Introduction

One of the most fascinating aspects of quantum information is how classical communication can enhance quantum information processing. For instance, “mixed” entanglement shared between two or more parties can be “purified” when the parties are allowed to perform Local quantum Operations on their subsystems and Communicate Classically with one another1, a process known as LOCC. An analog of this purification procedure can be found in the classical theory of secret correlations. Rather surprisingly, secret correlations shared between two or more parties can be strengthened by the parties performing Local stochastic Operations and “leaking” information partially through Public Communication2,3,4, a process known as LOPC. In all LOCC/LOPC protocols, the parties take turns exchanging information with one another, information that is extracted locally from their respective subsystems and earlier rounds of communication. In both settings, the principle is the same: resource manipulation (whether it be entanglement or secrecy) becomes more powerful when public classical communication is allowed.

For a distributed information-theoretic task, its communication complexity quantifies the minimum amount of messages that must be exchanged in order to perform the task5,6,7,8. A more fine-grained notion of communication complexity emerges by considering communication exchanges within a certain number of rounds. The r-round communication complexity of a task is the minimum amount of communication needed to perform the task in a protocol, lasting no more than r-rounds. The subject of r-round communication complexity has received notable attention on both the classical and quantum sides9,10,11,12,13,14. One of the most well-known examples is the so-called “pointer jumping” problem, which is known to demonstrate an exponential gap between the r − 1 and r-round communication complexity when computing the r th pointer value15,16,17. Even stronger, such a gap exists if quantum communication is allowed12 (i.e., the parties can exchange qubits with one another each round, something prohibited in the LOCC model).

The complexity of a distributed information-processing task can also be measured in terms of its round complexity, which quantifies the minimum number of communication rounds needed to perform the task, regardless of the total communication cost. Round complexity becomes an important question in distributed tasks where the parties do not want to share with one another all their local information, such as in secure function computation18 and interactive prover scenarios19. Round complexity is also a meaningful measure of complexity when constraints are placed on the allowed types of communication, particularly in the LOPC/LOCC frameworks where private/quantum communication is not allowed. Without such constraints, one round of communication is always sufficient to perform any distributed information processing task since one party can just transmit all of his/her local information to the other. In contrast, certain tasks such as generating secret correlations/quantum entanglement are impossible in the LOPC/LOCC settings, even when the parties can exchange an unbounded amount of public communication.

LOPC/LOCC round complexity is thus a fundamental property of multi-party tasks that captures the necessity of interaction for optimal resource manipulation. An important practical motivation for studying this property follows from relativistic constraints that place a limitation on how quickly messages can be sent between spatially separated parties. Round complexity thereby places a lower bound on the time needed to perform a given task. As a result, with more round complexity, there is a greater reliance on classical or quantum memories, something generally undesirable due to the fragility of quantum systems.

A comprehensive understanding of LOCC/LOPC round complexity is still lacking. It is known that two-round protocols can be strictly superior to one-way schemes for distilling classical key from wire-tapped sources3. On the quantum side, clear separations between one-round and two-round protocols have been demonstrated for various quantum information-processing tasks such as asymptotic entanglement distillation1, tripartite entanglement transformations20, quantum state discrimination21,22,23,24,25, and recently, the simulation of nonlocal gates using shared entanglement26. However, none of these results have been able to establish an operational separation between each of the finite-round LOCC classes in terms of the most basic LOCC tasks: manipulating a quantum state from one form to another. It has been previously unknown whether or not every LOCC transformation ρ → σ can be completed using a constant number of communication rounds, even if an unbounded amount of classical communication is allowed.

Here we construct, for any integer r ≥ 1 families of quantum (resp. classical) states for which a minimum of r communication rounds is both necessary and sufficient to obtain pure-state entanglement (resp. secret shared randomness). Such a phenomenon might be unexpected given that every bipartite pure-state transformation |ψ〉 → |ϕ〉 can be accomplished in just one round of LOCC, regardless of the dimensions27. Our findings imply that there exists no universal upper bound on the number of LOCC/LOPC rounds needed to perform such tasks, universal in the sense that it holds for states of all dimensions/alphabet size. Rigorously proving that this claim is a delicate matter since the general structure of LOCC and LOPC protocols is quite complex, allowing for arbitrary local operations and arbitrary interactive communication schemes28. With this complexity, it is difficult to definitively rule out the possibility of some clever round-compression technique that could always reduce the number of communication exchanges below some finite threshold, regardless of the system sizes. In fact, such a clever round-compression strategy is precisely what allows for the restriction to just one-way protocols for all bipartite pure-state transformations |ψ〉 → |ϕ〉29. Our work makes use of an analogous structure underlying both LOCC and LOPC protocols, and it conducts an analysis that applies to both the quantum and classical problems.

Results

The LOCC and LOPC frameworks

The problems studied in this paper involve two trustworthy parties (Alice and Bob) and one unwanted third party (Eve). When Alice, Bob, and Eve are holding quantum systems, we denote their joint state by ρ ABE. In contrast when Alice, Bob, and Eve are holding random variables X, Y, and Z, we denote their joint probability distribution by p XYZ. These variables range over sets \({\cal X}\), \({\cal Y}\), and \({\cal Z}\) , respectively, and the probability of event (x, y, z) will be denoted by \(p_{xyz}^{XYZ}\). When the underlying random variables are clear, we will simply write the probabilities by p xyz . Conditional probabilities are denoted, for example, by \(p_{xy|z}^{XY|Z = z}\).

In an LOCC protocol, Alice and Bob take turns performing a local quantum instrument, which is a collection of completely positive (CP) maps \(\left\{ {{\cal E}_\lambda } \right\}_\lambda\) such that \(\mathop {\sum}\nolimits_\lambda {\kern 1pt} {\cal E}_\lambda\) is trace-preserving28. The index λ represents the “measurement outcome” of the instrument, which is communicated to the other party, thereby correlating the choice of future local instruments to previous measurement outcomes. For the problem considered in this paper, we will be considering instruments in which each local CP maps has the form \({\cal E}_\lambda (\rho) = K_\lambda \rho K_\lambda ^{\mathrm{\dagger }}\), where the {K λ } λ form a complete set of Kraus operators; i.e., \(\mathop {\sum}\nolimits_\lambda {\kern 1pt} K_\lambda ^{\mathrm{\dagger }}K_\lambda = {\Bbb I}\).

In an LOPC protocol, Alice and Bob share random variables X and Y, respectively. They proceed with multiple iterations of public communication where the i th message M i is the stochastic output of a channel performed to (P, M <i ), where P ∈ {X, Y} is the variable of the announcing party in the i th round and \(M_{ < i} = M_1 \cdots M_{i - 1}\) denotes the sequence of messages generated in the previous i − 1 rounds. At the end of the protocol, Alice and Bob generate output variables \(\widehat X\) and \(\widehat Y\) that are obtained by processing (X, M) and (Y, M), respectively, where M represents all communication variables generated throughout the protocol. For both LOCC and LOPC, an r-round protocol consists of r classical communication exchanges between the parties.

One conceptual difference between the LOCC and LOPC settings is that in the latter, the presence of an unwanted eavesdropping party is always taken into account. Thus, a copy of the public communication M is shared by Eve, and a general LOPC protocol generates a transformation of probability distributions

$$p^{XYZ} \to p^{\hat X\hat Y\left({ZM} \right)}.$$
(1)

The fundamental resource unit in entanglement theory is the entangled bit (ebit), which has the form \(\left| {\mathrm{\Phi }} \right\rangle ^{AB} = \sqrt {1{\mathrm{/}}2} \left({\left| {00} \right\rangle ^{AB} + \left| {11} \right\rangle ^{AB}} \right)\). In classical secrecy theory, the basic resource unit is the secret bit (sbit). This is any distribution over the sets \(\{ 0,1\} \times \{ 0,1\} \times {\cal Z}\) of the form \(p_{xyz}^{XYZ} = \frac{1}{2}\delta _{xy}p_z^Z\), where p Z is an arbitrary distribution for Eve. Alice and Bob’s main concern is how much Eve is correlated with their variables, rather than the specific distribution over her variable. Hence, we will adopt the notation that Φ denotes a sbit, with Eve’s uncorrelated distribution being unspecified. For partially entangled two-qubit states and for non-uniform secret-shared bits, we will write

$$\left| {{\mathrm{\Phi }}_\lambda } \right\rangle = \sqrt \lambda \left| {00} \right\rangle + \sqrt {1 - \lambda } \left| {11} \right\rangle$$
(2)
$${\mathrm{\Phi }}_\lambda = \lambda \delta _{X0}\delta _{Y0} + (1 - \lambda)\delta _{X1}\delta _{Y1}.$$
(3)

Here δ X0, for example, is the distribution over \({\cal X}\) that has x = 0 with unit probability. The entropy of Φ λ is h(λ), where \(h(x) = - x{\kern 1pt} {\mathrm{log}}{\kern 1pt} x - (1 - x){\kern 1pt} {\mathrm{log}}(1 - x)\).

Transformations with high round complexity

Our results are based on a family of tripartite distributions, which we call the origami distributions. The family is given by the set \(\left\{ {{\bf{b}}^{\left({i,\lambda } \right)}:i \in {\Bbb N},\,0 < \lambda \le 1{\mathrm{/}}2} \right\}\), with b (i,λ) being a tripartite probability distribution taking on values \({\bf{b}}_{xyz}^{\left({i,\lambda } \right)}\) for each fixed pair of values (i,λ); i.e., event (x, y, z) occurs with probability \({\bf{b}}_{xyz}^{\left({i,\lambda } \right)}\) and \(\mathop {\sum}\nolimits_{xyz} {\kern 1pt} {\bf{b}}_{xyz}^{\left({i,\lambda } \right)} = 1\). The structure of these distributions is described recursively with b (1,λ) having the form:

The 8 events of (x, y, z) having nonzero probability in b (1,λ) are those in which z lies in row y and column x, as shown in this grid. The probabilities of these events are \({\bf{b}}_{xy|z}^{\left({1,\lambda } \right)} = \lambda\) for even values of x, \({\bf{b}}_{xy|z}^{\left({1,\lambda } \right)} = 1 - \lambda\) for odd values of x, and \({\bf{b}}_z^{\left({1,\lambda } \right)} = 1{\mathrm{/}}4\). In other words, b (1,λ) consists of four blocks of uniform probability, each corresponding to a different value of z. Within each block, X and Y are perfectly correlated, but with a nonuniform distribution (λ, 1 − λ). For example, the event (X = 1, Y = 2, Z = 3) occurs with probability 1/8 according to distribution b (1,λ), while the event (X = 1, Y = 2, Z = 2) occurs with probability zero.

Before describing the full set of distributions \(\{ {{\bf{b}}^{\left({i,\lambda } \right)}} \}_{i \in {\Bbb N}}\), let us note the crucial structural properties of b (1,λ) that we will want to generalize. The distribution b (1,λ) decomposes into two parts —the first with Y ∈ {0, 1} and the second with Y ∈ {2, 3}—such that within each of these sub-parts Alice can determine both the value of Y and Z from her value of X (see Fig. 1). A simple one-round protocol allowing Alice to “unlock” this information involves Bob announcing message M where M = 0 if Y ∈ {0, 1} and M = 1 if Y ∈ {2, 3}. This message will not leak any information to Eve, since by the structure of b (1,λ), M is also a function of Z; i.e., Eve learns no more information about XY from M than what she already knows from Z. Secret correlations Φ λ are then obtained by Alice and Bob applying the local functions:

$$\widehat X = \left\{ {\begin{array}{*{20}{c}} {{\mathrm{0}}\,{\mathrm{if}}\,X \in \{ {\mathrm{0}},{\mathrm{3}}\} \,{\mathrm{and}}\,M = {\mathrm{0}},\,{\mathrm{or}}\,X \in \{ {\mathrm{1}},{\mathrm{2}}\} \,{\mathrm{and}}\,M = {\mathrm{1}}} \\ {{\mathrm{1}}\,{\mathrm{if}}\,X \in \{ {\mathrm{0}},{\mathrm{1}}\} \,{\mathrm{and}}\,M = {\mathrm{1}},\,{\mathrm{or}}\,X \in \{ {\mathrm{2}},{\mathrm{3}}\} \,{\mathrm{and}}\,M = {\mathrm{0}}} \end{array}} \right.,\;\\ \widehat Y = \left\{ {\begin{array}{*{20}{l}} {{\mathrm{0,}}\,{\mathrm{if}}\,Y\,{\mathrm{is}}\,{\mathrm{even}}} \hfill \\ {{\mathrm{1,}}\,{\mathrm{if}}\,Y\,{\mathrm{is}}\,{\mathrm{odd}}} \hfill \end{array}} \right..$$
(5)

Even in this relatively simple case, it is not immediately obvious that the described LOPC protocol is essentially the only one-round protocol allowing Alice and Bob to establish secret key. However, the structure of b (1,λ) ensures that Eve will have side information of any common function \(J = \widehat X = \widehat Y\) computed locally by Alice and Bob unless at least one of the parties can determine the value of Z (see Supplementary Note 1). The only way to achieve this in one-round of communication is by Bob revealing whether Y ∈ {0, 1} of Y ∈ {2, 3}.

Fig. 1
figure 1

A One-Round LOPC for Obtaining Secret Correlations from b (1,λ). Bob announces whether the value of Y belongs to either {0, 1} or {2, 3}. Using this information, Alice can determine the values of both Y and Z from her value of X. Relabeling then brings Alice and Bob’s distribution into standard form Φ λ , independent of Z

Full size image

To build larger-round distributions, the idea will be to “copy and shift” b (1,λ) into a multi-layered structure so that going from one layer to the next requires performing the one-round protocol just described. More precisely, for each fixed value of λ the i th distribution in the family \(\left\{ {{\bf{b}}^{\left({i,\lambda } \right)}:i \in {\Bbb N},\;0 \, < \, \lambda \le 1{\mathrm{/}}2} \right\}\) is built according to the following prescription:

where \(\overline {{\bf{b}}^{\left({n,\lambda } \right)}}\) is obtained from b (n,λ) by interchanging the row (resp. column) i with row (resp. column) \(i + 2^{\left\lfloor {n{\mathrm{/}}2 + 1} \right\rfloor }\) for all odd i whenever n is odd (resp. even), and Eve’s values are increased by 2n from the original values in b (n,λ). In each grid, all of Eve’s values are still equiprobable, and for each value of z, Alice and Bob have shared randomness with \({\bf{b}}_{xy|z}^{\left({n,\lambda } \right)} = \lambda\) for even values of x. The distribution b (n,λ) thus ranges over sets \({\cal X}\), \({\cal Y}\), and \({\cal Z}\) with respective cardinalities \(\left| {\cal X} \right| = 2^{\left\lfloor {n{\mathrm{/}}2 + 2} \right\rfloor }\), \(\left| {\cal Y} \right| = 2^{\left\lfloor {n{\mathrm{/}}2 + 3{\mathrm{/}}2} \right\rfloor }\), and \(\left| {\cal Z} \right| = 2^{n + 2}\).

We call these origami distributions, due to the “unfolding” appearance of the construction. For example,

We now use the origami distributions to construct bipartite quantum states. This is accomplished by first embedding each distribution b (i,λ) into a tripartite quantum state according to

$$\begin{array}{*{20}{l}} {\left| {{\bf{b}}^{\left({i,\lambda } \right)}} \right\rangle ^{ABE}} \hfill & \hskip-8pt = \hfill &\hskip-7pt {\mathop {\sum}\limits_{x,y,z} {\kern 1pt} \sqrt {{\bf{b}}_{xyz}^{\left({i,\lambda } \right)}} \left| x \right\rangle ^A\left| y \right\rangle ^B\left| z \right\rangle ^E} \hfill \\ {} \hfill & \hskip-8pt = \hfill &\hskip-7pt {\frac{1}{{\sqrt {2^{i + 1}} }}{\kern 1pt} \mathop {\sum}\limits_z {\kern 1pt} \left| {\psi _z^{\left({i,\lambda } \right)}} \right\rangle ^{AB}\left| z \right\rangle ^E,} \hfill \end{array}$$
(9)

where \(\left| {\psi _z^{\left({i,\lambda } \right)}} \right\rangle ^{AB}: = \mathop {\sum}\nolimits_{x,y} {\kern 1pt} \sqrt {{\bf{b}}_{xy|z}^{\left({i,\lambda } \right)}} \left| x \right\rangle ^A\left| y \right\rangle ^B\). Notice that the von Neumann entropy of the reduced-state of \(\left| {\psi _z^{(i,\lambda)}} \right\rangle ^{AB}\) is h(λ) for every z and i. Alice and Bob’s reduced state is then given by \(\rho _{\bf{b}}^{\left({i,\lambda } \right)}: = {\mathrm{tr}}_E{\kern 1pt} \left({\left| {{\bf{b}}^{\left({i,\lambda } \right)}} \right\rangle \left\langle {{\bf{b}}^{\left({i,\lambda } \right)}} \right|} \right)\). The main results of this paper are stated in the following theorem.

Theorem 1

For any pair (r, λ) and any 0 < λ′ ≤ 1/2, the LOPC transformation

$${\bf{b}}^{\left({r,\lambda } \right)} \to {\mathrm{\Phi }}_{\lambda \prime }$$
(10)

and the LOCC transformation

$$\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle$$
(11)

are both impossible using r − 1 rounds of communication exchanges, nor are they possible in r rounds if Alice (resp. Bob) is the first to announce when r is odd (resp. even). Conversely, for λ′ ≤ λ ≤ 1/2 the transformations are possible in r rounds if Bob (resp. Alice) is the first to announce when r is odd (resp. even).

The classical secrecy rank

A key tool in proving the classical part of Theorem 1 is, what we will call, the secrecy rank of a tripartite distribution. Its construction is based on the so-called secret key cost of a tripartite distribution30, a quantity whose single-letter characterization31,32 has close connections to Wyner’s classic notion of common information33. A detailed exploration of the relationship between all these quantities is beyond the scope of this paper and will be saved for future work.

In what follows, for a distribution p W over the set \({\cal W}\), we let |p W| denote the number of events in \({\cal W}\) with a nonzero probability.

Definition 1

The secrecy rank of tripartite distribution p XYZ is defined as

$${\rm{Srk}}\left[ {p^{XYZ}} \right] = \mathop {{{\rm{min}}}}\limits_{X - ZW - Y} {\kern 1pt} \mathop {{{\rm{max}}}}\limits_z {\kern 1pt} \left| {p^{W|Z = z}} \right|,$$
(12)

where the minimization is taken over all auxiliary random variables W such that I(X:Y|ZW) = 0.

Let us describe how this quantity is analogous to the quantum Schmidt rank. First consider the case when Z is trivial; i.e., |p Z| = 1. The Schmidt decomposition of a bipartite pure state has the form \(\left| \varphi \right\rangle ^{AB} = \mathop {\sum}\nolimits_{w = 1}^{{\rm{Srk}}\left({\left| \varphi \right\rangle } \right)} {\kern 1pt} \sqrt {p_w} \left| {\alpha _w} \right\rangle ^A\left| {\beta _w} \right\rangle ^B\) , where the \(\left\{ {\left| {\alpha _w} \right\rangle ^A} \right\}\) and \(\left\{ {\left| {\beta _w} \right\rangle ^B} \right\}\) form orthonormal bases for Alice and Bob’s systems, respectively. Suppose that Alice and Bob both measure |φ〉AB by projecting in their Schmidt basis. If X (resp. Y) is the random variable describing Alice’s (resp. Bob’s) outcomes, then their measurement statistics can be described as the marginal of the tripartite distribution p XYW where \(p_{xyw}^{XYW} = \delta _{xw}\delta _{yw}p_w^W\); i.e., X − W − Y. Clearly \({\rm{Srk}}\left({\left| \varphi \right\rangle } \right) = {\rm{Srk}}\left({p^{XY}} \right)\). In the case that Z is not trivial, the definition of Eq. (12) most closely resembles the definition of Schmidt rank for bipartite mixed states, as proposed in ref. 34. Namely, for a density matrix ρ AB, one minimizes the quantity Srk(\({\frak E}\)) over all pure-state ensembles \({\frak E}\) = \(\left\{ {\left| {\psi _i} \right\rangle ^{AB},q_i} \right\}\) generating ρ AB, where Srk(\({\frak E}\)) is the maximum Schmidt rank of all the states in \({\frak E}\). For classical distributions p XYZ, one can think of p XYZ as defining an ensemble of bipartite classical states \({\frak E}\) = \(\left\{ {p^{XY|Z = z},p_z^Z} \right\}\). There is no minimization over ensembles as in the quantum case and therefore, one obtains the secrecy rank of p XYZ by just taking the maximum secrecy rank of all the states in \({\frak E}\). This is precisely what Eq. (12) gives.

Another similarity between the secrecy rank and the Schmidt rank concerns their monotonicity.

Theorem 2

The secrecy rank is a stochastic LOPC (SLOPC) monotone.

Being an SLOPC monotone means that if the secrecy rank decreases at any point along any branch in an LOPC protocol, then it cannot be increased again along that branch. As described above, this property of the secrecy rank is the key ingredient in proving Theorem 1. The proof of Theorem 2 is given in the Supplementary Note 4.

Discussion

The operational tasks explored in this paper involve extracting pure-state entanglement from some mixed quantum state using LOCC and the classical analog of extracting secret shared randomness from an unsecure classically correlated state using LOPC. These are two very important questions since pure-state entanglement is the fundamental building block for quantum information processing35, and likewise, secret key states provide the essential ingredient for information-theoretic secure communication36,37. The tasks studied here can be seen as single-copy versions of the well-studied secret key3,4 and entanglement distillation38 problems. Understanding the relationship between quantum entanglement and classical secrecy offers an intriguing research directions with many interesting connections already found39,40,41,42,43,44,45,46,47,48. We have shown another similarity between the two in terms of LOCC/LOPC round complexity. Specifically, our results imply that no universal upper bound exists on the minimum number of rounds needed to optimally transform bipartite entanglement or extract secret shared randomness from unsecure correlations. We close this paper with some additional observations and open questions.

First, it should be emphasized that the LOCC impossibiltiy result of Theorem 1 holds for any 0 < λ′ ≤ λ. In particular, the target state |Φ λ′〉 can be entangled by an arbitrarily small amount and the transformation still requires r rounds. This demonstrates a type of discontinuity in the trade-off between entanglement and LOCC round number since \(\left| {00} \right\rangle = {\mathrm{lim}}_{\lambda \prime \to 0}{\kern 1pt} \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) can be trivially obtained in zero rounds of LOCC. Such a phenomenon is reminiscent of the entanglement/round number trade-off demonstrated in ref. 20.

It is also noteworthy that the classical notion of common information played an essential role in our line of argumentation. Being able to unify the classical and quantum problems in this manner required the origami distributions to have special structure. Ozols et al. have previously used distributions of this sort to relate the tasks of classical and quantum key distillation47, and it appears that distributions with this structure provide a useful starting point for investigating the similarities and differences between quantum entanglement and classical secrecy theories.

In addition, we remark that that the bipartite quantum states \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\) constructed in this paper exhibit entanglement reversibility in the asymptotic sense35,49,50,51. That is, the entanglement cost of generating \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\) by LOCC is equal to the amount of entanglement that can be distilled from \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\), which is h(λ). A very simple protocol for generating \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\) at entanglement rate h(λ) involves Alice and Bob converting Nh(λ) copies of |Φ1/2〉 into N copies of |Φ λ 〉. On each of these copies Alice and Bob then choose a random joint permutation consistent with the block structure of b (r,λ): \(\left| {{\mathrm{\Phi }}_\lambda } \right\rangle \to \left| {\psi _z^{\left({r,\lambda } \right)}} \right\rangle\). Averaging over these permutation generates the state \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\). Our results show that the general structure of states possessing entanglement reversibility can be highly complex. Whether the entanglement distillation rate of h(λ) can still be achieved for \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\) in the asymptotic sense using fewer than r rounds of LOCC is an interesting question. We strongly conjecture that this is not possible, but we offer no definitive proof.

Another natural question to consider is the greatest success probability for achieving the transformations \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_\lambda } \right\rangle\) and b (r,λ) → Φ λ using r − 1 rounds of LOCC and LOPC, respectively. The structure of the b (r,λ) suggests that in both cases the success probability of any (r − 1)-round protocol should be no greater than 1/2. In fact, it is not difficult to construct an (r − 1)-round protocol that exactly attains the success probability 1/2. We can prove that this indeed is optimal for the classical case, but we are no longer able to easily map this bound to the quantum setting like we have done in this paper. The main reason is that monotonicity of the Schmidt/secrecy rank is no longer required in the transformation. Therefore, the unified analysis of the quantum and classical scenarios pursued in this paper no longer holds. We suspect that an LOCC/LOPC equivalence can still be established by using tools other than the Schmidt/secrecy rank. This is left for future work.

Methods

Properties of the origami distributions in both classical and quantum settings

The origami distributions belong to the more general class of “unambiguous distributions” introduced in ref. 47 since the value of one variable can always be determined from the values of the other two. The structures of unambiguous distributions lend themselves nicely to unifying LOPC and LOCC protocols via the embedding of Eq. (9). In fact, the full proof of Theorem 1, as carried out in the Supplementary Note 2, makes use of this unified structure and involves an argument that applies to both the quantum and classical problems. To compactly represent and analyze the structure of the origami distributions, we invoke in Supplmentary Note 1 the notion of common information between random variables, as proposed by Gács and Körner52. A slight strengthening of Theorem 1 is also presented in the Supplementary Note 3, where we relax the requirement of perfect transformation and consider ε-approximate transformations. Our argument involves deriving an upper bound on the r-round communication complexity for a general LOPC transformation of variables, a result which may be of independent interest elsewhere.

Theorem 1 proof sketch

The connection between the LOPC and LOCC frameworks can be seen in the basic transformation depicted by Fig. 1. The LOPC transformation b (1,λ) → \({\mathrm{\Phi }}_\lambda ^\prime\) is made coherent by replacing Bob’s announcement M (where M = 0 if Y ∈ {0, 1} and M = 1 if Y ∈ {2, 3}) with the projective measurement {P 0, P 1} (where P 0 = |0〉 〈0| + |1〉 〈1| and P 1 = |2〉 〈2| + |3〉 〈3|) and an announcement of the measurement outcome. The result of this LOCC protocol is the transformation \(\rho _{\bf{b}}^{\left({1,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\). It is then relatively easy to see that the transformations of Theorem 1 are achievable in r rounds by repeating these basic LOPC/LOCC protocols to r “layers” of b (1,λ) with Alice and Bob alternating in the communication. The difficulty comes in showing that no fewer than r rounds will succeed in accomplishing the transformations.

Proving the round-number lower bound of Theorem 1 is based on the theory of operational monotones. An LOPC/LOCC monotone is any function that cannot be increased under LOPC/LOCC processing44,53. While the use of LOCC monotones is a standard technique for proving impossibility results in entanglement theory, the analogous theory of LOPC monotones has received far less development and application. One of the most basic LOCC monotones is the Schmidt rank of a quantum pure state. Recall that the Schmidt rank of a bipartite pure state \(\left| \psi \right\rangle ^{AB}\), denoted by \(\mathrm{Srk}\left({\left| \psi \right\rangle } \right)\), is equivalent to the ranks of the reduced density matrices \(\rho ^A = {\mathrm{tr}}_B\left| \psi \right\rangle \left\langle \psi \right|\) and \(\rho ^B = {\mathrm{tr}}_A\left| \psi \right\rangle \left\langle \psi \right|\). Unlike most LOCC monotones, the Schmidt rank has an even stronger property that it cannot be increased under LOCC even with some nonzero probability, regardless of how small this probability may be29. Such a monotone is called a stochastic LOCC (SLOCC) monotone.

Since \(\rho _{\bf{b}}^{\left({r,\lambda } \right)}\) is a mixture of bipartite pure states \(\left| {\psi _z^{\left({r,\lambda } \right)}} \right\rangle\), the transformation \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) requires that protocols transform \(\left| {\psi _z^{\left({r,\lambda } \right)}} \right\rangle\) into \(\left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) for every z. The origami distributions and their embeddings \(\left| {{\bf{b}}^{\left({r,\lambda } \right)}} \right\rangle\) are designed in such a way that obtaining \(\left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) from \(\left| {\psi _z^{\left({r,\lambda } \right)}} \right\rangle\) in r − 1 rounds will necessarily cause the Schmidt of rank \(\left| {\psi _{z\prime }^{\left({r,\lambda } \right)}} \right\rangle\) to decrease for some other \(z\prime \not = z\). Since \(\left| {\psi _{z\prime }^{\left({r,\lambda } \right)}} \right\rangle\) and \(\left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) both have a Schmidt rank of 2, a decrease in the rank of the former will make it impossible to obtain the latter. Hence the transformation \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) is impossible in r − 1 rounds as there will always be at least one failure branch. The Schmidt rank can only be preserved along all branches if the protocol is carried out for r total rounds.

One can see the general idea of this argument in greater detail by examining b (4,λ) (see Eq. (8)). Suppose it is Bob who is making the first measurement and let this be described by Kraus operators {B k } k . Up to renormalization, the k th post-measurement state of each \(\left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\) will have the form \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\). In order for this state to ultimately reach \(\left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\), we must have that for every z either \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\) has Schmidt rank two or \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle = 0\). Inspection of b (4,λ) shows that if \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle = 0\) for some z (meaning that two rows of b (4,λ) have been eliminated in Eq. (8)), then \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle = 0\) for all z. The reason is that if a value of z lies in a row being eliminated, then the Schmidt rank of \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\) cannot be two, and therefore it must be that \(\left({{\Bbb I} \otimes B_k} \right){\kern 1pt} \left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle = 0\). Therefore, if Bob is the first measuring party on \(\left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\), each nonzero post-measurement state is SLOCC equivalent to \(\left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\), meaning it is related to \(\left| {\psi _z^{\left({4,\lambda } \right)}} \right\rangle\) by an invertible SLOCC transformation54. If Alice is the first measure, a similar argument shows that her actions are also sharply limited. However, unlike Bob, she can eliminate either the right or left sub-block of b (4,λ) without violating the Schmidt rank constraint. In the latter case, what remains is some state SLOCC equivalent to \(\rho _{\bf{b}}^{\left({3,\lambda } \right)}\). Thus, any LOCC protocol transforming \(\rho _{\bf{b}}^{\left({4,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) must generate a mixture σ AB that is SLOCC equivalent to \(\rho _{\bf{b}}^{\left({3,\lambda } \right)}\) along every branch in the protocol, and it will require at least one round to do so with Alice being the measuring party.

A careful inductive argument then allows one to establish the following general result: Any LOCC protocol transforming \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) must generate a state σ AB that is SLOCC equivalent to \(\rho _{\bf{b}}^{\left({1,\lambda } \right)}\) along every branch in the protocol, and it will require at least r − 1 rounds to do so. From this, it follows that the transformation \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) is possible in r − 1 rounds only if there exists a state σ AB that is SLOCC equivalent to \(\rho _{\bf{b}}^{\left({1,\lambda } \right)}\) and which can be transformed into \(\left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) via local completely positive trace-preserving (CPTP) maps by Alice and Bob. The last condition holds because after r − 1 rounds, Alice and Bob cannot communicate further and thus they must perform local CPTP maps on σ AB in order to obtain \(\left| {{\mathrm{\Phi }}_\lambda } \right\rangle\). It is not difficult to show that no such σ AB exists and consequently the transformation \(\rho _{\bf{b}}^{\left({r,\lambda } \right)} \to \left| {{\mathrm{\Phi }}_{\lambda \prime }} \right\rangle\) is not possible in r − 1 rounds.

The crucial piece in this argument is that the Schmidt rank is an SLOCC monotone, and therefore every local action must either eliminate \(\left| {\psi _z^{\left({r,\lambda } \right)}} \right\rangle\) or leave Schmidt rank unchanged. We introduce below a classical analog of the Schmidt rank called the secrecy rank that is similarly a stochastic LOPC (SLOPC) monotone; i.e., it cannot be increased even probabilistically under LOPC operations. With this monotonicity, it follows analogously to the quantum case that b (r,λ) → Φ λ′ is not possible in fewer than r rounds of communication.

Data availability

The authors declare that all the data supporting the findings of this study are available within the paper and its Supplementary Information Files.