Achieving the ultimate end-to-end rates of lossy quantum communication networks

The field of quantum communications promises the faithful distribution of quantum information, quantum entanglement, and absolutely secret keys, however, the highest rates of these tasks are fundamentally limited by the transmission distance between quantum repeaters. The ultimate end-to-end rates of quantum communication networks are known to be achievable by an optimal entanglement distillation protocol followed by teleportation. In this work, we give a practical design for this achievability. Our ultimate design is an iterative approach, where each purification step operates on shared entangled states and detects loss errors at the highest rates allowed by physics. As a simpler design, we show that the first round of iterations can purify completely at high rates. We propose an experimental implementation using linear optics and photon-number measurements which is robust to inefficient operations and measurements, showcasing its near-term potential for real-world practical applications.

The field of quantum communications promises the faithful distribution of quantum information, quantum entanglement, and absolutely secret keys, however, the highest rates of these tasks are fundamentally limited by the transmission distance between quantum repeaters.The ultimate end-to-end rates of quantum communication networks are known to be achievable by an optimal entanglement distillation protocol followed by teleportation.In this work, we give a practical design for this achievability.Our ultimate design is an iterative approach, where each purification step operates on shared entangled states and detects loss errors at the highest rates allowed by physics.As a simpler design, we show that the first round of iteration can purify completely at high rates.
We propose an experimental implementation using linear optics and photon-number measurements which is robust to inefficient operations and measurements, showcasing its near-term potential for real-world practical applications.
The great challenge for quantum communication [1] is how to overcome loss [2], the dominant source of noise through free space and telecom fibers.Many applications [3][4][5][6][7], including quantum key distribution (QKD) [8,9] (i.e., the task of sharing a secret random key between two distant parties), suffer from an exponential rate-distance scaling [10,11].Determining the most efficient protocols for distributing quantum information, entanglement, and secure keys is of vital importance to realise the full capability of the quantum internet [12].
It is known that the reverse coherent information (RCI) [13] is an achievable rate for entanglement distillation by an implicit optimal protocol based on one-way classical communication.For the bosonic pure-loss channel, this rate is R = − log 2 (1 − η) [10], where η ∈ [0, 1] is the channel transmissivity.This is an achievable rate for entanglement distillation, E D , over the lossy channel and is also an achievable rate for secret key distribution, K, since an ebit is a specific form of secret key bit.To summarise, we have K ≥ E D ≥ R = − log 2 (1 − η).
Likewise, there are fundamental limits to the highest end-to-end rates of arbitrary quantum communication networks [15], where untrusted quantum repeaters divide the total distances into shorter quantum channels (links).Quantum repeaters are strictly required to beat the PLOB bound [16,17].For a linear repeater chain, it is optimal to place repeaters equidistantly, then the ultimate end-to-end rate is given by − log 2 (1 − η) [15], where η now refers to the transmissivity of each link.For a multiband network, consisting * mattwinnel@gmail.com of m generally-entangled channels in parallel, the rate is additive, −m log 2 (1 − η) [15].These ultimate repeater bounds are achievable by using an optimal entanglement distillation protocol followed by quantum teleportation (entanglement swapping), while ideal quantum memories are most-likely required to achieve the highest rates.
The goal of this paper is to give a physical realisation for achieving these ultimate rates, which could pave the way for experimental implementations.While the highest achievable secret key rate for point-to-point CV QKD saturates the PLOB bound [8], it does not provide a physical design for entanglement distillation.Furthermore, it is impossible to distil Gaussian entanglement using Gaussian operations only [18,19] so quantum repeaters must use non-Gaussian elements [20].
Protocols based on infinite-dimensional systems are required to saturate the ultimate limits.However, the majority of quantum-information-processing tasks and techniques are for discrete-variable (DV) systems [21] where the quantum information is finite dimensional.In contrast, for continuous-variable (CV) systems [2,[22][23][24][25], the quantum information is infinite dimensional and encoded in the quadrature amplitudes, and in principle offer easier state manipulation [22] and compatibility with existing optical telecom infrastructure [26].Previous practical quantum repeater designs are unable to distil entanglement at the ultimate rates [27][28][29][30][31][32].
Quantum repeaters have previously been categorised into three generations depending on how they combat loss and other sources of noise [16,17].With respect to CV systems, the first two generations [33][34][35][36][37][38][39] remove loss via teleportation-based techniques, for instance, entanglement swapping and/or noiseless linear amplification [33][34][35][36][37][38][39].These techniques fail to achieve the ultimate limits under pure loss since the output state is not pure and the success probability is zero for high-energy input states.For instance, the schemes based on noiseless linear amplification [30][31][32] have the same rate-distance scaling as the ultimate bounds but do not saturate them.A simple explanation is given in Supplementary Note 1, also see Ref. [40].
The third generation of quantum repeaters [41] uses quantum error correction [42] and is a purely one-way communication scheme.It promises high rates since it does not require back-and-forth classical signalling, however, here the ultimate rates are bounded by the unassisted quantum capacity of each link [14], log 2 ( η 1−η ) < C.This means the third-generation rate is zero if η ≤ 0.5, which translates to a maximum link distance of about 15 km for optical fiber with a loss rate of 0.2 dB/km.In contrast, the two-way assisted capacity of pure loss allows a nonzero achievable rate at all distances.It is interesting to note that the family of GKP codes [43] achieves the unassisted capacity of general Gaussian thermal-loss channels with added thermal noise, where pure loss is the zero-temperature case, up to at most a constant gap [44].Likewise, our main result is to give a practical protocol which achieves the two-way assisted capacity of the pureloss channel.
In summary, all three generations of quantum repeaters are unable to operate at rates which saturate the ultimate limits of quantum communications.Motivated by this reality, we introduce an iterative protocol to purify completely from pure loss and achieve the capacity of the channel.Our schemes are inspired by Refs.[45,46].The idea is that neighbouring nodes locally perform photon-number measurements on copies of shared CV entanglement across the lossy channel, followed by two-way classical communication to compare photon-number outcomes.We show that the highest rates of our purification scheme, requiring two-way classical communication, achieve the fundamental limits of quantum communications for pure-loss channels.In contrast to quantum error correction, we describe purification as a quantum-error-detection scheme against loss.We consider a much-simpler design with good rates requiring only one-way classical communication and no iteration.
In this work, the required measurements are quantum non-demolition measurements (QND) of total photon number of multiple modes and can be implemented experimentally using linear optics and photon-number measurements.This implementation is naturally robust against inefficiencies of the detectors and gates.Alternatively, these QND measurements can be implemented using high finesse cavities and cross-Kerr nonlinearities [46].

RESULTS
First, we introduce our iterative protocol for the complete purification of high-dimensional entanglement, saturating the two-way assisted capacity of the bosonic pure-loss channel.Then, we show that our protocol without iteration (i.e.single-shot) still gives high rates which fall short of the ultimate limits by at worst a factor of 0.24.Finally, we explain how to implement our protocol using linear-optics and photon-number measurements.
Iterative purification.Alice and Bob share multiple copies of a state which is entangled in photon number, such that in a lossless situation they will always measure the same number of photons.Our purification technique, in a pure loss situation, is for Alice and Bob to each locally count the total number of photons contained in multiple copies of the shared entangled states, and then compare the results.If they locally find a different total number of photons, this means photons were lost.Alice and Bob then iteratively perform total photon-number measurements over smaller subsets of states until their outcomes are the same, and hence distil pure entanglement.We prove that the highest average rate of the protocol achieves the capacity of the pure-loss channel.
We now consider our protocol in detail.The protocol is shown in Fig. 1.Consider two neighbouring nodes in a network, Alice and Bob, separated by a repeaterless link.Round one of our iterative protocol is identical to entanglement purification of Gaussian CV quantum states from Ref. [46], however, our protocol includes an iterative procedure.Alice prepares m copies of a pure two-mode squeezed vacuum (TMSV) state Alice shares the second mode of each of the m pairs with Bob across the link.The error channel we consider is bosonic pure loss, modelled by mixing the data rails with vacuum modes of the environment, or a potential eavesdropper (Eve), on a beamsplitter with transmissivity η.
Alice encodes the quantum information into a quantum-error-detecting code so that Bob can detect errors on his side.To do this, she performs a QND measurement of total photon number on the m modes and obtains outcome k 1 (where the subscript 1 refers to the round one of iteration), and shares this information with Bob via classical communication.Alice's measurement projects the system before the channel onto a maximallyentangled state [46]  where |µ k1,m = |n , and the probability of Alice's measurement outcome, k 1 , is P Alice k1,m = (1 − χ 2 ) m χ 2k1 d k1,m .The dimension, d k1,m , is the total number of ways k 1 identical photons can be arranged among the m distinct rails.
Bob then performs a QND measurement of total photon number across the m rails on his side to detect loss errors.If Bob obtains the outcome j 1 photons, and knows that Alice sent k 1 photons, then both Alice and Bob know that k 1 −j 1 photons were lost.Bob's QND measurement, with success probability P Bob k1,j1 = (1−η) k1−j1 η j1 k1 j1 , heralds a renormalised mixed state shared between Alice and Bob which does not depend on loss for any outcome j 1 .That is, together Alice's and Bob's QND measurements remove all dependence on loss and has exchanged success probability for entanglement, while they learn that k 1 −j 1 photons were lost to the environment.All outcomes besides zero at Alice and Bob herald useful entanglement.If j 1 = k 1 , they must do further rounds of purification (iteration) since the output state is not pure.If j 1 = k 1 , then the output state is strictly pure and purification is complete in a single round.For a simpler protocol, Alice and Bob may post select on outcomes j 1 = k 1 without further iteration.We show later in the paper that this single-shot protocol still gives excellent rates.
Explicitly, the global output state heralded by out-comes k 1 and j 1 is where A, B, e refer to the m-rail quantum systems owned by Alice, Bob, and the environment, respectively, as shown in Fig. 1.The full derivation of this state is in Supplementary Note 2. The factor (1−η) 2 is outside the sum, thus, we have the remarkable result that the renormalised output state shared between Alice and Bob does not depend on η.Therefore, the entanglement shared between Alice and Bob also has no dependence on η, which has been exchanged for probabilities.
Additional rounds of purification can purify more entanglement after the initial round.One approach is for Alice and Bob to locally perform QND measurements as in round one but on m − n + 1 rails, and obtain outcomes k n , j n , where n refers to the round number.At round n, there is no entanglement shared between Alice and Bob on the last n − 1 rails and the photon number of each of these rails is completely known.At round n, these last n − 1 rails can be discarded while the m − n + 1 rails should be kept.
Exact rate of iterative entanglement purification for finite numbers of rails.The rate of our purification protocol (in ebits per use) is maximised if Alice performs her first measurement offline (i.e., setting P Alice k1,m = 1) where she obtains outcome k 1 .For finite m, there is a finite k 1 which optimises the rate.However, for large squeezing χ → 1 outcomes k 1 are dominated by k 1 → ∞ with unity probability.Therefore, the large squeezing limit χ → ∞ without k 1 pre-selection, is equivalent to k 1 → ∞ with offline k 1 pre-selection.
Taking Alice's first measurement to be done with result k 1 offline (which can be chosen in advance to optimise the rate or, for example, the practicality of the protocol), the rate for finite m is where the sum is constrained by where the probability of success for a particular combination of outcomes, j 1 , k 2 , j 2 , . . ., k n , j n , for a given k 1 and m is where a maximally-entangled state is generated with entanglement The rate E k1,m (η) for finite m can be optimised over Alice's initial outcome k 1 prepared offline and the number of rails m as a function of η.We numerically compute the rate in Supplementary Note 3 for small k 1 and m.We show next that the highest rate of our iterative protocol achieves the capacity, C, for m → ∞ and k 1 → ∞ (i.e., χ → 1).We show this without having to compute equation (4) directly which would be arduous.
Optimality of our protocol.The RCI [10,13], R, gives an achievable lower bound on the distillable entanglement, E D , and on the optimal secret key rate.The RCI is defined in the Methods section.We will show that our protocol is optimal for entanglement distillation as m → ∞ and χ → 1 and that no entanglement is lost between rounds.We use the RCI as a benchmark to test the quality of our distillation procedure.The optimal distillation protocol implicit by the RCI is not required here since our scheme gives the same performance as the implicit optimal protocol round after round for large m.
We require that the weighted average von Neumann entropy of the reduced pure states heralded after round one, S 1 , plus the average RCI of the failure states heralded after round one, F 1 , equals the RCI of the state before round one.Note that the RCI equals the von Neumann entropy for pure states.We have in units of ebits per channel use, where where P k1,j1,m =P Alice k1,m P Bob k1,j1 , where P Alice j1 .When the first round succeeds, the entanglement of the renormalised maximally-entangled pure-state shared between Alice and Bob heralded by outcomes k 1 = j 1 is given by the von Neumann entropy of the reduced state: which does not depend on the transmissivity, η, nor the amount of two-mode squeezing, χ.When the first round fails, the RCI of the renormalised mixed state shared between Alice and Bob heralded by each pair of outcomes k 1 and j 1 is which also does not depend on the transmissivity, η, nor the amount of two-mode squeezing, χ.See Supplementary Note 2 for the derivation.
The amount of squeezing is scaled to infinity χ → 1, such that Alice initially measures a large amount of photons k 1 → ∞ and m/k 1 → 0. Furthermore, from the fact that P Bob k1,j1 is a binomial distribution, Bob will most likely measure j 1 ≈ ηk 1 photons.Using these conditions, we show in Supplementary Note 3 that equation ( 12) approaches which ensures that round one of purification is optimal since there is no loss of rate after round one as m → ∞, given that the average RCI at the end of the round equals the initial RCI of the protocol.Thus, there exists an optimal protocol to follow round one which can saturate the two-way assisted quantum capacity (the PLOB bound) using our protocol as an initial step.The entanglement is optimally exchanged for success probability.
Similarly, we prove in Supplementary Note 3 that round n is optimal since there is no loss of rate at round n as m → ∞, up to the same factor, m−1 m .This factor comes from Alice's and Bob's measurement of photon number.
To quantify this loss of entanglement, consider the protocol before the channel.We'll see that for finite m some entanglement is immediately lost after Alice's QND measurement.Ref. [46] defined the entanglement ratio, denoted by Γ 1 , as the average entanglement heralded by Alice's QND measurement divided by the total initial entanglement mE χ , that is, In the limit of a large number of rails lim m→∞ Γ 1 = 1 for all 0 < χ ≤ 1, which means asymptotically Alice's QND measurement heralds no loss of entanglement.However, for finite m in the limit of large squeezing, lim χ→1 Γ 1 = (m − 1)/m.So, for finite number of rails m some entanglement is lost since 1/2 < (m − 1)/m < 1.
This means we must take m → ∞ to get the highest rates.
Similarly, to quantify the entanglement lost at round n > 1, we define the entanglement ratio, Γ kn−1 , as the weighted average entanglement heralded at round n over all outcomes k n normalised by the weighted entanglement heralded by outcome k n−1 at the previous round, n − 1, that is, where d kn = kn+m−n kn and d kn−1 = kn−1+m−n+1 kn−1 . P kn (P kn−1 ) and E kn (E kn−1 ) are defined in equations (10) and (11), for a given k n (k n−1 ), and of course we can take j i = k i for all i since here we consider no loss channel.Many of the factors cancel giving the simple expression in equation (19).Curiously, for large numbers of rails the amount of entanglement lost at round n is the same as for round one, i.e., lim m→∞ Γ kn−1 = (m − 1)/m for all k n−1 .This result ensures that "encoding" into k n photons is asymptotically optimal throughout the entire duration of our iterative procedure up to the factor (m − 1)/m, which approaches unity for large m.
Achieving the capacity.The average rate in case of success of pure entanglement distilled at round n in ebits per use of the channel is and the average rate in case of failure of entanglement distilled at round n in ebits per use of the channel is lower bounded by the average RCI where P is the probability from equation (10) and is the RCI of the heralded states.
Note δ kn,jn is the Kronecker delta function.For the rate in case of success, the RCI equals the von Neumann entropy since the states are pure, R = E.The entanglement in case of failure at round n will be purified at a later round.Since our protocol is optimal at round n for χ → 1 and m → ∞, we have the following expressions: for 2 ≤ n ≤ m.We solve this system of equations by addition, and we find that the average rate in case of success of purification using our iterative procedure for m → ∞ and χ → 1 is We achieve the capacity (PLOB) in the limit of a large number of rails, where lim m→∞ m−1 n=1 Fn m → 0 and lim m→∞ (m − 1)/m → 1. See Supplementary Note 3 for the proof.
Achievable rates of repeater networks.Our protocol purifies completely at the PLOB rate.Assuming ideal quantum memories are available, after teleportation (entanglement swapping) we achieve the the ultimate end-to-end rates of quantum communication networks by adopting the routing methods of Ref. [15].That is, the results can be extended beyond chains to consider more complex topologies and routing protocols [15].We describe details about entanglement swapping in Supplementary Note 4. We plot the highest rates of iterative purification as a function of total distance with no repeater and one repeater in Fig. 2a (black lines) which coincide with the capacities.We also plot rates in Fig. 2a for single-shot purification for finite m where Alice and Bob stop after the first round which is a much more practical design.We discuss in detail those singleshot rates next.
Single-shot purification.Purification is complete after a single round if no photons are lost and Alice and Bob detect the same number of photons, j 1 = k 1 .If Bob detects less photons than Alice, j 1 < k 1 , further purification is required, however, it is most practical to disregard those outcomes and keep only the outcome j 1 = k 1 which purifies in one shot.Alice's measurement can be preselected and prepared offline, thus, improving the rate of a particular pair of outcomes.The single-shot rate for a given m and k ≡ k 1 = j 1 can be quite close to the PLOB rate.
Recall that the optimal protocol implicit by the RCI is based on one-way classical communication [13], whereas, our iterative procedure requires two-way classical communication.Here, the single-shot protocol requires only one-way classical communication, like the implicit optimal protocol.Alice and Bob agree on the quantum-errordetecting code (k and m) in advance, so Alice does not need to send any classical information towards Bob.Bob only needs to send classical information towards Alice, telling her when the protocol succeeds.This greatly simplifies the required back-and-forth signalling in a quantum network.
Highest achievable rate for single-shot purification against the bosonic pure-loss channel.The We plot the highest rates of iterative purification (black), singleshot purification (red), and single-shot purification for qubits (blue dashed) as a function of the total end-to-end distance, for optical fiber with a loss rate of 0.2 dB/km.Purification is used to distribute and purify entanglement between nodes and entanglement swapping connects the end users.To illustrate, we plot rates without a repeater and with one repeater.Equivalently, these rates are secret key rates since ebits are specific types of secret bits [47].Our highest rates coincide with the ultimate limits of quantum communications (black), shown here the repeaterless PLOB bound [14] and the one-repeater bound [15].At all distances the output states are strictly pure.The scaling improves for increased numbers of repeaters (not shown).b The ratio of the optimised rate of our single-shot purification protocol without a repeater with the repeaterless PLOB bound as a function of distance, showing how close it comes to saturating the bound (and therefore end-to-end quantumrepeater networks in general).The optimal number of photons, k, at each distance is shown in rounded brackets.At shorter distances codes with more photons are optimal.The three-rail encoding (m = 3) is optimal at most distances, with sometimes a larger m optimal at distances less than about 1.6 km.At large distances, the ratio E single shot k,m /C approaches ln 3/3 ∼ 0.366.As the distance goes to zero, rate of single-shot purification is as follows.The probability that Alice obtains outcome , however, for the single-shot protocol we can incorporate this step into Alice's state preparation and assume this is done offline such that P Alice k,m = 1.This means the rate will not depend on χ.When Bob obtains the outcome which matches Alice's, k, his probability is P Bob k = η k and the output state is pure with entanglement E k,m = log 2 d k,m .Thus, the achievable rate of single-shot entanglement purification in ebits per use of the channel is The rate is divided by the number of rails, m, to compare directly with the PLOB bound [14].This is required because Alice and Bob exploit a quantum channel whose single use involves the simultaneous transmission of m distinct systems in a generally entangled state.This rate is for a perfect implementation without any additional losses, errors, or noise.The protocol heralds pure states in a single attempt, so if we have ideal quantum memories, after entanglement swapping (see Supplementary Note 4 for details on entanglement swapping) we can distribute entanglement between ends of a network without any loss of rate, i.e., at the rate given by equa-tion (27) where η is the transmissivity of the most destructive link.
Our optimised rate over k and m is shown in Fig. 2a, without and with one quantum repeater (with a repeater, we assume ideal quantum memories).The PLOB bound can ultimately be broken at 46.3 km using single-shot purification between nodes and a single repeater for entanglement swapping.In Fig. 2b, we show the ratio of our optimised single-shot rate with the PLOB bound, showing that at long distances the protocol falls short of the PLOB bound by just a factor of ln 3/3 ∼ 0.366, and remarkably, our rate approaches 1  2 C at short distances.At short distances, the rate is optimised for larger k while at long distances k = 1 is always optimal since the probability that photons arrive scales like η k at long distances.The optimal number of rails is about m = 3 at most distances (including long distances) since increasing the number of rails decreases the rate like 1/m.Larger m is sometimes optimal at short distances.
The rate of our single-shot purification protocol is unable to saturate the ultimate limit because we postselect on Bob's outcomes, throwing away useful entanglement when j = k and j > 0. Keeping all measurement outcomes, the rate increases, however, it is less practical to do so.
Quantum error detection.In this section, we describe our single-shot purification protocol as quantum error detection.Consider encoding an arbitrary finitedimensional single-rail state with dimension d k,m : where The code is a subspace with d k,m dimensions (d k,m -dimensional), a subspace of the infinitedimensional Hilbert space chosen to detect loss errors nondeterminisitically.It is represented by the projector onto the subspace where are the orthogonal basis states (code words) which make up the code subspace (code space), where µ is the logical label.Note n (µ) i is the number of photons in the ith rail, which depends on the logical label µ, as well as k and m where m i=1 n (µ) i = k.There are d k,m code words, i.e., for a given code the set of code words is can faithfully be transmitted to Bob, conditioned that he detects no errors.Photon loss (and photon gains) will result in states outside of code space, which we can distinguish as an error.
The set of logical states forming the d k,m -dimensional basis of the code consists of all possible ways k identical photons can be arranged among the m distinct rails.
For example, |µ k=2,m=3 ∈ {|0, 0, 2 , |0, 2, 0 , |2, 0, 0 , |0, 1, 1 , |1, 0, 1 , |1, 1, 0 }.The code space is a subspace of the full Hilbert space of the m rails which introduces the redundancy required for error detection, that is, k photons and m rails can encode d k,m -dimensional states.The dimension grows rapidly with k and m.For example, with just k = 4 photons and m = 5 rails, we can efficiently encode 70dimensional states, i.e., truncated at Fock number |69 , with success probability P Bob j=k=4 = η k = η 4 .This is a great advantage over noiseless linear amplification, for example, if we choose the gain of the amplifier to be g = 1/ √ η to overcome the loss then the success probability is = η 69 , totally impractical.Furthermore, noiseless linear amplification fails to purify completely and cannot completely overcome the loss.
The encoding step is which maps Fock states, |µ , from a single mode to the code words, |µ k,m = |n m .The combined operation of encoding, loss, and decoding is a completely-positive trace-non-increasing map where L ⊗m is the map for independent applications of the pure-loss channel on the m rails, the decoding step, S −1 , performs a QND measurement of the total photon number, and if k photons arrive, then it successfully decodes back to single rail.The decoding step succeeds only if no photons are lost.The combined operation, E, is a scaled identity map up to the (d k,m −1)th Fock state, thus, the protocol succeeds with success probability P Bob k = tr(ρ AB ) = η k with unit fidelity.The input state may be entangled with another mode.For example, we may consider encoding one arm of an arbitrary entangled state, In this case, the operation, E, acts on Bob's mode only and Alice leaves her mode alone.The final state shared between Alice and Bob is ρ AB = (1 ⊗ E)ρ in , where ρ in is the initial state and 1 is the identity on mode A. Note there is still useful entanglement if photons are lost.The entanglement-distribution rate of single-shot error detection for a maximally-entangled initial state |µ A |µ B is given by equation (27), showing that error detection and purification indeed are equivalent.One might consider using purification to distribute Gaussian entanglement for long-distance CV QKD between trusted end users of a network, performing the entanglement-based CV-QKD protocol based on homodyne detection [48,49] or heterodyne detection [50].Consider the initial data state to be a truncated TMSV state with dimension d k,m given by The state is Gaussian except for the hard truncation in Fock space.The protocol works as follows.First, truncated TMSV states, |χ k,m , are distributed using our single-shot purification scheme between all repeater nodes and held in quantum memories.Once successful, CV entanglement swapping is used to entangle the end users who use the entanglement to perform CV QKD.While the purification scheme can be complex (depending on the chosen protocol size), the CV entanglement swapping is simple.It works by performing dual-homodyne measurements on some of the modes, followed by conditional displacements, swapping the entanglement [51], see Supplementary Note 4 for details on how to compute the secret key rate.
A simple example: the qubit code.The simplest nontrivial code uses a single photon, k = 1, in two rails, m = 2, (i.e., unary dual-rail) and protects qubit systems, d k=1,m=2 = 2, from loss.It is equivalent to the original purification protocol from Ref. [45], but in this context we use it to purify entanglement completely from pure loss to first order in Fock space and we can protect arbitrary single-rail qubit states from loss.The code words can be defined |0 k=1,m=2 ≡ |0, 1 and |1 k=1,m=2 ≡ |1, 0 .The projector onto the code space is P = |0, 1 0, 1| + |1, 0 1, 0|.The encoding step is which maps the vacuum component of the data mode onto a single photon of the second rail and the singlephoton component of the data mode onto a single photon of the first rail.If either of these photons is lost, the protocol fails.The success probability is P Bob j=k=1 = η.The maximum single-shot rate in ebits per use is D single shot k=1,m=2 (η) = η/2, as shown by the dashed line in Fig. 2a (with and without a repeater).
Physical implementation.Entanglement purification (iterative and single shot) requires joint QND measurements on multiple rails.These measurements can be performed via controlled-SUM quantum gates and photon number-resolving measurements (see Supplementary Note 5, for example).Another technique is to use high finesse cavities and cross-Kerr nonlinearities [46].
More simply, our scheme can be implemented using beamsplitters and photon-number-resolving detectors, however, it also requires an entangled resource state, |Ω k,m .This is a common technique in linear optics [52,53].See Ref. [54] for a review of quantum information processing using linear optics.The resource state can also be generated using linear optics and photonnumber measurements.That is, we have a simple method of implementing our protocol, though at some cost to the success probability.
We focus on the single-shot linear-optics protocol, shown in Fig. 3. Alice shares m entangled states, |χ , with Bob.Note each rail could have a different χ, distilling different amounts of entanglement between Alice and Bob at the end of the protocol, however, maximal entanglement is heralded when all rails have the same value of χ.Alice and Bob each prepare locally multimode resource states, |Ω k,m , consisting of (m + 1) modes.We assume they do this offline so it does not affect the quantum communication rate: where |µ are Fock states, |µ k,m are "anticorrelated" code words.Writing the usual code words in the Fock basis as |µ k,m = |n m , where n m .The coefficients, f n , are The last m modes of |Ω k,m are fed into the beamsplitters with the distributed entanglement and are measured by photon-number detectors.The first mode is kept locally by the user and remains at the end of the protocol, as shown in Fig. 3.
Detecting k photons means there were no loss events since n That is, all photons are accounted for in the circuit and the output state is strictly pure.There may be useful entanglement for measurement outcomes other than |0, k 0, k| at each pair of detectors, and further purification (iteration) can increase the rate, but we do not consider it due to practicality.
Adjusting the amount of entanglement prepared for each rail, adjusting the loss on each rail, or selecting different coefficients in the resource state, f n , results in a different output state, which may be useful for certain tasks.For example, if the entangled states prepared for each rail are identical and have the same amount of squeezing and f n is chosen as in equation (36), then a maximally-entangled state will be heralded between Al-ice and Bob at the output.For another example, consider the dual-rail case (m = 2), if the second rail is maximally entangled and f n is chosen as in equation (36), then the output state is the initial state of the top rail.This tuning of the circuit parameters is useful, for instance, for CV QKD where the target state is a truncated TMSV state.
The linear-optics scheme detects all errors and outputs a pure state.There is, however, an additional success probability penalty using linear optics because of Bob's decoding measurement.We assume Alice prepares offline, then the success probability is which depends on m.Compare this with the ideal purification protocol where P Bob k = η k which does not depend on m.The penalty paid for using linear optics is mainly due to the exponential 2 m(k−1) factor, which is painful for anything other than k = 1, where P Bob linear optics k=1 = η/m.For more details we refer you to Supplementary Note 6.
The linear-optics circuit leads naturally to a controlled-SUM gate using linear optics and number measurements, albeit with distorted coefficients (this distortion ultimately has no effect in our protocol since we immediately measure the state).For the interested reader, we refer you to Supplementary Note 5 for more details.Since Alice's encoded state is prepared offline, it is useful to consider more generally that she encodes an arbitrary state into the code: (1 ⊗ S)|ψ k,m .
Preparation of resource states.For our linearoptics and number measurement circuit, the resource state, |Ω k,m , and Alice's encoded state she prepares offline, are multi-mode entangled states.Once these states are prepared, our scheme requires just beamsplitters and photon detectors.One practical way to prepare these states is to use a Gaussian Boson Sampler (GBS) [55] and postselecting on a specific photon-number-resolving measurement click pattern on some of the modes of the output [56,57].This allows our scheme to be implemented entirely using linear-optics and number measurements.Using the GBS method for the simplest scheme with k = 1 and m = 2, we have found the resource state, |Ω k=1,m=2 = (|0, 1, 0 + |1, 0, 1 )/ √ 2, can be prepared with high fidelity, F > 0.999, with success probability ≈ 10 −6 .This was found by optimising the parameters of a GBS network via a machine learning algorithm called "basin hopping" [58].In [59], we have provided our code which implements this algorithm, as well as the parameter set we found that generates this resource state.Alternatively, adaptive phase measurements [60] can be used to prepare the needed resource states directly from dualrail Bell pairs or GHZ-like states which may have a higher probability of success.
Experimental imperfections.Our linear-optics circuit is robust to loss.The quality of the state Alice sends can be managed since her encoding is done offline.In any case, we are interested in the noise introduced by the protocol, not the noise in the initial state we are trying to transmit.The measurement and detection scheme at Bob's side is such that all photons are accounted for, so if Alice's encoding is perfect, the protocol can correctly identify if any photons are lost in the channel or at the detectors.More details are presented in Supplementary Note 6, where we also perform a numerical simulation incorporating inefficient detectors with dark counts, and a thermal-noise channel.Our protocol is robust to practical values of these imperfections.
The directionality issue.Often in quantum communications it is best if quantum states propagate in one preferred direction (from Alice towards Bob) when reverse reconciliation is used.This is a persistent problem in CV quantum communications.For instance, CV measurement-device-independent protocols [61][62][63][64] work only in an extremely asymmetric configuration, with the node (ineffective as a repeater) positioned close to one of the trusted parties.This directionality problem is also present in the repeater protocols considered in Ref [30,31], where they work best in one direction, which for reverse reconciliation is again from Alice towards Bob.Our purification schemes allow states to propagate in any direction in a quantum network since the output states are pure.Using purification for CV-QKD works the same for both direct and reverse reconciliations.We have no directionality problem.This is an important requirement for large CV networks.Note that the memoryless CV repeater protocol introduced in Ref. [32] also fixes the directionality problem.

DISCUSSION
We have presented a physical protocol which achieves the two-way assisted quantum capacity of the pure-loss channel [14].Error correction requires short distances between neighbouring repeater nodes, while in contrast, we showed simple error detection can saturate the PLOB bound.An open question is what protocol can saturate the fundamental limits for added thermal noise and close the gap between the theoretical upper and lower bounds [14].Furthermore, can error detection saturate the ultimate limits for other noise models, for instance, dephasing?
Our protocol is an optimal one and can be performed using CSUM quantum gates and measurements.However, it is unknown whether other gates and measurements may also achieve the capacity, and if they can do so more efficiently, i.e., approaching the PLOB bound more quickly with the number of iteration rounds, n.
Our ultimate protocol is experimentally challenging since it requires iterative purification steps.However, we show that by simplifying our protocol to just a single round of purification, we can still achieve excellent rates.This is superior to other nondeterministic techniques such as noiseless linear amplification where it is impossible to remove all effects of loss.
Our purification protocol can be implemented using linear-optics and number measurements.This does introduce some probability penalty (which does not depend on the loss), however, having an all-optical design is experimentally convenient.
One limitation of our results is the requirement for high-performance quantum memories.However, purification outputs pure states which is extremely beneficial.Firstly, pure states can handle a higher amount of decoherence coming from nonideal quantum memories.Secondly, distributing pure states will prevent how much thermal noise builds up across a network during entanglement swapping.Finally, purity may be beneficial for both point-to-point and repeater-assisted CV QKD, improving the signal-to-noise ratio and decreasing Eve's knowledge of the key, speeding up the classical post-processing part of the protocol.Thus, purification is inherently a useful technique for overcoming the unavoidable losses in quantum communication networks.Remarkably, purification can be employed totally using linear optics and number measurements and is compatible with existing DV and CV infrastructure.Finally, we remark that since the lossy entanglement is completely purified, it can be used for exotic tasks, such as device-independent quantum key distribution and demonstrating Bell nonlocalities, over much longer distances than previously imagined.

METHODS
Noise model.Bosonic pure loss is the dominant source of noise for many quantum communication tasks.The pure-loss channel is equivalent to introducing a vacuum mode and mixing the data state on a beamsplitter with transmissivity η ∈ [0, 1].The Kraus-operator representation of the single-mode pure-loss channel is [65] with Kraus operators A l = (1−η) l l!
η n 2 âl associated with losing l photons to the environment, where â and â † are the single-mode annihilation and creation operators, respectively, and n = â † â is the photon-number operator.
Reverse coherent information.Take a maximally entangled state of two systems A and B. Propagating the B system through the quantum channel defines the Choi state of the channel.Then the reverse coherent information represents a lower bound for the distillable entanglement and for the optimal secret key rate.The reverse coherent information of a state ρ AB is defined as [13] where , entanglement E k,m = log 2 d k,m , and success probability P Alice k1,m = (1 − χ 2 ) m χ 2k1 d k1,m .After Alice obtains outcome k 1 , Alice has the following maximally-entangled state: where A refers to the quantum system Alice keeps and B refers to the quantum system which will be sent to Bob.Alice propagates Bob's modes (B 1 , B 2 , ..., B m ) across independent pure-loss channels.The pure loss is equivalent to introducing m vacuum modes and mixing those with the m data rails on beamsplitters of transmissivity η.We label the beamsplitter transformations T i which interact modes B i and e i .The state after this interaction is where l i is the number of photons lost from mode B i to e i .Finally, Bob performs a QND measurement and obtains an outcome of j 1 total photons.The terms that survive in equation ( S5) are those components where Bob's modes have total photons which add up to j 1 , that is, The total number of lost photons is the difference between Alice and Bob's outcomes, Thus, the unnormalised final state shared between Alice and Bob is which is equation (3) of the main text as required.
We can calculate the success probability (i.e., the probability to successfully get this output state) as follows We used the generalized Vandermonde identity to simplify the inner summation to k1 j1 ; this does not depend on the outer summation, which has d k1,m = k1+m−1 k1 terms.We can assign P Alice k1,m = (1 − χ 2 ) m χ 2k1 d k,m and P Bob k1,j1 = (1 − η) k1−j1 η j1 k1 j1 , where we can interpret P k1,j1,m = P Alice k1,m P Bob k1,j1 as a joint probability distribution.Remarkably, while this success probability P k1,j1,m depends on the transmissivity η, the renormalised output state shared between Alice and Bob does not depends on η.

Round two of purification
Recall that in the first round, Alice obtains outcome k 1 and Bob obtains outcome j 1 .They share the following state: Let us firstly consider the case when j 1 = k 1 , then l 1 + l 2 + • • • + l m = 0 thus the output state is: We can see that the environment modes are all vacuum states and are separable from the state.When j 1 = k 1 the state is purified in a single shot, and we do not need a second round.Now, consider the case when j 1 < k 1 , we will need further rounds of purification.In the second round, one option for further purification is to measure the total photon number on m − 1 rails instead of all m rails.This means they learn if some errors happened in the mth rail, or in the first m − 1 rails.If Alice obtains outcome k 2 and Bob obtains outcome j 2 , they share the state: If j 1 < k 1 and j 2 = k 2 , then no errors occurred in the first m − 1 rails and the output state is , so the mth rail is in a definite quantum state with no entanglement so this rail should be discarded.The rest of the m − 1 modes are not entangled with the environment, so Alice and Bob's state of these rails is pure.Finally, if j 1 < k 1 , j 2 < k 2 , we need still further purification rounds.After m − 1 iterative rounds, we show next that we achieve the capacity as χ → 1, m → ∞.
For our iterative purification protocol, the average RCI per channel use is where P k1,j1,m is the probability of Alice and Bob obtaining outcomes k 1 and j 1 , heralding a state with RCI, R k1,j1,m .S 1 is the average entanglement of the pure states where the RCI is equal to the von Neumann entropy (when k 1 = j 1 ): and F 1 is the average RCI of the failed terms (when k 1 = j 1 ): The sum over j 1 terminates at k 1 since Bob cannot obtain outcomes j 1 > k 1 .Notice the Kronecker delta δ k1,j1 in these equations highlights that the only difference between equation (S18) and equation (S19) is the constraint: j 1 = k 1 for S18 and j 1 = k 1 for S19.That way, it is easy to see that the total weighted average rate of success and failure is .This follows from the fact that the QND measurement is mode blind and we know for certain that k 1 − j 1 photons were lost to the environment, but we do not know on which modes these losses occurred.
The output state |φ k1,j1,m ABE , shown in equation ( 3) of the main text, shows that the arrangements of photons do not depend on χ or η and are distributed with equal weights.We confirmed this directly by computing Eve's information from the density matrix for the simplest cases.
Therefore, using equation (S16), the RCI for the renormalised state ρ AB is This dimension ratio can be rewritten in a more useful form Alice is free to prepare her state offline.Hence, let us further simplify the rate expression by conditioning on Alice having already measured k 1 photons (i.e., fixed k 1 value), Note this rate does not depend on χ, since this conditional probability means only Bob's measurement probability contributes to the rate P k1,j1,m → P k1,j1,m /P Alice k1,m = P Bob k1,j1 .For small χ, the most likely outcomes of Alice's QND measurement k 1 is a small number of photons.As χ squeezing increases, Alice will more often detect a larger number of photons.We are interested in the large energy limit χ → 1, since our aim is to saturate the PLOB bound.In this limit, the squeezed states become |χ ∝ ∞ n=0 |n |n , hence Alice obtains large numbers of photons k 1 → ∞ with unit probability.We have proven in Supplementary Note 7 the following asymptotic relation .

(S24)
Thus, our rate expression simplifies to lim k1→∞ At this point, we note that P Bob k1,j1 = (1 − η) k1−j1 η j1 k1 j1 is a binomial distribution; this means that both the expected value and the most likely value Bob will measure is j 1 ≈ ηk 1 photons.From this physical intuition, we expect only terms near j 1 ≈ ηk 1 are important, hence the sum should simplify to log 2 (1 − η) = −C(η).We can confirm this formally by firstly noting the binomial distribution moments are where we note only the p = n term in the summation has the k n 1 factor required to survive the k 1 → ∞ limit.Note that n p are the Stirling numbers of the second kind (i.e., an integer independent of k 1 ), and resolves to n n = 1 for the relevant p = n case.Thus, from the Taylor series expansion of the logarithm we have lim k1→∞ Finally, in the limit that m → ∞, we have shown that the first step of our protocol is optimal since the average RCI equals the channel capacity of the pure-loss channel (the PLOB bound).

Optimality of our protocol at each round
In this section, we show that our protocol is optimal at each round n.
After the first step of our protocol, the dependence on χ and on the transmissivity of the lossy channel, η, is removed from the state.That is, for some number of rails, m, we herald a state, |φ k,j1,m , conditioned on measurement outcomes at Alice and Bob, k 1 and j 1 respectively.When k = j 1 , the state is pure and purification is successful in the first round.The rate of this success is simply . If k 1 = j 1 , the state is not pure and further purification is necessary.Then, the achievable rate of further purification is given by the RCI of |φ k1,j1,m which is log 2 k1+m−1 k1 . This quantity specifies the asymptotically-achievable rate in ebits per use of the channel of an optimal entanglement distillation protocol given infinite uses of these unsuccessful mixed states for outcomes k 1 , j 1 where k 1 = j 1 .
We proved in the previous section that the average rate of the successful attempt plus the optimal distillation rate equals the PLOB bound.That is, after the first round, we have the state |φ k1,j1,m and we proved the average rate (over all outcomes k 1 and j 1 ) is given by lim where the sum over j 1 is constrained by k 1 ≥ j 1 since Bob cannot detect more photons than Alice.If k 1 = j 1 , we have a success, otherwise if k 1 > j 1 , it fails and needs further rounds of purification.Equation (S34) means we must have m → ∞ in order to saturate the PLOB bound.Going from equation (S32) to equation (S33) shows the connection between the without pre-selection protocol and with pre-selection protocol.This equality connection is physically justified, since in the limit of large amounts of squeezed light χ → ∞, Alice should measure large amounts of photons k 1 → ∞ with unity probability.Going from equation (S33) to equation (S34) was proven in the previous section.
The explicit and practical entanglement distillation protocol continues in the same way as the first step, that is, Alice and Bob perform total photon number measurements on smaller subset of rails and compare results.After each successive step, the state is sometimes purified (when Alice and Bob obtain the same outcome) and sometimes it fails.
Recall that the RCI gives the achievable rate of entanglement distillation by some optimal distillation protocol.We can use it at each round, to confirm our protocol stays optimal.
Given that Alice already obtained k 1 , and Bob already obtained j 1 , the RCI multiplied by the success probability heralded at the nth round with outcomes k 1 , j 1 , . . ., k n−1 , j n−1 , k n , j n , for a given number of rails, m, is where we have the constraints: Intuitively, the first (second) constraint k s ≥ k s+1 (j s ≥ j s+1 just says Alice (Bob) can't measure more photons in the next round s + 1 compared to the current round s.The third constraint k s − k s+1 ≥ j s − j s+1 simply says the amount of photons in the left-over rail (i.e. the rail we are throwing away) can't have more photons on Bob's side j s − j s+1 compared to Alice's side k s − k s+1 .The fourth constraint k s > j s is the condition where we continue the distillation process.If k n = j n then the RCI is equal to the von Neumann entropy since the state is pure.This counts as a successes, otherwise further purification is required.Then, the average RCI of the nth round, R n , over all outcomes of that round only, k n and j n , consists of pure terms (von Neumann entropies) and mixed terms (RCI), and should be equal to the RCI of the previous round in the limit of large m.That is, we must have that no entanglement is lost at each round.So we must have kn,jn P n R n = P n−1 E n−1 in the limit of large m, i.e., we must have: where we have the usual constraints on all the outcomes.We have numerically verified that this is true.
Numerically we have verified that the left hand side approaches the right hand side of equation (S42) multiplied by the factor m−1 m , i.e., kn jn ) . The factor m−1 m comes from the combinatorics of counting photons at Alice's and Bob's side.
We cancel the common factors and explicitly write the limits on k n , j n : We may consider the asymptotic behaviour for a large number of rails.Note that for large m the most important term is when Alice measures k n = k n−1 , which means Bob measures j n = j n−1 .This term is the following where we used the following identity k+m k . We can then consider the ratio between this final term and the RHS of Eq. equation (S42) as follows This ratio approaches one in the limit as m → ∞ (note that we also require k n−1 /m → 0), because we can show that we have Thus we have shown that no entanglement is lost at the nth round, in the limit that we have a large amount of rails m.
This optimally can be motivated by considering the environment.We showed that for m → ∞, we have that no RCI is lost after every round: When the protocol succeeds, it decouples the environment from Alice and Bob, and when it fails it does not (but may succeed in a later round).Alice and Bob's measurement tells them how many photons were lost to the environment.If we consider the environment we do not need to average over the particular outcomes at Alice and Bob so we can avoid having to compute the complicated sum over many outcomes.If Alice and Bob forget the particular outcomes but keep the environment outcome (whether the photon number at Alice and Bob was the same or different) then effectively they have measured the environment with either a success or failure: Our quantum measurement is defined by the set of operators {M S , M F } acting on the environment, where M S = |0 0| and M F = 1 − |0 0|, satisfying M S + M F = 1.So, after the first round, the global successful and failed density matrices shared between Alice, Bob, and the environment are: where |0 m = |0000 . . .(i.e., m vacuum modes), 1 m is the identity on m modes, and ρ is the global system of the m initial copies of lossy TSMV state with squeezing χ and transmissivity η.Equation (S51) projects the system onto vacuum of the environment, purifying completely Alice and Bob's state, while equation (S52) does not.The density matrix transforms as unnormalised density matrix ρ → M i ρM † i , where P i = Tr(ρM † i M i ) is the probability.We have (for m → ∞, χ → 1): which agrees with what we found earlier, that the first round is optimal and loses no rate as m → ∞.
Before round two, we have the failed density matrix from round one: ρ F1 .After round two, it either succeeds or fails (while the mth mode is left alone and is completely decoupled from the system anyway), and we have: So we have which can be shown to be true if we write ρ F1 in terms of its eigenvalues.
After the nth round, we have: and we have Proof that the highest rate of our iterative purification protocol achieves the PLOB bound There is a straight-forward recurrence relation in determining the average RCI for success and failure at the nth round of purification where n ∈ [2, m] and ≃ means asymptotic equivalence given a large number of rails m.Intuitively, this relationship simply says that about 1/m fraction of the left-over rate is lost at each round.We want to show that the total rate of our iteration protocol, which is the sum of all the success rates will add up to the capacity given infinite resources E iteration ≡ lim m→∞ E iteration,m = C.This is not a trivial question to answer, as the subtraction of m of these F n /m terms has the possibility of significantly reducing the rate of our protocol, even in m → ∞ limit.However, we show here that this is not the case, and hence our protocol can achieve the PLOB bound capacity C. Now, starting from the recurrence expression in equation (S61), we can derive the following closed-form expression for the failure rate at the nth round The sum of these rates can be simplified as follows In the asymptotic limit, this reduces down to Hence, we can show that the total rate of our iteration protocol gives Thus we have proven that our iteration protocol can achieve the PLOB bound.

Entropy argument for achieving the PLOB bound
In this section, we give a simpler argument that our protocol is optimal based on von Neumann entropies.
The RCI gives the achievable rate of entanglement distillation of an optimal protocol: For the lossy channel we have Our goal is to specify a protocol which achieves C (PLOB).
Imagine that Alice and Bob perform the following purification protocol.Alice shares entanglement with Bob in the form of TMSV states across a lossy channel then they both locally count total photon number on multiple modes and compare outcomes.Next, they keep the times they obtained the same outcome but forget what the particular outcomes were.This decouples the environment and Alice and Bob share mixed states.This procedure is equivalent to Eve performing a QND measurement on the environment and heralding states shared between Alice and Bob Supplementary Figure 1.Ratio of our finite m rate, E k 1 ,m with the two-way assisted quantum capacity, C, (PLOB) [S8] as a function of k1 at Alice at a fixed distance of a 1 km, b 10 km, and c 100 km.The number of rails ranges from m = 2 (light gray) to m = 9 (black).The figure shows that for finite m there is an optimal k1 at a particular distance.Unfortunately, we cannot simulate large numbers of rails because we have to sum over many measurement outcomes.Analytically, we prove that E k 1 ,m /C → 1 as m → ∞ and k1 → ∞.Supplementary Figure 2. Our purification for large quantum networks.a Our purification technique operating between neighbouring nodes in a network.It can be iterative or single-shot (non-iterative).b Linear quantum chain as an example of a simple quantum network.First, entanglement is purified between all neighbouring nodes of the network (pink) and the pure entanglement is held in quantum memories (QM, green).Then, Bell-state measurements (BSM) and classical communication perform quantum teleportation (i.e., entanglement swapping) so that eventually the end parties share pure entanglement.The Bell-state measurements can be DV or CV.
For CV, first, assume that non-maximally pure entangled states are shared between all neighbouring nodes of the network which are copies of the approximately-Gaussian truncated TMSV state (S74) Our single-shot purification scheme (quantum error detection) can be used to distribute |χ k,m between any two neighbouring nodes of a lossy quantum network for a given k and m.Next, require that |χ k,m is sufficiently Gaussian by choosing d large enough for a given χ.This allows us to use the covariance-matrix formalism.Then, we consider a deterministic CV Bell-state measurement in the relay consisting of dual homodyne, i.e., mixing the two incoming modes on a 50:50 beamsplitter and performing orthogonal quadrature measurements.The nodes communicate the outcomes of the dual-homodyne measurements so that the required displacement-correction operations can be performed.Since the state is sufficiently Gaussian, the covariance matrix is all that is required to calculate the rate of distilled entanglement or estimate the secret key rate.The covariance matrix does not depend on the particular outcome of the dual-homodyne measurement, and it can be calculated easily via the symplectic transformations for the dual-homodyne measurements as follows.
Assuming the dimension, d k,m , is sufficiently large, then the state |χ k,m is approximately Gaussian and the state is fully characterised by the following covariance matrix [S10]: where After the beamsplitter, the four-mode quantum system becomes For a matrix written in block form: measuring a quadrature of subsystem Γ Y via homodyne detection, where Γ Y is a 2 × 2 real matrix, transforms the covariance matrix of subsystem Γ X as follows [S10]: where Π = diag(1, 0) for q quadrature and Π = diag(0, 1) for p quadrature, and (Π Γ Y Π) −1 is a pseudoinverse.Note that the output covariance matrix does not depend on the measurement outcome.
For our four-mode system, we homodyne modes 1 and 4 in the repeater, one in q quadrature and one in p quadrature.We use equation (S80) twice since we perform two measurements.Performing homodyne in q quadrature of mode 1 and p quadrature of mode 4, the resulting covariance matrix is so we can see that the output state is a TMSV state with reduced squeezing, quantified by the reduced noise variance ν = ν 2 +1 2ν .That is, where previously two non-neighbouring nodes were not entangled, now they share deterministically a pure TMSV state with reduced squeezing.We keep doing this over all repeater nodes such that eventually the end users share deterministically a TMSV state with covariance matrix of the same form with a new noise variance which depends on the number of repeater nodes and initial squeezing.This covariance matrix shared between the end users allows us to estimate the asymptotic secret key rate.m rails ...
where Alice obtains outcome k and Bob obtains outcomes j.This is equivalent to round one of our protocol.Similarly, further gates and measurements can be performed on subsets of rails to iteratively purify entanglement.
Since we provide a linear-optics implementation of our protocol, we naturally have an approximate CSUM gate using linear optics and photon-number measurements (without mod d).Unfortunately, the CSUM gate is distorted, that is, the coefficients on the output state are not ideal.This distortion, however, does not impact purification since we measure the output state right away, and the linear-optics implementation of purification is ideal.
Using linear optics we can do the distorted CSUM: , where f c,t are in general unwanted factors.
For k = 1, m = 2, the basis states of the control and target are mapped as follows There is an unwanted factor √ 2 on the |0 |0 term.For purification this is not an issue since we remove this term via postselection.

Derivation of the circuit
In this section, we consider how to implement our protocol in an experimentally tractable platform.In this regard, we show that a linear-optical network, coupled with an entangled resource state, implements the required decoding action at Bob's side.We also derive the success probability of this decoding action.
First, consider our ideal single-shot error-detection protocol.Alice prepares the two-mode entangled state c µ |µ A |µ A1 and encodes the second mode (A1) into our quantum-error-detecting code to send to Bob.Recall that the encoding step is where |µ k,m 1,2,3,...,m are the m-rail code words of the code.Alice applies it to mode A1 of her initial state resulting in After the lossy channels, if Bob detects no loss errors then he successfully decodes, and Alice and Bob share the initial state |ψ d k,m A,B at the end of the protocol.Now let us consider the linear-optics circuit, focusing on Bob's side since Alice can encode in a similar way to how Bob decodes, since it is simply the complex conjugate transformation.Alice's encoding is assumed to be done offline and we assume that she has perfectly encoded the quantum information into the m-rail code, (1 A ⊗ S A1 )|ψ d k,m A,A1 , and then Bob performs the following action: m , and f µ is some free scaling factor which we will determine later.Now, writing equation (S101) in full we get , which means that µ = µ ′ .Thus, we have shown that these measurement actions and resource entangled state can perform the required decoding action in which we get back our original entangled state (but with one arm now at Bob).However, this requires that we set our resource state to have the following factors Finally, we note that the success probability of this action, Bob's measurements after loss characterised by transmissivity η, is given by We have an 1/2 m(k−1) factor from the m beamsplitter measurements M , as well as a factor from the normalised resource state The final rate of entanglement purification depends on the probability of Bob's side but not Alice's side since her encoding step is assumed to have been prepared offline: .
In general, it is clear that S k,m ∝ O(m k ), however for small m values S k,m will scale more like m.This means that the success probability cost of using linear optics will be dominated by the 1/2 m(k−1) factor.

Experimental imperfections
Our purification technique is robust to additional losses such as using inefficient detectors.If we consider that Alice has done her encoding offline and has a perfect state preparation, then additional losses at Bob's side, at the resource states and at the detectors, affects the success probability of Bob's side but not the purity of the output state.Therefore, the circuit is robust to both losses in the channel and at the resource state and detectors on Bob's side.All photons must arrive at Bob's detectors in order for the device to succeed, otherwise it fails.
To show this, recall that the output state of the circuit after Bob's measurement is given by equation (S104) and we must have that m i = n , which means that µ = µ ′ .Additional losses anywhere on the m rails (i.e., in the channel, at the detectors, or resource state) will decrease the success probability since it is less likely that m i = n for all i, but it will not decrease the purity when the protocol succeeds.Losses on the modes Alice and Bob keep do affect the purity of course.
Interestingly, if the losses are not the same on all the rails, the output state is still pure, but the amount of entanglement is increased or decreased depending on the ratio of the losses on each rail.
While the linear-optics circuit is robust to losses at Bob's detectors and resource states, unfortunately, dark counts, thermal noise, and the use of bucket detectors will in general decrease the purity and fidelity of the output state, however, numerical simulations suggest that practical values still result in good rates.We analyse these effects next.

24 FIG. 2 .
FIG. 2. Optimal rates of entanglement purification.aWe plot the highest rates of iterative purification (black), singleshot purification (red), and single-shot purification for qubits (blue dashed) as a function of the total end-to-end distance, for optical fiber with a loss rate of 0.2 dB/km.Purification is used to distribute and purify entanglement between nodes and entanglement swapping connects the end users.To illustrate, we plot rates without a repeater and with one repeater.Equivalently, these rates are secret key rates since ebits are specific types of secret bits[47].Our highest rates coincide with the ultimate limits of quantum communications (black), shown here the repeaterless PLOB bound[14] and the one-repeater bound[15].At all distances the output states are strictly pure.The scaling improves for increased numbers of repeaters (not shown).b The ratio of the optimised rate of our single-shot purification protocol without a repeater with the repeaterless PLOB bound as a function of distance, showing how close it comes to saturating the bound (and therefore end-to-end quantumrepeater networks in general).The optimal number of photons, k, at each distance is shown in rounded brackets.At shorter distances codes with more photons are optimal.The three-rail encoding (m = 3) is optimal at most distances, with sometimes a larger m optimal at distances less than about 1.6 km.At large distances, the ratio E single shot FIG.3.Implementation using linear optics and number measurements.The aim of the protocol is for Alice to share quantum information contained in a d k,m -dimensional pure state, |ψ k,m , which can be entangled with another system which Alice keeps, with Bob separated by a pure-loss channel.Shown in this figure, the aim is to distribute a pure maximally-entangled state between Alice and Bob.Alice shares m entangled states, |χ , with Bob.Encoding/decoding simply requires beamsplitters, photon detectors, and (m + 1)-mode entangled resource states, |Ω k,m .We can assume Alice's encoding (the state heralded after Alice's measurement) is prepared offline so that the success probability of the protocol is the probability of Bob's side only.There is, however, a success-probability penalty for using linear optics, noting crucially that this penalty does not depend on the loss.The protocol succeeds when Bob detects the same number of photons Alice sent, k.If Bob detects less photons, multiple rounds of error detection are required or Alice and Bob can simply disregard those states.
j1,m , without constraint.We calculate the RCI, R k1,j1,m , of the normalised state ρ AB = Tr E (|φ ′ k1,j1,m φ ′ k1,j1,m |) shared between Alice and Bob conditioned on measurement outcomes k 1 at Alice and j 1 at Bob, where ρ e refers to the m-mode system of the environment.The entropy of Alice's system is S(ρ A ) = log 2 (d k1,m ), where the dimensionality d k1,m is the number of ways k 1 photons can be arranged in m modes, i.e., d k1,m = k1+m−1 k1 .Furthermore, since the global state ρ ABE = |φ ′ k1,j1,m φ ′ k1,j1,m | is pure, we can use the self-duality property of the von Neumann entropy to calculate the entropy of Alice and Bob's system S(ρ AB ) = S(ρ e ).(S20) That is, the environment holds the purification of Alice and Bob's state.The entropy of the environment modes is S(ρ e ) = log 2 (h k1,j1,m ), where h k1,j1,m is the number of ways k 1 − j 1 photons can be arranged in m modes, i.e., h k1,j1,m = k1−j1+m−1 k1−j1
S(ρ A ) and S(ρ AB ) are von Neumann entropies of ρ A = tr B (ρ AB ) and ρ AB respectively.The von Neumann entropy of ρ is −tr(ρ log 2 ρ).measurement projects the m TMSV states onto a maximally-entangled state, |φ k1,m AB , with dimension d k1,m =