Fundamental limits to quantum channel discrimination

What is the ultimate performance for discriminating two arbitrary quantum channels acting on a finite-dimensional Hilbert space? Here we address this basic question by deriving a general and fundamental lower bound. More precisely, we investigate the symmetric discrimination of two arbitrary qudit channels by means of the most general protocols based on adaptive (feedback-assisted) quantum operations. In this general scenario, we first show how port-based teleportation can be used to completely simplify these adaptive protocols into a much simpler non-adaptive form, designing a new form of teleportation stretching. Then, we prove that the minimum error probability affecting the channel discrimination cannot beat a bound determined by the Choi matrices of the channels, establishing an ultimate and elegant formula for quantum hypothesis testing. As a consequence of this bound, we derive the ultimate limits for adaptive quantum illumination and single-photon quantum optical resolution. Finally, we show that our methodology can also be applied to other tasks, such as quantum metrology, quantum communication and secret key generation.

Quantum hypothesis testing [1][2][3][4][5][6][7][8] is a central area in quantum information theory [9,10], with many studies for both discrete variable (DV) [11] and continuous variable (CV) systems [12]. A number of tools [13][14][15][16][17] have been developed for its basic formulation, known as quantum state discrimination. In particular, since the seminal work of Helstrom in the 70s [1], we know how to bound the error probability affecting the discrimination of two arbitrary quantum states [18]. Remarkably, a similar bound is still missing for the discrimination of two arbitrary quantum channels. The main problem in quantum channel discrimination (QCD) [19][20][21][22][23] is that the strategies involve an optimization over the input state and the output measurement, and this process may also be adaptive in the most general case, so that feedback from the output is used to update the input.
The ultimate performance of adaptive QCD is not known because of the extreme difficulty to handle feedback-assistance in quantum protocols. At the same time, it is also known that adaptiveness needs to be considered in QCD. In fact, apart from the cases where two channels are classical [24], jointly programmable or teleportation-covariant [25,26], feedback may greatly improve the discrimination. For instance, Ref. [27] presented two channels which can be perfectly distinguished by using feedback in just two adaptive uses, while they cannot be perfectly discriminated by any number of uses of a block (non-adaptive) protocol, where the channels are probed in an identical and independent fashion, i.e., using multiple copies of the same input state. This implies that the best discrimination performance is not related to the diamond-norm distance [28], when multiple copies of two quantum channels are considered.
Here we fill this gap by deriving a universal lower bound for the error probability affecting the discrimination of two arbitrary quantum channels. To derive this bound we design a technique which reduces an adaptive protocol over an arbitrary finite-dimensional quan-tum channel into a block protocol over multiple copies of the channel's Choi matrix. This is obtained by using port-based teleportation (PBT) [29][30][31][32][33][34][35][36] for channel simulation and suitably generalizing the technique of teleportation stretching [37,38]. This reduction is shown in general for adaptive protocols with any task (not just QCD). When applied to QCD, it allows us to bound the ultimate error probability by using the Choi matrices of the channels. As a direct application of this result, we bound the ultimate adaptive performance of quantum illumination [39][40][41][42][43][44][45][46][47] and the ultimate adaptive resolution of any single-photon diffraction-limited optical system. Other implications for quantum metrology, quantum and private communications are discussed in Ref. [48].
Adaptive protocols.-Let us formulate the most general adaptive protocol over an arbitrary quantum channel E defined between Hilbert spaces of dimension d (more generally, this can be taken as the dimension of the input space). We first provide a general description and then we specify the protocol to the task of QCD. A general adaptive protocol involves an unlimited number of quantum systems which may be subject to completely arbitrary quantum operations (QOs). More precisely, we may organize the quantum systems into an input register a and an output register b, which are prepared in an initial state ρ 0 by applying a QO Λ 0 to some fundamental state of a and b. Then, a system a 1 is picked from the register a and sent through the channel E. The corresponding output b 1 is merged with the output register b 1 b → b. This is followed by another QO Λ 1 applied to a and b. Then, we send a second system a 2 ∈ a through E with the output b 2 being merged again b 2 b → b and so on. After n uses, the registers will be in a state ρ n which depends on E and the sequence of QOs {Λ 0 , Λ 1 , . . . , Λ n } defining the adaptive protocol P n .
In a protocol of quantum communication, the registers belong to remote users and, in absence of entanglementassistance, the QOs are local operations (LOs) assisted by two-way classical communication (CC), also known as adaptive LOCCs. The output is generated in such a way to approximate some target state [37]. In a protocol of quantum channel estimation, the channel is labelled by a continuous parameter E = E θ and the QOs include the use of entanglement across the registers. The output state will encode the unknown parameter ρ n = ρ n (θ), which is detected and the outcome processed into an optimal estimator [25]. Here, in a protocol of binary and symmetric QCD, the channel is labelled by a binary digit, i.e., E = E u where u ∈ {0, 1} has equal priors. The QOs are generally entangled and they generate an output state encoding the information bit, i.e., ρ n = ρ n (u).
The output state ρ n (u) of an adaptive discrimination protocol P n is finally detected by an optimal positiveoperator valued measure (POVM). For binary discrimination, this is the Helstrom POVM, which leads to the conditional error probability where D(ρ, σ) := ||ρ−σ||/2 is the trace distance [11]. The optimization over all discrimination protocols P n defines the minimum error probability affecting the n-use adaptive discrimination of E 0 and E 1 , i.e., we may write This is generally less than the n-copy diamond distance between the two channels E ⊗n 0 and E ⊗n Can we complete Eq. (3) with a lower bound? Up today this has been only proven for jointly-programmable channels, i.e., channels E 0 and E 1 admitting a simulation E u (ρ) = S(ρ ⊗ π u ) with a trace-preserving QO S and different program states π 0 and π 1 . In this case, we have p n ≥ [1 − D(π ⊗n 0 , π ⊗n 1 )]/2 [25]. In particular, this is true if the channels are jointly teleportation-covariant, so that S becomes teleportation and the program state is a Choi matrix ρ Eu . For these channels, Ref. [25] found that Eq. (3) holds with an equality and we may write More precisely, the question to ask is therefore the following: Can we establish a universal lower bound for p n (E 0 = E 1 ) which is valid for arbitrary channels? As we show here, this is possible by resorting to a more general (multi-program) simulation of the channels, i.e., of the type S(ρ ⊗ π ⊗M u ) [50].
Port-based teleportation.-Let us describe the protocol of PBT with qudits of arbitrary dimension d ≥ 2 [30,31]. The parties exploit two ensembles of M ≥ 2 qudits, i.e., Alice has A := {A 1 , . . . , A M } and Bob has B := {B 1 , . . . , B M } representing the output "ports". The generic ith pair (A i , B i ) is prepared in a maximally-entangled state, so that we have the global state [53] (4) To teleport the state of a qudit C, Alice performs a joint measurement on C and her ensemble A. This is a POVM {Π i CA } M i=1 with M possible outcomes (see Refs. [30,31] for the details). Once Alice communicates the outcome i to Bob, he discards all the ports but the ith one, which contains the teleported state (see Fig. 1a).
The measurement outcomes are equiprobable and independent of the input, and the output state is invariant under permutation of the ports [54]. Averaging over the outcomes, we define the teleported state ρ M B = Γ M (ρ C ), where Γ M is the corresponding PBT channel [55]. In the limit of many ports M , we have that Γ M approximates an identity channel I so that Bob's output becomes a perfect replica of Alice's input. More precisely, for any M , we prove [48] the following error in diamond distance. To teleport an input qubit state ρC, Alice applies a suitable POVM {Πi} to the input qubit C and her A qubits. The outcome i is communicated to Bob, who selects the i-th among his B qubits (tracing all the others). The performance does not depend on the specific "port" i selected and the average output state is given by ΓM (ρC) where ΓM is the PBT channel. The latter reduces to the identity channel in the limit of many ports M → ∞. (b) Suppose that Bob applies a quantum channel E on his teleported output. This produces the output state E M (ρC) of Eq. (6). For large M , one has E M → E in diamond norm. (c) Equivalently, Bob can apply E ⊗M to all his qubits B in advance to the CC from Alice. After selection of the port, this will result in the same output as before. (d) Now note that Alice's LO and Bob's port selection form a global LOCC T M (trace-preserving by averaging over the outcomes). This is applied to a tensor-product state ρ ⊗M E where ρE is the Choi matrix of the original channel E . Thus the approximate channel E M is simulated by applying T M to ρC ⊗ ρ ⊗M E as in Eq. (7). each channel E with its M -port approximation E M while controlling the propagation of the simulation error δ M from the channel to the output state. This step is crucial also in simulations via standard teleportation [26,38] (see also Refs. [57-61]). Second, we need to "stretch" the protocol [37] by replacing the approximate channel E M with its Choi matrices ρ ⊗M E and then suitably re-organize all the remaining QOs. Here we describe the technique for a generic task, before specifying it for QCD.
Given an adaptive protocol P n over a channel E with output ρ n , consider the same protocol over the simulated channel E M , so that we get the different output ρ M n . Using a "peeling" argument [48], we bound the output error in terms of the channel simulation error Once understood that the output state can be closely approximated, let us simplify the adaptive protocol over E M . Using the simulation in Eq. (7), we may replace each channel E M with the resource state ρ ⊗M E , iterate the process for all n uses, and collapse all the simulation LOCCs and QOs as shown in Fig. 2. As a result, we may write the multi-copy Choi decomposition for a trace-preserving QOΛ. Now, we can combine the two ingredients of Eqs. (9) and (10), into the following.
Lemma 2 (PBT stretching) Consider an adaptive quantum protocol (with arbitrary task) over an arbitrary d-dimensional quantum channel E (which may be unknown and parametrized). After n uses, the output ρ n of the protocol can be decomposed as follows whereΛ is a trace-preserving QO, ρ E is the Choi matrix of E, and δ M is the M -port simulation error in Eq. (5).
When we apply the lemma to protocols of quantum or private communication, where the QOs Λ i are LOCCs, then we may write Eq. (11) withΛ being a LOCC. In protocols of channel estimation or discrimination, where E is parametrized, we may write Eq. (11) with ρ E storing the parameter of the channel. In particular, for QCD we have {E u } u=0,1 and the output ρ n (u) of the adaptive protocol P n can be decomposed as follows Ultimate bound for channel discrimination.-We are now ready to show the lower bound for minimum error probability p n (E 0 = E 1 ) in Eq. (3). Consider an arbitrary protocol P n , for which we may write Eq. (1). Combining Lemma 2 with the triangle inequality leads to where we also use the monotonicity of the trace distance under channels. BecauseΛ is lost, the bound does no longer depend on the details of the protocol P n , which means that it applies to all adaptive protocols. Thus, using Eq. (13) in Eqs. (1) and (2), we get the following.
Theorem 3 Consider the adaptive discrimination of two channels {E u } u=0,1 in dimension d. After n probings, the minimum error probability satisfies the bound where M may be chosen to maximize the right hand side.
Let us bound the trace distance in Eq. (14) as [62] where F is the fidelity [63] between the Choi matrices of the channels. If we also exploit Eq. (5), we may write In the previous formula there are terms with opposite monotonicity in M . For this reason, the maximum value of B is achieved at some intermediate value of M .
Single-photon quantum optical resolution.-Consider a microscope-type problem where we aim at locating a point in two possible positions, either s/2 or −s/2, where the separation s is very small. Assume we are limited to use probe states with at most one photon and an output finite-aperture optical system (this makes the optical process to be a qubit-to-qutrit channel, so that the input dimension is d = 2). Apart from this, we are allowed to use an arbitrary large quantum computer and arbitrary QOs to manipulate its registers. We may apply Eq. (17) with ǫ ≃ ηs 2 /16, where η is a diffraction-related loss parameter [48]. In this way, we find that the error probability affecting the discrimination of the two positions is approximately bounded by B 1 4 exp(−2ns √ η) [48]. Adaptive quantum illumination.-Consider the protocol of quantum illumination in the DV setting [39]. Here the problem is to discriminate the presence or not of a target with low reflectivity η ≃ 0 in a thermal background which has b ≪ 1 mean thermal photons per optical mode. One assumes that d modes are used in each probing of the target and each of them contains at most one photon. This means that the Hilbert space is (d + 1)-dimensional with basis {|0 , |1 , . . . , |d }, where |i := |0 · · · 010 · · · 0 has one photon in the ith mode. If the target is absent (u = 0), the receiver detects thermal noise; if the target is present (u = 1), the receiver measures a mixture of signal and thermal noise. In the most general (adaptive) version of the protocol, the receiver belongs to a large quantum computer where the (d + 1)-dimensional signal qudits are picked from an input register, sent to target, and their reflection stored in an output register, with adaptive QOs performed between each probing. After n probings, the state of the registers ρ n (u) is optimally detected. Assuming the typical regime of quantum illumination [39], we find that the error probability affecting target detection is approximately bounded by B [48]. Conclusion.-In this work we have established a general and fundamental lower bound for the error probability affecting the adaptive discrimination of two arbitrary quantum channels acting on a finite-dimensional Hilbert space. This bound is conveniently expressed in terms of the Choi matrices of the channels involved, so that it is very easy to compute. It also applies to many scenarios, including adaptive protocols for quantum-enhance optical resolution and quantum illumination. In order to derive our result, we have employed port-based teleportation as a tool for channel simulation, and developed a methodology which simplifies adaptive protocols performed over an arbitrary finite-dimensional channel. This technique can be applied to many other scenarios, not just quantum hypothesis testing, but also quantum metrology, quantum and private communications. In particular, as we discuss in [48, Sec. V], our technique also allows us to show that adaptive protocols of quantum channel estimation are limited to the Heisenberg scaling, therefore drawing an intimate connection between portbased teleportation and quantum metrology.
Aknowledgements.-This work is supported by the culations related to adaptive quantum illumination; (Sec. V) Results related to adaptive quantum channel estimation, including the proof of the Heisenberg limit as a consequence of PBT; (Sec VI) Converse bounds for adaptive quantum and private communications.
[49] In fact, recall that the diamond distance is defined as where I is an identity map acting on a reference system r. The upper bound in Eq. (3) is achieved by a specific (non-adaptive) protocol, where an (optimal) input state ρar is prepared and its a-parts transmitted through E ⊗n u .
[50] Note that, if we allow the simulator S to include part of the channel E , then we may simulate any channel [37]. This solution can be adopted for the tasks of quantum and private communication. However, in QCD and quantum metrology, we need to consider a universal (channelindependent) S in order to simplify adaptive protocols. From Ref.
[51, 52], we know that single-program universal simulators cannot simulate any quantum channel, so that the use of multi-program versions must necessarily be considered. [53] Note that this resource state may be optimized in a suitable way to increase the performance of the protocol [31]. This is achieved by adding an operator on Alice's qudits before detection. Such an operator is generally non-trace preserving and, for this reason, it cannot be included in our derivations, where we exploit the monotonicity under trace-preserving QOs (data processing).
[54] The equiprobability of the outcomes and their independence from the input state can be understood by the fact that the scheme is invariant under permutation of the Bell states and, therefore, of the ports. For large M , this can also be understood by the fact that we may always feed a Bell state into the PBT and later use part of that state to teleport an arbitrary input via standard teleportation (whose correction unitaries can be done at the output, i.e., after the identity channel realized by PBT for large M ).
[55] Explicitly, this channel takes the form ΓM As noted in Ref.
[56], the channel Γ M associated with the qudit PBT protocol of Ref. [29] is covariant under unitary transformations, i.e., for any input state ρ and unitary operator U . Ref.
[56] has also shown that, for a channel with such a symmetry, the diamond distance with the identity map is saturated by a maximally entangled state, i.e., where In fact, first note that the map Λ M = I ⊗ Γ M is covariant under twirling unitaries of the form U ⊗ U * , i.e., where I is the two-qudit identity operator. We may rewrite this state as follows where ρ ⊥ is state with support in the orthogonal complement of Φ, and F is the singlet fraction Thanks to the decomposition in Eq. (S7) and using basic properties of the trace norm, we may then write where the last step exploits the fact that the singlet fraction F is the channel's entanglement fidelity f e (Γ M ). Finally, it is known that the entanglement fidelity of Γ M is bounded as [29] f e (Γ M ) ≥ 1 − d(d − 1)M −1 .

II. PROPAGATION OF THE SIMULATION ERROR
This is given for the sake of completeness, we prove the first inequality in Eq. (9) of the main text. Consider the adaptive protocol described in the main text. For the n-use output state we may compactly write where Λ's are adaptive QOs and E is the channel applied to the transmitted signal system. Then, ρ 0 is the preparation state of the registers, obtained by applying the first QO Λ 0 to some fundamental state. Similarly, for the M -port simulation of the protocol, we may write (Note that the following reasoning applies to a fixed channel E or, more generally, to classically-parametrized unknown channel E u ).
Consider now two instances (n = 2) of the adaptive protocol. We may bound the trace distance between ρ 2 and ρ M 2 using a "peeling" argument [25,37,38,81] (S14) In (1) we use the monotonicity of the trace distance under completely-positive trace-preserving (CPTP) maps (i.e., quantum channels); in (2) we employ the triangle inequality; in (3) we use the monotonicity with respect to the the CPTP map E • Λ 1 whereas in (4) we exploit the fact that the diamond norm is an upper bound for the trace norm computed on any input state. Generalizing the result of Eq. (S14) to arbitrary n, we achieve the first inequality in Eq. (9) of the main text.

III. ULTIMATE SINGLE-PHOTON QUANTUM OPTICAL RESOLUTION
Consider the problem of discriminating between the following situations: (1) A point-like source emitting light from position x = s/2; (2) A point-like source emitting light from the shifted position x = −s/2.
The discrimination is achieved by measuring the image created by a focusing optical system. More precisely, we consider a linear imaging system in the paraxial approximation that is used to image point-like sources. This is characterized by the Fresnel number where ℓ is the size of the object, and is the Rayleigh length. Here λ is the wavelength and N A = R/D is the numerical aperture, where R is the radius of the pupil and D is the distance from the object. In the far-field regime, light is attenuated by a loss parameter η ≃ F [82][83][84]. In particular, because we consider point-like sources, we are in the regime η ≪ 1.
First we need to model the imaging system as a quantum channel acting on the input state represented by the light emitted by the source. The two cases are described by the following Heisenberg-picture transformations on the input annihilation operator a (1) : a → √ ηb 1 + 1 − ηv 1 , (S17) where b 1,2 are the output operators (encoding the position of the source) and v 1,2 are associated with a vacuum environment. The modes b 1 , b 2 are defined on the image plane and have the form where a(x), a(x) † is a continuous family of canonical operators [a(x), a(y) † ] = δ(x − y) defined on the image plane (for simplicity, we assume unit magnification factor). In general the image modes b 1 , b 2 do satisfy the (non-canonical) commutation relations where ψ j is the point-spread function associated to the source being in poisiton j. Then, by setting δ = Re dx ψ 1 (x)ψ * 2 (x), we can define the effective image operators The fact that δ = 0 means that the two image fields overlap and the sources cannot be perfectly distinguished. This is a manifestation of diffraction through the finite objective of the optical imaging system. As a result, we can write the action of the channels as where η ± := (1 ± δ)η/2. For simplicity, consider a singlephoton state at the input. We then have where More generally, the action of the channels on a generic pure input state is given by As we can see from Eqs. (S27) and (S28), if we apply a Pauli operator X [11] to the input state α|0 + β|1 , we have a swap between α and β. This leads to an output state with a different eigenspectrum, so that it cannot be obtained by applying a unitary. This means that the quantum channels are not teleportation-covariant. By limiting ourselves to the space of either no photon or one photon H 2 = span{|0 , |1 }, the the input space of the channels is a qubit, and their output is a qutrit, so that the dimension of the input Hilbert space is d = 2. Apart from restricting the input space to qubits, we assume the most general adaptive strategy allowed by quantum mechanics, so that the quantum state of the source may be optimized as a consequence of the output (as generally happens in the adaptive protocol discussed in the main text). In order to compute the ultimate performance, we need to compute the quantum fidelity between the Choi matrices of the two channels in Eqs. (S22) and (S23) suitably truncated to H 2 .
where x j is the center of the jth emitter, and the variance of the Gaussian is 1 in units of Rayleigh length. Under this Gaussian model one obtains [67,68] δ ≃ e −s 2 /8 , where s is the separation in unit of wavelength. Therefore By replacing this quantity in Eq. (17) of the main text with d = 2 we obtain the lower bound

IV. ULTIMATE LIMIT OF ADAPTIVE QUANTUM ILLUMINATION
A. Standard (non-adaptive) protocol In quantum illumination [39,40,45,46], we aim at determining whether a low-reflectivity object is present or not in a region with thermal noise. We therefore prepare a signal system s and an idler system i in a joint entangled state ρ si . The signal system is sent to probe the target while the idler system is retained for its measurement together with the potential signal reflection from the target. If the object is absent, the "reflected" system is just thermal background noise. If the object is present, then this is composed of the actual reflection of the signal from the target plus thermal background noise. This object can be modelled by a beam splitter, with very small transmissivity η ≪ 1, which combines the each incoming optical mode (signal system) with a thermal mode with b mean number of photons.
In the discrete-variable version of quantum illumination [39], the signal system is prepared in an ensemble of d optical modes, with 1 photon in one of the modes and vacuum in the others. This is the number of modes which are distinguished by the detector in each detection process. If we introduce the following d−dimensional computational basis then the entangled signal-idler state can be written as Let us define the d-dimensional identity operator I d := d k=1 |k k| which projects onto the subspace spanned by the 1-photon states, and the (d + 1)-dimensional identity operator I d+1 := d k=0 |k k| which also includes the vacuum state |0 := |00 . . . 00 . Then, we have the reduced idler state and we define the thermal state of the environment as [39] ρ th (b) : where b is the mean number of thermal photons per mode. Here b ≪ 1 and db ≪ 1, where db is the mean number of thermal photons in each detection event.
The output (d + 1) × d state of the reflected signal and retained idler is given by If the target is probed n times, then we may use the QCB to bound Q the error probability p err in the discrimination of ρ and σ. In the regime of signal-to-noise-ratio ηd/b 1, one finds [39] which tightens the QCB by a factor d with respect to the unentangled case where Q ≈ 1−η 2 /(8b). From Eq. (S47), we may write the following bound for the error probability of target detection after n probings [39] p n (σ = ρ) ≤ In particular, for ηd/b ≃ 1, this can be written as The adaptive formulation of the discrete variable protocol of quantum illumination assumes an unlimited quantum computer with two register a and b, prepared in an arbitrary joint quantum state. In each probing, a system a is picked from the input register a and sent to the target. Its reflection a ′ is stored in the output register b. A adaptive quantum operation (QO) is applied to both the update registers before the next transmission and so on. Therefore any probing is interleaved by the application of adaptive QOs Λ's to the registers, defining the adaptive protocol P n (see also the main text for this description). After n probings, the state of the registers is ρ n (u) where u = 0, 1 is a bit encoding the absence or presence of the target. This state is optimally measured by an Helstrom POVM. By optimizing over all protocol P n , we define the minimum error probability p n for adaptive quantum illumination.
Following the constraints and typical regime of DV quantum illumination, we assume that the signal systems are (d + 1)-dimensional qudits described by a basis {|0 , |1 , . . . , |d }, where |i := |0 · · · 010 · · · 0 has one photon in the ith mode. For this reason, the two possible quantum illumination channels, E 0 and E 1 , are (d + 1)dimensional channels. In particular, consider as their input the maximally-entangled state which is similar to ψ si in Eq. (S43) but also includes the vacuum state. Then, we may write the following two (d + 1) × (d + 1) dimensional Choi matrices (S51) It is clear that E 0 and E 1 are not jointly teleportationcovariant due to the fact that they have different transmissivities (η 0 = 0 and η 1 = η).
To bound p n we apply Theorem 2 of the main text and, more specifically, Eq. (17) of the main text, because η ≪ 1 and, therefore, the fidelity between the Choi matrices can be expanded as F (σ, ρ) ≃ 1 − ǫ. Thus, let us start by computing this fidelity. Let us set x = √ 1 − bd and note that we may write Then, we may compute (S54) Once we find the eigenvalues of Ω 2 we take their square root so as to compute those of Ω. Finally, their sum provides TrΩ = F (σ, ρ). We are interested in the regime of low thermal noise b ≪ 1 and low reflectivity η ≪ 1. There, we may expand at the leading orders in η and b to get In the typical signal-to-noise-ratio ηd/b ≃ 1 of quantum illumination [39], we may directly re-write Eq. (S55) as By replacing the latter in Eq. (17) of the main text (and assuming the correct dimension d → d + 1), we get the following lower bound for the minimum error probability p n of adaptive quantum illumination

V. ADAPTIVE QUANTUM CHANNEL ESTIMATION
A. Adaptive protocols for parameter estimation Consider here adaptive quantum channel estimation. This corresponds to estimating a continuous parameter θ encoded in a quantum channel E θ by means of the most general protocols allowed by quantum mechanics, i.e., based on adaptive QOs as described in the main text. After n probings, there is a θ-dependent output state ρ n (θ) which is generated by the sequence of QOs {Λ 0 , Λ 1 , . . . , Λ n } characterizing the adaptive protocol P. Finally, the output state is measured by a POVM M providing an optimal unbiased estimatorθ of parameter θ. The minimum error variance Var(θ) := (θ −θ) 2 must satisfy the quantum Cramer-Rao bound (QCRB) [75] Var(θ) ≥ (QFI n θ ) −1 , where QFI n θ is the quantum Fisher information (QFI) associated with n adaptive uses.
Note that the QFI can be computed as where d B (ρ, σ) := 2[1 − F (ρ, σ)] is the Bures distance, with F (ρ, σ) being the Bures fidelity of ρ and σ. The ultimate precision of adaptive quantum metrology is given by optimizing the QFI over all adaptive protocols, i.e., QFI n θ := sup P QFI n θ (P).
Contrarily to the cases of sequential or parallel strategies [85], the ultimate performance of adaptive quantum metrology is poorly studied [86][87][88][89][90], with limited results for DV programmable channels [25,91], and more recent results for DV and CV teleportation-covariant channels, such as Pauli or Gaussian channels [25].

B. PBT stretching of adaptive quantum metrology
As shown in Ref. [25], the adaptive estimation of a noise parameter θ encoded in a teleportation-covariant channel (i.e., such that the parametrized class of channels E θ is jointly-teleportation covariant) is limited to the standard quantum limit (SQL). More generally, as discussed in Ref. [26], the adaptive estimation of a parameter in a quantum channel cannot beat the SQL if the channel has a single-copy simulation, i.e., of the type where S is a (parameter-independent) trace-preserving QO and π θ is a program state (depending on the parameter). To beat the SQL, the channel should not admit a simulation as in Eq. (S61) but a multi-copy version for some M > 1. This is approximately the type of simulation that we can achieve by using PBT.
First of all, we may replace the channel E θ with its M -port approximation E M θ := E θ • Γ M , where Γ M is the M -port PBT channel. Using Lemma 1 of the main text, the simulation error may be bounded as where we set β := d(d− 1). By repeating the steps shown in Fig. 1 of the main text, we may write the metrological equivalent of Eq. (7). In other words, for any input state ρ C , we may write the simulation where T M is a trace-preserving LOCC and ρ E θ is the Choi matrix of E θ . Then, we may also repeat the PBT stretching in Fig. 2 of the main text. In this way, the n-use output state ρ n = ρ n (θ) of an adaptive parameter estimation protocol can be decomposed as in Lemma 2 of the main text, i.e., Using the decomposition in Eq. (S65), we may write a bound for the optimal quantum Fisher information in Eq. (S60). For large n, we obtain the Heisenberg scaling QFI n θ n 2 QFI(ρ E θ ), where In order to show Eq. (S66), consider the function q n (θ, δ) = 2 d B [ρ n (θ), ρ n (θ + δ)] δ .
(S89) Note that for a private state, we may write log 2 d ≤ cn for some constant c [38]. Thus, for any adaptive key generation protocol P over a d-dimensional quantum channel E, the maximum ǫ-secure key rate that can be generated after n uses is bounded as in Eq. (S89) where E is an entanglement measure (as the REE or the SE), M is the number of ports, and δ M is the error of the M -port PBT defined in Eq. (5).
We can find alternate bound by extending the definition of channel's REE [37] to a tripartite version. Consider three finite-dimensional systems a ′ , a and b ′ , and a quantum channel E = E a→b from a to the output system b. Consider a generic input state ρ a ′ ab ′ transformed into an output state ω a ′ bb ′ := E a→b (ρ a ′ ab ′ ) by the action of this channel. Then, one can define a tripartite version of channel's REE as (S91) f (ǫ) := (1 + ǫ) log 2 (1 + ǫ) − ǫ log 2 ǫ, where d is the dimension of the Hilbert space. Finally, as a straightforward application of one of the tools established in Ref. [37], i.e., the LOCC simulation of a quantum channel E via a resource state σ [38], one may write