Experimental time-reversed adaptive Bell measurement towards all-photonic quantum repeaters

An all-optical network is identified as a promising infrastructure for fast and energy-efficient communication. Recently, it has been shown that its quantum version based on ‘all-photonic quantum repeaters’—inheriting, at least, the same advantages—expands its possibility to the quantum realm, that is, a global quantum internet with applications far beyond the conventional Internet. Here we report a proof-of-principle experiment for a key component for the all-photonic repeaters—called all-photonic time-reversed adaptive (TRA) Bell measurement, with a proposal for the implementation. In particular, our TRA measurement—based only on optical devices without any quantum memories and any quantum error correction—passively but selectively performs the Bell measurement only on single photons that have successfully survived their lossy travel over optical channels. In fact, our experiment shows that only the survived single-photon state is faithfully teleported without the disturbance from the other lost photons, as the theory predicts.

Q uantum internet 1 -the quantum version of the current Internet-holds promise for accomplishing quantum teleportation 2 , quantum key distribution (QKD) 3,4 and precise synchronisation of atomic clocks 5 among arbitrary clients all over the globe, as well as longer-baseline telescopes 6 and possibly even simulation of quantum many-body systems 1 . To realise it in a global scale for arbitrary users, it is reasonable to utilise not only recently developed satellites 7-10 but also existing optical networks that have already been installed in the world. An indispensable building block 11,12 for implementing such a quantum internet against photon loss of optical fibres is to use quantum repeaters over an optical network, irrespective of its topology [13][14][15][16] . For 17 years after the first proposal for quantum repeaters 17 , it had widely been believed that their realisation needs demanding matter quantum memories 18,19 or matter qubits 20 . However, in 2015, this belief was disproved by a proposal of all-photonic quantum repeaters 21 , which work without any matter quantum memories or matter qubits, that is, only with optical devices. Thanks to its all-optical nature, this scheme has advantages that cannot be seen in conventional quantum repeaters necessitating matter quantum memories. For instance, first, the repetition rate of the protocol could be as high as one wants, similarly to a memory-function-less scheme 20 , as it is determined only by the repetition rate of the optical devices, independently of the communication distance. This would lead to a future higher-bandwidth quantum internet. Second, in principle, the scheme could work at room temperature and does not need any quantum interfaces among photons with different wavelengths, let alone between matter quantum memories and photons. Third, the scheme is an ultimate version of the all-optical network approach 22 -which has already been identified as a promising infrastructure for fast and energy-efficient communication in the field of conventional communication. Thus, the scheme is an important target of the development of photonic networks 23,24 , and in particular their implementations using integrated quantum circuits [25][26][27][28][29][30] or frequency multiplexing 31,32 . The scheme would also represent a step towards a future all-photonic quantum computer [33][34][35][36][37] .
In this Article, we report a proof-of-principle experiment for a key component of all-photonic quantum repeaters, which we will call all-photonic time-reversed adaptive (TRA) Bell measurement. In particular, the experiment has been implemented, based on our proposal of a scheme which requires an initial state composed of far fewer single photons than what needed 21,38 before. Besides, it does not need large-scale optical switches and quantum nondemolition measurement, let alone matter quantum memories and quantum error correcting codes. Our scheme is obtained by invoking the concept of the 'time-reversal' in the proposal of allphotonic quantum repeaters and by combining a local delayed preparation of a multipartite Greenberger-Horne-Zeilinger (GHZ) state with utilisation of a special feature of the type-II fusion gate 36 . Our experiment shows that, as the theory predicts, only the survived single-photon state is faithfully teleported without the disturbance from the other lost photons. In principle, once the GHZ state is treated in a lossless manner, our scheme could double the achievable distance of QKD, that is, it could have the same impact as the all-photonic intercity QKD 38 .

Results
Basics of quantum repeaters. Before introducing our scheme, we start by reviewing the efficiency enhancement of quantum repeaters brought by the adaptive Bell measurement-which performs the Bell measurement only on qubits that have successfully shared entanglement with distant nodes. To see this, it is instructive to begin by considering the simplest quantum repeater scheme which uses only a single repeater node C in the middle of Alice (A) and Bob (B) separated over a distance L. Here, the node C is connected to Alice and Bob by optical fibres with length L/2, whose transmittance is described by η L=2 :¼ e ÀL= 2L att ð Þ for an attenuation length L att . Note that, if Alice and Bob do not utilise the node C as a quantum repeater node like the Ekert scheme 4 or if they just run a direct quantum communication scheme between them like the Bennett-Brassard protocol 3 , the communication efficiency inevitably scales as η L 11,12 . In this case, about 400 km for the use of the standard optical fibres is a practical distance limitation.
Let us first consider the mechanism of the simplest quantum repeater scheme using matter quantum memories (Fig. 1a), as a representative of conventional quantum repeater protocols. This protocol starts with l entanglement generation processes between nodes AC and between nodes CB. In particular, in each entanglement generation process, say in the ith process (i = 1, 2, …, l), the node A (B) locally prepares an entangled state between a single-photon α i (β i ) and her qubit a i (his qubit b i ), where the qubit a i (b i ) can be regarded as virtual for the case of application to QKD 21 , and then tries to supply the qubit a i (b i ) with entanglement with a matter quantum memory c i (c i+l ) at the node C by exchanging the single photon through the optical fibre. In practice, this trial succeeds only probabilistically, because of imperfection of local operations and the photon loss in the optical fibres. This success probability p g is normally described as p g (L/2) = c g η L/2 with an overall success probability c g of the local operations. This means that, if the nodes AC (CB) run the entanglement generation processes more than about p À1 g ðL=2Þ simultaneously in parallel, they can share, at least, an entangled pair almost deterministically. Then, the node C pairs its own matter quantum memories that are entangled with adjacent nodes A and B, respectively, and it performs Bell measurement on these pairs to convert the entangled pairs between AC and CB into entangled pairs between AB. This Bell measurement-applied only to halves of successfully entangled pairs-can be called adaptive Bell measurement. By including general cases (such as the Duan-Lukin-Cirac-Zoller protocol 18 ) where the Bell measurement may succeed only probabilistically, say with a probability p s , we can conclude that Alice and Bob can obtain an entangled pair when nodes AC and CB run about p À1 g ðL=2Þp À1 s entanglement generation processes on average (that is, when ' p À1 g ðL=2Þp À1 s ). On the other hand, if Alice and Bob perform the entanglement generation processes between them directly (without using the repeater node C), they need to run the processes about p À1 g ðLÞ times to obtain an entangled pair between AB. Since p À1 g ðLÞ>p À1 g ðL=2Þp À1 s holds for large L, even the simplest quantum repeater scheme utilising only the single node C could be more efficient than the direct entanglement generation between Alice and Bob. More precisely, compared with the direct entanglement generation, the simplest quantum repeater scheme enables Alice and Bob to double their communication distance without decreasing the communication efficiency. Hence, it already enables us to extend the achievable distance of fibre-based quantum communication up to about 800 km, which is useful for intercity backbone quantum links 38 . A more general quantum repeater scheme with 2 s − 1 repeater nodes (s = 1, 2, …) 18,19 for accomplishing further scaling improvement can be regarded as one obtained by concatenating this simplest quantum repeater scheme with the help of quantum error correction or quantum memories with long coherence time.
The essence of the scaling improvement of the simplest quantum repeater scheme is the adaptive Bell measurement at the node C. In the above simplest quantum repeater scheme, this adaptive Bell measurement can be performed thanks to three functions of the matter quantum memories {c i } i=1,2,…,2l at the node C: (i) They can establish entanglement with a distant node A or B if the entanglement generation process succeeds. (ii) Their memory function enables the node C to keep entanglement until it is informed of the success/failure of the entanglement generation processes between AC and between CB. (iii) The independent accessibility to them enables the node C to selectively apply the Bell measurement only to halves of successfully entangled pairs, in order to avoid the error propagation from the other failed entanglement generation processes. Therefore, conventional schemes require the node C to be equipped with matter quantum memories. However, our allphotonic scheme shows that the adaptive Bell measurement is possible without using matter quantum memories.
All-photonic time-reversed adaptive Bell measurement. Our scheme-called TRA Bell measurement-is brought by invoking the concept of the 'time-reversal' in the proposal of allphotonic quantum repeaters 21 . In fact, this concept enables our scheme to work without matter quantum memories associated with three functions (i)-(iii). The conception of the timereversal stems from the observation of the essential role of the adaptive Bell measurement at the node C, which is-among its own matter quantum memories {c i } i=1,2,…,2l -to entangle only local quantum memories that have successfully shared entanglement with distant nodes A and B. Unfortunately, this selective local supply of entanglement after the entanglement generation processes is impossible for our all-photonic scheme, because all the memories at the node C are replaced with singlephoton qubits {c i } i = 1,2,…,2l without the function (ii) in our scheme. Instead, as shown in Fig. 1b, our scheme entangles all the single-photon qubits {c i } i=1,2,…,2l at the node C before the completion of entanglement generation processes. This means that our scheme essentially begins with entanglement swapping, rather than entanglement generation processes. In particular, the node C starts by locally preparing the single-photon qubits {c i } i=1,2,…,2l in a 2l-partite GHZ state 39 . Note that, up to the freedom of local unitary operators, this GHZ state is the same as the complete cluster state, corresponding to the state of the first-leaf qubits in the original proposal 21 .
The next question for the node C in our scheme is how to perform the entanglement generation processes with the nodes A and B. This is possible by utilising a connection process for GHZ states: If we perform the Bell measurement between a qubit composing an m-partite GHZ state and a qubit composing another n-partite GHZ state, we obtain an (m + n − 2)-partite GHZ state. To see how this works, we first note that the ith entanglement generation process between nodes AC (BC) starts with a local preparation of a bipartite GHZ state-equivalent to a Bell state-between the qubit a i (b i ) and a single-photon α i (β i ). Hence, if the single-photon α i from Alice (β i from Bob) successfully arrives at the node C and if the Bell measurement at the node C on these photons α i c i (β i c i+l ) succeeds, an initial mpartite GHZ state (m = 1, 2, …, 2l) having included the qubit c i (c i+l ) is transformed into an m-partite GHZ state which newly includes Alice's qubit a i (Bob's qubit b i ) instead of the qubit c i (c i+l ). This mechanism works as the function (i), that is, it works as the entanglement generation processes between nodes AC (BC). On the other hand, if the single-photon α i (β i ) does not arrive at the node C-corresponding to the failure of the entanglement generation, we would like to disentangle the qubit c i (c i+l ) from the GHZ state, in order to satisfy function (iii) (or because such a qubit is associated with a matter quantum   . The essential of the quantum schemes is to perform the Bell measurement at the node C adaptively only on the pairs of matter quantum memories that have successfully shared entanglement with Alice and Bob through the entanglement generation processes. This adaptive Bell measurement is made possible thanks to the functionality of matter quantum memories. In contrast, our scheme described in b performs this adaptive Bell measurement without matter quantum memories, by invoking the conception of the 'time-reversal'. In particular, our scheme begins by entangling all the polarisation qubits {c i } i=1,2,…,2l at the node C initially, followed by connecting/disentangling the qubits dependently on the success/failure of the entanglement generation processes. This switching between connecting and disentangling is passively performed by adopting the type-II fusion gates as the implementation for the Bell measurement between optical pulses α i c i and between β i c i+l , as depicted in c. The type-II fusion gate is composed of the polarising beam splitter (PBS), the half-wave plates and single-photon detectors NATURE COMMUNICATIONS | https://doi.org/10.1038/s41467-018-08099-5 ARTICLE memory that is not subjected to Bell measurement in the original simplest quantum repeater scheme). But, fortunately, we can disentangle the qubit c i (c i+l ) just by performing the X-basis measurement on it. Therefore, if the node C can switch between the Bell measurement and the X-basis measurement dependently on the arrival of single photons from Alice and Bob, we can perform the adaptive Bell measurement in a time-reversed manner, as well as the entanglement generation. The final question for the node C is how to implement this switching between the Bell measurement and the X-basis measurement, by using only optical devices. For instance, such switching can be performed actively by combining quantum non-demolition (QND) measurement (based on an entangled photon source) and optical switches as in the all-photonic intercity QKD 38 , or by using loss-tolerant encoding for qubits {c i } i=1,2,…,2l as in the all-photonic quantum repeaters 21 . However, here we present the node C with another mechanism to perform the switching passively, rather than actively, in order to make it possible to start from far fewer single-photon resources. That is, in our case, the node C uses a delayed preparation of the 2l-partite GHZ-state and the type-II fusion gate 36 (Fig. 1c) with photon-number-resolving detectors as the implementation of the Bell measurement on α i c i (β i c i+l ). The delayed preparation means that the node C prepares the 2lpartite GHZ state just before the arrival of optical pulses from Alice and Bob. This could enable us to assume that the GHZ state is lossless compared with the optical pulses sent from distant nodes AB (see Discussion for the precise requirement here). We also utilise a property of the type-II fusion gate as follows (see Supplementary Note 1): (a) If it is performed on the single-photon qubit c i (c i+l ) and the optical pulse α i (β i ) in the vacuum state, it works as X-basis measurement on the qubit c i (c i+l ). (b) If it is performed on the single-photon qubit c i (c i+l ) and the optical pulse α i (β i ) including a single photon, it works as either (b1) the X-basis measurement on the single photons or (b2) the Bell measurement. Therefore, in principle, our TRA Bell measurement scheme can be performed just by using the type-II fusion gates, without invoking techniques such as the QND measurement and the loss-tolerant encoding.
In this way, we have arrived at the following protocol: (1) For the entanglement generation processes, Alice and Bob locally prepare l pairs of an optical pulse and a qubit in a Bell state (equivalent to a bipartite GHZ state). (2) Then, they send the l optical pulses to the node C through the optical fibres simultaneously. (3) At the timing of the arrival of all the 2l optical pulses sent by Alice and Bob, the node C prepares 2l single-photon qubits in a 2l-partite GHZ state locally and applies the type-II fusion gates to 2l pairs between the 2l-partite GHZ state and the 2l arriving optical pulses. (4) Then, the node C announces the measurement outcomes. (5) If the measurement outcomes inform Alice and Bob of the existence of the successful entanglement generation processes between nodes AC and between nodes CB and every measurement outcome corresponds to the case (a), (b1) or (b2), the qubits of Alice and Bob should be in a GHZ state. Except for these events, the protocol is considered to fail. The size of the final GHZ state shared by Alice and Bob depends on how many successful entanglement generation processes have existed. Depending on this, individual bit-flip errors can be compensated thanks to the robustness of the GHZ state against such errors.
Proof-of-principle experiment. Let us now discuss about the experimental demonstration of our all-photonic TRA Bell measurement with a three-partite photonic GHZ state GHZ j i c 1 c 2 c 5 as described in Fig. 1c. In particular, we suppose a situation where Alice sends two optical pulses α 1 and α 2 in single-photon states to the node C but only one of them survives the travel from the node A to the node C. Here, the node C does not know, in advance, which single photon is lost during the travel. Nevertheless, according to the theory above and described in Fig. 1c, just by performing the type-II fusion gates on α 1 c 1 and on α 2 c 2 , the node C should share a Bell state between its remaining qubit c 5 and Alice's qubit a i which has been in a Bell state with the only survived single-photon α i (i = 1, 2). In other words, arbitrary quantum states of only the survived single photon α i should be teleported into the qubit c 5 without the disturbance from the other lost photon, because the state of the photon α i can be chosen arbitrary by performing measurement on its partner a i . Here, we experimentally demonstrate this quantum teleporation as the most primitive function of our TRA Bell measurement.
Our experimental setup is shown in Fig. 2. Pump light at 395 nm with a power of 600 mW for spontaneous parametric downconversion (SPDC) is prepared by the frequency doubler with the light at 790 nm from a mode-locked Ti:sapphire (Ti:S) laser with a pulse width of 100 fs and a repetition rate of 80 MHz. The vertically (V-) polarised pump light is injected to a pair of type-I phase-matched and 1.5-mm-thick β-barium borate (BBO) crystals 40,41 to have a horizontally polarised photon pair HH j i αγ 2 . The subscripts indicate modes of photons. After passing through a quarter wave plate (QWP) with its axis oriented at 22.5°to H polarisation, the pump light is reflected back to the QWP and the BBO crystals by a dichroic mirror to prepare a polarisation entangled photon pair ϕ þ j i c By postselecting events where a single photon appears in mode α, we obtain an H-polarised single photon in mode γ 2 . The polarisation of photon γ 2 is rotated to diagonal polarisation by a half-wave plate (HWP), and then photons γ 1 and γ 2 are mixed at a polarising beam splitter (PBS 12 ). When two photons appear in output modes c 1 and c 2 , the three-photon GHZ state GHZ [42][43][44] . For demonstrating the TRA Bell measurement, we use photon α not only as the heralding photon but also as Alice's signal photon, whose quantum state is encoded into ψ j i ¼ ξ H j i þ ζ V j i. As we have mentioned, in this experiment, we simulate a case where Alice sends two optical pulses in single-photon states to the node C but only one photon of them survives the lossy travel from the node A to the node C (Fig. 1b). For this, the signal photon in mode α is divided into two modes α 1 and α 2 by a 50:50 beam splitter (BS), corresponding to 50% loss of the transmission. If the signal photon is transmitted to mode α 1 at the BS, photons α 1 and c 1 interfere at PBS 11 for a type-II fusion gate (the lower side in Fig. 2), while photon c 2 alone goes to the other fusion gate (the upper side in Fig. 2). In this case, if detector D 21 is clicked, photon c 2 is projected onto Then, the GHZ state GHZ j i c 1 c 2 c 5 is projected onto a Bell state as D h j c 2 GHZ j i c 1 c 2 c 5 / ϕ þ j i c 1 c 5 . As a result, by the type-II fusion gate on photons α 1 and c 1 , the state of photon α 1 is teleported to the state of photon c 5 as ϕ þ h j α 1 c 1 ψ j i α 1 ϕ þ j i c 1 c 5 / ψ j i c 5 . On the other hand, when detector where ϕ À j i c 1 c 5 ð HH j i c 1 c 5 À VV j i c 1 c 5 Þ= ffiffi ffi 2 p . After the fusion operation on photons α 1 and c 1 , the state of photon c 5 becomes ϕ þ h j α 1 c 1 ψ j i α 1 ϕ À j i c 1 c 5 / ξ H j i c 5 Àζ V j i c 5 . The phase shift here can be compensated by applying the phase-flip operation, and thus we can obtain ψ j i c 5 . In our proof-of-principle experiment, we skip this feed-forward phase-flip operation for simplicity.
Similarly, when the signal photon α is reflected to mode α 2 at the BS, photon α 2 and photon c 2 interfere at the fusion gate in the upper side and only photon c 1 goes to the fusion gate in the lower side. As a result, if detector D 11 is clicked, the final state in mode c 5 becomes ψ j i c 5 . If detector D 12 is clicked, the state in mode c 5 becomes ξ H j i c 5 Àζ V j i c 5 . In our experiment, photon α is mixed with a photon either in mode c 1 or c 2 , and, at the same time, photon α is used for heralding the successful generation of the GHZ state among modes c 1 , c 2 and c 5 at the fusion gate. Here we explain how it works properly in our experiment. When the perfectly modematched two photons in modes γ 1 and γ 2 interfere at the PBS 12 for generating the GHZ state, they come out from modes c 1 and c 2 with probability 1/2, or both of the two photons come out together from the same mode c 1 or c 2 with probability 1/4. The former case is a desired event as we described before. Apparently, the latter case may cause the degradation of the quality of the experiment. However, when the two photons are bunched in mode c 1 or c 2 after PBS 12 , the two-photon state always becomes the NOON state of diagonal and anti-diagonal polarisation which are rotated to H and V polarisation at the fusion gate. As a result, both of the two photons are transmitted or reflected at the PBS in the fusion gate, and thus such events never contaminate the successful coincidence events among three of detectors D 11 , D 12 , D 21 and D 22 . In order to obtain well mode matching of photons γ 1 and γ 2 , we adjust the temporal mode by mirrors on the motorised stage, select the frequency mode of the photons by an interference filter with a bandwidth of 2.7 nm, and use the single-mode fibre connected to the avalanche photon detectors (quantum efficiency is about 60%). Furthermore, for suppressing the multiple photon emission by the SPDC, we set the photon pair generation probability per pulse at the BBO crystals to~5 × 10 −3 . We also notice that BS, PBS 11 and PBS 22 add π phase shift between |H〉 and |V〉, resulting in the π phase shift of the teleported state in some coincidence patterns. Again, although this can be compensated by the feed-forward phase-flip operation, in the following experiment, we read the measurement basis state as one subjected to a proper phase-flip unitary, instead of the feedforward operation, for simplicity.
In the experiment, we first performed quantum state tomography 45 of the photon pair in modes c 5 and γ 1 prepared by the SPDC. The photons were detected at D 3 and D 11 . We reconstructed the density operator ρ c 5 γ 1 of the two-photon state by using the iterative maximum likelihood method 46 . The observed fidelity ϕ þ h jρ c 5 γ 1 ϕ þ j i was 0.95(02), where digits in parentheses represent the standard deviation, for example, 0.95 ± 0.02. Matrix representation of ρ c 5 γ 1 and the observed coincidence counts are shown in Fig. 3. The count rate was about 2500 Hz.
Next we performed the quantum state tomography of the three-photon state in modes c 5 , c 2 and c 1 prepared by using ρ c 5 γ 1 and the photon in mode 2 heralded by the detection of photon α by detector D 22 . For this measurement, we did not rotate the HWPs just before and after the PBSs at the fusion gates. The tomography was performed by using detectors D 11 , D 21 and D 3 . The reconstructed density operator ρ c 5 c 2 c 1 is shown in Fig. 4. The observed fidelity F GHZ ¼ GHZ h jρ c 5 c 2 c 1 GHZ j i was 0.84(05) with a count rate of about 0.06 Hz. With the witness operator defined by 47 , Trðρ c 5 c 2 c 1 WÞ ¼ À0:09ð05Þ<0 was confirmed, which clearly shows that the obtained state was in the genuine GHZ class.
Finally, we demonstrated the TRA Bell measurement. We prepared four states |H〉, |V〉, for |ψ〉 in mode α. We performed the quantum state tomography of the teleported state in mode c 5 and reconstructed its density operator for the four input states conditioned by the successful events of the two fusion gates. We list the experimental results in Table 1. From Table 1, we see that the teleportation succeeded with high fidelities for the four input states and for any detection events. Although the fidelities relatively deviate from each other due to the statistical fluctuations caused by the low-count events, we can confirm that the teleportation succeeded with high fidelities for most of the four input states and for any detection events. By using the above observed counts, we reconstructed the process matrices χ of the teleportation channels from input photon α to output photon c 5 by the technique of the process  48 . The process matrix is calculated by the input-output relation ρ out ¼ P 3 m;n¼0 σ m ρ in σ n χ mn , where ρ in (ρ out ), σ i and σ 0 represent the input (output) density matrix, the Pauli matrices and the identical matrix, respectively. The ideal process matrix χ ideal of the teleportation has only one non-zero element χ ideal 00 ¼ 1. The result of the reconstruction is shown in Fig. 5. The obtained process fidelity F p Tr χχ ideal À Á is given in Table 1. From these results, we conclude that our scheme works as quantum teleportation with two standard deviations apart from the classical limit 0.5 of the process fidelity 49 , irrespectively of whether Alice's signal photon α passes through either α 1 or α 2 . The degradation of the process fidelity is mainly caused by the mode mismatch between relevant photons. Especially, it seems that our complex interferometer with GHZ state generation and type-II fusion gates further increases the mode mismatch due to the misalignments. For example, the visibility of 0.82 for twophoton interference at GHZ state generation is relatively lower than typical value 0.90 obtained in a simpler experimental setup 50 . Integrated photonic circuits and indistinguishable photon sources, which have been actively studied recently [25][26][27][28][29][30]51 , could give a solution to this issue in the near future.

Discussion
We have proposed an all-photonic TRA Bell measurement and experimentally confirmed the working principle of the adaptive Bell measurement necessitated by all-photonic intercity QKD and all-photonic quantum repeaters. Although our scheme is designed mainly to experimentally demonstrate this proof-of-principle experiment, one might be interested in the potential of our current scheme. Here, we discuss this.
To check the potential of our protocol, among various types of error and imperfection, we consider the effect of non-unit quantum efficiency 1 À ϵ 0 of photon-number-resolving detectors as dominant 21,52 and inevitable noise for our protocol. Assuming the use of these imperfect detectors, we plot the asymptotic final secret key rate G :¼ max l G l of our protocol in Fig. 6, where G l represents average secret bits per the number l of multiplexing (see the derivation in Supplementary Note 2 and optimal choices of l in Supplementary Table 1 for several cases). From the figure, we can confirm that our protocol has a scaling of η L/2 in the ideal case of ϵ 0 ¼ 0 as the theory suggests. This is good in the sense that our protocol has no scaling gap with the private capacity [14][15][16] (the upper dashed curve in the figure) for the optical network of Alice, Bob and the middle node C-that is, the ultimate performance which can be achieved when Alice, Bob and the node C are allowed to use ideal universal quantum computers freely. However, the figure also suggests that the performance is very sensitive to the quantum efficiency. This is because, in the case of ϵ 0 > 0, even if a type-II fusion gate at the node C finds the arrival of a single photon, there might be the case where the found single photon has come from Alice or Bob, rather than the locally prepared 2l-partite GHZ state, leading to the phase error of the final GHZ state of Alice and Bob. In short, in principle, our protocol could achieve almost best performance allowed by quantum mechanics, but, in practice, it necessitates very high quantum efficiency.
Note that our protocol can be combined with loss-tolerant encoding. Indeed, even if a good photon detector with high quantum efficiency is unavailable, our 'delayed preparation' idea is still important to perform the time-reversed adaptive Bell In particular, even if the type-II fusion gates do not work properly to disentangle unnecessary qubits of the 2l-partite GHZ state due to ϵ 0 > 0, the best scaling of η L/2 can still be obtained by modifying our protocol such that it uses an encoded complete-like cluster state G l c appearing in the original protocol 21 , rather than the 2l-partite GHZ state. This is because, in this case, if necessary, the first-leaf qubits of the state G l c -associated with qubits in the 2l-partite GHZ state conceptually-are encoded to be able to be disentangled faithfully and almost deterministically even if photons receive not only loss corresponding to the effect of ϵ 0 > 0 but also depolarisation errors 21 . Nevertheless, the required number of photons to compose the first-leaf qubits here is far fewer than the original protocol. This is because our delayed preparation merely requires the first-leaf qubits to be robust against only local loss and only local depolarisation errors, rather than those occurring in their long travel to the adjacent repeater nodes, in contrast to the original protocol 21 . Therefore, even in the case of ϵ 0 > 0, our delayed preparation idea enables our protocol to be modified so as to achieve the best scaling of η L/2 .
As have been shown here, depending on the efficiency of photon detectors and the size of the multipartite entangled states that one can prepare at node C, our scheme will gradually expand  The output states in mode c 5 are estimated by detectors D 11 , D 12 , D 21 and D 22 at the fusion gates. When the input state in mode α is |H〉 and |V〉, the measurement time was 19,800 s for each basis setting. That was 59,600 s for the input state of |D〉 and |L〉. For the reconstruction of the output states in mode c 5 , we removed the fourfold coincidence events among D 11 , D 12 , D 21 and D 22 as error events. The method of the estimation of the process fidelity F p is written in the main text. The digits in parentheses represent the standard deviations calculated by the observed counts with an assumption of the Poisson statistics the achievable distance of the QKD up to 800 km, like all-photonic intercity QKD 38 . Subsequently, TRA Bell measurement with matured loss-tolerant encoding 53,54 and a good single/entangled photon source or a cluster-state machine gun 51,55,56 contributes the realisation of all-photonic quantum repeaters or internet. The concept of TRA Bell measurement can also be applied to matter systems such as trapped ions 57,58 and superconducting qubits 59 in order to achieve a distributed quantum information processing architecture, including quantum repeaters.

Data availability
The data that support the findings of this study are available from the corresponding authors on request.  Fig. 6 Performance of our protocol. We assume photon-number-resolving detectors with quantum efficiency 1 À ϵ 0 . We assume L att = 22 km. Solid curves represent the asymptotic final secret key rate G (per pulse) for ϵ 0 = 0, 10 −5 , 10 −4 , 10, −3 , 10 −2 , 10 −1 from the above in order, while the upper and lower dashed curves represent the private capacities of the optical network [14][15][16] of Alice, Bob and the middle node C and of point-to-point communication 12 between Alice and Bob, respectively. Solid curves with dots are obtained by fitting a smaller number of dots, compared with other curves. From this figure, we can confirm that our protocol has a scaling of η L/2 in the ideal case of ϵ 0 ¼ 0, with no scaling gap with the private capacity. We also see that our protocol is quite sensitive to local loss and requires very high detection efficiency. However, as explained in the main text, our protocol could be further improved via loss-tolerant encoding  Table 1