1. Introduction

Autocorrelation measurement of a light source has been known to be a convenient method for investigating the characteristics of the source. It dates back to Hanbury-Brown and Twiss (HBT) who measured [1, 2] the correlation of photocurrents from two photodetectors shone by a common light source to determine its second-order intensity correlation function. The meaning of the correlation functions in quantum optics was clarified by Glauber [3, 4], who showed that the second-order correlation function $G^{\left(2\right)}\left(r_1,r_2;\tau \right)=〈I\left(r_1,t\right)I\left(r_2,t+\tau \right)〉$ can also be determined from a HBT setup with two photon detectors by measuring the rate of coincidence counts. It was successfully used in the direct observation of the non-classical property of light [5]. In the case of a pulsed light, a proper integration around τ = 0 and a normalization lead to a normalized factorial moment $g^{\left(2\right)}\left(0\right)=〈n\left(n-1\right)〉/{〈n〉}^2$ of the photon number n in the pulse [6]. Since $g^{\left(2\right)}\left(0\right)=0$ is achieved only by an ideal single photon source (SPS), the measurement of $g^{\left(2\right)}\left(0\right)$ by the HBT setup has been widely adopted for the characterization of experimentally developed SPSs [7, 8]. Extension of the method to higher-order moments $g^{\left(r\right)}\left(0\right)$ is also straightforward by increasing the number of detectors to r [9, 10].

Despite the apparent success for the non-classical light sources, the above characterization method is not particularly suited to the emergent applications in quantum information. The most severe drawback is the fact that the HBT setup with conventional on-off (threshold) photon detectors provides the accurate value of the factorial moment only in the limit of low detection efficiencies. Here, on-off detectors such as avalanche photodiodes in Geiger mode or superconducting nano-wire detectors respond only to the absence or presence of photons. As a result, the value of $g^{\left(r\right)}\left(0\right)$ from an actual experiment is only approximate, and how it is deviated from the true value is unknown. This is problematic for the applications involving the security [11, 12], for which rigorous security statements are mandatory. For the computational tasks using photons such as boson sampling [13], reliability of the outcome will eventually be ascribed to that of the constituent components including light sources. Another drawback is that we encounter the moments ${\left\{g^{\left(r\right)}\left(0\right)\right\}}_r$ much less frequently in the quantum information theory than the photon-number probability distribution ${\left\{p_n\right\}}_n$. For example, the requirement for the light source used in the decoy-state quantum key distribution (QKD) [14–16] is given by a set of inequalities in terms of the photon-number probability distribution ${\left\{p_n\right\}}_n$ [17, 18]. Hence, as a characterization method in the era of quantum information, it is vital that it provides rigorous statements over ${\left\{p_n\right\}}_n$, and preferably it is tight.

Main difficulty of the problem lies in the fact that a practical characterization scheme must use a finite size of data, such as expectation values of a finite number of observables, while the input photon number is not bounded. Some of the previous methods [19, 20] using multiple on-off detectors assumed a cutoff on the input photon number and estimated likely values of $\left\{p_n\right\}$ rather than their bounds. Other methods to produce rigorous statements were limited to specific properties of light such as the non-classical property [21–26] and the non-Gaussian property [27, 28]. Very recently, Kovalenko et al. [29] have discussed the problem in a more general framework, but the obtained state-independent bounds on the systematic error for $\left\{p_n\right\}$ were rather large and will not be suited for applications such as QKD. Here we propose a characterization method using an HBT setup to produce rigorous bounds on emission probabilities of low photon numbers and show that the derived bounds are tight enough to improve the security of a quantum key distribution protocol without significant reduction in the key rate.

 

Fig. 1 An implementation of the D = 4 case of our characterization method. The overall detection efficiencies are given by ${\eta }_1=R_1{T}_2{\eta }_1^{\left(\text{det}\right)}$, ${\eta }_2=R_1{R}_2{\eta }_2^{\left(\text{det}\right)}$, ${\eta }_3=T_1{R}_3{\eta }_3^{\left(\text{det}\right)}$, and ${\eta }_4=T_1{T}_3{\eta }_4^{\left(\text{det}\right)}$, where $T_k\left(k=1,\dots ,3\right)$ and $R_k\left(k=1,\dots ,3\right)$ are transmittance and reflectance, respectively.

Download Full Size | PDF

2. Characterization method

2.1. Formalism for constructing the rigorous bounds

Our proposed method uses a generalized HBT setup with D photon detectors, where the light pulses to be characterized are divided into D parts by beam splitters. We assume that each detector is an on-off detector with quantum efficiency ${\eta }_i^{\left(\text{det}\right)}$, which is modeled as reporting a presence of nonzero photons after a linear absorber with transmission ${\eta }_i^{\left(\text{det}\right)}$. Figure 1 shows an example for D = 4. The configuration of the beam splitters is not relevant. The only relevant system parameters are the overall efficiencies, ${\left\{{\eta }_i\right\}}_{i=1,\dots ,D}$, including both the branching and the detector efficiencies. We denote their average as $\eta :=D^{-1}{\displaystyle \sum }_i{\eta }_i$.

 

Fig. 2 Comparison between the true values and the bounds. Each graph depicts the true value and the bounds from the characterization method in the case of $D=2,3,$ and 4 with $\eta ={\eta }_i=0.025$ (regardless of D) when applied to an ideal Poissonian source with $p_n=e^{-\mu }{\mu }^n/n!$ where μ is the mean photon number. (a), $p_0^U$ and $p_0^L$, (b), $p_1^U$ and $p_1^L$, (c), $p_2^U$, $p_2^L$, and $p_{\ge 2}^U$, (d), $p_3^U$, $p_3^L$, and $p_{\ge 3}^U$.

Download Full Size | PDF

We define an averaged r-fold coincidence probability $c_{\text{obs},r}$ to represent the observed data in the following way. We represent a subset of the D detectors by the corresponding index set $W\subset Z_D$, where $Z_D:=\left\{1,2,\dots ,D\right\}$. We denote by $\left|W\right|$ the cardinality of set W. We first define a full coincidence event at a detector set W as the case where all the $\left|W\right|$ detectors report detection, regardless of presence or absence of detections at the remaining detectors $Z_D\setminus W$. We denote the corresponding probability by $c_{\text{obs},W}$. The averaged r-fold coincidence probability $c_{\text{obs},r}$ is then defined as the arithmetic mean of $c_{\text{obs},W}$ over all the $\left(\begin{array}{c}D\\ r\end{array}\right)$ combination of r detectors, namely, $c_{\text{obs},r}:={\left(\begin{array}{c}D\\ r\end{array}\right)}^{-1}{\displaystyle \sum }_{W\in I_r}{c}_{\text{obs},W}$ with $I_r:=\{W\subset Z_D | |W|=r\}$.

Let us first consider the case where the measured pulse contains exactly n photons. We can express probabilities for various coincidence patterns in terms of the overall efficiencies ${\left\{{\eta }_i\right\}}_{i=1,\dots ,D}$ and combine those to construct a closed-form expression for the averaged r-fold coincidence probability $c_{\text{obs},r}$. As shown in Appendix A, the probability for the n-photon input (p_n = 1) is then given by

Our goal is to find rigorous bounds on ${\left\{p_n\right\}}_n$ under the constraint of Eq. (2).

The above expressions should not be confused with the standard model [30] of a photon number resolving detector based on multiple on-off detectors. For a setup with D on-off detectors, the latter considers the probability $c{\text{'}}_{obs,k}$ of reporting detection of k photons, which occurs when k on-off detectors click and the other $\left(D-k\right)$ detectors do not click. Events with distinct values of k are exclusive and ${\displaystyle \sum }_{k=0}^D{c{\text{'}}_{obs,k}}_{}=1$ holds. In contrast, our definition of r-fold coincidence involves events with $k>r$ as well as $k=r$, and events with distinct values of r are not exclusive.

To describe the formula for the bounds, it is convenient to introduce vectors of order $D+1$ as follows. Let ${\mathit{c}}_{\text{obs}}:=\left(1,c_{\text{obs},1},\dots ,c_{\text{obs},D}\right)$, ${\mathit{c}}_n:=\left(1,c_{n,1},\dots ,c_{n,D}\right)$, and ${\mathit{c}}_{\infty }:=\left(1,1,\dots ,1\right)$. Consider a basis ${\left\{{\mathit{c}}_j\right\}}_{j\in S}$ specified by the index set $S=\left\{0,1,\dots ,D\right\}$, and let ${\left\{{\mathit{d}}_j^{\left(S\right)}\right\}}_{j\in S}$ be its reciprocal basis, namely, ${\mathit{c}}_j\cdot {\mathit{d}}_i^{\left(S\right)}={\delta }_{ij}$ for $i,j\in S$. Similarly, define ${\mathit{d}}_i^{\left(S^{\prime }\right)}$ for $S^{\prime }:=\left\{0,1,\dots ,D-1,\infty \right\}$. We can obtain ${\left\{{\mathit{d}}_i^{\left(S\right)}\right\}}_i$ and ${\left\{{\mathit{d}}_i^{\left(S^{\prime }\right)}\right\}}_i$ as the rows of inverses of matrices $C:=\left({\mathit{c}}_0^{\mathrm{T}},{\mathit{c}}_1^{\mathrm{T}},\dots ,{\mathit{c}}_D^{\mathrm{T}}\right)$ and $C^{\prime }:=\left({\mathit{c}}_0^{\mathrm{T}},{\mathit{c}}_1^{\mathrm{T}},\dots ,{\mathit{c}}_{D-1}^{\mathrm{T}},{\mathit{c}}_{\infty }^{\mathrm{T}}\right)$, respectively. We postulate that the variations among the efficiencies ${\left\{{\eta }_i\right\}}_i$ are moderate, and they satisfy

Theorem 1 Under the condition (3), the constraint (2) implies

An analytical proof of Theorem 1 is given in Appendix B. Calculation of the bounds $p_n^L$ and $p_n^U$ in Eqs. (4)-(9) is straightforward because C and C^′ are triangular matrices. Each bound is given as a linear function of ${\left\{c_{\text{obs},r}\right\}}_r$ with their coefficients written in terms of ${\left\{{\eta }_i\right\}}_i$. It is flexible and versatile since the formula for an arbitrary number D of detectors is given in a closed-form expressionand the detection efficiencies do not need to be uniform. The explicit forms of the derived formulas are given in Appendix C. In Fig. 2, we plotted the expected numerical values of these bounds along with the true values when we characterize an ideal Poissonian source with $p_n=e^{-\mu }{\mu }^n/n!$. We see that the bounds on p₀ and p₁ are fairly good for $\mu \le 0.5$ with a D = 3 setup, and so are those on p₂ and p₃ with a D = 4 setup.

From Fig. 2, we notice that a bound $p_n^{L,U}$ often improves only slightly as an increment of D. The corresponding formulas like Eq. (32) to Eq. (38) and Eq. (40) to Eq. (48) in Appendix C show that the dominant $O\left(1\right)$ terms in η do not change. In general, we can prove that $p_n^U$ improves only by $O\left(\eta \right)$ from a $\left(D-1\right)$-detector setup to a D-detector setup when D − n is odd, and the same goes for $p_n^L$ when D − n is even (see Appendix D). In other words, each bound $p_n^{U,L}$ shows a major improvement for every other increment of the number D of detectors used in the setup. The origin of this unexpected behavior may be understood from the threshold or saturation behavior of the detectors, which an adversary may exploit to fool us to believe in a wrong distribution. Given a distribution ${\left\{p_n\right\}}_n$ and the corresponding ${\left\{c_{\text{obs},r}\right\}}_r$, one may change ${\left\{p_n\right\}}_n$ only slightly by replacing a $O\left({\eta }^D\right)$ potion of the pulses with ones with an extremely large photon number to flood the D detectors. Through this small modification, the adversary can increase $c_{\text{obs},D}$ to any value without changing the rest of ${\left\{c_{\text{obs},r}\right\}}_r$. Existence of such an attack forces us to trust the observed value of $c_{\text{obs},D}$ only in one direction, which results in improving only half of the bounds. The above argument tells us that, in the derivation of the rigorous bound, it is essential to take the saturation behavior of the detectors into consideration.

2.2. Optimality of the proposed bounds

The presented formulation of the bounds has several merits. First, one can make sure the optimality (nonexistence of a better bound) of the obtained bounds easily. In short, the optimality follows if all the calculated bounds are nonnegative (see Appendix E). Second, it is optimal for a broad class of light with a small mean photon number $〈n〉$. We consider the uniform case in the limit of $\eta \to 0$. For weak light sources where p_n rapidly decreases with n, the most severe condition for the optimality of the S-related bounds is expected to be $p_{D-1}^L={\mathit{c}}_{\text{obs}}\cdot {\mathit{d}}_{D-1}^{\left(S\right)}\ge 0$. Indeed, if a light source satisfies

Equations (10) and (11) form a sufficient condition for the optimality of the S-related bounds. We can obtain the conditions for S^′-related bounds by replacing D with $D-1$. The proof of these statements is given in Appendix F. Examples for sources satisfying these conditions are a coherent light source with $〈n〉<1$ and a thermal light source with $〈n〉<1/D$ (see Appendix F).

2.3. Parameter ambiguity and statistical errors

The closed-form expression allows us to adapt our method easily to the cases where there are ambiguities in the values of the system parameters ${\left\{{\eta }_i\right\}}_i$ and ${\left\{c_{\text{obs},r}\right\}}_r$, simply by calculating the worst-case values and by introducing confidence levels if necessary. It also helps us to estimate how the degrees of such ambiguities will affect the tightness of the bounds. As an example, we consider the D = 4 setup with a uniform efficiency $\eta \ll 1$. We assume that the actual distribution ${\left\{p_n\right\}}_n$ is similar to that of a weak coherent light source or a single photon source, namely, $p_n\gg p_{n+1}$ for $n\ge 1$. It implies $p_0\sim 1-{\tilde{c}}_{\text{obs},1}$ and $p_n\sim {\tilde{c}}_{\text{obs},n}$ for $n\ge 1$, where ${\tilde{c}}_{\text{obs},r}:={\stackrel{}{c}}_{\text{obs},r}/c_{r,r}$. Since $c_{r,r}=r!{\eta }^r$, we have $\mathrm{\Delta }{\tilde{c}}_{\text{obs},r}/{\tilde{c}}_{\text{obs},r}=\mathrm{\Delta }{c}_{\text{obs},r}/c_{\text{obs},r}-r\left(\mathrm{\Delta }\eta /\eta \right).$ By applying it to the dominant terms in the equations for the D = 4 case in Appendix C, we obtain

These show that the relative errors in $c_{\text{obs},r}$ and η affect the bounds only proportionally, unless $p_0=0$. While the above relations are derived from the explicit form for D = 4, it is not difficult to show that they hold for arbitrary values of D.

 

Fig. 3 Asymptotic secure key rates per pulse for the decoy-state BB84 protocol with various assumptions on the light source. The protocol uses pulses with three different intensities, termed signal, decoy, and vacuum. We assume that the vacuum pulses contain no photons. (a), An ideal Poissonian source with known distributions, $p_n=e^{-\mu }{\mu }^n/n!$ for the signal pulses and ${p^{\prime }}_n=e^{-{\mu }^{\prime }}{{\mu }^{\prime }}^n/n!$ for the decoy pulses. (b)-(d), Based on the characterization method with $D=4,3,2$ detectors applied to the same source. For the characterization, we assume that all the overall detection efficiencies ${\left\{{\eta }_i\right\}}_i$ have the same value η. We generated simulated values of $\left\{c_{\text{obs},r}\right\}$ assuming $\eta ={\eta }_0:=0.1/D$. For application of Theorem 1, we used all the values of η in the region $\left[0.99{\eta }_0,1.01{\eta }_0\right]$, and adopted the worst-case value of R as the key rate. We assume that statistical errors in estimating $c_{\text{obs},r}$ are negligible. For the protocol, we assume $q=0.8$, $q^{\prime }=0.1$, $Y_0={10}^{-8}$ and that the channel causes a constant error of 1% regardless of the transmission. The detection rate Q and the bit error rate E are modeled as $Q/q=1-\exp (-\mu \tau )+Y_0$ and $QE/q=0.01\left(1-\exp (-\mu \tau \right))+0.5Y_0$, where τ is the channel transmission. Q^′ and E^′ are defined similarly. The mean photon numbers are optimized for each value of τ under the condition ${\mu }^{\prime }=\mu /10$.

Download Full Size | PDF

3. The decoy-state BB84 protocol with a characterized source

As an application of the proposed characterization method, we consider the characterization of the laser light source used in the decoy-state BB84 protocol [14–16], which is one of the most frequently demonstrated QKD protocols [31]. The security of the protocol has usually been proved under the a priori Poissonian assumption, namely, $p_n=\exp (-\mu )\frac{{\mu }^n}{n!}$ with mean photon number μ. Since the Poissonian assumption involves an infinite number of conditions, it is impossible to verify it experimentally. The proposals [17, 32, 33] for the use of light sources other than lasers also rely on an infinite set of conditions. It is thus important to replace such a priori assumptions with experimentally verifiable ones [34–36]. What we seek here is to use experimentally available bounds from Theorem 1.

We focus on the decoy-state BB84 protocol using pulses with three different intensities, termed signal, decoy, and vacuum. Let ${\left\{p_n\right\}}_n$ and ${\left\{{p^{\prime }}_n\right\}}_n$ be the photon-number distributions of the signal and the decoy pulses, respectively. We assume that the vacuum pulses contain no photons. The crux of the decoy-state protocol is to estimate the amount of valid signals, namely, the conditional detection probability Y₁ given the sender emits exactly one photon (Y₁ is often called the one-photon yield). Comparison between the observed probability of the detected signal pulses, Q, and that of the detected decoy pulses, Q^′, establishes a lower bound $Y_1^L$ on Y₁. Combined with an upper bound $e_1^U$ on the error probability in the single photon emission events, an asymptotic secure key rate is given by [11]

Under the a priori Poissonian assumption of $p_n=\exp (-\mu )\frac{{\mu }^n}{n!}$ and ${p^{\prime }}_n=\exp (-{\mu }^{\prime })\frac{{{\mu }^{\prime }}^n}{n!}$ with $1>\mu >{\mu }^{\prime }$, the bounds [37] are then given by

The detailed derivation is given in Appendix G.

Figure 3 shows a comparison of the asymptotic secure key rate with the a priori assumption of ideal Poissonian and those with our characterization method. To calculate these curves, we used Eqs. (15) and (16) for curve (a) and Eqs. (17) and (18) for curves (b) and (c) in Fig. 3. For curve (d) with D = 2, Eq. (17) does not hold, and we used a trivial bound shown in Appendix G. We assumed that the overall quantum efficiencies of the detectors are uniform and known with an accuracy of 1 percent. From Fig. 3, we find that the secure key rate improves as D increases, and that for D = 4 it is comparable to that with the a priori assumption of ideal Poissonian. As mentioned in Sec. 1, previous schemes for characterizing the photon number statistics of a light source either require additional assumptions, concern properties not directly relevant to QKD, or produce too loose bounds. Hence the computed key rates (b)–(d) are the first instances with their security guaranteed with no a priori assumptions on the photon number statistics of the light source.

In order to test the robustness of our proposed scheme, we also computed the same key rates when the true distribution of the light source is slightly deviated from Poissonian. The result is given in Appendix H, which shows that the key rates do not change significantly.

4. Discussion and conclusion

We have presented a characterization method for photon-number distribution of a light source and shown the explicit formula for rigorous bounds on probabilities for small photon numbers. We believe that our characterization method makes a significant contribution to the quantum optics toolbox, and is especially useful in quantum information, such as in applications involving security and in computational tasks whose outcome cannot be verified efficiently.

For the measurement of the photon-number distribution of a light source, other methods with more compact setups [38–40] are known, but so far they only give us the most probable values of the probabilities and it is by no means obvious how one may derive rigorous bounds. Homodyne detection [39] and photon-number-resolving detectors [40–42] have an advantage of responding to arrival of two or more photons. On the other hand, these devices tend to require many system parameters to model them, which may make it difficult to produce a rigorous bound. They cannot avoid saturation behavior either, namely, a photon-number-resolving detector can resolve photons only up to a certain photon number, and homodyne tomography usually introduces a threshold manually to avoid artifacts. On these grounds, we believe that the HBT setup has an advantage of being made up of components, each of which is represented by a simple model. Of course, this inevitably raises a question of how closely an actual detector behaves to the on-off detector model. An obvious deviation is the dark counting, which may be treated as an estimation problem of genuine coincidence rates from the actually observed coincidence rates including the contribution of the dark counts. It is also important to verify [43] the validity of the on-off detector model in future experimental researches.