Bulk Locality and Quantum Error Correction in AdS/CFT

We point out a connection between the emergence of bulk locality in AdS/CFT and the theory of quantum error correction. Bulk notions such as Bogoliubov transformations, location in the radial direction, and the holographic entropy bound all have natural CFT interpretations in the language of quantum error correction. We also show that the question of whether bulk operator reconstruction works only in the causal wedge or all the way to the extremal surface is related to the question of whether or not the quantum error correcting code realized by AdS/CFT is also a"quantum secret sharing scheme", and suggest a tensor network calculation that may settle the issue. Interestingly, the version of quantum error correction which is best suited to our analysis is the somewhat nonstandard"operator algebra quantum error correction"of Beny, Kempf, and Kribs. Our proposal gives a precise formulation of the idea of"subregion-subregion"duality in AdS/CFT, and clarifies the limits of its validity.


Introduction
Almost twenty years after its initial formulation, the AdS/CFT correspondence remains our best-understood example of a precise theory of quantum gravity. It has shed light on many deep puzzles in quantum gravity, and has also been of practical use in studying the dynamics of strongly interacting quantum field theories. One aspect that remains mysterious, however, is the emergence of approximate bulk locality. Locality near the boundary is straightforward. In the "extrapolate" version of the AdS/CFT dictionary we have a simple relation [1,2] lim r→∞ r ∆ φ(r, x) = O(x) (1.1) between limiting values of a bulk field φ and a conformal field theory operator O; this dictionary manifestly respects locality in the x directions since the CFT does. The radial direction, however, is more subtle. One way to see this is to observe that naively a local operator in the center of the bulk should commute with every local operator at the boundary on a fixed time slice containing that bulk operator. This is not consistent, however, with a standard property of quantum field theory; any operator that commutes with all local operators at a fixed time must be proportional to the identity. 1 Bulk locality thus cannot be respected within the CFT at the level of the algebra of operators; we'd then like to know in what sense it is respected. 2 The basic idea of this paper is that bulk locality is a statement about certain subspaces of states in the CFT. That these subspaces can be large is a consequence of the large-N properties of the CFT, but the large degree of non-local entanglement in finite energy states of the CFT also plays an essential role. Our strategy will be to gradually back away from the r → ∞ limit in equation (1.1) and study how the the CFT representations of bulk operators spread in spatial support as we do so. On the bulk side the tool we will mostly use is the AdS-Rindler reconstruction of bulk fields introduced in [3] and refined in [4]. We will observe that this construction has several paradoxical features, which we will illuminate by recasting it on the CFT side in the language of quantum error correcting codes [5,6]. This language gives a new, more 1 For theories with scalars and fermions coupled to abelian gauge fields this property is essentially obvious in a Hamiltonian lattice formulation of the theory. Showing it for non-abelian gauge fields requires more work. In all cases the goal is to show that the algebra generated by local operators acts irreducibly on the Hilbert space; the theorem then follows from Schur's lemma. 2 One subtlety in this argument is that to put the operator at a definite bulk point in a diffeomorphism-invariant way we need to include "gravitational dressing" that will allow the operator to not necessarily commute with local operators at the boundary at subleading order in 1/N . We will discuss this more in section 5, where we will see that this level of non-locality is not enough to avoid a contradiction between the bulk and boundary algebras. general perspective on the issue of bulk reconstruction, and we believe that it is the natural framework for understanding the idea of "subregion-subregion" duality [7][8][9][10]. In particular, the radial direction in the bulk is realized in the CFT as a measure of how well CFT representations of bulk quantum information are protected from local erasures. The holographic principle also naturally arises in the guise of the general statement that there is an upper bound on how much quantum information a given code can protect from erasures.
One point that will appear in this analysis is that truncated subalgebras of bulk observables are of interest; these were also advocated in [11] in the context of describing the black hole interior. Aspects of our proposal are inspired by their construction, but here we do not discuss black hole interiors and we are not violating quantum mechanics [12]. A connection between black holes and quantum error correction was also made in [13], which is essentially an earlier version of the proposal of [11], but again the context was different and our work here should be uncontroversial by comparison.
Before proceeding, let us establish a few conventions used throughout this paper. We will frequently discuss subspaces and tensor factors of the Hilbert space. When we say that an operator acts within a subspace we also mean that the same is true for its hermitian conjugate. If the Hilbert space is a tensor product H E ⊗ H E , for any operator O E that acts on E we may trivially form an operator I E ⊗ O E that acts on the entire Hilbert space. We will often drop the identity operator I E and write it simply as O E . The reader should also keep in mind that the CFT regions A and A that we will talk about in section 4 unfortunately correspond to E and E respectively in the language of section 3.
2 Bulk reconstruction and an AdS-Rindler puzzle 2

.1 Global AdS reconstruction
We begin by briefly recalling the standard CFT construction of local bulk fields in AdS [1,3,14]. We will first work in global coordinates, where the metric asymptotically has the form The CFT dual to this system lives on S d−1 × R, with the R being the time direction. The Hilbert space of states is the set of field configurations on S d−1 . The idea is then to perturbatively construct operators in the CFT which obey the bulk equations of motion, with the boundary conditions set by the dictionary (1.1). For simplicity we will assume that all bulk interactions are suppressed by inverse powers of a quantity N , which will also set the AdS radius in Planck units. At leading order in 1/N , this procedure results in a straightforward prescription for the CFT representation of a bulk field φ(x); we simply have where the integral is over the conformal boundary and K(x, Y ) is a so-called "smearing function". The smearing function obeys the bulk wave equation in its x index, and leads to (1.1) as we take x to the boundary. It can be chosen to only have support when x and Y are spacelike separated, which we illustrate for AdS 3 in the left diagram of figure 1; the point x is represented by a boundary integral over the green region only. In the case of empty AdS, where we take (2.1) to hold everywhere, explicit representations of the smearing function can be found in [3,14]. 3 1/N corrections can be systematically included [14,15], although we won't really need to discuss them here. It is clear that this prescription can only work perturbatively about a background, or in other words perturbatively about a specific state in the CFT; otherwise we would run into a contradiction with the argument in the introduction. At higher orders in this perturbation theory we will need to confront the problem of defining local operators in a diffeomorphism invariant theory, but we postpone discussion of this until section 5. Note that once we have a representation of the form (2.2), we can use the CFT Hamiltonian to re-express all operators on the right hand side in terms of Heisenberg picture fields on a single Cauchy surface in the CFT, denoted as Σ in figure 1. This representation is quite nontrivial, in general it involves severely nonlocal and multitrace operators. It also has the property that if we take x to be near the boundary but not quite on it, the single-time CFT representation of φ(x) still involves operators with support on all of Σ. We might hope to find a representation whose boundary support shrinks as the operator approaches the boundary, and indeed the AdS-Rindler representation does exactly this, as we will now explain.

AdS-Rindler reconstruction
Consider a subregion A of a CFT Cauchy surface Σ. The boundary domain of dependence of A, denoted D[A], is defined as the set of points on the boundary with the 3 One subtlety here is that for more general asymptotically AdS backgrounds, we are not aware of a rigorous argument for the existence of K, even in the distributional sense that we will see we need to allow in the following subsection. One obvious problem is that x could be behind a horizon, but even for geometries with no horizons the only precise argument for the existence of K (or more precisely the existence of the "spacelike Green's function" it is built from) requires spherical symmetry [14]. We are not aware of any obstruction to its existence, but it would nonetheless be very interesting to see a detailed analysis of this somewhat nonstandard problem in partial differential equations. property that every inextendible causal curve, meaning a curve whose tangent vector is never spacelike and which is not part of a larger curve with this property, that passes through it must also intersect A. This is illustrated for the boundary of AdS 3 in the right diagram of figure 1, where A is the boundary interval lying between the two vertical hash marks and D[A] is shaded green. For any boundary region R, its bulk causal future/past J ± [R] is defined as the set of bulk points which can be reached by bulk causal curves evolving from/to the region R. The causal wedge of a CFT subregion A [10] is defined as In the right diagram of figure 1, W C [A] roughly lies between the dashed lines and D[A]. The bulk codimension-two surface χ A in the figure is the "rim" of the wedge and is commonly referred to as the causal surface of A [10]; more precisely it is defined as the part of the intersection of the boundaries of J ± [D[A]] that does not also intersect the conformal boundary at infinity. χ A can also be described as the intersection of the past and future horizons of D[A].
A simple example of these definitions is where we take the geometry to be pure AdS d+1 , Σ = S d−1 to be the t = 0 slice of the boundary, and A to be one hemisphere of Σ. In this case W C [A] becomes what is usually referred to as the AdS-Rindler wedge. A natural set of bulk coordinates on the AdS-Rindler wedge gives a metric with the form where the coordinate ranges are ρ > 1, x ≥ 0, −∞ < τ < ∞ and the geometry in parentheses is just the d − 1 dimensional hyperbolic disc. The causal surface χ A is given by the limit ρ → 1 at fixed τ , and A itself is given by ρ → ∞ and τ = 0. We illustrate this for AdS 3 in figure 2. By acting on this example with bulk isometries (or equivalently boundary conformal transformations), we can arrive at the causal wedge for any round disc in Σ. The case of AdS 3 is especially simple; all connected boundary regions are intervals and thus can be produced in this way. The point then is that the construction of CFT representations of bulk fields in the previous subsection can also be implemented purely within the causal wedge [3]. 4 At leading order in 1/N , the claim is that for any φ(x) with x ∈ W C [A], we can again represent φ(x) via the expression (2.2), but with the Y integral now taken only over D [A]. This is illustrated for AdS 3 in the right diagram in figure 1, where we have allowed for a conformal transformation that changes the size of the boundary interval A. We review more details of this construction in appendix A; the only major subtlety is that the smearing function K no longer exists as a function and must be understood as a distribution for integration against CFT expectation values [4].
Thus we see that the AdS-Rindler construction of φ indeed has the property that if x is close to the boundary, only a small boundary region A localized near x is needed to be able to reconstruct φ in D(A). Moreover, by making use of the CFT evolution we can again rewrite the expression (2.2) entirely in terms of nonlocal Heisenberg operators acting at t = 0, but now they will act only on A.
A B x A B C Figure 3. Three examples of AdS 3 -Rindler reconstruction. Shown here is a top-down view of a bulk Cauchy slice whose boundary is Σ. On the left, the blue shaded region is the intersection of this Cauchy slice with the causal wedge for a CFT region A that is the complement of a small boundary interval around the boundary point Y . In the center we have the point x lying in the causal wedge of two different CFT regions, A and B. A borders the blue and green regions, while B borders the green and yellow regions. The black circle segments are χ A , χ B , and χ A∩B . On the right we have split Σ into a union of three disjoint intervals, A, B, and C, and the circle segments are χ A , χ B , and χ C .

Overlapping wedges
The AdS-Rindler construction of bulk fields we have just described has the somewhat counter-intuitive property that the same bulk field operator φ(x) lies in multiple causal wedges, and thus can be represented as an operator on distinct regions A, B, . . . in Σ. One consequence of this is shown in the left diagram of figure 3; for any bulk field operator φ(x) and any CFT local operator O(Y ) such that x and Y are spacelike separated, we can choose a causal wedge W C [A] such that O(Y ) lies in the complement of A in Σ. By CFT locality O(Y ) then must exactly commute with our representation of φ(x) in that wedge. This is coming dangerously close to contradicting the theorem mentioned in the introduction, that is that no nontrivial operator in the CFT can commute with all local CFT operators on Σ.
To avoid this contradiction it must be the case that the representations of φ(x) in different wedges are not really all the same operator on the CFT Hilbert space. We can see this in another way by considering the setup of the center diagram in figure 3, where we have two overlapping wedges W C [A] and W C [B] that both contain the point For a CFT operator defined with support only on A to really be equal to a CFT operator defined with support only on B, it must be that the operator really only has support on A ∩ B. But given that we have chosen x to lie outside of W C [A ∩ B], we do not expect the operator to have such a representation. In fact in this example the operator has a representation on the complement of A ∩ B, and we will see in the following section that, as long as we smear the operator over a distance scale that is small compared to its proper distance from χ A∩B , the no-cloning theorem of quantum mechanics forbids an accurate representation of the operator on A ∩ B.
We can see the non-equivalence of the operators even more clearly by considering a third example, shown in the right diagram in figure 3. Now a bulk field at the point x lies outside of the causal wedge for any one of the regions, but it can be reconstructed in A ∪ B, B ∪ C, or A ∪ C. The mutual intersection of these regions is just three points, and if we consider another set of three regions slightly rotated from these we can come up with a set of six possible reconstructions whose mutual intersection is genuinely empty. There is simply no possible way that they can all be equal as operators. For future reference we will refer to the three operators as φ AB (x), φ BC (x), and φ AC (x).
We thus need to decide how we are to reconcile these operator inequivalences with the fact that in the bulk theory it seems that the operators are equivalent. There will clearly be some CFT states where they act quite differently, and we would like to understand the physics of the subset of states where their action is equivalent. This problem can be nicely understood in the language of quantum error correction, to which we now turn.

Correcting quantum erasures
Say Alice wants to send Bob a quantum state of k qubits in the mail, but she is worried that some of the qubits might get lost on the way. Quantum error correction is a procedure that allows her to embed this state into n > k qubits in such a way that even if some qubits are lost, Bob can still recover it. In this section we review some basic facts about this, beginning with an example.

A simple example of erasure correction
The simplest example of quantum error correction actually involves three-state "qutrits" instead of two-state qubits, and it uses three qutrits to send a single-qutrit message [16]. Say Alice wishes to send the state The idea is to instead send the state where This protocol has two remarkable properties. First of all for any state | ψ , the reduced density matrix on any one of the qutrits is maximally mixed. Thus no single qutrit can be used to acquire any information about the state. Secondly, from any two of the qutrits Bob can reconstruct the state. For example, say he has access to only the first two qutrits. He can make use of the fact that there exists a unitary transformation U 12 acting only on the first two qutrits that implements Acting with this on the encoded message, we see that Bob can recover the state |ψ : Explicitly U 12 is a permutation that acts as Clearly by the symmetry of (3.3) a similar construction is also possible if Bob has access only to the second and third, or first and third qutrits. Thus Bob can correct for the loss of any one of the qutrits; in quantum information terminology one describes this as a quantum error correcting code that can protect against arbitrary single qutrit erasures. The subspace spanned by (3.3) is called the code subspace; the entanglement of the states in the code subspace is essential for the functioning of the protocol. In our discussion of reconstruction in the previous section we were interested in the action of operators rather than the recovery of states, and we can rephrase the error correction protocol in this language. Indeed, say that O is an operator that acts on the single qutrit Hilbert space as 5 In quantum computing language, operators that act directly on the code subspace in this manner are called logical operations, since they are the types of things that we want to implement when performing a fault-tolerant quantum computation. We will use this terminology occasionally. It is straightforward to see that the operator so there is an operator acting only on the first two qutrits that implements the operator O directly on the code subspace. Since we can also analogously construct O 23 or O 13 , we have realized a situation where operators with nontrivial support on different qutrits have the same action on the code subspace. This should be reminiscent of our discussion of overlapping wedges in the previous section; we will make the connection more explicit soon but first we need to discuss some general properties of quantum erasure correction.

General erasure correction
We now describe a natural generalization of the protocol of the previous subsection.
For familiarity we will describe it using qubits, although none of the results rely on this. Say that we want to protect a k-qubit code subspace of an n-qubit system against the loss of some collection of E of l of the qubits. We define the code subspace H C as the span of the orthonormal states where U enc is called the encoding unitary transformation. There is a necessary and sufficient condition for the correctability of the erasure of E [17]. Say that we adjoin to our system a reference system R of k additional qubits. We then consider the state where E denotes the set of n − l qubits that aren't erased. The code (3.10) can correct for the erasure of E if and only if we have , etc are the reduced density matrices obtained from |φ by partial trace. This is equivalent to saying that the mutual information where S X is the Von Neumman entropy, S X ≡ −trρ X log ρ X . Let us first see that this ensures we can correct the erasure. The Schmidt decomposition 6 of |φ , together with (3.12), ensures us that there exists a basis |e for E and a set of orthonormal states |ψ i,e E in E such that where C e are some non-negative coefficients obeying e C 2 e = 1. In other words there exists a unitary transformation U E acting only on E such that where we have denoted the first k qubits of E as E 1 and the rest as E 2 . |χ is some state that is independent of i. This then implies that we must have which is the analogue of (3.4) above and demonstrates that we can use U E to correct the erasure. If we do not have (3.12), then there is nonzero correlation between R and E, so we can learn about the state of R by doing measurements on E. Since any successful protocol must not care about what happens to the qubits we lose, this prevents us from being able to correct the erasure. We can thus loosely rephrase (3.12) as the statement that the erasure of E is correctable if and only if no information about i can be obtained from E. This is related to the no-cloning theorem; if we were able to get the same quantum information about the encoded state | ψ from both E and E then we would have built a machine for cloning that information.
There is a useful reformulation of the condition (3.12) as the statement that for any operator X E acting on E, we must have [19] i|X E | j = δ ij C(X). (3.17) In other words we must have the projection of X E onto the code subspace be proportional to the identity. One immediate consequence of this is that in any state | ψ in 6 The Schmidt decomposition of a pure state |ψ in a bipartite Hilbert space H A ⊗ H B is the observation that for any |ψ ∈ H A ⊗ H B there exists a set of orthonormal states |i A in H A , a set of orthonormal states |i B in H B , and a set of non-negative real numbers C i such that For a derivation and some more details see for example [18].
the code subspace, the correlation function of X E with any operator O that acts within the code subspace 7 must vanish: This is another manifestation of the idea that E has no access to the encoded information.
As in the previous subsection, we can use U E to realize any operator O acting within the code subspace as an operator O E that acts just on E. Indeed we have both In fact the converse of this statement also holds; if any operator on the code subspace can be realized as an operator on E as in (3.19) (3.19)) to hold. In situations where we would like our code to be able to correct against a wide variety of erasures, we expect that ρ E [φ] will have full rank. 8 In that case, in order to be able to have the orthonormal set of states |ψ i,e we need the dimensionality of E to be at least as large as dimensionality of RE. In other words we need n ≥ 2l + k. (3.20) This condition is quite intuitive; wanting to send a larger message or correct larger erasures requires more qubits.
In fact for large systems (3.20) is typically not only necessary but sufficient. Say we take |φ to be a random state of 2 k+n qubits in the Haar measure. By Page's theorem [20] 9 , the density matrix of R will be exponentially close to maximally mixed provided that k n, so by the Schmidt decomposition this is equivalent to choosing a random k-qubit code subspace of n qubits. The condition (3.12) will hold if RE is maximally mixed, which again by Page's theorem should be true provided that n − 2l − k 1. Thus, not only is (3.20) necessary for a typical code to correct for the loss of a particular set E of l qubits, it is basically sufficient for the code to correct for the loss of any set of l qubits.

Quantum secret sharing
The three-qutrit example of section 3.1 has the interesting property that every collection of qutrits either can perfectly reconstruct the state |ψ or has no information about it at all. General error correcting codes do not have this property, since sometimes we can have erasures which can be "partially corrected", but it is interesting to think about the codes that do. Say that we have a Hilbert space that is a tensor product of p factors of not necessarily equal size, which in this context we will refer to as shares.
A code subspace C of this Hilbert space is called a Quantum Secret Sharing Scheme if it has the property that every collection of shares either can distinguish perfectly different elements of C, meaning given access to it we can correct for the erasure of its complement, or it cannot distinguish different elements at all [16]. Collections which enable erasure correction are called authorized and collections which do not are called unauthorized. We will see a possible application of quantum secret sharing to AdS/CFT in the following section.

Approximate erasure correction
So far we have discussed exact quantum error correction, but in AdS/CFT we only expect the emergence of the bulk to be approximate. It will thus be important for us to get a sense of how badly we might want to allow our three necessary and sufficient conditions for correctability to be violated. The simplest way to relax the condition (3.12) is to require only [21] Here ||M || 1 ≡ tr √ M † M is the trace norm of M ; two density matrices whose difference has trace norm are "operationally close" in the sense that the probability distributions they predict for arbitrary measurements differ by at most . This essentially says that typical states in the code subspace can be reconstructed to accuracy ; following [21] we take this to be the definition of approximate error correction. We would like to relate this to our second condition for correctability, (3.17), but we need a convenient way to quantify the violation of (3.17). One good choice is to use correlation functions of the R denotes taking the transpose of an operator O on the code subspace and acting with it on the reference system R; by construction acting on the state |φ this is equivalent to acting with O on EE. C φ (O, X E ) is essentially the average of the correlation function (3.18) over all | ψ ∈ H C ; they become equal in the limit of a large code subspace. 10 From the right hand side of (3.22) it is not difficult to show that [22] where λ O and λ X are the largest eigenvalues of their respective operators. Thus we see that, as one might expect from our discussion around (3.17), the presence of nonzero correlation between O and X E puts a limit on how accurately we can correct for the erasure of E. This inequality will be very useful in our discussion of AdS/CFT, since after all computing correlation functions in the bulk theory is much easier than computing the trace norm directly.

Operator algebra quantum error correction
In our discussion of AdS/CFT we will soon see that the presence of bulk correlation puts nontrivial restrictions on the correctability of errors via the inequality (3.23). There is, however, a generalized version of quantum error correction, called operator algebra quantum error correction, that is able to accommodate such correlation by requiring that our third necessary and sufficient condition (3.19) apply only to a subalgebra of operators on the code subspace [23,24]. This requirement is greatly illuminated by the following theorem: Theorem. Say that we have a code subspace H C ⊂ H E ⊗ H E and an operator O that, together with its hermitian conjugate, acts within the code subspace. In other words we have Then there exists an operator O E acting just on E that obeys for any | ψ ∈ H C if and only if O commutes with the projection of any operator X E onto the code subspace, where X E acts on E. In other words We give a proof of this theorem in appendix B. It is clear that the set of O's that satisfy the assumptions of the theorem form a unital *-subalgebra A of the operators on the code subspace, meaning they include the identity and are closed under addition, multiplication, and hermitian conjugation. If we take A to be the entire algebra of operators on H C then we recover our condition (3.19). Notice, however, that when A is a proper subalgebra we cannot use our previous argument to derive the condition (3.17) from (3.19), since the O that we constructed that doesn't have an O E will not be in A. This gives a loophole that simultaneously allows correlation between O and X E and the existence of O E .
For example in the two qubit system, consider a code subspace spanned by 1 √ 2 (|00 + |11 ) and 1 √ 2 (|01 + |10 ). The operator X that exchanges these two states can be realized just on the first qubit as the X 1 operator that flips it, even though in either state this operator is perfectly correlated with the X 2 operator that flips the second qubit. This is possible because the Z operator on the code subspace, for which the first state is a +1 eigenstate and the second state is a −1 eigenstate, cannot be realized as an operator just on the first qubit; this code corrects only the subalgebra generated by 1 and X.

AdS/CFT as quantum error correction
We now return to our discussion of bulk reconstruction. Consider again the right diagram in figure 3. We argued using the AdS-Rindler reconstruction that the operator in the center can be represented either as an operator φ AB with support on A ∪ B, an operator φ BC with support on B ∪ C, or an operator φ AC with support on A ∪ C. By now it should be obvious that this is directly analogous to the situation with O 12 , O 23 , and O 13 in the three qutrit example, or more generally the existence of the operator O E . The main proposal of this paper is that this is more than an analogy, it is actually how AdS/CFT is reproducing the bulk! In other words we can think of local bulk operators as logical operations on an encoded subspace, which becomes better and better protected against localized boundary errors as we move the operators inwards in the radial direction. 11 We illustrate this in figure 4. In the remainder of the paper we will spell out this idea in more detail, giving the bulk versions of most of the statements of the previous section.

Defining the code subspace
We begin by defining a candidate code subspace H C for AdS/CFT. Our proposal is that we should pick some finite set of local bulk operators φ i (x), realized in the CFT via the global representation of section 2.1. We then define H C as the linear span of states of the form where we take the range of i, the number of φ i (x)'s we act with, and the number of points x where the operators can be located to be bounded by some fixed finite number.
Here |Ω is the ground state of the system; we could also do a similar construction around other sufficiently "semiclassical" states, but for rigor we will stick to |Ω since, as mentioned in section 2.1, the existence of appropriate smearing functions has not been completely established in the general case. We postpone to section 5 the question of how large H C can be. It is essential that our definition of the code subspace will be different for different choices of the operators φ i (x); the set of erasures that are correctable will depend on this choice, and we can learn about the way that the bulk theory is realized in the CFT by studying this dependence. For example, in figure 4 we see that moving the operators closer to the boundary makes our code subspace less protected against small erasures. We would like to think of the operators φ i (x) as logical operations on this code subspace, but this does not quite work since by construction acting repeatedly with φ i (x) will eventually take us out of H C . To get a set of operators that really act within H C we can include projection operators onto H C on both sides of φ i ; these will be irrelevant except in studying high-point correlation functions, so we will not carry them around explicitly here. 12 Now consider a decomposition of the boundary Cauchy surface Σ into A and A. If our code subspace H C can protect against the erasure of A, then by our condition (3.19) it must be that we can find a representation of any operator on H C with support only in A. In fact, this is what the AdS-Rindler reconstruction we reviewed in section 2.2 provides us; any causal wedge W C [A] which contains the locations of the φ i (x)'s used in defining H C will allow a set of operators φ A,i (x) with support only on A and whose action on H C is the same as that of φ i (x). We now see that in the CFT this is a statement about being able to correct for the erasure of A.

Bulk correlation and smearing
It is illuminating to understand in more detail to what extent the AdS-Rindler reconstruction is consistent with our three equivalent conditions (3.12), (3.17), (3.19) for quantum erasure correction. We clearly do not expect them to hold exactly, but we might hope for them to hold in the approximate sense of (3.21). As we explained in section 3.4, a good diagnostic for approximate quantum erasure correction is that the correlation functions between operators acting within the code subspace and operators acting on the set to be erased are small enough that the inequality (3.23) does not preclude (3.21) from holding. 13 In fact it is a basic property of bulk physics that there is correlation between fields in W C [A] and fields in W C [A], as we indicate in figure 5. In deciding whether or not this bulk correlation interferes with our interpretation of AdS-Rindler reconstruction as quantum error correction, we need to properly take into account the operator eigenvalues in the denominator of (3.23). Formally these are infinite in a continuum quantum 12 A subtlety here is that the states (4.1) are not mutually orthogonal; a state of the form φ m |Ω has a normalized overlap with the vacuum of order Ω|φ m |Ω √ Ω|φ 2m |Ω ∼ 2 −m . The scaling with m follows from counting Wick contractions at leading order in 1/N . If we choose our code subspace such that the maximum power of each φ grows like some power of N , then for states on which the projection onto H C is nontrivial this overlap will be exponentially small in N . It then will be okay to conjugate the φ's by these projectors without ruining their low-point correlation functions. 13 We thank Juan Maldacena for pointing out the relevance of (3.23) in this situation.
A φ(x) φ(y) Figure 5. Potentially troublesome bulk correlation. Here φ(x) is an operator that acts within the code subspace H C , and which we thus expect can be represented as an operator on A. φ(y) we similarly expect to reconstructed on A, but there is nonvanishing correlation between them in the ground state |Ω . Using inequality (3.23), this correlation puts a lower bound on the accuracy with which we can view AdS/CFT as quantum error correction in the conventional sense of section 3.2.
field theory, but every quantum field theorist knows that field operators are not really well-defined until they are integrated against smooth test functions with support over some region of nonzero measure, which we will take to have linear size s . For simplicity we will take the bulk fields to be massless scalars and take their separation to be small compared to the AdS radius, in which case we have Here d is the spacetime dimension of the boundary theory and d(x, y) is the geodesic distance between x and y. This formula also holds in other states we produce by acting on |Ω with smeared operators near x, and thus on average in the code subspace H C . We thus see that the right hand side of (3.23) will be small in our case provided that the operators φ i (x) used in constructing H C are smeared over a distance which is small compared to their distance to the causal surface χ A of the wedge W C [A] in which we are trying to reconstruct them. This observation does much to justify our interpretation of AdS-Rindler reconstruction as quantum error correction, but it is somewhat unsatisfactory in the sense that the AdS-Rindler reconstruction still seems to work in the situation where we smear the operators over a distance that is comparable to their distance to the bifurcate Rindler horizon χ A , even though the bulk correlation is then too large to be ignored. Indeed we interpret this as saying that the conventional quantum error correction of section 3.2 does not fully capture the mechanism by which AdS/CFT realizes bulk locality. The operator algebra quantum error correction introduced in section 3.5 however provides precisely the generalization we need to fix this. Consider for example an operator S which acts on φ(x)|Ω as Sφ(x)|Ω = |Ω , and which annihilates any state orthogonal to φ(x)|Ω . This is an operator that acts within the code subspace, but its commutator with an operator φ(y) in W C [A] obeys Ω|[S, φ(y)]|Ω = Ω|φ(x)φ(y)|Ω = 0. (4.3) Thus S clearly cannot have a representation as an operator just on A. Fortunately there is no reason to expect this operator to have an AdS-Rindler reconstruction, but the broader lesson is that we should really expect AdS-Rindler reconstruction to in general produce only a subalgebra of the operators on H C . We saw in section 3.5 that the condition a subalgebra must obey for this to be possible is that the subalgebra must commute with the projection onto H C of any operator on A. In fact this is precisely the condition that we expect to be true for local operators in W C [A] (and their sums and products), which by bulk causality should commute with operators in W C [A]. 14 That this commutator vanishes with the projections onto H C of all CFT operators in A is not something we can prove directly, but AdS-Rindler reconstruction requires it. A second reason to prefer operator algebra quantum error correction is that even when the right hand side of (4.2) is small, it will at most be suppressed by some fixed power of 1/N . This is because we should not smear the operators over distances shorter than the Planck length. Since we in principle would like a version of AdS-Rindler reconstruction that works to all orders in 1/N , it would be unsatisfying if our error correction interpretation failed at some finite order because of bulk correlation.
We can now state our final proposal: the AdS-Rindler reconstruction of local bulk operators in [3,4] is dual in the CFT to the operator algebra quantum error correction of [23,24]. An erasure of a region A is correctable if the φ i (x)'s used in defining the code subspace all lie within the causal wedge W C [A]. In cases where the operators we are interested in are well-localized away from the causal surface χ A of W C [A], the situation is well-approximated by conventional quantum error correction. Either way, the further the φ i (x)'s are from the asymptotic boundary, the better they are protected from CFT erasures.
It is worth emphasizing that in the case where a bulk operator is of order an AdS radius distance from W C [A], our approximate equivalence between conventional and 14 This statement is rendered somewhat more subtle by the need for gravitational dressing to localize operators in a gravitational theory; at leading order in 1/N this is irrelevant, we will comment in section 5 on what happens at higher orders.  Figure 6. A reconstruction phase transition? As we increase the region A, the extremalarea codimension two surface of smallest area whose boundary is ∂A, shown as the solid lines, changes discontinuously. Does this mean that we can now reconstruct the point in the center as an operator on A?
operator algebra quantum error correction requires sub-AdS scale bulk locality. This is a special property of those CFTs that have local holographic duals, which we have here reformulated in the language of quantum information theory.

Disconnected regions and quantum secret sharing
So far we have only discussed the erasure of connected regions of the boundary. More general erasures are also interesting. Consider for example the AdS 3 situation depicted in figure 6. Here we consider a region A which is the union of two disjoint intervals; in other words we have erased two disjoint intervals. Can we choose a code subspace where we can realize the bulk operator in the center as an operator acting on A or A? If the AdS-Rindler reconstruction is the last word on bulk reconstruction [7], then the answer is clearly no; this point lies neither in W C [A] nor in W C [A]. This is possible within the context of quantum error correction, but only if both A and A can access partial information about the code subspace. For example, say that A had no information whatsoever about which state of the code subspace we are in. Then by definition (3.12) would hold, so we could recover the information from A. We are not, however, able to determine whether or not such partial information is really present.
In fact there have been recent conjectures in the literature that this operator can still be reconstructed in A as long as A is bigger than A; more generally, the claim is that one can do reconstruction throughout the entanglement wedge, which is defined as the bulk domain of dependence of any bulk spacelike surface whose boundary is the union of A and the codimension two extremal-area surface of minimal area whose boundary is ∂A [8,25,26]. In the figure, the intersection of the entanglement wedge with a bulk Cauchy surface is shaded blue; the minimal area condition causes a discontinuous change as we increase the size of A. Is this conjecture compatible with our proposal? Indeed it is; we saw below equation (3.20) that in a generic code subspace any A which is greater than half of the system can correct for the erasure of its complement A. 15 The sharp jump in correctability as A surpasses A in size is consistent with our analysis around (3.20), where from Page's theorem we expect that the density matrix of A together with the reference system will approach being maximally mixed exponentially fast once we cross the transition.
In section 3.3 we saw that a division of the CFT into a union of shares with the property that any collection of the shares has either complete information or no information about the encoded state is called a quantum secret sharing scheme; we now see that in the situation of figure 6 we will be able to reconstruct the operator in the center if and only if our boundary division into four regions gives a quantum secret sharing scheme.

MERA as an error correcting code?
One shortcoming of our work so far is that, although we have laid out a plausible CFT interpretation of AdS-Rindler reconstruction as quantum error correction, we have ultimately relied on the bulk in deriving this reconstruction. This boils down to the assumption that there exist operators in the CFT that obey the bulk equations of motion and algebra on a subspace. We then use this assumption to perform the Bogoliubov transformation that relates the global and the Rindler reconstructions. This assumption is quite plausible, and essentially follows from the assumed large-N structure of the CFT [27], but it would still be nice if we could explicitly demonstrate the structure of the quantum error correcting code in the CFT. In particular, in section 4.2 we had to use bulk causality to argue that the necessary and sufficient condition (3.26) for operator algebra quantum error correction held, and we were not able to check it explicitly for all possible CFT operators on A. Similarly we were unable to determine whether or not the central point could be reconstructed in the two-interval A of the previous subsection.
A promising starting point for addressing these issues is the MERA tensor network construction of a discrete version of AdS/CFT [28][29][30]. It seems possible that in that fairly controlled setting one could rigorously confirm the quantum error correction structure we have motivated in this paper. Moreover, one could attempt to determine explicitly whether or not the example of the previous subsection allows reconstruction of the operator in the center; this could be done by using the global construction to make a code subspace, entangling this code subspace with a reference system R to prepare a state |φ , and then seeing whether there is mutual information between R and A. The state |φ would still be prepared by a tensor network, with tensors acting both on the CFT and/or the reference system. This calculation would go a long way towards settling the "causal wedge vs. entanglement wedge" debate of bulk reconstruction. 16 We will not attempt this calculation here, but the typicality argument leading to (3.20) favors the entanglement wedge; we will say more about this in section 5.3.

Backreaction and holography
We now turn to the question of how large we can make the code subspace H C . Each φ i (x) that we act with raises the energy of the state, so doing so repeatedly will eventually lead to backreaction becoming important. When this happens it is clear that the approximation of perturbation theory around a fixed background geometry will break down. In this section we argue that this is related to a basic property of error correcting codes: the larger the code subspace, the fewer correctable errors. For erasures we quantified this in equation (3.20) above.

Defining local operators
Once we allow nontrivial backreaction, it is no longer possible to ignore the issue of how we define local operators in a diffeomorphism-invariant way. Following [31,32], we do this by choosing a cutoff surface at large but finite radius, with induced metric S d−1 × R, and then specifying bulk points by sending in spacelike geodesics from the t = 0 slice of this cutoff surface that start out orthogonal to the S d−1 directions. We then take the limit as the cutoff surface approaches the boundary. Points are labeled by a location on S d−1 , a renormalized proper distance along the geodesic, and an angle in the radial/temporal plane. This is illustrated in figure 7. These geodesics can be thought of as the "gravitational dressing" of the bulk operator, analogous to the Wilson line one would use to connect a charged operator to the boundary to make it gauge-invariant in electrodynamics.
As in the electromagnetic case, the operators defined in this way will have nonlocal commutators due to their nontrivial Dirac brackets. This issue has recently been studied 16 One challenge in doing this is that the region of discrepancy between the entanglement wedge and the causal wedge in that example has a size which is only of order the AdS radius, and it is not so clear how to represent sub-AdS scale physics using MERA. One strategy for getting around this is to consider the limit of A being a union of a large number of smaller disjoint intervals of equal size; this allows a parametrically large separation between the causal wedge and the entanglement wedge. in considerable detail in [32], although they send the geodesics from arbitrary times but take them to be orthogonal to the boundary in the temporal direction as well as the S d−1 directions. 17 In particular they show that in Einstein gravity coupled to matter, the commutators of operators defined in this way are nonlocal only if they involve the metric or its canonical momentum; the matter fields and their canonical momenta still have local commutators. 18 We can make contact with this result by restricting to operators located at points whose geodesics start out orthogonal to the boundary time direction; these operators are identical to those of [32] and thus have the same commutators.
We can use this result to verify that the nonlocality from the gravitational dressing of operators does not invalidate our previous claims. For example in the introduction we argued that because in the bulk theory an operator in the center of the space commutes with all local operators at the boundary, the bulk operator algebra is inconsistent with the CFT algebra. We can now give a version of this argument that includes the gravitational dressing. Consider a scalar field φ(x) located near the center of AdS and dressed by a geodesic to make it gauge-invariant. It will have a nonlocal commutator 17 We have not made this choice because we want to restrict to operators acting on a fixed time slice at the boundary; as explained in more detail in section 4.2 of [14] this is the natural way to define the fixed-time Hilbert space in the bulk since it makes it clear that expectation values are independent of possible sources on the boundary at later times. 18 We have not studied in detail the case of more general theories of gravity that involve derivative couplings of the metric to matter. The results of [32] do not immediately extend to this case, and it would be interesting to understand to what extent our analysis would need to be modified.
with the metric at infinity, in particular with the ADM energy that is defined as an integral of the boundary stress tensor T 00 [31,33]. But using the result of [32] φ(x) will commute with its own canonical momentum at spacelike separation, which extrapolates to the boundary to becomeȮ, the time derivative of the CFT operator O dual to φ. These two statements, however, are inconsistent with the CFT operator algebra; from the conformal Ward identity T 00 always lies in the operator product expansion ofȮ with itself at spacelike separation, and can be extracted by an appropriate limit after subtracting off a few relevant operators that are dual to matter fields and thus commute with φ(x). 19 It is thus impossible for φ(x) to commute withȮ but not with T 00 ; again we find that the bulk algebra is inconsistent with the boundary algebra. The resolution of this contradiction that we are proposing is that the bulk algebra holds only acting on the code subspace.
Similarly we can now revisit our claim that operators in W C [A] commute with operators in W C [A], which was a necessary condition for our interpretation of the AdS-Rindler construction as operator algebra quantum error correction. For matter fields it clearly works, but we might worry that a matter operator in W C [A] might not commute with a metric operator in W C [A]. We note, however, that as long as the gravitational dressing of an operator at x ∈ W C [A] also lies entirely in W C [A], meaning that the spatial geodesic connecting x to the boundary also lies in W C [A], then it will only produce nonlocal commutators with operators that are also located in W C [A]; any operator localized by a geodesic in one wedge will still commute with any operator localized by a geodesic in the complementary wedge.
In this subsection, to allow direct use of the results of [32] we studied only operators attached to geodesics that start out orthogonal to the boundary time direction at t = 0. It would be interesting to do the analogue of their analysis at arbitrary temporal-radial angle; this amounts to working with boundary conditions that approach the "open-FRW" slicing of AdS ds 2 = −dt 2 + sin 2 t dχ 2 + sinh 2 χdΩ 2 d−1 (5.1) as χ → ∞. As explained in [14], this would be a natural bulk construction of gaugeinvariant operators on the fixed-time Hilbert space.

Shrinking of the causal wedge
We now return to the question of how backreaction affects causal wedge reconstruction. Our basic proposal is that adding energy in the bulk causes the causal wedge of a fixed boundary region A to recede towards the boundary, giving it less access to bulk operators defined at fixed renormalized geodesic distance (for some related discussion see [10,25,26,34,35]).
Consider for example the AdS-Schwarzschild geometry in d + 1 dimensions.
α is proportional to the ADM mass of this geometry. Now consider a boundary disc A of angular size θ; its causal wedge reaches a radius r θ (α) in the bulk defined implicitly by The proper distance of this radius to a cutoff surface at r = r c is so we can subtract log r c to define a renormalized proper distance We claim that d θ (α) is a decreasing function of α at fixed θ, which by differentiating under the integral sign is equivalent to the claim that for all α > 0 and for all r > r + (α), where r + (α) is the positive root of f . This can be shown analytically in various limits, and is easily checked numerically in the general case. One can also study the asymptotically-AdS 3 BTZ black hole, where a similar result holds and all integrals can be done analytically. Thus we see that indeed the causal wedge has access to fewer and fewer bulk observables as we increase the mass of the matter in the center. This after all must be the case, since as we keep increasing the mass a point at fixed renormalized geodesic distance from the boundary will eventually go through the horizon.
It is interesting to think about how general this statement is; under what circumstances can the causal wedge move inwards in renormalized geodesic distance as we insert energy? One might guess that the null energy condition should generically prevent this, but to test that we need a more precise conjecture. One first guess is that in any geometry obeying the null energy condition the causal wedge of a fixed boundary region can see at most as far in renormalized geodesic distance as it can in the vacuum. In fact this conjecture is false, we have constructed explicit counterexamples. Indeed a weaker conjecture, where we replace the null energy condition by the dominant energy condition 20 , still has counterexamples. One counterexample is given by a small perturbation of AdS 4 , with the metric With a small positive , the causal wedges of certain fixed boundary regions can see farther in renormalized geodesic distance than they can in the vacuum. These boundary regions include spherical regions whose causal wedges probe deep into the bulk geometry.
Although these counterexamples prevent any straightforward "monoticity of causal wedge recession theorem", we expect that the Schwarzschild calculation we have just discussed captures the general tendency. It would be nice to prove a more general theorem verifying this, but we have not succeeded in finding one.

Counting states
The recession of the causal wedge has a nice quantum error correction interpretation; as we allow the code subspace to have more and more excited states, a bulk operator localized at some fixed geodesic distance will eventually no longer lie in the causal wedge of a fixed boundary region. In other words, the code will lose some of its ability to correct erasures; we will need access to more of the boundary to study the same bulk observables. In this subsection we study this a bit more quantitatively, making contact with the general condition (3.20) for typical correctability.
To apply (3.20) to AdS/CFT, we need to identify CFT analogues of the quantities n, l, and k. n is the total number of qubits used in doing the encoding, and should roughly correspond to the total number of CFT degrees of freedom relevant for reconstructing a particular bulk region of interest. This is somewhat nontrivial; the CFT has an infinite number of degrees of freedom in the UV which are needed to reconstruct bulk operators that are arbitrarily close to the boundary. To deal with this we take our code subspace to only involve states where we act on the vacuum with operators φ i (x) that are all localized within a region R at the center of the AdS space that has proper size of order the AdS radius. We will also take them to be smeared over distances that are small compared to their separation from the boundary of R, so that we do not have to worry about the difference between conventional and operator algebra quantum error correction. The global reconstructions (2.2) of these operators involve integrals over functions that vary smoothly on the scale of the radius of curvature of the boundary S d−1 , so we can integrate out all CFT degrees of freedom with shorter wavelength. 21 For concreteness we will consider the case of the N = 4 super Yang-Mills theory in 3 + 1 boundary dimensions with gauge group SU (N ), in which case we have n ∼ N 2 . (5.10) Erasing a disc of angular size θ will then correspond to erasing qubits, where this function is just n times the ratio of the area of the disc to the area of the S 3 . Let us first consider the case where the code subspace is small, that is when k ∼ 1. From (3.20) we then expect that we can correct for the erasure as long as n − 2l 1, or in other words θ < π. But this is exactly what we expect from the AdS-Rindler reconstruction; once θ < π, W C [A] will contain the center of the space. We can now start increasing k; nothing interesting will happen until we get k ∼ N 2 , after which the set of erasures we are able to correct will start decreasing. But this is exactly the condition for backreaction to become important in the center; with k ∼ N 2 the entropy of the code subspace is comparable to that of a black hole filling R and thus most states in the code subspace must actually be black holes. So both on the CFT side through equation (3.20) and the bulk side via backreaction we arrive at the same conclusion for when correctability should break down. This is a manifestation of the holographic entropy bound of [38].

Conclusion
In this paper we have provided what we consider to be a new understanding of how the holographic principle is realized in AdS/CFT. Bulk effective field theory operators emerge as a set of logical operations on an encoded subspace, which is protected against local errors in the boundary CFT. The bulk algebra is realized only on this subspace, and only if we do not try to describe too many operations at once. Asking for more causes the error correction procedure to fail, which in the bulk is manifested by the formation of a black hole.
To some extent we have only recast known facts about the AdS-Rindler reconstruction in a new language, but in our view that construction is quite opaque once the operators in the boundary domain of dependence of A are evolved back to the boundary Cauchy surface Σ at t = 0. Our description in terms of error correction is phrased entirely on this Cauchy surface, and gives what we feel to be a satisfying interpretation of how the AdS-Rindler reconstruction is realized in the CFT that cleanly resolves some of its paradoxical features.
It is of course interesting to ask if there are any implications of this work for the recent controversy on whether or not the interiors of black holes are describable in AdS/CFT; for now we leave this for future study.
where f ωλ (ρ, τ, α) is a solution of the Klein-Gordon equation of the form Here Y λ (α) is an eigenfunction of the Laplacian on H d−1 with eigenvalue −λ; the set of λ's is continuous (and positive) so " λ " should really be understood as shorthand for an integral together with a sum over degeneracies. ψ ωλ is explicitly given by The normalization is chosen to ensure that a and a † have the usual algebra, and implies that for ρ large and negative, ψ ωλ is of order 1 √ ω . F is a hypergeometric function that goes to one as ρ → ∞. By comparing to the extrapolate dictionary (1.1) we can read off that and substituting back into (A.2) and formally exchanging the τ α integral with the ωλ integral/sum we arrive at The "smearing function" K is given by K can be understood as a kernel for constructing a bulk solution of the KG equation in the AdS-Rindler wedge given arbitrary boundary conditions at spatial infinity as a function of τ and α. It was immediately realized however that in fact this expression for K is not well-defined [3] (see also [39,40]); the reason is that from Stirling's formula it is straightforward to see that at large λ we have This is problematic for the convergence of the λ integral in (A.9), and using the WKB approximation for Y and ψ at large λ it is not hard to see that indeed the integral does not converge for any choice of bulk and boundary points [4,39,40]. In fact, the nonconvergence of K is necessary to avoid the following paradox; say that we have two overlapping Rindler wedges, In [3] it was argued that one should analytically continue in the boundary spatial coordinates to avoid this divergence, but this is a rather unusual thing to do to a quantum field theory and would be rather problematic from the point of view of our analysis in this paper. The issue was recently illuminated considerably in [4], where it was argued that as long as we are careful to think of K as a distribution for integration against CFT correlation functions we are allowed to use it without any analytic continuations. The key point of [4] was that at least at leading order in 1/N , if we integrate K against appropriate bulk test functions then its singularity structure is such that we are always able to integrate it against CFT expectation values and get a reasonable answer. Intuitively, the reason that this is able to avoid the contradiction of the previous paragraph is that in the CFT O obeys a boundary equation of motion; we are not free to choose it independently at different boundary times. Turning on a source at x will necessarily propagate in the boundary into D[A] ∪ D[B], so we will not be able to change the boundary data at x without also changing it in D [A].
The argument of [4] does not immediately generalize to higher order corrections in 1/N , but we expect a more detailed analysis will show that it can be improved order by order in 1/N . 22 B The basic theorem of operator algebra quantum error correction In this appendix we prove the theorem of section 3.5. The proof is original, but the theorem is a special case of the results of [23,24].
Proof. Indeed say that we have a code subspace H C spanned by an orthonormal basis | i EE . Moreover say that O is an operator which acts as Finally, say that for any operator X E acting on E we have so this is all we need to show ((B.3) follows from applying projections to R). Our strategy then is to notice that we can decompose REE into a bipartite system in two different ways, either as the R system and the EE system or as the E system and the RE system. The first decomposition is manifest in (B.7), and since in this case C is just the identity we see that (B.6) holds and we have It will be very convenient in what follows to treat C as a rectangular matrix, with a being the first index and im being the second index. For example, we have the reduced density matrices Since g is a non-negative hermitian matrix with positive trace, it will be invertible on a subspace of E. Moreover, any state orthogonal to this subspace will also be orthogonal to all of the | i 's, so we can just take E to be given by this subspace; g is then invertible. This then means that C has a right inverse C † g −1 . Now observe that the commutator condition (B.2) implies that where we've used (B.13), so the second equation in (B.8) is also satisfied. This concludes the proof. 24 Intuitively this is because if we do a Schmidt decomposition of |φ into RE and E, we can choose a basis where C is actually a square matrix, so there is no difference between its left and right inverses. The condition (B.13) ensures us that O R acts within the subspace defined by the Schmidt decomposition.