Quantum Fingerprinting Over AWGN Channels With Power-Limited Optical Signals

Quantum fingerprinting reduces communication complexity of determination whether two <inline-formula> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula>-bit long inputs are equal or different in the simultaneous message passing model. Here we quantify the advantage of quantum fingerprinting over classical protocols when communication is carried out using optical signals with limited power and unrestricted bandwidth propagating over additive white Gaussian noise (AWGN) channels with power spectral density (PSD) much less than one photon per unit time and unit bandwidth. We identify a noise parameter whose order of magnitude separates near-noiseless quantum fingerprinting, with signal duration effectively independent of <inline-formula> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula>, from a regime where the impact of AWGN is significant. In the latter case the signal duration is found to scale as <inline-formula> <tex-math notation="LaTeX">$O(\sqrt {n})$ </tex-math></inline-formula>, analogously to classical fingerprinting. However, the dependence of the signal duration on the AWGN PSD is starkly distinct, leading to quantum advantage in the form of a reduced multiplicative factor in <inline-formula> <tex-math notation="LaTeX">$O(\sqrt {n})$ </tex-math></inline-formula> scaling.

which corresponds to a test whether the input strings are equal or different. In order to reduce the amount of information transmitted to the referee, Alice and Bob can send only fingerprints of their inputs at the expense of tolerating a non-zero probability of error.
Classically, the fingerprints have the form of bit strings shorter than inputs. If Alice and Bob do not have access to shared randomness, the fingerprints must be at least O( √ n) bits long for an arbitrarily low probability of error [5], [6], [7]. On the other hand, when quantum states are used to carry fingerprints, it is sufficient that Alice and Bob communicate to the referee O(log 2 n) qubits [8], [9], [10], [11], [12]. Because according to Holevo's theorem [13], [14] a qubit can carry at most one bit of classical information, this presents a scaling advantage over classical fingerprinting. A key ingredient to attain this advantage is joint detection of quantum signals received from Alice and Bob by the referee.
Interestingly, quantum fingerprints can be efficiently generated as trains of coherent states of light with joint detection implemented using optical interference and photon counting [15], [16]. Coherent states are routinely used in conventional optical communication, which facilitated recent experimental proof-of-principle demonstrations of quantum fingerprinting [17], [18].
This naturally leads to a question about the advantage of quantum fingerprinting over its classical counterpart in terms of physical resources required to transmit optical signals carrying fingerprints rather than by the number of bits or qubits that need to be communicated.
This paper presents an analysis of quantum finger-printing when optical signals sent from Alice and Bob to the referee are power-limited, but no restrictions on their bandwidth are in place. Our model includes contribution from background radiation described by additive white gaussian noise (AWGN). Motivated by recent studies of photon-starved communication [19], [20], [21], we consider regime when the noise power spectral density (PSD) ν expressed in photons per unit time per unit bandwidth is much less than one. The principal objective is to minimize the signal duration, which defines the transmission time required to execute the protocol. We show that because the impact of AWGN becomes more severe with increasing signal bandwidth, there exists an optimal operating point that is determined by a combination of the input length n, the noise PSD ν and the desired probability of error ε which is not to be exceeded when executing the protocol.
The obtained results are compared with a scenario when classical fingerprints are transmitted from Alice and Bob to the referee over optical channels with matching signal power and AWGN strength. This allows us to express quantum advantage in terms of reduction of the signal duration. We find that the performance of the quantum fingerprinting protocol changes qualitatively with increasing input size n. When n 2ν −1 log[1/(2ε)], the effects of channel AWGN are insignificant and one remains close to the noiseless regime analyzed in [15]. On the other hand, for sufficiently long inputs, when n 2ν −1 log[1/(2ε)], the transmission time for quantum fingerprints scales as O( √ n), which is the same as in the classical scenario. However, the pro-portionality constant has a starkly distinct dependence on the noise PSD ν. While in the classical scenario the noise PSD enters through a multiplicative factor [log 2 (1+ν −1 )] −1 , which follows directly from the Holevo capacity of an AWGN channel [22], [23], in the case of quantum fingerprinting the dependence is of the form √ ν. This difference becomes substantial for ν many orders below one photon per unit time and unit bandwidth, as is the case e.g. in space optical communication links [24].  Figure 1. Optical layer of the quantum fingerprinting protocol. Alice and Bob use optical transmitters OTx which imprint phase L-tuples θ z = (θ z 1 , . . . , θ z L ) depending on inputs z = x, y onto trains of L light pulses using phase modulators PM. In the course of propagation, individual pulse amplitudes acquire random AWGN components ξ l and ζ l . The optical receiver ORx used by the referee combines the received signals, described by time-dependent fields E x (t) and E y (t), on a balanced 50/50 beam splitter which produces superpositions The output ports of the beam splitter are monitored by photon counting detectors which yield the total photocount numbers k + and k − registered over the signal duration.
that the mode function is orthogonal to its replica displaced by any integer number l of temporal slots: For a modulation bandwidth B, the duration of a single slot is equal to 1/B and the physical time is t = s/B.
Hence the overall duration of each of the signals is L/B. Note that in general the signal spectral support can exceed B [25].
We will assume that the optical receiver used by the referee accepts only temporal modes matching those in the generated signals. Such selectivity can be achieved without any signal loss using the technique of quantum pulse gating [26], [27], [28], [29]. In this case, the optical fields E x (t) and E y (t) received by the referee respectively from Alice and Bob can be described by Individual pulses are phase modulated by Alice and Bob according to L-tuples θ z = (θ z 1 , . . . , θ z L ), z = x, y, that depend on the input strings x and y. The map z → θ z will be specified in Sec. III. The complex amplitudes α x l and α y l in (3) read where S is the optical power, in photons per unit time, of the signal received from either Alice or Bob. Linear attenuation of the signal amplitude in the course of propagation can be taken into account in a straightforward manner by rescaling S. The complex variables ξ l and ζ l describe contributions from AWGN acquired by the signals and will be assumed to have equal variance that specifies noise PSD expressed in photons per unit time per unit bandwidth. Because broadband noise is assumed, its contribution to field amplitudes α z l in (4) is independent of the modulation bandwidth B.
The referee brings the received optical signals to interfere on a balanced 50/50 beam splitter. The fields E + (t) and E − (t) at the two ± output ports of the beam splitter, described by superpositions are subsequently measured by a pair of photon counting detectors that return the total numbers of photocounts k + and k − registered over the entire signal duration. According to the semiclassical theory of photodetection [30], [23], the probability distribution for the pair (k + , k − ) where The analysis will be carried out for ν 1. Further, terms of the order O(νLS/B) and higher will be neglected.
As shown in Appendix A, under these assumptions the characteristic function after averaging over the noise variables can be recast as where is the total number of photocounts generated on both the detectors by the noisy signal coming from one sender, and V = 1 has the physical interpretation of interference visibility.
The characteristic function derived in (10) indicates Poissonian distributions for the photocount numbers k ± with respective means µ(1 ± V): We have written explicitly the conditional dependence of the photocount statistics on the visibility V, as this parameter contains information about the relation between the inputs x and y. The pair of photocount numbers The codewords define via a PSK map phase L-tuples θ x and θ y that feed into optical transmitters OTx. The optical receiver ORx produces a pair of integers k + , k − that serves as the basis for the equality test. In the noiseless case the test has the form of a check whether k − = 0 or not, whereas in the presence of noise a more complex test described in Sec. IV is required.

III. NOISELESS SCENARIO
The optical layer described in the preceding section is used to implement the quantum fingerprinting protocol as shown in Fig. 2. The inputs x and y are mapped onto phase L-tuples θ x and θ y that define modulation of signals generated by Alice and Bob using optical transmitters OTx. Joint detection of these signals with an optical receiver ORx returns a pair of integers (k + , k − ) that is used by the referee to infer the value of the equality function defined in (1).
We will begin with a discussion of a simplified scenario when there is no background noise, ν = 0. In order to gain intuition about the workings of the fingerprinting protocol, suppose for a moment that the binary input strings x and y of length n are used directly to generate optical signals composed of L = n pulses using a binary PSK map. In this setting, the two bit values z l = 0, 1 are mapped onto phases θ z l = πz l , where z stands for x or y and l = 1, . . . , n. For equal inputs, x = y, the two signals are identical, completely destructive interference occurs at the '−' output port of the beam splitter, and E − (t) = 0 over the entire signal duration given absence of background noise. As a result, no photocounts can be registered by the detector monitoring the '−' port and k − = 0. Conversely, registering k − ≥ 1 photocounts heralds unambiguously that the inputs were different, x y, as in this case E − (t) is not identically equal to zero. However, because photon counting is a Poissonian process, it may happen that different strings will not produce any counts on the detector monitoring the '−' port.
According to (13) the probability of such an event is In the worst-case scenario, when the input strings differ at just one location, the visibility calculated according to (12)  and E(y) for which the Hamming distance satisfies Here δ ∈ [0, 1/2[ is a constant specifying the minimum relative Hamming distance between any two different codewords. It will be assumed that the ECC E operates at the asymptotic Gilbert-Varshamov bound given by where is the binary entropy. There exist efficient ECCs operating close to the Gilbert-Varshamov bound, such as the random Toeplitz matrix ECC employed in a recent experimental demonstration of quantum fingerprinting [18].
The codewords E(x) and E(y) are mapped onto Ltuples of phases θ x and θ y that are used to modulate optical signals. We shall take L = m/2 and employ a quadrature PSK map so that an individual phase depends on a block of two consecutive codeword bits according where l = 1, . . . , L = m/2. Compared to binary PSK, quadrature PSK allows for a two-fold reduction of the pulse train length without altering otherwise the performance of the protocol [16]. This would no longer be the case for higher PSK constellations. Calculation of the interference visibility (12) is aided by the following straightforward observation: Assuming absence of noise, one obtains: where in the last step (14) has been used. The probability

IV. HYPOTHESIS TESTING
In the remainder of the paper, the fingerprinting protocol will be required to operate at or below a desired average probability of error ε for the equality test, assuming equiprobable hypotheses of equal and different inputs, and considering for the latter hypothesis the worst-case scenario of the minimum relative Hamming distance δ between the codewords. The objective will be to minimize the overall duration of signals sent by Alice and Bob given by L/B. For a fixed signal power S, the signal duration can be equivalently characterized by the signal optical energy expressed as the mean photon number received from Alice or Bob that is equal to In the noiseless case discussed in the preceding section, assuming unlimited bandwidth and taking δ → 1/2 yields the average probability of error equal to ε = exp(−N Q )/2, which can be recast as: This expression is independent of the input length n In the general scenario with background noise, the visibilities corresponding to hypotheses of equal and different inputs, assuming for the latter the worst-case scenario with the minimum relative Hamming distance δ, are given respectively by The referee needs to decide whether the pair of integers (k + , k − ) produced by the joint detection of optical signals received from Alice and Bob was generated by the probability distribution p e (k + , k − |V e ) or p d (k + , k − |V d ).
We will use the Neyman-Pearson criterion for a priori equiprobable hypotheses, which yields the decision rule x y and a random draw when p(k + , k − |V e ) = p(k + , k − |V d ).
The probability of error for such a test is upper bounded by the Chernoff bound [32] ε where C(V e , V d ; µ) is Chernoff information given by As specified in (13), the joint probability distributions p(k + , k − |V e ) and p(k + , k − |V d ) are products of Poissonian distributions with respective means µ(1 ± V e ) and µ(1 ± V d ). In such a case, Chernoff information is proportional to the total photocount number 2µ, The multiplicative factor C(V e , V d ) can be interpreted as Chernoff information per count and is given by the expression in Appendix B, for V e , V d 1 the Chernoff information per count is well approximated by the expression This simple formula will greatly simplify the analysis of the performance of the quantum fingerprinting protocol in the limit of large input size n.

V. OPTIMIZATION
The task now is to identify the operating point Note that the inverse β −1 specifies the signal-to-noise ratio. The range of the variables is 0 ≤ δ < 1/2 and β > 0.
Transforming the Chernoff bound (21) For a fixed β the expressions on the right hand sides of (27) and (28)  is monotonically increasing in δ as noted in Sec. IV, while the code rate r(δ) in the denominator of (28) is monotonically decreasing in δ. Consequently, if one seeks minimum N Q that satisfies both inequalities (27) and (28), it is sufficient to consider the case when the expressions on the right hand sides of these inequalities are equal to each other. This yields an implicit relation between β and δ in the form βr(δ) where .
The ratio defined in (30)  impact the protocol designed for the noiseless case. In the following we will refer to N as the noise parameter.

Equation (29) provides a relation between β and δ
that can be used to reduce the number of independent optimization variables to one and to find the optimum operating point by minimizing the right hand side of either (27) or (28) over the remaining variable. Fig. 4 depicts numerically found optimal δ * and the corresponding β * as a function of the noise parameter N .
Two operating regimes can be identified depending on the order of magnitude of N . When N 1 it is possible to attain δ * ≈ 1/2 and β * 1. This corresponds to large ECC expansion with the code rate approaching r(δ * ) ≈ 0, as shown in Fig. 4(a). In this regime the minimum photon number N * Q can be conveniently cal-   Fig. 4(b). For N ≤ 10 −1 this factor remains between 1 and 6.6. Thus the fingerprinting protocol requires transmission time that depends primarily on the desired probability of error and the minimum number of signal photons is within one order of magnitude the same as in the noiseless scenario. which corresponds to low signal-to-noise ratio. This allows one to apply the low-visibility approximation of the Chernoff information per count according to (25).
This approximation expressed in presently used variables takes the form: Using the above closed formula in (29) and solving it with respect to β yields β = N δ 2 /r(δ) + 1/4 − 1/2 ≈ N δ 2 /r(δ), where the second approximate expression can be applied when β 1. Inserting the latter expression for β into the right hand side of (28) yields nν/[2 N δ 2 r(δ)] that needs to be optimized over δ.
The product δ 2 r(δ) appearing in the denominator has a single maximum over the interval 0 ≤ δ < 1/2 at the argument whose numerically found value is equal toδ ≈ 0.244. As seen in Fig. 4(a), this value agrees very well with the results of numerical optimization for N 1. Consequently, one can take and express the minimum photon number using the right hand side of (28) as: where the numerical multiplicative factor is given by the inverse of 2δ 2 r(δ) ≈ 0.154.

VI. COMPARISON
The performance of the optimized quantum fingerprinting protocol can be compared directly with a scenario when optical channels are used to transmit classical fingerprints of inputs x and y. Based on results obtained by Babai and Kimmel [7] one can specify a classical protocol that uses fingerprints of length bits each. It is also possible to devise a lower bound on the classical fingerprint length in the form [18] I B = n 2 log 2 It is worth noting that I B retains O( √ n) scaling in the limit ε → 0, which suggests that this bound is not tight.
When the desired probability of error is equal to zero, it should be necessary to transmit entire inputs, leading to a breakdown of O( √ n) scaling. This is the case of I C defined in (35).
The maximum attainable rate R in bits per unit time for transmission of classical information over an AWGN channel, allowing for the most general detection strategies, follows from the Holevo capacity and is given by [22] where is the entropy of a thermal state of a quantized harmonic oscillator with the mean number of excitations equal to x. For a given signal power S and noise PSD ν the information rate is maximized in the limit B → ∞. The first term in (37) can be then expanded around ν up to the first order in S/B. This yields R = Sg (ν), where has the interpretation of photon information efficiency (PIE), which specifies how many bits of information can be encoded in one photon [33], [21].
Consequently, I C and I B defined respectively in (35) and (36) divided by PIE characterize the performance of classical fingerprinting in terms of total photon numbers carried by optical signals sent from Alice and Bob to the referee. Specifically, is sufficient to implement a constructive classical fingerprinting protocol, and defines a lower bound on the total signal photon number required by any classical fingerprinting protocol.  Fig. 5. In this regime the quantum advantage has the form of a reduced multiplicative factor compared to (39) and (40). The principal reason behind this reduction is distinct dependence on the AWGN strength ν: the factor 1/log 2 (1 + ν −1 ), corresponding to the inverse of the PIE, is replaced by √ ν in the quantum case. In the numerical example considered here with ν = 10 −7 the ratio between these two factors exceeds two orders of magnitude and it would grow further for lower ν.

VII. CONCLUSIONS
We have presented a theoretical analysis of a quantum fingerprinting protocol using power-limited optical signals transmitted over AWGN channels with noise strength much less than one photon per unit time and unit bandwidth. Although for large input size no scaling advantage over classical fingerprinting is retained, the Importantly, in this regime both visibilities V e and V d for the optimal bandwidth β * are substantially below one, as implied by Fig. 4. Therefore, their rescaling by W can be included in a straightforward manner in the approximation (32) leading to (34). This produces an additional multiplicative factor W −1 in the expression for N * Q derived in (34). In the present example W −1 ≈ 1.05 which implies that the assumed phase uncertainty does not alter noticeably N * Q in Fig. 5 when N 1.
A practical limitation when implementing the quantum fingerprinting protocol with phase estimation described above is the number of temporal slots that can be accommodated within the coherence time of the generated optical signals. Using state-of-the-art sub-Hz linewidth lasers [35] and phase modulators reaching 100 GHz bandwidth [36] yields the available number of slots up to 10 11 . Given that the required code rate is above 0.1 in the regime N 1, this number of slots should be sufficient to achieve the quantum advantage for the input size n ∼ 10 9 -10 10 and other parameters as in Fig. 5, even when taking into account the overhead required for phase estimation. A more universal strategy, applicable also for longer inputs, is to interleave the fingerprint signal with the reference signal at intervals shorter than the coherence time so that the referee can track the relative phase between the received signals.
In terms of the required optical energy, such phase tracking adds an overhead scaling linearly with the transmission time and hence proportional to N * Q , which retains a constant separation between N * Q and N B for large input size n in the logarithmic scale of Fig. 5. Yet another option to implement the quantum fingerprinting protocol is to exploit higher-order optical interference for signals without a defined phase relation [37], [38].
For this scenario, a preliminary analysis of the quantum advantage in terms of transmitted information has been recently presented [39].
On an ending note, the problem of comparing weak optical signals carrying classical or quantum information occurs in a number of quantum information protocols.
Two relevant classes are quantum digital signatures [40], which provide a secure method to sign a message preventing impersonation, repudiation, or message tampering, and communication complexity protocols based on the so-called quantum switch [41].
Note that linear combinations (ξ l ± ζ l )/ √ 2 are Gaussian random variables with zero mean and variance Var[(ξ l ± ζ l )/ √ 2] = ν. This allows one to calculate directly the expectation value in (9) which yields: The terms in the exponent involving ν produce expressions of the order O(νLS/B) and will be neglected. Sums over l can be written as which is identical with (10) when expressed in terms of µ and V defined respectively in (11) and (12).

APPENDIX B
The argument λ * optimizing the right hand side of (24) can be found by solving equation df /dλ = 0, The solution is given by the following closed expression: For V e , V d 1 the above formula can be approximated up to the second order by Inserting this expression into (46) yields up to the second order in V e , V d : The same result is obtained by using the zeroth order expansion λ * ≈ 1/2 in (46).