C.2), en- ories B,C was already shown in (Rudnicki et al., 2012). tropic uncertainty relations like (269) and (272) can not Furrer et al. (2014) show that the relation (294) is tight only be shown for the Shannon entropy, but also more for any spacing δ > 0 even in the absence of any cor- generally for pairs of Rényi entropies (Białynicki-Birula, relations (i.e., there exist states for which the relation 2006, 2007; Rudnicki et al., 2012). Here we focus on a becomes an equality). Note that this is contrast to the special case that is important for applications in contin- situation for the Shannon entropy, where neither (272) uous variable quantum cryptography (see Sec. VI.B.5): and (273), nor (279) are tight. we study relations in terms of the Rényi entropy of order and its dual quantity the Rényi entropy of order 1/2. ∞These are exactly the min- and max-entropy, respectively. 2. Diﬀerential relations

For the differential version we take the limit δ 0, → 1. Finite-spacing relations hmin(Q B) := lim Hmin(Qδ B) + log δ , (295) | δ→0 | Following the finite resolution detector picture as and similarly for h (Q B).25 We then find the uncer- in (262) and (263), the conditional min-entropy is de- max | fined as tainty relation (Furrer et al., 2014), h (Q B) + h (P C) log(2π) (298) H (Qδ B) := log p (Qδ B) . (290) min max min | − guess | | | ≥ Here we have the optimal guessing probability as in (139), as well as the same relation with Q and P interchanged. (Białynicki-Birula, 2006) shows that (298) becomes an p (X B) equality for pure Gaussian states as in (259) and (260). guess | ( ∞ ) Note that this implies in particular that the uncondi- h i X k k;δ tional special case := sup ΓQδ (k) tr XBρB : XB POVM on B . XB k −∞ = h (Q) + h (P ) log(2π) (299) (291) min max ≥ is tight. Hence, the optimal state independent constant is In analogy to the finite-dimensional case, the min- log(2π) for the min- and max-entropy where as the opti- entropy quantifies the uncertainty of the classical regis- mal constant for the Shannon entropy in (269) is log(eπ). ter Qδ from the perspective of an observer with access to the quantum memory B. The conditional max-entropy is given by F. Other infinite-dimensional measurements

H (Qδ B) := log F (Qδ B) , (292) max | dec | As a multidimensional extension of (269), Huang where we have the optimal decoupling ﬁdelity (2011) shows that for any measurements of the form n n Fdec(Qδ B) X 0 X 0 | A = aiQi + aiPi,B = biQi + biPi ( ∞ !2 ) r i i X k;δ =1 =1 := sup F ρB , σB : σB state on B . 0 0 with ai, ai, bi, bi R , (300) k=−∞ ∈ (293)

The decoupling fidelity is a measure of how much in- 25 Under some finiteness assumptions we also have formation the quantum memory B contains about the (Z 2 ) 24 q q classical register Qδ. For these definitions Furrer et al. hmax(Q|B) = log sup dq F ρB , σB : σB state on B (296) Z q q q 24 For finite-dimensional systems the expression (292) is equivalent hmin(Q|B) = − log sup dq ρB (XB ): q 7→ XB POVM on B to the max-entropy as defined in (157), see (Furrer et al., 2014; (297) König et al., 2009). 41 we have that to scientific simulations and cryptography. Randomness is a scarce resource since computers are designed to per- h(A) + h(B) log(eπ) + log [A, B] . (301) ≥ | | form deterministic operations. Even more importantly classical physics is deterministic, meaning that every out- Huang(2011) also shows that for any measurement pair come of an experiment can in principle be predicted by A, B as in (300) there exist states for which (301) be- an observer who has full knowledge of the initial state comes an equality. of the physical system and the operations that are per- Moreover, the techniques for deriving position- formed on it. The study of pseudorandomness (Vadhan, momentum uncertainty relations can also be applied to 2012) tries to circumvent this problem. other complementary observable pairs that are modeled Quantum mechanics with its inherent nondeterminism on infinite-dimensional Hilbert spaces. For example, for a allows us to consider a stronger notion of randomness, particle on a circle we have the position angle ϕ and the namely randomness that is information-theoretically se- conjugate angular momentum observable L . We con- z cure. Formally, we want to generate a random variable sider a measurement device that either tells in which of L that is uniformly distributed over all bit strings 0, 1 ` { } M := 2π/δϕ bins of size δϕ (302) of a given length `. Moreover, we want that this random variable is independent of any side information an ob- the particle is in or the exact value of the angular momen- server might have, including information about the pro- tum Lz. Improving on the earlier earlier work of Partovi cess that is used to calculate L and any random seeds (1983), Białynicki-Birula(1984) shows that that are used prepare L. A classical-quantum product state H(ϕδ) + H(Lz) log M, (303) ≥ 2` ˜ 1 X where the discrete angle distribution Pϕδ is defined sim- πLE = i i L πE (306) ˜ 2` | ih | ⊗ ilarly as in (263), and PLz denotes the distribution over i=1 the L eigenstates. By inspection (303) becomes an z describes ` bits of uniform randomness that is indepen- equality for any eigenstate of the L observable. The z dent of its environment, or side information, E. Often, relation was also extended to two angles ϕ and θ and the the best we can hope for is to approximate such a state. corresponding pair of observables L and L2 (Białynicki- z Namely, we say that describes a state where is Birula and Madajczyk, 1985). ρZE L δ-close to uniform on ` bits and independent of E if Another example are the number N and phase Φ observables for the harmonic oscillator. Hall(1993) shows ` 2 that 1 X ρLE ` i i L ρE δ , (307) − 2 | ih | ⊗ tr ≤ H(N) + h(Φ) log 2π , (304) i=1 ≥ where denotes the trace norm. This bound implies where P (n) represents the probability distribution in tr N that Lkcannot · k be distinguished from a uniform and in- the number basis n , and the probability distribution {| i} dependent random variable with probability more than in the phase basis is 1 2 (1 + δ). This viewpoint is at the core of universally eiφ ψ 2 X composable security frameworks (Canetti, 2001; Unruh, P (φ) := |h | i| with eiφ := einφ n . (305) Φ 2π | i | i 2010), which ensure that a secret key satisfying the above n property can safely be employed in any cryptographic This can also be seen as a special case of the re- protocol requiring a secret key. sults in (Białynicki-Birula and Mycielski, 1975). Equa- Entropic uncertainty relations can help us since they tion (304) becomes an equality for number states. Fur- certify that the random variables resulting from a quan- thermore, Hall(1994) also extends (304) to noisy har- tum measurement are uncertain and thus contain ran- monic oscillators degraded by Gaussian noise. domness. However, in order to extract approximately Finally, time-energy entropic uncertainty relations for uniform and independent randomness we will need an systems with discrete energy spectra were discussed additional step, which we describe next. in (Hall, 2008).

1. The operational signiﬁcance of conditional min-entropy VI. APPLICATIONS The importance of the min-entropy in cryptography A. Quantum randomness is partly due to the following lemma, called the Left- over Hashing Lemma (Impagliazzo et al., 1989; Impagli- Randomness is a crucial resource for many everyday in- azzo and Zuckerman, 1989; Mclnnes, 1987). Informally, formation processing tasks, ranging from online gambling it states that there exists a family of functions fs s, { } 42

` where fs : [2 ], called hash functions, such that 2. Certifying quantum randomness X → the random variable L = fS(X), which results by applying the function fS with S a seed chosen uniformly at Note that we can certify randomness, if we can some- random, is close to uniform and independent of S if the how conclude that Hmin(X E) is large. In principle, all initial min-entropy is sufficiently large. entropic uncertainty relations| that involve a quantum More formally, Renner and König(2005) and Renner memory are suitable for this task, whenever we can verify (2005) show the following result for the quantum case: the terms lower bounding the entropy. Tripartite uncer- There exists a family fs s as described above such that tainty relations are especially suitable to this task, and for any cq state { } the security of quantum key distribution below rests on our ability to make such estimates. For example, Vallone X x et al. (2014) specialize the uncertainty relation for min- ρXE = PX (x) x x X ρE (308) x | ih | ⊗ and max-entropy in (226) to assert that (310) with H (X E) k, the classical-quantum-classical Hmin(X E)ρ log d Hmax(Z) , min | ≥ | ≥ − state ρLES after applying fS, namely where X and Z are mutually unbiased measurements on a d-dimensional Hilbert space. Here E is the environment X PX (x) x of the measured system and the max-entropy Hmax(Z) = ρLES = fs(x) fs(x) L ρE s s S , (309) S | ih | ⊗ ⊗ | ih | H1 (Z) can be estimated using statistical tests, resulting s,x | | /2 in confidence about Hmin(X E). As discussed above, the | describes a state where L is δ-close to uniform on ` bits Leftover Hashing Lemma now allows to extract uniform 1 (`−k) and independent of E and S with δ = 2 2 . randomness from X. The special case where the environment E is trivial has Miller and Shi(2014) derive a lower bound on an en- been discussed extensively in the computer science litera- tropy difference instead of a conditional entropy. Assume ture (Vadhan, 2012). Since hashing is a classical process, that X and Z are complementary binary measurements one might expect that the physical nature of the side in- on a qubit. Then, the following relation holds, formation is irrelevant and that a classical treatment is Hα(XB) Hα(B) q(α, δ) for α (1, 2] , (311) sufficient. However, this is not true in general. For ex- − ≥ ∈ ample, the output of certain extractors may be partially where δ is determined by the equality 0 0 α α known if side information about their input is stored in a tr Z ρAB Z = δ tr ρB , (312) quantum memory, while the same output is almost uni- h | | i and q is a function satisfying lim q(α, δ) = 1 2h(δ). form conditioned on any classical side information.26 α→1 The authors then proceed to use this result to bound− the A generalization of this result is possible by considering smooth min-entropy and apply the generalized Leftover a variation of the min-entropy, which is called ε-smooth ε Hashing Lemma. min-entropy, and denoted Hmin(X E), for a small ε > 0. This is defined by maximizing the| min-entropy over states that are in a ball of radius ε around the state ρ. B. Quantum key distribution (See Tomamichel et al. (2010) for a precise definition.) The generalized Leftover Hashing Lemma (Renner, The goal of a key distribution scheme is for two honest 2005) asserts that there exists a family fs s such that parties to agree on a shared key by communicating over a ε { } for any state ρXE with H (X E) k, we find that public channel in such a way that the key is secret from min | ≥ L = fS(X) is (ε + δ)-close to uniform and independent any potential adversary eavesdropping on the channel. of E and S, with δ as defined above. Traditionally the two honest parties trying to share a key The latter result is tight in the following sense. If L = are called Alice and Bob and the eavesdropper is called fS(X) is ε-close to uniform and independent from E and Eve. By a simple symmetry argument it is evident that S for any family of functions fs s, then we must have key distribution is impossible if only classical information ε0 0 { } Hmin(X E) ` with ε = √2ε. is considered: Since Eve will hear all communication from Due to| this≥ tightness result we are justified to say that Alice to Bob, at any point in the protocol she will have at the smooth min-entropy characterized (at least approxi- least as much information about Alice’s key as Bob — in mately) how much uniform randomness can be extracted particular, if Bob knows Alice’s key then so does Eve. from a random source X that is correlated with its envi- Quantum key distribution (QKD) was first proposed ronment E. by Bennett and Brassard(1984) and Ekert(1991) to get out of this impasse.27 Since quantum information cannot be copied or cloned (Wootters and Zurek, 1982), the

26 See (Gavinsky et al., 2009) for a concrete example and (König and Renner, 2011) for a more general discussion of this topic. 27 We refer to (Scarani et al., 2009) for a recent review. 43 Eve qubits in this basis. (These two steps are repeated many times.)

Alice Bob Parameter estimation: Alice announces her measure- ρABE ment results on a random subset of these rounds. If their measurement results agree on most rounds, they conclude that their correlations contain some secrecy and proceed to correct their errors and ex- (a) Preparation phase tract a secret key (we will not discuss this further here). If not, they abort the protocol. Alice Eve Bob

2. Security criterion for QKD Θ To show security of QKD we thus need to show that the following two statements are mutually exclusive: a) Alice’s and Bob’s measurement results agree in most rounds, and b) Eve has a lot of information about Al- ice’s or Bob’s measurement outcomes. Security of quantum key distribution against general attacks was first formally established by Mayers(1996, Θ 2001) as well as Biham et al. (2000, 2006) and Shor and Preskill(2000). In all these security arguments, the com- Y Yˆ plementarity or uncertainty principle is invoked in some form to argue that if Alice and Bob have large agree- ment on the qubits measured in one basis, then neces- (b) Measurement phase: Alice and Bob measure their quantum system in the basis indicated by Θ to recover Y sarily Eve’s information about the bits measured in the and Yˆ , respectively. Eve stores Θ and keeps her quantum complementary basis must be low. memory intact. The uncertainty relation is applied to the In Sec. VI.B.3 we attempt to present the security argu- resulting state ρ . Y YEˆ Θ ment in a concise and intuitive way, and for this purpose we adopt a notion of security—certifying that the raw FIG. 15 Preparation and measurement phase of the QKD key has high entropy—that has proven to be insufficient protocol described in Sec. VI.B.1. in practice. Note that our ultimate goal is to extract a secret key, and not to have a bit string with high entropy. This ultimately requires the use of different entropies and above impossibility argument does no longer apply when a post-processing step in the protocol to distill a secret Alice and Bob are allowed to communicate over a quan- key. A discussion of these issues follows in Sec. VI.B.4. tum channel. Roughly speaking, the main idea is that Entropic uncertainty relations were first used in this whenever the eavesdropper interacts with the channel context by Koashi(2006), who establishes security of (for example by performing a measurement on a parti- QKD by leveraging the Maasseen-Uffink relation (31). cle) she will necessarily introduce noise in the quantum However, entropic uncertainty relations with quantum communication between Alice and Bob, which they can memory provide a more direct tool to formalize security then detect and subsequently abort the protocol. arguments for QKD, as we will see in the following.

1. A simple protocol 3. Proof of security via an entropic uncertainty relation

We will focus on a truncated version of Ekert’s proto- a. Single round. We will here broadly follow an argument col (Ekert, 1991), which proceeds as follows: outlined by Berta et al. (2010). First, note that during the preparation step (as described above) the eavesdrop- Preparation: Alice and Bob share a maximally entan- per might interfere and we can thus not know if Alice gled two-qubit state using the public channel. Eve and Bob will indeed share a maximally entangled state can coherently interact with the channel. after the preparation step is complete. However, without loss of generality we may assume that Alice (A), Bob Measurement: They randomly agree (using the public (B), and Eve (E) share an arbitrary state ρABE after the channel) on either the basis Z = 0 0 , 1 1 or preparation step, where A and B are qubits and E is any {| ih | | ih |} X = + + , , and measures their respective quantum system held by Eve (see Fig. 15(a)). {| ih | |−ih−|} 44

Let Θ be a binary register in a fully mixed state that a fully mixed state, where Θi determines the choice of determines if the qubits are to be measured in the basis X measurement on the systems indexed by i. Analogously, or Z and let Y denote the output of Alice’s measurement. we store the measurement outcomes on Alice’s system in 1 1 n Then we can write H(Y BΘ) = 2 H(X B) + 2 H(Z B) a bit string Y = (Y1,Y2,...,Yn) and on Bob’s system | 1 1| | ˆ n ˆ ˆ ˆ and similarly H(Y EΘ) = 2 H(X E) + 2 H(Z E). Thus, in a bit string Y = (Y1, Y2,..., Yn). the tripartite entropic| uncertainty| principle with| quan- The crucial observation is that the tripartite uncer- tum memory (209) can be cast into the form tainty principle in (209) implies that

1 H(X X Z X ...Xn− Zn E) H(Y EΘ) + H(Y BΘ) log = 1, (313) 1 2 3 4 1 | | | ≥ c + H(Z Z X Z ...Zn− Xn B) n , (315) 1 2 3 4 1 | ≥ where we used that 1 for the measurements and c = 2 X where we made sure that all n systems are measured Z. The entropies are evaluated for the state ρY ΘBE after in the opposite basis in the two terms, and used that the measurement on Alice’s qubit is performed. 1 log cn = n. A similar averaging argument as for the one Next we perform Bob’s measurement, which yields an round case and the data-processing inequality (C5) then ˆ estimate Y of Y . The data-processing inequality (C5) reveal the bounds implies that H(Y BΘ) H(Y Yˆ ), and thus we conclude that H(Y EΘ) | 1 H≤(Y Yˆ )|. This ensures that Eve’s H(Y n EΘn) + H(Y n Yˆ n) | ≥ − | | | uncertainty—in terms of von Neumann entropy—of Al- H(Y n EΘn) + H(Y n BnΘn) n . (316) ice’s measurement outcome is large as long as the condi- ≥ | | ≥ tional entropy H(Y Yˆ ) is small (see Fig. 15(b)). This is a Hence, Eve’s uncertainty (in terms of von Neumann en- quantitative expression| of the above-mentioned security tropy) of the measurement outcome Y n increases linearly criterion.28 in the number of rounds. Notably, this is true without assuming anything about the attack. In particular, Example 33. If Alice and Bob’s measurement outcomes the state ρAnBnE after preparation but before the un- agree with high probability, let us say with probability certainty principle is applied does not need to have any ˆ 1 1 δ, then H(Y Y ) evaluates to h(δ) = δ log δ + (1 particular structure and is assumed to be arbitrary. − 1 | − δ) log 1−δ , the binary entropy of δ. Hence, we ﬁnd that

H(Y EΘ) 1 h(δ) , (314) 4. Finite size effects and min-entropy | ≥ − which is positive as long as δ is strictly less than 50%. So far we have argued that security of QKD is en- sured if Eve’s uncertainty of the key expressed in terms of the von Neumann entropy is large. This might be b. Multiple rounds. The protocol extends over multiple a reasonable ad-hoc criterion — but more operationally rounds and we can repeat the above argument for each what we want to say is that a key is secure if it can be round individually and then attempt to add up the re- safely used in any other protocol, for example one-time sulting entropies — but it is much more convenient to use pad encryption, that requires a secret key. This leads a stronger uncertainty relation that describes the situa- to the notion of composable security, which was recently tion for multiple rounds directly. reviewed by Portmann and Renner(2014) in the context For this purpose, let us model the situation after Alice of QKD. It turns out that in order to achieve compos- and Bob have exchanged n qubits but before they mea- able security, it is not sufficient to consider Eve’s uncer- sure them. This is a hypothetical situation since in the tainty in terms of the von Neumann entropy (König et al., actual protocol Alice and Bob measure their qubits after 2007). Instead, it is necessary to ensure that the smooth every round. However, we can always imagine that Al- min-entropy of the measurement results is large (Renner, ice and Bob delay their measurement since Eve’s strategy 2005; Renner and König, 2005), so that we can extract a cannot depend on the timing of their measurement. After secret key, i.e. uniform randomness that is independent the exchange Alice and Bob each hold n qubits in systems n n of the eavesdropper’s memory. (Recall the discussion of A = A1A2 ...An and B = B1B2 ...Bn, respectively. randomness in Sec. VI.A.) Thus, instead of the inequality This is described by an arbitrary state ρAnBnE where E involving von Neumann entropies above (315), we want is any quantum system held by the eavesdropper. Again, to apply a generalization of the Maassen-Uffink uncer- we model the random measurement choice using a reg- n tainty relation with quantum memory (225). This leads ister, a bit string Θ = (Θ1, Θ2,..., Θn) of length n in to the following relation (Tomamichel and Renner, 2011).

Hε (Y n EΘn) + Hε (Y n Yˆ n) n , (317) min | max | ≥ 28 ε ε Note that in practice we need a stronger statement, namely a where Hmin and Hmax denote the smooth min- and max- bound on the min-entropy. This is discussed in Sec. VI.B.4. entropies, variations of the min- and max-entropy (that 45 we will not discuss further here). Hence, in order to as factoring is difficult to solve, and in addition that the ensure security it is sufficient to estimate the smooth adversary has limited computational resources, in partic- ε n ˆ n max-entropy Hmax(Y Y ). This can be done by a ular not enough to solve the difficult problem. However, suitable parameter estimation| procedure, as is shown it is also possible to obtain security based on physical as- in (Tomamichel et al., 2012). sumptions, where we will first consider assuming that the advsersies memory resources are limited. Even a limit on classical memory can lead to security Cachin and Mau- 5. Continuous variable QKD rer(1997) and Maurer(1992), however classical memory is typically cheap and plentiful. More significantly, how- Quantum information processing with continuous vari- ever, Dziembowski and Maurer(2004) have shown that ables (Weedbrook et al., 2012) offers an interesting and any classical protocol in which the honest players need to practical alternative to finite-dimensional systems. Here store n bits to execute the protocol can be broken by an we discuss a particular variation of the above QKD pro- adversary who is able to store more than O(n2) bits. Mo- tocol where Alice and Bob measure the quadrature com- tivated by this unsatisfactory gap it is an evident ques- ponents of an electromagnetic field, and then extract a tion to ask if quantum communication can be of any help. secret key from the correlations contained in the resulting The situation is rather different if we allow quantum com- continuous variables. munication: we can have quantum protocols (see below) If Alice and Bob share a squeezed Gaussian state, Fur- that require no quantum memory to be executed, but rer et al. (2012) show that the security of such protocols that are secure as long as the adversary’s quantum mem- can be shown rigorously using entropic uncertainty rela- ory is not larger than n O(log2 n) qubits Dupuis et al. tions, including finite size effects. For this purpose, it is (2015) where n is the number− of qubits sent during the convenient to employ a smoothed extension of (294) as protocol. This is essentially optimal, since any protocol first shown by Furrer et al. (2011). This yields that allows the adversary to store n qubits is known to ε n n ε n ˆ n be insecure Lo(1997); Lo and Chau(1997); and May- Hmin(Y EΘ ) + Hmax(Y Y ) | | ! ers(1997). The asssumption of a memory limitation is 2π δ2 −2 n log S(1) 1, , (318) known as the bounded Damgaard et al. (2008), or more ≥ δ2 · 0 4 generally, noisy-storage model Wehner et al. (2008), as illustrated in Fig. 16. where Y is the outcome of the quadrature measurement i Security proofs in this model are intimately con- in the basis (position or momentum) specified by Θ dis- i nected to entropic uncertainty relations. What’s more, cretized with bin size δ. We point to (Gehring et al., uncertainty relations of Dupuis et al. (2015) together 2015) for an implementation. with König et al. (2012) demonstrate that any physical assumption that limits the adversary’s entanglement C. Two-party cryptography leads to security.

In this section we discuss applications of entropic uncertainty relations to cryptographic tasks between two 1. Weak string erasure mutually distrustful parties (traditionally called Alice and Bob). This setup is in contrast to quantum key The relation between cryptographic security and en- distribution where Alice and Bob do trust each other tropic uncertainty relations can easily be understood by and only a third party is eavesdropping. Typical tasks looking at the very simple cryptographic building block for two-party cryptography are bit commitment, oblivi- known as weak string erasure (WSE) (König et al., 2012). ous transfer or secure identification (see Broadbent and Weak string erasure is universal for two-party secure com- Schaffner(2015) for a recent review). putation, in the sense that any other protocol can be It turns out, however, that even using quantum com- obtained by repeated executions of weak string erasure, munication it is only possible to obtain security if we following by additional quantum or classical communica- make some assumptions about the adversary (Lo, 1997; tion (Kilian, 1988). Importantly, the storage assumption Lo and Chau, 1997; Mayers, 1997). What makes this only needs to hold during some time ∆t during the exe- problem harder is that unlike in QKD where Alice and cution of weak string erasure. Bob trust each other to check on any eavesdropping activ- Weak string erasure generates the following outputs ity, here every party has to fend for himself. Nevertheless, if both Alice and Bob are honest: Alice obtains an n- since tasks like secure identification are of great practical bit string Kn, and Bob obtains a random subset I n n ⊆ importance one is willing to make such assumptions in [n], and the bits KI K of K as indexed by the practise. subset I. In additition,⊆ the following demands are made Classically, such assumptions are typically computa- for security. If Bob is honest, then Alice does not know tional assumptions: we assume a particular problem such anything about I. In turn, if Alice is honest, then Bob 46

other hand, note that a dishonest Bob with a quantum memory can easily cheat by just keeping the n qubits he quantum quantum gets from Alice and wait until he receives the n bit string Θn from Alice as well. Namely, he can then measure the F n Bob’s n qubits in the same basis Θ as Alice and get the full n n n n infor- bit string K (that is: Hmin(K BΘ ) = 0). However, if mation Bob only has a limited quantum| memory, then he could classical storage not keep a perfect copy of the n qubits he gets from Alice.

encoding attack (unlimited) decoding attack The security analysis is linked immediately to a guessing game, whenever we consider a puriﬁed version of additional information the protocol in which Alice does not prepare BB84 states herself, but instead makes EPR pairs ΦAB = | i time t time t + ∆t ( 0 A 0 B + 1 A 1 B) /√2 and sends B to Bob, while measuring| i | i A| ini | ai randomly chosen BB84 basis. In the FIG. 16 The noisy-storage model König et al. (2012) and analysis, one can indeed give even more power to Bob, in Wehner et al. (2008) assumes that during waiting times ∆t in which we imagine that he prepares a state ρ in each the protocol, the adversary can only keep quantum informa- AB tion in an imperfect and limited storage device described by a round of the protocol and Alice measures A in randomly quantum channel, F. This is the only restriction and the ad- chosen BB84 basis. Alice then sends him the basis choice. n n n n versary is otherwise abitrarily powerful. In particular, he can Recall that Hmin(K BΘ ) = log pguess(K BΘ ), ﬁrst store all incoming qubits, and has a quantum computer to that is, the min-entropy| security− guarantee that| WSE encode them into an abitrary quantum error-correcting code demands is then precisely related to Bob’s ability to win to protect them against the noise of the channel F. He can the guessing game Ballester et al. (2008). The storage as- also keep an unlimited amount of classical memory, and per- sumption then translates into one particular example of form any operation instantaneously. how the entanglement in ρAB is limited, putting a limit n on Hmin(A B) of the states that Bob can prepare. n | should not too much about K (except for KI ). More precisely, Bob should not be able to guess Kn too well, that is with (140), 2. Bounded-storage model

n Hmin(K B) λ n for some λ [0, 1] , (319) To illustrate further how a bound on entropic uncer- | ≥ · ∈ tainty leads to security, let us first consider a special case where B denotes all of Bob’s knowledge. We refer of the noisy-storage model, also known as the bounded- to König et al. (2012) for a more detailed definition. A ⊗q storage model. Here, the channel = 2 in Fig. 16 simple protocol for implementing weak string erasure is is just the identity on q qubits. ThisF bounded-storageI as follows: model was introduced and first studied in Damgaard et al. (2007, 2008); and Schaffner(2007). 1. Alice prepares a random n bit string Kn, encodes While much more refined bounds are known Dupuis each bit K in one of the BB84 Bennett and Bras- i et al. (2015), let us first explain how already entropic un- sard(1984) bases Θ σ , σ at random, and X Z certainty relations for a classical memory system can be sends these n qubits to∈ Bob. { } used to obtain weak security statements in this setting. 2. Bob measures the n qubits in randomly chosen To this end, we first differentiate Bob’s knowledge into 0 B = QMΘn, where Q denotes the q qubits of quantum bases Θ σX, σZ . ∈ { } memory, M denotes (unbounded) classical information, 3. After the waiting time ∆t, Alice sends the classical and Θn is the n bit basis information string Alice sent n n n bit string Θ to Bob and outputs K . to Bob. Since the conditional min-entropy obeys a chain 0 rule Renner(2005), we can separate the quantum mem- 4. Bob computes I = i : θi = θ and outputs I and { i} ory as KI . n n n Note that if both parties are honest, then the protocol Hmin(K B) = Hmin(K QMΘ ) (320) n | n| n is correct in the sense that Alice outputs K and Bob Hmin(K MΘ ) q . (321) n ≥ | − I with KI K . Moreover, when Alice is dishonest, it ⊆ n n is intuitively obvious that she is unable to gain any in- Analyzing Hmin(K MΘ ) is then directly determined formation about the index set I (even with an arbitrary by Bob’s ability to win| the guessing game, in which he quantum memory), since she never receives any informa- only has classical information M. Using the min-entropy tion from Bob during the protocol. A precise argument uncertainty relation (104) for the n qubit BB84 measure- for this can be found in, e.g., König et al. (2012). On the ments (with an extension to classical side information M 47 as sketched in Sec. IV.C), we get which was then refined significantly by Berta et al. (2013, 2014b), leading to the asymptotically tight security anal- n n 1 1 ysis by Dupuis et al. (2015). Here, one can not just Hmin(K MΘ ) n log + . (322) | ≥ − · 2 2√2 use the chain rule to separate the quantum memory as in (320)–(321). Such a separation is only possible when Hence, we find a non-trivial lower bound relating the security to the classical capacity of the stor- n age channel (König et al., 2012). Instead, we have to Hmin(K B) > 0 as long as q . n 0.22 . (323) | · apply a min-entropyF uncertainty relation with quantum This security analysis can be refined and improving memory to directly lower bound on Damgaard et al. (2007), Ng et al. (2012) make use of H (Kn B) = H (Kn QMΘn) . (328) the following stronger smooth min-entropy uncertainty min | min | relation which is based on (105), We use a variant of the relation (204) for the n qubit BB84 measurements to bound (Dupuis et al., 2015), ε n n Hmin(K MΘ ) n | ε n n Hmin(A QM) 1 1 2 H (K QMΘ ) n γBB84 | n sup 1 + s log (1 + 2s) log . min | ≥ · n ≥ · s − − sn ε2 s∈(0,1] 2 (324) 1 log , (329) − − ε2 One can use this uncertainty relation together with the where the function γBB84( ) is as in (205). In order more refined analysis of König et al. (2012) instead to get an idea how to lower· bound the right-hand side of (321), to obtain perfect security (λ 1) against quan- → of (329) under a noisy quantum memory Q assumption, tum memory of size n recall that Hmin(A QM) is a measure of entanglement n | n between A and B = QM. In particular, one can relate q . (325) ≤ 2 this amount of entanglement to Bob’s ability to store the n EPR pairs that Alice sends in the purified version of for n . Ultimately, Dupuis et al. (2015) show by de- the protocol, that is, the quantum capacity of the stor- → ∞ riving strong entropic uncertainty relations that the pro- age channel . If cannot preserve said entanglement, Fn F n tocol from Sec. VI.C.1 implements a WSE scheme against then Hmin(K QMΘ ) in (329) will be lower bounded q qubits of quantum memory for non-trivially leading| to a secure WSE scheme for some trade-off between the security parameter λ from (319), 1 q 1 λ = γBB84 , (326) the number n of qubits sent, and the noisiness of the 2 −n − n quantum memory Q. We refer to Dupuis et al. (2015) for any details. where the function γBB84( ) is as in (205). Asymptot- ically (n ), this provides· perfect security (λ 1) Again we could also use a six state encoding → ∞ → for the weak string erasure protocol de- against quantum memories of size σX, σY, σZ scribed{ in Sec.} VI.C.1. We refer to Berta et al. (2014b) q n O log2 n . (327) and Dupuis et al. (2015) for a security analysis. ≤ − This is basically optimal, since no protocol can be secure if q = n. Finally, we mention that alternatively we could 4. Uncertainty in other protocols also use a six state encoding σX, σY, σZ for the weak string erasure protocol described{ in Sec. VI.C.1} . We refer Entropic uncertainty relations feature in many other to Dupuis et al. (2015); Mandayam and Wehner(2011); quantum cryptographic protocols. The entropic relation and Ng et al. (2012) for a security analysis. for channels (245) was used in Buhrman et al. (2008) to obtain cheat-sensitivity for a quantum string commitment protocol. The same relations as relevant for the 3. Noisy-storage model noisy-storage model above, have also been used to prove security in the isolated qubit model Liu(2014, 2015). In Let us know consider the most general case of arbitrary this model, the adversary is given a quantum memory of storage devices in Fig. 16(Wehner et al., 2008). This potentially long-lived qubits, but they are isolated in the model is motivatedF by the fact that counting qubits is sense that he is unable to perform coherent operations generally a significant over estimate of the storage capa- on many qubits simultaneously. In particular, the uncer- bilities of a quantum memory, and indeed for example for tainty relation of Damgaard et al. (2007) was used in Liu continous variable systems there is no dimension bound (2014) to obtain security. It would possible to use the re- to which to apply the bounded-storage analysis. The first lation (105) from Ng et al. (2012) to obtain improved se- general security analysis was given by König et al. (2012), curity parameters. Furthermore, tripartite Tomamichel 48 et al. (2013) and bipartite Ribeiro and Grosshans(2015) (2012)) uncertainty relations have been used to ensure the secu- 1 rity of position-based cryptography. Finally, in relativis- tr[ρABEXZ ] . (333) tic cryptography, security of two-party protocols is pos- ≥ 2 sible under the assumptions that each player is split into Hence if EX + EX < 1/2, where O := tr[OρAB], h i h i h i several non-communicating agents, and tripartite uncer- then ρAB is entangled. This witness is depicted as the tainty relations have been used to establish security in solid line in Fig. 17. this setting (Kaniewski et al., 2013).

1. Shannon entropic witness

D. Entanglement witnessing Consider the bipartite uncertainty relation with quantum memory in (167). Berta et al. (2010) discussed how Entanglement is a central resource in quantum infor- this can be used for entanglement witnessing, and this mation processing, hence methods for detecting entangle- approach was experimentally implemented by Li et al. ment are crucial for quantum information technologies. (2011) and Prevedel et al. (2011). Specifically, from Entanglement witnessing refers to the process of verifying (167), one finds that all separable states satisfy that a source is producing entangled particles. Entangled states are defined as those states that are non-separable, 1 H(XA XB) + H(ZA ZB) log , (334) i.e., they cannot be written as a convex combination of | | ≥ c product states. A common theme in entanglement wit- where the c parameter refers to Alice’s observables, nessing is to first prove a mathematical identity that all whereas Bob’s observables XB and ZB are arbitrary. One separable states must satisfy; let us refer to such an iden- can see this by noting that H(A B) 0 for any separa- tity as an entanglement witness. Experimentally demon- ble state, and furthermore that measuring| ≥ Bob’s system strating that one’s source violates this identity will then in some basis XB cannot reduce his uncertainty about guarantee that the source produces entangled particles. Alice’s measurement, i.e., H(XA XB) H(XA B). Entanglement witnessing is a well-developed field (e.g., One can use (334) for entanglement| ≥ witnessing,| using see the review article by Gühne and Tóth(2009) and a protocol where Alice and Bob have many copies of ρAB Horodecki et al. (2009)), and their are many types of and they each measure either their X or Z observable entanglement witnesses. Here we focus on entanglement on each copy. The quantities H(XA XB) and H(ZA ZB) witnesses that follow from entropic uncertainty relations. can then be calculated from their joint| probability distri-| In what follows, we restrict the discussion to bipar- butions Pr(XA = xA,XB = xB) and Pr(ZA = zA,ZB = tite entanglement. We note that entanglement witness- zB), and if (334) is violated, then ρAB must be entangled. ing typically occurs in the distant-laboratories paradigm, Fig. 17 depicts this entanglement witness (long-dashed where two parties - Alice and Bob - can each perform lo- curve) for the case of qubits and mutually unbiased cal measurements on their respective systems, but neither bases. A comparison of this curve to the black line shows party can perform a global measurement on the bipartite that‘’(333) detects more entangled states than (334). system. However, the “quality” of entanglement that (334) de- For introductory purposes, let us mention a sim- tects is higher. This is because (334) holds for ple, well-known bipartite entanglement witness for two all non-distillable states, i.e., states from which Alice qubits. Although it is non-entropic, it is based on com- and Bob cannot distill any EPR (maximally-entangled) plementary observables, and so it can be directly com- states using local operations and classical communica- pared to the entropic witnesses discussed below. Namely, tion (LOCC) (see, e.g., (Horodecki et al., 2009) for a dis- consider the operator cussion of LOCC). In this sense, (334) detects distillable entanglement whereas (333) detects all forms of entanglement. EXZ := EX + EZ , where (330) One can make this quantitative using a result by De- EX := + + + + + , (331) | ih | ⊗ |−ih−| |−ih−|⊗ | ih | vetak and Winter(2005) that minus the conditional en- EZ := 0 0 1 1 + 1 1 0 0 . (332) | ih | ⊗ | ih | | ih | ⊗ | ih | tropy lower bounds the distillable entanglement ED, i.e., the optimal asymptotic rate for distilling EPR states us- Note that EX and EZ are “error operators” in that they ing LOCC: project onto the subspaces where Alice’s and Bob’s measurement outcomes are different. For a maximally en- ED H(A B) . (335) ≥ − | tangled state of the form √ , there ψ = ( 00 + 11 )/ 2 Combining this with (167) gives is no probability for error| ini either| i basis,| i so we have ψ EXZ ψ = 0. On the other hand, for any separable 1 h | | i ED log H(XA XB) H(ZA ZB) . (336) state ρAB, we have that (e.g., see Namiki and Tokunaga ≥ c − | − | 49

This reveals an advantage of the entropic uncertainty ap- 0.5 proach to entanglement witnessing, namely, that it can linear witness give quantitative lower bounds, in contrast to witnesses 0.4 Shannon entropy like that in (333) that only answer a ”yes or no” question. collision entropy Another advantage of the entropic uncertainty ap- 0.3 proach is that it requires no structure on Bob’s side. Z While (333) requires both Alice’s and Bob’s measure- e ments to be mutually unbiased, the entropic uncertainty 0.2 approach allows for arbitrary measurements on Bob’s system, and hence is more ﬂexible. 0.1

0.0 2. Other entropic witnesses 0.0 0.1 0.2 0.3 0.4 0.5 eX Other bipartite quantum memory uncertainty relations FIG. 17 Entanglement witnessing for a bipartite two-qubit (see Sec.IV) lead to similar entanglement witnesses. For state using mutually unbiased observables. Suppose Alice and 1−eX example, Berta et al. (2014a) discuss how the uncertainty Bob observe Pr[XA = XB = 0] = Pr[XA = XB = 1] = 2 eX relation in (188) allows for entanglement witnessing using and Pr[XA =0,XB =1] = Pr[XA = 1,XB =0] = 2 and anal- a set of n MUBs on Alice’s system (more precisely, a sub- ogously for Z and eZ . The region below the curve in the plot indicates the region for which one can guarantee entanglement set of size of MUBs chosen from a set of MUBs, n dA + 1 for the respective witnesses. where dA is a prime power and 2 n dA + 1). Con- ≤ ≤ sider such a set Xj of n MUBs on Alice’s system, and { } consider a set of n arbitrary POVMs Yj on Bob’s system. Berta et al. (2014a) show that all{ separable} states admit a local hidden state (LHS) model. An LHS model must satisfy is a model where, say, system B has a local quantum state that is classically correlated to arbitrary observables n X n 1 on system A. This formalization has led researchers to 2−H2(Xj |Yj ) 1 + − . (337) ≤ dA derive steering inequalities (Cavalcanti et al., 2009), in j=1 analogy to Bell inequalities. Fig. 17 compares this entanglement witness (short- Schneeloch et al. (2013) and Walborn et al. (2011) dashed curve) to the previous discussed ones, in the qubit show how entropic uncertainty relations can be used to case with n = 2. Notice that (337) detects more entan- derive steering inequalities. The idea is that if B has gled states than (334), but not as much as (333). a local hidden state, then its measurement probabilities Similar to the Shannon entropy case in (336), the must obey a single system uncertainty relation, even if uncertainty relation (188) actually allows one to give they are conditioned on the measurement outcomes on a quantitative lower bound on an entanglement-like A. More precisely, an LHS model implies that the joint measure. Namely, (188) allows one to lower bound probability distribution for discrete observables XA on A and B on B has the form Hcoll(A B). X − | X P (XA, XB) = P (Λ = λ)P (XA Λ = λ)PQ(XB Λ = λ) . | | λ E. EPR steering inequalities (338)

Steering is a phenomenon for bipartite quantum sys- Here Λ is the hidden variable that determines Bob’s local tems that is related to (although not precisely the same state, λ is a particular value that this variable may take, as) entanglement. Like the previous subsection, we con- and the subscript Q on PQ(XB Λ = λ) emphasizes that sider the distant-laboratories paradigm involving two the probability distribution arises| from a single quantum parties, Alice and Bob, where Alice (Bob) has access to state. Next, we have that system A (B). Steering corresponds to one party’s (say H(XB XA) H(XB XA, Λ) (339) Alice’s) measurement choice giving rise to diﬀerent en- | ≥ | sembles of states on the other party’s (Bob’s) system. X = P (Λ = λ)H(XB XA, Λ = λ) (340) | Not all quantum states exhibit steering, e.g., separable λ states are non-steerable. At the other extreme, all states X = P (Λ = λ)H(XB Λ = λ) , (341) that violate a Bell inequality are steerable. While Bell in- | equalities are derived for states that admit a local hidden λ variable (LHV) model, Wiseman et al. (2007) formalized where the notation H(XB XA, Λ = λ) should be read as | the notion of steerability as those states ρAB that do not the entropy of XB conditioned on XA and conditioned 50 on the event that Λ = λ. Hence for two observables XB and B on B, and some other observables A and A on Z X Z D0 A, we have 0 | i

H(XB XA) + H(ZB ZA) E BS2 | | BS X 1 φ P (Λ = λ)[H(XB Λ = λ) + H(ZB Λ = λ)] (342) 1 ≥ | | λ | i D1

Combining this with, say, Maassen-Uffink’s uncertainty relation (31) gives the following steering inequality FIG. 18 Mach-Zehnder interferometer for single photons. A (Schneeloch et al., 2013), photon impinges on a beam splitter, after which we label the two possible paths by the Z basis states |0i, |1i. The photon 1 may interact with some environment E inside the interferom- H(XB XA) + H(ZB ZA) log , (343) | | ≥ c eter. Then a phase φ is applied to the lower path, and the two paths are recombined on a second beam splitter. Finally where c refers to Bob’s observables. Any state ρAB that the photon is detected at either D0 or D1. admits an LHS model must satisfy (343), hence an experimental violation of (343) would constitute a demon- stration of steering. Similar steering inequalities can be which implies = 0 when = 1 (full particle behavior derived for continuous variables (Walborn et al., 2011). means no waveV behavior) andP vice-versa. More generally, suppose the photon may interact with F. Wave-particle duality some environment system E inside the interferometer. Measuring E might reveal, e.g., some information about Wave-particle duality is the fundamental concept that which path the photon took, so it is natural to consider a single quantum system can exhibit either wave behavior the path distinguishability or particle behavior, but the two behaviors compete, in = 2pguess(Z E) 1 . (346) the sense that one cannot design an interferometer that D | − can simultaneously show both behaviors. This idea was Englert(1996) and Jaeger et al. (1995) prove a stronger qualitatively discussed, e.g., by Feynman, and was sub- version of (345), namely sequently put on quantitative grounds by Wootters and 2 + 2 1 . (347) Zurek(1979) and Jaeger et al. (1995) as well as Englert D V ≤ (1996) and Englert and Bergou(2000), who proved in- WPDRs such as (345) and (347) have often been thought equalities known as wave-particle duality relations (WP- to be conceptually different from uncertainty relations, DRs). Many such relations consider the Mach-Zehnder although this has been debated. interferometer for single photons, shown in Fig. 18. In It turns out that (345) and (347) are actually entropic this case, particle behavior is associated with knowing the uncertainty relations in disguise (Coles et al., 2014). In path that the photon travels through the interferometer, particular, they correspond to the uncertainty relation for while wave behavior is associated with seeing oscillations the min- and max-entropies, see (226), applied to comple- in the probability to detect the photon in a given output mentary qubit observables. Namely, (345) is equivalent to the uncertainty relation, mode as one varies the relative phase φ between the two interferometer arms. Denoting the which-path observ- Hmin(Z) + min Hmax(W ) 1 , (348) W ∈XY ≥ able as Z = 0 0 , 1 1 , then particle behavior can be {| ih | | ih |} quantified by the path predictability = 2pguess(Z) 1, where the minW ∈XY corresponds to minimizing over all which is related to the probability ofP guessing the path− observables in the xy plane of the Bloch sphere. Likewise correctly pguess(Z). The wave behavior is quantified by (347) is equivalent to the uncertainty relation the fringe visibility Hmin(Z E) + min Hmax(W ) 1 . (349) | W ∈XY ≥ p0 p0 max min (344) This unifies the wave-particle duality principle with the = 0 − 0 , V pmax + pmin entropic uncertainty principle, showing that the former is a special case of the latter. where p0 is the probability for the photon to be de- 0 tected by detector D0 (see Fig. 18), pmax := maxφ p0, 0 and pmin := minφ p0. Wootters and Zurek(1979) prove G. Quantum metrology that Quantum metrology deals with the physical limits on 2 + 2 1 , (345) P V ≤ the accuracy of measurements (Giovannetti et al., 2011). 51

The uncertainty principle plays an important role in coherence measures, but one in particular has an opera- establishing such physical limits. Typically in quan- tional meaning in terms of the number of distillable max- tum metrology one is interested in estimating an opti- imally coherent states (Winter and Yang, 2015), namely cal phase, e.g., the phase shift in an interferometer (as the relative entropy of coherence in Fig. 18). Hence uncertainty relations involving the ! phase observable have application here. Recall that we X z z z z Φ(Z, ρ) := D ρ Z Z ρ Z Z . (352) briefly discussed an entropic uncertainty relation for the z | ih | | ih | number and phase observables in Sec. V.F, specifically in Eq. (304). While quantum metrology is a broad field Note that the coherence is a function of the state ρ as well as the orthonormal basis Z = Zz Zz . (see, e.g., Giovannetti et al. (2011) for a review), we men- {| ih |} tion here a few works that exploit entropic uncertainty The following connection between coherence and en- relations. tropic uncertainty was established in (Coles, 2012; Coles et al., 2011). Let be any state for system , let be The Heisenberg limit is a well-known limit in quantum ρS S Z a projective observable on , then metrology stating that the uncertainty in the phase esti- S mation scales as 1/ N . Here, N is the mean photon Φ(Z, ρS) = H(Z E) , (353) number of the lighth thati is usedh to probei the phase. Hall | et al. (2012) note that the Heisenberg limit is heuristic, where E is a purifying system for ρS. This states that the and they put it on rigorous footing by proving the fol- relative entropy of coherence for a projective observable lowing bound, is equivalent to the uncertainty of that observable given the purifying system, or in other words, given access to δΦˆ k/ N + 1 , (350) the environment E. ≥ h i The right-hand-side of (353) quantifies uncertainty in where δΦˆ is the root-mean-square deviation of the phase the presence of quantum memory, and uncertainty rela- p estimate Φˆ from the actual phase Φ, and k := 2π/e2. tions for such measures have been discussed in Sec.IV. To prove (350), Hall et al. (2012) define the random vari- Hence one can reinterpret such uncertainty relations, e.g., able Θ := Φˆ Φ and apply the entropic uncertainty re- (167), as lower bounds on the coherence of ρS for different lation in (304−), giving observables. This idea was discussed by Korzekwa et al. (2014b), H(N) + h(Θ) log 2π . (351) although they focused more on the perspective of Luo ≥ (2005) of separating total uncertainty into a “classical” Then they combine (351) with some simple identities that and “quantum” part. In particular, for a rank-one pro- z z relate to ˆ and to , to obtain (350). jective observable Z = Z Z and a quantum state h(Θ) δΦ H(N) N + 1 {| ih |} Hall and Wiseman(2012) considerh a morei general sce- ρ, they defined the classical uncertainty as the entropy of nario where one may have some prior information about the state, C(Z, ρ) := H(ρ), and the quantum uncertainty the phase, and they likewise use the entropic uncertainty as the relative entropy of coherence, relation to obtain a rigorous statement of the Heisenberg ! limit. X z z z z Q(Z, ρ) := D ρ Z Z ρ Z Z . (354) z | ih | | ih | It is straightforward to show that overall uncertainty is H. Other applications in quantum information theory the sum of the classical and quantum parts

Recent eﬀorts to understand the classical-quantum H(Z) = Q(Z, ρ) + C(Z, ρ) . (355) boundary, in the context of both physics and information- Korzekwa et al. (2014b) derive several uncertainty rela- processing, have led to quantitative measures of “quan- tions for the quantum uncertainty Q( , ρ). However, us- tumness” like coherence and discord, which are discussed Z ing (353), one can reinterpret their relations as entropic in Sec. VI.H.1 and VI.H.2, respectively. We further dis- uncertainty relations in the presence of quantum memory. cuss information locking in Sec. VI.H.3 and touch on In particular, their uncertainty relations follow directly quantum coding in Sec. VI.H.4. from combining (167) with (353).

1. Coherence 2. Discord

Baumgratz et al. (2014) introduced a framework for Ollivier and Zurek(2001) quantify quantum correla- quantifying coherence, which is a measure of quantum- tions by discord, which is defined as ness that satisfies some properties, such as not increas- D(B A) := I(A : B) J(B A) , (356) ing under incoherent operations. There are a variety of | − | 52 which is the difference between the quantum mutual in- by means of a simple example based on the Maassen- formation I(A : B) and the classical correlations, Uffink bound for the n qubit BB84 measurements (103),

(357) J(B A) := max I(X : B) , n n 1 n | X H(K Θ ) n with Θ θ , . . . , θ n . (361) | ≥ · 2 ∈ { 1 2 } where the optimization is over all POVMs X acting on system A. In Sec. IV.E, Ex. 25, we discussed how dis- In order to encode a uniformly random n bit string X we cord quantifies the gap between conditioning on classi- choose at random a n qubit BB84 basis θi (the key) and cal versus quantum memory. Another connection to dis- encode the message in this basis. Based on (361), DiVin- cord is the following. In an effort to strengthen the un- cenzo et al. (2004) show that for any measurement on certainty relation with quantum memory in (167), (Pati this quantum state the mutual information between the et al., 2012) introduced an additional term on the right- outcome of that measurement and the original classical hand-side that depends on the discord of the state ρAB. message X is at most n/2. That is, n/2 bits are locked in Namely they proved the bound the quantum state and are not accessible without knowing the basis choice (the key). This is remarkable be- 1 H(X B) + H(Z B) log + H(A B) cause any non-trivial purely classical encryption of a n | | ≥ c | bit string message requires a key of size at least n 1. Of n o − + max 0,D(B A) J(B A) . course, this then raises the question about the optimal | − | (358) trade-off between the number of lockable bits and the key size. For that purpose Fawzi et al. (2011) make use of Clearly this strengthens the bound in (167) for states the uncertainty relation (102), ρAB whose discord exceeds their classical correlations: D(B A) > J(B A). Indeed, Pati et al. (2012) showed H(K Θ) n (1 2ε) h(ε) with Θ = θ1, . . . , θL . | ≥ · − − { } that| this is true| for Werner states, and furthermore that (362) their bound (358) is perfectly tight for Werner states. In turn, this result was used by Hu and Fan(2013) Based on this they show that a key size of L = to obtain a strong upper bound on discord. That is, O(log(n/ε)) allows for locking an n bit string up to a the uncertainty relation (358) allows one to bound the mutual information (accessible information) smaller than discord by ε > 0. State-of-the-art results use stronger definitions for information locking in terms of the trace norm instead of 1 D(B A) I(A : B) + δT , (359) the mutual information and are based on so-called metric | ≤ 2 uncertainty relations (Dupuis et al., 2013; Fawzi et al., where 2011).29 Finally, we mention that Guha et al. (2014) initiated the study of the information locking capacity 1 δT := H(X B) + H(Z B) log H(A B) . (360) of quantum channels, which is also intimately related to | | − c − | uncertainty.

Here δT is the gap between the left and right hand sides in the uncertainty relation (167). 4. Quantum Shannon theory 3. Locking of classical correlations The original partial results and conjectures for entropic One operational way of understanding entropic uncer- uncertainty relations with quantum memory by Chris- tainty relations is in terms of information locking (Di- tandl and Winter(2005) and Renes and Boileau(2009) Vincenzo et al., 2004). In the following we present a were inspired by applications in quantum Shannon the- cryptographic view on information locking as discussed ory (Renes and Boileau, 2008). More recently, entropic by Fawzi et al. (2011). uncertainty relations and in particular their equality con- A locking scheme is a protocol that encodes a classical ditions have been used to analyze the performance of message into a quantum state using a classical key of size quantum Polar codes, e.g. in (Renes et al., 2015; Renes much smaller than the message. The goal is that without and Wilde, 2014). knowing the key the message is locked in the quantum state such that any possible measurement only reveals a negligible amount of information about the message. Furthermore, knowing the key it is possible to unlock and 29 We emphasize that the security deﬁnitions for information lock- completely recover the message. The connection of infor- ing are not composable (see, e.g., (Renner, 2005) for a discus- mation locking to entropic uncertainty is best presented sion). 53

VII. MISCELLANEOUS TOPICS Here h : R R and φ : [0; 1] R are generic continuous functions such→ that either φ →is strictly concave and h is A. Tsallis and other entropy functions strictly increasing, or φ is strictly convex and h is strictly decreasing. Additionally, they imposed φ(0) = 0 and From a mathematical perspective it is interesting to h(φ(1)) = 0. This family includes as special cases both consider uncertainty relations for various generalizations the Rényi and Tsallis families and hence also the Shannon of the Shannon entropy. While the Rényi entropies were entropy. discussed above, the Tsallis entropies are another family In addition to giving a detailed overview of the lit- of interest. The Tsallis entropy of order α is defined as erature on entropic uncertainty relations, Zozor et al. (2014) derived a new uncertainty relation for the H ! (h,φ) T log e X α entropies. For any two POVMs and , and for any Hα (X) := PX (x) 1 X Z 1 α − two pairs of functionals (h , φ ) and (h , φ ), their rela- − x 1 1 2 2 tion takes the form, for α (0, 1) (1, ) , (363) ∈ ∪ ∞ H (X) + H (Z) B (t) , (369) and as the corresponding limit for α 0, 1, . Similar (h1,φ1) (h2,φ2) ≥ (h1,φ1),(h2,φ2) ∈ { ∞} to the Rényi entropies, the α = 1 Tsallis entropy corre- where the right-hand side is a function of the triplet sponds to the Shannon entropy. Note that for x 1 we have log x log e (x 1), so when P P (x)α ≈1 the x z x X t := cX, cZ, c , cX := max X , cZ := max Z , Tsallis entropy≈ approximates· − the Rényi entropy. ≈ { } x k k z k k (370) Rastegin has studied uncertainty relations in terms of the Tsallis entropy. For example, Rastegin(2012) proved and c is defined in (49). The reader is referred to the following uncertainty relation for Tsallis entropies, for (Zozor et al., 2014) for the explicit form of the bound a set of three MUBs , , on a qubit. For α (0, 1] X Y Z B(h1,φ1),(h2,φ2)(t). In general, this bound can be com- and for integers α 2{, we have} ∈ ≥ puted, since it only involves a one-parameter optimiza- T T T tion over a bounded interval. Note that the functionals H (X) + H (Y ) + H (Z) 2 log e fα(2) , (364) α α α ≥ · associated with the two terms in (369) may be differ- 1 x1−α ent. This gives a very general result allowing the au- where fα(x) := − . (365) α 1 thors to consider, e.g., Rényi entropy uncertainty rela- − tions that go beyond the usual conjugacy curve, defined This generalizes the result in (87), which is recovered by (1/α) + (1/β) = 2. by taking the limit α 1, noting that limα→1 fα(x) = log x/ log e. → A more general scenario was considered in (Rastegin, B. Certainty relations 2013), where system A has dimension d, and the measurements under consideration form a set of n MUBs, Instead of lower bounding sums of entropies for differ- Xj . For α (0, 2], Rastegin(2013) shows that ent observables, it is interesting to ask whether there exist { } ∈ non-trivial upper bounds on such sums. Upper bounds of n 1 X T nd this nature are called certainty relations. Of course, one H (Xj) 2 log e fα . (366) n α ≥ · n + d 1 would not expect to find non-trivial upper bounds for, j=1 − say, the maximally mixed state ρA = 1/d. But suppose one restricts to pure states ψ A. This result is quite general in that it holds for any n and | i d. Furthermore, in the case of n = d + 1 and α 1, one For some sets of observables, even restricting to pure recovers the result presented in (80). So (366) generalizes→ states is not enough to get a certainty relation. For ex- (80). Rastegin(2013) also tightened this bound for mixed ample, consider the standard σX and σZ observables on states, with a state-dependent bound a qubit. One cannot find a certainty relation for these two observables because there exist states, namely the n eigenstates of σ , that are unbiased with respect to the 1 X T nd Y H (Xj) 2 log e fα . (367) n α ≥ · n + d tr(ρ2) 1 eigenbases of σX and σZ , and hence lead to maximum j=1 − uncertainty in these two bases. So the best bound we can get is , which is obviously trivial. Other entropy families are also discussed in the literature. H(X) + H(Z) 2 Recently Korzekwa et al.≤ (2014a) proved a general re- For example, Zozor et al. (2014) consider a broad class sult that non-trivial certainty relations are not possible of entropies defined as for two arbitrary orthonormal bases X and Z, in any fi- ! nite dimension d. This follows from the fact that one can X H(h,φ)(X) := h φ(PX (x)) . (368) always find a pure state ψ that is unbiased with respect | i x to both X and Z. 54

However, there do exist non-trivial certainty relation, to derive certainty relations for other entropies, such as e.g., for a d+1 set of MUBs, which is obviously connected the min-entropy, due to the fact that H H . min ≤ 2 to the fact that there are no states that are unbiased to all The generalization of (81) to bipartite states ρAB was bases in d+1 MUB set. Consider a result from (Sánchez, given in (188). Equation (188) is a certainty relation in 1993), which deals with three MUBs (X, Y, Z) on a qubit the presence of quantum memory. It relates the amount system in a pure state, and says that of uncertainty to the amount of entanglement, as quantified by the conditional entropy H2(A B). Similar to the 3 √3 | H(X) + H(Y ) + H(Z) log 6 log(2 + √3) . unipartite case, (188) can be used to derive certainty re- ≤ 2 − 2 lations (in the presence of quantum memory) for other (371) entropies, such as the min-entropy, as discussed in (Berta et al., 2014a). The right-hand side of (371) is 2.23. Comparing this Bipartite certainty relations (i.e., in the presence of to the lower bound of 2, from≈ (87), one sees that the quantum memory) are an interesting open problem. For allowable range for H(X) + H(Y ) + H(Z) is quite small. example, one could ask whether (371) or (372) can be Sánchez(1993) noted that (371) is in fact the optimal appropriately generalized to the quantum memory case. certainty relation for these observables. More generally, considering a d + 1 set of MUBs Xj , Sánchez(1993) showed that { } C. Measurement uncertainty n X H(Xj) n log(n + √n) ≤ This review has focused on preparation uncertainty j=1 relations. Two other aspects of the uncertainty princi- 1 (n + (n 2)√n) log(2 + √n) . (372) ple are (1) the joint measurability of observable pairs − d − and (2) the disturbance of one observable caused by the measurement of another observable. Joint measur- where n = d + 1. Note that (371) is a special case of ability and measurement-disturbance are two aspects of (372) corresponding to d = 2. measurement uncertainty, which deals with fundamen- Rastegin obtained some generalizations of (371) to tal restrictions on ones ability to measure things. For the Rényi and Tsallis entropy families. In the Rényi a detailed discussion of measurement uncertainty, we re- case Rastegin(2014) found, for all α (0, 1], ∈ fer the reader to (Busch et al., 2007, 2014a; Hall, 2004; Ozawa, 2003). It is important, though, that we mention Hα(X) + Hα(Y ) + Hα(Z) 3Rα , (373) ≤ measurement uncertainty here because the topic has seen where significant debate recently (see, e.g., (Busch et al., 2013, !α !α! 2014a,b)). It represents an area where further research 1 1 + 1/√3 1 1/√3 is needed, and entropic approaches could play a valuable Rα := log + − . 1 α 2 2 role. − (374) Rather than delve into the conceptual issues of measurement uncertainty, we will simply give a taste here of Likewise Rastegin(2012) found a similar sort of bound a few recent works that have taken an entropic approach, for the Tsallis entropies, but with log(x) in (374) replaced in particular, to measurement-disturbance. by x 1. While− the above certainty relations are for MUBs, very recently Puchała et al. (2015) studied a more general sit- 1. State-independent measurement-disturbance relations uation. They considered sets of n > 2 orthonormal bases in dimension d and derived certainty relations for this A promising approach to measurement uncertainty very general situation. Their certainty relations are up- asks the question: how well can a measurement de- per bounds on the sum of Shannon entropies, similar to vice perform on particular idealized sets of input states, (372), but are not restricted to MUBs. Certainty rela- e.g., the basis states associated with two complemen- tions for k-designs with k = 2, 4 in terms of the mutual tary observables X and Z. This is often called a state- information can also be found in (Matthews et al., 2009). independent approach, although it could also be called a Finally, it is worth reminding the reader that for the calibration approach, since one is calibrating a device’s collision entropy one can obtain an equality, as in (81). performance based on idealized input states. For exam- An equation of this sort is both an uncertainty and a cer- ple, this approach was taken for the position and mo- tainty relation. Stated another way, an equation implies mentum observables in (Busch et al., 2013), although the that the strongest uncertainty relation coincides with the quantities in their relation were not entropic so we will strongest certainty relation, leaving no gap between the not discuss it. two bounds. Equations such as (81) can, in turn, be used More recently the calibration approach was taken 55 by Buscemi et al. (2014). They considered the sequential 2. State-dependent measurement-disturbance relations measurement (or more generally, a joint measurement) of two orthonormal bases, X and Z, and employed entropic Now let us consider a sequential measurement scenario measures of X measurement noise and Z disturbance. where Alice feeds in system A in an arbitrary state ρA. Bob’s measurement of Alice’s system A was modeled us- We now discuss some state-dependent relations, i.e., re- ing a quantum channel that maps A to two classical lations that hold for any input state ρA. M registers MX and MZ that respectively store Bob’s out- For simplicity, consider the sequential measurement of comes for his attempted X and Z measurements. can orthonormal bases, X followed by Z, where the first mea- be decomposed into complementary quantum channelsM surement is a von Neumann measurement, i.e., it leaves and (see (255) for the definition of complementary the system in an X basis state. One can apply Maassen- E F channels), where maps A to the classical register MX . Uffink’s uncertainty relation to each outcome of the X E x The complementary channel maps A to a bipartite measurement, i.e., to each state X , giving 0 0 0 F | i system A MX , where A is simply system A at a later 0 1 time, and MX is an additional copy of the classical regis- H(Z) x = H(X) x + H(Z) x log . (378) |X i |X i |X i ≥ c ter MX . (When we say a register is “classical”, we mean x x x that there exists another copy of it somewhere, and in Multiplying this by the probability p = X ρA X for 0 h | | i this case MX is that copy.) Finally, Bob uses a recovery outcome x, and summing over x gives 0 0 map to map A M to the classical register MZ . R X 1 In the spirit of the calibration approach, they supposed H(Z X) log , (379) that Alice sends the X basis states with equal probability | ≥ c into the channel , and quantified the X measurement E where H(Z X) denotes the uncertainty for a future Z noise by N( , X) = H(XA MX ). Alternatively, they | M | measurement given the outcome of the previous X mea- supposed Alice sends the Z basis states with equal prob- surement. Equation (379) was discussed in detail by Baek ability into the channel , and quantified the distur- R ◦ F et al. (2014), and was also briefly mentioned by Coles and bance of Z by D( , Z) = H(ZA MZ ). Here XA and ZA Piani(2014a). Note that (379) holds for any input state refer to Alice’s classicalM registers| that store which basis ρA, so technically it is a state-dependent relation. state she sent. Their measurement-disturbance relation While (379) assumes the X measurement is an ideal von states that Neumann measurement, it is interesting to ask what hap- 1 pens if the first measurement is non-ideal. There are var- N( , X) + D( , Z) log , (375) ious ways to address this. One approach, given by Coles M M ≥ c and Furrer(2015), quantified the imperfection of the X which shows a trade-off between Bob’s ability to measure measurement by the predictive error, the X states well versus his ability to leave the Z states undisturbed. Buscemi et al. (2014) emphasize that their E(ρA, X, ) := Hmax(X MX ) , (380) E | measures have a close connection to the guessing probability, and hence are well-motivated operationally. Fur- that is, the max-entropy of a future (perfect) X mea- thermore, their allowance of a recovery map captures surement given the register MX that stores the outcome the notion of irreversible disturbance. R of the previous (imperfect) measurement of X. Here , which maps , is the channel that performsE Formally speaking, we remark that (375) can be de- A AMX this imperfect →measurement. One is interested in the rived from (257), which deals with sending information X disturbance of the observables caused by the imperfect over complementary quantum channels. One can see this Z measurement. Coles and Furrer(2015) quantified the using X disturbance of Z using the Rényi relative entropies for α [1/2, ], N( , X) = log d χ( , X) (376) M − E ∈ ∞ D( , ) = log d χ( , ) . (377) E Z Z Dα(ρA, Z, ) := Dα(PZ PZ ) . (381) M − R ◦ F E ||

These identities allow one to convert between the forms Here PZ is the initial probability distribution for the E in (375) and (257). Z measurement and PZ is the final probability distri- Recently Renes and Scholz(2014) introduced an alter- bution for Z, i.e., after the imperfect X measurement. native approach that is not explicitly entropic, but it has With these definitions, they found the measurement- both a clear operational interpretation and relevance to disturbance relation information-processing tasks. Namely they quantify er- 1 ror and disturbance in terms of the probability of distin- Dα(ρA, Z, ) + E(ρA, X, ) + Hα(Z)P . (382) guishing the channel associated with the actual measure- E E ≥ c ment apparatus from a channel that performs an ideal On the one hand this gives a trade-off between mea- measurement. suring X well and causing large Z disturbance. On the 56 other hand, the trade-off gets weaker as more initial uncertainty. Sec. VII.C noted that entropic uncertainty re- certainty is contained in PZ , as quantified by the term lations may play an important role in obtaining conceptu- Hα(Z)P . So there is an interplay between initial uncer- ally clear formulations of measurement uncertainty. Fur- tainty, measurement error, and disturbance. thermore, entropic uncertainty relations will continue to help researchers characterize the boundary between separable vs. entangled states (Sec. VI.D), as well as steerable VIII. PERSPECTIVES vs. non-steerable states (Sec. VI.E). But other physics applications are emerging. Entropic We have discussed modern formulations of Heisen- uncertainty relations may play a role in the study of berg’s uncertainty principle, where uncertainty is quan- phase transitions in condensed matter physics (Romera tified by entropy. Such formulations are directly relevant and Calixto, 2015). Entropic uncertainty relations are to quantum information processing tasks as discussed in also studied in the context of special and general rela- Sec.VI. tivity (Feng et al., 2013; Jia et al., 2015). Given that Technological applications such as QKD (Sec. VI.B) quantum information is playing an increasing role in cos- provide the driving force for obtaining better entropic mology (Hayden and Preskill, 2007), it would not be sur- uncertainty relations. For example, to prove security of prising to see future work on entropic uncertainty rela- QKD protocols involving more than two measurements, tions in the context of black hole physics. new entropic uncertainty relations are needed - namely ones that allow for quantum memory and for multiple measurements. This is an important frontier that requires more research. Device-independent randomness, ACKNOWLEDGMENTS i.e., certifying randomness obtained from untrusted devices (Sec. VI.A.2), is another emerging application for which entropic uncertainty relations appear to be useful We thank Kais Abdelkhalek, Iwo Białynicki-Birula, but more research is needed to find uncertainty relations Matthias Christandl, Rupert L. Frank, Gilad Gour, that are specifically tailored to this application. Michael J. W. Hall, Hans Maassen, Joseph M. Renes, Aside from their technological applications, we believe Renato Renner, Lukasz Rudnicki, Christian Schaffner, entropic uncertainty relations have a beauty to them. Reinhard F. Werner, Mark M. Wilde, and Karol Zy- They give insight into the structure of quantum the- czkowski for feedback. PJC acknowledges support from ory, and for that reason alone they are worth pursuing. Industry Canada, Sandia National Laboratories, NSERC For example Sec. IV.F.5 noted a simple conjecture — that Discovery Grant, and Ontario Research Fund (ORF). the sum of the mutual informations for two MUBs lower MB acknowledges funding provided by the Institute for bounds the quantum mutual information. It would be in- Quantum Information and Matter, an NSF Physics Fron- teresting to prove this conjecture because of its beautiful tiers Center (NFS Grant PHY-1125565) with support simplicity. of the Gordon and Betty Moore Foundation (GBMF- New tools are now being developed to prove en- 12500028). Additional funding support was provided by tropic uncertainty relations. The majorization approach the ARO grant for Research on Quantum Algorithms at (Sec. III.I) is quite promising and very recently it has the IQIM (W911NF-12-1-0521). MT is funded by an Uni- been extended to allow for a memory system (Gour et al., versity of Sydney Postdoctoral Fellowship and acknowl- 2015). The relation between the majorization proof ap- edges support from the ARC Centre of Excellence for En- proach and the relative-entropy proof approach (e.g., see gineered Quantum Systems (EQUS). SW is supported by App.B) remains to be clarified, and a unified framework STW, Netherlands and an NWO VIDI grant. would be insightful. For uncertainty relations with memory, Dupuis et al. (2015) establish a powerful meta theorem to derive new uncertainty relations. Yet, it is known that the resulting relations are not tight in all regimes, Appendix A: Mutually unbiased bases calling for further improvements. One of most exciting things about entropic uncertainty Sec. III.B.2 defined MUBs, and sets of n MUBs. The relations is that they are showing promise for giving study of MUBs is closely related to the study of entropic insight into basic physics. For example Sec VI.F dis- uncertainty. Strong entropic uncertainty relations have cussed how entropic uncertainty relations allow one to been derived generically for sets of MUBs (particularly unify the uncertainty principle with the wave-particle for d + 1 sets of MUBs), hence constructing a new set duality principle. A natural framework for quantifying of MUBs immediately yields a new entropic uncertainty wave-particle duality will likely come from applying en- relation. On the other hand, there are interesting open tropic uncertainty relations to interferometers. Likewise, questions about whether a set of n MUBs Xj yield the a hot topic in quantum foundations is measurement un- strongest bound b in a generic uncertainty{ relation} of the 57 form forming a complex projective two-design (Klappenecker n and Rotteler, 2005). X H(Xj) b . (A1) Complete sets of MUBs are known to exist in prime ≥ m j=1 power dimensions, i.e., d = p where p is a prime and m is a positive integer. However, even for the smallest num- A review of MUBs can be found in (Durt et al., 2010). ber that is not a prime power, namely 6, the existence Here we discuss the connection of MUBs to Hadamard problem remains unsolved. matrices, as well as the existence and construction of MUBs. 3. Simple constructions

1. Connection to Hadamard matrices When d is a prime, a simple construction (Bandyopad- hyay et al., 2002; Wootters and Fields, 1989) of a com- Any two orthonormal bases are related by a uni- plete set of MUBs is to consider the eigenvectors of the tary, and in the case of MUBs, that unitary is called a d + 1 products of the form Hadamard matrix H. The general form of such matrices σ , σ , σ σ , σ σ2, ..., σ σd−1 . (A5) is { Z X X Z X Z X Z } m iφ More generally for d = p , a construction is known where X e jk H = j k , (A2) each basis Bi comes from the common eigenvectors of √d | ih | j,k a corresponding set Ci of commuting matrices (Bandy- opadhyay et al., 2002). The elements of Ci are a subset where the phase factors φjk must be appropriately chosen 2 j k of size Ci = d 1 of the d 1 Pauli products σ σ so that is unitary. Notice that each matrix element has X Z H (excluding| | the identity).− The subset− is chosen such that a magnitude of 1/√d, which is the deﬁning property of all the elements of C commute and C T C = 1 for Hadamard unitaries. The most well-known Hadamard is i i j i = j. { } the Fourier matrix, deﬁned in (207) but restated here, 6

X ω−jk F = j k with ω = e2πi/d , (A3) Appendix B: Proof of Maassen-Uffink’s Shannon entropy √ | ih | j,k d relation which relates the generalized Pauli operators Here we give a simple proof of Maassen-Uffink’s uncer- X X tainty relation for the Shannon entropy (31). Our proof σ = ωj j j , σ = F σ F † = j + 1 j . (A4) Z | ih | X Z | ih | closely follows the ideas in (Coles et al., 2012) and makes j j use of the data-processing inequality for Umegaki’s rela- For d = 2 these are just the usual Pauli matrices from tive entropy (Lindblad, 1975; Uhlmann, 1977). In fact, Ex.7. we will prove the slightly stronger relation stated in (47) It should be clear that the problem of finding MUBs is and repeated here, equivalent to the problem of finding Hadamard matrices. 1 H(X) + H(Z) log + H(A) . (B1) We note that Hadamards can be categorized into equiv- ≥ c alence classes, based on whether there exists a diagonal Note that this strengthens the Maassen-Uffink rela- unitary or permutation that that maps one Hadamard to tion (31) when the state ρA has some mixedness. another. A detailed catalog of Hadamard matrices can be found online (Bruzda et al., 2015). Proof. For the proof of (B1) we consider the classical state ρ˜X = A→X (ρA) generated by applying the measurement mapX 2. Existence X x x A→X ( ) = X X x x X , (B2) X · h | · | i| ih | That there exist MUB pairs in any finite dimension x follows, e.g., from the fact that we can write down F in where x x is an orthonormal basis of an auxiliary {| i} (A3) for any d. In fact, for any d there exists a set of 3 Hilbert space X that allows us to represent the classi-

MUBs, e.g., formed from the eigenvectors of σX, σZ, and cal random variable X in the quantum formalism. σXσZ. It is easy to verify that the Shannon entropy of the It is also known that a set of MUBs can at most be of distribution PX is equal to the von Neumann entropy of size d+1 (Bandyopadhyay et al., 2002). Such d+1 sets (if the state ρ˜X . From this we get they exist) are called complete sets of MUBs. Complete H(X) = tr [˜ρX logρ ˜X ] = tr [ (ρA) log (ρA)] (B3) sets play a role in tomography since they are informa- − − X X = tr [ρA log (ρA)] , (B4) tionally complete, and they have the useful property of − X 58 where the last equality is straightforward to check by 1. Deﬁnitions writing out the trace and the measurement map A→X . X 1 By phrasing the right-hand side of (B3) in terms of For any bipartite quantum state ρAB and α [ 2 , ], Umegaki’s relative entropy, we deﬁne the quantum conditional Rényi entropy∈ as ∞

D(ρA σA) = tr[ρA(log ρA log σA)] , (B5) Hα(A B) := min Dα(ρAB 1A σB) , k − σ we arrive at | − B k ⊗ where σB is a quantum state on B. (C1) H(X) = D(ρA (ρA)) + H(A)ρ . (B6) kX We then apply the measurement map Here, Dα is the Rényi divergence of order α (Müller- Lennert et al., 2013; Wilde et al., 2014), namely30 X ( ) = z z z z . (B7) A→Z Z Z Z Z · z h | · | i| ih | 1 1−α 1−α α Dα(ρ σ) := log tr σ 2α ρσ 2α to both arguments of the relative entropy, and ﬁnd by the k α 1 − data-processing inequality for the relative entropy (Lind- 1 for α , 1 (1, ) (C2) blad, 1975; Uhlmann, 1977) that ∈ 2 ∪ ∞

D(ρA (ρA)) D( (ρA) (ρA)) kX ≥ Z kZ ◦ X and as the corresponding limit for α 1, . These = D(˜ρZ (ρA)) , (B8) ∈ { ∞} kZ ◦ X divergences are measures of distinguishability between where ρ˜Z = A→Z (ρA). By writing out both measure- quantum states and some of their properties will be dis- ment maps weZ ﬁnd the classical state cussed in App. C.2. Here we want to note the following special cases that X X x z 2 x x (ρA) = z z Z X Z X ρA X , Z ◦ X | ih | · |h | i| h | | i we have encountered previously. First, the conditional z x min- and max-entropies are simply recovered as H (B9) min ≡ H∞ and H H1 2. The von Neumann entropy is max ≡ / and the relative entropy on the right-hand side of (B8) recovered as H H1. Finally, the conditional collision becomes entropy can be expressed≡ as

D(˜ρZ (ρA)) = H(Z)ρ˜ kZ ◦ X − Hcoll(A B) = D2(ρAB 1A ρB) . (C3) | − k ⊗ X z z X x z 2 x x Z ρA Z log X Z X ρA X . − h | | i |h | i| h | | i Note that H2(A B) Hcoll(A B) since the former in- z x | ≤ | (B10) volves a minimization over marginal states σB. The two expressions are not equal in general and we want to work Now, the logarithm is a monotonic function and hence with Hcoll(A B) because it has the operational interpre- we can bound tation as in (|141) and (150). X z z X x z 2 x x Z ρA Z log X Z X ρA X − z h | | i x |h | i| h | | i 2. Entropic properties X z z x0 z0 2 X x x Z ρA Z log max X Z X ρA X x0,z0 ≥ − z h | | i |h | i| x h | | i We present the properties for the whole family of Rényi (B11) divergences and entropies here, but recall that the prop- x0 z0 2 erties also apply to the relative entropy and the von Neu- = log max X Z . (B12) − x0,z0 |h | i| mann entropy as special cases. Most properties of the conditional Rényi entropy can be derived from proper- By combining (B3)–(B12) and noting that H(Z) equals ties of the underlying Rényi divergence.31 the von Neumann entropy of ρ˜Z , we arrive at the claim (B1).

Appendix C: Rényi entropies for joint quantum systems 30 This quantum generalization is not unique — in fact other generalizations based on Petz’s notion of Rényi divergence (Ohya and Petz, 1993) have also been explored, for example in (Tomamichel We will now define conditional Rényi entropies for gen- et al., 2014). However, for the purpose of the present review it is eral quantum states. This allows us to exhibit their in- convenient to stick with the proposed general definition in (C1) tuitive properties in a very general setting without hav- and (C2) as it entails the most important special cases encoun- ing to discuss various special cases individually. We will tered here and in the literature. 31 These divergences have been investigated in a series of recent exhibit these properties to show a generalization of the works (Beigi, 2013; Frank and Lieb, 2013b; Mosonyi and Ogawa, Maassen-Uffink relation to the tripartite quantum mem- 2015; Müller-Lennert et al., 2013; Wilde et al., 2014) and proofs ory setting. of the properties discussed here can be found in these references. 59 a. Positivity and monotonicity takes ρAB to

First, we remark that D (ρ σ) is guaranteed to be ρ˜XB = A→X B(ρAB) α X ⊗ I non-negative when the argumentsk and are normal- X x x ρ σ = x x X X A 1B ρAB X A 1B . ized, and Dα(ρ σ) = 0 when ρ = σ. Also, α Dα(ρ σ) x | ih | · h | ⊗ | i ⊗ is monotonicallyk increasing in α. Thus, for7→ any β kα, (C6) we have ≥ Then, we find that Hα(A B)ρ Hα(X B)τ , which reveals that measuring out system| ≤A completely| can only 0 Dα(ρ σ) Dβ(ρ σ) , and ≤ k ≤ k increase the uncertainty we have about it.32 log dA Hα(A B)ρ Hβ(A B)ρ log min dA, dB . ≥ | ≥ | ≥ − { (C4)} c. Duality and additivity This means that the conditional Rényi entropies, in particular also the von Neumann entropy, can be negative. We will see that the following property is essential for However, this can only happen in the presence of quan- deriving uncertainty relations with quantum side infor- tum entanglement and the conditional entropies are thus mation. For any tripartite state ρABC , the conditional always positive when one of the two systems is classical. Rényi entropies satisfy the following duality relation. For The maximum, log d , is achieved for a state of the α, β [ 1 , ] such that 1 + 1 = 2, we have (Beigi, 2013; A ∈ 2 ∞ α β form ρAB = τA ρB where τA is fully mixed. On the Müller-Lennert et al., 2013) ⊗ other hand, the minimum, log dA, is achieved for a − Hα(A B)ρ + Hβ(A C)ρ 0 , (C7) maximally entangled pure state of the form ψ AB = | | ≥ √1 P | i x x A x B. dA | i ⊗ | i with equality if ρABC is pure. This is a quantitative manifestation of the monogamy of quantum correlations. For example, if system A is b. Data-processing inequalities highly entangled with system B we find that the conditional von Neumann entropy H(A B)ρ is negative. How- | The Rényi divergences satisfy a data-processing in- ever, the duality relation (C7) now shows that for any 1 third system C correlated with A and B, it holds that equality. Namely, for all α 2 and any cptp map , we find the following relation≥ (Frank and Lieb, 2013b):E H(A C)ρ H(A B)ρ, that is, the uncertainty of A from| an observer≥ − with| access to C is necessarily large in this case. Dα (ρ) (σ) Dα(ρ σ) . (C5) E E ≤ k The Rényi entropies are additive. Namely, given a product state of the form ρABCD = ρAC ρBD, they This is an expression of the intuitive property that it is ⊗ easier to distinguish between the inputs rather than the satisfy Hα(AB CD)ρ = Hα(A C)ρ + Hα(B D)ρ. This is | | | 33 outputs of any quantum channel. In fact, this property in fact a consequence of the above duality relation. holds more generally for any completely positive trace non-increasing map which satisfies tr[ (ρ)] = 1. This E E 3. Axiomatic proof of uncertainty relation with quantum property has two important implications for conditional memory entropies. First, consider an arbitrary cptp map B→B0 acting Here we give a concise proof of the generalized E on the side information that takes ρAB to τAB0 = A Maassen-Uffink relation (225), restated here I 0 ⊗ B→B0 (ρAB). Then we have Hα(A B)ρ Hα(A B )τ . E | ≤ | 1 This tells us that any physically allowed information pro- Hα(X B)ρ + Hβ(Z C)ρ log , (C11) cessing of the side information B may only increase the | | ≥ c uncertainty we have about A.

Example 34. An often encountered special case of this is 32 The above inequality holds a little more generally for all cptp 1 1 the inequality Hα(A BC)ρ Hα(A B)ρ for any tripar- maps on EA→A0 that satisfy EA→A0 ( A) = A0 , e.g., unital | ≤ | maps. tite state ρABC , which expresses the fact that throwing 33 Recall that by deﬁnition (C1), we have away part of the side information can only increase the Hα(AB|CD)ρ = − min Dα(ρABCDk1AB ⊗ σCD) (C8) uncertainty about A. σCD

≥ − min Dα(ρABCDk1AB ⊗ σC ⊗ σD) (C9) The second application concerns rank-1 projective σC ,σD measurements on the A system. More precisely, we = Hα(A|C)ρ + Hα(B|D)ρ . (C10) The reverse inequality then follows due to the duality relation. consider any rank-1 projective measurement A→X that X 60

1 1 where α + β = 2. Let us note that the proof applies where (C18) again follows by the definition of the condi- to a very general class of entropic quantities that sat- tional entropy. isfy certain properties, but we will specialize it here to conditional Rényi entropies. x Let us consider measurements X = XA and Z = REFERENCES z { x } z ZA in two orthonormal bases such that XA and ZA are { } rank-one projectors. The more general proof for POVMs Abdelkhalek, K., R. Schwonnek, H. Maassen, F. Furrer, (and more general entropy measures) follows essentially J. Duhme, P. Raynal, B.-G. Englert, and R. F. Werner the same steps and is detailed in (Coles et al., 2012), (2015), “Optimality of Entropic Uncertainty Relations,” based on ideas of Coles et al. (2011) and Tomamichel arXiv:1509.00398. and Renner(2011). Adamczak, R., R. Latała, Z. Puchała, and K. Ży- czkowski (2014), “Asymptotic Entropic Uncertainty Rela- Proof of (C11). First, let us define the isometry V := tions,” arXiv:1412.7065. P z Ambainis, A. (2010), Quantum Information and Computation z Z associated with the measurement on z ZA Z 10 (9&10), 0848. system| i A⊗, and the state ρ˜ := V ρ V †. We find ZABC ABC Azarchs, A. (2004), Entropic Uncertainty Relations for In- the following sequence of inequalities (which will be ex- complete Sets of Mutually Unbiased Observables, Semester plained in detail below), thesis (California Institute of Technology). Baek, K., T. Farrow, and W. Son (2014), Physical Review A Hβ(Z C)ρ | 89 (3), 032108. Hα(Z AB)ρ (C12) Ballester, M., and S. Wehner (2007), Physical Review A ≥ − | 75 (2), 022319. = min Dα ρ˜ZAB 1Z σAB (C13) σAB ⊗ Ballester, M. A., S. Wehner, and A. Winter (2008), IEEE Transactions on Information Theory 54 (9), 4183. X z z min Dα ρAB ZAσABZA (C14) Bandyopadhyay„ Boykin, V. Roychowdhury, and Vatan σAB ≥ z (2002), Algorithmica 34 (4), 512. Barnum, H., and E. Knill (2002), Journal of Mathematical X x z 2 x z min Dα ρXB XA ZA XA trA ZAσAB . Physics 43 (5), 2097. σAB ≥ x,z h | i ⊗ Baumgratz, T., M. Cramer, and M. B. Plenio (2014), Phys- (C15) ical Review Letters 113 (14), 140401. Beckner, W. (1975), Annals of Mathematics 102 (1), 159. P x x where we have used ρXB := k XAρABXA. To estab- Beigi, S. (2013), Journal of Mathematical Physics 54 (12), lish (C12), we apply the duality relation (C7) to the state 122202. ρ˜ZABC . Equation (C13) is simply the definition of the Bennett, C. H., and G. Brassard (1984), in Proc. IEEE In- conditional entropy as in (C1). To find (C14), we ap- ternational Conference on Computers, Systems and Signal ply the data-processing inequality for the partial isom- Processing 1984, Vol. 1 (IEEE, Bangalore) pp. 175–179. † Berta, M. (2013), Quantum Side Information: Uncertainty etry V as a trace non-increasing map, and note that Relations, Extractors, Channel Simulations, Ph.D. thesis † 1 P z z V ( Z σAB)V = ZAσABZA. Next, (C15) follows ⊗ z (ETH Zurich). by applying the data-processing inequality for the mea- Berta, M., F. G. S. L. Brandao, M. Christandl, and S. Wehner P x x surement cptp map [ ] = x X X . (2013), IEEE Transactions on Information Theory 59 (10), Next we observe thatX · · 6779. Berta, M., M. Christandl, R. Colbeck, J. M. Renes, and X x z 2 x z XA ZA XA trA ZAσAB R. Renner (2010), Nature Physics 6 (9), 659. x,z h | i ⊗ Berta, M., P. J. Coles, and S. Wehner (2014a), Physical Re- X x z 1 view A 90 (6), 062127. c XA trA ZAσAB = c A σB, (C16) ≤ ⊗ ⊗ Berta, M., O. Fawzi, and S. Wehner (2014b), IEEE Transac- x,z tions on Information Theory 60 (2), 1168. x z 2 Bialynicki-Birula, I., and L. Rudnicki (2011), in Statistical where we recall that c = maxx,z XA ZA as defined Complexity, edited by K. Sen (Springer Netherlands, Dor- h | i0 in (32). Moreover, we need that for any σ and positive drecht) pp. 1–34. 0 0 λ such that σ λσ , we have Dα(ρ σ) Dα(ρ σ ) + Białynicki-Birula, I. (1984), Physics Letters A 103 (5), 253. 1 34 ≤ k ≥ k log λ . Continuing from (C15), we thus find that Białynicki-Birula, I. (2006), Physical Review A 74 (5), 10.1103/PhysRevA.74.052101. 1 1 Białynicki-Birula, I. (2007), in AIP Conference Proceedings, Hβ(Z C)ρ min Dα ρXB X σB + log (C17) | ≥ σB ⊗ c Vol. 889 (AIP, Vaxjo) pp. 52–61. 1 Białynicki-Birula, I., and J. L. Madajczyk (1985), Physics = Hα(X B)ρ + log , (C18) − | c Letters A 108 (8), 384. Białynicki-Birula, I., and J. Mycielski (1975), Communica- tions in Mathematical Physics 44 (2), 129. Biham, E., M. Boyer, P. O. Boykin, T. Mor, and V. Roy- 34 For a proof of this property, see (Müller-Lennert et al., 2013, chowdhury (2000), in Proc. ACM STOC 2000 (ACM Press, Prop. 4). New York, NY) pp. 715–724. 61

Biham, E., M. Boyer, P. O. Boykin, T. Mor, and V. Roy- Devetak, I., and A. Winter (2005), Proceedings of the Royal chowdhury (2006), Journal of Cryptology 19 (4), 381. Society A 461 (2053), 207. Boltzmann, L. (1872), in Sitzungsberichte der Akademie der Dey, A., T. Pramanik, and A. S. Majumdar (2013), Physical Wissenschaften zu Wien, Vol. 66, pp. 275–370. Review A 87 (1), 012120. Broadbent, A., and C. Schaffner (2015), “Quan- Dietz, K. (2006), Journal of Physics A: Mathematical and tum Cryptography Beyond Quantum Key Distribution,” Theoretical 39 (6), 1433. arXiv:1510.06120. DiVincenzo, D., M. Horodecki, D. Leung, J. Smolin, and Brukner, Č., and A. Zeilinger (1999), Physical Review Letters B. Terhal (2004), Physical Review Letters 92 (6), 067902. 83 (17), 3354. Dupuis, F., O. Fawzi, and S. Wehner (2015), IEEE Transac- Bruß, D. (1998), Physical Review Letters 81 (14), 3018. tions on Information Theory 61 (2), 1093. Bruzda, W., W. Tadej, and K. Życzkowski (2015), “Complex Dupuis, F., J. Florjanczyk, P. Hayden, and D. Leung (2013), Hadamard Matrices,”. Proceedings of the Royal Society A 469 (2159), 20130289. Buhrman, H., M. Christandl, P. Hayden, H.-K. Lo, and Durt, T., B.-G. Englert, I. Bengtson, and K. Życzkowski S. Wehner (2008), Physical Review A 78 (2), 022316. (2010), International Journal of Quantum Information Buscemi, F., M. J. W. Hall, M. Ozawa, and M. M. Wilde 08 (04), 535. (2014), Physical Review Letters 112 (5), 050401. Dziembowski, S., and U. Maurer (2004), in Proc. EURO- Busch, P., T. Heinonen, and P. Lahti (2007), Physics Reports CRYPT 2004 , LNCS, Vol. 3027 (Springer) pp. 126–137. 452 (6), 155. Eberle, T., V. Händchen, and R. Schnabel (2013), Optics Busch, P., P. Lahti, and R. F. Werner (2013), Physical Re- Express 21 (9), 11546. view Letters 111 (16), 160405. Einstein, A., B. Podolsky, and N. Rosen (1935), Physical Busch, P., P. Lahti, and R. F. Werner (2014a), Review of Review 47 (10), 777. Modern Physics 86 (4), 1261. Ekert, A. K. (1991), Physical Review Letters 67 (6), 661. Busch, P., P. Lahti, and R. F. Werner (2014b), Physical Englert, B.-G. (1996), Physical Review Letters 77 (11), 2154. Review A 89 (1), 012129. Englert, B. G., and J. a. Bergou (2000), Optics Communica- Cachin, C., and U. Maurer (1997), in Proc. CRYPTO 1997 , tions 179 (1), 337. LNCS, Vol. 1294 (Springer) pp. 292–306. Everett, H. (1957), Review of Modern Physics 29 (3), 454. Canetti, R. (2001), in Proc. IEEE FOCS 2001 (IEEE) pp. Fawzi, O., P. Hayden, and P. Sen (2011), in Proc. ACM 136–145. STOC 2011 (ACM Press, New York, NY) pp. 773–782. Cavalcanti, E. G., S. J. Jones, H. M. Wiseman, and M. D. Feng, J., Y.-Z. Zhang, M. D. Gould, and H. Fan (2013), Reid (2009), Physical Review A 80 (3), 032112. Physics Letters B 726 (1-3), 527. Cerf, N., M. Bourennane, A. Karlsson, and N. Gisin (2002), Frank, R. L., and E. H. Lieb (2012), Annals Henri Poincaré Physical Review Letters 88 (12), 127902. 13 (8), 1711. Chen, B., and S.-M. Fei (2015), Quantum Information Pro- Frank, R. L., and E. H. Lieb (2013a), Communications in cessing 14 (6), 2227. Mathematical Physics 323 (2), 487. Choi, M. (1975), Linear Algebra Appl. 10 (3), 285. Frank, R. L., and E. H. Lieb (2013b), Journal of Mathemat- Christandl, M., and A. Winter (2005), IEEE Transactions on ical Physics 54 (12), 122201. Information Theory 51 (9), 3159. Friedland, S., V. Gheorghiu, and G. Gour (2013), Physical Coles, P. J. (2012), Physical Review A 85 (4), 042103. Review Letters 111 (23), 230401. Coles, P. J., R. Colbeck, L. Yu, and M. Zwolak (2012), Phys- Furrer, F., J. Aberg, and R. Renner (2011), Communications ical Review Letters 108 (21), 210405. in Mathematical Physics 306 (1), 165. Coles, P. J., and F. Furrer (2015), Physics Letters A 379 (3), Furrer, F., M. Berta, M. Tomamichel, V. B. Scholz, and 105. M. Christandl (2014), Journal of Mathematical Physics 55, Coles, P. J., J. Kaniewski, and S. Wehner (2014), Nature 122205. Communications 5, 5814. Furrer, F., T. Franz, M. Berta, A. Leverrier, V. B. Scholz, Coles, P. J., and M. Piani (2014a), Physical Review A 89 (1), M. Tomamichel, and R. F. Werner (2012), Physical Review 010302. Letters 109 (10), 100502. Coles, P. J., and M. Piani (2014b), Physical Review A 89 (2), Gavinsky, D., J. Kempe, I. Kerenidis, R. Raz, and R. de Wolf 022112. (2009), SIAM Journal of Computing 38 (5), 1695. Coles, P. J., L. Yu, V. Gheorghiu, and R. Griffiths (2011), Gehring, T., V. Händchen, J. Duhme, F. Furrer, T. Franz, Physical Review A 83 (6), 062338. C. Pacher, R. F. Werner, and R. Schnabel (2015), Nature Cover, T. M., and J. A. Thomas (1991), Elements of Infor- Communications 6, 8795. mation Theory (Wiley). Ghirardi, G., L. Marinatto, and R. Romano (2003), Physics Damgaard, I. B., S. Fehr, R. Renner, L. Salvail, and Letters A 317 (1-2), 32. C. Schaffner (2007), in Proc. CRYPTO 2007 , LNCS, Vol. Gibbs, J. W. (1876), Transactions of the Connecticut 4622 (Springer) pp. 360–378. Academy of Arts and Sciences III, 108. Damgaard, I. B., S. Fehr, L. Salvail, and C. Schaffner (2008), Giovannetti, V., S. Lloyd, and L. Maccone (2011), Nature SIAM Journal of Computing 37 (6), 1865. Photonics 5 (4), 222. Dammeier, L., R. Schwonnek, and R. F. Werner (2015), New Gour, G., V. Narasimhachar, A. Grudka, M. Horodecki, Journal of Physics 17 (9), 093046. W. Klobus, and J. Lodyga (2015), “The Conditional Un- Dankert, C., R. Cleve, J. Emerson, and E. Livine (2009), certainty Principle,” arXiv:1506.07124. Physical Review A 80 (1), 012304. Grudka, A., M. Horodecki, P. Horodecki, R. Horodecki, Deutsch, D. (1983), Physical Review Letters 50 (9), 631. W. Klobus, and L. Pankowski (2013), Physical Review Devetak, I., and A. Winter (2003), Physical Review A 68 (4), A 88 (3), 032106. 042301. Guha, S., P. Hayden, H. Krovi, S. Lloyd, C. Lupo, J. H. 62

Shapiro, M. Takeoka, and M. M. Wilde (2014), Physical ISIT 2005 (IEEE) pp. 1740–1744. Review X 4 (1), 011016. Koashi, M. (2006), Journal of Physics: Conference Series Gühne, O., and G. Tóth (2009), Physics Reports 474 (1-6), 36 (1), 98. 1. König, R., and R. Renner (2011), IEEE Transactions on In- Hall, M. (1995), Physical Review Letters 74 (17), 3307. formation Theory 57 (7), 4760. Hall, M. J. (1993), Journal of Modern Optics 40 (5), 809. König, R., R. Renner, A. Bariska, and U. M. Maurer (2007), Hall, M. J. W. (1994), Physical Review A 49 (1), 42. Physical Review Letters 98 (14), 140502. Hall, M. J. W. (1997), Physical Review A 55 (1), 100. König, R., R. Renner, and C. Schaﬀner (2009), IEEE Trans- Hall, M. J. W. (1999), Physical Review A 59 (4), 2602. actions on Information Theory 55 (9), 4337. Hall, M. J. W. (2004), Physical Review A 69 (5), 052113. König, R., S. Wehner, and J. Wullschleger (2012), IEEE Hall, M. J. W. (2008), Journal of Physics A 41 (25), 255301. Transactions on Information Theory 58 (3), 1962. Hall, M. J. W., D. W. Berry, M. Zwierz, and H. M. Wiseman Korzekwa, K., D. Jennings, and T. Rudolph (2014a), Physical (2012), Physical Review A 85 (4), 041802. Review A 89 (5), 052108. Hall, M. J. W., and H. M. Wiseman (2012), New Journal of Korzekwa, K., M. Lostaglio, D. Jennings, and T. Rudolph Physics 14 (3), 033040. (2014b), Physical Review A 89 (4), 042122. Hasegawa, J., M. Hayashi, T. Hiroshima, and A. Tomita Kraus, K. (1987), Physical Review D 35 (10), 3070. (2007), “Security Analysis of Decoy State Quantum Krishna, M., and K. R. Parthasarathy (2002), Indian Journal Key Distribution Incorporating Finite Statistics,” of Statistics 64 (3), 842. arXiv:0707.3541. Kuznetsova, A. A. (2011), Theory of Probability and its Ap- Hausladen, P., and W. K. Wootters (1994), Journal of Mod- plications 55 (4), 709. ern Optics 41 (12), 2385. Larsen, U. (1990), Journal of Physics A: Mathematical and Hayden, P., D. Leung, P. W. Shor, and A. Winter (2004), Theoretical 23 (7), 1041. Communications in Mathematical Physics 250 (2), 1. Li, C.-F., J.-S. Xu, X.-Y. Xu, K. Li, and G.-C. Guo (2011), Hayden, P., and J. Preskill (2007), Journal of High Energy Nature Physics 7 (10), 752. Physics 2007 (09), 120. Lieb, E. H., and M. B. Ruskai (1973), Journal of Mathemat- Heisenberg, W. (1927), Zeitschrift für Physik 43 (3-4), 172. ical Physics 14 (12), 1938. Hiai, F., and D. Petz (1991), Communications in Mathemat- Lindblad, G. (1975), Communications in Mathematical ical Physics 143 (1), 99. Physics 40 (2), 147. Hirschman, I. I. (1957), American Journal of Mathematics Liu, S., L.-Z. Mu, and H. Fan (2015), Physical Review A 79 (1), 152. 91 (4), 042133. Holevo, A. S. (1973), Problems of Information Transmission Liu, Y.-K. (2014), in Proc. CRYPTO 2014 , LNCS, Vol. 8617, 9 (3), 177. edited by J. A. Garay and R. Gennaro (Springer, Santa Horodecki, M., J. Oppenheim, and A. Winter (2006), Com- Barbara, CA) pp. 19–36. munications in Mathematical Physics 269 (1), 107. Liu, Y.-K. (2015), in Proc. EUROCRYPT 2015 , LNCS, Vol. Horodecki, R., P. Horodecki, M. Horodecki, and K. Horodecki 9057 (Springer) pp. 785–814. (2009), Review of Modern Physics 81 (2), 865. Lo, H.-k. (1997), Physical Review A 56 (2), 1154. Hu, M.-L., and H. Fan (2013), Physical Review A 88 (1), Lo, H.-k., and H. F. Chau (1997), Physical Review Letters 014105. 78 (17), 3410. Huang, Y. (2011), Physical Review A 83 (5), 052124. Luo, S. L. (2005), Theoretical and Mathematical Physics Impagliazzo, R., L. A. Levin, and M. Luby (1989), in Proc. 143 (2), 681. ACM STOC 1989 (ACM Press) pp. 12–24. Maassen, H., and J. Uﬃnk (1988), Physical Review Letters Impagliazzo, R., and D. Zuckerman (1989), in Proc. IEEE 60 (12), 1103. FOCS 1989 , pp. 248–253. Maccone, L., and A. K. Pati (2014), Physical Review Letters Ivanovic, I. D. (1992), Journal of Physics A: Mathematical 113 (26), 260401. and Theoretical 25 (7), L363. Mandayam, P., and S. Wehner (2011), Physical Review A Jaeger, G., A. Shimony, and L. Vaidman (1995), Physical 83 (2), 022329. Review A 51 (1), 54. Mandayam, P., S. Wehner, and N. Balachandran (2010), Jamiołkowski, A. (1972), Reports on Mathematical Physics Journal of Mathematical Physics 51 (8), 082201. 3 (4), 275. Marshall, A. W., I. Olkin, and B. C. Arnold (2011), Inequali- Jia, L., Z. Tian, and J. Jing (2015), Annals of Physics 353, ties: Theory of Majorization and Its Applications, Springer 37. Series in Statistics (Springer, New York). Julsgaard, B., J. Sherson, J. I. Cirac, J. Fiurášek, and E. S. Matthews, W., S. Wehner, and A. Winter (2009), Commu- Polzik (2004), Nature 432 (7016), 482. nications in Mathematical Physics 291 (3), 813. Kalev, A., and G. Gour (2014), New Journal of Physics Maurer, U. M. (1992), Journal of Cryptology 5 (1), 53. 16 (5), 053038. Mayers, D. (1996), in Proc. CRYPTO 1996, LNCS, Vol. 1109 Kaniewski, J., M. Tomamichel, E. Hanggi, and S. Wehner (Springer) pp. 343–357. (2013), IEEE Transactions on Information Theory 59 (7), Mayers, D. (1997), Physical Review Letters 78 (17), 3414. 4687. Mayers, D. (2001), Journal of the ACM 48 (3), 351. Kaniewski, J., M. Tomamichel, and S. Wehner (2014), Phys- Mclnnes, J. (1987), Technical Report, University of Toronto. ical Review A 90 (1), 012332. Miller, C. A., and Y. Shi (2014), in Proc. ACM STOC 2014 , Kennard, E. H. (1927), Zeitschrift für Physik 44 (4-5), 326. pp. 417–426. Kilian, J. (1988), in Proc. ACM STOC 1988 (ACM Press, Modi, K., A. Brodutch, H. Cable, T. Paterek, and V. Vedral New York, NY) pp. 20–31. (2012), Review of Modern Physics 84 (4), 1655. Klappenecker, A., and M. Rotteler (2005), in Proc. IEEE Mosonyi, M., and T. Ogawa (2015), Communications in 63

Mathematical Physics 334 (3), 1617. ifornia Press, Berkeley, California, USA) pp. 547–561. Müller-Lennert, M., F. Dupuis, O. Szehr, S. Fehr, and Ribeiro, J., and F. Grosshans (2015),. M. Tomamichel (2013), Journal of Mathematical Physics del Rio, L., J. Aberg, R. Renner, O. Dahlsten, and V. Vedral 54 (12), 122203. (2011), Nature 474 (7349), 61. Namiki, R., and Y. Tokunaga (2012), Physical Review Let- Robertson, H. P. (1929), Physical Review 34 (1), 163. ters 108 (23), 230503. Romera, E., and M. Calixto (2015), Journal of Physics: Con- Narasimhachar, V., A. Poostindouz, and G. Gour densed Matter 27 (17), 175003. (2015), “The principle behind the Uncertainty Principle,” Rudnicki, L. (2011), Journal of Russian Laser Research arXiv:1505.02223. 32 (4), 393. von Neumann, J. (1932), Mathematische Grundlagen der Rudnicki, L. (2015), Physical Review A 91 (3), 032123. Quantenmechanik (Springer). Rudnicki, L., Z. Puchała, and K. Życzkowski (2014), Physical Ng, N. H. Y., M. Berta, and S. Wehner (2012), Physical Review A 89 (5), 052115. Review A 86 (4), 042315. Rudnicki, L., S. P. Walborn, and F. Toscano (2012), Physical Ohya, M., and D. Petz (1993), Quantum Entropy and Its Use Review A 85 (4), 042115. (Springer). Rumin, M. (2011), Duke Mathematical Journal 160 (3), 567. Ollivier, H., and W. H. Zurek (2001), Physical Review Letters Rumin, M. (2012), Letters in Mathematical Physics 100 (3), 88 (1), 017901. 291. Oppenheim, J., and S. Wehner (2010), Science 330 (6007), Sánches-Ruiz, J. (1998), Physics Letters A 244 (4), 189. 1072. Sánchez, J. (1993), Physics Letters A 173 (3), 233. Ozawa, M. (2003), Physical Review A 67 (4), 042105. Sánchez-Ruiz, J. (1995), Physics Letters A 201 (2-3), 125. Partovi, M. (1983), Physical Review Letters 50 (24), 1883. Scarani, V., H. Bechmann-Pasquinucci, N. Cerf, M. Dusek, Partovi, M. H. (2011), Physical Review A 84 (5), 052117. N. Lütkenhaus, and M. Peev (2009), Review of Modern Pati, A. K., M. M. Wilde, A. R. U. Devi, and A. K. Rajagopal Physics 81 (3), 1301. (2012), Physical Review A 86 (4), 042105. Schaffner, C. (2007), Cryptography in the Bounded-Quantum- Portmann, C., and R. Renner (2014), “Cryptographic Secu- Storage Model, Phd thesis (University of Aarhus). rity of Quantum Key Distribution,” arXiv:1409.3525. Schneeloch, J., C. J. Broadbent, and J. C. Howell (2014), Prevedel, R., D. R. Hamel, R. Colbeck, K. Fisher, and K. J. Physical Review A 90 (6), 062119. Resch (2011), Nature Physics 7 (10), 757. Schneeloch, J., C. J. Broadbent, S. P. Walborn, E. G. Caval- Puchała, Z., L. Rudnicki, K. Chabuda, M. Paraniak, and canti, and J. C. Howell (2013), Physical Review A 87 (6), K. Życzkowski (2015), Physical Review A 92 (3), 032109. 062103. Puchała, Z., L. Rudnicki, and K. Życzkowski (2013), Jour- Schrödinger, E. (1930), Proceedings of the Prussian Academy nal of Physics A: Mathematical and Theoretical 46 (27), of Sciences XIX, 296. 272002. Schumacher, B., and M. A. Nielsen (1996), Physical Review Rastegin, A. E. (2012), Quantum Information and Computa- A 54 (4), 2629. tion 12 (9), 0743. Shannon, C. (1948), Bell System Technical Journal 27, 379. Rastegin, A. E. (2013), European Physics Journal D 67 (12), Shor, P. W., and J. Preskill (2000), Physical Review Letters 269. 85 (2), 441. Rastegin, A. E. (2014), Communications in Theoretical Slepian, D., and H. O. Pollak (1961), Bell System Technical Physics 61 (3), 293. Journal 40 (1), 43. Rastegin, A. E. (2015a), Quantum Information Processing Stinespring, W. F. (1955), Proceedings of the Americal Math- 14 (2), 783. ematical Society 6, 211. Rastegin, A. E. (2015b), Open Systems & Information Dy- Tomamichel, M. (2012), A Framework for Non-Asymptotic namics 22 (01), 1550005. Quantum Information Theory, Ph.D. thesis (ETH Zurich). Ren, L.-H., and H. Fan (2014), Physical Review A 90 (5), Tomamichel, M. (2016), Quantum Information Process- 052110. ing with Finite Resources — Mathematical Foundations, Renes, J., and J.-C. Boileau (2009), Physical Review Letters SpringerBriefs in Mathematical Physics, Vol. 5 (Springer 103 (2), 020402. International Publishing). Renes, J. M., R. Blume-Kohout, A. J. Scott, and C. M. Caves Tomamichel, M., M. Berta, and M. Hayashi (2014), Journal (2004), Journal of Mathematical Physics 45 (6), 2171. of Mathematical Physics 55 (8), 082206. Renes, J. M., and J.-C. Boileau (2008), Physical Review A Tomamichel, M., R. Colbeck, and R. Renner (2009), IEEE 78 (3), 032335. Transactions on Information Theory 55 (12), 5840. Renes, J. M., and V. B. Scholz (2014), “Operationally- Tomamichel, M., R. Colbeck, and R. Renner (2010), IEEE Motivated Uncertainty Relations for Joint Measurability Transactions on Information Theory 56 (9), 4674. and the Error-Disturbance Tradeoff,” arXiv:1402.6711. Tomamichel, M., S. Fehr, J. Kaniewski, and S. Wehner Renes, J. M., D. Sutter, F. Dupuis, and R. Renner (2015), (2013), New Journal of Physics 15 (10), 103002. IEEE Transactions on Information Theory 61 (11), 6395. Tomamichel, M., and E. Hänggi (2013), Journal of Physics Renes, J. M., and M. M. Wilde (2014), IEEE Transactions A: Mathematical and Theoretical 46 (5), 055301. on Information Theory 60 (6), 3090. Tomamichel, M., C. C. W. Lim, N. Gisin, and R. Renner Renner, R. (2005), Security of Quantum Key Distribution, (2012), Nature Communications 3, 634. Ph.D. thesis (ETH Zurich). Tomamichel, M., and R. Renner (2011), Physical Review Renner, R., and R. König (2005), in Proc. TCC 2005 , LNCS, Letters 106 (11), 110506. Vol. 3378 (Cambridge, MA) pp. 407–425. Tsallis, C. (1988), Journal of Statistical Physics 52 (1-2), 479. Rényi, A. (1961), in Proc. 4th Berkeley Symposium on Mathe- Uffink, J. (1990), Measures of Uncertainty and the Uncer- matical Statistics and Probability, Vol. 1 (University of Cal- tainty Principle, Ph.D. thesis (R.U. Utrecht). 64

Uhlmann, A. (1977), Communications in Mathematical 12 (2), 025009. Physics 54 (1), 21. Wehrl, A. (1978), Review of Modern Physics 50 (2), 221. Umegaki, H. (1962), Kodai Math. Sem. Rep. 14, 59. Weyl, H. (1928), Gruppentheorie und Quantenmechanik Unruh, D. (2010), in Proc. EUROCRYPT 2010 , LNCS, Vol. (Hirzel, Leipzig). 6110 (Springer) pp. 486–505. Wilde, M. M., A. Winter, and D. Yang (2014), Communica- Vadhan, S. P. (2012), Pseudorandomness, Foundations and tions in Mathematical Physics 331 (2), 593. Trends in Theoretical Computer Science, Vol. 7 (Now Pub- Winter, A., and D. Yang (2015), “Operational Resource The- lishers). ory of Coherence,” arXiv:1506.07975. Vallone, G., D. G. Marangon, M. Tomasin, and P. Villoresi Wiseman, H. M., S. J. Jones, and A. C. Doherty (2007), (2014), Physical Review A 90 (5), 052327. Physical Review Letters 98 (14), 140402. Ver Steeg, G., and S. Wehner (2009), Quantum Information Wootters, W., and W. H. Zurek (1979), Physical Review D and Computation 9 (9&10), 0801. 19 (2), 473. de Vicente, J., and J. Sánchez-Ruiz (2008), Physical Review Wootters, W. K., and B. D. Fields (1989), Annals of Physics A 77 (4), 042110. 191 (2), 363. Walborn, S. P., A. Salles, R. M. Gomes, F. Toscano, and P. H. Wootters, W. K., and D. M. Sussman (2007), in Proc. QCMC Souto Ribeiro (2011), Physical Review Letters 106 (13), 2007 , p. 269, arXiv:0704.1277. 130402. Wootters, W. K., and W. H. Zurek (1982), Nature Weedbrook, C., S. Pirandola, R. García-Patrón, N. Cerf, 299 (5886), 802. T. Ralph, J. Shapiro, and S. Lloyd (2012), Review of Mod- Wu, S., S. Yu, and K. Molmer (2009), Physical Review A ern Physics 84 (2), 621. 79 (2), 022104. Wehner, S., C. Schaﬀner, and B. M. Terhal (2008), Physical Zozor, S., G. M. Bosyk, and M. Portesi (2014), Journal of Review Letters 100 (22), 220502. Physics A: Mathematical and Theoretical 47 (49), 495302. Wehner, S., and A. Winter (2008), Journal of Mathematical Zurek, W. H. (2003), Review of Modern Physics 75 (3), 715. Physics 49 (6), 062105. Życzkowski, K., and I. Bengtsson (2004), Open Systems & Wehner, S., and A. Winter (2010), New Journal of Physics Information Dynamics 11 (01), 3.