Efficient entanglement distillation without quantum memory

Entanglement distribution between distant parties is an essential component to most quantum communication protocols. Unfortunately, decoherence effects such as phase noise in optical fibres are known to demolish entanglement. Iterative (multistep) entanglement distillation protocols have long been proposed to overcome decoherence, but their probabilistic nature makes them inefficient since the success probability decays exponentially with the number of steps. Quantum memories have been contemplated to make entanglement distillation practical, but suitable quantum memories are not realised to date. Here, we present the theory for an efficient iterative entanglement distillation protocol without quantum memories and provide a proof-of-principle experimental demonstration. The scheme is applied to phase-diffused two-mode-squeezed states and proven to distil entanglement for up to three iteration steps. The data are indistinguishable from those that an efficient scheme using quantum memories would produce. Since our protocol includes the final measurement it is particularly promising for enhancing continuous-variable quantum key distribution.

L ight is the most suitable carrier of quantum information over long distances. Distribution of entangled states of light among distant nodes of a quantum communication network 1,2 may be used for various purposes, such as quantum cryptography 3,4 or quantum teleportation [5][6][7] . However, the transmission of quantum states of light is, in practice, unavoidably affected by losses and other decoherence effects that usually grow with distance. To fight these detrimental effects, entanglement distillation can be used, which extracts from a large number of noisy and weakly entangled states a smaller number of copies with increased entanglement and purity [8][9][10][11][12][13][14][15][16] . Crucially, entanglement distillation only requires local quantum operations and classical communication between the spatially separated parties holding parts of the entangled state. A canonical iterative entanglement distillation protocol 8,9 is illustrated in Fig. 1a. At each step, two copies of a decohered entangled state are consumed and, with some probability, one copy of a distilled state with improved properties is produced, which in turn serves as the input for the next round of the protocol. An efficient implementation of this iterative protocol requires a quantum memory 17 , which motivates the extensive current effort for harnessing the quantum light-matter interface, ultimately leading to quantum repeaters 18 . Without quantum memory, all elementary two-copy distillation steps need to succeed simultaneously, which imposes an exponential overhead in terms of required resources, and hence drastically reduces the success rate of the protocol. Let us consider N iterations of the protocol and suppose, for simplicity, that the success probability of each elementary distillation step is the same and equal to P. A single attempt to perform N iterations requires 2 N input states, and all 2 N À 1 elementary distillation steps must succeed simultaneously. To obtain 1 distilled copy, one thus needs to consume on average 2 N =P 2 N À 1 input states. With quantum memories, the distillation becomes far more efficient because the successfully distilled states after each step of the protocol can be stored and used in the subsequent step as required. Ideally, this reduces the required number of input states to 2 N /P N . Note that the hardware-efficient pumping Gaussifier proposed in ref. 19 requires only a single quantum memory unit on each side, and enables sequential processing of the individual copies of distilled quantum state but achieves similarly inefficient distillation rate as a purely optical scheme without quantum memory.
To date, single-copy entanglement concentration 10,13,14,16,20 , and elementary two-copy entanglement distillation 11,12 have been demonstrated for both discrete-and continuous-variable quantum states of light. A collective three-copy distillation of continuous-variable entangled states could even be implemented 15 , but it remained inefficient in the absence of a quantum memory. Aside from this, an efficient realization of the full iterative multicopy entanglement distillation protocol could never be done because it is pending on operating an efficient quantum memory.
Here, we address this challenge from an opposite viewpoint and cancel out the need for quantum memories by exploiting the recently proposed concept of emulation of a quantum protocol 21,22 . The emulation replaces the actual physical implementation of a certain quantum operation by suitable postprocessing of measurement data and postselection, which offers a high potential to circumvent hardware implementation problems. In particular, the emulation of noiseless quantum amplification and attenuation by processing the data resulting from (eight-port) homodyne detection was proposed 21,22 , and a proof-of-principle experimental emulation of single-mode noiseless quantum amplification was reported 23 .
In this article, we apply such a strategy to multicopy continuous-variable entanglement distillation. Our scheme is solely based on the measurement data taken on a single beam of light that carries a continuous stream of copies of a decohered entangled state. Remarkably, due to the specific nature of the measurement and postprocessing, neither quantum memories nor the simultaneous physical realization of many copies are required, in contrast to the common knowledge on entanglement distillation. In principle, an arbitrary number of elementary (two-copy) distillation steps can be emulated by postprocessing the experimental data, solely limited by the length of the measured data stream. Specifically, we demonstrate the distillation of phase-diffused two-mode-squeezed states of light by iterative Gaussification 24-27 based on the interference of two copies of the state on balanced beam splitters, followed by projecting one output port on each side onto a vacuum state, see Fig. 1b. Here, we show that this scheme can be emulated by suitable processing of data obtained by eight-port homodyne detection on each mode of each phase-diffused state. Crucially, such emulation is completely indistinguishable from a full physical implementation with even ideal quantum memories to anyone outside Alice and Bob's labs. The only difference is that the distilled states are already detected and not physically available for further processing.
Nevertheless, the data may be used to fully characterize the distillation protocol and, for example, to extract a secret key from the distilled states. Our procedure is therefore particularly suitable for quantum cryptography, where it can convert seemingly useless highly noisy states into states that allow for the extraction of a secret key. It is similarly applicable to all related quantum communication protocols provided they terminate with suitable measurements.

Results
Emulation of iterative entanglement distillation. The starting point of our work is the iterative Gaussification scheme 24,25 illustrated in Fig. 1 Elementary two-copy distillation (E2CD) Increased entanglement and purity (1) (2) (3) ... copy of at t 0 b a Figure 1 | Iterative entanglement distillation. (a) At each elementary step of the protocol, two copies of the input state, described by the density matrices r, are combined to produce, with some probability, one output copy with better properties. (b) Elementary step of iterative Gaussification of two-mode continuous-variable quantum states. Alice's and Bob's modes locally interfere on balanced beam splitters and one output mode on each side is measured with a photodetector. The procedure succeeds if both modes are projected onto vacuum. A quantum memory was previously deemed necessary for an efficient implementation of such an iterative protocol as one must store the successfully distilled states in a quantum memory to make them available for subsequent distillation steps.
the Gaussification protocol requires two copies of a two-mode entangled state, whose modes are labelled as A 1 , B 1 , and A 2 , B 2 , respectively. Modes A 1 and A 2 belong to Alice, and modes B 1 and B 2 are held by Bob. Both Alice and Bob combine their pairs of modes on a balanced beam splitter and obtain output modes A þ , A À and B þ , B À , where þ and À refer to constructive and destructive interference, respectively. Subsequently, Alice and Bob perform photon number measurement on the modes A À and B À and exchange the measurement outcomes. This elementary distillation step is successful if both modes A À and B À are projected onto a vacuum state, and the distilled state in modes A þ and B þ provides the input for another round of the iterative protocol. Suppose now that Alice and Bob decide to measure the final distilled state with eight-port homodyne detectors, which perform projections onto coherent states. The generally impracticable implementation of the full iterative distillation protocol can be replaced by the following emulation procedure as depicted in Fig. 2. Alice and Bob perform the eight-port homodyne detection directly on the distributed decohered entangled state, and they repeat this measurement many times to collect a sufficiently large data set. Let a j and b j denote the measurement outcomes (complex amplitudes of coherent states) for the jth copy of the distributed state. Alice and Bob then combine the measurement results into pairs, say (a 2n , a 2n þ 1 ) and (b 2n , b 2n þ 1 ), and emulate the interference on beam splitters making the first layer of the protocol by performing simple additions and subtractions of the measurement results, which faithfully mimics interference of coherent states, Projection of the output modes A À and B À onto vacuum is equivalent to conditioning on a n, À ¼ b n, À ¼ 0. After the conditioning we obtain a reduced set of pairs a 1 ð Þ j ¼ a n j ; þ and b 1 ð Þ j ¼b n j ; þ where n j represent the values of n for which the conditioning was successful. These pairs of data represent effective measurement outcomes of eight-port homodyne detections on modes A and B of the distilled two-mode state after the first iteration of the distillation protocol. This procedure can be repeated, and outputs of the kth round of the protocol, a k ð Þ j and b k ð Þ j , can be used as inputs of the next round of the protocol, resulting in a Since the probability to obtain the specific outcomes a n, À ¼ b n, À ¼ 0 in eight-port homodyning vanishes, we need to modify the conditioning to make the protocol practicable. A theoretically appealing modification is to impose an acceptance probability that is a Gaussian function of the complex amplitudes, Physically, this corresponds to a modified conditioning in Fig. 1b, where modes A À and B À are projected onto thermal states with a mean number of thermal photons equal to n. The choice of Gaussian P acc guarantees that the iterative Gaussification protocol indeed converges to a Gaussian state 25,27 , which greatly simplifies its theoretical treatment and allows us to derive analytically the asymptotic state to which the protocol converges.
To be more specific, let us consider as an example the distillation of phase-diffused two-mode-squeezed states, as used in our experiment. A covariance matrix of the initial Gaussian symmetric two-mode-squeezed state before phase diffusion reads 1 Here, a denotes the (symmetric) variance of phase space projections of the complex amplitude (quadratures) of the individual modes, and b represents the correlations between quadratures of modes A and B. Suppose now that modes A and B are sent through noisy channels where random phase shifts f A and f B are imposed. For the sake of simplicity, we shall assume that the phase diffusions are independent and have the same statistics for both modes (although our results can be easily extended to more general scenarios). Note that the phase-noise does not modify the value of parameter a, since each mode is locally in a thermal state that is invariant under phase-shift. So the covariance matrix of the phase-diffused non-Gaussian state at the output of the noisy channels preserves the form (3), but the phase diffusion reduces the intermodal correlations, where q ¼ hcosf A cosf B i quantifies the phase diffusion for uncorrelated noise. The stronger the phase diffusion, the smaller is |q|. We assume here that the phase noise is symmetric,  Figure 2 | Emulation of iterative Gaussification protocol. A single, continuously operated source distributes copies of the entangled and decohered states r to Alice and Bob. The states' coherent amplitudes are locally measured with two out-of-phase BHDs each, the so-called eight-port homodyne detectors. By prolonging the measurement time any quantity of copies may be generated. An emulated iterative distillation protocol based on the local operations and classical communication is realized as described in the main text. In the end, Alice and Bob share data that are equivalent to that from measurements on distilled entangled states.
and f B , the covariance matrix g AB of an input two-mode state is transformed according to Rg AB R T with describing the action of the particular phase-shift values f A and f B at the level of the covariance matrix. This expression has to be averaged over the random phase shifts to obtain the resulting covariance matrix of the de-phased state. Note that in this last averaging step we assume that the mean values of quadratures of the input state vanish, which is satisfied in our experiment where we utilize squeezed vacuum state. If non-zero, the mean values can be eliminated and set to zero by suitable local coherent displacements, which in our emulation-based scheme can be implemented simply as displacements of the measured data. With the help of the general theory of iterative Gaussification protocols presented in ref. 27, one can derive the following analytical expression for the covariance matrix of the asymptotic Gaussian state, Where, I denotes the identity matrix and h.i f represents statistical averaging over random phase diffusions. The performance of the distillation protocol and its usefulness for quantum key distribution is illustrated in Fig. 3. The squeezing properties of the two-mode state can be characterized by the squeezed variance V sq defined as the minimum eigenvalue of the covariance matrix, V sq ¼ min(eig(g AB )), while entanglement can be detected using the Duan-Simon criterion 28,29 . Technically, one has to determine the minimum symplectic eigenvalue m of a covariance matrix corresponding to the partially transposed state, and entanglement is witnessed if mo1. For a symmetric two-mode-squeezed state as in equation (3), we find that V sq ¼ m ¼ a À |b|, hence the presence of squeezing, V sq o1, also indicates that the state is entangled. In Fig. 3a, the dependence of m on the dephasing parameter q is plotted for the phase-diffused state (blue solid line) and the asymptotic distilled state for different n (red lines). The enhancement of entanglement by distillation is clearly visible, and the closer we choose n to zero (which corresponds to projection on vacuum) the stronger is the effect. Importantly, the distillation protocol can even recover seemingly lost quadrature entanglement as the distilled state can exhibit mo1 even if the initial phase-diffused state exhibited m41. Distillation of entanglement necessarily implies that the input state was (weakly) entangled too. However, its initial entanglement is not visible via the covariance matrix (which is consistent with a separable Gaussian state) but hidden in higher-order correlations of the quadratures.
We can determine the maximum tolerable phase noise (minimum |q|) for which we can still distil Gaussian entanglement. For the pure symmetric two-mode Gaussian state with covariance matrix given by equation (3), and a ¼ cosh(2r) and b ¼ sinh(2r) we find that the Gaussian entanglement is asymptotically distilled provided that n n þ 1 tanh ro q j j: ð7Þ Here, r denotes the squeezing parameter of the squeezed input states. If we project on vacuum ( n ¼ 0) then entanglement is distilled for any r40 and |q|40. For n40, however, entanglement is only distilled in the asymptotic limit if the dephasing is not too large (|q| not too small). For mixed states, the entanglement might not be distillable even if n ¼ 0, c.f. the red solid line in Fig. 3a which crosses the horizontal line m ¼ 1 at non-zero q.
We can go further and calculate the distillable secret key in continuous-variable quantum key distribution K ¼ I AB À w AE (Fig. 3b), where I AB is the mutual information between Alice's and Bob's data and w AE is Eve's classically accessible information on Alice's quantum state. The key rate can be calculated analytically using the optimality of Gaussian attacks 30-32 and the well-known formulas for entropies of Gaussian probability distributions and Gaussian quantum states (see refs 1,21,33 for more details). As shown in Fig. 3b, the distillation protocol can significantly enlarge the range of q values for which a secret key can be distilled. Crucially, the key rate for the distilled state can be positive even if the initial phase-diffused state does not exhibit squeezing, V sq 41, that is, if its covariance matrix is compatible with that of a Gaussian separable state. In such a case, no secure key could be obtained from the decohered state by any protocol involving Gaussian measurements and a security analysis based on the covariance matrix of that state. The emulation of iterative entanglement distillation can thus efficiently convert seemingly useless noisy data into data from which a non-zero secret key could be extracted.
Experimental setup. A schematic picture of the experimental setup is shown in Fig. 4. In a first step, we generated two Gaussian entangled light fields, which was achieved by superimposing two squeezed vacuum states on a balanced beam splitter with a 90°p hase-shift (refs 6,34). Previous realizations of multicopy continuous-variable entanglement distillation protocols used the  Figure 3 | Entanglement distillation of phase-diffused two-modesqueezed states. Squeezing variance V sq (a) and distillable secret key K (b) are plotted for the phase-diffused state (blue) and for the asymptotic distilled state for different n (red lines). n gives here the mean number of thermal photons of the state we project onto. The parameter q quantifies the strength of the phase diffusion: q ¼ 1 indicates that no phase noise is present, whereas q ¼ 0 corresponds to a completely randomized phase. The parameters of the input state before phase-diffusion read a ¼ 3.583 and b ¼ 3.417, which corresponds to variances of squeezed and anti-squeezed quadratures V sq ¼ 1/6 and V antisq ¼ 7.
so-called v-class entangled states 12,15 , which are simply achieved by superimposing a squeezed-vacuum mode and an ordinary vacuum mode on a balanced beam splitter. Replacing the vacuum mode by a second squeezed light field increases the experimental effort, but also allows, in principle, stronger entanglement, which is needed for QKD. Our scheme has the advantage that the (efficient) multistep iterative distillation of entanglement only requires at-most two squeezed light sources, whereas an actual hardware implementation of a (still inefficient) iterative distillation without quantum memories requires doubling the number of squeezed light sources with each iteration step. In our proof-of-principle experiment the squeezed-vacuum sources produced slightly different squeezing values, around 3 dB. Due to this asymmetry the covariance matrix of the entangled state did not hold the form given by equation (3) but was given by g AB;exp ¼ 3:20 À 0:13 À 2:90 À 0:04 À 0:13 6:24 À 0:03 6:08 À 2:90 À 0:03 3:70 À 0:06 À 0:04 6:08 À 0:06 6:83 We reconstructed this covariance matrix by measuring the prepared state without additional phase diffusion with the eight-port homodyne detectors and using the formula g AB,exp ¼ 2g EHD À I, where g EHD is a covariance matrix calculated directly from the eight-port homodyne data, and I denotes the identity matrix. The small values at the off-diagonal elements are not exactly zero due to imprecisions in the quadrature phases. The different values of the diagonal elements are mainly caused by the different squeezing values. The matrix g AB,exp was reconstructed without correcting for detection inefficiencies and detector dark noise. For this reason, the covariance matrix is a good description of the actual measurement data (but a less good description of the quantum state before detection). We note that two-mode squeezing of 410 dB has already been demonstrated 34 and our scheme would work equally well with these higher squeezing strengths. Our entangled modes were distributed between Alice and Bob's sites. During transmission, the modes were exposed to independent phase noise, which models a noisy transmission through, for example, optical fibres. The noise was applied by varying the position of steering mirrors in the path, driven by piezo electric transducers. We varied the strength of the noise by The entangled outputs are sent to two separate sites. During transmission the modes are exposed to phase noise, which produces de-Gaussified mixed quantum states. For strong phase noise the two-mode squeezing, that is, the entanglement in the second moments of the quadratures, is completely destroyed. The decohered modes are continuously and unconditionally detected by eightport homodyne detectors, which have negligible intrinsic phase noise and detection efficiencies of about 87 ± 6%. DBS, dichroic beam splitter. The panels a-f show the dependences of V sq , m and P G on the threshold T acc and success probability p for one (red, circle), two (blue, square) and three (green, triangle) iterations of the distillation protocol as discussed in the main text. The error bars give a 2s confidence interval and are obtained by bootstrapping the samples 100 times where the length of each bootstrapping sample equals the length of the analysed data set. The solid lines give theoretical predictions obtained by Monte Carlo simulations for 10 10 samples. These simulations use the measured undiffused covariance matrix (equation 8) and the experimentally determined phase-noise factor q ¼ 0.78. The model takes into account additional losses induced by the implementation of our de-phasing channel, and, for simplicity, we assume an uncorrelated Gaussian distribution of the random phase shifts with equal variances. The general good agreement between simulation and experiment suggests that our model represents a good approximation. The discrepancy for V sq can be explained by the fact that the actual phase noise does not precisely meet our assumptions. By a slight change of q we could get a good fit for V sq at the expense of a worse fit for m. The short fading horizontal lines represent the asymptotic limit for projection onto vacuum ( n ¼ 0).
amplifying or attenuating the voltage given to the actuators to examine the behaviour of the protocol for different noise strengths. For all measurements shown in the next section we used the same phase diffusion which corresponded to q ¼ 0.78. At the sites, the received light beams were absorbed in eight-port homodyne detectors, consisting of a balanced beam splitter and two conventional balanced homodyne detectors (BHDs), which measure the amplitude and phase quadrature on the first and the second beam, respectively. This measurement corresponds to a projection onto coherent states. The recorded data provided the basis to execute the emulated distillation protocol.
Experimental results. In the experiment, we collected up to 5 Â 10 8 data points for a fixed strength q of phase noise, and we emulated up to three rounds of the iterative entanglement distillation protocol. To simplify data processing, we used a deterministic conditioning rule and the elementary entanglement distillation step was taken successful if |a À |oT acc and |b À | oT acc , where T acc is a tunable threshold. While such conditioning may lead to some residual non-Gaussianity of the asymptotic state, it does not modify the qualitative properties of the distillation protocol. We have used the resulting data to reconstruct the covariance matrix g of the two-mode state after each iteration of the distillation protocol, and we have used the covariance matrix to determine various properties of the distilled state. The results are plotted in Fig. 5, which shows the two-mode squeezing variance V sq , the symplectic eigenvalue m witnessing entanglement, and the quantity P G ¼1= ffiffiffiffiffiffiffiffiffi det g p , which for Gaussian states coincides with the state purity. Figure 5a-c illustrate that each iteration of the protocol increases squeezing and (Gaussian) entanglement of the distilled state for a fixed threshold T acc , as indicated by the reduction of V sq and m. Furthermore, P G increases with the number of iterations, which is a strong indication that the purity of the state is increased by the protocol. The absolute bounds presented in all panels are the asymptotic bounds for projection onto vacuum ( n ¼ 0) calculated with equation (6). Statistical properties of the random phase shifts required for evaluation of the phase average in equation (6) were determined by comparing the covariance matrices of the initial and the de-phased states. It is remarkable how close the data come to the absolute bound with only three iteration steps and a finite threshold T acc . Figure 5d-f show the practically more relevant dependence of V sq , m and P G on the total success probability of the protocol p, which was determined as the ratio of the number of distilled copies of the state versus the total number of input copies of the state. These plots fully demonstrate the usefulness of an iterative distillation scheme. For a fixed total success probability, more iterations may be advantageous as they lead to better squeezing, entanglement and purity. The crossover between one and two iterations is clearly and unambiguously demonstrated by the data, while the crossover between two and three iterations can be seen in the region of 10 À 4 oPo10 À 3 , albeit the results in this region are already affected by statistical uncertainties. We have repeated the experiment for several different strengths of phase noise, and the results were in all cases qualitatively similar to those shown in Fig. 5.
We emphasize that the emulated iterative entanglement distillation presented here is inherently as efficient as if the protocol had been implemented with quantum memories, which would store successfully distilled states from previous rounds of the protocol to be utilized in the next rounds of the protocol. In the emulation, we naturally use in the subsequent rounds of the protocol only the successfully distilled states from previous rounds, which ensures that the average number of input copies that are consumed to produce a single distilled copy scales exactly as if quantum memories had been used.

Discussion
Our proof-of-principle experiment paves the way to efficient quantum communication protocols, where a specific data processing mimicks quantum memories (hence, provides the same advantage in terms of resources) without actually requiring them. This strategy can be applied at the end points of any entanglement distribution scheme where the end users perform eight-port homodyne detection. Importantly, our protocol is not limited to schemes where entanglement is physically distributed, but is also applicable to a prepare-and-measure quantum key distribution schemes where Alice prepares Gaussian-modulated coherent states and sends them to Bob who performs eight-port homodyne detection 35 . Indeed, since the preparation of coherent states by Alice is indistinguishable from the preparation of two-mode-squeezed vacuum followed by eight-port homodyne detection on Alice's mode, the preparation can be equivalently interpreted as a measurement on a (virtual) shared entangled state. Similarly, our procedure is also applicable to the recently proposed and demonstrated measurement-device independent continuousvariable QKD protocol 36,37 , where Alice and Bob both prepare randomly modulated coherent states and send them to an untrusted relay which performs a continuous-variable Bell measurement on the two modes and publicly announces the results of the measurement. Given its wide range of potential applications, our proposal represents a promising tool for improving the performance of various quantum communication systems.

Methods
Squeezed-light preparation. The main light source was a Nd:YAG laser that produced a continuous-wave field at a wavelength of 1064 nm, as well as frequency-doubled light at 532 nm. The infrared light provided the control fields for the active-length stabilization of two squeezed-light resonators containing 7% magnesium-oxid-doped lithium-niobate crystals (MgO:LiNbO3), as well as the optical local oscillators for homodyne detection. The green light field was mode-matched into the squeezed-light resonators to pump degenerate type I parametric-downconversion processes, which provided resonator output modes at 1064 nm in squeezed-vacuum states. The squeezed-light resonators were singly resonant for 1064 nm, had a standing-wave and half-monolithic design, and a length of about 40 mm. The resonators' coupling mirrors were attached to piezo electric transducers to stabilize the cavity lengths on resonance using the Pound-Drever-Hall locking scheme 38,39 . An active temperature control stabilized the crystal temperatures at phase matching of the fundamental and the harmonic fields at about 60°C.
Light detection and data acquisition. The two-mode (squeezed) state was detected with two eight-port homodyne detectors incorporating altogether four conventional BHDs. Each BHD consisted of a balanced beam splitter, two high-quantum efficiency PIN photodiodes and used a homodyne local oscillator power of about 3 mW at 1064 nm. The difference photo-electric current of the two photodiodes was amplified and transferred to a voltage by a trans-impedance amplifier. The voltage signal was then mixed with a 6.4 MHz electronic local oscillator, anti-alias filtered with a corner frequency of 400 kHz and finally synchronously sampled at a frequency of 1 MHz.
Data availability. The data that support these findings are available from the corresponding author on request.