Abstract
Demonstrating a quantum advantage with currently available experimental systems is of utmost importance in quantum information science. While this remains elusive for quantum computation, the field of communication complexity offers the possibility to already explore and showcase this advantage for useful tasks. Here, we define such a task, the Sampling Matching problem, which is inspired by the Hidden Matching problem and features an exponential gap between quantum and classical protocols in the oneway communication model. Our problem allows by its conception a photonic implementation based on encoding in the phase of coherent states of light, the use of a fixed size linear optic circuit, and singlephoton detection. This enables us to demonstrate in a proofofprinciple experiment an advantage in the transmitted information resource over the best known classical protocol, something impossible to reach for the original Hidden Matching problem. Our demonstration has implications in quantum verification and cryptographic settings.
Similar content being viewed by others
Introduction
A major objective in quantum information science presently is finding communication and computational tasks for which it is possible to demonstrate in practice that using quantum instead of classical resources leads to superior performance in terms of computational power, security, or communication efficiency. In the quest for such demonstrations for computational tasks^{1}, significant achievements include Boson Sampling^{2,3}, which has been implemented for small sizes^{4,5,6,7}, and sparse commuting (IQP) or random quantum circuits^{8,9,10,11,12,13,14}. Another recent proposal deals with the power of quantum interactive proofs for verifying NPcomplete problems with small proofs^{15,16}.
Concerning communication tasks, there have been several works demonstrating security impossible to achieve by classical means, including quantum key distribution^{17,18} and several other cryptographic primitives in various configurations^{19,20,21,22,23,24}, or involving nonlocal games that rely on the violation of Bell inequalities^{25,26,27}.
In addition to increased security, quantum technologies can also provide an advantage in terms of communication and information resources, such as the amount of information that needs to be transmitted to jointly perform a distributed task between two or more parties who each receive an input, or the total time this takes. Calculating and optimizing the use of such resources is the goal of the field of communication complexity, where protocols typically either minimize the amount of information that needs to be exchanged to solve a problem with certainty, or maximize the probability of solving the problem successfully using a restricted amount of communication. This field has a great range of applications including, for instance, the optimization of very largescale integrated circuits or data structures. It has been shown that quantum resources lead to exponential asymptotic savings compared with classical resources for several protocols^{28,29,30,31,32,33}, including the Hidden Matching protocol^{34} used in our work. The underlying factor that enables this advantage is that while in classical networks such tasks require a very large amount of information exchange, when quantum resources are available it is sufficient for one of the parties to generate, locally manipulate, and send specific states called quantum fingerprints. However, these are highly entangled multiqubit states of large dimension, whose generation is out of reach of experimental photonic technologies currently used in quantum communications.
A significant step in the direction of experimental quantum communication complexity was made by theoretical work proposing a mapping for encoding quantum communication protocols involving pure states of many qubits, unitary operations, and projective measurements to protocols based on coherent states of light in a superposition of optical modes, linear optics operations, and singlephoton detection^{35}. This model was used to propose the practical implementation of coherent state quantum fingerprints for computing the equality function in the simultaneous message passing model of communication complexity^{36}, leading to experiments demonstrating a quantum advantage in the transmitted information in this model^{37,38}. Further work proposed a model involving multiplexed coherent state fingerprints to improve not only the information resource but also the communication resource^{39}. We also remark that a communication complexity advantage in time was claimed to be experimentally shown recently for the quantum switch resource used in indefinite causal structures^{40}.
Here, we define a communication task and experimentally demonstrate a quantum advantage over the bestknown classical protocol in the oneway communication complexity model, where only one party is allowed to send a message to a second one, who outputs a solution to the task—a model particularly suitable for applications in quantum networks. More precisely, based on the Hidden Matching problem introduced in ref. ^{34}, we define the Sampling Matching problem, for which we show that it remains a hard problem for classical oneway communication while there is a quantum protocol that is exponentially more efficient with respect to the transmitted information than any randomized classical protocol with bounded error. We then apply the aforementioned coherent state mapping to Sampling Matching and we show that its implementation in this framework requires a single beam splitter and two detectors, contrary to the original Hidden Matching problem that would require the number of active components to increase at least logarithmically with the input size of the problem. The conception of Sampling Matching was inspired by a passive implementation of the round robin differential phase shift quantum key distribution (RRDPSQKD) protocol^{41,42}, which trades simplicity and stability of the experimental setup with the need for remote phase locking in a fullscale implementation. In our case, exploiting these concepts allows us to use a stateoftheart photonic system involving encoding in the phase of weak coherent states, linear optics, and singlephoton detection, for a proofofprinciple implementation of Sampling Matching, which outperforms the bestknown classical protocol with respect to the transmitted information from threshold input size of around 3000. The simplicity of our experimental demonstration paves the way to the demonstration of a number of useful communication tasks that rely on similar principles.
Results
Sampling matching
We start by defining a oneway communication task that we call Sampling Matching (SM), which is inspired by the Hidden Matching (HM) problem defined in refs. ^{31,34} (see the Methods section for description and analysis of Hidden Matching). We then outline the linear optic circuit necessary for implementing Sampling Matching, which showcases the fact that through this problem we are able to drastically reduce the resources required for demonstrating a quantum advantage in the model of oneway communication complexity.
The Sampling Matching problem is illustrated in Fig. 1. It is a task involving two players, Alice and Bob, and is described as follows. For any positive even integer n, Alice receives as input a string x ∈ {0, 1}^{n}, while Bob does not receive an input. His task is to sample a perfect matching σ_{i} on the complete graph of n vertices (where the vertices are indexed with the numbers {1, 2, …, n} and all edges are present) uniformly at random from a set of n − 1 edgedisjoint perfect matchings \({\cal{M}}_n \in \{ \sigma _1,..,\sigma _{n  1}\}\). A perfect matching here is a list of n/2 pairs of vertices such that no vertex appears twice in the list. A set of edgedisjoint perfect matchings is a set of matchings where each edge (pair of vertices) appears at most once in the set. It is well known that the complete graph of n nodes can be decomposed into a set of n − 1 edgedisjoint perfect matchings. This set is known to both Alice and Bob. An example for n = 4 is shown in Fig. 2. The objective of the problem is for Bob to output any matching \(\sigma _i \in {\cal{M}}_n\) and the parity x_{k} ⊕ x_{l} (where x_{k}, x_{l} are the kth and lth bit of x, respectively) for some pair (k, l) that belongs to the matching σ_{i}, with the constraint that the distribution of the matchings is uniform in \({\cal{M}}_n\) even conditioned on the message m(x) sent from Alice, i.e., \({\Bbb P}(\sigma _im(x)) = \frac{1}{{{\cal{M}}_n}}\), \(\forall \sigma _i \in {\cal{M}}_n\). This constraint of uniform matching output conditioned on Alice’s message is important because otherwise Alice and Bob can trivially solve the problem by sharing a public random coin which determines the matching, and then Alice sends the parity of an edge for that specific matching to Bob. This would solve the problem with O(1) transmitted information and thus becomes easy classically. Since we are in a communication complexity model, we expect Alice and Bob to be honest and perform the task according to the protocol.
It is also important to note that in our oneway model the communication cost of a protocol is the number of bits Alice has to send to Bob in order to solve the problem, while the transmitted information, instead of the number of bits sent, calculates the real bits of information about the inputs that the messages carry. For example, if Alice always sends the same, long message, independent of her input, then the communication cost will be large, while the transmitted information will be zero, since no information about her input has been transmitted. Transmitted information is a resource that is important for privacy, when on top of having an efficient protocol, we want the players to solve the task without learning much about the other player's input. One can define the transmitted information as the mutual information between the messages and the inputs and can upper bound it with the logarithm of the number of different messages. The transmitted information is always at most the communication cost, since one bit carries at most one bit of information, and hence the bottleneck is always the time. Last, we remark that we define our problem in the randomized setting where Bob is allowed to use random coins and output the correct value with high probability.
Let us now analyse the Sampling Matching problem in detail and show that there is an exponential gap between the classical and quantum transmitted information resource, as it is the case for the Hidden Matching problem as well. The two problems are in fact classically equivalent in their complexity. Indeed, it is relatively straightforward to see that Sampling Matching, which is effectively a sampling problem where Bob uniformly samples a matching from a set \({\cal{M}}_n\) and then uses Alice’s message to find the parity of an edge in the matching, and Hidden Matching, where Bob a priori receives a uniformly random matching from the set as input, are effectively equivalent with respect to their complexity.

SM → HM: Imagine there exists a protocol for Sampling Matching, meaning Alice sends a message m and Bob samples uniformly a matching σ_{i} from all matchings and uses m to output a parity of an edge in σ_{i}. Then, Bob uses the same protocol until the output of his sampling is the matching that he has received as input, in which case he computes the parity and outputs as in the Sampling Matching protocol. The error in HM is the same as in SM.

HM → SM: Imagine there exists a protocol for Hidden Matching. Then, to solve Sampling Matching, Bob first samples a matching uniformly at random, and then Alice and Bob use the protocol for HM and output accordingly. The error is the same.
The classical complexity bound for Sampling Matching is \(\Omega (\sqrt n )\) and is the same as the one for the Hidden Matching problem (see the Methods section for details). More specifically, in order for Bob to succeed with an error probability p_{error}, we must have for the size of Alice’s message that
This bound was proven to be tight by describing a randomized oneway protocol using the birthday paradox argument to show that only \({\cal{O}}(\sqrt n )\) classical bits are sufficient to solve the problem. In particular, for \(p_{{\mathrm{error}}} \le 0.1\), the communication message size for the bestknown classical protocol is \(c \ge \sqrt {2{\mathrm{log}}_e10} \sqrt n\). This bound as well as the lower bound of Eq. (1) will be used later in the performance analysis of our scheme.
When quantum resources are available, the task can be solved by transmitting an exponentially smaller number of qubits, similarly to Hidden Matching (see the Methods section for details). Alice encodes her nbit input x into the state
where x_{k} is the kth bit of the string x, and sends it to Bob. This state x〉 is referred to as the fingerprint of the input x. Bob uniformly picks a matching \(\sigma _i \in {\cal{M}}_n\) and then measures the state x〉 in the basis \(\left\{ {\frac{1}{{\sqrt 2 }}\left( {\left k \right\rangle } \right. \pm \left l \right\rangle } \right\}\), with (k, l) ∈ σ_{i} to output the pair 〈(k, l), b = x_{k} ⊕ x_{l}〉 with certainty. This is because the measurement outcome \(\frac{1}{{\sqrt 2 }}(k\rangle + l\rangle )\) occurs if and only if x_{k} ⊕ x_{l} = 0, whereas \(\frac{1}{{\sqrt 2 }}(k\rangle  l\rangle )\) occurs if and only if x_{i} ⊕ x_{j} = 1. This protocol uses only log_{2}n qubits, and hence both the communication and the transmitted information are exponentially better than in the classical case, where both resources must be at least \(\Omega (\sqrt n )\).
The physical implementation of the qubit protocol is extremely challenging due to the high dimensionality of the fingerprint states required to show a quantum advantage, which means that highly entangled states of many qubits need to be generated and maintained during the entire run of the protocol. Applying the coherent state mapping proposed by Arrazola and Lütkenhaus^{35}, it is possible to describe an alternative quantum protocol based on coherent state fingerprints^{36} as follows. Alice prepares the message α_{x}〉, by applying the displacement operator \(\hat D_x(\alpha ) = {\mathrm{exp}}\,(\alpha \hat a_x^\dagger  \alpha ^ \ast \hat a_x)\) to the vacuum state, where \(\hat a_x = \frac{1}{{\sqrt n }}\mathop {\sum}\nolimits_{k = 1}^n (  1)^{x_k + \phi }\hat a_k\) is the annihilation operator of the entire coherent state mode, and \(\hat a_k\) is the photon annihilation operator of the kth time mode; she also adds an additional constant factor of ϕ ∈ {0, 1} chosen uniformly randomly. Hence,
where \(\left{(  1)^{x_k \oplus \phi }\frac{\alpha }{{\sqrt n }}} \right\rangle_k\) is a coherent state with amplitude \(\frac{\alpha }{{\sqrt n }}\) occupying the kth time mode. Here, α_{x}〉 is the fingerprint for input x, and can be thought of as a sequence of n coherent pulses with the total mean photon number over the sequence being \(\mu = \mathop {\sum}\nolimits_k \frac{\alpha }{{\sqrt n }}^2 = \alpha ^2\), which is independent of the input size.
Note that this protocol takes time n, since we have a sequence of n time modes, and thus loses any advantage compared with the classical protocol in terms of communication time. Nevertheless, the information transmitted by this protocol remains only logarithmic, which is exponentially better that the classical protocol that requires \(O(\sqrt n )\) bits of information.
Let us now see how Alice and Bob could implement this protocol in practice. An illustration for any n is shown in Fig. 3. Alice sends the state α_{x}〉 as described above, and Bob generates locally a sequence of n coherent pulses \(\left \beta \right\rangle = \mathop { \otimes }\nolimits_{i = 1}^n \left {\frac{\alpha }{{\sqrt n }}} \right\rangle _i\), interferes them sequentially in a balanced beam splitter with the corresponding pulses from Alice, and observes the clicks on the singlephoton detectors that we name D_{0} and D_{1}.
In the ideal setting, the state in the incoming modes of the beam splitter at the kth time slot is,
and the output state is,
From this equation, we see that D_{0} clicks only if x_{k} ⊕ ϕ = 0, while D_{1} clicks only if x_{k} ⊕ ϕ = 1. Now suppose Bob gets the clicks at kth and lth time slots in detectors D_{0} and D_{1}, respectively. This implies x_{k} ⊕ ϕ = 0, while x_{l} ⊕ ϕ = 1. Combining them results in x_{k} ⊕ x_{l} = 1 since 2ϕ ≡ 0 (mod 2). Therefore, Bob successfully outputs the pair 〈(k, l)∈σ_{i}, b = x_{k} ⊕ x_{l}〉 for the matching (k, l)∈σ_{i}. This protocol only lets Bob obtain the parity information of the bits and not the bit values x_{k},x_{l} because of the hiding factor ϕ.
The cases where Bob can make an error in inferring the correct parity value of any matching are as follows. (i) Bob does not observe any single click over the entire run of the experiment. The probability of this happening is p_{¬1} = exp(−2α^{2}). Bob’s error probability in this case is \(\frac{1}{2}p_{\neg 1}\). (ii) Bob observes exactly one single click over the entire run of the experiment. Since the parity of a pair is inferred from the clicks at two distinct time slots, in this case Bob does not infer any parity outcome with certainty. The probability of exactly one single click happening is,
where \(p_c = 1  {\mathrm{exp}}\left( {  2\frac{{\alpha ^2}}{n}} \right)\) is the probability of getting a click in one time slot. Bob’s error probability in this event would be \(\frac{1}{2}p_1\). Combining the two cases, Bob’s error probability is,
In a practical setting, we need to take into account three main sources of error: (i) the transmission and detection loss characterized by the efficiency parameters η_{channel} and η_{det}, respectively; modeling the detection loss with a beam splitter followed by perfect detection allows us to lump these two loss factors into a single parameter \(0 \le \eta \le 1\); (ii) the limited interference visibility \(0 \le \nu \le 1\); and (iii) the detector dark counts characterized by the probability p_{dark}. As we will justify in the following, in our experimental conditions the dark count probability is negligible compared to the expected signal count probability, therefore we do not consider the effect of dark counts in our analysis. Considering experimental imperfections (η, ν), the incoming state at the kth time slot becomes,
and the output state is now written as,
We see that due to the limited visibility there is a nonzero click probability for the wrong detector in a given time slot. From Eq. (9), we find that the probability of a click in the correct detector at each time slot is,
while the probability that a click occurs in the wrong detector is,
Now we look at the cases where Bob can output the incorrect parity outcome: (i) He does not observe at least two single clicks in the time slots during the experiment. The probability \({\Bbb P}\)(less than two single clicks) = \({\Bbb P}\)(no single clicks) + \({\Bbb P}\)(exactly one single click),
where p_{1} = p_{c}(1 − p_{w}) + p_{w}(1 − p_{c}) is the probability of observing a single click in one time slot. Bob’s error probability in this case is \(\frac{1}{2}p_{\neg 11}\). (ii) Bob observes at least two single clicks in the time slots. He then randomly chooses any two of those singleclick slots (k, l) to output the parity for pair (k, l) ∈ σ_{i}. The probability that he outputs the wrong parity value is,
Combining these two cases, Bob’s total error probability is,
The quantum protocol with coherent state fingerprints for Sampling Matching that we introduced above has a complexity of \({\cal{O}}(\alpha ^2{\mathrm{log}}_2n)\) for the transmitted information, where μ = α^{2} is the total mean photon number in the coherent fingerprint of Alice and is independent of n. Note that our protocol offers an exponential advantage for the information resource, but not for the communication resource which is n. This is the same as in previous works on protocols with coherent states^{35}.
In order to illustrate the performance of this protocol for Sampling Matching with respect to the classical bounds and examine the possibility of demonstrating a quantum advantage in practice, we compare the transmitted information resource for the quantum protocols with coherent states for a given error probability p_{error}. The results are shown in Fig. 4a for p_{error} = 0.1 for the bestknown classical protocol and for the coherent state protocol in the ideal and practical settings, where in the latter case we have considered the experimental parameters of Table 1. In both cases, we have found the optimal α^{2} for our fixed p_{error} value. We have also included in the graph the classical lower bound described previously and we have additionally considered the case where Bob only outputs the parity outcome when he he obtains at least two single clicks in the experimental run, which we call the postselected protocol.
We remark that although the ideal protocol can outperform the best classical protocol for relatively low input size, in the realistic case this can happen for n ~3000. We also observe that the postselected case diminishes slightly this threshold and that beating the classical lower bound requires a very large input size. These threshold input sizes are similar to Hidden Matching (see the Methods section for details). However, although reaching such values would be a formidable challenge for Hidden Matching, Sampling Matching allows by its conception to reach the threshold for the best classical protocol in practice, as we will see below.
Experimental implementation
The experimental setup realizing in practice the schematic illustration of Fig. 3 and that we use for our proofofprinciple implementation of the Sampling Matching problem is shown in Fig. 5.
The coherent light is generated using a low linewidth (~10 kHz) continuous wave laser source operating at telecommunication wavelength (Laser1, Pure Photonics, λ = 1563 nm). An amplitude modulator (AM) is then used to produce a sequence of coherent pulses with a 1MHz repetition rate and pulse duration of 16 ns. A balanced 50:50 beam splitter (BS1) is used to monitor the power of the laser pulse, and we use a variable optical attenuator (VOA) to attenuate the pulses to the desired mean photon number. A second 50:50 beam splitter (BS2) splits the coherent pulses in two paths, sent to Alice and Bob. We introduce a delay line (DL, Kylia) to fine tune the path lengths of Alice and Bob, hence ensuring that their pulses arrive simultaneously at the 50:50 beam splitter BS3 and interfere optimally. Before this, Alice and Bob modulate their pulses, each using a phase modulator (PM). These are driven by a data acquisition card that provides the desired voltage levels, which is fixed for Bob and corresponding to her input x ∈ {0, 1}^{n} for Alice. After interfering, the pulses are detected by telecom wavelength, free running InGaAs singlephoton detectors D_{0} and D_{1} (ID230, IDQuantique). The detection events are recorded and analyzed with a precision of 1 ps using a time tagger (quTAG, QuTools).
The remaining components in the experimental setup are used for the phasecorrection loop that we use to monitor and correct the phase drift between Alice’s and Bob’s pulses. More specifically, we introduce a second continuous wave laser source (Laser2, Pure Photonics, λ = 1527 nm) that is modulated similarly as described before. The pulses are directed through a circulator (C2) to BS3, where they are separated and then interfere on BS2 before being detected using a photodiode (PD). A second circulator (C1) prevents any of this light to go into the direction of Laser1. Furthermore, an optical filter (OF) is used in the path leading to detector D_{0} to ensure that only light from Laser1 (λ = 1563 nm) reaches the detector. The difference in the length of the paths leading to D_{0} and D_{1} due to the presence of these components is appropriately compensated using a fiber before detector D_{1}. To correct the phase drift, we use an averaging technique that estimates the phase drift over a block of pulses and corrects accordingly the phase in the next block (see the Methods section for details).
We are now ready to analyze the performance of our experiment for Sampling Matching. The relevant experimental parameters that have also been used for the simulations are shown in Table 1. The channel transmission loss, i.e., the loss from when Alice and Bob apply their phase modulation to the input of detectors D_{0} and D_{1} is 3.5 dB, hence η_{channel} ≈ 45%. Furthermore, our singlephoton detectors feature a quantum efficiency η_{det} ≈ 25%. The effect of these losses is that it is necessary to increase the mean photon number in the coherent fingerprint state compared with the ideal setting, in order to achieve the desired error rate p_{error}.
The limited visibility, ν, is due to the imperfect interference of Alice and Bob’s pulses. It is important to remark that in our proofofprinciple implementation, we use a single laser for generating the pulses that Alice and Bob need to prepare their states, which is important for improving the visibility. However, the preparation of these states and all subsequent steps are done independently following the protocol, hence enabling us to use this setup for assessing the quantum advantage. As noted before, to achieve a high visibility, we also fine tune the delay line in the setup by following a simple calibration procedure whereby we send first sequences of 0 inputs to both Alice and Bob and then sequences of 0 and 1 inputs to Alice and Bob, respectively, and observe the resulting detector clicks.
Finally, we further investigate the dark counts to make sure it is safe to neglect them in our analysis and indeed we observe that the signal click probability is substantially (three orders of magnitude) larger than the dark count probability. We also note that our detectors feature a dead time of 10 μs, which means that after a detection event, the detector becomes idle for the next 10 pulses. For the input size targeted in our work (≥1000), the probability of a click within these pulses is extremely low due to the extremely low photon number of pulse that we use. This effect can therefore be safely neglected.
Based on these experimental parameters obtained in our setup, we estimate the optimal mean photon number μ for the entire coherent fingerprint state that achieves the desired error rate p_{error} = 0.1, and hence the mean photon number per pulse, μ_{p}, for input size n around the threshold regions observed in Fig. 4, in particular from 1000 to 4000. These values are summarized in Table 2. In Fig. 4a, b, we show the experimentally obtained results for the transmitted information based on the above analysis. We see that for input size above 3000, our experiment for Sampling Matching provides an advantage in information compared to the best classical protocol, even within the error bars.
Furthermore, we also consider the case when Bob runs the Sampling Matching protocol multiple times (#Runs in Table 2) and gives an output only for those runs where he gets a parity outcome. Without this post selection, every time Bob would not obtain the parity outcome, he would output a random parity with error rate 1/2. However, with post selection, since he rejects those noparity outcome cases, he can succeed with a lower error rate \(p_{{\mathrm{error}}}^{{\mathrm{POST}}}\). This can also be interpreted as performing the protocol with lower mean photon number,
The corresponding experimental values are provided in Table 2. In Fig. 4, we also plot the experimental results for the transmitted information in the postselected scenario. We observe that the quantum protocol performs the Sampling Matching task with lower resources than the best classical protocol from input size of 2000 and above, hence demonstrating a quantum advantage in this case as well.
Discussion
The results that we have presented demonstrate rigorously a quantum advantage in the information resource in the oneway model of communication complexity. We achieved this by introducing the Sampling Matching problem, which is inspired by the emblematic Hidden Matching problem, and by analyzing it using the recently formulated coherent state mapping for quantum communication protocols. These two advancements enabled us to bypass the great challenge associated to the implementation of such tasks with the usual high dimensional multiqubit fingerprint states.
As we have noted, an essential element of our proofofprinciple implementation is the ability to achieve high interference visibility, which has been facilitated in our case by the use of a single laser for generating the coherent states used by Alice and Bob for their sequences and the fine tuning of the path length difference using a delay line. In a fullscale implementation, where two separate lasers would be used, maintaining a good interference would require the use of stable, ultra narrow linewidth lasers such that the phase difference between the pulses would be slower than the duration of the experimental run^{43}. In combination with phasecorrection techniques like the one used in our experiment, such an experiment is foreseeable in the near future and would be useful more generally for quantum communication tasks.
We also remark that our experimental results allow outperforming the bestknown classical protocol but not the classical lower bound. For this, we need an input size on the order of ~10^{6}, which in turn would require attenuating the coherent pulses to a mean photon number per pulse of the same order. In this case, the dark counts of the singlephoton detectors cannot be neglected any longer; indeed, the dark count rate exhibited by the detectors used in our experiment is precisely of this order, and therefore it is impossible to show an advantage due to the noise. However, this would become possible using ultra low dark count superconducting nanowire singlephoton detectors^{44}, which also feature good quantum efficiencies and are commercially available.
The Sampling Matching problem that we have defined can also be seen as a verification tool, with applications in cryptographic and computational settings, most notably quantum money schemes, where it can replace the verification techniques that use Hidden Matching^{45,46}. The soundness of verification in these schemes depends on the size of the input, hence since Sampling Matching allows for a simple implementation for large input sizes, our approach may readily increase the robustness of these schemes.
Methods
Hidden matching
The intuition behind introducing the Sampling Matching problem was the Hidden Matching problem. Here, we describe this problem as defined in refs ^{31,34} and provide a possible linear optic implementation, which as we will see is out of reach for current experimental technology.
The Hidden Matching problem is illustrated in Fig. 6. Here, for any positive even integer n, Alice receives as input a string x ∈ {0, 1}^{n} while Bob receives a perfect matching σ_{i} on the complete graph of n vertices uniformly at random from a set of n − 1 edgedisjoint perfect matchings \({\cal{M}}_n \in \{ \sigma _1,..,\sigma _{n  1}\}\). The objective of the problem is for Bob to output any one of the n/2 possible parity values x_{k} ⊕ x_{l} for some pair (k, l) that belongs to the matching σ_{i} with minimum communication and information cost. It is important to note that we look at the oneway communication model for this problem, otherwise it is easy to see that the task can be done with logarithmic communication, since Bob can send to Alice the indices (k, l) and Alice will reply with the parity. Furthermore, as for Sampling Matching, we analyse this problem in the randomized setting where Bob is allowed to use random coins and output the correct value with high probability.
BarYossef et al.^{34} and later Buhrman et al.^{47} showed that the best classical protocol for Hidden Matching must have communication and transmitted information of at least \(\Omega (\sqrt n )\). The detailed proofs can be found in refs. ^{34,47} but we provide here a highlevel description. The main idea is that Alice’s message should allow Bob to output the parity of an edge from each one of the possible matchings, in other words for O(n) different edges, since there are O(n) edgedisjoint matchings in the set. No matter which \(\Omega (\sqrt n )\) edges one picks on a complete graph of n nodes, they will always contain at least \(\Omega (\sqrt n )\) different vertices corresponding to different bits of the input x, and hence Alice must send at least \(\Omega (\sqrt n )\) bits of information about these bits if Bob is to be able to solve the problem and hence also \(\Omega (\sqrt n )\) communication (since communication is always at least as much as the information). The proof structure for computing the lower bound is as follows^{47}: if Alice’s message to Bob is small, let’s say c bits, then the set of inputs x ∈ {0, 1}^{n} for which Alice sends a particular message m will be large (typically of the order of 2^{n−c}). This would mean that Bob will have very little knowledge for most of the bits of x. Using techniques from ref. ^{48} this implies that Bob would not be able to correctly answer the parity x_{k} ⊕ x_{l} for most of the \(\left( {\begin{array}{*{20}{c}} n \\ 2 \end{array}} \right)\) possible pairs (k, l). Even though Bob has some relaxation in the sense that he can output the parity outcome of any one of the n/2 pairs of σ_{i}, still it turns out that on average it is hard for him to output the correct parity outcome. Using this idea, it was shown in^{47} that in order for Bob to succeed with an error probability p_{error}, we must have for the size of Alice’s message that
BarYossef et al. also proved that this bound is tight by describing a randomized oneway protocol using the birthday paradox argument to show that only \({\cal{O}}(\sqrt n )\) classical bits are sufficient to solve the problem. The proof structure is as follows: Note that Bob’s matching belongs to the set \({\cal{M}}_n\) of n − 1 edgedisjoint perfect matchings. Since Alice has no information about which matching Bob has received, to maximize the probability of success she encodes her message to contain the parity information of at least one pair from each matching with high probability. Suppose she does this by sending c random bits of the input x or equivalently c(c − 1)/2 pairs to Bob. Each perfect matching σ_{i} that Bob would receive has n/2 pairs. Thus the matching set \({\cal{M}}_n\) has in total n(n − 1)/2 distinct pairs, since each edge appears only once. The probability that none of the pairs that Alice sends to Bob is in the matching σ_{i} received by Bob is,
For \(p_{{\mathrm{error}}} \le 0.1\), the communication message size for the bestknown classical protocol is therefore \(c \ge \sqrt {2{\mathrm{log}}_e10} \sqrt n\). These bounds are the same for Sampling Matching as explained previously.
Using quantum resources, the above task can be solved by transmitting an exponentially smaller number of qubits^{34}. Alice encodes her input x into the fingerprint state, \(\left x \right\rangle = \frac{1}{{\sqrt n }}\mathop {\sum}\nolimits_{k = 1}^n (  1)^{x_k}\left k \right\rangle\), where x_{k} is the kth bit of the string x, and sends it to Bob. For any matching \(\sigma _i \in {\cal{M}}\) that Bob has as input, there exists a measurement by Bob which allows him to give the correct answer with certainty. To do so, he just measures the quantum state in the basis \(\left\{ {\frac{1}{{\sqrt 2 }}\left( {\left k \right\rangle } \right. \pm \left l \right\rangle } \right\}\), ∀(k, l) ∈ σ_{i}. The outcome \(\frac{1}{{\sqrt 2 }}(k\rangle + l\rangle )\) occurs if and only if x_{k} ⊕ x_{l} = 0 whereas \(\frac{1}{{\sqrt 2 }}(k\rangle  l\rangle )\) occurs if and only if x_{i} ⊕ x_{j} = 1. Thus Bob gets the parity result of one of the pairs (k, l) ∈ σ_{i} with certainty. This protocol uses only log_{2}n qubits, and hence both the communication and the transmitted information are exponentially better than in the classical case.
As we did for Sampling Matching, let us now analyze the physical implementation of the Hidden Matching problem under the coherent state framework of refs. ^{35,36}. In this framework, Alice prepares the coherent state fingerprint as a sequence of n coherent pulses whose phase corresponds to her input x ∈ {0, 1}^{n}, hence,
where μ = α^{2} is the mean photon number for the state α_{x}〉, which is independent of the input size n. As shown in Fig. 7, which illustrates how this scheme could be implemented in practice for n = 4, upon receiving the state α_{x}〉 from Alice, Bob rearranges the input modes of α_{x}〉 according to the pairs (k, l) ∈ σ_{i} using a number of switches and delay lines, interferes all the pairs in σ_{i} sequentially in a balanced beam splitter, and observes the clicks recorded by singlephoton detectors D_{0} and D_{1}.
In the ideal setting, the state in the incoming modes at the beam splitter for pairs (k, l) is,
and following the standard beam splitting transformations the state at the output modes is,
From the above equation, we see that D_{0} clicks only if x_{k} ⊕ x_{l} = 0, and D_{1} clicks otherwise. Now if Bob gets clicks at multiple time slots, he picks arbitrarily one of these time slots and outputs the pair 〈(k, l) ∈ σ_{i}, b = x_{k} ⊕ x_{l}〉 depending on which detector clicked. The only way he can output an incorrect parity value is if he does not observe any click during the entire run of the protocol, which happens with probability p_{0} = exp(−α^{2}), in which case he outputs a random choice. Thus his error probability is \(p_{{\mathrm{error}}} = \frac{1}{2}p_0\).
In a practical setting, and following the same model for experimental imperfections as for Sampling Matching, the incoming state becomes,
and the output state is now written as,
From the above equation, we see that the probability that there is a click in the correct detector is,
while the probability that the wrong detector clicks is,
Let us now consider the cases where Bob can output an incorrect parity value outcome. (i) He does not observe any single click over the entire run of the experiment. The probability of this happening is p_{¬1} = (1 − p_{1})^{n/2}, where p_{1} = p_{c}(1 − p_{w}) + p_{w}(1 − p_{c}) is the probability of observing a single click in one time slot. In this case, he outputs a random parity value. (ii) Bob observes at least one single click within all time slots. He then randomly chooses any one of those to output the parity value. The probability that he outputs the wrong parity value is \(p_{1w} = \frac{{p_w(1 \, \, p_c)}}{{p_w(1 \,  \, p_c) + p_c(1 \,  \, p_w)}}\). From these two cases, we find that Bob’s error probability is,
The quantum protocol with coherent state fingerprints for Hidden Matching that we have described and analyzed has a complexity of \({\cal{O}}(\alpha ^2{\mathrm{log}}_2n)\) for the transmitted information, where μ = α^{2} is the total mean photon number in the coherent state. Note again that the exponential advantage concerns the information, but not the communication resource. As for Sampling Matching, for a fixed error probability p_{error} = 0.1, we calculate the optimal α^{2} and the transmitted information for the quantum protocols with coherent states for the ideal, practical and postselected cases. The latter here refers to the case where Bob only outputs the parity outcome when he observes at least one click in the protocol run. The results are shown in Fig. 8, where we have also included the bounds for the best classical protocol and the classical lower bound. The same remarks on the threshold input sizes as in Sampling Matching hold. Reaching these thresholds with the setup of Fig. 7 is currently beyond experimental reach. This motivates the definition of the Sampling Matching problem.
Phasecorrection procedure
For our experiments for Sampling Matching, we have applied an averaging technique over blocks of pulses to correct for the phase drift occurring between Alice’s and Bob’s pulse sequences. Such an averaging corresponds well to our conditions, with the relatively high 1MHz repetition rate of our experiment and the high stability of our setup. We make blocks of pulses and track the average of the phase drift in one block to use it to correct the drift of the subsequent block. The block construction we use is detailed in Fig. 9. We choose a block size of 8192 pulses. The first 7680 pulses are used for protocol run. The second segment of the block, Alice_{track}, tracks the phase drift in the path corresponding to Alice’s PM. This is done by providing a ramp voltage in Alice’s PM from −5V to +5 V, and 0 V in Bob’s PM across 256 pulses. The response of the linear ramp voltage across a phase modulator is a cosine function Acos(ωt + ϕ), which is tracked using the photodiode PD. We then model the expected response corresponding to the actual response, hence obtaining the information on the phase and the phase drift up to a certain error. If V_{bias} is the voltage corresponding to the phase drift, then we add this factor to the voltage provided to Alice’s PM for the next block, i.e., \(V_{{\mathrm{PM}}} = V_{x_i} + V_{{\mathrm{bias}}}\). We similarly track and correct the phase drift in Bob’s PM over the last 256 pulses of the block, Bob_{track}.
Data availability
All relevant data are available from the authors upon request.
Code availability
All relevant code is available from the authors upon request.
References
Harrow, A. W. & Montanaro, A. Quantum computational supremacy. Nature 549, 203 (2017).
Aaronson, S. & Arkhipov, A. The computational complexity of linear optics. In Proceedings of the 43rd Annual ACM Symposium on Theory of Computing, 333–342 (ACM, San Jose, California, USA, 2011).
Neville, A. et al. Classical boson sampling algorithms with superior performance to nearterm experiments. Nat. Phys. 13, 1153 (2017).
Broome, M. A. et al. Photonic boson sampling in a tunable circuit. Science 339, 794–798 (2013).
Tillmann, M. et al. Experimental boson sampling. Nat. Photon. 7, 540–544 (2013).
Crespi, A. et al. Integrated multimode interferometers with arbitrary designs for photonic boson sampling. Nat. Photon. 7, 545–549 (2013).
Spagnolo, N. et al. Experimental validation of photonic boson sampling. Nat. Photon. 8, 615–620 (2014).
Farhi, E. & Harrow, A. W. Quantum supremacy through the quantum approximate optimization algorithm. Preprint at: http://arxiv.org/abs/1602.07674 (2016).
Bremner, M. J., Montanaro, A. & Shepherd, D. J. Achieving quantum supremacy with sparse and noisy commuting quantum computations. Quantum 1, 8 (2017).
Bravyi, S., Gosset, D. & Koenig, R. Quantum advantage with shallow circuits. Preprint at: http://arXiv.org/abs/1704.00690 (2017).
Gao, X., Wang, S.T. & Duan, L.M. Quantum supremacy for simulating a translationinvariant ising spin model. Phys. Rev. Lett. 118, 040502 (2017).
BermejoVega, J., Hangleiter, D., Schwarz, M., Raussendorf, R. & Eisert, J. Architectures for quantum simulation showing a quantum speedup. Phys. Rev. X 8, 021010 (2018).
Aaronson, S. & Chen, L. Complexitytheoretic foundations of quantum supremacy experiments. Preprint at: http://arXiv.org/abs/1612.05903 (2016).
Boixo, S. et al. Characterizing quantum supremacy in nearterm devices. Nat. Phys. 14, 595 (2018).
Aaronson, S., Beigi, S., Drucker, A., Fefferman, B. & Shor, P. The power of unentanglement. In Proceedings of the 23rd Annual IEEE Conference on Computational Complexity, 223–236 (IEEE, College Park, MD, USA, 2008).
Arrazola, J. M., Diamanti, E. & Kerenidis, I. Quantum superiority for verifying npcomplete problems with linear optics. npj Quantum Inf. 4, 56 (2018).
Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod. Phys. 81, 1301 (2009).
Diamanti, E., Lo, H.K., Qi, B. & Yuan, Z. Practical challenges in quantum key distribution. npj Quantum Inf. 2, 16025 (2016).
Donaldson, R. J. et al. Experimental demonstration of kilometerrange quantum digital signatures. Phys. Rev. A. 93, 012329 (2016).
Pappa, A. et al. Experimental plug and play quantum coin flipping. Nat. Commun. 5, 3717 (2014).
Lunghi, T. et al. Experimental bit commitment based on quantum communication and special relativity. Phys. Rev. Lett. 111, 180504 (2013).
Liu, Y. et al. Experimental unconditionally secure bit commitment. Phys. Rev. Lett. 112, 010504 (2014).
Barz, S. et al. Demonstration of blind quantum computing. Science 335, 303 (2012).
McCutcheon, W. et al. Experimental verification of multipartite entanglement in quantum networks. Nat. Commun. 7, 13251 (2016).
Hensen, B. et al. Loopholefree bell inequality violation using electron spins separated by 1.3 kilometres. Nature 526, 682–686 (2015).
Pappa, A. et al. Nonlocality and conflicting interest games. Phys. Rev. Lett. 114, 020401 (2015).
Liu, Y. et al. Deviceindependent quantum randomnumber generation. Nature 562, 548 (2018).
Buhrman, H., Cleve, R., Watrous, J. & De Wolf, R. Quantum fingerprinting. Phys. Rev. Lett. 87, 167902 (2001).
Buhrman, H., Cleve, R. & Wigderson, A. Quantum vs. classical communication and computation. In Proceedings of the 30th Annual ACM Symposium on Theory of Computing, 63–68 (ACM, Dallas, Texas, USA, 1998).
Raz, R. Exponential separation of quantum and classical communication complexity. In Proceedings of the 31st Annual ACM Symposium on Theory of Computing, 358–367 (ACM, Atlanta, Georgia, USA, 1999).
Gavinsky, D., Kempe, J., Kerenidis, I., Raz, R. & De Wolf, R. Exponential separations for oneway quantum communication complexity, with applications to cryptography. In Proceedings of the 39th Annual ACM Symposium on Theory of Computing, 516–525 (ACM, San Diego, CA, USA, 2007).
Gavinsky, D. Entangled simultaneity versus classical interactivity in communication complexity. Preprint at: http://arXiv.org/abs/1602.05059 (2016).
Regev, O. & Klartag, B. Quantum oneway communication can be exponentially stronger than classical communication. In Proceedings of the 43rd Annual ACM Symposium on Theory of Computing, 31–40 (ACM, San Jose, CA, USA, 2011).
BarYossef, Z., Jayram, T. S. & Kerenidis, I. Exponential separation of quantum and classical oneway communication complexity. In Proceedings of the 36th Annual ACM Symposium on Theory of Computing, 128–137 (ACM, Chicago, IL, USA, 2004).
Arrazola, J. M. & Lütkenhaus, N. Quantum communication with coherent states and linear optics. Phys. Rev. A. 90, 042335 (2014).
Arrazola, J. M. & Lütkenhaus, N. Quantum fingerprinting with coherent states and a constant mean number of photons. Phys. Rev. A. 89, 062305 (2014).
Xu, F. et al. Experimental quantum fingerprinting with weak coherent pulses. Nat. Commun. 6, 8735 (2015).
Guan, J.Y. et al. Observation of quantum fingerprinting beating the classical limit. Phys. Rev. Lett. 116, 240502 (2016).
Kumar, N., Diamanti, E. & Kerenidis, I. Efficient quantum communications with coherent state fingerprints over multiple channels. Phys. Rev. A. 95, 032337 (2017).
Wei, K. et al. Experimental quantum switching for exponentially superior quantum communication complexity. Phys. Rev. Lett. 122, 120504 (2019).
Sasaki, T., Yamamoto, Y. & Koashi, M. Practical quantum key distribution protocol without monitoring signal disturbance. Nature 509, 475 (2014).
Guan, J.Y. et al. Experimental passive roundrobin differential phaseshift quantum key distribution. Phys. Rev. Lett. 114, 180502 (2015).
Comandar, L. et al. Quantum key distribution without detector vulnerabilities using optically seeded lasers. Nat. Photonics 10, 312 (2016).
Schweickert, L. et al. Ondemand generation of backgroundfree single photons from a solidstate source. Appl. Phys. Lett. 112, 093106 (2018).
Gavinsky, D. Quantum money with classical verification. In Proceedings of the 27th Annual IEEE Conference on Computational Complexity, 42–52 (IEEE, Porto, Portugal, 2012).
Amiri, R. & Arrazola, J. M. Quantum money with nearly optimal error tolerance. Phys. Rev. A. 95, 062334 (2017).
Buhrman, H., Regev, O., Scarpa, G. & De Wolf, R. Nearoptimal and explicit bell inequality violations. In Proceedings of the 26th Annual IEEE Conference on Computational Complexity, 157–166 (IEEE, San Jose, CA, USA, 2011).
Kahn, J., Kalai, G. & Linial, N. The Influence of Variables on Boolean Functions (IEEE, 1988).
Acknowledgements
We thank Frédéric Grosshans, Norbert Lütkenhaus, Luis Trigo Vidarte, and Adeline Orieux for useful discussions. This research was supported by the European Research Council projects QCC (I.K.) and QUSCO (E.D.), the French National Research Agency project quBIC and the BPI France project RISQ.
Author information
Authors and Affiliations
Contributions
All authors contributed to the theoretical analysis and the design of the experiment. N.K. developed the software, experimental system control tools, and collected the data. I.K. and E.D. conceived and supervised the project. All authors contributed to writing the paper.
Corresponding authors
Ethics declarations
Competing interests
The authors declare no competing interests.
Additional information
Peer review information Nature Communications thanks the anonymous reviewers for their contribution to the peer review of this work. Peer reviewer reports are available.
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Supplementary information
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Kumar, N., Kerenidis, I. & Diamanti, E. Experimental demonstration of quantum advantage for oneway communication complexity surpassing bestknown classical protocol. Nat Commun 10, 4152 (2019). https://doi.org/10.1038/s4146701912139z
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s4146701912139z
 Springer Nature Limited
This article is cited by

Entanglementbased quantum communication complexity beyond Bell nonlocality
npj Quantum Information (2022)

Experimental demonstration of quantum advantage for NP verification with limited information
Nature Communications (2021)